Merge staging-next into staging

doc/README.md

@@ -1,21 +1,32 @@
-# Contributing to the Nixpkgs reference manual
+# Contributing to the Nixpkgs manual
 
-This directory houses the source files for the Nixpkgs reference manual.
+This directory houses the source files for the Nixpkgs manual.
 
-> [!IMPORTANT]
-> We are actively restructuring our documentation to follow the [Diátaxis framework](https://diataxis.fr/)
+> [!NOTE]
 >
-> Going forward, this directory should **only** contain [reference documentation](https://nix.dev/contributing/documentation/diataxis#reference).
-> For tutorials, guides and explanations, contribute to <https://nix.dev/> instead.
+> We are actively restructuring our documentation to be more beginner friendly.
 >
-> We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
-> This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
 
-For documentation only relevant for contributors, use Markdown files next to the source and regular code comments.
+When writing new docs use **Progressive Disclosure**
 
-> [!TIP]
-> Feedback for improving support for parsing and rendering doc-comments is highly appreciated.
-> [Open an issue](https://github.com/NixOS/nixpkgs/issues/new?labels=6.topic%3A+documentation&title=Doc%3A+) to request bugfixes or new features.
+Start simple, pick up beginners.
+Use **examples** first to show how to get something done. Keep **Explanation** lean.
+
+Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
+
+This directory contains **guides** and **reference** documentation for Nixpkgs.
+
+Borrowing from [Diátaxis framework](https://diataxis.fr/) what suits our needs:
+
+**Guides** are task-oriented. They can be tutorial-style walkthroughs or how-to sections.
+Explanations appear as prose after examples.
+
+**Reference** documentation is the specification of functions and attributes.
+
+We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
+This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
+
+See [Document structure](#document-structure) for a structural template.
 
 Rendered documentation:
 - [Unstable (from master)](https://nixos.org/manual/nixpkgs/unstable/)
@@ -54,9 +65,11 @@ Make sure that your local files aren't added to Git history by adding the follow
 /**/.direnv
 ```
 
-#### `devmode`
+#### Live preview
 
-Use [`devmode`](../pkgs/by-name/de/devmode/README.md) for a live preview when editing the manual.
+Run [`devmode`](../pkgs/by-name/de/devmode/README.md) for a live preview while editing the manual: it rebuilds on every change and reloads the page in your browser automatically.
+
+Changes to the renderer 'pkgs/by-name/ni/nixos-render-docs' need a manual restart. Run: `devmode` again.
 
 ### Testing redirects
 
@@ -209,6 +222,62 @@ You, as the writer of documentation, are still in charge of its content.
 
 **For prose style, see the [documentation styleguide](./styleguide.md).**
 
+### Document structure
+
+Organize each chapter as guide sections first, then a single `## Reference` section.
+
+A well-structured chapter looks like this:
+
+````markdown
+# Foo {#foo}
+
+`foo` builds Foo projects from a `foo.toml`.
+
+## Package a Foo application {#foo-packaging}
+
+:::{.example #ex-foo-packaging}
+
+# Package the hello app
+
+```nix
+{ foo }:
+buildFooPackage {
+  pname = "hello";
+  version = "1.0";
+}
+```
+
+:::
+
+`buildFooPackage` needs `pname` and `version`.
+Keep explanation short, and place it after the example.
+
+## Reference {#foo-reference}
+
+### `buildFooPackage` {#foo-buildFooPackage}
+
+Builds a Foo application from source.
+
+#### Inputs {#foo-buildFooPackage-inputs}
+
+`pname` (String)
+: The program name.
+
+#### Examples {#foo-buildFooPackage-examples}
+
+See [](#ex-foo-packaging).
+````
+
+Examples live in one place: the guide owns them and the reference links to them.
+
+Guides introduce minimal working examples that are goal-oriented (typical usage).
+
+Reference may introduce additional examples that are unit-oriented. (minimal usage, edge-cases).
+If the guide example is already sufficient, just link to it from the reference.
+
+Follow this structure strictly; to deviate, ping @NixOS/documentation-team.
+
+
 ### One sentence per line
 
 Put each sentence in its own line.
@@ -284,7 +353,15 @@ Use the [admonition syntax](#admonitions) for callouts and examples.
 
 ### `callPackage`-compatible examples
 
-Provide at least one example per function.
+Provide at least one example per function, in its doc-comment.
+
+Keep each example at the level it documents:
+
+- A **reference example** might sometimes live in a doc-comment and show function call shape.
+- A **guide example** lives in a guide section and shows a complete task that may compose several functions.
+
+When the task is nothing more than the call itself, the guide example is enough.
+The reference example links to the guide example.
 
 Example code should be such that it can be passed to `pkgs.callPackage`.
 Instead of something like:

lib/systems/doubles.nix

@@ -14,13 +14,16 @@ let
   inherit (lib.attrsets) matchAttrs;
 
   all = [
+    # our primary systems. at the top of the list for fastest matching
+    # inside check-meta
+    "x86_64-linux"
+    "aarch64-darwin"
+    "aarch64-linux"
+
     # Cygwin
     "i686-cygwin"
     "x86_64-cygwin"
 
-    # Darwin
-    "aarch64-darwin"
-
     # FreeBSD
     "i686-freebsd"
     "x86_64-freebsd"
@@ -37,8 +40,7 @@ let
     # JS
     "javascript-ghcjs"
 
-    # Linux
-    "aarch64-linux"
+    # Linux (excluding the primary two at the top)
     "arc-linux"
     "armv5tel-linux"
     "armv6l-linux"
@@ -61,7 +63,6 @@ let
     "riscv64-linux"
     "s390-linux"
     "s390x-linux"
-    "x86_64-linux"
 
     # MMIXware
     "mmix-mmixware"

nixos/doc/manual/contributing-to-this-manual.chapter.md

@@ -35,9 +35,11 @@ Make sure that your local files aren't added to Git history by adding the follow
 /**/.direnv
 ```
 
-### `devmode` {#sec-contributing-devmode}
+### Live preview {#sec-contributing-devmode}
 
-Use [`devmode`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/de/devmode/README.md) for a live preview when editing the manual.
+Run [`devmode`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/de/devmode/README.md) for a live preview while editing the manual: it rebuilds on every change and reloads the page in your browser automatically.
+
+Changes to the renderer 'pkgs/by-name/ni/nixos-render-docs' need a manual restart. Run: `devmode` again.
 
 ## Testing redirects {#sec-contributing-redirects}
 

nixos/modules/virtualisation/nixos-containers.nix

@@ -520,7 +520,7 @@ let
     hostAddress6 = null;
     localAddress = null;
     localAddress6 = null;
-    localmacAddress = null;
+    localMacAddress = null;
     tmpfs = null;
   };
 

nixos/tests/unbound.nix

@@ -7,6 +7,7 @@
     * running a recursive DNS resolver on the local machine, forwarding to a local DNS server via TCP/853 (DoT)
     * running a recursive DNS resolver on a machine in the network awaiting input from clients over TCP/53 & UDP/53
     * running a recursive DNS resolver on a machine in the network awaiting input from clients over TCP/853 (DoT)
+    * running a recursive DNS resolver on a machine in the network awaiting input from clients over UDP/853 (DoQ)
 
   In the below test setup we are trying to implement all of those use cases.
 
