From efbd6691a089b0831a279dee38079df224b346b4 Mon Sep 17 00:00:00 2001
From: eymeric <eymericdechelette@gmail.com>
Date: Sat, 7 Jun 2025 17:43:10 +0200
Subject: [PATCH 001/190] kdenlive: add to release-cuda

---
 pkgs/top-level/release-cuda.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/release-cuda.nix b/pkgs/top-level/release-cuda.nix
index f5800cc7828f..189a720e83a0 100644
--- a/pkgs/top-level/release-cuda.nix
+++ b/pkgs/top-level/release-cuda.nix
@@ -90,6 +90,7 @@ let
       gimp3 = linux;
       gpu-screen-recorder = linux;
       gst_all_1.gst-plugins-bad = linux;
+      kdePackages.kdenlive = linux;
       lightgbm = linux;
       llama-cpp = linux;
       meshlab = linux;

From f5e7f9cd07989458512bb185fe2226402d9a3db5 Mon Sep 17 00:00:00 2001
From: eymeric <eymericdechelette@gmail.com>
Date: Sat, 7 Jun 2025 17:43:21 +0200
Subject: [PATCH 002/190] octave: add to release-cuda

---
 pkgs/top-level/release-cuda.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/release-cuda.nix b/pkgs/top-level/release-cuda.nix
index 189a720e83a0..2fb616c2d46a 100644
--- a/pkgs/top-level/release-cuda.nix
+++ b/pkgs/top-level/release-cuda.nix
@@ -98,6 +98,7 @@ let
       monado = linux; # Failed in https://github.com/NixOS/nixpkgs/pull/233581
       noisetorch = linux;
       obs-studio-plugins.obs-backgroundremoval = linux;
+      octave = linux; # because depend on SuiteSparse which need rebuild when cuda enabled
       ollama = linux;
       onnxruntime = linux;
       openmvg = linux;

From 9fdce1a71b7008d7f2bd52de21065c66d055ea4b Mon Sep 17 00:00:00 2001
From: Stefan <stefan@eu90h.com>
Date: Wed, 11 Jun 2025 23:08:46 -0400
Subject: [PATCH 003/190] maintainers: add eu90h

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a48b7d44626f..8e4408631e88 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7754,6 +7754,12 @@
     name = "Elis Hirwing";
     keys = [ { fingerprint = "67FE 98F2 8C44 CF22 1828  E12F D57E FA62 5C9A 925F"; } ];
   };
+  eu90h = {
+    email = "stefan@eu90h.com";
+    github = "eu90h";
+    githubId = 5161785;
+    name = "Stefan";
+  };
   euank = {
     email = "euank-nixpkg@euank.com";
     github = "euank";

From af9937b224867c2c94182ed9bb63fedaee5430f9 Mon Sep 17 00:00:00 2001
From: Stefan <stefan@eu90h.com>
Date: Wed, 11 Jun 2025 23:09:30 -0400
Subject: [PATCH 004/190] python-modules.langchain-google-genai: init at 2.1.5

---
 .../langchain-google-genai/default.nix        | 89 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 91 insertions(+)
 create mode 100644 pkgs/development/python-modules/langchain-google-genai/default.nix

diff --git a/pkgs/development/python-modules/langchain-google-genai/default.nix b/pkgs/development/python-modules/langchain-google-genai/default.nix
new file mode 100644
index 000000000000..0bb29afa3d52
--- /dev/null
+++ b/pkgs/development/python-modules/langchain-google-genai/default.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  filetype,
+  google-api-core,
+  google-auth,
+  google-generativeai,
+  langchain-core,
+  pydantic,
+
+  # tests
+  freezegun,
+  langchain-tests,
+  numpy,
+  pytest-asyncio,
+  pytest-mock,
+  pytestCheckHook,
+  syrupy,
+
+  # passthru
+  gitUpdater,
+}:
+
+buildPythonPackage rec {
+  pname = "langchain-google-genai";
+  version = "2.1.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "langchain-ai";
+    repo = "langchain-google";
+    tag = "libs/genai/v${version}";
+    hash = "sha256-NCy4PHUSChsMVSebshDRGsg/koY7S4+mvI+GlIqW4q4=";
+  };
+
+  sourceRoot = "${src.name}/libs/genai";
+
+  build-system = [ poetry-core ];
+
+  pythonRelaxDeps = [
+    # Each component release requests the exact latest core.
+    # That prevents us from updating individual components.
+    "langchain-core"
+  ];
+
+  dependencies = [
+    filetype
+    google-api-core
+    google-auth
+    google-generativeai
+    langchain-core
+    pydantic
+  ];
+
+  nativeCheckInputs = [
+    freezegun
+    langchain-tests
+    numpy
+    pytest-asyncio
+    pytest-mock
+    pytestCheckHook
+    syrupy
+  ];
+
+  pytestFlagsArray = [ "tests/unit_tests" ];
+
+  pythonImportsCheck = [ "langchain_google_genai" ];
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "libs/genai/v";
+  };
+
+  meta = {
+    changelog = "https://github.com/langchain-ai/langchain-google/releases/tag/${src.tag}";
+    description = "LangChain integrations for Google Gemini";
+    homepage = "https://github.com/langchain-ai/langchain-google/tree/main/libs/genai";
+    license = lib.licenses.mit;
+    maintainers = [
+      lib.maintainers.eu90h
+      lib.maintainers.sarahec
+    ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 35539f3ee485..834e5bf7af12 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7699,6 +7699,8 @@ self: super: with self; {
 
   langchain-fireworks = callPackage ../development/python-modules/langchain-fireworks { };
 
