From fee9d68c3e1b59e7f95bc334520d60eca8cc7462 Mon Sep 17 00:00:00 2001
From: nobbele <realnobbele@gmail.com>
Date: Sun, 6 Apr 2025 16:17:05 +0200
Subject: [PATCH 01/50] maintainers: add nobbele

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d2f0b3ccb6f3..0ddd30211db1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17296,6 +17296,12 @@
     github = "noahgitsham";
     githubId = 73707948;
   };
+  nobbele = {
+    name = "nobbele";
+    email = "realnobbele@gmail.com";
+    github = "nobbele";
+    githubId = 17962514;
+  };
   nobbz = {
     name = "Norbert Melzer";
     email = "timmelzer+nixpkgs@gmail.com";

From e8f196e4f04e77670eb3becc485a756f67d1bd30 Mon Sep 17 00:00:00 2001
From: nobbele <realnobbele@gmail.com>
Date: Sun, 6 Apr 2025 16:54:58 +0200
Subject: [PATCH 02/50] mymake: init at 2.3.6

---
 pkgs/by-name/my/mymake/package.nix | 45 ++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 pkgs/by-name/my/mymake/package.nix

diff --git a/pkgs/by-name/my/mymake/package.nix b/pkgs/by-name/my/mymake/package.nix
new file mode 100644
index 000000000000..d30ec4f40f85
--- /dev/null
+++ b/pkgs/by-name/my/mymake/package.nix
@@ -0,0 +1,45 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mymake";
+  version = "2.3.6";
+
+  src = fetchFromGitHub {
+    owner = "fstromback";
+    repo = "mymake";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UQjvxdOvD9O6TrzBFJwh3CistDGZM9HZbcwVPx1n4+A=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    ./compile.sh mm
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 mm $out/bin/mm
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool for compiling and running programs with minimal configuration";
+    homepage = "https://github.com/fstromback/mymake";
+    maintainers = [ lib.maintainers.nobbele ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    mainProgram = "mm";
+  };
+})

From d954e11ca1a3444701fcc11bc9d4a2f98ec849d1 Mon Sep 17 00:00:00 2001
From: ghpzin <ghpzin@gmail.com>
Date: Wed, 17 Sep 2025 21:54:22 +0300
Subject: [PATCH 03/50] cups-filters: fix build with gcc15

- add patch from merged upstream PR:
https://www.github.com/OpenPrinting/cups-filters/pull/618
https://github.com/OpenPrinting/cups-filters/commit/9871a50b5c1f9c2caa2754aac1f5db70c886021b

Fixes build failure with gcc15:
```
filter/foomatic-rip/renderer.c: In function 'exec_kid3':
filter/foomatic-rip/renderer.c:456:32: error: passing argument 2 of
'start_process' from incompatible pointer type [-Wincompatible-pointer-types]
  456 |   kid4 = start_process("kid4", exec_kid4, NULL, &kid4in, NULL);
      |                                ^~~~~~~~~
      |                                |
      |                                int (*)(FILE *, FILE *, void *)
In file included from filter/foomatic-rip/renderer.c:21:
filter/foomatic-rip/process.h:21:45: note: expected 'int (*)(void)' but
argument is of type 'int (*)(FILE *, FILE *, void *)'
   21 | pid_t start_process(const char *name, int (*proc_func)(), void *user_arg,
      |                                       ~~~~~~^~~~~~~~~~~~
filter/foomatic-rip/renderer.c:384:1: note: 'exec_kid4' declared here
  384 | exec_kid4(FILE *in,
      | ^~~~~~~~~
filter/foomatic-rip/process.c:231:1: error: conflicting types for 'start_process';
have 'pid_t(const char *, int (*)(FILE *, FILE *, void *), void *, FILE **, FILE **)'
{aka 'int(const char *, int (*)(FILE *, FILE *, void *), void *, FILE **, FILE **)'}
  231 | start_process(const char *name,
      | ^~~~~~~~~~~~~
In file included from filter/foomatic-rip/process.c:14:
filter/foomatic-rip/process.h:21:7: note: previous declaration of 'start_process'
with type 'pid_t(const char *, int (*)(void), void *, FILE **, FILE **)'
{aka 'int(const char *, int (*)(void), void *, FILE **, FILE **)'}
   21 | pid_t start_process(const char *name, int (*proc_func)(), void *user_arg,
      |       ^~~~~~~~~~~~~
```
---
 pkgs/by-name/cu/cups-filters/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/cu/cups-filters/package.nix b/pkgs/by-name/cu/cups-filters/package.nix
index a5468f00fecc..0abca6114c34 100644
--- a/pkgs/by-name/cu/cups-filters/package.nix
+++ b/pkgs/by-name/cu/cups-filters/package.nix
@@ -6,6 +6,7 @@
   dbus,
   dejavu_fonts,
   fetchFromGitHub,
+  fetchpatch,
   fontconfig,
   gawk,
   ghostscript,
@@ -62,6 +63,16 @@
         hash = "sha256-bLOl64bdeZ10JLcQ7GbU+VffJu3Lzo0ves7O7GQIOWY=";
       };
 
+      patches = [
+        # Fix build with gcc15
+        # https://github.com/OpenPrinting/cups-filters/pull/618
+        (fetchpatch {
+          name = "cups-filters-fix-build-with-gcc15-c23.patch";
+          url = "https://github.com/OpenPrinting/cups-filters/commit/9871a50b5c1f9c2caa2754aac1f5db70c886021b.patch";
+          hash = "sha256-Hu3nCHzX6K4tD7T5XIt0dh6GPQxmgfuHqbBXWfdXxoA=";
+        })
+      ];
+
       strictDeps = true;
 
       nativeBuildInputs = [

From 2f196e9bab8407386ac9e0d8a3d09b07d0083f1e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Oct 2025 12:05:36 +0000
Subject: [PATCH 04/50] xpra: 6.3.3 -> 6.3.4

---
 pkgs/by-name/xp/xpra/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xp/xpra/package.nix b/pkgs/by-name/xp/xpra/package.nix
index 3c4db4ba3d84..e8fa28a857d8 100644
--- a/pkgs/by-name/xp/xpra/package.nix
+++ b/pkgs/by-name/xp/xpra/package.nix
@@ -89,7 +89,7 @@ let
 in
 buildPythonApplication rec {
   pname = "xpra";
-  version = "6.3.3";
+  version = "6.3.4";
   format = "setuptools";
 
   stdenv = if withNvenc then cudaPackages.backendStdenv else args.stdenv;
@@ -98,7 +98,7 @@ buildPythonApplication rec {
     owner = "Xpra-org";
     repo = "xpra";
     tag = "v${version}";
-    hash = "sha256-hk+C6I/QS6ihwmuNlnoNFipJ98SW6LO+Qa3Uh1h1Ji8=";
+    hash = "sha256-Wx8s1e0nhFyNrwHYD2aVutudjNSc8ukTLPqaiYHp8n8=";
   };
 
   patches = [

From 10d44ba76e7f9c7db0910be363c22f01f95cb9ea Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Fri, 24 Oct 2025 00:07:01 -0700
Subject: [PATCH 05/50] mattermost: 10.5.12 -> 10.11.4

---
 pkgs/by-name/ma/mattermost/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index 1b8e7e4ab3a6..e2dc15a2ead6 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -18,11 +18,11 @@
     # the version regex here as well.
     #
     # Ensure you also check ../mattermostLatest/package.nix.
-    regex = "^v(10\\.5\\.[0-9]+)$";
-    version = "10.5.12";
-    srcHash = "sha256-VaW+rA0UeIZhGU9BlYZgyznAOtLN+JI7UPbMRPCwTww=";
-    vendorHash = "sha256-vxUxSkj1EwgMtPpCGJSA9jCDBeLrWhecdwq4KBThhj4=";
-    npmDepsHash = "sha256-tIeuDUZbqgqooDm5TRfViiTT5OIyN0BPwvJdI+wf7p0=";
+    regex = "^v(10\\.11\\.[0-9]+)$";
+    version = "10.11.4";
+    srcHash = "sha256-gSVoO0paAwvxEeZkcCP81oxMcSu/H8n3Tr+2OEXuFyM=";
+    vendorHash = "sha256-DS4OC3eQffD/8yLE01gnTJXwV77G7rWk4kqA/rTCtJw=";
+    npmDepsHash = "sha256-p9dq31qw0EZDQIl2ysKE38JgDyLA6XvSv+VtHuRh+8A=";
     lockfileOverlay = ''
       unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
     '';

From 8370c8f930e11abe7bae3092fb44ba0eef202e92 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 25 Oct 2025 23:23:14 -0700
Subject: [PATCH 06/50] mattermostLatest: 10.12.1 -> 11.0.2

---
 pkgs/by-name/ma/mattermostLatest/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix
index 726da1dfb70c..47305a7125eb 100644
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -10,11 +10,11 @@ mattermost.override {
     # See https://docs.mattermost.com/about/mattermost-server-releases.html
     # and make sure the version regex is up to date here.
     # Ensure you also check ../mattermost/package.nix for ESR releases.
-    regex = "^v(10\\.[0-9]+\\.[0-9]+)$";
-    version = "10.12.1";
-    srcHash = "sha256-PL55NKypsLA+H19cS99iIsMI3IBb6vLvAbAVLZyg+sE=";
-    vendorHash = "sha256-DS4OC3eQffD/8yLE01gnTJXwV77G7rWk4kqA/rTCtJw=";
-    npmDepsHash = "sha256-O9iX6hnwkEHK0kkHqWD6RYXqoSEW6zs+utiYHnt54JY=";
+    regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
+    version = "11.0.2";
+    srcHash = "sha256-2w9v/ktmqSwzcylq8ayRDZD5BsHo9tBL+9X3GRNlvd0=";
+    vendorHash = "sha256-JkQvj92q5FZjQWB5gGCsAz7EpHO+IckBSFoFEFi3v0A=";
+    npmDepsHash = "sha256-YU6FDsMX0QIGFatUDRos/AkgwljIBeI5w/TJt/lglw0=";
     lockfileOverlay = ''
       unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
     '';

From 5172d806152af0779df9e6be7b01f37724f1697c Mon Sep 17 00:00:00 2001
From: Lukas Wurzinger <lukas@wrz.one>
Date: Sun, 26 Oct 2025 12:39:07 +0100
Subject: [PATCH 07/50] nixos/rsync: remove assertion

---
 nixos/modules/services/misc/rsync.nix | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/nixos/modules/services/misc/rsync.nix b/nixos/modules/services/misc/rsync.nix
index 0a262a076621..f0768bf2771c 100644
--- a/nixos/modules/services/misc/rsync.nix
+++ b/nixos/modules/services/misc/rsync.nix
@@ -119,15 +119,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = lib.all (job: job.sources != [ ]) (lib.attrValues cfg.jobs);
-        message = ''
-          At least one source directory must be provided to rsync.
-        '';
-      }
-    ];
-
     systemd = lib.mkMerge (
       lib.mapAttrsToList (
         jobName: job:

From fe8ec962bf4243aef705ee4a10a3b5d2b03be3ff Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Wed, 22 Oct 2025 21:11:36 -0700
Subject: [PATCH 08/50] yubihsm-setup: init at 2.3.3

---
 .../by-name/yu/yubihsm-setup/cargo-lock.patch | 403 ++++++++++++++++++
 pkgs/by-name/yu/yubihsm-setup/package.nix     |  51 +++
 2 files changed, 454 insertions(+)
 create mode 100644 pkgs/by-name/yu/yubihsm-setup/cargo-lock.patch
 create mode 100644 pkgs/by-name/yu/yubihsm-setup/package.nix