@@ -100,7 +101,7 @@ in
       };
 
     # The resolver that knows that forwards (only) to the authoritative server
-    # and listens on UDP/53, TCP/53 & TCP/853.
+    # and listens on UDP/53, TCP/53, TCP/853 & UDP/853.
     resolver =
       { lib, nodes, ... }:
       {
@@ -122,7 +123,10 @@ in
           853 # DNS over TLS
           443 # DNS over HTTPS
         ];
-        networking.firewall.allowedUDPPorts = [ 53 ];
+        networking.firewall.allowedUDPPorts = [
+          53 # regular DNS
+          853 # DNS over QUIC
+        ];
 
         services.unbound = {
           enable = true;
@@ -150,6 +154,8 @@ in
               ];
               tls-service-pem = "${cert}/cert.pem";
               tls-service-key = "${cert}/key.pem";
+              quic-port = 853;
+              quic-size = "8m";
             };
             forward-zone = [
               {
@@ -306,7 +312,7 @@ in
               assert expected == out, f"Expected `{expected}` but got `{out}`"
 
 
-      def test(machine, remotes, /, doh=False, zone=zone, records=records, args=[]):
+      def test(machine, remotes, /, doh=False, doq=False, zone=zone, records=records, args=[]):
           """
           Run queries for the given remotes on the given machine.
           """
@@ -331,6 +337,15 @@ in
                           expected,
                           ["+https"] + args,
                       )
+                  if doq:
+                      query(
+                          machine,
+                          remote,
+                          query_type,
+                          zone,
+                          expected,
+                          ["+quic"] + args,
+                      )
 
 
       client.start()
@@ -348,12 +363,12 @@ in
 
       # verify that the resolver is able to resolve on all the local protocols
       with subtest("test that the resolver resolves on all protocols and transports"):
-          test(resolver, ["::1", "127.0.0.1"], doh=True)
+          test(resolver, ["::1", "127.0.0.1"], doh=True, doq=True)
 
       resolver.wait_for_unit("multi-user.target")
 
       with subtest("client should be able to query the resolver"):
-          test(client, ["${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}", "${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"], doh=True)
+          test(client, ["${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}", "${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"], doh=True, doq=True)
 
       # discard the client we do not need anymore
       client.shutdown()

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-n6UmUqfzOADzZzJMvY40gBCBKYgDtig41AD1aieA/kQ=";
+          hash = "sha256-/uvQIg773WUzalc9XFtBrocsGye3v5y1rvKyJVpXWS0=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-/T7H1itSllf1h6vPzXlwokBvNOVQjZjNuhmC/ocqmPI=";
+          hash = "sha256-zC0iYoAxmymxdqo2JgDcMOvUOA3pFbkx0s9C4F6E75k=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-qj9K/BlKbl5ZuowRMSVBXLknM6NeOxtIYynIcSE+K5A=";
+          hash = "sha256-mhZBWpV3Gl5TLieIEvrtDmtqQBKeiCcDCwOShQnp++Y=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-kXKnSZ6VQa/NPXroEbQT1pNwIy1eKnIDgOWX5WvA3JI=";
+          hash = "sha256-I570YO5mvXgzXG52NdoGjgVgHbyshm6fIkCIN0li9+4=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.199";
+      version = "2.1.201";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "windows-ai-studio";
     publisher = "ms-windows-ai-studio";
-    version = "1.6.1";
-    hash = "sha256-9q3rK/7Q7XiaH9DZN8Yvar/WTdYdEdRXH02WK1tfk5k=";
+    version = "1.6.2";
+    hash = "sha256-irI7rcyCUc3jUhrEa449pDix3MhwMh18ezvri3bi0Gk=";
   };
 
   meta = {

pkgs/applications/editors/vscode/generic.nix

@@ -308,11 +308,6 @@ stdenv.mkDerivation (
     dontConfigure = true;
     noDumpEnvVars = true;
 
-    stripExclude = lib.optional hasVsceSign [
-      # vsce-sign is a single executable application built with Node.js, and it becomes non-functional if stripped
-      "lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign"
-    ];
-
     installPhase = ''
       runHook preInstall
     ''
@@ -474,9 +469,11 @@ stdenv.mkDerivation (
           --add-needed ${libglvnd}/lib/libEGL.so.1 \
           $out/lib/${libraryName}/${executableName}
       ''
+      # restore original vsce-sign, which has integrity checks
       + (lib.optionalString hasVsceSign ''
+        cp -r ./resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign "$out/lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign"
         patchelf \
-          --add-needed ${lib.getLib openssl}/lib/libssl.so \
+          --add-needed ${lib.getLib openssl}/lib/libssl.so.3 \
           $out/lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign
       '')
     );

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1319,11 +1319,11 @@
     "vendorHash": "sha256-7ZoJg1HEVj5Nygr46lmBZeJDfZuU4F90yntrgkBVgGg="
   },
   "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-p8AW+AzezOP6N3wzlLZOMoTbSwb/cil7cmXkdwheXtE=",
+    "hash": "sha256-tADmls3GAmR3S5wdasoHrBYOtZTVXDS2alZD6Mzfo4M=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.83.6",
+    "rev": "v1.83.7",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1508,12 +1508,12 @@
     "vendorHash": "sha256-8p6dJwGyTK+qtgplSLtIRKxnNAQAgHfs4z/EsBcg/iY="
   },
   "yandex-cloud_yandex": {
-    "hash": "sha256-/t4HHlZ/E4QM4vvJAUzn+uJIox3Duqxl0/3Hu4AGGak=",
+    "hash": "sha256-7IyFMqzkdZ2wd5KUo5eNXUr847f3VhyYKDxwMKYZ+j0=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.209.0",
+    "rev": "v0.213.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-UKWLZp64nvohXqYHMhRB+nWfUKSYyGJBMpo1nk792XY="
+    "vendorHash": "sha256-JoOuqaiQFWWjnH/HjLxvznnyqQauxSef1KRQTMrhoGQ="
   }
 }

pkgs/by-name/ai/air-formatter/package.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   versionCheckHook,
   nix-update-script,
+  installShellFiles,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "air-formatter";
@@ -32,6 +33,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
     updateScript = nix-update-script { };
   };
 
+  nativeBuildInputs = [ installShellFiles ];
+  # TODO: Upstream also provides Elvish and PowerShell completions,
+  # but `installShellCompletion` only has support for Bash, Zsh and Fish at the moment.
+  postInstall = ''
+    installShellCompletion --cmd air-formatter \
+      --bash <($out/bin/air generate-shell-completion bash) \
+      --fish <($out/bin/air generate-shell-completion fish) \
+      --zsh  <($out/bin/air generate-shell-completion zsh)
+  '';
+
   meta = {
     description = "Extremely fast R code formatter";
     homepage = "https://posit-dev.github.io/air";

pkgs/by-name/be/beeper/package.nix

@@ -10,10 +10,10 @@
 }:
 let
   pname = "beeper";
-  version = "4.2.948";
+  version = "4.2.957";
   src = fetchurl {
     url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-x86_64.AppImage";
-    hash = "sha256-MvfQSCV8b5aOeOSlTnRlOupzg+wmHhG0hGWznwCx0Yc=";
+    hash = "sha256-wUGUwWopQ8ox2+UP5hXIIF2XVLQmZyhfb712S8JjTGk=";
   };
   appimageContents = appimageTools.extract {
     inherit pname version src;

pkgs/by-name/ca/cargo-tally/package.nix

@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-tally";
-  version = "1.0.74";
+  version = "1.0.75";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-JZtELsvxOx6FFQ+l8fbhPnR8Tt+sQWV4fGsoS8ue4QY=";
+    hash = "sha256-X3VJfzIXxwHPu31wYo79Ei6+S970UHlPPTADlB4CwjI=";
   };
 
