From 447aaff2fd169b3d991ae181e34443c09e3a75b7 Mon Sep 17 00:00:00 2001
From: themadbit <marktanui75@gmail.com>
Date: Tue, 30 Sep 2025 10:04:53 +0300
Subject: [PATCH 01/46] cryptpad: 2025.3.0 -> 2025.6.0

Signed-off-by: themadbit <marktanui75@gmail.com>
---
 pkgs/by-name/cr/cryptpad/package.nix | 92 +++++++++++++++++++++-------
 1 file changed, 71 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/cr/cryptpad/package.nix b/pkgs/by-name/cr/cryptpad/package.nix
index 7238621b3a1c..a588aaccda80 100644
--- a/pkgs/by-name/cr/cryptpad/package.nix
+++ b/pkgs/by-name/cr/cryptpad/package.nix
@@ -14,22 +14,60 @@
 }:
 
 let
-  version = "2025.3.0";
+  version = "2025.6.0";
   # nix version of install-onlyoffice.sh
   # a later version could rebuild from sdkjs/web-apps as per
   # https://github.com/cryptpad/onlyoffice-builds/blob/main/build.sh
-  onlyoffice_build =
-    rev: hash:
-    fetchFromGitHub {
-      inherit rev hash;
-      owner = "cryptpad";
-      repo = "onlyoffice-builds";
-    };
+  onlyoffice_fetch =
+    {
+      rev ? null,
+      version ? null,
+      hash,
+      ...
+    }:
+    assert (
+      lib.assertMsg (lib.xor (rev == null) (
+        version == null
+      )) "onlyoffice_fetch requires one of either `rev` or `version` to be provided (not both)."
+    );
+    if rev != null then
+      fetchFromGitHub {
+        inherit rev hash;
+        owner = "cryptpad";
+        repo = "onlyoffice-builds";
+      }
+    # New method for v7+ versions that use ZIP releases
+    else
+      fetchurl {
+        url = "https://github.com/cryptpad/onlyoffice-editor/releases/download/${version}/onlyoffice-editor.zip";
+        inherit hash;
+      };
+
   onlyoffice_install = oo: ''
     oo_dir="$out_cryptpad/www/common/onlyoffice/dist/${oo.subdir}"
-    cp -a "${onlyoffice_build oo.rev oo.hash}/." "$oo_dir"
-    chmod -R +w "$oo_dir"
-    echo "${oo.rev}" > "$oo_dir/.commit"
+    ${
+      if oo ? "version" then
+        ''
+          mkdir -p "$oo_dir"
+          unzip ${onlyoffice_fetch oo} -d "$oo_dir"
+          echo "${oo.version}" > "$oo_dir/.version"
+
+          # Clean up help files and dictionaries as per upstream
+          ${lib.optionalString (oo.subdir == "v7") ''
+            rm -rf "$oo_dir"/web-apps/apps/*/main/resources/help
+            rm -rf "$oo_dir"/dictionaries/
+          ''}
+        ''
+      else
+        ''
+          cp -a "${onlyoffice_fetch oo}/." "$oo_dir"
+          chmod -R +w "$oo_dir"
+          echo "${oo.rev}" > "$oo_dir/.commit"
+
+          # Clean up help files as per upstream
+          rm -rf "$oo_dir"/web-apps/apps/*/main/resources/help
+        ''
+    }
   '';
   onlyoffice_versions = [
     {
@@ -59,8 +97,13 @@ let
     }
     {
       subdir = "v7";
-      rev = "e1267803";
-      hash = "sha256-iIds0GnCHAyeIEdSD4aCCgDtnnwARh3NE470CywseS0=";
+      version = "v7.3.3.60+11";
+      hash = "sha256-He8RwsaJPBhaxFklA7vSxxNUpmcM41lW859gQUUJWbQ=";
+    }
+    {
+      subdir = "v8";
+      version = "v8.3.3.23+4";
+      hash = "sha256-DeK84fa7Jc1L1+vF8LBKLXM5oWS0SV2qBnAWG3Xzu4U=";
     }
   ];
 
@@ -83,11 +126,11 @@ buildNpmPackage {
   src = fetchFromGitHub {
     owner = "cryptpad";
     repo = "cryptpad";
-    rev = version;
-    hash = "sha256-NxkVMsfLzdzifdn+f0C6mBJGd1oLwcMTAIXv+gBG7rI=";
+    tag = version;
+    hash = "sha256-R8Oonrnb1tqvl1zTkWv5Xv/f8bFtUljD6X/re72IvsU=";
   };
 
-  npmDepsHash = "sha256-GWkyRlizPSA72WwoY+mRLwaMeD/SXdo6oUVwsd2gp7c=";
+  npmDepsHash = "sha256-4Zr+8ANZJ9XX2umY/SY7BrEHPheVelFSeZipgOaW6bI==";
 
   nativeBuildInputs = [
     makeBinaryWrapper
@@ -120,8 +163,13 @@ buildNpmPackage {
     # Move to install directory manually.
     npm run install:components
     mv www/components "$out_cryptpad/www/"
-    # and fix absolute symlink to /build...
-    ln -Tfs ../../src/tweetnacl "$out_cryptpad/www/components/tweetnacl"
+    # optimization: replace copies with symlinks...
+    for d in "$out_cryptpad/www/components/"*; do
+      d="''${d##*/}"
+      [ -e "$out_cryptpad/node_modules/$d" ] || continue
+      rm -rf "$out_cryptpad/www/components/$d"
+      ln -Tfs "../../node_modules/$d" "$out_cryptpad/www/components/$d"
+    done
 
     # install OnlyOffice (install-onlyoffice.sh without network)
     mkdir -p "$out_cryptpad/www/common/onlyoffice/dist"
@@ -130,8 +178,10 @@ buildNpmPackage {
     # Run upstream's `install-onlyoffice.sh` script in `--check` mode to
     # verify that we've installed the correct versions of the various
     # OnlyOffice components.
-    patchShebangs --build $out_cryptpad/install-onlyoffice.sh
-    $out_cryptpad/install-onlyoffice.sh --accept-license --check --rdfind
+
+    # TODO: Patch the new install method to only verify versions;
+    # patchShebangs --build $out_cryptpad/install-onlyoffice.sh
+    # $out_cryptpad/install-onlyoffice.sh --accept-license --check --rdfind
 
     # cryptpad assumes it runs in the source directory and also outputs
     # its state files there, which is not exactly great for us.
@@ -144,7 +194,7 @@ buildNpmPackage {
     # directory.
     makeWrapper "${lib.getExe nodejs}" "$out/bin/cryptpad" \
       --add-flags "$out_cryptpad/server.js" \
-      --run "for d in customize.dist lib www scripts; do ${coreutils}/bin/ln -sf \"$out_cryptpad/\$d\" .; done" \
+      --run "for d in src customize.dist lib www scripts; do ${coreutils}/bin/ln -sf \"$out_cryptpad/\$d\" .; done" \
       --run "if ! [ -d customize ]; then \"${lib.getExe nodejs}\" \"$out_cryptpad/scripts/build.js\"; fi"
   '';
 

From e538beb4aca2c075da5ca5824378e037625db2b4 Mon Sep 17 00:00:00 2001
From: qzylinra <225773816+qzylinra@users.noreply.github.com>
Date: Thu, 6 Nov 2025 01:24:23 +0000
Subject: [PATCH 02/46] libcef: drop

---
 .../applications/video/obs-studio/default.nix |  39 ++--
 pkgs/by-name/bo/bolt-launcher/package.nix     |  15 +-
 pkgs/by-name/ce/cef-binary/package.nix        | 111 +++++++++++-
 .../ce/cef-binary}/update.sh                  |   6 +-
 .../li/linux-wallpaperengine/package.nix      |  16 +-
 .../compilers/jetbrains-jdk/jcef.nix          |  91 ++--------
 pkgs/development/libraries/libcef/default.nix | 168 ------------------
 pkgs/top-level/aliases.nix                    |   1 +
 pkgs/top-level/all-packages.nix               |   2 -
 9 files changed, 167 insertions(+), 282 deletions(-)
 rename pkgs/{development/libraries/libcef => by-name/ce/cef-binary}/update.sh (86%)
 delete mode 100644 pkgs/development/libraries/libcef/default.nix

diff --git a/pkgs/applications/video/obs-studio/default.nix b/pkgs/applications/video/obs-studio/default.nix
index 64938df8bbbd..ba5818198996 100644
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@@ -7,6 +7,7 @@
   nv-codec-headers-12,
   fetchFromGitHub,
   fetchpatch2,
+  fetchurl,
   addDriverRunpath,
   autoAddDriverRunpath,
   cudaSupport ? config.cudaSupport,
@@ -68,19 +69,33 @@
 let
   inherit (lib) optional optionals;
 
-  cef = cef-binary.overrideAttrs (oldAttrs: {
-    version = "138.0.17";
-    __intentionallyOverridingVersion = true; # `cef-binary` uses the overridden `srcHash` values in its source FOD
-    gitRevision = "ac9b751";
-    chromiumVersion = "138.0.7204.97";
+  selectSystem =
+    attrs:
+    attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system ${stdenv.hostPlatform.system}");
 
-    srcHash =
-      {
-        aarch64-linux = "sha256-kdO7c9oUfv0HK8wTmvYzw9S6EapnSGEQNCGN9D1JSL0=";
-        x86_64-linux = "sha256-3qgIhen6l/kxttyw0z78nmwox62riVhlmFSGPkUot7g=";
-      }
-      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
-  });
+  cef = cef-binary.overrideAttrs (
+    oldAttrs:
+    let
+      version = "6533";
+      revision = "6";
+    in
+    {
+      inherit version;
+
+      src = fetchurl {
+        url = "https://cdn-fastly.obsproject.com/downloads/cef_binary_${version}_linux_${
+          selectSystem {
+            aarch64-linux = "aarch64";
+            x86_64-linux = "x86_64";
+          }
+        }_v${revision}.tar.xz";
+        hash = selectSystem {
+          aarch64-linux = "sha256-ZCUURp6qKaXIh4kQhNLnP33C10Bfffp3JrLbwkswmZk=";
+          x86_64-linux = "sha256-eWMzVRmhnM3FIz9zNMWrAjAm4vPpoMxBcAfAnYZggUY=";
+        };
+      };
+    }
+  );
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-studio";
diff --git a/pkgs/by-name/bo/bolt-launcher/package.nix b/pkgs/by-name/bo/bolt-launcher/package.nix
index acedcd6ca3a8..e9a0f451b99d 100644
--- a/pkgs/by-name/bo/bolt-launcher/package.nix
+++ b/pkgs/by-name/bo/bolt-launcher/package.nix
@@ -23,19 +23,16 @@
   enableRS3 ? false,
 }:
 let
-  cef = cef-binary.overrideAttrs (oldAttrs: {
+  cef = cef-binary.override {
     version = "126.2.18";
-    __intentionallyOverridingVersion = true; # `cef-binary` uses the overridden `srcHash` values in its source FOD
     gitRevision = "3647d39";
     chromiumVersion = "126.0.6478.183";
 