diff --git a/pkgs/by-name/yu/yubihsm-setup/cargo-lock.patch b/pkgs/by-name/yu/yubihsm-setup/cargo-lock.patch
new file mode 100644
index 000000000000..c24c7c8888af
--- /dev/null
+++ b/pkgs/by-name/yu/yubihsm-setup/cargo-lock.patch
@@ -0,0 +1,403 @@
+From 5acf0a321cd3393d145e7b158d21f790e1e94a39 Mon Sep 17 00:00:00 2001
+From: Morgan Jones <me@numin.it>
+Date: Wed, 22 Oct 2025 21:01:34 -0700
+Subject: [PATCH] Update Cargo.lock
+
+---
+ Cargo.lock | 240 ++++++++++-------------------------------------------
+ 1 file changed, 44 insertions(+), 196 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index 1fd1883..f555e92 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1,21 +1,12 @@
+ # This file is automatically @generated by Cargo.
+ # It is not intended for manual editing.
+-version = 3
++version = 4
+ 
+ [[package]]
+ name = "aho-corasick"
+-version = "0.6.10"
++version = "1.1.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "81ce3d38065e618af2d7b77e10c5ad9a069859b4be3c2250f674af3840d9c8a5"
+-dependencies = [
+- "memchr",
+-]
+-
+-[[package]]
+-name = "aho-corasick"
+-version = "0.7.18"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
++checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+ dependencies = [
+  "memchr",
+ ]
+@@ -42,9 +33,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "base64"
+-version = "0.13.0"
++version = "0.13.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "904dfeac50f3cdaba28fc6f57fdcddb75f49ed61346676a78c4ffe55877802fd"
++checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+ 
+ [[package]]
+ name = "bitflags"
+@@ -52,12 +43,6 @@ version = "1.3.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+ 
+-[[package]]
+-name = "cfg-if"
+-version = "1.0.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+-
+ [[package]]
+ name = "clap"
+ version = "2.34.0"
+@@ -69,7 +54,7 @@ dependencies = [
+  "bitflags",
+  "strsim",
+  "textwrap",
+- "unicode-width",
++ "unicode-width 0.1.14",
+  "vec_map",
+ ]
+ 
+@@ -81,19 +66,13 @@ checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+ 
+ [[package]]
+ name = "getopts"
+-version = "0.2.21"
++version = "0.2.24"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
++checksum = "cfe4fbac503b8d1f88e6676011885f34b7174f46e59956bba534ba83abded4df"
+ dependencies = [
+- "unicode-width",
++ "unicode-width 0.2.2",
+ ]
+ 
+-[[package]]
+-name = "heck"
+-version = "0.4.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+-
+ [[package]]
+ name = "hermit-abi"
+ version = "0.1.19"
+@@ -105,15 +84,15 @@ dependencies = [
+ 
+ [[package]]
+ name = "lazy_static"
+-version = "1.4.0"
++version = "1.5.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
++checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+ 
+ [[package]]
+ name = "libc"
+-version = "0.2.126"
++version = "0.2.177"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "349d5a591cd28b49e1d1037471617a32ddcda5731b99419008085f72d5a53836"
++checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+ 
+ [[package]]
+ name = "libyubihsm-sys"
+@@ -124,42 +103,21 @@ dependencies = [
+ 
+ [[package]]
+ name = "log"
+-version = "0.3.9"
++version = "0.4.28"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e19e8d5c34a3e0e2223db8e060f9e8264aeeb5c5fc64a4ee9965c062211c024b"
+-dependencies = [
+- "log 0.4.17",
+-]
+-
+-[[package]]
+-name = "log"
+-version = "0.4.17"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+-dependencies = [
+- "cfg-if",
+-]
++checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+ 
+ [[package]]
+ name = "memchr"
+-version = "2.5.0"
++version = "2.7.6"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
++checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+ 
+ [[package]]
+ name = "pkg-config"
+-version = "0.3.25"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1df8c4ec4b0627e53bdf214615ad287367e482558cf84b109250b37464dc03ae"
+-
+-[[package]]
+-name = "proc-macro2"
+-version = "1.0.69"
++version = "0.3.32"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
+-dependencies = [
+- "unicode-ident",
+-]
++checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+ 
+ [[package]]
+ name = "quick-error"
+@@ -167,15 +125,6 @@ version = "1.2.3"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+ 
+-[[package]]
+-name = "quote"
+-version = "1.0.33"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+-dependencies = [
+- "proc-macro2",
+-]
+-
+ [[package]]
+ name = "rand"
+ version = "0.3.23"
+@@ -225,54 +174,38 @@ dependencies = [
+ 
+ [[package]]
+ name = "regex"
+-version = "0.2.11"
++version = "1.12.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "9329abc99e39129fcceabd24cf5d85b4671ef7c29c50e972bc5afe32438ec384"
++checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
+ dependencies = [
+- "aho-corasick 0.6.10",
++ "aho-corasick",
+  "memchr",
+- "regex-syntax 0.5.6",
+- "thread_local",
+- "utf8-ranges",
++ "regex-automata",
++ "regex-syntax",
+ ]
+ 
+ [[package]]
+-name = "regex"
+-version = "1.5.6"
++name = "regex-automata"
++version = "0.4.13"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "d83f127d94bdbcda4c8cc2e50f6f84f4b611f69c902699ca385a39c3a75f9ff1"
++checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+ dependencies = [
+- "aho-corasick 0.7.18",
++ "aho-corasick",
+  "memchr",
+- "regex-syntax 0.6.26",
+-]
+-
+-[[package]]
+-name = "regex-syntax"
+-version = "0.5.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7d707a4fa2637f2dca2ef9fd02225ec7661fe01a53623c1e6515b6916511f7a7"
+-dependencies = [
+- "ucd-util",
++ "regex-syntax",
+ ]
+ 
+ [[package]]
+ name = "regex-syntax"
+-version = "0.6.26"
++version = "0.8.8"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "49b3de9ec5dc0a3417da371aab17d729997c15010e7fd24ff707773a33bddb64"
++checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+ 
+ [[package]]
+ name = "rustc-serialize"
+-version = "0.3.24"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "dcf128d1287d2ea9d80910b5f1120d0b8eede3fbf1abe91c40d39ea7d51e6fda"
+-
+-[[package]]
+-name = "rustversion"
+-version = "1.0.14"
++version = "0.3.25"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
++checksum = "fe834bc780604f4674073badbad26d7219cadfb4a2275802db12cbae17498401"
+ 
+ [[package]]
+ name = "rusty_secrets"
+@@ -294,114 +227,32 @@ dependencies = [
+  "quick-error",
+ ]
+ 
+-[[package]]
+-name = "serde"
+-version = "1.0.190"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "91d3c334ca1ee894a2c6f6ad698fe8c435b76d504b13d436f0685d648d6d96f7"
+-dependencies = [
+- "serde_derive",
+-]
+-
+-[[package]]
+-name = "serde_derive"
+-version = "1.0.190"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "67c5609f394e5c2bd7fc51efda478004ea80ef42fee983d5c67a65e34f32c0e3"
+-dependencies = [
+- "proc-macro2",
+- "quote",
+- "syn 2.0.38",
+-]
+-
+ [[package]]
+ name = "strsim"
+ version = "0.8.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+ 
+-[[package]]
+-name = "strum"
+-version = "0.24.1"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "063e6045c0e62079840579a7e47a355ae92f60eb74daaf156fb1e84ba164e63f"
+-
+-[[package]]
+-name = "strum_macros"
+-version = "0.24.3"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "1e385be0d24f186b4ce2f9982191e7101bb737312ad61c1f2f984f34bcf85d59"
+-dependencies = [
+- "heck",
+- "proc-macro2",
+- "quote",
+- "rustversion",
+- "syn 1.0.109",
+-]
+-
+-[[package]]
+-name = "syn"
+-version = "1.0.109"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+-dependencies = [
+- "proc-macro2",
+- "quote",
+- "unicode-ident",
+-]
+-
+-[[package]]
+-name = "syn"
+-version = "2.0.38"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
+-dependencies = [
+- "proc-macro2",
+- "quote",
+- "unicode-ident",
+-]
+-
+ [[package]]
+ name = "textwrap"
+ version = "0.11.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+ dependencies = [
+- "unicode-width",
++ "unicode-width 0.1.14",
+ ]
+ 
+-[[package]]
+-name = "thread_local"
+-version = "0.3.6"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c6b53e329000edc2b34dbe8545fd20e55a333362d0a321909685a19bd28c3f1b"
+-dependencies = [
+- "lazy_static",
+-]
+-
+-[[package]]
+-name = "ucd-util"
+-version = "0.1.8"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c85f514e095d348c279b1e5cd76795082cf15bd59b93207832abe0b1d8fed236"
+-
+-[[package]]
+-name = "unicode-ident"
+-version = "1.0.12"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+-
+ [[package]]
+ name = "unicode-width"
+-version = "0.1.9"
++version = "0.1.14"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
++checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+ 
+ [[package]]
+-name = "utf8-ranges"
+-version = "1.0.5"
++name = "unicode-width"
++version = "0.2.2"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7fcfc827f90e53a02eaef5e535ee14266c1d569214c6aa70133a624d8a3164ba"
++checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+ 
+ [[package]]
+ name = "vec_map"
+@@ -433,12 +284,12 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+ 
+ [[package]]
+ name = "yubihsm-setup"
+-version = "2.3.1"
++version = "2.3.3"
+ dependencies = [
+  "base64",
+  "clap",
+  "lazy_static",
+- "regex 1.5.6",
++ "regex",
+  "rusty_secrets",
+  "scan_dir",
+  "yubihsmrs",
+@@ -446,14 +297,11 @@ dependencies = [
+ 
+ [[package]]
+ name = "yubihsmrs"
+-version = "2.1.3"
++version = "2.1.4"
+ dependencies = [
+  "lazy_static",
+  "libyubihsm-sys",
+- "log 0.3.9",
+- "regex 0.2.11",
++ "log",
++ "regex",
+  "rustc-serialize",
+- "serde",
+- "strum",
+- "strum_macros",
+ ]
diff --git a/pkgs/by-name/yu/yubihsm-setup/package.nix b/pkgs/by-name/yu/yubihsm-setup/package.nix
new file mode 100644
index 000000000000..50fedb2c0213
--- /dev/null
+++ b/pkgs/by-name/yu/yubihsm-setup/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch,
+  pkg-config,
+  yubihsm-shell,
+}:
+
+rustPlatform.buildRustPackage (finalPackage: {
+  pname = "yubihsm-setup";
+  version = "2.3.3";
+
+  src = fetchFromGitHub {
+    owner = "Yubico";
+    repo = "yubihsm-setup";
+    tag = finalPackage.version;
+    hash = "sha256-ScpcEDNWLhywtcPPG84vZyIAQ5lF07udmGsmsyc3+iU=";
+  };
+
+  yubihsmrs = fetchFromGitHub {
+    owner = "Yubico";
+    repo = "yubihsmrs";
+    tag = "2.1.4";
+    hash = "sha256-MQwp2dkAkPNyclDgRhHWRHZ9y4LC+bGIeLBv8CgMGXY=";
+  };
+
+  prePatch = ''
+    ln -s $yubihsmrs yubihsmrs
+    substituteInPlace Cargo.toml --replace-fail ../yubihsmrs/ ./yubihsmrs/
+  '';
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ yubihsm-shell ];
+
+  # https://github.com/Yubico/yubihsm-setup/pull/20
+  cargoPatches = [ ./cargo-lock.patch ];
+
+  cargoHash = "sha256-Mk0uGNb0WGygSqocpo566sVHs13zvoFBbAevJj4OSBM=";
+
+  meta = {
+    description = "Tool to easily set up a YubiHSM device";
+    homepage = "https://github.com/Yubico/yubihsm-setup";
+    maintainers = with lib.maintainers; [
+      numinit
+    ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+  };
+})

From b81e3028eb4fa6def2387134d9ed213c79736902 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Oct 2025 03:53:41 +0000
Subject: [PATCH 09/50] s7: 11.7-unstable-2025-10-20 ->
 11.7-unstable-2025-10-26

---
 pkgs/by-name/s7/s7/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/s7/s7/package.nix b/pkgs/by-name/s7/s7/package.nix
index 6d8aa7a2c2f9..f4f741529e75 100644
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.7-unstable-2025-10-20";
+  version = "11.7-unstable-2025-10-26";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "479045bf9445789c6a0a0252dd6fc092f2b0b507";
-    hash = "sha256-F7IPAjIlfZcuj9Of0wDYQWPTAWWZO9z6/FbjHwZlJAo=";
+    rev = "6fc94288ed46533527b1ddb24c3b162a9d0f7ab7";
+    hash = "sha256-kJhvgZ/GTSSplmY6bzHxHhtgukssepBsSWD7kwXwnps=";
   };
 
   buildInputs =

From f04a4e0951bf65c267bb7acda28d238fa1ee70f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 27 Oct 2025 10:47:53 -0700
Subject: [PATCH 10/50] python3Packages.aiosomecomfort: 0.0.34 -> 0.0.35

Diff: https://github.com/mkmer/AIOSomecomfort/compare/0.0.34...0.0.35

Changelog: https://github.com/mkmer/AIOSomecomfort/releases/tag/0.0.35
---
 pkgs/development/python-modules/aiosomecomfort/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiosomecomfort/default.nix b/pkgs/development/python-modules/aiosomecomfort/default.nix
index 43256333cdcb..98ada059e360 100644
--- a/pkgs/development/python-modules/aiosomecomfort/default.nix
+++ b/pkgs/development/python-modules/aiosomecomfort/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "aiosomecomfort";
-  version = "0.0.34";
+  version = "0.0.35";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mkmer";
     repo = "AIOSomecomfort";
     tag = version;
-    hash = "sha256-aHqroDhMYlBF20JNSMZDkfYvio15XTrG+9NANSTC1Fw=";
+    hash = "sha256-zhCpV11nzRpWiCPNgeBfBzXgLM2NAw1p9R0ACD3u/mk=";
   };
 
   build-system = [

From b6c855e7a3194460258608b167785dc25f006647 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 27 Oct 2025 14:32:32 -0700
Subject: [PATCH 11/50] python3Packages.construct-typing: 0.6.2 -> 0.7.0

Diff: https://github.com/timrid/construct-typing/compare/v0.6.2...v0.7.0

Changelog: https://github.com/timrid/construct-typing/releases/tag/v0.7.0
---
 .../python-modules/construct-typing/default.nix | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/construct-typing/default.nix b/pkgs/development/python-modules/construct-typing/default.nix
index d56525e538fa..071d73658370 100644
--- a/pkgs/development/python-modules/construct-typing/default.nix
+++ b/pkgs/development/python-modules/construct-typing/default.nix
@@ -8,6 +8,7 @@
   typing-extensions,
   arrow,
   cloudpickle,
+  cryptography,
   numpy,
   pytestCheckHook,
   ruamel-yaml,
@@ -15,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "construct-typing";
-  version = "0.6.2";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "timrid";
     repo = "construct-typing";
     tag = "v${version}";
-    hash = "sha256-zXpxu+VUcepEoAPLQnSlMCZkt8fDsMCLS0HBKhaYD20=";
+    hash = "sha256-iiMnt/f1ppciL6AVq3q0wOtoARcNYJycQA5Ev+dIow8=";
   };
 
   build-system = [ setuptools ];
@@ -42,22 +43,12 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     arrow
     cloudpickle
+    cryptography
     numpy
     pytestCheckHook
     ruamel-yaml
   ];
 
-  disabledTests = [
-    # tests fail with construct>=2.10.70
-    "test_bitsinteger"
-    "test_bytesinteger"
-  ]
-  ++ lib.optionals (pythonAtLeast "3.13") [
-    # https://github.com/timrid/construct-typing/issues/31
-    "test_tenum_docstring"
-    "test_tenum_flags_docstring"
-  ];
-
   meta = {
     changelog = "https://github.com/timrid/construct-typing/releases/tag/v${version}";
     description = "Extension for the python package 'construct' that adds typing features";

From 8d614300ab97ecdb0deef916ebd26cf1f9b70933 Mon Sep 17 00:00:00 2001
From: Michi <abramjannikmichael06@gmail.com>
Date: Mon, 27 Oct 2025 01:19:46 +0100
Subject: [PATCH 12/50] superTuxKart: update license from gpl2Plus to gpl3Plus

The source code is licensed under GPLv3 or later.
This was changed upstream at Nov 23, 2018 [here](https://github.com/supertuxkart/stk-code/commit/06952bfd524ce368e12e62aadcc8546b0786051c),
but wasn't updated here in nixpkgs, until now.