-  cargoHash = "sha256-Vn5OSJNpwE3rjs+tYX784o1Khrcf4f21dvb8Yn/c9bY=";
+  cargoHash = "sha256-86V96i5DvydXu1mzxRP6hWW3TA25piubcGRYVJIi/x0=";
 
   meta = {
     description = "Graph the number of crates that depend on your crate over time";

pkgs/by-name/cl/claude-code/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.199",
-  "commit": "968b0c4118bde7c998acd97511e68daecacd8507",
-  "buildDate": "2026-07-02T01:58:04Z",
+  "version": "2.1.201",
+  "commit": "5bb45156ece6b12214696c88adec695b2dca1338",
+  "buildDate": "2026-07-03T20:01:44Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "e3cb61abc8a2ec7b98976cee1ffdde5a3fa755c9990bc8d688cd89290e0dcec0",
-      "size": 232155536
+      "checksum": "a0852d76afc47b30f5cb0b7625ec9a7714cb189f2eeef6c28c77e2be954fb7fd",
+      "size": 231708784
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "e64853ff3bc2ae6ed8115581c851e1176762d445d0b8b9e0dd37d0d560224a88",
-      "size": 240192080
+      "checksum": "1889287a92d25356ae8bd8d8e67b11456015516ee8ba4277a0c7074786c49bb6",
+      "size": 241100240
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "14851b5170b154b01baca09bba970172e70cdd768b5a012bf347ba0f594b4ad3",
-      "size": 247184112
+      "checksum": "86b2eab34d382c7b428fc2e9f4c97f04e46805e950582472a13eb7d48de60516",
+      "size": 248101616
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "b31dfd5e3dee23b51c42e0d8ddb405148978237d3aabc8cbbf77c5cf83367e27",
-      "size": 250383160
+      "checksum": "a34809a6839fdefff21b9347d7fb5b6b58e6a9cc208a5e62853f29c83eb107a3",
+      "size": 251300664
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "4115c07bc6dfa71affff595400599032b70b4ab25b7a2dae982341ef4da47b38",
-      "size": 240432312
+      "checksum": "5b4cde588b0196c8f88654ca9652c4703788f4d9fbab32a17ab3c444830085ae",
+      "size": 241349816
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "22c8b0861078cef1b572023e7eda4ce0dda7e12cc2e3060858eaa3de010bee21",
-      "size": 245068160
+      "checksum": "a0f81ec99ac65e8c5919e7aae54b8a496488e0f1311884fc9ffd05c7cbf6bd2f",
+      "size": 245985664
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "63de670613bb74594564a2125cb54e0e2e78192c5696e396adfae093b9132eec",
-      "size": 240716448
+      "checksum": "fb804ee019bfbb8d7e85abf965e528e53b5aa5a4e4ebc0f164139dc10a9e0320",
+      "size": 241591968
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "7e4900b1ce5588003e0ade6caa0aaef1e2b8efd903c5a86c671d0de258b7a4d4",
-      "size": 235182752
+      "checksum": "a3ad78a0b593dea94c3ee787b1f5b17a173a7679203a296acf9aae7ef4705d42",
+      "size": 236058784
     }
   }
 }

pkgs/by-name/da/dawarich/gemset.nix

@@ -598,10 +598,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
+      sha256 = "1c2i64xsd35vijnb50rxb70g508s0x674xi0qpyyb8jy7bncl4j4";
       type = "gem";
     };
-    version = "1.3.6";
+    version = "1.3.7";
   };
   connection_pool = {
     groups = [
@@ -993,10 +993,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1b930ag8nh99v8n9645ac1wcah9fx0mclbp323q4i1ly9acvkk3k";
+      sha256 = "0y7j6yzv07zggic6g0p2v1ivnvkzsbqjnfdl4215qqb6cxz290hq";
       type = "gem";
     };
-    version = "2.14.2";
+    version = "2.14.3";
   };
   faraday-follow_redirects = {
     dependencies = [ "faraday" ];
@@ -1756,10 +1756,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
+      sha256 = "1d9safb4dly6qmc2g06444l0zifby52yy6j1a5fa1g4j3ihm3jah";
       type = "gem";
     };
-    version = "1.19.3";
+    version = "1.19.4";
   };
   oauth2 = {
     dependencies = [

pkgs/by-name/da/dawarich/sources.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.9.1",
-  "hash": "sha256-ukpX2HOGNh14vbH/2UgjIU13PMBIA8Es2p7sBySAgVQ=",
+  "version": "1.9.2",
+  "hash": "sha256-vUJPMwzYZK/UAFiqnn0fkJH7GJjdBkewfYikK35Tbb4=",
   "npmHash": "sha256-sUDEqvqNrztedUGZRRkD2ythpBQQwpqJz/QleUvqz0Y="
 }

pkgs/by-name/de/devin-cli/package.nix

@@ -7,29 +7,29 @@
 }:
 
 let
-  version = "2026.8.18";
+  version = "3000.1.23";
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://static.devin.ai/cli/${version}/devin-${version}-x86_64-unknown-linux.tar.gz";
-      hash = "sha256-3Uu6IFkwhr9whHR5LBGrDJQovlskGf9cGC7F8QmaBmE=";
+      hash = "sha256-m7DOI/PY0ldm4kRmAxeEQXTiH/R2oT3R8igmtXYA40g=";
     };
 
     aarch64-linux = fetchurl {
       url = "https://static.devin.ai/cli/${version}/devin-${version}-aarch64-unknown-linux.tar.gz";
-      hash = "sha256-En56i68uCcsP0jhxr5idyeMuO/p/SXsfZWDMUvW/GcY=";
+      hash = "sha256-oOZjPyr3sgaH54KBWQhODFwxrEnuhkTW/rVPwXUAeUY=";
     };
 
     aarch64-darwin = fetchurl {
       url = "https://static.devin.ai/cli/${version}/devin-${version}-aarch64-apple-darwin.tar.gz";
-      hash = "sha256-n0GtTUnA9OYw4VmAQkGA4rcOGk9ifwYz+ouyJEkZpAo=";
+      hash = "sha256-x+g7kILZuWG2JX4tc+GdIE7XqpHIzWt6+xPQU/gzyeA=";
     };
 
     x86_64-darwin = fetchurl {
       url = "https://static.devin.ai/cli/${version}/devin-${version}-x86_64-apple-darwin.tar.gz";
-      hash = "sha256-KZ7FeZjOIR+/vW7Tt3BOBQUsShXOglaRbxxGSR6R2Bg=";
+      hash = "sha256-LF1Mk53ds28Avvq+TtyvIu/BPYSHm9tBVjAlUXAyJVU=";
     };
   };
 in

pkgs/by-name/dr/drm_info/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitLab,
   libdrm,
+  libdisplay-info,
   json_c,
   pciutils,
   meson,
@@ -14,18 +15,23 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "drm_info";
-  version = "2.8.0";
+  version = "2.10.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "emersion";
     repo = "drm_info";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-LtZ7JJmVNWMjJL2F6k+tcBpJ2v2fd+HNWyHAOvIi7Ko=";
+    hash = "sha256-QKF0frDPelwHOzf3r0tzSo7i1WfGhcFGJfxf2bj1+OE=";
   };
 
   strictDeps = true;
 