-    srcHash =
-      {
-        aarch64-linux = "sha256-Ni5aEbI+WuMnbT8gPWMONN5NkTySw7xJvnM6U44Njao=";
-        x86_64-linux = "sha256-YwND4zsndvmygJxwmrCvaFuxjJO704b6aDVSJqpEOKc=";
-      }
-      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
-  });
+    srcHashes = {
+      aarch64-linux = "sha256-Ni5aEbI+WuMnbT8gPWMONN5NkTySw7xJvnM6U44Njao=";
+      x86_64-linux = "sha256-YwND4zsndvmygJxwmrCvaFuxjJO704b6aDVSJqpEOKc=";
+    };
+  };
 in
 let
   bolt = stdenv.mkDerivation (finalAttrs: {
diff --git a/pkgs/by-name/ce/cef-binary/package.nix b/pkgs/by-name/ce/cef-binary/package.nix
index 060e935cfe88..35bb0309cdaf 100644
--- a/pkgs/by-name/ce/cef-binary/package.nix
+++ b/pkgs/by-name/ce/cef-binary/package.nix
@@ -1,15 +1,118 @@
 {
-  libcef,
+  lib,
+  stdenv,
+  fetchurl,
+  glib,
+  nss,
+  nspr,
+  atk,
+  at-spi2-atk,
+  libdrm,
+  expat,
+  libxkbcommon,
+  libgbm,
+  gtk3,
+  pango,
+  cairo,
+  alsa-lib,
+  dbus,
+  at-spi2-core,
+  cups,
+  libGL,
+  udev,
+  systemdLibs,
+  xorg,
+  version ? "141.0.7",
+  gitRevision ? "a5714cc",
+  chromiumVersion ? "141.0.7390.108",
+  buildType ? "Release",
+  srcHashes ? {
+    aarch64-linux = "sha256-2A0hVzUVMBemhjnFE/CrKs4CU96Qkxy8S/SieaEJjwE=";
+    x86_64-linux = "sha256-tZzUxeXxbYP8YfIQLbiSyihPcjZM9cd2Ad8gGCSvdGk=";
+  },
 }:
 
-libcef.overrideAttrs (oldAttrs: {
+let
+  gl_rpath = lib.makeLibraryPath [ stdenv.cc.cc ];
+
+  rpath = lib.makeLibraryPath [
+    glib
+    nss
+    nspr
+    atk
+    at-spi2-atk
+    libdrm
+    expat
+    libxkbcommon
+    libgbm
+    gtk3
+    pango
+    cairo
+    alsa-lib
+    dbus
+    at-spi2-core
+    cups
+    libGL
+    udev
+    systemdLibs
+    xorg.libxcb
+    xorg.libX11
+    xorg.libXcomposite
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXrandr
+    xorg.libxshmfence
+  ];
+
+  selectSystem =
+    attrs:
+    attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation {
   pname = "cef-binary";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://cef-builds.spotifycdn.com/cef_binary_${version}+g${gitRevision}+chromium-${chromiumVersion}_${
+      selectSystem {
+        aarch64-linux = "linuxarm64";
+        x86_64-linux = "linux64";
+      }
+    }_minimal.tar.bz2";
+    hash = selectSystem srcHashes;
+  };
+
+  dontStrip = true;
+
+  dontPatchELF = true;
 
   installPhase = ''
     runHook preInstall
 
-    cp -r .. $out
+    sed 's/-O0/-O2/' -i cmake/cef_variables.cmake
+    patchelf --set-rpath "${rpath}" --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" ${buildType}/chrome-sandbox
+    patchelf --add-needed libudev.so --set-rpath "${rpath}" ${buildType}/libcef.so
+    patchelf --set-rpath "${gl_rpath}" ${buildType}/libEGL.so
+    patchelf --add-needed libGL.so.1 --set-rpath "${gl_rpath}" ${buildType}/libGLESv2.so
+    patchelf --set-rpath "${gl_rpath}" ${buildType}/libvk_swiftshader.so
+    patchelf --set-rpath "${gl_rpath}" ${buildType}/libvulkan.so.1
+    cp --recursive . $out
 
     runHook postInstall
   '';
-})
+
+  passthru = {
+    inherit buildType;
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "Simple framework for embedding Chromium-based browsers in other applications";
+    homepage = "https://cef-builds.spotifycdn.com/index.html";
+    maintainers = with lib.maintainers; [ puffnfresh ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.bsd3;
+    platforms = builtins.attrNames srcHashes;
+  };
+}
diff --git a/pkgs/development/libraries/libcef/update.sh b/pkgs/by-name/ce/cef-binary/update.sh
similarity index 86%
rename from pkgs/development/libraries/libcef/update.sh
rename to pkgs/by-name/ce/cef-binary/update.sh
index 556337c5333d..2aa4e0155d60 100755
--- a/pkgs/development/libraries/libcef/update.sh
+++ b/pkgs/by-name/ce/cef-binary/update.sh
@@ -3,7 +3,7 @@
 
 set -euo pipefail
 
-current_version=$(nix-instantiate --eval -E "with import ./. {}; libcef.version or (lib.getVersion libcef)" | tr -d '"')
+current_version=$(nix-instantiate --eval -E "with import ./. {}; cef-binary or (lib.getVersion cef-binary)" | tr -d '"')
 
 ROOT="$(dirname "$(realpath "${BASH_SOURCE[0]}")")"
 
@@ -23,7 +23,7 @@ fi
 update_nix_value() {
     local key="$1"
     local value="${2:-}"
-    sed -i "s|$key = \".*\"|$key = \"$value\"|" $ROOT/default.nix
+    sed -i "s|$key ? \".*\"|$key ? \"$value\"|" $ROOT/package.nix
 }
 
 update_nix_value version "$cef_version"
@@ -39,5 +39,5 @@ for platform in "${platforms[@]}"; do
     read -r system arch <<< "$platform"
     url="https://cef-builds.spotifycdn.com/cef_binary_${cef_version}+g${git_revision}+chromium-${chromium_version}_linux${arch}_minimal.tar.bz2"
     hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url --quiet "$url")")
-    update-source-version libcef "$cef_version" "$hash" --system="$system" --ignore-same-version
+    update-source-version cef-binary "$cef_version" "$hash" --system="$system" --ignore-same-version
 done
diff --git a/pkgs/by-name/li/linux-wallpaperengine/package.nix b/pkgs/by-name/li/linux-wallpaperengine/package.nix
index 7c4c2e924119..f68566c65e9a 100644
--- a/pkgs/by-name/li/linux-wallpaperengine/package.nix
+++ b/pkgs/by-name/li/linux-wallpaperengine/package.nix
@@ -38,19 +38,16 @@
 }:
 
 let
-  cef = cef-binary.overrideAttrs (oldAttrs: {
+  cef = cef-binary.override {
     version = "135.0.17"; # follow upstream. https://github.com/Almamu/linux-wallpaperengine/blob/b39f12757908eda9f4c1039613b914606568bb84/CMakeLists.txt#L47
-    __intentionallyOverridingVersion = true; # `cef-binary` uses the overridden `srcHash` values in its source FOD
     gitRevision = "cbc1c5b";
     chromiumVersion = "135.0.7049.52";
 
-    srcHash =
-      {
-        aarch64-linux = "sha256-LK5JvtcmuwCavK7LnWmMF2UDpM5iIZOmsuZS/t9koDs=";
-        x86_64-linux = "sha256-JKwZgOYr57GuosM31r1Lx3DczYs35HxtuUs5fxPsTcY=";
-      }
-      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
-  });
+    srcHashes = {
+      aarch64-linux = "sha256-LK5JvtcmuwCavK7LnWmMF2UDpM5iIZOmsuZS/t9koDs=";
+      x86_64-linux = "sha256-JKwZgOYr57GuosM31r1Lx3DczYs35HxtuUs5fxPsTcY=";
+    };
+  };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "linux-wallpaperengine";
@@ -102,7 +99,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=${cef.buildType}"
     "-DCEF_ROOT=${cef}"
     "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/share/linux-wallpaperengine"
   ];
diff --git a/pkgs/development/compilers/jetbrains-jdk/jcef.nix b/pkgs/development/compilers/jetbrains-jdk/jcef.nix
index 516dd447affc..e0154b3bcae9 100644
--- a/pkgs/development/compilers/jetbrains-jdk/jcef.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/jcef.nix
@@ -1,7 +1,6 @@
 {
   fetchFromGitHub,
   fetchurl,
-  fetchzip,
   stdenv,
   cmake,
   python3,
@@ -16,66 +15,16 @@
 
   debugBuild ? false,
 
-  glib,
   nss,
   nspr,
-  atk,
-  at-spi2-atk,
-  libdrm,
-  libGL,
-  expat,
-  libxcb,
-  libxkbcommon,
   libX11,
-  libXcomposite,
   libXdamage,
-  libXext,
-  libXfixes,
-  libXrandr,
-  libgbm,
-  gtk3,
-  pango,
-  cairo,
-  alsa-lib,
-  dbus,
-  at-spi2-core,
-  cups,
-  libxshmfence,
-  udev,
   boost,
   thrift,
+  cef-binary,
 }:
 
 let
-  rpath = lib.makeLibraryPath [
-    glib
-    nss
-    nspr
-    atk
-    at-spi2-atk
-    libdrm
-    libGL
-    expat
-    libxcb
-    libxkbcommon
-    libX11
-    libXcomposite
-    libXdamage
-    libXext
-    libXfixes
-    libXrandr
-    libgbm
-    gtk3
-    pango
-    cairo
-    alsa-lib
-    dbus
-    at-spi2-core
-    cups
-    libxshmfence
-    udev
-  ];
-
   buildType = if debugBuild then "Debug" else "Release";
   platform =
     {
@@ -99,6 +48,19 @@ let
     .${platform};
   inherit (arches) depsArch projectArch targetArch;
 
+  # `cef_binary_${CEF_VERSION}_linux64_minimal`, where CEF_VERSION is from $src/CMakeLists.txt
+  cef-name = "cef_binary_137.0.17+gf354b0e+chromium-137.0.7151.104_${platform}_minimal";
+
+  cef-bin = cef-binary.override {
+    version = "137.0.17"; # follow upstream. https://github.com/Almamu/linux-wallpaperengine/blob/b39f12757908eda9f4c1039613b914606568bb84/CMakeLists.txt#L47
+    gitRevision = "f354b0e";
+    chromiumVersion = "137.0.7151.104";
+    srcHashes = {
+      aarch64-linux = "sha256-C9P4+TpzjyMD5z2qLbzubbrIr66usFjRx7QqiAxI2D8=";
+      x86_64-linux = "sha256-iDC3a/YN0NqjX/b2waKvUAZCaR0lkLmUPqBJphE037Q=";
+    };
+  };
+
   thrift20 = thrift.overrideAttrs (old: {
     version = "0.20.0";
 
@@ -149,22 +111,7 @@ stdenv.mkDerivation rec {
     inherit rev;
     hash = "sha256-BHmGEhfkrUWDfrUFR8d5AgIq8qkAr+blX9n7ZVg8mtc=";
   };
-  cef-bin =
-    let
-      # `cef_binary_${CEF_VERSION}_linux64_minimal`, where CEF_VERSION is from $src/CMakeLists.txt
-      name = "cef_binary_137.0.17+gf354b0e+chromium-137.0.7151.104_${platform}_minimal";
-      hash =
-        {
-          "linuxarm64" = "sha256-QKkJwLtYS3o7lf4T31jIww2LGuAJT3sNTeI3Jq0VEYQ=";
-          "linux64" = "sha256-qE5SOi0/6dPsewyemarTbWG9MbWCQUlng8TgqU+4Tak=";
-        }
-        .${platform};
-      urlName = builtins.replaceStrings [ "+" ] [ "%2B" ] name;
-    in
-    fetchzip {
-      url = "https://cef-builds.spotifycdn.com/${urlName}.tar.bz2";
-      inherit name hash;
-    };
+
   # Find the hash in tools/buildtools/linux64/clang-format.sha1
   clang-fmt = fetchurl {
     url = "https://storage.googleapis.com/chromium-clang-format/dd736afb28430c9782750fc0fd5f0ed497399263";
@@ -176,12 +123,8 @@ stdenv.mkDerivation rec {
 
     patchShebangs .
 