The game assets are released under a mixture of licenses and noted in their respective 'licenses.txt' files.
---
 pkgs/by-name/su/superTuxKart/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/su/superTuxKart/package.nix b/pkgs/by-name/su/superTuxKart/package.nix
index 5b4cf6f8f577..2cb36b616e19 100644
--- a/pkgs/by-name/su/superTuxKart/package.nix
+++ b/pkgs/by-name/su/superTuxKart/package.nix
@@ -170,7 +170,7 @@ stdenv.mkDerivation rec {
       Kart.
     '';
     homepage = "https://supertuxkart.net/";
-    license = lib.licenses.gpl2Plus;
+    license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       peterhoeg
     ];

From a79325ca71a2b22f4219a3a5e4ad97a4b9bec9d6 Mon Sep 17 00:00:00 2001
From: SchweGELBin <abramjannikmichael06@gmail.com>
Date: Sun, 26 Oct 2025 15:07:55 +0100
Subject: [PATCH 13/50] superTuxKart: rename src.rev to src.tag

---
 pkgs/by-name/su/superTuxKart/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/su/superTuxKart/package.nix b/pkgs/by-name/su/superTuxKart/package.nix
index 2cb36b616e19..d684976f3afc 100644
--- a/pkgs/by-name/su/superTuxKart/package.nix
+++ b/pkgs/by-name/su/superTuxKart/package.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "supertuxkart";
     repo = "stk-code";
-    rev = version;
+    tag = version;
     hash = "sha256-gqdaVvgNfCN40ZO/9y8+vTeIJPSq6udKxYZ/MAi4ZMM=";
   };
 

From 777bba68472d030e134f940667edc64fef66e8b7 Mon Sep 17 00:00:00 2001
From: SchweGELBin <abramjannikmichael06@gmail.com>
Date: Sun, 26 Oct 2025 14:25:09 +0100
Subject: [PATCH 14/50] superTuxKart: 1.4 -> 1.5

stk-assets: 18464 -> 18621
---
 pkgs/by-name/su/superTuxKart/package.nix | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/pkgs/by-name/su/superTuxKart/package.nix b/pkgs/by-name/su/superTuxKart/package.nix
index d684976f3afc..bbeb70dcd8df 100644
--- a/pkgs/by-name/su/superTuxKart/package.nix
+++ b/pkgs/by-name/su/superTuxKart/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   fetchsvn,
-  fetchpatch,
   cmake,
   pkg-config,
   makeWrapper,
@@ -29,8 +28,8 @@
 let
   assets = fetchsvn {
     url = "https://svn.code.sf.net/p/supertuxkart/code/stk-assets";
-    rev = "18464";
-    sha256 = "1a84j3psl4cxzkn5ynakpjill7i2f9ki2p729bpmbrvg8fki95aa";
+    rev = "18621";
+    sha256 = "sha256-iqQSezGu0tecA53qhrtYA77SLj28WUUCcL4ZCJbK5C8=";
     name = "stk-assets";
   };
 
@@ -68,29 +67,15 @@ in
 stdenv.mkDerivation rec {
 
   pname = "supertuxkart";
-  version = "1.4";
+  version = "1.5";
 
   src = fetchFromGitHub {
     owner = "supertuxkart";
     repo = "stk-code";
     tag = version;
-    hash = "sha256-gqdaVvgNfCN40ZO/9y8+vTeIJPSq6udKxYZ/MAi4ZMM=";
+    hash = "sha256-/fp5iqTHVrVcxRqbTy/3r+dp19oUj9MI2JauvtPWTWA=";
   };
 
-  patches = [
-    # upstreamed patches required to build against cmake 4.0; remove with next release update.
-    (fetchpatch {
-      name = "Require-Cmake-3.6-or-higher";
-      url = "https://github.com/supertuxkart/stk-code/commit/7d4e8433c124c08c62f5335e2a884aeea71cf184.patch?full_index=1";
-      hash = "sha256-5q/Gf1I/maFPQ83NDIa7Sn6gtLfErwxP16fup4SZ+gc=";
-    })
-    (fetchpatch {
-      name = "Fixed-cmake-4.0-warnings";
-      url = "https://github.com/supertuxkart/stk-code/commit/184c80138faf5232c33ff99ffe7706e821be70c2.patch?full_index=1";
-      hash = "sha256-5zoDmKBRBC2rAUjgpmyc0ZCObGofjuImqk07Tr5K7Og=";
-    })
-  ];
-
   postPatch = ''
     # Deletes all bundled libs in stk-code/lib except those
     # That couldn't be replaced with system packages

From e18f03258aa9754c9bc96665231530c3d5da2d72 Mon Sep 17 00:00:00 2001
From: SchweGELBin <abramjannikmichael06@gmail.com>
Date: Sun, 26 Oct 2025 14:50:38 +0100
Subject: [PATCH 15/50] superTuxKart: update descriptions

The decription was copied from the official website's discover page ([here](https://supertuxkart.net/Discover)) and got modified.
It got added by @Benau [here](https://github.com/supertuxkart/stk-website/commit/2c46fee5aad8412a0187d4e2e0580a5403fbdbf6)
---
 pkgs/by-name/su/superTuxKart/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/su/superTuxKart/package.nix b/pkgs/by-name/su/superTuxKart/package.nix
index bbeb70dcd8df..1c6c0462fe59 100644
--- a/pkgs/by-name/su/superTuxKart/package.nix
+++ b/pkgs/by-name/su/superTuxKart/package.nix
@@ -147,12 +147,12 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    description = "Free 3D kart racing game";
+    description = "3D open-source arcade racer";
     mainProgram = "supertuxkart";
     longDescription = ''
-      SuperTuxKart is a Free 3D kart racing game, with many tracks,
-      characters and items for you to try, similar in spirit to Mario
-      Kart.
+      Karts. Nitro. Action! SuperTuxKart is a 3D open-source arcade racer
+      with a variety of characters, tracks, and modes to play.
+      It aims to be more fun than realistic, and provides an enjoyable experience for all ages.
     '';
     homepage = "https://supertuxkart.net/";
     license = lib.licenses.gpl3Plus;

From 4a9e4fafab9488da85992200a4d1d82768856871 Mon Sep 17 00:00:00 2001
From: SchweGELBin <abramjannikmichael06@gmail.com>
Date: Sun, 26 Oct 2025 14:51:04 +0100
Subject: [PATCH 16/50] superTuxKart: add SchweGELBin to maintainers

---
 pkgs/by-name/su/superTuxKart/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/su/superTuxKart/package.nix b/pkgs/by-name/su/superTuxKart/package.nix
index 1c6c0462fe59..35a74463adff 100644
--- a/pkgs/by-name/su/superTuxKart/package.nix
+++ b/pkgs/by-name/su/superTuxKart/package.nix
@@ -158,6 +158,7 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       peterhoeg
+      SchweGELBin
     ];
     platforms = with lib.platforms; unix;
     changelog = "https://github.com/supertuxkart/stk-code/blob/${version}/CHANGELOG.md";

From 3e1cc243dbd276d98625e9a4fdf4c4da5af07f5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 27 Oct 2025 14:19:31 -0700
Subject: [PATCH 17/50] python3Packages.ntfy-webpush: init at 0.1.3

---
 pkgs/by-name/nt/ntfy/package.nix                          | 2 --
 .../python-modules/ntfy-webpush/default.nix}              | 8 ++++----
 pkgs/top-level/python-packages.nix                        | 2 ++
 3 files changed, 6 insertions(+), 6 deletions(-)
 rename pkgs/{by-name/nt/ntfy/webpush.nix => development/python-modules/ntfy-webpush/default.nix} (82%)

diff --git a/pkgs/by-name/nt/ntfy/package.nix b/pkgs/by-name/nt/ntfy/package.nix
index 5d2d50e9ae06..4e2d069ea8ff 100644
--- a/pkgs/by-name/nt/ntfy/package.nix
+++ b/pkgs/by-name/nt/ntfy/package.nix
@@ -16,8 +16,6 @@ let
   python = python3.override {
     self = python;
     packageOverrides = self: super: {
-      ntfy-webpush = self.callPackage ./webpush.nix { };
-
       # databases, on which slack-sdk depends, is incompatible with SQLAlchemy 2.0
       sqlalchemy = super.sqlalchemy_1_4;
     };
diff --git a/pkgs/by-name/nt/ntfy/webpush.nix b/pkgs/development/python-modules/ntfy-webpush/default.nix
similarity index 82%
rename from pkgs/by-name/nt/ntfy/webpush.nix
rename to pkgs/development/python-modules/ntfy-webpush/default.nix
index 9c7adcad3981..0aed4f2c10b8 100644
--- a/pkgs/by-name/nt/ntfy/webpush.nix
+++ b/pkgs/development/python-modules/ntfy-webpush/default.nix
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "dschep";
     repo = "ntfy-webpush";
-    rev = "v${version}";
-    sha256 = "1dxlvq3glf8yjkn1hdk89rx1s4fi9ygg46yn866a9v7a5a83zx2n";
+    tag = "v${version}";
+    hash = "sha256-VvQ/kCrq7KSMQdYb8p5P0REdek5oNhjslB45+gbetLc=";
   };
 
   postPatch = ''
@@ -35,10 +35,10 @@ buildPythonPackage rec {
   # no tests, just a script
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "Cloudbell webpush notification support for ntfy";
     homepage = "https://dschep.github.io/ntfy-webpush/";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a65855a2a2aa..afe90b42eb29 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10700,6 +10700,8 @@ self: super: with self; {
 
   ntc-templates = callPackage ../development/python-modules/ntc-templates { };
 
+  ntfy-webpush = callPackage ../development/python-modules/ntfy-webpush { };
+
   ntplib = callPackage ../development/python-modules/ntplib { };
 
   nuclear = callPackage ../development/python-modules/nuclear { };

From 17e2966646c53f91d74490328950cd70d723a5da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 27 Oct 2025 14:22:11 -0700
Subject: [PATCH 18/50] ntfy: don't override python3

---
 pkgs/by-name/nt/ntfy/package.nix | 19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/nt/ntfy/package.nix b/pkgs/by-name/nt/ntfy/package.nix
index 4e2d069ea8ff..6cefdf6cc280 100644
--- a/pkgs/by-name/nt/ntfy/package.nix
+++ b/pkgs/by-name/nt/ntfy/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  python3,
+  python3Packages,
   fetchFromGitHub,
   fetchpatch,
   withXmpp ? false, # sleekxmpp doesn't support python 3.10, see https://github.com/dschep/ntfy/issues/266
@@ -12,16 +12,7 @@
   withDbus ? stdenv.hostPlatform.isLinux,
 }:
 
-let
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      # databases, on which slack-sdk depends, is incompatible with SQLAlchemy 2.0
-      sqlalchemy = super.sqlalchemy_1_4;
-    };
-  };
-in
-python.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "ntfy";
   version = "2.7.0";
 
@@ -74,10 +65,10 @@ python.pkgs.buildPythonApplication rec {
       --replace-fail "':sys_platform == \"darwin\"'" "'darwin'"
   '';
 
-  build-system = with python.pkgs; [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
   dependencies =
-    with python.pkgs;
+    with python3Packages;
     (
       [
         requests
@@ -106,7 +97,7 @@ python.pkgs.buildPythonApplication rec {
       ]
     );
 
-  nativeCheckInputs = with python.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     mock
     pytestCheckHook
   ];

From 6942d8e4ef1ae6a3c23c3186bcf8ffe96fe46796 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 27 Oct 2025 15:12:20 -0700
Subject: [PATCH 19/50] ntfy: 2.7.0 -> 2.7.1

Diff: https://github.com/dschep/ntfy/compare/v2.7.0...v2.7.1

Changelog: https://github.com/dschep/ntfy/releases/tag/v2.7.1
---
 pkgs/by-name/nt/ntfy/package.nix | 60 ++++++++------------------------
 1 file changed, 14 insertions(+), 46 deletions(-)

diff --git a/pkgs/by-name/nt/ntfy/package.nix b/pkgs/by-name/nt/ntfy/package.nix
index 6cefdf6cc280..d21624f41393 100644
--- a/pkgs/by-name/nt/ntfy/package.nix
+++ b/pkgs/by-name/nt/ntfy/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   python3Packages,
   fetchFromGitHub,
-  fetchpatch,
+  writableTmpDirAsHomeHook,
   withXmpp ? false, # sleekxmpp doesn't support python 3.10, see https://github.com/dschep/ntfy/issues/266
   withMatrix ? true,
   withSlack ? true,
@@ -14,51 +14,17 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ntfy";
-  version = "2.7.0";
+  version = "2.7.1";
 
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dschep";
     repo = "ntfy";
-    rev = "v${version}";
-    sha256 = "09f02cn4i1l2aksb3azwfb70axqhn7d0d0vl2r6640hqr74nc1cv";
+    tag = "v${version}";
+    hash = "sha256-EIhoZ2tFJQOc5PyRCazwRhldFxQb65y6h+vYPwV7ReE=";
   };
 
-  patches = [
-    # Fix Slack integration no longer working.
-    # From https://github.com/dschep/ntfy/pull/229 - "Swap Slacker for Slack SDK"
-    (fetchpatch {
-      name = "ntfy-Swap-Slacker-for-Slack-SDK.patch";
-      url = "https://github.com/dschep/ntfy/commit/2346e7cfdca84c8f1afc7462a92145c1789deb3e.patch";
-      sha256 = "13k7jbsdx0jx7l5s8whirric76hml5bznkfcxab5xdp88q52kpk7";
-    })
-    # Add compatibility with emoji 2.0
-    # https://github.com/dschep/ntfy/pull/250
-    (fetchpatch {
-      name = "ntfy-Add-compatibility-with-emoji-2.0.patch";
-      url = "https://github.com/dschep/ntfy/commit/4128942bb7a706117e7154a50a73b88f531631fe.patch";
-      sha256 = "sha256-V8dIy/K957CPFQQS1trSI3gZOjOcVNQLgdWY7g17bRw=";
-    })
-    # Change getargspec to getfullargspec for python 3.11 compatibility
-    (fetchpatch {
-      url = "https://github.com/dschep/ntfy/commit/71be9766ea041d2df6ebbce2781f980eea002852.patch";
-      hash = "sha256-6OChaTj4g3gxVDScc/JksBISHuq+5fbNQregchSXYaQ=";
-    })
-    # Fix compatibility with Python 3.11
-    # https://github.com/dschep/ntfy/pull/271
-    (fetchpatch {
-      url = "https://github.com/dschep/ntfy/pull/271/commits/444b60bec7de474d029cac184e82885011dd1474.patch";
-      hash = "sha256-PKTu8cOpws1z6f1T4uIi2iCJAoAwu+X0Pe7XnHYtHuI=";
-    })
-    # Fix compatibility with Python 3.12
-    # https://github.com/dschep/ntfy/pull/271
-    (fetchpatch {
-      url = "https://github.com/dschep/ntfy/pull/271/commits/d49ab9f9dba4966a44b5f0c6911741edabd35f6b.patch";
-      hash = "sha256-qTUWMS8EXWYCK/ZL0Us7iJp62UIKwYT1BqDy59832ig=";
-    })
-  ];
-
   postPatch = ''
     # We disable the Darwin specific things because it relies on pyobjc, which we don't have.
     substituteInPlace setup.py \
@@ -100,27 +66,29 @@ python3Packages.buildPythonApplication rec {
   nativeCheckInputs = with python3Packages; [
     mock
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
   disabledTests = [
+    # AssertionError: {'backends': ['default']} != {}
+    "test_default_config"
+  ]
+  ++ lib.optionals (!withXmpp) [
     "test_xmpp"
   ];
 
-  disabledTestPaths = [
+  disabledTestPaths = lib.optionals (!withXmpp) [
     "tests/test_xmpp.py"
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
   pythonImportsCheck = [ "ntfy" ];
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/dschep/ntfy/releases/tag/${src.tag}";
     description = "Utility for sending notifications, on demand and when commands finish";
     homepage = "https://ntfy.readthedocs.io/en/latest/";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ kamilchm ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ kamilchm ];
     mainProgram = "ntfy";
   };
 }

From a34c42b91be2ef4c3da75f4b6d4108b6bc285326 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Oct 2025 02:37:46 +0000
Subject: [PATCH 20/50] sqlpage: 0.38.0 -> 0.39.0

---
 pkgs/by-name/sq/sqlpage/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sq/sqlpage/package.nix b/pkgs/by-name/sq/sqlpage/package.nix
index cb20579d8b93..bef63a5b00e4 100644
--- a/pkgs/by-name/sq/sqlpage/package.nix
+++ b/pkgs/by-name/sq/sqlpage/package.nix
@@ -42,13 +42,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sqlpage";
-  version = "0.38.0";
+  version = "0.39.0";
 
   src = fetchFromGitHub {
     owner = "lovasoa";
     repo = "SQLpage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sIbEyW1/EuZuspU9pBOe6y9Ktwvz9ZNEsQ4CU/yU278=";
+    hash = "sha256-M9WtpDc067G/EfRTJBoDxBrdXRMqOwVTdGgyXSdHlhE=";
   };
 
   postPatch = ''
@@ -73,7 +73,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       "$(cat ${tomselect})"
   '';
 
-  cargoHash = "sha256-uWdEzuEKxN50OM40i/BedgfoWf3oijks8tM5bs7qUao=";
+  cargoHash = "sha256-lUQ1j2f/LXpqpb6VK4Bq2NI0L9KoyEdlPkENMOKkt0w=";
 
   nativeBuildInputs = [ pkg-config ];
 

From ac4467452261439919a0a9fb111fb06d4732e553 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Fri, 24 Oct 2025 00:07:27 -0700
Subject: [PATCH 21/50] mattermost: only run mmctl tests

The full Mattermost test suite is a bit of a treadmill to keep on top
of, and I've definitely seen some recent ones that were generated with
Claude. Hydra is not the Claude Code regression test runner.