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace-fail "'<2.4.134'" "'<2.4.133'"
+  '';
+
   depsBuildBuild = [
     pkg-config
   ];
@@ -39,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     libdrm
+    libdisplay-info
     json_c
     pciutils
   ];

pkgs/by-name/fl/flye/package.nix

@@ -56,7 +56,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   meta = {
     description = "De novo assembler for single molecule sequencing reads using repeat graphs";
-    homepage = "https://github.com/fenderglass/Flye";
+    homepage = "https://github.com/mikolmogorov/Flye";
     license = lib.licenses.bsd3;
     mainProgram = "flye";
     maintainers = with lib.maintainers; [ assistant ];

pkgs/by-name/gh/gh-dash/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gh-dash";
-  version = "4.24.1";
+  version = "4.25.0";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "gh-dash";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-eNmOSYsmB+G0VgVn1ITo/mUyYSeXz43goG/VjYqmiQI=";
+    hash = "sha256-gdjP1jIYI84szuNhP7LgGRMXIPqrRwb8nRWB0BjQF+k=";
   };
 
-  vendorHash = "sha256-fXgj2q0HAGu9Jfdy7NJ6iE5hEKmt50HAEg/9Wds56g0=";
+  vendorHash = "sha256-Teu+8jiZE2gZ+0ErKsunhotY9W4Hjg6PAeFkFLgESIk=";
 
   ldflags = [
     "-s"

pkgs/by-name/gi/gitqlient/package.nix

@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
   env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations"; # QCheckBox::stateChanged is deprecated
 
   meta = {
-    homepage = "https://github.com/francescmm/GitQlient";
+    homepage = "https://github.com/francescmaestre/GitQlient";
     description = "Multi-platform Git client written with Qt";
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.linux;

pkgs/by-name/gr/grav/package.nix

@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.7.53";
+  version = "1.7.53.2";
 in
 stdenvNoCC.mkDerivation {
   pname = "grav";
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchzip {
     url = "https://github.com/getgrav/grav/releases/download/${version}/grav-admin-v${version}.zip";
-    hash = "sha256-Ug8sIEMwIoCUyHpxk5NaGHaJA7lThgbUuu+8NpmI9YI=";
+    hash = "sha256-6cQotHwIwWFR5phFQI9r79jpd+iYA1HpFBbYIzEVBsc=";
   };
 
   patches = [

pkgs/by-name/ld/ldacbt/make-byte-order-checks-portable.patch

@@ -0,0 +1,55 @@
+diff --git a/src/ldacBT_internal.c b/src/ldacBT_internal.c
+index 94458854fe..ca9df42c72 100644
+--- a/src/ldacBT_internal.c
++++ b/src/ldacBT_internal.c
+@@ -241,7 +241,7 @@
+             char *p_pcm_8 = (char *)pbuff;
+             char *p_lch_8 = (char *)ap_pcm[0];
+             char *p_rch_8 = (char *)ap_pcm[1];
+-#if __BYTE_ORDER == __LITTLE_ENDIAN
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+             for (i = 0; i < nsmpl; i++) {
+                 *p_lch_8++ = p_pcm_8[0];
+                 *p_lch_8++ = p_pcm_8[1];
+@@ -252,24 +252,24 @@
+                 *p_rch_8++ = p_pcm_8[2];
+                 p_pcm_8+=3;
+             }
+-#else   /* __BYTE_ORDER */
++#else   /* __BYTE_ORDER__ */
+ #error unsupported byte order
+-#endif  /* #if __BYTE_ORDER == __LITTLE_ENDIAN */
++#endif  /* #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ */
+         }
+         else if ( fmt == LDACBT_SMPL_FMT_S32 ){
+             char *p_pcm_8 = (char *)pbuff;
+             char *p_lch_8 = (char *)ap_pcm[0];
+             char *p_rch_8 = (char *)ap_pcm[1];
+-#if __BYTE_ORDER == __LITTLE_ENDIAN
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+             for (i = 0; i < nsmpl; i++) {
+                 *p_lch_8++ = p_pcm_8[0]; *p_lch_8++ = p_pcm_8[1]; *p_lch_8++ = p_pcm_8[2]; *p_lch_8++ = p_pcm_8[3];
+                 p_pcm_8+=4;
+                 *p_rch_8++ = p_pcm_8[0]; *p_rch_8++ = p_pcm_8[1]; *p_rch_8++ = p_pcm_8[2]; *p_rch_8++ = p_pcm_8[3];
+                 p_pcm_8+=4;
+             }
+-#else   /* __BYTE_ORDER */
++#else   /* __BYTE_ORDER__ */
+ #error unsupported byte order
+-#endif  /* #if __BYTE_ORDER == __LITTLE_ENDIAN */
++#endif  /* #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ */
+         }
+         else if ( fmt == LDACBT_SMPL_FMT_F32 ){
+             float *p_pcm = (float *)pbuff;
+diff --git a/src/ldacBT_internal.h b/src/ldacBT_internal.h
+index 70dac607e7..170d14be7d 100644
+--- a/src/ldacBT_internal.h
++++ b/src/ldacBT_internal.h
+@@ -9,7 +9,6 @@
+ 
+ #include <stdlib.h>
+ #include <string.h>
+-#include <endian.h>
+ #ifdef ANDROID
+ #include <stdint.h>
+ #include <unistd.h>

pkgs/by-name/ld/ldacbt/meson.build

@@ -0,0 +1,52 @@
+project(
+  'ldacbt',
+  'c',
+  meson_version: '>=1.10.0',
+  version: files('VERSION'),
+)
+
+pkg = import('pkgconfig')
+
+cc = meson.get_compiler('c')
+dep_m = cc.find_library('m')
+
+lib = library(
+  'ldacBT',
+  'abr/src/ldacBT_abr.c',
+  'src/ldacBT.c',
+  'src/ldaclib.c',
+  include_directories: [
+    'abr/inc',
+    'inc',
+  ],
+  dependencies: [dep_m],
+  version: meson.project_version(),
+  install: true,
+)
+
+install_headers(
+  'abr/inc/ldacBT_abr.h',
+  'inc/ldacBT.h',
+  subdir: 'ldac',
+)
+
+pkg.generate(
+  lib,
+  name: 'ldacBT-enc',
+  description: 'LDAC Bluetooth encoder',
+  subdirs: 'ldac',
+)
+
+pkg.generate(
+  lib,
+  name: 'ldacBT-abr',
+  description: 'LDAC Bluetooth ABR library',
+  subdirs: 'ldac',
+)
+
+pkg.generate(
+  lib,
+  name: 'ldacBT-dec',
+  description: 'LDAC Bluetooth decoder',
+  subdirs: 'ldac',
+)

pkgs/by-name/ld/ldacbt/package.nix

@@ -2,10 +2,12 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  meson,
+  ninja,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "ldacBT";
+  pname = "ldacbt";
   version = "2.0.72";
 
   src = fetchFromGitHub {
@@ -22,96 +24,38 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./0001-abr-drop-support-for-dynamic-loading-libldac.patch
+
+    # Darwin doesn’t have `<endian.h>`; use the predefined GCC/Clang
+    # macros instead.
+    ./make-byte-order-checks-portable.patch
   ];
 
-  env.NIX_CFLAGS_COMPILE = "-O2 -fPIC -fno-merge-constants -Wall -Iinc -Isrc -Iabr/inc";
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  mesonBuildType = "release";
+
+  # The upstream build system is tied to AOSP, so we use our own Meson
+  # definitions to replace it.
+  postPatch = ''
+    ln -s ${./meson.build} meson.build
 