-    cp -r ${cef-bin} third_party/cef/${cef-bin.name}
-    chmod +w -R third_party/cef/${cef-bin.name}
-    patchelf third_party/cef/${cef-bin.name}/${buildType}/libcef.so --set-rpath "${rpath}" --add-needed libudev.so
-    patchelf third_party/cef/${cef-bin.name}/${buildType}/libGLESv2.so --set-rpath "${rpath}" --add-needed libGL.so.1
-    patchelf third_party/cef/${cef-bin.name}/${buildType}/chrome-sandbox --set-interpreter $(cat $NIX_BINTOOLS/nix-support/dynamic-linker)
-    sed 's/-O0/-O2/' -i third_party/cef/${cef-bin.name}/cmake/cef_variables.cmake
+    cp -r ${cef-bin} third_party/cef/${cef-name}
+    chmod +w -R third_party/cef/${cef-name}
 
     sed \
       -e 's|os.path.isdir(os.path.join(path, \x27.git\x27))|True|' \
diff --git a/pkgs/development/libraries/libcef/default.nix b/pkgs/development/libraries/libcef/default.nix
deleted file mode 100644
index 51033edff513..000000000000
--- a/pkgs/development/libraries/libcef/default.nix
+++ /dev/null
@@ -1,168 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  cmake,
-  glib,
-  nss,
-  nspr,
-  atk,
-  at-spi2-atk,
-  libdrm,
-  expat,
-  libxcb,
-  libxkbcommon,
-  libX11,
-  libXcomposite,
-  libXdamage,
-  libXext,
-  libXfixes,
-  libXrandr,
-  libgbm,
-  gtk3,
-  pango,
-  cairo,
-  alsa-lib,
-  dbus,
-  at-spi2-core,
-  cups,
-  libxshmfence,
-  libGL,
-  udev,
-  systemd,
-  obs-studio,
-  xorg,
-}:
-
-let
-  gl_rpath = lib.makeLibraryPath [ stdenv.cc.cc ];
-
-  rpath = lib.makeLibraryPath [
-    glib
-    nss
-    nspr
-    atk
-    at-spi2-atk
-    libdrm
-    expat
-    libxcb
-    libxkbcommon
-    libX11
-    libXcomposite
-    libXdamage
-    libXext
-    libXfixes
-    libXrandr
-    libgbm
-    gtk3
-    pango
-    cairo
-    alsa-lib
-    dbus
-    at-spi2-core
-    cups
-    libxshmfence
-    libGL
-    udev
-    systemd
-    xorg.libxcb
-    xorg.libX11
-    xorg.libXcomposite
-    xorg.libXdamage
-    xorg.libXext
-    xorg.libXfixes
-    xorg.libXrandr
-    xorg.libxshmfence
-  ];
-
-  selectSystem =
-    attrs:
-    attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system ${stdenv.hostPlatform.system}");
-
-  platformInfo = selectSystem {
-    aarch64-linux = {
-      platformStr = "linuxarm64";
-      projectArch = "arm64";
-    };
-    x86_64-linux = {
-      platformStr = "linux64";
-      projectArch = "x86_64";
-    };
-  };
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "libcef";
-  version = "141.0.7";
-  gitRevision = "a5714cc";
-  chromiumVersion = "141.0.7390.108";
-  buildType = "Release";
-
-  srcHash = selectSystem {
-    aarch64-linux = "sha256-2A0hVzUVMBemhjnFE/CrKs4CU96Qkxy8S/SieaEJjwE=";
-    x86_64-linux = "sha256-tZzUxeXxbYP8YfIQLbiSyihPcjZM9cd2Ad8gGCSvdGk=";
-  };
-
-  src = fetchurl {
-    url = "https://cef-builds.spotifycdn.com/cef_binary_${finalAttrs.version}+g${finalAttrs.gitRevision}+chromium-${finalAttrs.chromiumVersion}_${platformInfo.platformStr}_minimal.tar.bz2";
-    hash = finalAttrs.srcHash;
-  };
-
-  nativeBuildInputs = [ cmake ];
-
-  cmakeFlags = [ "-DPROJECT_ARCH=${platformInfo.projectArch}" ];
-
-  makeFlags = [ "libcef_dll_wrapper" ];
-
-  dontStrip = true;
-
-  dontPatchELF = true;
-
-  preInstall = ''
-    patchelf --set-rpath "${rpath}" --set-interpreter "${stdenv.cc.bintools.dynamicLinker}" ../${finalAttrs.buildType}/chrome-sandbox
-    patchelf --add-needed libudev.so --set-rpath "${rpath}" ../${finalAttrs.buildType}/libcef.so
-    patchelf --set-rpath "${gl_rpath}" ../${finalAttrs.buildType}/libEGL.so
-    patchelf --add-needed libGL.so.1 --set-rpath "${gl_rpath}" ../${finalAttrs.buildType}/libGLESv2.so
-    patchelf --set-rpath "${gl_rpath}" ../${finalAttrs.buildType}/libvk_swiftshader.so
-    patchelf --set-rpath "${gl_rpath}" ../${finalAttrs.buildType}/libvulkan.so.1
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/lib/ $out/share/cef/ $out/libexec/cef/
-    cp libcef_dll_wrapper/libcef_dll_wrapper.a $out/lib/
-    cp ../${finalAttrs.buildType}/libcef.so $out/lib/
-    cp ../${finalAttrs.buildType}/libEGL.so $out/lib/
-    cp ../${finalAttrs.buildType}/libGLESv2.so $out/lib/
-    cp ../${finalAttrs.buildType}/libvk_swiftshader.so $out/lib/
-    cp ../${finalAttrs.buildType}/libvulkan.so.1 $out/lib/
-    cp ../${finalAttrs.buildType}/chrome-sandbox $out/libexec/cef/
-    cp ../${finalAttrs.buildType}/*.bin ../${finalAttrs.buildType}/*.json $out/share/cef/
-    cp -r ../Resources/* $out/share/cef/
-    cp -r ../include $out/
-
-    runHook postInstall
-  '';
-
-  passthru = {
-    updateScript = ./update.sh;
-    tests = {
-      inherit obs-studio; # frequently breaks on CEF updates
-    };
-  };
-
-  meta = {
-    description = "Simple framework for embedding Chromium-based browsers in other applications";
-    homepage = "https://cef-builds.spotifycdn.com/index.html";
-    maintainers = with lib.maintainers; [ puffnfresh ];
-    sourceProvenance = with lib.sourceTypes; [
-      fromSource
-      binaryNativeCode
-    ];
-    license = lib.licenses.bsd3;
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
-  };
-})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index b4bfc2093dee..790834411528 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -782,6 +782,7 @@ mapAliases {
   libbencodetools = throw "'libbencodetools' has been renamed to/replaced by 'bencodetools'"; # Converted to throw 2025-10-27
   libbpf_1 = throw "'libbpf_1' has been renamed to/replaced by 'libbpf'"; # Converted to throw 2025-10-27
   libbson = throw "'libbson' has been renamed to/replaced by 'mongoc'"; # Converted to throw 2025-10-27
+  libcef = throw "'libcef' has been removed, as no packages depend on it"; # Added 2025-11-06
   libdevil = throw "libdevil has been removed, as it was unmaintained in Nixpkgs and upstream since 2017"; # Added 2025-09-16
   libdevil-nox = throw "libdevil has been removed, as it was unmaintained in Nixpkgs and upstream since 2017"; # Added 2025-09-16
   libdwarf-lite = throw "`libdwarf-lite` has been replaced by `libdwarf` as it's mostly a mirror"; # Added 2025-06-16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cbf01694873f..60f9b3ce6973 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7694,8 +7694,6 @@ with pkgs;
 
   libcec_platform = callPackage ../development/libraries/libcec/platform.nix { };
 
-  libcef = callPackage ../development/libraries/libcef { };
-
   libcdr = callPackage ../development/libraries/libcdr { lcms = lcms2; };
 
   libchamplain_libsoup3 = libchamplain.override { withLibsoup3 = true; };

From 555f7c9c65aed596840bc4a1b0f064a1fe101a1e Mon Sep 17 00:00:00 2001
From: Jasi <normalc@posteo.net>
Date: Fri, 7 Nov 2025 10:10:40 -0500
Subject: [PATCH 03/46] duckstation: 0.1-9787-unstable-2025-10-13 -> 0.1-9903

---
 pkgs/by-name/du/duckstation/package.nix  | 6 +++---
 pkgs/by-name/du/duckstation/sources.json | 6 +++---
 pkgs/by-name/du/duckstation/update.sh    | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/du/duckstation/package.nix b/pkgs/by-name/du/duckstation/package.nix
index e84c5306363f..6ddc323cfa0c 100644
--- a/pkgs/by-name/du/duckstation/package.nix
+++ b/pkgs/by-name/du/duckstation/package.nix
@@ -64,13 +64,13 @@ let
 
   linuxDrv = llvmPackages.stdenv.mkDerivation (finalAttrs: {
     pname = "duckstation";
-    version = "0.1-9787-unstable-2025-10-13";
+    version = pkgSources.duckstation.version;
 
     src = fetchFromGitHub {
       owner = "stenzek";
       repo = "duckstation";
-      rev = "8f0c9dd171210dfd7f06223a393e2565abbaabf3";
-      hash = "sha256-CzHWdY0RaGBB6CY3PzHHHbq3/Mbf6WtUm6Dizr0IW6I=";
+      tag = "v${finalAttrs.version}";
+      hash = pkgSources.duckstation.hash_linux;
     };
 
     # TODO: Remove once this is fixed upstream.
diff --git a/pkgs/by-name/du/duckstation/sources.json b/pkgs/by-name/du/duckstation/sources.json
index a4db277a14d0..2e258e9e0068 100644
--- a/pkgs/by-name/du/duckstation/sources.json
+++ b/pkgs/by-name/du/duckstation/sources.json
@@ -1,8 +1,8 @@
 {
   "duckstation": {
-    "version": "0.1-9669",
-    "hash_linux": "sha256-Q3vU4PaHMHzA8MTxLQbR++ND4L0iRMw6M7J74jyWBKI=",
-    "hash_darwin": "sha256-qbY1xKqjYAoxU5EWSFRq8Quu3bZBHHsS8nqnLW3xT+k="
+    "version": "0.1-9903",
+    "hash_linux": "sha256-CzHWdY0RaGBB6CY3PzHHHbq3/Mbf6WtUm6Dizr0IW6I=",
+    "hash_darwin": "sha256-7gVpINajfRRDLYBQMQBQtBELosvROiQzTEa2zZbtK44="
   },
   "discord_rpc": {
     "rev": "cc59d26d1d628fbd6527aac0ac1d6301f4978b92",
diff --git a/pkgs/by-name/du/duckstation/update.sh b/pkgs/by-name/du/duckstation/update.sh
index 2e82fa5347e4..0e02fba855bb 100755
--- a/pkgs/by-name/du/duckstation/update.sh
+++ b/pkgs/by-name/du/duckstation/update.sh
@@ -23,13 +23,13 @@ duckstation_storepath=$(nix --extra-experimental-features "nix-command flakes" f
 pinned_versions=$duckstation_storepath/scripts/deps/versions
 
 echo "Using pinned discord_rpc..."
-discord_rpc_rev=$(grep "DISCORD_RPC=" "$pinned_versions" | sed 's|.*=||g')
+discord_rpc_rev=$(grep "DISCORD_RPC_COMMIT=" "$pinned_versions" | sed 's|.*=||g')
 discord_rpc_hash=$(nix --extra-experimental-features "nix-command flakes" \
   flake prefetch github:stenzek/discord-rpc/"$discord_rpc_rev" --json |
   jq -r '.hash')
 
 echo "Using pinned shaderc..."
-shaderc_rev=$(grep "SHADERC=" "$pinned_versions" | sed 's|.*=||g')
+shaderc_rev=$(grep "SHADERC_COMMIT=" "$pinned_versions" | sed 's|.*=||g')
 shaderc_hash=$(nix --extra-experimental-features "nix-command flakes" flake prefetch github:stenzek/shaderc/"$shaderc_rev" --json | jq -r '.hash')
 
 echo "Fetching latest chtdb commit..."