We can mostly get away with running the mmctl test suite instead.
---
 pkgs/by-name/ma/mattermost/tests.nix | 115 ++-------------------------
 1 file changed, 6 insertions(+), 109 deletions(-)

diff --git a/pkgs/by-name/ma/mattermost/tests.nix b/pkgs/by-name/ma/mattermost/tests.nix
index 85d3003fa8c8..53ccc82ab558 100644
--- a/pkgs/by-name/ma/mattermost/tests.nix
+++ b/pkgs/by-name/ma/mattermost/tests.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   mattermost,
   gotestsum,
   which,
@@ -12,16 +11,10 @@
   runtimeShell,
 }:
 
-let
-  inherit (lib.lists) optionals;
-  inherit (lib.strings) versionAtLeast;
-  is10 = version: versionAtLeast version "10.0";
-in
 mattermost.overrideAttrs (
   final: prev: {
     doCheck = true;
     checkTargets = [
-      "test-server"
       "test-mmctl"
     ];
     nativeCheckInputs = [
@@ -52,113 +45,17 @@ mattermost.overrideAttrs (
     # X  TestFoo
     # X  TestFoo/TestBar
     # -> TestFoo/TestBar/baz_test
-    disabledTests = [
+    disabledTests = lib.lists.uniqueStrings [
       # All these plugin tests for mmctl reach out to the marketplace, which is impossible in the sandbox
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Plugin/SystemAdminClient"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Plugin/LocalClient"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_a_Plugin_without_permissions"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Unknown_Plugin/SystemAdminClient"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Unknown_Plugin/LocalClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_new_plugins/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_new_plugins/LocalClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_without_force/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_without_force/LocalClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_with_force/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_with_force/LocalClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd/install_a_plugin/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd/install_a_plugin/LocalClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceListCmd/List_Marketplace_Plugins_for_Admin_User/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceListCmd/List_Marketplace_Plugins_for_Admin_User/LocalClient"
-
-      # Seems to just be broken.
-      "TestMmctlE2ESuite/TestPreferenceUpdateCmd"
-
-      # Has a hardcoded "google.com" test which also verifies that the address isn't loopback,
-      # so we also can't just substituteInPlace to one that will resolve
-      "TestDialContextFilter"
-
-      # No interfaces but loopback in the sandbox, so returns empty
-      "TestGetServerIPAddress"
-
-      # S3 bucket tests (needs Minio)
-      "TestInsecureMakeBucket"
-      "TestMakeBucket"
-      "TestListDirectory"
-      "TestTimeout"
-      "TestStartServerNoS3Bucket"
-      "TestS3TestConnection"
-      "TestS3FileBackendTestSuite"
-      "TestS3FileBackendTestSuiteWithEncryption"
-      "TestWriteFileVideoMimeTypes"
-
-      # Mail tests (needs a SMTP server)
-      "TestSendMailUsingConfig"
-      "TestSendMailUsingConfigAdvanced"
-      "TestSendMailWithEmbeddedFilesUsingConfig"
-      "TestSendCloudWelcomeEmail"
-      "TestMailConnectionAdvanced"
-      "TestMailConnectionFromConfig"
-      "TestEmailTest"
-      "TestBasicAPIPlugins/test_send_mail_plugin"
-
-      # Seems to be unreliable
-      "TestPluginAPIUpdateUserPreferences"
-      "TestPluginAPIGetUserPreferences"
-
-      # These invite tests try to send a welcome email and we don't have a SMTP server up.
-      "TestInviteUsersToTeam"
-      "TestInviteGuestsToTeam"
-      "TestSendInviteEmails"
-      "TestDeliver"
-
-      # https://github.com/mattermost/mattermost/issues/29184
-      "TestUpAndDownMigrations/Should_be_reversible_for_mysql"
-    ]
-    ++ optionals (is10 final.version) [
-      ## mattermostLatest test ignores
-
-      # These bot related tests appear to be broken.
-      "TestCreateBot"
-      "TestPatchBot"
-      "TestGetBot"
-      "TestEnableBot"
-      "TestDisableBot"
-      "TestAssignBot"
-      "TestConvertBotToUser"
-
-      # Need Elasticsearch or Opensearch
-      "TestBlevePurgeIndexes"
-      "TestOpensearchAggregation"
-      "TestOpensearchInterfaceTestSuite"
-      "TestOpenSearchIndexerJobIsEnabled"
-      "TestOpenSearchIndexerPending"
-      "TestBulkProcessor"
-      "TestElasticsearchAggregation"
-      "TestElasticsearchInterfaceTestSuite"
-      "TestElasticSearchIndexerJobIsEnabled"
-      "TestElasticSearchIndexerPending"
-
-      # Broken in the sandbox.
-      "TestVersion"
-      "TestRunServerNoSystemd"
-
-      # Appear to be broken.
-      "TestSessionStore/MySQL"
-      "TestAccessControlPolicyStore/MySQL"
-      "TestAttributesStore/MySQL"
-      "TestBasicAPIPlugins"
-
-      "TestRunExportJobE2EByType"
-      "TestUpdateTeam"
-      "TestSyncSyncableRoles"
-    ]
-    ++ optionals (!stdenv.hostPlatform.isx86_64) [
-      # aarch64: invalid operating system or processor architecture
-      "TestCanIUpgradeToE0"
-
-      # aarch64: thumbnail previews are nondeterministic
-      "TestUploadFiles/multipart_Happy_image_thumbnail"
-      "TestUploadFiles/simple_Happy_image_thumbnail"
+      "TestMmctlE2ESuite/TestPluginInstallURLCmd"
+      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd"
+      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd"
+      "TestMmctlE2ESuite/TestPluginMarketplaceListCmd"
     ];
 
     preCheck = ''
@@ -378,7 +275,7 @@ mattermost.overrideAttrs (
 
       # Ensure we parallelize the tests, and skip the correct ones.
       # Spaces are important here due to how the Makefile works.
-      export GOFLAGS=" -parallel=$NIX_BUILD_CORES -skip='$(echo "$disabledTests" | tr ' ' '|')' "
+      export GOFLAGS=" -p=$NIX_BUILD_CORES -parallel=$NIX_BUILD_CORES -skip='$(echo "$disabledTests" | tr ' ' '|')' "
 
       # ce n'est pas un conteneur
       MMCTL_TESTFLAGS="$GOFLAGS" MM_NO_DOCKER=true make $checkTargets

From 42f8f463bf9e7c36df6a9f9697101043b66a7af0 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 25 Oct 2025 23:21:32 -0700
Subject: [PATCH 22/50] nixos/mattermost: require Postgres for version 11+

---
 nixos/modules/services/web-apps/mattermost.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index 39d380b4ed79..412a36c29c90 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -966,6 +966,13 @@ in
             or hostname, and services.mattermost.port to specify the port separately.
           '';
         }
+        {
+          # Can't use MySQL on version 11.
+          assertion = versionAtLeast cfg.package.version "11" -> cfg.database.driver == "postgres";
+          message = ''
+            Only Postgres is supported as the database driver in Mattermost 11 and later.
+          '';
+        }
       ];
     })
     (mkIf cfg.matterircd.enable {

From 301c477b66da4a9c7f18f8be1cd92e44e43d3884 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 25 Oct 2025 23:21:57 -0700
Subject: [PATCH 23/50] tests/mattermost: don't test MySQL

MySQL was dropped from Mattermost in version 11.
---
 nixos/tests/mattermost/default.nix | 53 +-----------------------------
 1 file changed, 1 insertion(+), 52 deletions(-)

diff --git a/nixos/tests/mattermost/default.nix b/nixos/tests/mattermost/default.nix
index 2783390b9082..bc795c2f5940 100644
--- a/nixos/tests/mattermost/default.nix
+++ b/nixos/tests/mattermost/default.nix
@@ -69,27 +69,11 @@ import ../make-test-python.nix (
         )
         extraConfig
       ];
-
-    makeMysql =
-      mattermostConfig: extraConfig:
-      lib.mkMerge [
-        mattermostConfig
-        (
-          { pkgs, config, ... }:
-          {
-            services.mattermost.database = {
-              driver = lib.mkForce "mysql";
-              peerAuth = lib.mkForce true;
-            };
-          }
-        )
-        extraConfig
-      ];
   in
   {
     name = "mattermost";
 
-    nodes = rec {
+    nodes = {
       postgresMutable = makeMattermost {
         mutableConfig = true;
         preferNixConfig = false;
@@ -174,25 +158,6 @@ import ../make-test-python.nix (
           MM_SUPPORTSETTINGS_ABOUTLINK=https://nixos.org
         '';
       } { };
-
-      mysqlMutable = makeMysql postgresMutable { };
-      mysqlMostlyMutable = makeMysql postgresMostlyMutable { };
-      mysqlImmutable = makeMysql postgresImmutable {
-        # Let's try to use this on MySQL.
-        services.mattermost.database = {
-          peerAuth = lib.mkForce true;
-          user = lib.mkForce "mmuser";
-          name = lib.mkForce "mmuser";
-        };
-      };
-      mysqlEnvironmentFile = makeMysql postgresEnvironmentFile {
-        services.mattermost.environmentFile = lib.mkForce (
-          pkgs.writeText "mattermost-env" ''
-            MM_SQLSETTINGS_DATASOURCE=mattermost@unix(/run/mysqld/mysqld.sock)/mattermost?charset=utf8mb4,utf8&writeTimeout=30s
-            MM_SUPPORTSETTINGS_ABOUTLINK=https://nixos.org
-          ''
-        );
-      };
     };
 
     testScript =
@@ -567,22 +532,6 @@ import ../make-test-python.nix (
             shutdown_queue.task_done()
         threading.Thread(target=shutdown_worker, daemon=True).start()
 
-        ${pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isx86_64 ''
-          # Only run the MySQL tests on x86_64 so we don't have to debug MySQL ARM issues.
-          run_mattermost_tests(
-            shutdown_queue,
-            "${nodes.mysqlMutable.system.build.toplevel}",
-            mysqlMutable,
-            "${nodes.mysqlMostlyMutable.system.build.toplevel}",
-            "${nodes.mysqlMostlyMutable.services.mattermost.pluginsBundle}",
-            mysqlMostlyMutable,
-            "${nodes.mysqlImmutable.system.build.toplevel}",
-            mysqlImmutable,
-            "${nodes.mysqlEnvironmentFile.system.build.toplevel}",
-            mysqlEnvironmentFile
-          )
-        ''}
-
         run_mattermost_tests(
           shutdown_queue,
           "${nodes.postgresMutable.system.build.toplevel}",

From f18ca51953a9de63e17f5afebae7eed84060a499 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Fri, 24 Oct 2025 00:07:37 -0700
Subject: [PATCH 24/50] release-notes: add mattermost details

---
 nixos/doc/manual/release-notes/rl-2511.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 4c32943f3e3f..0fb408ebe28c 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -375,6 +375,8 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
 
 - `services.gitea` supports sending notifications with sendmail again. To do this, activate the parameter `services.gitea.mailerUseSendmail` and configure SMTP server.
 
+- `services.mattermost` has been updated to use the 10.11 ESR instead of 10.5. While this shouldn't break anyone, we also now package Mattermost 11 as mattermostLatest. Note that Mattermost 11 drops support for MySQL. The Mattermost module will assertion fail if you try to use MySQL with Mattermost 11; support for using MySQL with Mattermost will fully be removed in NixOS 26.
+
 - `simplesamlphp` has been removed since the package was severely outdated, unmaintained in nixpkgs and having known vulnerabilities.
 
 - `networking.wireless.networks.<name>` now has an option to specify SSID, hence allowing duplicated SSID setup. The BSSID option is added along side with this.