+  langchain-google-genai = callPackage ../development/python-modules/langchain-google-genai { };
+
   langchain-groq = callPackage ../development/python-modules/langchain-groq { };
 
   langchain-huggingface = callPackage ../development/python-modules/langchain-huggingface { };

From c9ebaf5c581b1da4cdff833caac5cabfec5c6c25 Mon Sep 17 00:00:00 2001
From: Yarny0 <41838844+Yarny0@users.noreply.github.com>
Date: Wed, 5 Mar 2025 18:24:30 +0100
Subject: [PATCH 005/190] nixos/tsm-client: drop migration code from 2023
 freeform update

This manually reverts
20a9a21b246ca684e4e5a45e543a8a53be46e1d2.
Automatic revert is not possible due to nixfmt in
4f0dadbf38ee4cf4cc38cbc232b7708fddf965bc.
---
 nixos/modules/programs/tsm-client.nix | 61 +--------------------------
 1 file changed, 2 insertions(+), 59 deletions(-)

diff --git a/nixos/modules/programs/tsm-client.nix b/nixos/modules/programs/tsm-client.nix
index abbcfa9055eb..e35dce45ff66 100644
--- a/nixos/modules/programs/tsm-client.nix
+++ b/nixos/modules/programs/tsm-client.nix
@@ -1,13 +1,9 @@
 {
   config,
   lib,
-  options,
   pkgs,
   ...
-}: # XXX migration code for freeform settings: `options` can be removed in 2025
-let
-  optionsGlobal = options;
-in
+}:
 
 let
 
@@ -150,27 +146,6 @@ let
       };
       config.commmethod = mkDefault "v6tcpip"; # uses v4 or v6, based on dns lookup result
       config.passwordaccess = if config.genPasswd then "generate" else "prompt";
-      # XXX migration code for freeform settings, these can be removed in 2025:
-      options.warnings = optionsGlobal.warnings;
-      options.assertions = optionsGlobal.assertions;
-      imports =
-        let
-          inherit (lib.modules) mkRemovedOptionModule mkRenamedOptionModule;
-        in
-        [
-          (mkRemovedOptionModule [ "extraConfig" ]
-            "Please just add options directly to the server attribute set, cf. the description of `programs.tsmClient.servers`."
-          )
-          (mkRemovedOptionModule [ "text" ]
-            "Please just add options directly to the server attribute set, cf. the description of `programs.tsmClient.servers`."
-          )
-          (mkRenamedOptionModule [ "name" ] [ "servername" ])
-          (mkRenamedOptionModule [ "server" ] [ "tcpserveraddress" ])
-          (mkRenamedOptionModule [ "port" ] [ "tcpport" ])
-          (mkRenamedOptionModule [ "node" ] [ "nodename" ])
-          (mkRenamedOptionModule [ "passwdDir" ] [ "passworddir" ])
-          (mkRenamedOptionModule [ "includeExclude" ] [ "inclexcl" ])
-        ];
     };
 
   options.programs.tsmClient = {
@@ -291,16 +266,7 @@ let
         contain duplicate names
         (note that setting names are case insensitive).
       '';
-    }) cfg.servers)
-    # XXX migration code for freeform settings, this can be removed in 2025:
-    ++ (enrichMigrationInfos "assertions" (
-      addText:
-      { assertion, message }:
-      {
-        inherit assertion;
-        message = addText message;
-      }
-    ));
+    }) cfg.servers);
 
   makeDsmSysLines =
     key: value:
@@ -340,17 +306,6 @@ let
       attrs = removeAttrs serverCfg [
         "servername"
         "genPasswd"
-        # XXX migration code for freeform settings, these can be removed in 2025:
-        "assertions"
-        "warnings"
-        "extraConfig"
-        "text"
-        "name"
-        "server"
-        "port"
-        "node"
-        "passwdDir"
-        "includeExclude"
       ];
     in
     ''
@@ -369,16 +324,6 @@ let
     ${concatLines (map makeDsmSysStanza (attrValues cfg.servers))}
   '';
 