-  # Verify finalAttrs.version matches LDACBT_LIB_VER_* in upstream source.
-  # Guards against silent version drift when the pinned commit changes.
-  preBuild = ''
     awk -v want=${finalAttrs.version} '
       /^#define LDACBT_LIB_VER_/ { v = v sep ($3+0); sep = "." }
       END {
         if (v != want) { print "version mismatch: package says " want ", source reports " v > "/dev/stderr"; exit 1 }
+        print v
       }
-    ' src/ldacBT_api.c
-  '';
-
-  # Upstream ships AOSP build files and a gcc/ makefile that only knows
-  # about the in-tree layout. Compile and link directly; the entire
-  # library is two umbrella translation units.
-  buildPhase = ''
-    runHook preBuild
-
-    soname=libldacBT.so.${lib.versions.major finalAttrs.version}
-    sofile=libldacBT.so.${finalAttrs.version}
-
-    $CC -shared -Wl,-soname,$soname src/ldaclib.c src/ldacBT.c abr/src/ldacBT_abr.c -lm -o $sofile
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 -t $out/lib $sofile
-    ln -s $sofile $out/lib/$soname
-    ln -s $sofile $out/lib/libldacBT.so
-
-    install -Dm644 inc/ldacBT.h $dev/include/ldac/ldacBT.h
-    install -Dm644 abr/inc/ldacBT_abr.h $dev/include/ldac/ldacBT_abr.h
-
-    mkdir -p $dev/lib/pkgconfig
-    cat > $dev/lib/pkgconfig/ldacBT-dec.pc <<EOF
-    prefix=$out
-    exec_prefix=\''${prefix}
-    libdir=$out/lib
-    includedir=$dev/include/ldac
-
-    Name: ldacBT-dec
-    Description: LDAC Bluetooth decoder
-    Version: ${finalAttrs.version}
-    Libs: -L\''${libdir} -lldacBT
-    Libs.private: -lm
-    Cflags: -I\''${includedir}
-    EOF
-
-    cat > $dev/lib/pkgconfig/ldacBT-enc.pc <<EOF
-    prefix=$out
-    exec_prefix=\''${prefix}
-    libdir=$out/lib
-    includedir=$dev/include/ldac
-
-    Name: ldacBT-enc
-    Description: LDAC Bluetooth encoder
-    Version: ${finalAttrs.version}
-    Libs: -L\''${libdir} -lldacBT
-    Libs.private: -lm
-    Cflags: -I\''${includedir}
-    EOF
-
-    cat > $dev/lib/pkgconfig/ldacBT-abr.pc <<EOF
-    prefix=$out
-    exec_prefix=\''${prefix}
-    libdir=$out/lib
-    includedir=$dev/include/ldac
-
-    Name: ldacBT-abr
-    Description: LDAC Bluetooth ABR library
-    Version: ${finalAttrs.version}
-    Libs: -L\''${libdir} -lldacBT
-    Libs.private: -lm
-    Cflags: -I\''${includedir}
-    EOF
-
-    runHook postInstall
+    ' src/ldacBT_api.c > VERSION
   '';
 
   meta = {
     description = "Sony LDAC Bluetooth decoder library (from AOSP via open-vela)";
     homepage = "https://github.com/open-vela/external_libldac";
     license = lib.licenses.asl20;
-    # LDAC bitstream format assumes LE; source has endian checks
+    # libldac code detects & #error's out on non-LE byte order
     platforms = lib.platforms.littleEndian;
     maintainers = with lib.maintainers; [ qweered ];
   };

pkgs/by-name/li/libcava/package.nix

@@ -8,13 +8,13 @@
 cava.overrideAttrs (old: rec {
   pname = "libcava";
   # fork may not be updated when we update upstream
-  version = "0.10.6";
+  version = "0.10.7";
 
   src = fetchFromGitHub {
     owner = "LukashonakV";
     repo = "cava";
     tag = version;
-    hash = "sha256-63be1wypMiqhPA6sjMebmFE6yKpTj/bUE53sMWun554=";
+    hash = "sha256-zkyj1vBzHtoypX4Bxdh1Vmwh967DKKxN751v79hzmgQ=";
   };
 
   nativeBuildInputs = old.nativeBuildInputs ++ [

pkgs/by-name/li/libphonenumber/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libphonenumber";
-  version = "9.0.33";
+  version = "9.0.34";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "libphonenumber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YsTvJgHBLrIWDJH/SooYDu1ecZyFib7PAqdqcOhHc8Q=";
+    hash = "sha256-KWn58r2Dnh9DMwiESmrF/pN5LPuYe0G7z3TeM+Zp6ZA=";
   };
 
   patches = [

pkgs/by-name/ma/maigret/package.nix

@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "maigret";
-  version = "0.6.1";
+  version = "0.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "soxoj";
     repo = "maigret";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gojeqNZd0n5Qs7YVFBy6zDdjXR6KKdebcu8vfNs/AE8=";
+    hash = "sha256-KgSf0lM8euahWRYT+acuoH6C+NN08IzkVGzytfnvHEg=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/na/nagstamon/package.nix

@@ -7,14 +7,16 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nagstamon";
-  version = "3.16.2";
+  version = "3.18.2";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "HenriWahl";
     repo = "Nagstamon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9w8ux+AeSg0vDhnk28/2eCE2zYLvAjD7mB0pJBMFs2I=";
+    hash = "sha256-ZA6gxV9zLKZ0g5v8CvnAuiYPhEDByz17kC54Idk9CYM=";
   };
 
   build-system = with python3Packages; [ setuptools ];
@@ -46,6 +48,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     requests
     requests-kerberos
     setuptools
+    tzlocal
   ];
 
   nativeCheckInputs = with python3Packages; [

pkgs/by-name/ni/nixpkgs-openjdk-updater/nixpkgs-openjdk-updater/pyproject.toml

@@ -28,7 +28,7 @@ line-length = 80
 
 [tool.ruff.lint]
 select = ["ALL"]
-ignore = ["COM812", "D203", "D213", "ISC001", "T201"]
+ignore = ["COM812", "D203", "D213", "ISC001", "T201", "S607"]
 allowed-confusables = ["’"]
 
 [tool.ruff.format]

pkgs/by-name/ni/nixpkgs-vet/package.nix

@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nixpkgs-vet";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "nixpkgs-vet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vOKZ5Da6PMI39WlOS7CXDME3oCvJw64dQDEfaCsDL0A=";
+    hash = "sha256-+A4KmOIOC7glVOdW+jxSwQnrBHVej4QqwxTsOQin07U=";
   };
 