From 26a33c284c33afb1c4151e78259972e37dcecc73 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Wed, 22 Oct 2025 23:46:11 -0700
Subject: [PATCH 25/50] ovftool: 4.6.3 -> 5.0.0

---
 pkgs/by-name/ov/ovftool/package.nix | 30 ++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/pkgs/by-name/ov/ovftool/package.nix b/pkgs/by-name/ov/ovftool/package.nix
index 23c18565c499..0ea75d4342f9 100644
--- a/pkgs/by-name/ov/ovftool/package.nix
+++ b/pkgs/by-name/ov/ovftool/package.nix
@@ -33,13 +33,13 @@ let
       fileName,
       version,
       toolId ? ovftoolId,
-      artifactId ? 21342,
+      artifactId ? 29161,
       fileType ? "Download",
       source ? "",
       hash ? "",
     }:
     let
-      requestJson = builtins.toJSON {
+      requestJson = lib.strings.toJSON {
         inherit
           fileName
           artifactId
@@ -73,14 +73,14 @@ let
 
   ovftoolSystems = {
     "x86_64-linux" = rec {
-      version = "4.6.3-24031167";
+      version = "5.0.0-24781994";
       fileName = "VMware-ovftool-${version}-lin.x86_64.zip";
-      hash = "sha256-NEwwgmEh/mrZkMMhI+Kq+SYdd3MJ0+IBLdUhd1+kPow=";
+      hash = "sha256-I389VdRZQH9BJT/qxSyUPlRZC7MHv++TDc8rJ1jY788=";
     };
     "x86_64-darwin" = rec {
-      version = "4.6.3-24031167";
+      version = "5.0.0-24781994";
       fileName = "VMware-ovftool-${version}-mac.x64.zip";
-      hash = "sha256-vhACcc4tjaQhvKwZyWkgpaKaoC+coWGl1zfSIC6WebM=";
+      hash = "sha256-vfhagEOnTGxOsY8kFY555c8EhI12GwQ2JwgTjEz7UT0=";
     };
   };
 
@@ -326,24 +326,24 @@ stdenv.mkDerivation (final: {
       set +x
     '';
 
-  meta = with lib; {
+  meta = {
     description = "VMware tools for working with OVF, OVA, and VMX images";
     homepage = "https://developer.vmware.com/web/tool/ovf-tool/";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
       numinit
       thanegill
     ];
-    platforms = builtins.attrNames ovftoolSystems;
+    platforms = lib.attrNames ovftoolSystems;
     mainProgram = "ovftool";
-    knownVulnerabilities = lib.optionals (stdenv.hostPlatform.isDarwin) [
-      "The bundled version of openssl 1.0.2zj in ovftool for Darwin has open vulnerabilities."
+    knownVulnerabilities = lib.optionals stdenv.hostPlatform.isDarwin [
+      "The bundled version of openssl 1.0.2zk in ovftool for Darwin has open vulnerabilities (maximum severity: Moderate)"
       "https://openssl-library.org/news/vulnerabilities-1.0.2/"
-      "CVE-2024-0727"
-      "CVE-2024-5535"
+      "Please nag Broadcom to update to OpenSSL 3 for Darwin."
       "CVE-2024-9143"
       "CVE-2024-13176"
+      "CVE-2025-9230"
     ];
   };
 })

From e27184decf71425a0fd8ce52fb89204b355a30d2 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 22 Oct 2025 10:53:06 -0700
Subject: [PATCH 26/50] animdl: remove `with lib;`

---
 pkgs/by-name/an/animdl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/an/animdl/package.nix b/pkgs/by-name/an/animdl/package.nix
index 28a2ecab20fd..4e3caa64413c 100644
--- a/pkgs/by-name/an/animdl/package.nix
+++ b/pkgs/by-name/an/animdl/package.nix
@@ -55,12 +55,12 @@ python3Packages.buildPythonApplication {
 
   doCheck = true;
 
-  meta = with lib; {
+  meta = {
     description = "Highly efficient, powerful and fast anime scraper";
     homepage = "https://github.com/justfoolingaround/animdl";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
     mainProgram = "animdl";
-    maintainers = with maintainers; [ passivelemon ];
+    maintainers = with lib.maintainers; [ passivelemon ];
     platforms = [ "x86_64-linux" ];
   };
 }

From c88ff31d9fc469e224625b80de0e1b8c412813fb Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 22 Oct 2025 10:49:36 -0700
Subject: [PATCH 27/50] animdl: allow click 8.2.x

---
 pkgs/by-name/an/animdl/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/an/animdl/package.nix b/pkgs/by-name/an/animdl/package.nix
index 4e3caa64413c..751c4b394dea 100644
--- a/pkgs/by-name/an/animdl/package.nix
+++ b/pkgs/by-name/an/animdl/package.nix
@@ -21,6 +21,7 @@ python3Packages.buildPythonApplication {
   ];
 
   pythonRelaxDeps = [
+    "click"
     "cssselect"
     "httpx"
     "lxml"

From 8196656fba972625dd93ae7ef6948b17177c74af Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Tue, 28 Oct 2025 11:57:53 +0100
Subject: [PATCH 28/50] zotero: 7.0.20 -> 7.0.27

Changelog: https://www.zotero.org/support/changelog
---
 pkgs/by-name/zo/zotero/darwin.nix  | 2 +-
 pkgs/by-name/zo/zotero/linux.nix   | 2 +-
 pkgs/by-name/zo/zotero/package.nix | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/zo/zotero/darwin.nix b/pkgs/by-name/zo/zotero/darwin.nix
index f7aaebb8993f..9a0cec7b3630 100644
--- a/pkgs/by-name/zo/zotero/darwin.nix
+++ b/pkgs/by-name/zo/zotero/darwin.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}.dmg";
-    hash = "sha256-DeiQbg8wMFHsJ/jlbGj3wdXrRsGLJ0tOyGRex2w43lU=";
+    hash = "sha256-YivHBEFPkm79y2R5QIV+trm8O3aFzvXTqVzFr1tcoIo=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/by-name/zo/zotero/linux.nix b/pkgs/by-name/zo/zotero/linux.nix
index f0626da413fa..2d84e0bbe7f2 100644
--- a/pkgs/by-name/zo/zotero/linux.nix
+++ b/pkgs/by-name/zo/zotero/linux.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    hash = "sha256-L2Mvi11X4YBU4ezHDJosl7qHClmzUwmghvXG8TChA8c=";
+    hash = "sha256-ce0Lvz0k3DH6rGzdGoqYIW1OBiaJwaxn8pDnMQbqtv4=";
   };
 
   dontPatchELF = true;
diff --git a/pkgs/by-name/zo/zotero/package.nix b/pkgs/by-name/zo/zotero/package.nix
index 7abf2bd8e4e8..1bfda3290939 100644
--- a/pkgs/by-name/zo/zotero/package.nix
+++ b/pkgs/by-name/zo/zotero/package.nix
@@ -6,7 +6,7 @@
 
 let
   pname = "zotero";
-  version = "7.0.20";
+  version = "7.0.27";
   meta = {
     homepage = "https://www.zotero.org";
     description = "Collect, organize, cite, and share your research sources";

From 507d3045c477e6ac48529d8e28196d104a7cd4cd Mon Sep 17 00:00:00 2001
From: Sergey Volkov <taranarmo@gmail.com>
Date: Tue, 28 Oct 2025 12:32:15 +0100
Subject: [PATCH 29/50] qwen-code: 0.0.14 -> 0.1.0

---
 ...dd-missing-resolved-integrity-fields.patch | 70 -------------------
 pkgs/by-name/qw/qwen-code/package.nix         | 51 ++++++++------
 2 files changed, 28 insertions(+), 93 deletions(-)
 delete mode 100644 pkgs/by-name/qw/qwen-code/add-missing-resolved-integrity-fields.patch

diff --git a/pkgs/by-name/qw/qwen-code/add-missing-resolved-integrity-fields.patch b/pkgs/by-name/qw/qwen-code/add-missing-resolved-integrity-fields.patch
deleted file mode 100644
index 9dade6622787..000000000000
--- a/pkgs/by-name/qw/qwen-code/add-missing-resolved-integrity-fields.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 0735b59eba183574e080d2912347d58e6e3d158e Mon Sep 17 00:00:00 2001
-From: Sergey Volkov <taranarmo@gmail.com>
-Date: Fri, 12 Sep 2025 20:06:24 +0200
-Subject: [PATCH] Add missing resolved and integrity fields to several packages
-
----
- package-lock.json | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/package-lock.json b/package-lock.json
-index 146686dc..9ad9009f 100644
---- a/package-lock.json
-+++ b/package-lock.json
-@@ -12574,6 +12574,8 @@
-     },
-     "packages/cli/node_modules/@testing-library/dom": {
-       "version": "10.4.0",
-+      "resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.0.tgz",
-+      "integrity": "sha512-pemlzrSESWbdAloYml3bAJMEfNh1Z7EduzqPKprCH5S341frlpYnUEW0H72dLxa6IsYr+mPno20GiSm+h9dEdQ==",
-       "dev": true,
-       "license": "MIT",
-       "peer": true,
-@@ -12609,6 +12611,8 @@
-     },
-     "packages/cli/node_modules/@testing-library/react": {
-       "version": "16.3.0",
-+      "resolved": "https://registry.npmjs.org/@testing-library/react/-/react-16.3.0.tgz",
-+      "integrity": "sha512-kFSyxiEDwv1WLl2fgsq6pPBbw5aWKrsY2/noi1Id0TK0UParSF62oFQFGHXIyaG4pp2tEub/Zlel+fjjZILDsw==",
-       "dev": true,
-       "license": "MIT",
-       "dependencies": {
-@@ -12660,6 +12664,8 @@
-     },
-     "packages/cli/node_modules/aria-query": {
-       "version": "5.3.0",
-+      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.0.tgz",
-+      "integrity": "sha512-b0P0sZPKtyu8HkeRAfCq0IfURZK+SuwMjY1UXGBU27wpAiTwQAIlq56IbIO+ytk/JjS1fMR14ee5WBBfKi5J6A==",
-       "dev": true,
-       "license": "Apache-2.0",
-       "peer": true,
-@@ -12669,6 +12675,8 @@
-     },
-     "packages/cli/node_modules/emoji-regex": {
-       "version": "10.4.0",
-+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.4.0.tgz",
-+      "integrity": "sha512-EC+0oUMY1Rqm4O6LLrgjtYDvcVYTy7chDnM4Q7030tP4Kwj3u/pR6gP9ygnp2CJMK5Gq+9Q2oqmrFJAz01DXjw==",
-       "license": "MIT"
-     },
-     "packages/cli/node_modules/react-is": {
-@@ -12681,6 +12689,8 @@
-     },
-     "packages/cli/node_modules/string-width": {
-       "version": "7.2.0",
-+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz",
-+      "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==",
-       "license": "MIT",
-       "dependencies": {
-         "emoji-regex": "^10.3.0",
-@@ -12815,6 +12825,8 @@
-     },
-     "packages/core/node_modules/ignore": {
-       "version": "7.0.5",
-+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
-       "license": "MIT",
-       "engines": {
-         "node": ">= 4"
--- 
-2.51.0
-
diff --git a/pkgs/by-name/qw/qwen-code/package.nix b/pkgs/by-name/qw/qwen-code/package.nix
index 3c087d4a58a7..cf265c7999b5 100644
--- a/pkgs/by-name/qw/qwen-code/package.nix
+++ b/pkgs/by-name/qw/qwen-code/package.nix
@@ -6,46 +6,40 @@
   jq,
   git,
   ripgrep,
+  pkg-config,
+  glib,
+  libsecret,
 }:
 
 buildNpmPackage (finalAttrs: {
   pname = "qwen-code";
-  version = "0.0.14";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "QwenLM";
     repo = "qwen-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Rld6k0MPfOOncK240zOJbcvheV4UKU2yF7luBrTrnFs=";
+    hash = "sha256-5XC4Pwf+vuK1T3/bPptUejg8v9wj3izF80Mt+iqVr9Y=";
   };
 
-  patches = [
-    # similar to upstream gemini-cli some node deps are missing resolved and integrity fields
-    # upstream the problem is solved in master and in v0.4+, eventually the fix should arrive to qwen
-    ./add-missing-resolved-integrity-fields.patch
-  ];
-
-  npmDepsHash = "sha256-43s13HncNKv4uOKVwNvqIF+Ih3rJBWrpVJnE3hCKD2w=";
+  npmDepsHash = "sha256-Psj/5SDWBnsRJVJnJwXGUgVbqUnjoH6HpAqqFruHkYw=";
 
   nativeBuildInputs = [
     jq
+    pkg-config
+    git
   ];
 
   buildInputs = [
-    git
     ripgrep
+    glib
+    libsecret
   ];
 
   postPatch = ''
-    # Remove @lvce-editor/ripgrep dependency (no network on buildPhase
-    substituteInPlace package.json --replace-fail '"@lvce-editor/ripgrep": "^1.6.0",' ""
-    substituteInPlace packages/core/package.json --replace-fail '"@lvce-editor/ripgrep": "^1.6.0",' ""
-    substituteInPlace packages/core/src/tools/ripGrep.ts \
-      --replace-fail "const { rgPath } = await import('@lvce-editor/ripgrep');" "const rgPath = 'rg';"
-
-    # patches below remove node-pty dependency which causes build fail on Darwin
+    # patches below remove node-pty and keytar dependencies which cause build fail on Darwin
     # should be conditional on platform but since package-lock.json is patched it changes its hash
-    # though seems like this dependency is not really required by the package
+    # though seems like these dependencies are not really required by the package
     ${jq}/bin/jq '
       del(.packages."node_modules/node-pty") |
       del(.packages."node_modules/@lydell/node-pty") |
@@ -55,11 +49,18 @@ buildNpmPackage (finalAttrs: {
       del(.packages."node_modules/@lydell/node-pty-linux-x64") |
       del(.packages."node_modules/@lydell/node-pty-win32-arm64") |
       del(.packages."node_modules/@lydell/node-pty-win32-x64") |
+      del(.packages."node_modules/keytar") |
       walk(
         if type == "object" and has("dependencies") then
-          .dependencies |= with_entries(select(.key | contains("node-pty") | not))
+          .dependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
         elif type == "object" and has("optionalDependencies") then
-          .optionalDependencies |= with_entries(select(.key | contains("node-pty") | not))
+          .optionalDependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
+        else .
+        end
+      ) |
+      walk(
+        if type == "object" and has("peerDependencies") then
+          .peerDependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
         else .
         end
       )
@@ -79,10 +80,14 @@ buildNpmPackage (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/bin $out/share/qwen-code
-    cp -r bundle/* $out/share/qwen-code/
-    cp node_modules/tiktoken/tiktoken_bg.wasm $out/share/qwen-code/
+    cp -r dist/* $out/share/qwen-code/
+    # Install production dependencies only
+    npm prune --production
+    cp -r node_modules $out/share/qwen-code/
+    # Remove broken symlinks that cause issues in Nix environment
+    find $out/share/qwen-code/node_modules -type l -delete || true
     patchShebangs $out/share/qwen-code
-    ln -s $out/share/qwen-code/gemini.js $out/bin/qwen
+    ln -s $out/share/qwen-code/cli.js $out/bin/qwen
 
     runHook postInstall
   '';

From d9957c75774acfbb044a22390e26c22c4c150eec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Silva?= <andrerfosilva@gmail.com>
Date: Tue, 28 Oct 2025 18:49:03 +0000
Subject: [PATCH 30/50] uwsm: 0.24.1 -> 0.24.2