-  # XXX migration code for freeform settings, this can be removed in 2025:
-  enrichMigrationInfos =
-    what: how:
-    concatLists (
-      mapAttrsToList (
-        name: serverCfg:
-        map (how (text: "In `programs.tsmClient.servers.${name}`: ${text}")) serverCfg."${what}"
-      ) cfg.servers
-    );
-
 in
 
 {
@@ -393,8 +338,6 @@ in
       dsmSysApi = dsmSysCli;
     };
     environment.systemPackages = [ cfg.wrappedPackage ];
-    # XXX migration code for freeform settings, this can be removed in 2025:
-    warnings = enrichMigrationInfos "warnings" (addText: addText);
   };
 
   meta.maintainers = [ lib.maintainers.yarny ];

From 37922d6e2f22d762bde2129a498092eb320b77d8 Mon Sep 17 00:00:00 2001
From: Yarny0 <41838844+Yarny0@users.noreply.github.com>
Date: Mon, 31 Mar 2025 18:25:31 +0200
Subject: [PATCH 006/190] tsm-client: 8.1.25.0 -> 8.1.26.0

"What's new" page:
https://www.ibm.com/docs/en/storage-protect/8.1.26?topic=new-backup-archive-client-updates

Other resources are hidden behind a login portal.
---
 nixos/modules/programs/tsm-client.nix  | 2 +-
 nixos/modules/services/backup/tsm.nix  | 2 +-
 pkgs/by-name/ts/tsm-client/package.nix | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/programs/tsm-client.nix b/nixos/modules/programs/tsm-client.nix
index e35dce45ff66..c859a0296c76 100644
--- a/nixos/modules/programs/tsm-client.nix
+++ b/nixos/modules/programs/tsm-client.nix
@@ -71,7 +71,7 @@ let
     {
       freeformType = attrsOf (either scalarType (listOf scalarType));
       # Client system-options file directives are explained here:
-      # https://www.ibm.com/docs/en/storage-protect/8.1.25?topic=commands-processing-options
+      # https://www.ibm.com/docs/en/storage-protect/8.1.26?topic=commands-processing-options
       options.servername = mkOption {
         type = servernameType;
         default = name;
diff --git a/nixos/modules/services/backup/tsm.nix b/nixos/modules/services/backup/tsm.nix
index 697f798b7fcf..ea8d62e6c86e 100644
--- a/nixos/modules/services/backup/tsm.nix
+++ b/nixos/modules/services/backup/tsm.nix
@@ -89,7 +89,7 @@ in
       environment.HOME = "/var/lib/tsm-backup";
       serviceConfig = {
         # for exit status description see
-        # https://www.ibm.com/docs/en/storage-protect/8.1.25?topic=clients-client-return-codes
+        # https://www.ibm.com/docs/en/storage-protect/8.1.26?topic=clients-client-return-codes
         SuccessExitStatus = "4 8";
         # The `-se` option must come after the command.
         # The `-optfile` option suppresses a `dsm.opt`-not-found warning.
diff --git a/pkgs/by-name/ts/tsm-client/package.nix b/pkgs/by-name/ts/tsm-client/package.nix
index ff2d492613b9..5555161e0f62 100644
--- a/pkgs/by-name/ts/tsm-client/package.nix
+++ b/pkgs/by-name/ts/tsm-client/package.nix
@@ -44,7 +44,7 @@
 # point to this derivations `/dsmi_dir` directory symlink.
 # Other environment variables might be necessary,
 # depending on local configuration or usage; see:
-# https://www.ibm.com/docs/en/storage-protect/8.1.25?topic=solaris-set-api-environment-variables
+# https://www.ibm.com/docs/en/storage-protect/8.1.26?topic=solaris-set-api-environment-variables
 
 let
 
@@ -91,10 +91,10 @@ let
 
   unwrapped = stdenv.mkDerivation (finalAttrs: {
     name = "tsm-client-${finalAttrs.version}-unwrapped";
-    version = "8.1.25.0";
+    version = "8.1.26.0";
     src = fetchurl {
       url = mkSrcUrl finalAttrs.version;
-      hash = "sha512-OPNjSMnWJ/8Ogy9O0wG0H4cEbYiOwyCVzkWhpG00v/Vm0LDxLzPteMnMOyH8L1egIDhy7lmQYSzI/EC4WWUDDA==";
+      hash = "sha512-Q4iPumiq2uI6TtbBK+0lUZZXp+yy/+LcjatGqJ0zwdkxgRcF4di52Z+O/8CYFPRqSxS+0AiJs6yDd27PbJsR1w==";
     };
     inherit meta passthru;
 

From f9cc9bf9119c61511908c400e2e4a3f4c87ffdb4 Mon Sep 17 00:00:00 2001
From: Yarny0 <41838844+Yarny0@users.noreply.github.com>
Date: Sat, 21 Jun 2025 13:02:32 +0200
Subject: [PATCH 007/190] tsm-client: 8.1.26.0 -> 8.1.27.0