From 2e59e4828dabe95fc62e7893bc99fcfac86a97b3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 7 Nov 2025 22:12:34 +0000
Subject: [PATCH 04/46] python3Packages.htmldate: 1.9.3 -> 1.9.4

---
 pkgs/development/python-modules/htmldate/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/htmldate/default.nix b/pkgs/development/python-modules/htmldate/default.nix
index c97199f97a3d..830b271a5e7a 100644
--- a/pkgs/development/python-modules/htmldate/default.nix
+++ b/pkgs/development/python-modules/htmldate/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "htmldate";
-  version = "1.9.3";
+  version = "1.9.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "adbar";
     repo = "htmldate";
     tag = "v${version}";
-    hash = "sha256-9uFf/sx0AZdlvizU65H87hbtwDKf8Ykm67bKM9Oq//s=";
+    hash = "sha256-ZSHQgj6zXmLdqDQWGnh2l70iXzdohsxdAIQGDSBufIA=";
   };
 
   build-system = [ setuptools ];

From 4a8f2c2a693d004e14d720aa7a2711f6731f1375 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Nov 2025 01:23:47 +0000
Subject: [PATCH 05/46] python3Packages.philipstv: 2.1.1 -> 3.0.1

---
 pkgs/development/python-modules/philipstv/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/philipstv/default.nix b/pkgs/development/python-modules/philipstv/default.nix
index d482554a755d..5f0231d9e695 100644
--- a/pkgs/development/python-modules/philipstv/default.nix
+++ b/pkgs/development/python-modules/philipstv/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "philipstv";
-  version = "2.1.1";
+  version = "3.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "bcyran";
     repo = "philipstv";
     tag = version;
-    hash = "sha256-BvQurZls9NjtHhTXLQ9t8fHkAF/QU/c6mmRvNmE0v90=";
+    hash = "sha256-9OlPaGruD6HDJArvIOb/pIVw5nqTUleDfxeYp2xBbEA=";
   };
 
   build-system = [

From af0f9f884d1b59e9b1fd0dc8834022efc3ae4d65 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 8 Nov 2025 23:51:14 +0100
Subject: [PATCH 06/46] python313Packages.philipstv: modernize

---
 pkgs/development/python-modules/philipstv/default.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/philipstv/default.nix b/pkgs/development/python-modules/philipstv/default.nix
index 5f0231d9e695..82ecfccb3130 100644
--- a/pkgs/development/python-modules/philipstv/default.nix
+++ b/pkgs/development/python-modules/philipstv/default.nix
@@ -2,7 +2,6 @@
   lib,
   fetchFromGitHub,
   buildPythonPackage,
-  pythonOlder,
   poetry-core,
   poetry-dynamic-versioning,
   installShellFiles,
@@ -21,8 +20,6 @@ buildPythonPackage rec {
   version = "3.0.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "bcyran";
     repo = "philipstv";
@@ -65,7 +62,7 @@ buildPythonPackage rec {
   meta = {
     description = "CLI and library to control Philips Android-powered TVs";
     homepage = "https://github.com/bcyran/philipstv";
-    changelog = "https://github.com/bcyran/philipstv/releases/tag/${version}";
+    changelog = "https://github.com/bcyran/philipstv/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     mainProgram = "philipstv";
     maintainers = with lib.maintainers; [ bcyran ];

From c9d159af9e79248a8a28062f576de813eef4df93 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 8 Nov 2025 23:53:28 +0100
Subject: [PATCH 07/46] python313Packages.htmldate: modernize

---
 pkgs/development/python-modules/htmldate/default.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/development/python-modules/htmldate/default.nix b/pkgs/development/python-modules/htmldate/default.nix
index 830b271a5e7a..b6664646514a 100644
--- a/pkgs/development/python-modules/htmldate/default.nix
+++ b/pkgs/development/python-modules/htmldate/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  backports-datetime-fromisoformat,
   buildPythonPackage,
   charset-normalizer,
   dateparser,
@@ -9,7 +8,6 @@
   lxml,
   pytestCheckHook,
   python-dateutil,
-  pythonOlder,
   setuptools,
   urllib3,
 }:
@@ -19,8 +17,6 @@ buildPythonPackage rec {
   version = "1.9.4";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "adbar";
     repo = "htmldate";
@@ -45,13 +41,11 @@ buildPythonPackage rec {
       faust-cchardet
       urllib3
     ]
-    ++ lib.optionals (pythonOlder "3.11") [ backports-datetime-fromisoformat ]
     ++ urllib3.optional-dependencies.brotli;
     all = [
       faust-cchardet
       urllib3
     ]
-    ++ lib.optionals (pythonOlder "3.11") [ backports-datetime-fromisoformat ]
     ++ urllib3.optional-dependencies.brotli;
   };
 

From 0ebff31f162f5961a59df6c304b5ecd8e23a7ad8 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 9 Nov 2025 00:02:45 +0100
Subject: [PATCH 08/46] python313Packages.alexapy: 1.29.8 -> 1.29.9

Diff: https://gitlab.com/keatontaylor/alexapy/-/compare/v1.29.8...v1.29.9

Changelog: https://gitlab.com/keatontaylor/alexapy/-/blob/v1.29.9/CHANGELOG.md
---
 pkgs/development/python-modules/alexapy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/alexapy/default.nix b/pkgs/development/python-modules/alexapy/default.nix
index 100547acf298..5d4d34aca69f 100644
--- a/pkgs/development/python-modules/alexapy/default.nix
+++ b/pkgs/development/python-modules/alexapy/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "alexapy";
-  version = "1.29.8";
+  version = "1.29.9";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "keatontaylor";
     repo = "alexapy";
     tag = "v${version}";
-    hash = "sha256-AmczPJK7v1ymRT3XUUNzFR8GmDr9eZYGRH2FL3RvPsE=";
+    hash = "sha256-Ecj4IQd0UJuNcGqSj48WrULyOwkbNh1YITkj0ftS7yY=";
   };
 
   pythonRelaxDeps = [ "aiofiles" ];

From 445143845dc761030ca9a9c7ffedc15b0c16d823 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 9 Nov 2025 00:06:10 +0100
Subject: [PATCH 09/46] qovery-cli: 1.53.0 -> 1.54.0

Diff: https://github.com/Qovery/qovery-cli/compare/v1.53.0...v1.54.0

Changelog: https://github.com/Qovery/qovery-cli/releases/tag/v1.54.0
---
 pkgs/by-name/qo/qovery-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/qo/qovery-cli/package.nix b/pkgs/by-name/qo/qovery-cli/package.nix
index ab8083942882..8f4b5a9b204b 100644
--- a/pkgs/by-name/qo/qovery-cli/package.nix
+++ b/pkgs/by-name/qo/qovery-cli/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "qovery-cli";
-  version = "1.53.0";
+  version = "1.54.0";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kE45z/uObUcmjiYm7zO14Lhroe7PkD0pSYnRw4HbHcc=";
+    hash = "sha256-6z5s6bVzPYUHI3rBEddQT933Lj+hbcBK+safi5pHVO4=";
   };
 
-  vendorHash = "sha256-TDvlICfKLtrG/0KPpfrN61wpUZejaJGiRR4DUBNEllY=";
+  vendorHash = "sha256-1TprPzZb+Q9QcoGop6CAmnyqSU3dQ5CSAS0hsnQeWPw=";
 
   env.CGO_ENABLED = 0;
 

From e3f80ba2be13f3ca7e2382aa07b5cf8f911d94b1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Nov 2025 03:21:34 +0000
Subject: [PATCH 10/46] python3Packages.pylacus: 1.19.0 -> 1.19.1

---
 pkgs/development/python-modules/pylacus/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pylacus/default.nix b/pkgs/development/python-modules/pylacus/default.nix
index 10551ce6489e..51384b2aa280 100644
--- a/pkgs/development/python-modules/pylacus/default.nix
+++ b/pkgs/development/python-modules/pylacus/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pylacus";
-  version = "1.19.0";
+  version = "1.19.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "ail-project";
     repo = "PyLacus";
     tag = "v${version}";
-    hash = "sha256-Ezp/aFTETvU1bOZZvMlZn0XmaLWoOd6l8s0n5lIqV2w=";
+    hash = "sha256-aOTXz/77ZeX0xiMeUIaqDrtpMvIM7Idp+3rYeXJ4bpg=";
   };
 
   build-system = [ poetry-core ];

From d4554ab8d0106825e373d36c5431e0e5f7cf85b1 Mon Sep 17 00:00:00 2001
From: Ryan Hendrickson <ryan.hendrickson@alum.mit.edu>
Date: Sun, 9 Nov 2025 03:23:23 -0500
Subject: [PATCH 11/46] nixosTests.redlib: mock OAuth endpoint

---
 .../common/acme/server/generate-certs.nix     |  5 +----
 nixos/tests/redlib.nix                        | 22 +++++++++++++++++++
 nixos/tests/redlib/ca.cert.pem                | 13 +++++++++++
 nixos/tests/redlib/ca.key.pem                 |  6 +++++
 nixos/tests/redlib/snakeoil-certs.nix         | 17 ++++++++++++++
 nixos/tests/redlib/www.reddit.com.cert.pem    | 13 +++++++++++
 nixos/tests/redlib/www.reddit.com.key.pem     |  6 +++++
 7 files changed, 78 insertions(+), 4 deletions(-)
 create mode 100644 nixos/tests/redlib/ca.cert.pem
 create mode 100644 nixos/tests/redlib/ca.key.pem
 create mode 100644 nixos/tests/redlib/snakeoil-certs.nix
 create mode 100644 nixos/tests/redlib/www.reddit.com.cert.pem
 create mode 100644 nixos/tests/redlib/www.reddit.com.key.pem

diff --git a/nixos/tests/common/acme/server/generate-certs.nix b/nixos/tests/common/acme/server/generate-certs.nix
index 0cec83282707..a95c58a45964 100644
--- a/nixos/tests/common/acme/server/generate-certs.nix
+++ b/nixos/tests/common/acme/server/generate-certs.nix
@@ -4,11 +4,8 @@
   pkgs ? import <nixpkgs> { },
   minica ? pkgs.minica,
   mkDerivation ? pkgs.stdenv.mkDerivation,
+  domain ? (import ./snakeoil-certs.nix).domain,
 }:
-let
-  conf = import ./snakeoil-certs.nix;
-  domain = conf.domain;
-in
 mkDerivation {
   name = "test-certs";
   buildInputs = [
diff --git a/nixos/tests/redlib.nix b/nixos/tests/redlib.nix
index e03df475fe3d..9d7e7ec1632a 100644
--- a/nixos/tests/redlib.nix
+++ b/nixos/tests/redlib.nix
@@ -1,4 +1,8 @@
 { lib, pkgs, ... }:
+let
+  certs = import redlib/snakeoil-certs.nix;
+  redditDomain = certs.domain;
+in
 {
   name = "redlib";
   meta.maintainers = with lib.maintainers; [
@@ -7,6 +11,24 @@
   ];
 