---
 pkgs/by-name/uw/uwsm/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/uw/uwsm/package.nix b/pkgs/by-name/uw/uwsm/package.nix
index 6b3b676410b6..99be1f986702 100644
--- a/pkgs/by-name/uw/uwsm/package.nix
+++ b/pkgs/by-name/uw/uwsm/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "uwsm";
-  version = "0.24.1";
+  version = "0.24.2";
 
   src = fetchFromGitHub {
     owner = "Vladimir-csp";
     repo = "uwsm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x8Nx0Y4pIOjcN0aYSfTi3WyjzF/wzzgLpNrjpI2s/O0=";
+    hash = "sha256-gX+6fNnndmnEpuKymqVt/5U8RmUq2j9X99L34BJy6LI=";
   };
 
   nativeBuildInputs = [

From 3fbbba471cd137edad7ab2984b7217b77f0c177f Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Tue, 28 Oct 2025 15:32:58 -0400
Subject: [PATCH 31/50] ejabberd: 25.08 -> 25.10

Changelog: https://github.com/processone/ejabberd/releases/tag/25.10
---
 pkgs/by-name/ej/ejabberd/package.nix    |  6 +++---
 pkgs/by-name/ej/ejabberd/rebar-deps.nix | 24 ++++++++++++------------
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/pkgs/by-name/ej/ejabberd/package.nix b/pkgs/by-name/ej/ejabberd/package.nix
index d6c6534257cb..bd2108bac3cb 100644
--- a/pkgs/by-name/ej/ejabberd/package.nix
+++ b/pkgs/by-name/ej/ejabberd/package.nix
@@ -19,7 +19,6 @@
   gawk,
   fetchFromGitHub,
   fetchgit,
-  fetchpatch2,
   beamPackages,
   nixosTests,
   withMysql ? false,
@@ -141,7 +140,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ejabberd";
-  version = "25.08";
+  version = "25.10";
 
   nativeBuildInputs = [
     makeWrapper
@@ -171,7 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "processone";
     repo = "ejabberd";
     tag = finalAttrs.version;
-    hash = "sha256-nipFr4ezo2prlpLfAW8iu8HAG8nhkIXXiAbsoM7QKTM=";
+    hash = "sha256-dTu3feSOakSHdk+hMDvYQwog64O3e/z5NOsGM3Rq7WY=";
   };
 
   passthru.tests = {
@@ -217,6 +216,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Open-source XMPP application server written in Erlang";
     mainProgram = "ejabberdctl";
+    changelog = "https://github.com/processone/ejabberd/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl2Plus;
     homepage = "https://www.ejabberd.im";
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ej/ejabberd/rebar-deps.nix b/pkgs/by-name/ej/ejabberd/rebar-deps.nix
index 5f102ca8151a..cc082f0cc89d 100644
--- a/pkgs/by-name/ej/ejabberd/rebar-deps.nix
+++ b/pkgs/by-name/ej/ejabberd/rebar-deps.nix
@@ -44,21 +44,21 @@ let
     };
     yconf = builder {
       name = "yconf";
-      version = "1.0.21";
+      version = "1.0.22";
       src = fetchHex {
         pkg = "yconf";
-        version = "1.0.21";
-        sha256 = "sha256-xSSl8f2Gh12FtGnMLjaMIE+XzKHDkYc24h9QAcAdCWw=";
+        version = "1.0.22";
+        sha256 = "sha256-rKg0V86r5wdWSEtch7p7GVX1EdSZFoaH6uqnwwDoV/E=";
       };
       beamDeps = [ fast_yaml ];
     };
     xmpp = builder {
       name = "xmpp";
-      version = "1.11.1";
+      version = "1.11.2";
       src = fetchHex {
         pkg = "xmpp";
-        version = "1.11.1";
-        sha256 = "sha256-pckz35BKs87BVCXaM05BDOhOw657ge/gaeXbNop7NxY=";
+        version = "1.11.2";
+        sha256 = "sha256-u2gWROFePvwACKs6cXlE1nz2EaS340Q4KqY2dEe9UtI=";
       };
       beamDeps = [
         ezlib
@@ -124,11 +124,11 @@ let
     };
     p1_pgsql = builder {
       name = "p1_pgsql";
-      version = "1.1.35";
+      version = "1.1.36";
       src = fetchHex {
         pkg = "p1_pgsql";
-        version = "1.1.35";
-        sha256 = "sha256-6ZWURGxBHGYGlnlbBiM29cS9gARR2PYgu01M4wTiVcI=";
+        version = "1.1.36";
+        sha256 = "sha256-gryouJXIT0YA641gmjLLX91yp/W9k437KReeCMZD/Qk=";
       };
       beamDeps = [ xmpp ];
     };
@@ -154,11 +154,11 @@ let
     };
     p1_acme = builder {
       name = "p1_acme";
-      version = "1.0.28";
+      version = "1.0.29";
       src = fetchHex {
         pkg = "p1_acme";
-        version = "1.0.28";
-        sha256 = "sha256-zmhpht4/nV/Sha/odSPLRTKaNJxsa+eswe2RZyXUZCM=";
+        version = "1.0.29";
+        sha256 = "sha256-CP049/vi3CiiN6obOLMGtzRVaVzIiBo93WoRt8Ufe8c=";
       };
       beamDeps = [
         base64url

From 98d31b4eb62a927004208b2cf59ba5dcea067129 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Oct 2025 19:58:30 +0000
Subject: [PATCH 32/50] harbor-cli: 0.0.13 -> 0.0.14

---
 pkgs/by-name/ha/harbor-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ha/harbor-cli/package.nix b/pkgs/by-name/ha/harbor-cli/package.nix
index 8b46de187513..f9a8e1403259 100644
--- a/pkgs/by-name/ha/harbor-cli/package.nix
+++ b/pkgs/by-name/ha/harbor-cli/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "harbor-cli";
-  version = "0.0.13";
+  version = "0.0.14";
 
   src = fetchFromGitHub {
     owner = "goharbor";
     repo = "harbor-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TVuWSbBPRXq9icfMXEg0wONaqD5S2ge5DQiDHSlrADk=";
+    hash = "sha256-86qRXxCLcmVpO/fdmVGxiqVFrAQYIFlNHLxnoBgY9+k=";
   };
 
   vendorHash = "sha256-Pj573V6S2LaytQMK0jGVyLMX/GBZ1GOmYV/LPO1ScS4=";

From 4f0273e6ac823937ca6e735044a6a011be9279a1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Oct 2025 20:28:07 +0000
Subject: [PATCH 33/50] baidupcs-go: 3.9.9 -> 4.0.0

---
 pkgs/by-name/ba/baidupcs-go/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ba/baidupcs-go/package.nix b/pkgs/by-name/ba/baidupcs-go/package.nix
index 6738a39984ba..57a3993d5dee 100644
--- a/pkgs/by-name/ba/baidupcs-go/package.nix
+++ b/pkgs/by-name/ba/baidupcs-go/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "baidupcs-go";
-  version = "3.9.9";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "qjfoidnh";
     repo = "BaiduPCS-Go";
     rev = "v${version}";
-    hash = "sha256-x0oEuj8LoR0yUkKOzI27u3AIFVDDV7vMHCqvjENHwv8=";
+    hash = "sha256-synfJtYZmIiK2SoTG0rt+qZ0ixXIXDXnrNL2s5eDtQY=";
   };
 
-  vendorHash = "sha256-hW+IrzS5+DublQUIIcecL08xoauTjba9qnAtpzNeDXw=";
+  vendorHash = "sha256-oOZeBCHpAasi9K77xA+8HxZErGWKwb4OaWzWhHagtQE=";
 
   doCheck = false;
 

From f5a9262cfdde377014915514bdd3e77b0d1925f8 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Tue, 28 Oct 2025 20:13:11 +0000
Subject: [PATCH 34/50] privatebin: 2.0.1 -> 2.0.2

Changelog: https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.2
Diff: https://github.com/PrivateBin/PrivateBin/compare/2.0.1...2.0.2
---
 pkgs/by-name/pr/privatebin/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pr/privatebin/package.nix b/pkgs/by-name/pr/privatebin/package.nix
index 50f973613382..984d544045ca 100644
--- a/pkgs/by-name/pr/privatebin/package.nix
+++ b/pkgs/by-name/pr/privatebin/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "privatebin";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "PrivateBin";
     repo = "PrivateBin";
     tag = finalAttrs.version;
-    hash = "sha256-FspB10F/gz4d5T4TEYyifosgFLvnSMpVsr2t4NvFTqU=";
+    hash = "sha256-ErTB+qUz0CQf+YZZoFH2/ceAHFfgIbKXst6dTTM1pKQ=";
   };
 
   installPhase = ''

From a37e1d827b1be4b47a0a1a7b3bbc69d2981b864e Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Tue, 28 Oct 2025 21:59:01 +0100
Subject: [PATCH 35/50] ledfx: 2.0.111 -> 2.1.0

---
 pkgs/by-name/le/ledfx/package.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/le/ledfx/package.nix b/pkgs/by-name/le/ledfx/package.nix
index 68840bed9e5f..d03729741691 100644
--- a/pkgs/by-name/le/ledfx/package.nix
+++ b/pkgs/by-name/le/ledfx/package.nix
@@ -1,17 +1,19 @@
 {
   lib,
-  fetchPypi,
+  fetchFromGitHub,
   python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ledfx";
-  version = "2.0.111";
+  version = "2.1.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-b6WHulQa1er0DpMfeJLqqb4z8glUt1dHvvNigXgrf7Y=";
+  src = fetchFromGitHub {
+    owner = "LedFx";
+    repo = "LedFx";
+    tag = "v${version}";
+    hash = "sha256-N9EHK0GVohFCjEKsm3g4h+4XWfzZO1tzdd2z5IN1YjI=";
   };
 
   pythonRelaxDeps = true;

From e1426a5d767d8dcea3a258c9c0c8521a60d036d8 Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Tue, 28 Oct 2025 21:59:57 +0100
Subject: [PATCH 36/50] ledfx: move python-mbedtls to optional-dependencies,
 run tests, reorder deps

---
 pkgs/by-name/le/ledfx/package.nix | 49 +++++++++++++++++++------------
 1 file changed, 31 insertions(+), 18 deletions(-)

diff --git a/pkgs/by-name/le/ledfx/package.nix b/pkgs/by-name/le/ledfx/package.nix
index d03729741691..4d4ac302d230 100644
--- a/pkgs/by-name/le/ledfx/package.nix
+++ b/pkgs/by-name/le/ledfx/package.nix
@@ -16,6 +16,13 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-N9EHK0GVohFCjEKsm3g4h+4XWfzZO1tzdd2z5IN1YjI=";
   };
 
+  postPatch = ''
+    substituteInPlace tests/conftest.py \
+      --replace-fail '"uv",' "" \
+      --replace-fail '"run",' "" \
+      --replace-fail '"ledfx",' "\"$out/bin/ledfx\","
+  '';
+
   pythonRelaxDeps = true;
 
   pythonRemoveDeps = [
@@ -29,43 +36,49 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   dependencies = with python3.pkgs; [
+    # sorted like in pyproject.toml in upstream
+    numpy
+    cffi
     aiohttp
     aiohttp-cors
     aubio
     certifi
-    flux-led
-    python-dotenv
-    icmplib
-    mss
     multidict
-    netifaces2
-    numpy
     openrgb-python
     paho-mqtt
-    pillow
     psutil
-    pybase64
     pyserial
     pystray
-    python-mbedtls
-    python-osc
     python-rtmidi
-    # rpi-ws281x # not packaged
     requests
     sacn
-    samplerate
     sentry-sdk
-    setuptools
     sounddevice
-    stupidartnet
-    uvloop
-    vnoise
+    samplerate
+    icmplib
     voluptuous
     zeroconf
+    pillow
+    flux-led
+    python-osc
+    pybase64
+    mss
+    uvloop
+    stupidartnet
+    python-dotenv
+    vnoise
+    netifaces2
+    packaging
   ];
 
-  # Project has no tests
-  doCheck = false;
+  optional-dependencies = {
+    hue = with pyproject.pkgs; [ python-mbedtls ];
+  };
+
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
   meta = {
     description = "Network based LED effect controller with support for advanced real-time audio effects";

From f39a477c9d18ec60dfd4bd992155222132c417dc Mon Sep 17 00:00:00 2001
From: 7c6f434c <7c6f434c@mail.ru>
Date: Tue, 28 Oct 2025 03:19:56 +0100
Subject: [PATCH 37/50] openscad-unstable: 2025-06-04 ->
 2021.01-unstable-2025-11-27, fix build

---
 pkgs/by-name/op/openscad-unstable/package.nix | 52 +++++++++++--------
 pkgs/by-name/op/openscad-unstable/test.diff   | 42 ---------------
 2 files changed, 29 insertions(+), 65 deletions(-)
 delete mode 100644 pkgs/by-name/op/openscad-unstable/test.diff

diff --git a/pkgs/by-name/op/openscad-unstable/package.nix b/pkgs/by-name/op/openscad-unstable/package.nix
index 7f64438b8078..0184ab5753c6 100644
--- a/pkgs/by-name/op/openscad-unstable/package.nix
+++ b/pkgs/by-name/op/openscad-unstable/package.nix
@@ -44,33 +44,29 @@
   ctestCheckHook,
 }:
 # clang consume much less RAM than GCC
-clangStdenv.mkDerivation rec {
-  pname = "openscad-unstable";
-  version = "2025-06-04";
-  src = fetchFromGitHub {
-    owner = "openscad";
-    repo = "openscad";
-    rev = "65856c9330f8cc4ffcaccf03d91b4217f2eae28d";
-    hash = "sha256-jozcLFGVSfw8G12oSxHjqUyFtAfENgIByID+omk08mU=";
-    fetchSubmodules = true; # Only really need sanitizers-cmake and MCAD and manifold
-  };
-
-  patches = [ ./test.diff ];
-
-  # fix use of our lib3mf cmake export instead of finder
-  postPatch = ''
-    substituteInPlace CMakeLists.txt --replace-fail \
-      "Lib3MF" \
-      "lib3mf"
-  '';
-
-  nativeBuildInputs = [
-    (python3.withPackages (
+let
+  python3withPackages = (
+    python3.withPackages (
       ps: with ps; [
         numpy
         pillow
       ]
-    ))
+    )
+  );
+in
+clangStdenv.mkDerivation rec {
+  pname = "openscad-unstable";
+  version = "2021.01-unstable-2025-10-27";
+  src = fetchFromGitHub {
+    owner = "openscad";
+    repo = "openscad";
+    rev = "aa785fe4ab3d52450a5e51eb73585ac9bbcc8798";
+    hash = "sha256-TngfItArYtm8243DdYkQlkfc/MBTZGYrf08hfloWRWk=";
+    fetchSubmodules = true; # Only really need sanitizers-cmake and MCAD and manifold
+  };
+
+  nativeBuildInputs = [
+    python3withPackages
     bison
     cmake
     flex
@@ -134,6 +130,10 @@ clangStdenv.mkDerivation rec {
     # The sources enable this for only apple. We turn it off globally anyway to stay
     # consistent.
     "-DUSE_QT6=OFF"
+
+    # For tests
+    "-DVENV_DIR=${python3withPackages}"
+    "-DVENV_BIN_PATH=${python3withPackages}/bin"
   ];
 