"What's new" page:
https://www.ibm.com/docs/en/storage-protect/8.1.27?topic=new-backup-archive-client-updates

Other resources are hidden behind a login portal.
---
 nixos/modules/programs/tsm-client.nix  | 2 +-
 nixos/modules/services/backup/tsm.nix  | 2 +-
 pkgs/by-name/ts/tsm-client/package.nix | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/programs/tsm-client.nix b/nixos/modules/programs/tsm-client.nix
index c859a0296c76..9331671fcb20 100644
--- a/nixos/modules/programs/tsm-client.nix
+++ b/nixos/modules/programs/tsm-client.nix
@@ -71,7 +71,7 @@ let
     {
       freeformType = attrsOf (either scalarType (listOf scalarType));
       # Client system-options file directives are explained here:
-      # https://www.ibm.com/docs/en/storage-protect/8.1.26?topic=commands-processing-options
+      # https://www.ibm.com/docs/en/storage-protect/8.1.27?topic=commands-processing-options
       options.servername = mkOption {
         type = servernameType;
         default = name;
diff --git a/nixos/modules/services/backup/tsm.nix b/nixos/modules/services/backup/tsm.nix
index ea8d62e6c86e..7322f6175064 100644
--- a/nixos/modules/services/backup/tsm.nix
+++ b/nixos/modules/services/backup/tsm.nix
@@ -89,7 +89,7 @@ in
       environment.HOME = "/var/lib/tsm-backup";
       serviceConfig = {
         # for exit status description see
-        # https://www.ibm.com/docs/en/storage-protect/8.1.26?topic=clients-client-return-codes
+        # https://www.ibm.com/docs/en/storage-protect/8.1.27?topic=clients-client-return-codes
         SuccessExitStatus = "4 8";
         # The `-se` option must come after the command.
         # The `-optfile` option suppresses a `dsm.opt`-not-found warning.
diff --git a/pkgs/by-name/ts/tsm-client/package.nix b/pkgs/by-name/ts/tsm-client/package.nix
index 5555161e0f62..574c69a78469 100644
--- a/pkgs/by-name/ts/tsm-client/package.nix
+++ b/pkgs/by-name/ts/tsm-client/package.nix
@@ -44,7 +44,7 @@
 # point to this derivations `/dsmi_dir` directory symlink.
 # Other environment variables might be necessary,
 # depending on local configuration or usage; see:
-# https://www.ibm.com/docs/en/storage-protect/8.1.26?topic=solaris-set-api-environment-variables
+# https://www.ibm.com/docs/en/storage-protect/8.1.27?topic=solaris-set-api-environment-variables
 
 let
 
@@ -91,10 +91,10 @@ let
 
   unwrapped = stdenv.mkDerivation (finalAttrs: {
     name = "tsm-client-${finalAttrs.version}-unwrapped";
-    version = "8.1.26.0";
+    version = "8.1.27.0";
     src = fetchurl {
       url = mkSrcUrl finalAttrs.version;
-      hash = "sha512-Q4iPumiq2uI6TtbBK+0lUZZXp+yy/+LcjatGqJ0zwdkxgRcF4di52Z+O/8CYFPRqSxS+0AiJs6yDd27PbJsR1w==";
+      hash = "sha512-nbQHoD7fUp4qBTgRJ6nHXF4PsZRTin7FGPi340jKc73O/9DCNb1JQG/gY+B2xzPM2g6agqWu/MX5J+Wt0nOEkA==";
     };
     inherit meta passthru;
 

From db75f901032d7cea58f43cef27d12d9754cc099a Mon Sep 17 00:00:00 2001
From: Franz Pletz <fpletz@fnordicwalking.de>
Date: Thu, 3 Jul 2025 17:36:32 +0200
Subject: [PATCH 008/190] nixos/nginx: remove recommendedZstdSettings, add
 experimental option

The zstd nginx module has known bugs and upstream is currently not
maintained. We should not recommend a buggy module and configuration
to our users since we are not maintaining the module either.
---
 .../services/web-servers/nginx/default.nix    | 20 ++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index cd4f404a58ee..3eaed22f3d35 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -171,6 +171,14 @@ let
           quic_bpf on;
         ''}
 
+        ${optionalString cfg.experimentalZstdSettings ''
+          zstd on;
+          zstd_comp_level 9;
+          zstd_min_length 256;
+          zstd_static on;
+          zstd_types ${lib.concatStringsSep " " compressMimeTypes};
+        ''}
+
         ${cfg.config}
 
         ${optionalString (cfg.eventsConfig != "" || cfg.config == "") ''
@@ -630,11 +638,11 @@ in
         '';
       };
 
-      recommendedZstdSettings = mkOption {
+      experimentalZstdSettings = mkOption {
         default = false;
         type = types.bool;
         description = ''
-          Enable recommended zstd settings.
+          Enable alpha quality zstd module with recommended settings.
           Learn more about compression in Zstd format [here](https://github.com/tokers/zstd-nginx-module).
 