-  cargoHash = "sha256-9XQvmYO4bw57NoKsXTY281fMQE0vjV3pvoRlrUaRX3o=";
+  cargoHash = "sha256-bWmI79H6yQjxoWxcZ7GgqbxIc8fCLB1I4g9WF2IejVI=";
 
   doCheck = false;
 

pkgs/by-name/op/openrsync/package.nix

@@ -2,21 +2,33 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation {
   pname = "openrsync";
-  version = "unstable-2025-01-27";
+  version = "0.5.0-unstable-2026-05-31";
 
   src = fetchFromGitHub {
     owner = "kristapsdz";
     repo = "openrsync";
-    rev = "a257c0f495af2b5ee6b41efc6724850a445f87ed";
-    hash = "sha256-pc1lo8d5FY8/1K2qUWzSlrSnA7jnRg4FQRyHqC8I38k=";
+    rev = "48070e68d73f67d6922b2ffc8c2dee9754e659c6";
+    hash = "sha256-9ApkHIak1/XQn1nMwdC0iiZEzZI2gHCOIj8P6bQPFyA=";
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+  enableParallelBuilding = true;
+
   # Uses oconfigure
-  prefixKey = "PREFIX=";
+  env.prefixKey = "PREFIX=";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex=^VERSION_(\\d+)_(\\d+)_(\\d+.*)"
+      "--version=branch"
+    ];
+  };
 
   meta = {
     homepage = "https://www.openrsync.org/";

pkgs/by-name/ph/photoqt/package.nix

@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "photoqt";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchurl {
     url = "https://photoqt.org/downloads/source/photoqt-${finalAttrs.version}.tar.gz";
-    hash = "sha256-NuZET8uS7sxRXvpJGKiOulUvb/y5/O6LYXyr0RBln+4=";
+    hash = "sha256-Gifem+gVPmpF7uhiD2atejtFmOVuu7t2ZLKHMNS5yvY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/re/retroarch-assets/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "retroarch-assets";
-  version = "1.22.0-unstable-2026-04-11";
+  version = "1.22.0-unstable-2026-06-27";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "retroarch-assets";
-    rev = "cd17f64cff4eaff187a0702d17520ccb9a760fe3";
-    hash = "sha256-v+zHGv7hMZ0Esq36hb+CvfnxEUtDjCAWwrRxmtLiiGY=";
+    rev = "a12a7be0898de32ab3eefb891e6778ff5130e5fb";
+    hash = "sha256-Mhp9+Mr/M79ZqIt9H6RrciOH+bE1cI5TLTjGzz4zKrw=";
   };
 
   makeFlags = [

pkgs/by-name/sn/snip/package.nix

@@ -2,21 +2,24 @@
   lib,
   fetchFromGitHub,
   buildGoModule,
+  gitMinimal,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "snip";
-  version = "0.15.0";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "edouard-claude";
     repo = "snip";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pRYxTHNdR2NGiE+RdThcmz3zVP5rKVRbt+IEILIgavk=";
+    hash = "sha256-u6Jc9U4tb5Y/evtWR/Nw535xVh09ChcKN0Dm+l3bjvA=";
   };
 
   vendorHash = "sha256-2MxFZqjNuLzcuu+bsLyOyHIakCxh7j0FUx8LsjZRhrY=";
 
+  nativeCheckInputs = [ gitMinimal ];
+
   ldflags = [
     "-s"
     "-w"

pkgs/by-name/tr/trufflehog/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "trufflehog";
-  version = "3.95.7";
+  version = "3.95.8";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vCn3V19UOIZg54ppPRnPGEJOtmHO4zkmy7vzu94gscc=";
+    hash = "sha256-STrdxRwo3Q5dE9TmQRzMPtNPBatEWYffO3+cXsAzykI=";
   };
 
   vendorHash = "sha256-KVocEbpKYN/PE1Dnx4KO4V8AGEfYoNMKWZsAtXhLXv4=";

pkgs/by-name/un/unbound/package.nix

@@ -31,6 +31,8 @@
   systemd ? null,
   # optionally support DNS-over-HTTPS as a server
   withDoH ? false,
+  # optionally support DNS-over-QUIC as a server
+  withDoQ ? false,
   withECS ? false,
   withDNSCrypt ? false,
   withDNSTAP ? false,
@@ -38,7 +40,7 @@
   withRedis ? false,
   # Avoid .lib depending on lib.getLib openssl
   # The build gets a little hacky, so in some cases we disable this approach.
-  withSlimLib ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isMusl && !withDNSTAP,
+  withSlimLib ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isMusl && !withDNSTAP && !withDoQ,
   # enable support for python plugins in unbound: note this is distinct from pyunbound
   # see https://unbound.docs.nlnetlabs.nl/en/latest/developer/python-modules.html
   withPythonModule ? false,
@@ -47,6 +49,7 @@
   withLto ? !stdenv.hostPlatform.isStatic && !stdenv.hostPlatform.isMinGW,
   withMakeWrapper ? !stdenv.hostPlatform.isMinGW,
   libnghttp2,
+  ngtcp2,
 
   # for passthru.updateScript
   nix-update-script,
@@ -55,6 +58,9 @@
   versionCheckHook,
 }:
 
+assert lib.assertMsg (
+  !withDoQ || lib.versionAtLeast openssl.version "3.5.0"
+) "unbound: withDoQ requires OpenSSL with QUIC support (OpenSSL >= 3.5)";
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
   version = "1.25.1";
@@ -90,6 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals withSystemd [ systemd ]
   ++ lib.optionals withDoH [ libnghttp2 ]
+  ++ lib.optionals withDoQ [ ngtcp2 ]
   ++ lib.optionals withPythonModule [ python ];
 
   enableParallelBuilding = true;
@@ -120,6 +127,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withDoH [
     "--with-libnghttp2=${libnghttp2.dev}"
   ]
+  ++ lib.optionals withDoQ [
+    "--with-libngtcp2=${ngtcp2.dev}"
+  ]
   ++ lib.optionals withECS [
     "--enable-subnet"
   ]

pkgs/by-name/un/unrar/package.nix

@@ -6,12 +6,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unrar";
-  version = "7.2.6";
+  version = "7.2.7";
 
   src = fetchzip {
     url = "https://www.rarlab.com/rar/unrarsrc-${finalAttrs.version}.tar.gz";
     stripRoot = false;
-    hash = "sha256-rYW8ytF/eyhlgmQugbPXSyaQOPu+UmP6A6xmKh80iuE=";
+    hash = "sha256-X0MOIbsIL5iczClCLSj8UX0ofLHBu1Asap4EKKbLVnw=";
   };
 
   sourceRoot = finalAttrs.src.name;

pkgs/by-name/wl/wl-vapi-gen/package.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitea,
+  meson,
+  ninja,
+  python3,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "wl-vapi-gen";
+  version = "1.1.0";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "kotontrion";
+    repo = "wl-vapi-gen";
+    tag = finalAttrs.version;
+    hash = "sha256-Wi6zDrabUjIXJuxRJ9oHYfKF1ULkim/5kHGb+pl0oc4=";
+  };
+
+  postPatch = ''
+    patchShebangs wl-vapi-gen.py
+  '';
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    python3
+  ];
+
+  meta = {
+    description = "Generate vala bindings for wayland protocols";
+    homepage = "https://codeberg.org/kotontrion/wl-vapi-gen";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.PerchunPak ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/ze/zed-editor/package.nix

@@ -98,7 +98,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "1.8.2";
+  version = "1.9.0";
 
   outputs = [
     "out"
@@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j8CwQnVBHvc//4O2N55+4AAAhcARNHGEcccUoSHK8d4=";
+    hash = "sha256-jD77wB/86DsZKO6Qh7pyszK4QgkzfgJthdQhbPVKeh0=";
   };
 
   postPatch = ''
@@ -134,7 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail 'builder.include(&glib_path_config);' 'builder.include("${lib.getLib glib}/lib/glib-2.0/include");'
   '';
 
-  cargoHash = "sha256-zTAIGL5cmswjRqaBgEN+aiyAXMMY9OYZ2bfd6sd1c4Y=";
+  cargoHash = "sha256-sISPA9qZriyN2po3LM5n/YCdosQBgNnA4n9tmq/UC7w=";
 