   nodes.machine = {
+    # The test will hang if Redlib can't initialize its OAuth client, so we
+    # provide it with a mock endpoint.
+    networking.hosts."127.0.0.1" = [ redditDomain ];
+    security.pki.certificates = [
+      (builtins.readFile certs.ca.cert)
+    ];
+    services.nginx = {
+      enable = true;
+      virtualHosts.${redditDomain} = {
+        onlySSL = true;
+        sslCertificate = certs.${redditDomain}.cert;
+        sslCertificateKey = certs.${redditDomain}.key;
+        locations."/auth/v2/oauth/access-token/loid".extraConfig = ''
+          return 200 "{\"access_token\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\"expires_in\":0}";
+        '';
+      };
+    };
+
     services.redlib = {
       package = pkgs.redlib;
       enable = true;
diff --git a/nixos/tests/redlib/ca.cert.pem b/nixos/tests/redlib/ca.cert.pem
new file mode 100644
index 000000000000..0e0496e1ac37
--- /dev/null
+++ b/nixos/tests/redlib/ca.cert.pem
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB/TCCAYKgAwIBAgIIR+NCHSDJCIAwCgYIKoZIzj0EAwMwIDEeMBwGA1UEAxMV
+bWluaWNhIHJvb3QgY2EgNDdlMzQyMCAXDTI1MTEwOTA2MjMwNFoYDzIxMjUxMTA5
+MDYyMzA0WjAgMR4wHAYDVQQDExVtaW5pY2Egcm9vdCBjYSA0N2UzNDIwdjAQBgcq
+hkjOPQIBBgUrgQQAIgNiAASo81ED5tomfR47qFXpan+0cBKP7eoAhAAkJeT9w/h2
+axpVVQ/X+rDFu1QbKDqE7lJ2j3Ue7eb/6Q5Zrt9MSFPDcQz7eFr6kX0S2u5AHO9z
+6E60gUNUwZBDBenr0P/uTQ6jgYYwgYMwDgYDVR0PAQH/BAQDAgKEMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1Ud
+DgQWBBQuPLVPdRiEUCga2W3RKwL4diQVMDAfBgNVHSMEGDAWgBQuPLVPdRiEUCga
+2W3RKwL4diQVMDAKBggqhkjOPQQDAwNpADBmAjEAqG8PIYJ0CQG3CfLsQFpwDLmj
+DoEFgcRMkRQz4vtAQMpLhoo8VAPo7Vl+AAaZgRVPAjEA6XDte56Oou5qMj4Zkzi8
+EYIucHtYrfTNJOarDSYYvTlNrmuQ73KTP4Hxfd26TA2q
+-----END CERTIFICATE-----
diff --git a/nixos/tests/redlib/ca.key.pem b/nixos/tests/redlib/ca.key.pem
new file mode 100644
index 000000000000..d085e8ba3f85
--- /dev/null
+++ b/nixos/tests/redlib/ca.key.pem
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBuuWbxl4uwwcIT0SvT
+jcQHDekytbQrLw4imrpfrAJmTdvyHcfEGiWuwscs36mq50WhZANiAASo81ED5tom
+fR47qFXpan+0cBKP7eoAhAAkJeT9w/h2axpVVQ/X+rDFu1QbKDqE7lJ2j3Ue7eb/
+6Q5Zrt9MSFPDcQz7eFr6kX0S2u5AHO9z6E60gUNUwZBDBenr0P/uTQ4=
+-----END PRIVATE KEY-----
diff --git a/nixos/tests/redlib/snakeoil-certs.nix b/nixos/tests/redlib/snakeoil-certs.nix
new file mode 100644
index 000000000000..6fd0badcca7d
--- /dev/null
+++ b/nixos/tests/redlib/snakeoil-certs.nix
@@ -0,0 +1,17 @@
+# To generate cert files:
+# cp $(nix-build ../common/acme/server/generate-certs.nix --arg domain '(import ./snakeoil-certs.nix).domain' --no-out-link)/* .
+
+let
+  domain = "www.reddit.com";
+in
+{
+  inherit domain;
+  ca = {
+    cert = ./ca.cert.pem;
+    key = ./ca.key.pem;
+  };
+  ${domain} = {
+    cert = ./${domain}.cert.pem;
+    key = ./${domain}.key.pem;
+  };
+}
diff --git a/nixos/tests/redlib/www.reddit.com.cert.pem b/nixos/tests/redlib/www.reddit.com.cert.pem
new file mode 100644
index 000000000000..fbd8636683f4
--- /dev/null
+++ b/nixos/tests/redlib/www.reddit.com.cert.pem
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB5jCCAW2gAwIBAgIIFaN6FT3RbaswCgYIKoZIzj0EAwMwIDEeMBwGA1UEAxMV
+bWluaWNhIHJvb3QgY2EgNDdlMzQyMB4XDTI1MTEwOTA2MjMwNFoXDTQ1MTEwOTA2
+MjMwNFowGTEXMBUGA1UEAxMOd3d3LnJlZGRpdC5jb20wdjAQBgcqhkjOPQIBBgUr
+gQQAIgNiAAQpU1quYyW3g2ZjtwSFLNOhucqkjFhCN5rcSZOLpbnieelZ6axvoH6x
+2Znfcu4YqYtK8G/zHDv2o9gQQpDBcWp7dobpUVbfrSRxsr5LEYlEXPUslbFkFWau
+HzKTx5QTyu2jezB5MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcD
+AQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBQuPLVPdRiEUCga
+2W3RKwL4diQVMDAZBgNVHREEEjAQgg53d3cucmVkZGl0LmNvbTAKBggqhkjOPQQD
+AwNnADBkAjAqU0nW3KRXEZMTP9qjnNqherjVYa8WPWMCtwYqiFDOWilByZFjEZUs
+8it+unxaNe4CMA12fOFHgsM1tKRiSslIHXSx5V71RkXGrQxxqfRlD0w7LjsJWXRv
+Z6DKyxfF6MJPEA==
+-----END CERTIFICATE-----
diff --git a/nixos/tests/redlib/www.reddit.com.key.pem b/nixos/tests/redlib/www.reddit.com.key.pem
new file mode 100644
index 000000000000..d9f7056e6d68
--- /dev/null
+++ b/nixos/tests/redlib/www.reddit.com.key.pem
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDB1r7aQH0yOtCYquZXn
+1jVqo9gD7kIZRa4TaeHNRRKcv9w9WswTfSJ/0QILIFP0K7WhZANiAAQpU1quYyW3
+g2ZjtwSFLNOhucqkjFhCN5rcSZOLpbnieelZ6axvoH6x2Znfcu4YqYtK8G/zHDv2
+o9gQQpDBcWp7dobpUVbfrSRxsr5LEYlEXPUslbFkFWauHzKTx5QTyu0=
+-----END PRIVATE KEY-----

From 32d5a620f0aa55cbcc9a6d613cf8d83e9f2593ca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Nov 2025 10:26:06 +0000
Subject: [PATCH 12/46] python3Packages.cerberus: 1.3.7 -> 1.3.8

---
 pkgs/development/python-modules/cerberus/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cerberus/default.nix b/pkgs/development/python-modules/cerberus/default.nix
index 159bfc1662aa..eaf0c4e08a64 100644
--- a/pkgs/development/python-modules/cerberus/default.nix
+++ b/pkgs/development/python-modules/cerberus/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "cerberus";
-  version = "1.3.7";
+  version = "1.3.8";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "pyeve";
     repo = "cerberus";
     tag = version;
-    hash = "sha256-KYZpd8adKXahSc/amQHZMFdJtEtZLklZZgwfkYu8/qY=";
+    hash = "sha256-C7YZjqQtdkakqHXBU3cFUl/gCFvCl3saP14eqt2fdAM=";
   };
 
   build-system = [

From 4d2a9d6cf686cb91c8e45ebd03ed6ea26d27ca65 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Nov 2025 10:46:52 +0000
Subject: [PATCH 13/46] python3Packages.hier-config: 3.2.2 -> 3.3.0

---
 pkgs/development/python-modules/hier-config/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hier-config/default.nix b/pkgs/development/python-modules/hier-config/default.nix
index 15f980e1a36e..196dbda6b7e2 100644
--- a/pkgs/development/python-modules/hier-config/default.nix
+++ b/pkgs/development/python-modules/hier-config/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "hier-config";
-  version = "3.2.2";
+  version = "3.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "netdevops";
     repo = "hier_config";
     tag = "v${version}";
-    hash = "sha256-3xSxzdIxoQgJtA3CX141jP2Zl2j8Dwfplv4JYpHpCdQ=";
+    hash = "sha256-rIZ87jzpvSluDo+g3a2aHSmD7JXbZFHa7tvHePUwboI=";
   };
 
   build-system = [ poetry-core ];

From 47691257b504378e628fb28692c7f50aec0806c9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Nov 2025 11:55:02 +0000
Subject: [PATCH 14/46] python3Packages.model-checker: 1.2.11 -> 1.2.12

---
 pkgs/development/python-modules/model-checker/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/model-checker/default.nix b/pkgs/development/python-modules/model-checker/default.nix
index 422a5513b0e4..d5b978ee95eb 100644
--- a/pkgs/development/python-modules/model-checker/default.nix
+++ b/pkgs/development/python-modules/model-checker/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "model-checker";
-  version = "1.2.11";
+  version = "1.2.12";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "model_checker";
     inherit version;
-    hash = "sha256-OcF1aJgQFB+YTC6Ksx/WImKciOjodY0wq/KRUAxiqqU=";
+    hash = "sha256-vIH3CFgFEO+UlmpS7FhBsQtZv5Yep4OQ6koMGzyJGa4=";
   };
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail

From a53ea4159758dc9ba950d9fec848ecf85c4e7520 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sun, 9 Nov 2025 17:00:06 +0100
Subject: [PATCH 15/46] ggshield: 1.40.0 -> 1.44.1

https://github.com/GitGuardian/ggshield/blob/v1.44.1/CHANGELOG.md
---
 pkgs/tools/security/ggshield/default.nix | 9 +++++----
 pkgs/top-level/all-packages.nix          | 4 +---
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/tools/security/ggshield/default.nix b/pkgs/tools/security/ggshield/default.nix
index a197f7e3f85c..bbd189258bb0 100644
--- a/pkgs/tools/security/ggshield/default.nix
+++ b/pkgs/tools/security/ggshield/default.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ggshield";
-  version = "1.40.0";
+  version = "1.44.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "GitGuardian";
     repo = "ggshield";
     tag = "v${version}";
-    hash = "sha256-Y42MBRyjPljUAGTwhH2FS8drUAceuJse8Qd1GbctWQs=";
+    hash = "sha256-PHCrUzZmpjZMAfKinBYahhwQFjByaIQ/2udSqoGMmdU=";
   };
 
   pythonRelaxDeps = true;
@@ -22,7 +22,6 @@ python3.pkgs.buildPythonApplication rec {
   build-system = with python3.pkgs; [ pdm-backend ];
 
   dependencies = with python3.pkgs; [
-    appdirs
     charset-normalizer
     click
     cryptography
@@ -37,6 +36,8 @@ python3.pkgs.buildPythonApplication rec {
     requests
     rich
     truststore
+    typing-extensions
+    urllib3
   ];
 
   nativeCheckInputs = [
@@ -49,7 +50,7 @@ python3.pkgs.buildPythonApplication rec {
     pytest-mock
     pytest-voluptuous
     pytestCheckHook
-    snapshottest
+    syrupy
     vcrpy
   ]);
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1a89aeaffa4e..da478d44ac62 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2779,9 +2779,7 @@ with pkgs;
 
   gawkInteractive = gawk.override { interactive = true; };
 