           This adds `pkgs.nginxModules.zstd` to `services.nginx.additionalModules`.
@@ -1305,6 +1313,12 @@ in
       [ "services" "nginx" "proxyCache" "enable" ]
       [ "services" "nginx" "proxyCachePath" "" "enable" ]
     )
+    (mkRemovedOptionModule [ "services" "nginx" "recommendedZstdSettings" ] ''
+      The zstd module for Nginx has known bugs and is not maintained well. It is thus not
+      generally recommend to use it. You may enable anyway by setting
+      `services.nginx.experimentalZstdSettings` which adds the same configuration as the
+      removed option.
+    '')
   ];
 
   config = mkIf cfg.enable {
@@ -1453,7 +1467,7 @@ in
 
     services.nginx.additionalModules =
       optional cfg.recommendedBrotliSettings pkgs.nginxModules.brotli
-      ++ lib.optional cfg.recommendedZstdSettings pkgs.nginxModules.zstd;
+      ++ lib.optional cfg.experimentalZstdSettings pkgs.nginxModules.zstd;
 
     services.nginx.virtualHosts.localhost = mkIf cfg.statusPage {
       serverAliases = [ "127.0.0.1" ] ++ lib.optional config.networking.enableIPv6 "[::1]";

From f4fe5e45a0e7248abe2ff45129c68e128731c8ea Mon Sep 17 00:00:00 2001
From: Connor Baker <ConnorBaker01@gmail.com>
Date: Thu, 3 Jul 2025 20:42:49 +0000
Subject: [PATCH 009/190] opencv.passthru.tests.opencv4-tests: refactor and fix
 CUDA tests

Signed-off-by: Connor Baker <ConnorBaker01@gmail.com>
---
 pkgs/development/libraries/opencv/tests.nix | 174 +++++++++++++-------
 1 file changed, 110 insertions(+), 64 deletions(-)

diff --git a/pkgs/development/libraries/opencv/tests.nix b/pkgs/development/libraries/opencv/tests.nix
index ca4c9631dc51..040554a6683b 100644
--- a/pkgs/development/libraries/opencv/tests.nix
+++ b/pkgs/development/libraries/opencv/tests.nix
@@ -1,85 +1,131 @@
 {
-  opencv4,
-  testDataSrc,
-  stdenv,
-  lib,
-  runCommand,
-  gst_all_1,
-  runAccuracyTests,
-  runPerformanceTests,
   enableGStreamer,
   enableGtk2,
   enableGtk3,
+  gst_all_1,
+  lib,
+  opencv4,
+  runAccuracyTests,
+  runCommand,
+  runPerformanceTests,
+  stdenv,
+  testDataSrc,
+  writableTmpDirAsHomeHook,
   xvfb-run,
 }:
 let
-  testNames =
-    [
+  inherit (lib) getExe optionals optionalString;
+  inherit (opencv4.passthru) cudaSupport;
+  inherit (stdenv.hostPlatform) isAarch64 isDarwin;
+in
+runCommand "opencv4-tests"
+  {
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    nativeBuildInputs =
+      [ writableTmpDirAsHomeHook ]
+      ++ optionals enableGStreamer (
+        with gst_all_1;
+        [
+          gstreamer
+          gst-plugins-base
+          gst-plugins-good
+        ]
+      );
+
+    ignoredTests =
+      [
+        "AsyncAPICancelation/cancel*"
+        "Photo_CalibrateDebevec.regression"
+      ]
+      ++ optionals cudaSupport [
+        # opencv4-tests> /build/source/modules/photo/test/test_denoising.cuda.cpp:115: Failure
+        # opencv4-tests> The max difference between matrices "bgr_gold" and "dbgr" is 2 at (339, 486), which exceeds "1", where "bgr_gold" at (339, 486) evaluates to (182, 239, 239), "dbgr" at (339, 486) evaluates to (184, 239, 239), "1" evaluates to 1
+        # opencv4-tests> [  FAILED  ] CUDA_FastNonLocalMeans.Regression (48 ms)
+        "CUDA_FastNonLocalMeans.Regression"
+      ];
+
+    inherit runAccuracyTests;
+
+    accuracyTestNames =
+      [
+        "calib3d"
+        "core"
+        "features2d"
+        "flann"
+        "imgcodecs"
+        "imgproc"
+        "ml"
+        "objdetect"
+        "photo"
+        "stitching"
+        "video"
+        #"videoio" # - a lot of GStreamer warnings and failed tests
+        #"dnn" #- some caffe tests failed, probably because github workflow also downloads additional models
+      ]
+      ++ optionals (!isAarch64 && enableGStreamer) [ "gapi" ]
+      ++ optionals (enableGtk2 || enableGtk3) [ "highgui" ];
+
+    inherit runPerformanceTests;
+
+    performanceTestNames = [
       "calib3d"
       "core"
       "features2d"
-      "flann"
       "imgcodecs"
       "imgproc"
-      "ml"
       "objdetect"
       "photo"
       "stitching"
       "video"
-      #"videoio" # - a lot of GStreamer warnings and failed tests
-      #"dnn" #- some caffe tests failed, probably because github workflow also downloads additional models
-    ]
-    ++ lib.optionals (!stdenv.hostPlatform.isAarch64 && enableGStreamer) [ "gapi" ]
-    ++ lib.optionals (enableGtk2 || enableGtk3) [ "highgui" ];
-  perfTestNames = [
-    "calib3d"
-    "core"
-    "features2d"
-    "imgcodecs"
-    "imgproc"
-    "objdetect"
-    "photo"
-    "stitching"
-    "video"
-  ] ++ lib.optionals (!stdenv.hostPlatform.isAarch64 && enableGStreamer) [ "gapi" ];
-  testRunner = lib.optionalString (!stdenv.hostPlatform.isDarwin) "${lib.getExe xvfb-run} -a ";
-  testsPreparation = ''
-    touch $out
+    ] ++ optionals (!isAarch64 && enableGStreamer) [ "gapi" ];
+
+    testRunner = optionalString (!isDarwin) "${getExe xvfb-run} -a ";
+
+    requiredSystemFeatures = optionals cudaSupport [ "cuda" ];
+  }
+  ''
+    set -euo pipefail
+
     # several tests want a write access, so we have to copy files
-    tmpPath="$(mktemp -d "/tmp/opencv_extra_XXXXXX")"
-    cp -R ${testDataSrc} $tmpPath/opencv_extra
-    chmod -R +w $tmpPath/opencv_extra
-    export OPENCV_TEST_DATA_PATH="$tmpPath/opencv_extra/testdata"
+    nixLog "Preparing test data"
+    cp -R "${testDataSrc}" "$HOME/opencv_extra"
+    chmod -R +w "$HOME/opencv_extra"
+    export OPENCV_TEST_DATA_PATH="$HOME/opencv_extra/testdata"
     export OPENCV_SAMPLES_DATA_PATH="${opencv4.package_tests}/samples/data"
 