   __structuredAttrs = true;
 

pkgs/by-name/zo/zoxide/package.nix

@@ -15,13 +15,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zoxide";
-  version = "0.9.9";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "ajeetdsouza";
     repo = "zoxide";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2scJ5/+A3ZSpIdce5GLYqxjc0so9sVsYiXNULmjMzLY=";
+    hash = "sha256-BLGjsmljY2UZSWmbRX+Xf5sIgSBrDviKGzXjyGmB+2w=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace '"fzf"' '"${fzf}/bin/fzf"'
   '';
 
-  cargoHash = "sha256-4BXZ5NnwY2izzJFkPkECKvpuyFWfZ2CguybDDk0GDU0=";
+  cargoHash = "sha256-5Be/eIMn3JurFIhoPK6B5L054lLPek9CR93zTJzJS6w=";
 
   passthru = {
     tests = {

pkgs/development/compilers/swift/swiftpm/default.nix

@@ -135,6 +135,11 @@ let
           # so we don't have to account for that scenario.
           "-DCMAKE_BUILD_WITH_INSTALL_NAME_DIR=ON"
         ];
+
+        # TODO: Clean up on `staging`.
+        env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+          NIX_LDFLAGS = "-headerpad_max_install_names";
+        };
       }
     );
 

pkgs/development/compilers/swift/wrapper/default.nix

@@ -5,6 +5,10 @@
   useSwiftDriver ? true,
   swift-driver,
   clang,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
+  writeShellScriptBin,
 }:
 
 stdenv.mkDerivation (
@@ -90,6 +94,15 @@ stdenv.mkDerivation (
           cp "$input" "$out/nix-support/$(basename "$input")"
         done
       fi
+    ''
+    # TODO: Clean up on `staging`.
+    + lib.optionalString stdenv.targetPlatform.isDarwin ''
+      printf "NIX_SWIFTFLAGS_COMPILE+=' -use-ld=lld -tools-directory %s'\n" \
+        ${writeShellScriptBin "ld" ''
+          exec ${lib.getExe' llvmPackages.lld "ld64.lld"} "$@"
+        ''}/bin \
+        >> $out/nix-support/setup-hook
+      printf '%s\n' ${lib.getBin llvmPackages.lld} >> $out/nix-support/propagated-build-inputs
     '';
 
     passthru = {

pkgs/development/libraries/astal/default.nix

@@ -9,6 +9,7 @@ self: {
   auth = self.callPackage ./modules/auth.nix { };
   battery = self.callPackage ./modules/battery.nix { };
   bluetooth = self.callPackage ./modules/bluetooth.nix { };
+  brightness = self.callPackage ./modules/brightness.nix { };
   cava = self.callPackage ./modules/cava.nix { };
   gjs = self.callPackage ./modules/gjs.nix { };
   greet = self.callPackage ./modules/greet.nix { };
@@ -18,7 +19,9 @@ self: {
   network = self.callPackage ./modules/network.nix { };
   notifd = self.callPackage ./modules/notifd.nix { };
   powerprofiles = self.callPackage ./modules/powerprofiles.nix { };
+  quarrel = self.callPackage ./modules/quarrel.nix { };
   river = self.callPackage ./modules/river.nix { };
   tray = self.callPackage ./modules/tray.nix { };
   wireplumber = self.callPackage ./modules/wireplumber.nix { inherit wireplumber; };
+  wl = self.callPackage ./modules/wl.nix { };
 }

pkgs/development/libraries/astal/modules/brightness.nix

@@ -0,0 +1,13 @@
+{
+  buildAstalModule,
+  json-glib,
+  quarrel,
+}:
+buildAstalModule {
+  name = "brightness";
+  buildInputs = [
+    json-glib
+    quarrel
+  ];
+  meta.description = "Astal module for brightness devices";
+}

pkgs/development/libraries/astal/modules/greet.nix

@@ -1,6 +1,13 @@
-{ buildAstalModule, json-glib }:
+{
+  buildAstalModule,
+  json-glib,
+  quarrel,
+}:
 buildAstalModule {
   name = "greet";
-  buildInputs = [ json-glib ];
+  buildInputs = [
+    json-glib
+    quarrel
+  ];
   meta.description = "Astal module for greetd using IPC";
 }

pkgs/development/libraries/astal/modules/mpris.nix

@@ -2,12 +2,16 @@
   buildAstalModule,
   gvfs,
   json-glib,
+  libsoup_3,
+  quarrel,
 }:
 buildAstalModule {
   name = "mpris";
   buildInputs = [
     gvfs
     json-glib
+    libsoup_3
+    quarrel
   ];
   meta.description = "Astal module for mpris players";
 }

pkgs/development/libraries/astal/modules/notifd.nix

@@ -2,12 +2,14 @@
   buildAstalModule,
   json-glib,
   gdk-pixbuf,
+  quarrel,
 }:
 buildAstalModule {
   name = "notifd";
   buildInputs = [
     json-glib
     gdk-pixbuf
+    quarrel
   ];
   meta.description = "Astal module for notification daemon";
 }

pkgs/development/libraries/astal/modules/quarrel.nix

@@ -0,0 +1,5 @@
+{ buildAstalModule }:
+buildAstalModule {
+  name = "quarrel";
+  meta.description = "Astal module for command line argument parsing";
+}

pkgs/development/libraries/astal/modules/river.nix

@@ -1,7 +1,16 @@
-{ buildAstalModule, json-glib }:
+{
+  buildAstalModule,
+  json-glib,
+  wl,
+  wl-vapi-gen,
+}:
 buildAstalModule {
   name = "river";
-  buildInputs = [ json-glib ];
+  nativeBuildInputs = [ wl-vapi-gen ];
+  buildInputs = [
+    json-glib
+    wl
+  ];
   meta.description = "Astal module for River using IPC";
 
   postUnpack = ''

pkgs/development/libraries/astal/modules/wl.nix

@@ -0,0 +1,6 @@
+{ buildAstalModule, wl-vapi-gen }:
+buildAstalModule {
+  name = "wl";
+  nativeBuildInputs = [ wl-vapi-gen ];
+  meta.description = "Central wayland connection manager";
+}

pkgs/development/libraries/astal/source.nix

@@ -7,15 +7,15 @@ let
   originalDrv = fetchFromGitHub {
     owner = "Aylur";
     repo = "astal";
-    rev = "7d1fac8a4b2a14954843a978d2ddde86168c75ef";
-    hash = "sha256-Jh4VtPcK2Ov+RTcV9FtyQRsxiJmXFQGfqX6jjM7/mgc=";
+    rev = "11842ae3045c1367fb3a62a2302dba0d9ccb4a33";
+    hash = "sha256-FGZHls4eQJ8y3pvf5h3b83PfXlve3vD/Gj3g1qoAK6o=";
   };
 in
 originalDrv.overrideAttrs (
   final: prev: {
     name = "${final.pname}-${final.version}"; # fetchFromGitHub already defines name
     pname = "astal-source";
-    version = "0-unstable-2025-11-26";
+    version = "0-unstable-2026-06-21";
 
     meta = prev.meta // {
       description = "Building blocks for creating custom desktop shells (source)";

pkgs/development/python-modules/ai-edge-litert/default.nix

@@ -84,7 +84,6 @@ buildPythonPackage {
   passthru.updateScript = ./update.py;
 
   meta = {
-    broken = stdenv.hostPlatform.isDarwin; # elftools.common.exceptions.ELFError: Magic number does not match
     changelog = "https://github.com/google-ai-edge/LiteRT/releases/tag/v${release.version}";
     description = "LiteRT is for mobile and embedded devices";
     downloadPage = "https://github.com/google-ai-edge/LiteRT";
@@ -93,5 +92,12 @@ buildPythonPackage {
     platforms = lib.attrNames platforms;
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
     maintainers = with lib.maintainers; [ hexa ];
+    badPlatforms = [
+      # elftools.common.exceptions.ELFError: Magic number does not match
+      lib.systems.inspect.patterns.isDarwin
+    ];
+    # Incompatible with the openvino currently shipped in nixpkgs:
+    #   auto-patchelf could not satisfy dependency libopenvino.so.2620
+    broken = true;
   };
 }

pkgs/development/python-modules/env-canada/default.nix

@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "env-canada";
-  version = "0.16.0";
+  version = "0.16.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "michaeldavie";
     repo = "env_canada";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-99kf2A8nkxWZmhgD/x3YipYpxAJej5RjBTGomS/U8EQ=";
+    hash = "sha256-QSMc7MLN83aNGr8EKbtE1NINZuO2sCuwHs64K1d5b50=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/ggml-python/default.nix