-  ggshield = callPackage ../tools/security/ggshield {
-    python3 = python311;
-  };
+  ggshield = callPackage ../tools/security/ggshield { };
 
   gibberish-detector = with python3Packages; toPythonApplication gibberish-detector;
 

From 09d5435ac28d37ee4ae8d25b90872b71fd03d2be Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sun, 9 Nov 2025 17:05:48 +0100
Subject: [PATCH 16/46] ggshield: fix `meta.changelog`, remove `with lib;`

---
 pkgs/tools/security/ggshield/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/security/ggshield/default.nix b/pkgs/tools/security/ggshield/default.nix
index bbd189258bb0..1fb187fe69bb 100644
--- a/pkgs/tools/security/ggshield/default.nix
+++ b/pkgs/tools/security/ggshield/default.nix
@@ -81,12 +81,12 @@ python3.pkgs.buildPythonApplication rec {
     "test_get_file_sha_in_ref"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Tool to find and fix various types of hardcoded secrets and infrastructure-as-code misconfigurations";
     homepage = "https://github.com/GitGuardian/ggshield";
-    changelog = "https://github.com/GitGuardian/ggshield/blob/${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    changelog = "https://github.com/GitGuardian/ggshield/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
     mainProgram = "ggshield";
   };
 }

From 7660b3d5b6d8a801adfb2623ee42e37ae9a256ca Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sun, 9 Nov 2025 17:11:02 +0100
Subject: [PATCH 17/46] ggshield: move to `pkgs/by-name`

---
 .../ggshield/default.nix => by-name/gg/ggshield/package.nix}    | 0
 pkgs/top-level/all-packages.nix                                 | 2 --
 2 files changed, 2 deletions(-)
 rename pkgs/{tools/security/ggshield/default.nix => by-name/gg/ggshield/package.nix} (100%)

diff --git a/pkgs/tools/security/ggshield/default.nix b/pkgs/by-name/gg/ggshield/package.nix
similarity index 100%
rename from pkgs/tools/security/ggshield/default.nix
rename to pkgs/by-name/gg/ggshield/package.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index da478d44ac62..2754ead6e806 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2779,8 +2779,6 @@ with pkgs;
 
   gawkInteractive = gawk.override { interactive = true; };
 
-  ggshield = callPackage ../tools/security/ggshield { };
-
   gibberish-detector = with python3Packages; toPythonApplication gibberish-detector;
 
   gitlab-ee = callPackage ../by-name/gi/gitlab/package.nix {

From 5bf390d89edc5e9439425a245f41efcb62de3b40 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 9 Nov 2025 12:23:01 +0200
Subject: [PATCH 18/46] ycmd: 0-unstable-2025-{06-16 -> 10-24}

---
 pkgs/by-name/yc/ycmd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/yc/ycmd/package.nix b/pkgs/by-name/yc/ycmd/package.nix
index 6978a1b60085..3b2b06cbefaa 100644
--- a/pkgs/by-name/yc/ycmd/package.nix
+++ b/pkgs/by-name/yc/ycmd/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation {
   pname = "ycmd";
-  version = "0-unstable-2025-06-16";
+  version = "0-unstable-2025-10-24";
 
   # required for third_party directory creation
   src = fetchFromGitHub {
     owner = "ycm-core";
     repo = "ycmd";
-    rev = "9160b4eee67ea61c8501bad36d061bcec5340021";
+    rev = "7895484ad55e0cbd0686e882891d59661f183476";
     hash = "sha256-MSzYX1vXuhd4TNxUfHWaRu7O0r89az1XjZBIZ6B3gBk=";
     fetchSubmodules = true;
   };

From d17ec6705fed9ac6238187936c97e3f3cade99f0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Nov 2025 18:45:10 +0000
Subject: [PATCH 19/46] python3Packages.iamdata: 0.1.202511081 -> 0.1.202511091

---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index fde5b9ed486e..78261611b7dd 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "iamdata";
-  version = "0.1.202511081";
+  version = "0.1.202511091";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${version}";
-    hash = "sha256-0yV5yZ0gElw2p8UjwU6ujkXu1DV2cmOPlG9XgObUNUA=";
+    hash = "sha256-1XO1vovWAMIKOdEPKANLUBTfOHQuQrkp3ie5aAFYlDI=";
   };
 
   __darwinAllowLocalNetworking = true;

From 013af00de98ee4a9801be912bf253b93a545a04a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Nov 2025 19:20:19 +0000
Subject: [PATCH 20/46] trufflehog: 3.90.12 -> 3.90.13

---
 pkgs/by-name/tr/trufflehog/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/tr/trufflehog/package.nix b/pkgs/by-name/tr/trufflehog/package.nix
index 08fa92c2bb99..78a2fdd64e37 100644
--- a/pkgs/by-name/tr/trufflehog/package.nix
+++ b/pkgs/by-name/tr/trufflehog/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.90.12";
+  version = "3.90.13";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${version}";
-    hash = "sha256-r+j9YnRKQ5m7XLavM5rARRZwDiNTcGmxpL6Sv8eTZLE=";
+    hash = "sha256-mds8LVRws1r91OoGy4kQXyXdPM0GfTnbkh1Q6ib52x8=";
   };
 
   vendorHash = "sha256-zQ67yLN/HCshOndP/FAUOOyiQpOjyOJChkZZmFb06WM=";

From 6ce2b613d1d6c8cd8fe1efa0fe1faf7ece9910ef Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Nov 2025 19:38:13 +0000
Subject: [PATCH 21/46] python3Packages.xknx: 3.10.0 -> 3.10.1

---
 pkgs/development/python-modules/xknx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/xknx/default.nix b/pkgs/development/python-modules/xknx/default.nix
index e7e06f673eb8..958102290648 100644
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "xknx";
-  version = "3.10.0";
+  version = "3.10.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "XKNX";
     repo = "xknx";
     tag = version;
-    hash = "sha256-tkZ0Hltpd5DARxYc05LjDTlB62jsJJJ8v/oUuVPT/uo=";
+    hash = "sha256-vyGQ1e4MDkCau1hQkcxKfUgEo9PYUXzeky4LSqOW93E=";
   };
 
   build-system = [ setuptools ];

From 3ca72815d58b77ec1ff0bef0950bd3f6478cd23d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Nov 2025 20:08:31 +0000
Subject: [PATCH 22/46] python3Packages.metaflow: 2.19.0 -> 2.19.6

---
 pkgs/development/python-modules/metaflow/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/metaflow/default.nix b/pkgs/development/python-modules/metaflow/default.nix
index fa6892b17517..1c8e541c5f48 100644
--- a/pkgs/development/python-modules/metaflow/default.nix
+++ b/pkgs/development/python-modules/metaflow/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "metaflow";
-  version = "2.19.0";
+  version = "2.19.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Netflix";
     repo = "metaflow";
     tag = version;
-    hash = "sha256-MMPkQ1cjl/Sid4RyvP04xIDb6Xtr5S+LdJTOYgo0LFQ=";
+    hash = "sha256-heJz9rk2nTMrHc2213J1die6QX/jkOG6ohmufGXCNso=";
   };
 
   build-system = [

From bc0ebc8383b5294308a904b9286082c08fb93dbe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Nov 2025 23:55:42 +0000
Subject: [PATCH 23/46] python3Packages.mitogen: 0.3.30 -> 0.3.31

---
 pkgs/development/python-modules/mitogen/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mitogen/default.nix b/pkgs/development/python-modules/mitogen/default.nix
index b11f0420ecfd..08115a3690df 100644
--- a/pkgs/development/python-modules/mitogen/default.nix
+++ b/pkgs/development/python-modules/mitogen/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "mitogen";
-  version = "0.3.30";
+  version = "0.3.31";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "mitogen-hq";
     repo = "mitogen";
     tag = "v${version}";
-    hash = "sha256-witxGRPi2TOwLOnsJcxOKLJdZ6ggapANXneFMJdHa98=";
+    hash = "sha256-ecDRva+K/caMV9T5W5dxFRwJyGvrURpexOa5bNyXkb4=";
   };
 
   build-system = [ setuptools ];

From 9a86a3568f4653758c8aeff29852a60248901bba Mon Sep 17 00:00:00 2001
From: Gliczy <129636582+Gliczy@users.noreply.github.com>
Date: Mon, 10 Nov 2025 01:02:42 +0100
Subject: [PATCH 24/46] chicago95: fix `noBrokenSymlinks`

---
 pkgs/by-name/ch/chicago95/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/ch/chicago95/package.nix b/pkgs/by-name/ch/chicago95/package.nix
index d3a9e61289a7..1901362a646c 100644
--- a/pkgs/by-name/ch/chicago95/package.nix
+++ b/pkgs/by-name/ch/chicago95/package.nix
@@ -18,6 +18,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ gtk3 ];
 
+  buildPhase = ''
+    runHook preBuild
+    find . -xtype l -delete
+    runHook postBuild
+  '';
+
   installPhase = ''
     runHook preInstall
 

From ccf9d4127e02506b972cc78fe7ecf89392e9cfab Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 10 Nov 2025 02:24:41 +0000
Subject: [PATCH 25/46] python3Packages.whirlpool-sixth-sense: 1.0.2 -> 1.0.3

---
 .../python-modules/whirlpool-sixth-sense/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix b/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
index 41501959d4fa..bb2b1cf0041c 100644
--- a/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
+++ b/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "whirlpool-sixth-sense";
-  version = "1.0.2";
+  version = "1.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "abmantis";
     repo = "whirlpool-sixth-sense";
     tag = version;
-    hash = "sha256-Xgz9SqH++pWZb7r1qxOrEEfC7I80qhrqcI0Zlduxlq4=";
+    hash = "sha256-SXa5Ccnng1McWgSWy85xCEr7odtBSJtJhjZoC/JfI/A=";
   };
 
   build-system = [ setuptools ];

From ced3c3fda934afc01a4ee8b6826d48ef561b23a4 Mon Sep 17 00:00:00 2001
From: Nikita Wootten <me@nikita.computer>
Date: Sun, 9 Nov 2025 21:26:04 -0500
Subject: [PATCH 26/46] poutine: 0.15.2 -> 1.0.4

---
 pkgs/by-name/po/poutine/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/po/poutine/package.nix b/pkgs/by-name/po/poutine/package.nix
index b41951ad7671..d6de3256a338 100644
--- a/pkgs/by-name/po/poutine/package.nix
+++ b/pkgs/by-name/po/poutine/package.nix
@@ -8,22 +8,25 @@
 
 buildGoModule rec {
   pname = "poutine";
-  version = "0.15.2";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "boostsecurityio";
     repo = "poutine";
     tag = "v${version}";
-    hash = "sha256-YBoGsexYT2/lAWEajMVa/xNRBv1R1i0hB6pTAlk43E0=";
+    hash = "sha256-Rk4Fd/h83NKIVlz/QXOSLnCKfxfKFXUfvUF5FSjomQY=";
   };
 
-  vendorHash = "sha256-CZLzIGu6jj4JXmKJaWmyeRvcRNjBYecblW47kcsg5Nw=";
+  vendorHash = "sha256-qp3Ko+01kk9AH0oCT2Si/si+74gT5KFtPFslwih/IBE=";
 
   ldflags = [
     "-s"
     "-w"
   ];
 
+  # "dagger" directory contains its own go module, which should be excluded from the build
+  excludedPackages = [ "dagger" ];
+
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
@@ -40,6 +43,5 @@ buildGoModule rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "poutine";
-    broken = stdenv.hostPlatform.isDarwin;
   };
 }