     # ignored tests because of gtest error - "Test code is not available due to compilation error with GCC 11"
     # ignore test due to numerical instability
-    export GTEST_FILTER="-AsyncAPICancelation/cancel*:Photo_CalibrateDebevec.regression"
-  '';
-  accuracyTests = lib.optionalString runAccuracyTests ''
-    ${builtins.concatStringsSep "\n" (
-      map (
-        test:
-        "${testRunner}${opencv4.package_tests}/opencv_test_${test} --test_threads=$NIX_BUILD_CORES --gtest_filter=$GTEST_FILTER"
-      ) testNames
-    )}
-  '';
-  performanceTests = lib.optionalString runPerformanceTests ''
-    ${builtins.concatStringsSep "\n" (
-      map (
-        test:
-        "${testRunner}${opencv4.package_tests}/opencv_perf_${test} --perf_impl=plain --perf_min_samples=10 --perf_force_samples=10 --perf_verify_sanity --skip_unstable=1 --gtest_filter=$GTEST_FILTER"
-      ) perfTestNames
-    )}
-  '';
-in
-runCommand "opencv4-tests" {
-  nativeBuildInputs = lib.optionals enableGStreamer (
-    with gst_all_1;
-    [
-      gstreamer
-      gst-plugins-base
-      gst-plugins-good
-    ]
-  );
-} (testsPreparation + accuracyTests + performanceTests)
+    if [[ -n ''${ignoredTests+x} ]]; then
+      export GTEST_FILTER="-$(concatStringsSep ":" ignoredTests)"
+      nixLog "Using GTEST_FILTER: $GTEST_FILTER"
+    fi
+
+    if [[ -n $runAccuracyTests ]]; then
+      nixLog "Running accuracy tests"
+      for testName in "''${accuracyTestNames[@]}"; do
+        nixLog "Running accuracy test: $testName"
+        ''${testRunner}${opencv4.package_tests}/opencv_test_''${testName} \
+          --test_threads=$NIX_BUILD_CORES
+      done
+      nixLog "Finished running accuracy tests"
+    fi
+
+    if [[ -n $runPerformanceTests ]]; then
+      nixLog "Running performance tests"
+      for testName in "''${performanceTestNames[@]}"; do
+        nixLog "Running performance test: $testName"
+        ''${testRunner}${opencv4.package_tests}/opencv_perf_''${testName} \
+          --perf_impl=plain \
+          --perf_min_samples=10 \
+          --perf_force_samples=10 \
+          --perf_verify_sanity \
+          --skip_unstable=1
+      done
+      nixLog "Finished running performance tests"
+    fi
+
+    nixLog "Finished running tests"
+    touch "$out"
+  ''