@@ -35,7 +35,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ggml-python";
-  version = "0.0.44";
+  version = "0.0.45";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -45,7 +45,7 @@ buildPythonPackage (finalAttrs: {
     tag = "v${finalAttrs.version}";
     # ggml-python expects an older version of ggml than pkgs.ggml's
     fetchSubmodules = true;
-    hash = "sha256-Pjc91nKBAdmEg8TmirWdD1AcKlY+BCDAoHzL6mTE2SM=";
+    hash = "sha256-rPbYp6if9bCiQGfM7ZC84hkJKadE2mwC9N3elgVfQBc=";
   };
 
   build-system = [

pkgs/development/python-modules/iamdata/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202607031";
+  version = "0.1.202607041";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aXMdBBInT3JlWwlgjXyxodE9WVvdGNENMS8j6JtJjfk=";
+    hash = "sha256-X4RG1C5/ZPQCdekYfSWhsGTIzQkDsdVNThb0Dhnr8nY=";
   };
 
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/pendulum/default.nix

@@ -7,9 +7,6 @@
   # build-system
   rustPlatform,
 
-  # native dependencies
-  iconv,
-
   # dependencies
   python-dateutil,
   tzdata,
@@ -31,6 +28,13 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-zpBymeYhCy+yu6RPhOuN5xOVk6928hd3+oRsfiBPPuY=";
   };
 
+  patches = [
+    # Fix the build on Darwin.
+    #
+    # <https://github.com/python-pendulum/pendulum/pull/979>
+    ./delete-obsolete-cargo-toml.patch
+  ];
+
   cargoRoot = "rust";
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
@@ -43,8 +47,6 @@ buildPythonPackage (finalAttrs: {
     rustPlatform.cargoSetupHook
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ iconv ];
-
   dependencies = [
     python-dateutil
     tzdata

pkgs/development/python-modules/pendulum/delete-obsolete-cargo-toml.patch

@@ -0,0 +1,39 @@
+From dd0c442ab1f50f19dde95875b39a6a4463e6e835 Mon Sep 17 00:00:00 2001
+From: Emily <hello@emily.moe>
+Date: Sat, 4 Jul 2026 18:18:19 +0100
+Subject: [PATCH] Delete obsolete `.cargo/config.toml`
+
+Maturin adds these flags by itself, but the presence of this file can
+seemingly cause them to not get added at all in some environments,
+likely related to them using their own `.cargo/config.toml` file.
+
+This was possibly caused by
+<https://github.com/PyO3/maturin/commit/74baa6714808eae61ac330c972d22a9122f9b190>,
+as we noticed it when bumping Maturin past that commit in
+Nixpkgs. Removing the file fixes the macOS build in our environment.
+---
+ rust/.cargo/config.toml | 15 ---------------
+ 1 file changed, 15 deletions(-)
+ delete mode 100644 rust/.cargo/config.toml
+
+diff --git a/rust/.cargo/config.toml b/rust/.cargo/config.toml
+deleted file mode 100644
+index f0ba8af4..00000000
+--- a/rust/.cargo/config.toml
++++ /dev/null
+@@ -1,15 +0,0 @@
+-[build]
+-rustflags = []
+-
+-# see https://pyo3.rs/main/building_and_distribution.html#macos
+-[target.x86_64-apple-darwin]
+-rustflags = [
+-  "-C", "link-arg=-undefined",
+-  "-C", "link-arg=dynamic_lookup",
+-]
+-
+-[target.aarch64-apple-darwin]
+-rustflags = [
+-  "-C", "link-arg=-undefined",
+-  "-C", "link-arg=dynamic_lookup",
+-]

pkgs/development/python-modules/publicsuffixlist/default.nix

@@ -11,12 +11,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "publicsuffixlist";
-  version = "1.0.2.20260702";
+  version = "1.0.2.20260703";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-DqicazZHXh8ZzxIpYC8NuvsuGIp4xfrsxk0/AbBLgNA=";
+    hash = "sha256-NTZ4oalz09w74HpiWHRJP95yartWAHc8baWeQPBnZ3Q=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pytenable/default.nix

@@ -27,14 +27,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pytenable";
-  version = "26.5.1";
+  version = "26.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tenable";
     repo = "pyTenable";
     tag = finalAttrs.version;
-    hash = "sha256-o11Lq11btpIwzgZlPMcChHexNOZSFEFOsnaIv1n66uY=";
+    hash = "sha256-KRZbrJgIxdNAnlmP7Ww/JasoDJqJZkBkd0qXm9gfXp4=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/robot-descriptions/default.nix

@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "robot-descriptions";
-  version = "1.22.0";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "robot-descriptions";
     repo = "robot_descriptions.py";
     tag = "v${version}";
-    hash = "sha256-4O2mAkO/2xc9cAq55DMdyCzdEwMzAo5uStJwS3rQdws=";
+    hash = "sha256-PykMzWOwnjvay5zzddqD/07SdZ03GN80tRAa1CzrJzU=";
   };
 
   build-system = [

pkgs/development/python-modules/yfinance/default.nix

@@ -23,16 +23,16 @@
   websockets,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "yfinance";
-  version = "1.3.0";
+  version = "1.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ranaroussi";
     repo = "yfinance";
-    tag = version;
-    hash = "sha256-z6O1din71ZAZQGm4TEEtrFyB/CZPGPFC+qnfpGrdXgc=";
+    tag = finalAttrs.version;
+    hash = "sha256-5ynbdBys7uTcvsKQB44aoe8PmQgqP28wPtOATcv8I7g=";
   };
 
   build-system = [ setuptools ];
@@ -62,9 +62,7 @@ buildPythonPackage rec {
       requests-cache
       requests-ratelimiter
     ];
-    repair = [
-      scipy
-    ];
+    repair = [ scipy ];
   };
 
   # Tests require internet access
@@ -75,8 +73,8 @@ buildPythonPackage rec {
   meta = {
     description = "Module to doiwnload Yahoo! Finance market data";
     homepage = "https://github.com/ranaroussi/yfinance";
-    changelog = "https://github.com/ranaroussi/yfinance/blob/${src.tag}/CHANGELOG.rst";
+    changelog = "https://github.com/ranaroussi/yfinance/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})

pkgs/top-level/all-packages.nix

@@ -3050,6 +3050,7 @@ with pkgs;
     withDynlibModule = true;
     withPythonModule = true;
     withDoH = true;
+    withDoQ = true;
     withECS = true;
     withDNSCrypt = true;
     withDNSTAP = true;