From f186ff8e50afab79930db090b40c78fa4f9a8f0f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 10 Nov 2025 03:32:44 +0000
Subject: [PATCH 27/46] oci-cli: 3.69.0 -> 3.70.0

---
 pkgs/by-name/oc/oci-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/oc/oci-cli/package.nix b/pkgs/by-name/oc/oci-cli/package.nix
index ce3535b5a0ed..4472a612da3d 100644
--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@@ -25,14 +25,14 @@ in
 
 py.pkgs.buildPythonApplication rec {
   pname = "oci-cli";
-  version = "3.69.0";
+  version = "3.70.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "oci-cli";
     tag = "v${version}";
-    hash = "sha256-mGwe3I8LobdoIQQrWLUDz0ARD8/WVIoNt80TatdtDKo=";
+    hash = "sha256-RB6NTxLFHnDunDEPTVg9fWoIKiWCAzUgzhlydFshmaI=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

From f102dc554a13050fa66bdb4a2fdd7c381f5c32b6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 10 Nov 2025 05:07:14 +0000
Subject: [PATCH 28/46] cnspec: 12.7.1 -> 12.8.0

---
 pkgs/by-name/cn/cnspec/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index 5210397c707c..927d9904b7de 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "12.7.1";
+  version = "12.8.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${version}";
-    hash = "sha256-IriF6vr2Kw7h44zFd7hMhybseqtlYepjfQl+Z54fdbQ=";
+    hash = "sha256-9vGqElva4sS0uV2Be1WV9dW2bLYNOFZRB3wF3rSassM=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-P0spAsBp3jv0Nn4gVYTd+5WbWQgGZ83fyzxT3i0ncHs=";
+  vendorHash = "sha256-aEiHnYEJGg+kTUN2k9GKUtSaNpdQio5OsEJ8EnbxPLk=";
 
   subPackages = [ "apps/cnspec" ];
 

From 270dc15730b4123f742473c6fa834c2fc8cb246a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 10 Nov 2025 05:11:33 +0000
Subject: [PATCH 29/46] mdfried: 0.13.0 -> 0.14.4

---
 pkgs/by-name/md/mdfried/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/md/mdfried/package.nix b/pkgs/by-name/md/mdfried/package.nix
index 33c4019dabdf..625c4b439577 100644
--- a/pkgs/by-name/md/mdfried/package.nix
+++ b/pkgs/by-name/md/mdfried/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdfried";
-  version = "0.13.0";
+  version = "0.14.4";
 
   src = fetchFromGitHub {
     owner = "benjajaja";
     repo = "mdfried";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BMBV01VF0oubtFP6WHBiZqUAkxkhsxggPZ0255pONoA=";
+    hash = "sha256-MvyLJyCfZw4pCJOHwqcxtgKVrUE7dHFzoVyQwwfA69k=";
   };
 
-  cargoHash = "sha256-FJFdGhoV7Y9sy24DmqLiuwgOryodLjacobeT9jamEfk=";
+  cargoHash = "sha256-FFKtJI3mBkRQARm6urcgbUNnBEyZA3BI4epsRVb1dwc=";
 
   doCheck = true;
 

From 180f8273404ab86401151b88024509a14378a575 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 10 Nov 2025 05:44:30 +0000
Subject: [PATCH 30/46] python3Packages.libuuu: 1.5.233 -> 1.5.239

---
 pkgs/development/python-modules/libuuu/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/libuuu/default.nix b/pkgs/development/python-modules/libuuu/default.nix
index 45f14805c02e..8e236742c9c5 100644
--- a/pkgs/development/python-modules/libuuu/default.nix
+++ b/pkgs/development/python-modules/libuuu/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "libuuu";
-  version = "1.5.233";
+  version = "1.5.239";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SbnQs+khNT1DwrctwHi0rsuO1WR/KgA7TUFARw9AHAU=";
+    hash = "sha256-fknRdLwdB3JCnd6OJzU4jiOWvKgsQJdYkvBgONddaCY=";
   };
 
   build-system = [

From 92147c20e2e79340af8d0da37965a97c402fad60 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Silva?= <andrerfosilva@gmail.com>
Date: Mon, 10 Nov 2025 08:38:35 +0000
Subject: [PATCH 31/46] codex: 0.56.0 -> 0.57.0

---
 pkgs/by-name/co/codex/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 0a2afc4c8aab..72a1bbd8d717 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -14,18 +14,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.56.0";
+  version = "0.57.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-CIKoOfqZwCCCDFXnRdU7haxfiyvrgGD3vSwXZpE9DUU=";
+    hash = "sha256-Mjn2SesclOTBLiE7hQRtdyI/TpIM5lw2uswYyCMhyGY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-FN20afqRVdGl17+fbzNoXqF8BY+dPtGi1lvwB6w+ieE=";
+  cargoHash = "sha256-ijXcYBMP63VzeHqVTEebJ83cYQtQgHU62kWklA1NHEA=";
 
   nativeBuildInputs = [
     installShellFiles

From 9ddf5e6f3d01d699a6808e1bd711e569a87fd48a Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sun, 9 Nov 2025 23:08:44 +0000
Subject: [PATCH 32/46] uutils-coreutils: fix for aarch64-linux

---
 pkgs/by-name/uu/uutils-coreutils/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/uu/uutils-coreutils/package.nix b/pkgs/by-name/uu/uutils-coreutils/package.nix
index 686fc1404f02..d7a865719001 100644
--- a/pkgs/by-name/uu/uutils-coreutils/package.nix
+++ b/pkgs/by-name/uu/uutils-coreutils/package.nix
@@ -30,6 +30,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-4C4i3oHw9WHwuq9DOufRvc/tOdwqHmYF/gUr2VkRmwM=";
   };
 
+  # error: linker `aarch64-linux-gnu-gcc` not found
+  postPatch = ''
+    rm .cargo/config.toml
+  '';
+
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "uutils-coreutils-${finalAttrs.version}";

From 22db7a73e4b4145220408222869031df11c5b768 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Mon, 10 Nov 2025 09:55:48 +0100
Subject: [PATCH 33/46] SDL_compat: revert breaking upstream change

Fixes several of the build failures that were caused by
<https://github.com/NixOS/nixpkgs/pull/457112>, e.g.:

* https://hydra.nixos.org/build/311791969
* https://hydra.nixos.org/build/311791578
* https://hydra.nixos.org/build/311802072

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 pkgs/by-name/sd/SDL_compat/package.nix | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/sd/SDL_compat/package.nix b/pkgs/by-name/sd/SDL_compat/package.nix
index 737170945a9f..c47b15a164ab 100644
--- a/pkgs/by-name/sd/SDL_compat/package.nix
+++ b/pkgs/by-name/sd/SDL_compat/package.nix
@@ -4,6 +4,7 @@
   cmake,
   darwin,
   fetchFromGitHub,
+  fetchpatch2,
   libGLU,
   libiconv,
   libX11,
@@ -84,10 +85,18 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/lib/pkgconfig/sdl12_compat.pc $out/lib/pkgconfig/sdl.pc
   '';
 
-  # The setup hook scans paths of buildInputs to find SDL related packages and
-  # adds their include and library paths to environment variables. The sdl-config
-  # is patched to use these variables to produce correct flags for compiler.
-  patches = [ ./find-headers.patch ];
+  patches = [
+    # The setup hook scans paths of buildInputs to find SDL related packages and
+    # adds their include and library paths to environment variables. The sdl-config
+    # is patched to use these variables to produce correct flags for compiler.
+    ./find-headers.patch
+
+    # https://github.com/libsdl-org/sdl12-compat/issues/382
+    (fetchpatch2 {
+      url = "https://github.com/libsdl-org/sdl12-compat/commit/bef8f7412dd44edc4f7e14dc35d3b20399e25496.patch?full_index=1";
+      hash = "sha256-5kJawjmA8C3uH3OIXHmqQjnIRtoTJtXmm3iLxG3e1qc=";
+    })
+  ];
   setupHook = ./setup-hook.sh;
 
   passthru.tests = {

From a9352160f133ce9b7410da232fc82308d3d71c5c Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 9 Nov 2025 12:12:18 +0200
Subject: [PATCH 34/46] python3Packages.pytest-lsp: 0.4.3 -> 1.0.0

Changelog: https://github.com/swyddfa/lsp-devtools/blob/develop/lib/pytest-lsp/CHANGES.md
---
 pkgs/development/python-modules/pytest-lsp/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-lsp/default.nix b/pkgs/development/python-modules/pytest-lsp/default.nix
index 4fa32e477d79..d1758b118cf6 100644
--- a/pkgs/development/python-modules/pytest-lsp/default.nix
+++ b/pkgs/development/python-modules/pytest-lsp/default.nix
@@ -3,20 +3,21 @@
   fetchPypi,
   buildPythonPackage,
   hatchling,
-  pygls,
+  pygls_2,
   pytestCheckHook,
   pytest-asyncio,
+  packaging,
 }:
 
 buildPythonPackage rec {
   pname = "pytest-lsp";
-  version = "0.4.3";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "pytest_lsp";
-    hash = "sha256-ND9r2i+qMg7V/Ld8lCDScDzlZdHRRP6CfjGYp9wpkRw=";
+    hash = "sha256-uoyVstl1o2Akn/pXaOHm9E2H0Q73dUBw07MhECckovE=";
   };
 
   build-system = [
@@ -24,8 +25,9 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    pygls
+    pygls_2
     pytest-asyncio
+    packaging
   ];
 
   nativeCheckInputs = [

From 32836b97f5947950f8d4db06f40150f6d18d2b16 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 9 Nov 2025 12:15:19 +0200
Subject: [PATCH 35/46] python3Packages.jedi-language-server: 0.45.1 -> 0.46.0

Diff: https://github.com/pappasam/jedi-language-server/compare/v0.45.1...v0.46.0

Changelog: https://github.com/pappasam/jedi-language-server/blob/v0.46.0/CHANGELOG.md
---
 .../jedi-language-server/default.nix             | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/jedi-language-server/default.nix b/pkgs/development/python-modules/jedi-language-server/default.nix
index 39156bb4aaf4..9d468fcd8cc0 100644
--- a/pkgs/development/python-modules/jedi-language-server/default.nix
+++ b/pkgs/development/python-modules/jedi-language-server/default.nix
@@ -11,9 +11,9 @@
   # dependencies
   docstring-to-markdown,
   jedi,
-  lsprotocol,
-  pydantic,
-  pygls,
+  lsprotocol_2025,
+  cattrs,
+  pygls_2,
 
   # tests
   pytestCheckHook,
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "jedi-language-server";
-  version = "0.45.1";
+  version = "0.46.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "pappasam";
     repo = "jedi-language-server";
     tag = "v${version}";
-    hash = "sha256-uO7+ui9FEeMF4sC/jI91px5wEWecvfJApogFMfwpPEs=";
+    hash = "sha256-8B/FYktdWtZvB8Us6zQ3gvx1MxJTzP2xyj1VhnM+Viw=";
   };
 
   build-system = [
@@ -42,9 +42,9 @@ buildPythonPackage rec {
   dependencies = [
     docstring-to-markdown
     jedi
-    lsprotocol
-    pydantic
-    pygls
+    lsprotocol_2025
+    cattrs
+    pygls_2
   ];
 
   nativeCheckInputs = [

From 94f72323f416445ca2fa47651d30d0c33a57ab3a Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 9 Nov 2025 12:15:43 +0200
Subject: [PATCH 36/46] python3Packages.ufmt: 2.8.0 -> 2.9.0