   # tests rely on sysprof which is not available on darwin
@@ -147,6 +147,12 @@ clangStdenv.mkDerivation rec {
       done )
   '';
 
+  postPatch = ''
+    # Take Python3 executable as passed
+    sed -e '/set(VENV_DIR /d' -i tests/cmake/ImageCompare.cmake
+    sed -e '/find_path(VENV_BIN_PATH /d' -i tests/cmake/ImageCompare.cmake
+  '';
+
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir $out/Applications
     mv $out/bin/*.app $out/Applications
diff --git a/pkgs/by-name/op/openscad-unstable/test.diff b/pkgs/by-name/op/openscad-unstable/test.diff
deleted file mode 100644
index 23b3983daddd..000000000000
--- a/pkgs/by-name/op/openscad-unstable/test.diff
+++ /dev/null
@@ -1,42 +0,0 @@
-diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
-index 5c1b40af4..917451dee 100644
---- a/tests/CMakeLists.txt
-+++ b/tests/CMakeLists.txt
-@@ -59,13 +59,14 @@ if(USE_IMAGE_COMPARE_PY)
- 
-   # Since msys2 on Windows prefers bin/ over Scripts, we need to look for the actual folder to determine
-   # how to utilize the venv
--  find_path(VENV_BIN_PATH activate PATHS "${VENV_DIR}/bin" "${VENV_DIR}/Scripts" NO_DEFAULT_PATH NO_CACHE)
--  if(WIN32)
--    set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python.exe")
--  else()
--    set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python")
--  endif()
--  if(EXISTS "${IMAGE_COMPARE_EXE}")
-+  # find_path(VENV_BIN_PATH activate PATHS "${VENV_DIR}/bin" "${VENV_DIR}/Scripts" NO_DEFAULT_PATH NO_CACHE)
-+  # if(WIN32)
-+  #   set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python.exe")
-+  # else()
-+  #   set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python")
-+  # endif()
-+  set(IMAGE_COMPARE_EXE "python3")
-+  # if(EXISTS "${IMAGE_COMPARE_EXE}")
-     message(STATUS "venv found, testing libraries")
-     execute_process(
-       COMMAND "${IMAGE_COMPARE_EXE}" "${CCSD}/image_compare.py" "--status"
-@@ -77,10 +78,10 @@ if(USE_IMAGE_COMPARE_PY)
-       message(STATUS "venv libraries complete")
-       set(BUILD_VENV FALSE)
-     endif()
--  else()
--    message(STATUS "venv not found")
--    set(BUILD_VENV TRUE)
--  endif()
-+  # else()
-+  #   message(STATUS "venv not found")
-+  #   set(BUILD_VENV TRUE)
-+  # endif()
-   if(BUILD_VENV)
-     message(STATUS "Setting up testing venv for image comparison")
-     execute_process(
-

From a3657f183e38973a3d2a1fe96c5af0bc8a8fb6ba Mon Sep 17 00:00:00 2001
From: Cobalt <cobalt@cobalt.rocks>
Date: Tue, 28 Oct 2025 23:46:46 +0100
Subject: [PATCH 38/50] squid: 7.2 -> 7.3

Refer to upstream changelog for specific details:
https://github.com/squid-cache/squid/releases/tag/SQUID_7_3

For nixpkgs this notably includes a regression fix that was previously
fixed with a patch.
---
 pkgs/by-name/sq/squid/package.nix | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/sq/squid/package.nix b/pkgs/by-name/sq/squid/package.nix
index 384dadf43743..ed953ff47fbf 100644
--- a/pkgs/by-name/sq/squid/package.nix
+++ b/pkgs/by-name/sq/squid/package.nix
@@ -16,26 +16,18 @@
   cppunit,
   ipv6 ? true,
   nixosTests,
-  fetchpatch,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "squid";
-  version = "7.2";
+  version = "7.3";
 
   src = fetchurl {
     url = "https://github.com/squid-cache/squid/releases/download/SQUID_${
       builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
     }/squid-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Xgd74dg6nmls6NDZ5yOxJzFSIHoJFAS+aKS5qeGMcAM=";
+    hash = "sha256-2twqmjkmzhs7q+qnp9eyHLsIkCWHbao/XBnn62OR3c0=";
   };
 
-  patches = lib.optional (lib.versionOlder finalAttrs.version "7.2.0") (fetchpatch {
-    # Merged upstream PR; fixes the issue of rejecting domain names starting with digits
-    # To remove when 7.3 is released (or 7.2.1, but that doesn't seem likely)
-    url = "https://patch-diff.githubusercontent.com/raw/squid-cache/squid/pull/2283.patch";
-    hash = "sha256-HLGmzrAH5y1sFfFnVeeegRihyn+N7csGX9lVqmCDIHc=";
-  });
-
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     perl

From a9caf74e0fbcf2fc69e796be0394d36fa839c06b Mon Sep 17 00:00:00 2001
From: Rafael Ieda <git@ieda.me>
Date: Tue, 21 Oct 2025 09:23:48 -0300
Subject: [PATCH 39/50] gargoyle: fix build with cmake4

---
 pkgs/by-name/ga/gargoyle/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/ga/gargoyle/package.nix b/pkgs/by-name/ga/gargoyle/package.nix
index 3722c7a16240..63e8fdba53ea 100644
--- a/pkgs/by-name/ga/gargoyle/package.nix
+++ b/pkgs/by-name/ga/gargoyle/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   fetchDebianPatch,
+  fetchpatch,
   cmake,
   pkg-config,
   fluidsynth,
@@ -36,6 +37,11 @@ stdenv.mkDerivation rec {
       patch = "ftbfs_gcc14.patch";
       hash = "sha256-eMx/RlUpq5Ez+1L8VZo40Y3h2ZKkqiQEmKTlkZRMXnI=";
     })
+    (fetchpatch {
+      name = "cmake4-fix";
+      url = "https://github.com/garglk/garglk/commit/8d976852e2db0215e9cf4f926e626f1aa766f751.patch?full_index=1";
+      hash = "sha256-lJAuiOErSp3oDmeoqrfCdnHH816VLYiVthIG4U8BJ5E=";
+    })
   ];
 
   postPatch = ''

From 9029dde28129467c35411fbf938ae6c2b74e4c0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 28 Oct 2025 16:24:49 -0700
Subject: [PATCH 40/50] python3Packages.ha-silabs-firmware-client: 0.2.0 ->
 0.3.0

Diff: https://github.com/home-assistant-libs/ha-silabs-firmware-client/compare/v0.2.0...v0.3.0

Changelog: https://github.com/home-assistant-libs/ha-silabs-firmware-client/releases/tag/v0.3.0
---
 .../python-modules/ha-silabs-firmware-client/default.nix      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ha-silabs-firmware-client/default.nix b/pkgs/development/python-modules/ha-silabs-firmware-client/default.nix
index dd983d98cdd4..dbe4b27569dd 100644
--- a/pkgs/development/python-modules/ha-silabs-firmware-client/default.nix
+++ b/pkgs/development/python-modules/ha-silabs-firmware-client/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "ha-silabs-firmware-client";
-  version = "0.2.0";
+  version = "0.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "ha-silabs-firmware-client";
     tag = "v${version}";
-    hash = "sha256-Kip9JL9tuF7OI22elN0w2Z7Xjdaayboo8LThp4FAets=";
+    hash = "sha256-OCDMJtcgBfVKATJQgqH/YuEU8112tSBjqT81jDUu4b8=";
   };
 
   postPatch = ''

From 4b20a03d0bd71ed6f7fcf2d239bbc961a04b2339 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Oct 2025 00:37:12 +0000
Subject: [PATCH 41/50] exim: 4.98.2 -> 4.99

---
 pkgs/by-name/ex/exim/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/exim/package.nix b/pkgs/by-name/ex/exim/package.nix
index beb459c582b5..2ee910bcb939 100644
--- a/pkgs/by-name/ex/exim/package.nix
+++ b/pkgs/by-name/ex/exim/package.nix
@@ -39,11 +39,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "exim";
-  version = "4.98.2";
+  version = "4.99";
 
   src = fetchurl {
     url = "https://ftp.exim.org/pub/exim/exim4/${pname}-${version}.tar.xz";
-    hash = "sha256-iLjopnwdtswLHRSBYao25mL0yi/vJdW282lNSQ5C3K4=";
+    hash = "sha256-XfOLBC/6mpyNMbILyEgVWAcONhsG9ldghiKmKjJ63Lo=";
   };
 
   enableParallelBuilding = true;

From 980872c9091cdf77b6769d9b577b4e845a354acf Mon Sep 17 00:00:00 2001
From: Ulysses Zhan <UlyssesZhan@gmail.com>
Date: Tue, 26 Aug 2025 20:31:56 -0700
Subject: [PATCH 42/50] apkeditor: 1.4.1 -> 1.4.5; add update script

---
 pkgs/by-name/ap/apkeditor/arsclib/default.nix |  8 +--
 .../by-name/ap/apkeditor/jcommand/default.nix |  6 +-
 pkgs/by-name/ap/apkeditor/package.nix         | 14 ++++-
 pkgs/by-name/ap/apkeditor/smali/default.nix   |  6 +-
 pkgs/by-name/ap/apkeditor/update.sh           | 58 +++++++++++++++++++
 5 files changed, 79 insertions(+), 13 deletions(-)
 create mode 100755 pkgs/by-name/ap/apkeditor/update.sh

diff --git a/pkgs/by-name/ap/apkeditor/arsclib/default.nix b/pkgs/by-name/ap/apkeditor/arsclib/default.nix
index 37e9d0d9ec59..56625eb1af31 100644
--- a/pkgs/by-name/ap/apkeditor/arsclib/default.nix
+++ b/pkgs/by-name/ap/apkeditor/arsclib/default.nix
@@ -8,8 +8,8 @@
 let
   self = REAndroidLibrary {
     pname = "arsclib";
-    # 1.3.5 is not new enough for APKEditor because of API changes
-    version = "1.3.5-unstable-2024-10-21";
+    # 1.3.8 is not new enough for APKEditor because of API changes
+    version = "1.3.8-unstable-2025-09-23";
     projectName = "ARSCLib";
 
     src = fetchFromGitHub {
@@ -18,8 +18,8 @@ let
       # This is the latest commit at the time of packaging.
       # It can be changed to a stable release ("V${version}")
       # if it is compatible with APKEditor.
-      rev = "ed6ccf00e56d7cce13e8648ad46a2678a6093248";
-      hash = "sha256-jzd7xkc4O+P9hlGsFGGl2P3pqVvV5+mDyKTRUuGfFSA=";
+      rev = "7238433395dea6f7d0fce3139f1659063ac31f42";
+      hash = "sha256-93eskC/qdkkNAZFYqSzoFxhmWgzTvDyZmZxOvwELGCs=";
     };
 
     mitmCache = gradle.fetchDeps {
diff --git a/pkgs/by-name/ap/apkeditor/jcommand/default.nix b/pkgs/by-name/ap/apkeditor/jcommand/default.nix
index 43b6ce8cae4c..b2e5a0c021ba 100644
--- a/pkgs/by-name/ap/apkeditor/jcommand/default.nix
+++ b/pkgs/by-name/ap/apkeditor/jcommand/default.nix
@@ -8,7 +8,7 @@
 let
   self = REAndroidLibrary {
     pname = "jcommand";
-    version = "0-unstable-2024-09-20";
+    version = "0-unstable-2025-01-21";
     projectName = "JCommand";
 
     src = fetchFromGitHub {
@@ -18,8 +18,8 @@ let
       # it is hard to determine the actual commit that APKEditor is intended to use,
       # so I think we should use the latest commit that doesn't break compilation or basic functionality.
       # Currently this is the latest commit at the time of packaging.
-      rev = "714b6263c28dabb34adc858951cf4bc60d6c3fed";
-      hash = "sha256-6Em+1ddUkZBCYWs88qtfeGnxISZchFrHgDL8fsgZoQg=";
+      rev = "27d5fd21dc7da268182ea81e59007af890adb06e";
+      hash = "sha256-sbblGrp16rMGGGt7xAFd9F3ACeadYYEymBEL+s5BZ1E=";
     };
 
     mitmCache = gradle.fetchDeps {
diff --git a/pkgs/by-name/ap/apkeditor/package.nix b/pkgs/by-name/ap/apkeditor/package.nix
index 04f1d608a952..8647e87359d1 100644
--- a/pkgs/by-name/ap/apkeditor/package.nix
+++ b/pkgs/by-name/ap/apkeditor/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   callPackage,
+  versionCheckHook,
 
   jre,
   gradle,
@@ -54,7 +55,7 @@ let
   apkeditor =
     let
       pname = "apkeditor";
-      version = "1.4.1";
+      version = "1.4.5";
       projectName = "APKEditor";
     in
     REAndroidLibrary {
@@ -69,8 +70,8 @@ let
       src = fetchFromGitHub {
         owner = "REAndroid";
         repo = "APKEditor";
-        tag = "v${version}";
-        hash = "sha256-a72j9qGjJXnTFeqLez2rhBSArFVYCX+Xs7NQd8CY5Yk=";
+        tag = "V${version}";
+        hash = "sha256-yuNMyEnxTjHPSBPWVD8b+f612hWGGayZHKHxtWtxXDg=";
       };
 
       patches = [
@@ -99,8 +100,15 @@ let
           --add-flags "-jar $out/${apkeditor.outJar}"
       '';
 