From 1155da2fa740d017d6e3bd52e6cc8df2a42f5880 Mon Sep 17 00:00:00 2001
From: Tim Schumacher <timschumi@gmx.de>
Date: Mon, 9 Jun 2025 21:08:56 +0200
Subject: [PATCH 010/190] ghidra-extensions.ghidra-firmware-utils: init at
 2024.04.20

---
 pkgs/tools/security/ghidra/extensions.nix     |  2 ++
 .../ghidra-firmware-utils/default.nix         | 24 +++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 pkgs/tools/security/ghidra/extensions/ghidra-firmware-utils/default.nix

diff --git a/pkgs/tools/security/ghidra/extensions.nix b/pkgs/tools/security/ghidra/extensions.nix
index c17eb7f7d1ef..459977a4ba91 100644
--- a/pkgs/tools/security/ghidra/extensions.nix
+++ b/pkgs/tools/security/ghidra/extensions.nix
@@ -17,6 +17,8 @@ lib.makeScope newScope (self: {
     inherit ghidra;
   };
 
+  ghidra-firmware-utils = self.callPackage ./extensions/ghidra-firmware-utils { };
+
   ghidra-golanganalyzerextension = self.callPackage ./extensions/ghidra-golanganalyzerextension { };
 
   ghidraninja-ghidra-scripts = self.callPackage ./extensions/ghidraninja-ghidra-scripts { };
diff --git a/pkgs/tools/security/ghidra/extensions/ghidra-firmware-utils/default.nix b/pkgs/tools/security/ghidra/extensions/ghidra-firmware-utils/default.nix
new file mode 100644
index 000000000000..c201816c4fc8
--- /dev/null
+++ b/pkgs/tools/security/ghidra/extensions/ghidra-firmware-utils/default.nix
@@ -0,0 +1,24 @@
+{
+  buildGhidraExtension,
+  fetchFromGitHub,
+  lib,
+}:
+buildGhidraExtension (finalAttrs: {
+  pname = "ghidra-firmware-utils";
+  version = "2024.04.20";
+
+  src = fetchFromGitHub {
+    owner = "al3xtjames";
+    repo = "ghidra-firmware-utils";
+    rev = finalAttrs.version;
+    hash = "sha256-BbPRSD1EzgMA3TCKHyNqLjzEgiOm67mLJuOeFOTvd0I=";
+  };
+
+  meta = {
+    description = "Ghidra utilities for analyzing PC firmware";
+    homepage = "https://github.com/al3xtjames/ghidra-firmware-utils";
+    downloadPage = "https://github.com/al3xtjames/ghidra-firmware-utils/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ timschumi ];
+  };
+})

From 762726b2a1924ac756779dad7643ec9108244848 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 04:07:10 +0000
Subject: [PATCH 011/190] github-runner: 2.325.0 -> 2.326.0

---
 pkgs/by-name/gi/github-runner/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gi/github-runner/package.nix b/pkgs/by-name/gi/github-runner/package.nix
index 13f2de4dda02..a3263af9f43a 100644
--- a/pkgs/by-name/gi/github-runner/package.nix
+++ b/pkgs/by-name/gi/github-runner/package.nix
@@ -25,13 +25,13 @@ assert builtins.all (x: builtins.elem x [ "node20" ]) nodeRuntimes;
 
 buildDotnetModule (finalAttrs: {
   pname = "github-runner";
-  version = "2.325.0";
+  version = "2.326.0";
 
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ic/+bdEfipyOB7jA+SXBuyET6ERu6ox+SdlLy4mbuqw=";
+    hash = "sha256-bKOxTV6iAvC+QOsfSs1hTS9k/Ou+YGEwTr5hew23cLY=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git-revision

From 1688920298030e84e51f93f7c3e883fdbde05c33 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 12:44:20 +0000
Subject: [PATCH 012/190] mdp: 1.0.15 -> 1.0.17

---
 pkgs/by-name/md/mdp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/md/mdp/package.nix b/pkgs/by-name/md/mdp/package.nix
index d2b979d83f4f..cc36c93783de 100644
--- a/pkgs/by-name/md/mdp/package.nix
+++ b/pkgs/by-name/md/mdp/package.nix
@@ -6,14 +6,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.0.15";
+  version = "1.0.17";
   pname = "mdp";
 
   src = fetchFromGitHub {
     owner = "visit1985";
     repo = "mdp";
     rev = version;
-    sha256 = "1m9a0vvyw2m55cn7zcq011vrjkiaj5a3g5g6f2dpq953gyi7gff9";
+    sha256 = "sha256-g9+bqMoUpcRL1pcNqaeMR3l5uHuiEpDZj/6YmyOSn7k=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];

From aa18f87e062c6acca74996ee2b1adb42c2abede9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 15:08:09 +0000
Subject: [PATCH 013/190] postgresqlPackages.hypopg: 1.4.1 -> 1.4.2