Diff: https://github.com/omnilib/ufmt/compare/v2.8.0...v2.9.0

Changelog: https://github.com/omnilib/ufmt/blob/2.9.0/CHANGELOG.md
---
 .../python-modules/ufmt/default.nix           | 20 ++++---------------
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/python-modules/ufmt/default.nix b/pkgs/development/python-modules/ufmt/default.nix
index 7537b44f8d60..8215f457ab54 100644
--- a/pkgs/development/python-modules/ufmt/default.nix
+++ b/pkgs/development/python-modules/ufmt/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch2,
 
   # build-system
   flit-core,
@@ -18,7 +17,7 @@
   usort,
 
   # optional-dependencies
-  pygls,
+  pygls_2,
   ruff-api,
 
   # tests
@@ -28,27 +27,16 @@
 
 buildPythonPackage rec {
   pname = "ufmt";
-  version = "2.8.0";
+  version = "2.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "omnilib";
     repo = "ufmt";
     tag = "v${version}";
-    hash = "sha256-oEvvXUju7qne3pCwnrckplMs0kBJavB669qieXJZPKw=";
+    hash = "sha256-/5sfawsBmsStCCdu4lIq2iL0zywrWAN+qW/t3h2UIu0=";
   };
 
-  patches = [
-    # Fix click 8.2.x incompatibility
-    # TypeError: CliRunner.__init__() got an unexpected keyword argument 'mix_stderr'
-    # https://github.com/omnilib/ufmt/pull/260
-    (fetchpatch2 {
-      name = "fix-click-incompatibility.patch";
-      url = "https://github.com/omnilib/ufmt/pull/260/commits/7980d7cd0a29fbd287e10d939248ef7c9d38a660.patch";
-      hash = "sha256-97/jQVGCC+PXk8uxyF/M7XlLuVqJ5SgQZd/MXkaiO70=";
-    })
-  ];
-
   build-system = [ flit-core ];
 
   dependencies = [
@@ -63,7 +51,7 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = {
-    lsp = [ pygls ];
+    lsp = [ pygls_2 ];
     ruff = [ ruff-api ];
   };
 

From 4f26e36f399d62490722f2eaa9c4561c80be5aa0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 7 Nov 2025 02:28:26 +0000
Subject: [PATCH 37/46] python3Packages.lsp-tree-sitter: 0.0.18 -> 0.1.1

---
 .../python-modules/lsp-tree-sitter/default.nix            | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/lsp-tree-sitter/default.nix b/pkgs/development/python-modules/lsp-tree-sitter/default.nix
index 37395c94091e..262b4155713a 100644
--- a/pkgs/development/python-modules/lsp-tree-sitter/default.nix
+++ b/pkgs/development/python-modules/lsp-tree-sitter/default.nix
@@ -7,21 +7,21 @@
   colorama,
   jinja2,
   jsonschema,
-  pygls,
+  pygls_2,
   tree-sitter,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "lsp-tree-sitter";
-  version = "0.0.18";
+  version = "0.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "neomutt";
     repo = "lsp-tree-sitter";
     tag = version;
-    hash = "sha256-Hjl3EASaOWmLZpBxmyelSUTy7jJEIEo77IIQh5DHIbg=";
+    hash = "sha256-H5yb33ZsqRtqm1zlnOI0WUfcM2VDKn+qyezmFNtdLGA=";
   };
 
   build-system = [
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     colorama
     jinja2
     jsonschema
-    pygls
+    pygls_2
     tree-sitter
   ];
   nativeCheckInputs = [ pytestCheckHook ];

From 5e99c199d0de7d4f31ddc5e7ac967937b50a7b79 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 9 Nov 2025 11:58:39 +0200
Subject: [PATCH 38/46] autotools-language-server: 0.0.22 -> 0.0.23

Diff: https://github.com/Freed-Wu/autotools-language-server/compare/0.0.22...0.0.23
---
 pkgs/by-name/au/autotools-language-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/au/autotools-language-server/package.nix b/pkgs/by-name/au/autotools-language-server/package.nix
index 020a5d04f58d..b1fbff0a93d7 100644
--- a/pkgs/by-name/au/autotools-language-server/package.nix
+++ b/pkgs/by-name/au/autotools-language-server/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "autotools-language-server";
-  version = "0.0.22";
+  version = "0.0.23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Freed-Wu";
     repo = "autotools-language-server";
     tag = version;
-    hash = "sha256-PvaEcdvUE8QpxKuW65RL8SgDl/RM/C3HTEK3v+YA73c=";
+    hash = "sha256-cehiqxst3iGpR2UnkpN7wVAxd924n0ZNek3aiwEW+ZA=";
   };
 
   build-system = [

From 26bc2dc444fb8424e1661a017a164e631086125e Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 9 Nov 2025 18:59:53 +0200
Subject: [PATCH 39/46] python3.pkgs.jedi-language-server: use
 writableTmpDirAsHomeHook

---
 .../python-modules/jedi-language-server/default.nix         | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/jedi-language-server/default.nix b/pkgs/development/python-modules/jedi-language-server/default.nix
index 9d468fcd8cc0..bc163b53b462 100644
--- a/pkgs/development/python-modules/jedi-language-server/default.nix
+++ b/pkgs/development/python-modules/jedi-language-server/default.nix
@@ -19,6 +19,7 @@
   pytestCheckHook,
   pyhamcrest,
   python-lsp-jsonrpc,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
@@ -51,12 +52,9 @@ buildPythonPackage rec {
     pytestCheckHook
     pyhamcrest
     python-lsp-jsonrpc
+    writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    HOME="$(mktemp -d)"
-  '';
-
   disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
     # https://github.com/pappasam/jedi-language-server/issues/313
     "test_publish_diagnostics_on_change"

From 11e6cfbb33a890770430abbd5d6ec3df42f55c7d Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 9 Nov 2025 19:43:15 +0200
Subject: [PATCH 40/46] ycmd: remove pybind11, as it is bundled with src

---
 pkgs/by-name/yc/ycmd/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/yc/ycmd/package.nix b/pkgs/by-name/yc/ycmd/package.nix
index 3b2b06cbefaa..33ddbdcad837 100644
--- a/pkgs/by-name/yc/ycmd/package.nix
+++ b/pkgs/by-name/yc/ycmd/package.nix
@@ -50,7 +50,6 @@ stdenv.mkDerivation {
     ++ [
       jedi
       jedi-language-server
-      pybind11
     ];
 
   buildPhase = ''

From 280502f64bdd24cbaffc1a64f59f0c41bef2abaf Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 10 Nov 2025 10:30:41 +0100
Subject: [PATCH 41/46] python313Packages.mitogen: remove disabled

---
 pkgs/development/python-modules/mitogen/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/python-modules/mitogen/default.nix b/pkgs/development/python-modules/mitogen/default.nix
index 08115a3690df..880c87fb03b8 100644
--- a/pkgs/development/python-modules/mitogen/default.nix
+++ b/pkgs/development/python-modules/mitogen/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
   setuptools,
 }:
 
@@ -11,8 +10,6 @@ buildPythonPackage rec {
   version = "0.3.31";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "mitogen-hq";
     repo = "mitogen";

From 8e852c1f297b41c58d32074d393ea23185221aa5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 10 Nov 2025 10:35:12 +0100
Subject: [PATCH 42/46] python313Packages.whirlpool-sixth-sense: modernize

---
 .../python-modules/whirlpool-sixth-sense/default.nix        | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix b/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
index bb2b1cf0041c..d71e045a5470 100644
--- a/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
+++ b/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
@@ -9,7 +9,6 @@
   pytest-asyncio,
   pytest-mock,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
   websockets,
 }:
@@ -19,8 +18,6 @@ buildPythonPackage rec {
   version = "1.0.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.11";
-
   src = fetchFromGitHub {
     owner = "abmantis";
     repo = "whirlpool-sixth-sense";
@@ -49,7 +46,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for Whirlpool 6th Sense appliances";
     homepage = "https://github.com/abmantis/whirlpool-sixth-sense/";
-    license = with licenses; [ mit ];
+    changelog = "https://github.com/abmantis/whirlpool-sixth-sense/releases/tag/${src.tag}";
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }

From bf3503cef77b0246085a0c9919a8e7b0c3f647be Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 10 Nov 2025 10:35:25 +0100
Subject: [PATCH 43/46] python313Packages.model-checker: remove disabled

---
 pkgs/development/python-modules/model-checker/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/python-modules/model-checker/default.nix b/pkgs/development/python-modules/model-checker/default.nix
index d5b978ee95eb..cc95fd51bb96 100644
--- a/pkgs/development/python-modules/model-checker/default.nix
+++ b/pkgs/development/python-modules/model-checker/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchPypi,
   networkx,
-  pythonOlder,
   setuptools,
   tqdm,
   z3-solver,
@@ -14,8 +13,6 @@ buildPythonPackage rec {
   version = "1.2.12";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchPypi {
     pname = "model_checker";
     inherit version;

From 1a4852787b7ab2c5abd61bebf2e5017b01725762 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 10 Nov 2025 10:38:03 +0100
Subject: [PATCH 44/46] python313Packages.pylacus: remove disabled

---
 pkgs/development/python-modules/pylacus/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/python-modules/pylacus/default.nix b/pkgs/development/python-modules/pylacus/default.nix
index 51384b2aa280..5d1d564584d7 100644
--- a/pkgs/development/python-modules/pylacus/default.nix
+++ b/pkgs/development/python-modules/pylacus/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
-  pythonOlder,
   requests,
 }:
 
@@ -12,8 +11,6 @@ buildPythonPackage rec {
   version = "1.19.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "ail-project";
     repo = "PyLacus";

From 3de5d06c54636db133ec3fec951e994454b84b46 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 10 Nov 2025 11:19:34 +0100
Subject: [PATCH 45/46] python313Packages.cerberus: remove disabled

---
 pkgs/development/python-modules/cerberus/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/python-modules/cerberus/default.nix b/pkgs/development/python-modules/cerberus/default.nix
index eaf0c4e08a64..0524a11daba2 100644
--- a/pkgs/development/python-modules/cerberus/default.nix
+++ b/pkgs/development/python-modules/cerberus/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   poetry-core,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
 }:
 
@@ -13,8 +12,6 @@ buildPythonPackage rec {
   version = "1.3.8";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "pyeve";
     repo = "cerberus";

From 1aaea419cd3c730d19fbeacd26fc21805a17aa3d Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Mon, 10 Nov 2025 11:41:46 +0100
Subject: [PATCH 46/46] vcv-rack: update apple-sdk to 14 to fix eval

---
 pkgs/by-name/vc/vcv-rack/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vc/vcv-rack/package.nix b/pkgs/by-name/vc/vcv-rack/package.nix
index 337995abe01e..692c88ab0e3a 100644
--- a/pkgs/by-name/vc/vcv-rack/package.nix
+++ b/pkgs/by-name/vc/vcv-rack/package.nix
@@ -1,6 +1,6 @@
 {
   alsa-lib,
-  apple-sdk_13,
+  apple-sdk_14,
   cmake,
   copyDesktopItems,
   curl,
@@ -123,7 +123,7 @@ let
       libjack2
       libpulseaudio
     ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin [ apple-sdk_13 ];
+    ++ lib.optional stdenv.hostPlatform.isDarwin [ apple-sdk_14 ];
 
     cmakeFlags = [
       (lib.cmakeBool "RTAUDIO_API_ALSA" stdenv.hostPlatform.isLinux)
@@ -277,7 +277,7 @@ stdenv.mkDerivation (finalAttrs: {
     libpulseaudio
     zenity
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_13 ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_14 ];
 
   enableParallelBuilding = true;