+      doInstallCheck = true;
+      nativeInstallCheckInputs = [ versionCheckHook ];
+
+      passthru.updateScript = ./update.sh;
+
       meta = {
         description = "Powerful android apk resources editor";
+        homepage = "https://github.com/REAndroid/APKEditor";
+        changelog = "https://github.com/REAndroid/APKEditor/releases/tag/V${version}";
         maintainers = with lib.maintainers; [ ulysseszhan ];
         license = lib.licenses.asl20;
         platforms = lib.platforms.all;
diff --git a/pkgs/by-name/ap/apkeditor/smali/default.nix b/pkgs/by-name/ap/apkeditor/smali/default.nix
index de6b87c8e82e..ee0032ad27d0 100644
--- a/pkgs/by-name/ap/apkeditor/smali/default.nix
+++ b/pkgs/by-name/ap/apkeditor/smali/default.nix
@@ -8,7 +8,7 @@
 let
   self = REAndroidLibrary {
     pname = "smali";
-    version = "0-unstable-2024-10-15";
+    version = "0-unstable-2024-11-24";
     projectName = "smali";
 
     src = fetchFromGitHub {
@@ -18,8 +18,8 @@ let
       # it is hard to determine the actual commit that APKEditor is intended to use,
       # so I think we should use the latest commit that doesn't break compilation or basic functionality.
       # Currently this is the latest commit at the time of packaging.
-      rev = "c781eafb31f526abce9fdf406ce2c925fec20d28";
-      hash = "sha256-6tkvikgWMUcKwzsgbfpxlB6NZBAlZtTE34M3qPQw7Y4=";
+      rev = "76b35b4e0c9e8c874ca3e374bb943bba8d280770";
+      hash = "sha256-PhRBjiIKA4EIiafPplZNBErXG8V84Xn0cZLWVPmJelQ=";
     };
 
     patches = [
diff --git a/pkgs/by-name/ap/apkeditor/update.sh b/pkgs/by-name/ap/apkeditor/update.sh
new file mode 100755
index 000000000000..45b43b916690
--- /dev/null
+++ b/pkgs/by-name/ap/apkeditor/update.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+
+set -euo pipefail
+
+GITHUB_TOKEN="${GITHUB_TOKEN:-}"
+
+nixpkgs_attr() {
+  nix-instantiate --eval --raw --attr "$1"
+}
+
+github_api() {
+  local token_opt=()
+  if [[ -n "$GITHUB_TOKEN" ]]; then
+    token_opt=(-H "Authorization: Bearer $GITHUB_TOKEN")
+  fi
+  curl -fsS "${token_opt[@]}" "https://api.github.com$1"
+}
+
+update_mitm_cache() {
+  if [[ -z "$(nixpkgs_attr "$1.mitmCache.name")" ]]; then
+    return
+  fi
+  "$(nix-build -A "$1.mitmCache.updateScript")"
+}
+
+update() {
+  echo "Updating $1..." >&2
+
+  local owner="$(nixpkgs_attr "$1.src.owner")"
+  local repo="$(nixpkgs_attr "$1.src.repo")"
+
+  local old_version="$(nixpkgs_attr "$1.version")"
+  local use_last_commit=0
+  if [[ "$old_version" == *unstable* ]]; then
+    use_last_commit=1
+  fi
+
+  if (( use_last_commit )); then
+    local repo_info="$(github_api "/repos/$owner/$repo/commits?per_page=1" | jq ".[0]")"
+    local new_rev="$(echo "$repo_info" | jq -r .sha)"
+    local date="$(echo "$repo_info" | jq -r .commit.author.date)"
+    date="$(date -u -d "$date" +%Y-%m-%d)"
+    local new_version="${old_version%%-unstable*}-unstable-$(date -u -d "$date" +%Y-%m-%d)"
+    update-source-version "$1" "$new_version" --rev="$new_rev" --ignore-same-version --ignore-same-hash
+  else
+    local tag="$(github_api "/repos/$owner/$repo/releases/latest" | jq -r .tag_name)"
+    local new_version="${tag#V}"
+    update-source-version "$1" "$new_version" --ignore-same-version --ignore-same-hash
+  fi
+
+  update_mitm_cache "$1"
+}
+
+update apkeditor.passthru.deps.arsclib
+update apkeditor.passthru.deps.smali
+update apkeditor.passthru.deps.jcommand
+update apkeditor

From 476eda159f0ff96517a8d4606314a7b3b00ddf54 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Oct 2025 00:56:21 +0000
Subject: [PATCH 43/50] go-judge: 1.9.8 -> 1.9.9

---
 pkgs/by-name/go/go-judge/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/go-judge/package.nix b/pkgs/by-name/go/go-judge/package.nix
index 24877f211833..c106594e9c76 100644
--- a/pkgs/by-name/go/go-judge/package.nix
+++ b/pkgs/by-name/go/go-judge/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "go-judge";
-  version = "1.9.8";
+  version = "1.9.9";
 
   src = fetchFromGitHub {
     owner = "criyle";
     repo = "go-judge";
     rev = "v${version}";
-    hash = "sha256-hBOH5FDqzUGiCXucbTPBPXdEnHPq7fL0SYlY5b3OMHY=";
+    hash = "sha256-orYfnqtNvTIJLAfjrrRU6WT3wKzQCzYmCNEHC8OBlQo=";
   };
 
-  vendorHash = "sha256-dUJpNGJvvmIJuA6GSWhL4weQEwn5iM9k+y8clHdxhvY=";
+  vendorHash = "sha256-2mCd8ymY9l4A2wAe7+MVCsCqT92qIVHHHfkNJvEMg5k=";
 
   tags = [
     "nomsgpack"

From 532616753d738881a76cb00e02bae0b2c7ba18c6 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Sat, 4 Oct 2025 05:33:18 +0200
Subject: [PATCH 44/50] cwltool: 3.1.20250110105449 -> 3.1.20250925164626

---
 pkgs/by-name/cw/cwltool/package.nix | 41 +++++++----------------------
 1 file changed, 10 insertions(+), 31 deletions(-)

diff --git a/pkgs/by-name/cw/cwltool/package.nix b/pkgs/by-name/cw/cwltool/package.nix
index df62af94dcd7..847d3484f7cf 100644
--- a/pkgs/by-name/cw/cwltool/package.nix
+++ b/pkgs/by-name/cw/cwltool/package.nix
@@ -1,62 +1,39 @@
 {
   lib,
   fetchFromGitHub,
-  git,
   nodejs,
-  python3,
+  python3Packages,
 }:
 
-let
-  py = python3.override {
-    packageOverrides = final: prev: {
-      # Requires "pydot >= 1.4.1, <3",
-      pydot = prev.pydot.overridePythonAttrs (old: rec {
-        version = "2.0.0";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-YCRq8hUSP6Bi8hzXkb5n3aI6bygN8J9okZ5jeh5PMjU=";
-        };
-        doCheck = false;
-      });
-    };
-  };
-in
-with py.pkgs;
-
-py.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cwltool";
-  version = "3.1.20250110105449";
+  version = "3.1.20250925164626";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "common-workflow-language";
     repo = "cwltool";
     tag = version;
-    hash = "sha256-V0CQiNkIw81s6e9224qcfbsOqBvMo34q+lRURpRetKs=";
+    hash = "sha256-esY/p7wm0HvLiX+jZENBye4NblYveYAXevYRQxk+u44=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace-fail "prov == 1.5.1" "prov" \
-      --replace-fail '"schema-salad >= 8.7, < 9",' '"schema-salad",' \
       --replace-fail "PYTEST_RUNNER + " ""
     substituteInPlace pyproject.toml \
-      --replace-fail "mypy==1.14.1" "mypy"
+      --replace-fail "mypy==1.18.2" "mypy"
   '';
 
-  build-system = with py.pkgs; [
+  build-system = with python3Packages; [
     setuptools
     setuptools-scm
   ];
 
-  nativeBuildInputs = [ git ];
-
-  dependencies = with py.pkgs; [
+  dependencies = with python3Packages; [
     argcomplete
     bagit
     coloredlogs
     cwl-utils
-    mypy
     mypy-extensions
     prov
     psutil
@@ -74,7 +51,7 @@ py.pkgs.buildPythonApplication rec {
     typing-extensions
   ];
 
-  nativeCheckInputs = with py.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     mock
     nodejs
     pytest-mock
@@ -83,6 +60,8 @@ py.pkgs.buildPythonApplication rec {
     pytestCheckHook
   ];
 
+  pythonRelaxDeps = [ "prov" ];
+
   disabledTests = [
     "test_content_types"
     "test_env_filtering"

From e550553dca66eb4a0be9c196bfea6efe139356a2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Oct 2025 02:50:49 +0000
Subject: [PATCH 45/50] traefik: 3.5.3 -> 3.5.4

---
 pkgs/by-name/tr/traefik/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index 5b0ecef2daac..475faea34b89 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -8,16 +8,16 @@
 
 buildGo124Module (finalAttrs: {
   pname = "traefik";
-  version = "3.5.3";
+  version = "3.5.4";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${finalAttrs.version}/traefik-v${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-vKpOlB29OJHppQOspIICYgeAtemBGb419TIXIW9zrhU=";
+    hash = "sha256-gA1H2oJXm6l3JQdn1+SMPf3ZzG0pvXRDiVgZu2MAT3E=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-Juf5LYB/o1hyTIZB5NQrJBOLdkEjL1mOsBgndF3vpd8=";
+  vendorHash = "sha256-UziRO6cNgbVRyLWm8i/oOXVktOAt8exCNz2bdpX8yk8=";
 
   subPackages = [ "cmd/traefik" ];
 

From 3c138e076486122420c37775045b421a9a69c309 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Oct 2025 02:57:54 +0000
Subject: [PATCH 46/50] typescript-go: 0-unstable-2025-10-22 ->
 0-unstable-2025-10-29

---
 pkgs/by-name/ty/typescript-go/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/typescript-go/package.nix b/pkgs/by-name/ty/typescript-go/package.nix
index 92b1ad63fdf7..9835f8f89062 100644
--- a/pkgs/by-name/ty/typescript-go/package.nix
+++ b/pkgs/by-name/ty/typescript-go/package.nix
@@ -10,13 +10,13 @@ let
 in
 buildGoModule {
   pname = "typescript-go";
-  version = "0-unstable-2025-10-22";
+  version = "0-unstable-2025-10-29";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "typescript-go";
-    rev = "42241ec50d438ce9ef1f2b90a7b2cdd1bfa5f51d";
-    hash = "sha256-5vm9ht3nZ3ELODN+J5PfAOWrxIUCyvsIxbf29geSYrA=";
+    rev = "6642b0a33b7fbea3594e8c243d9323a1ad945202";
+    hash = "sha256-kvG21V9prb+Brg2wPaXwzd4eEfNE6VfYn8st3hsCsco=";
     fetchSubmodules = false;
   };
 

From 68c01a5d5a80d79b97545403e161bade37288bce Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sun, 26 Oct 2025 13:26:59 -0700
Subject: [PATCH 47/50] animdl: open up platforms

---
 pkgs/by-name/an/animdl/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/an/animdl/package.nix b/pkgs/by-name/an/animdl/package.nix
index 751c4b394dea..99dc42e8e962 100644
--- a/pkgs/by-name/an/animdl/package.nix
+++ b/pkgs/by-name/an/animdl/package.nix
@@ -62,6 +62,5 @@ python3Packages.buildPythonApplication {
     license = lib.licenses.gpl3Only;
     mainProgram = "animdl";
     maintainers = with lib.maintainers; [ passivelemon ];
-    platforms = [ "x86_64-linux" ];
   };
 }

From 0a85f72c7a7573e749a0905b92bc1a14d75f119c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Oct 2025 04:20:44 +0000
Subject: [PATCH 48/50] terraform-providers.integrations_github: 6.7.0 -> 6.7.1

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 8463aec0adc5..7cd2e9204937 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -741,11 +741,11 @@
     "vendorHash": null
   },
   "integrations_github": {
-    "hash": "sha256-OexDIuEHRSOeHq0lRZcaaezdQpm5tgINGcka6jk+bK0=",
+    "hash": "sha256-FVDx8KH7foy1rZigDVEWMEalQ9nJnLkRjkJsFi0aEuM=",
     "homepage": "https://registry.terraform.io/providers/integrations/github",
     "owner": "integrations",
     "repo": "terraform-provider-github",
-    "rev": "v6.7.0",
+    "rev": "v6.7.1",
     "spdx": "MIT",
     "vendorHash": null
   },

From f05240770cb89268131766357c315be40b82e719 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Oct 2025 04:30:43 +0000
Subject: [PATCH 49/50] terraform-providers.hashicorp_aws: 6.17.0 -> 6.18.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 8463aec0adc5..304464db54e0 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -489,13 +489,13 @@
     "vendorHash": "sha256-MYVkNvJ+rbwGw0htClIbmxk3YX2OK/ZO/QOTyMRFiug="
   },
   "hashicorp_aws": {
-    "hash": "sha256-paVJc2HHtdAoc1KoYj0P5/t990/9nZedqBnjJNvmoOM=",
+    "hash": "sha256-5W5v4j4oBXIfqW75ClXkBtAahgEW6oMiTmILL6++fEc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v6.17.0",
+    "rev": "v6.18.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-93DyqAPi6hirke0KyR6gggC7cgAZOOByUIIA6C+6LZU="
+    "vendorHash": "sha256-Nxw5C4li2kH6MAlyaqHAUL+XYyuVPZYSkQ6PnmL3sV8="
   },
   "hashicorp_awscc": {
     "hash": "sha256-SrJQG1F9V/HThL6TDduT/qEA2x3tzII56+JMVDFpqEk=",

From e67fb9bf1e51f020c647f83ec7e81faa487e1fae Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Tue, 28 Oct 2025 21:38:04 -0700
Subject: [PATCH 50/50] ovftool: comment nits

---
 pkgs/by-name/ov/ovftool/package.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ov/ovftool/package.nix b/pkgs/by-name/ov/ovftool/package.nix
index 0ea75d4342f9..fe4888375a97 100644
--- a/pkgs/by-name/ov/ovftool/package.nix
+++ b/pkgs/by-name/ov/ovftool/package.nix
@@ -158,9 +158,7 @@ stdenv.mkDerivation (final: {
     # libgoogleurl and libcurl.
     #
     # FIXME: Replace libgoogleurl? Possibly from Chromium?
-    # FIXME: Tell VMware to use a modern version of OpenSSL on macOS. As of ovftool
-    # v4.6.3 ovftool uses openssl-1.0.2zj which in seems to be the extended
-    # support LTS release: https://www.openssl.org/support/contracts.html
+    # FIXME: Tell VMware to use a modern version of OpenSSL on macOS.
 
     # Install all libs that are not patched in preFixup.
     # Darwin dylibs are under `lib` in the zip.
@@ -174,7 +172,7 @@ stdenv.mkDerivation (final: {
     libvmacore.so \
     libvmomi.so
   ''
-  # macOS still relies on OpenSSL 1.0.2 as of v4.6.3, but Linux is in the clear
+  # macOS still relies on OpenSSL 1.0.2 as of v4.6.3 and later, but Linux is in the clear
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     lib/libcrypto.1.0.2.dylib \
     lib/libgoogleurl.59.0.30.45.2.dylib \