---
 pkgs/servers/sql/postgresql/ext/hypopg.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/hypopg.nix b/pkgs/servers/sql/postgresql/ext/hypopg.nix
index 4389862a5403..d5c0fd4cfe85 100644
--- a/pkgs/servers/sql/postgresql/ext/hypopg.nix
+++ b/pkgs/servers/sql/postgresql/ext/hypopg.nix
@@ -8,13 +8,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "hypopg";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "HypoPG";
     repo = "hypopg";
     tag = finalAttrs.version;
-    hash = "sha256-88uKPSnITRZ2VkelI56jZ9GWazG/Rn39QlyHKJKSKMM=";
+    hash = "sha256-J1ltvNHB2v2I9IbYjM8w2mhXvBX31NkMasCL0O7bV8w=";
   };
 
   passthru = {

From cfb4e6450ea049ee6db0d29c9d5d79f77919555c Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Wed, 9 Jul 2025 17:29:24 +0200
Subject: [PATCH 014/190] postgresqlPackages.hypopg: add meta.changelog

---
 pkgs/servers/sql/postgresql/ext/hypopg.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/servers/sql/postgresql/ext/hypopg.nix b/pkgs/servers/sql/postgresql/ext/hypopg.nix
index d5c0fd4cfe85..0f89f16833dc 100644
--- a/pkgs/servers/sql/postgresql/ext/hypopg.nix
+++ b/pkgs/servers/sql/postgresql/ext/hypopg.nix
@@ -26,6 +26,7 @@ postgresqlBuildExtension (finalAttrs: {
   meta = {
     description = "Hypothetical Indexes for PostgreSQL";
     homepage = "https://hypopg.readthedocs.io";
+    changelog = "https://github.com/HypoPG/hypopg/releases/tag/${finalAttrs.version}";
     license = lib.licenses.postgresql;
     platforms = postgresql.meta.platforms;
     maintainers = with lib.maintainers; [ bbigras ];

From bc122c4fab1e3540e6f878e1bfe63c2d339d116e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakob=20Sch=C3=B6ttl?= <jschoett@gmail.com>
Date: Wed, 9 Jul 2025 21:16:50 +0200
Subject: [PATCH 015/190] lychee: 0.18.1 -> 0.19.1

---
 pkgs/by-name/ly/lychee/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ly/lychee/package.nix b/pkgs/by-name/ly/lychee/package.nix
index 50d841d2a8a0..2b104cabac9e 100644
--- a/pkgs/by-name/ly/lychee/package.nix
+++ b/pkgs/by-name/ly/lychee/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lychee";
-  version = "0.18.1";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "lycheeverse";
     repo = pname;
     rev = "lychee-v${version}";
-    hash = "sha256-aT7kVN2KM90M193h4Xng6+v69roW0J4GLd+29BzALhI=";
+    hash = "sha256-OyJ3K6ZLAUCvvrsuhN3FMh31sAYe1bWPmOSibdBL9+4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-TKKhT4AhV2uzXOHRnKHiZJusNoCWUliKmKvDw+Aeqnc=";
+  cargoHash = "sha256-hruCTnj6rZak5JbZjtdSpajg+Y+GVTZqvS0Z09S7cfE=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -38,6 +38,7 @@ rustPlatform.buildRustPackage rec {
     # "error reading DNS system conf: No such file or directory (os error 2)" } }
     "--skip=archive::wayback::tests::wayback_suggestion"
     "--skip=archive::wayback::tests::wayback_suggestion_unknown_url"
+    "--skip=archive::wayback::tests::wayback_api_no_breaking_changes"
     "--skip=cli::test_dont_dump_data_uris_by_default"
     "--skip=cli::test_dump_data_uris_in_verbose_mode"
     "--skip=cli::test_exclude_example_domains"

From 4e0bd794fa21003b55e7302b1344f3281b731a8f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 22:38:03 +0000
Subject: [PATCH 016/190] ghidra-extensions.kaiju: 250610 -> 250709

---
 pkgs/tools/security/ghidra/extensions/kaiju/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/ghidra/extensions/kaiju/default.nix b/pkgs/tools/security/ghidra/extensions/kaiju/default.nix
index 2f2ffcc809fd..6c84f949615e 100644
--- a/pkgs/tools/security/ghidra/extensions/kaiju/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/kaiju/default.nix
@@ -26,13 +26,13 @@ let
 
   self = buildGhidraExtension (finalAttrs: {
     pname = "kaiju";
-    version = "250610";
+    version = "250709";
 
     src = fetchFromGitHub {
       owner = "CERTCC";
       repo = "kaiju";
       rev = finalAttrs.version;
-      hash = "sha256-qqUnWakQDOBw3sI/6iWD9140iRAsM5PUEQJSV/3/8FQ=";
+      hash = "sha256-xt/h0HeFCk4s1GIr3wKegGCGIUxMPFfyKKJ9o/WId/E=";
     };
 
     buildInputs = [

From 80363bfd8da4b2df79d6811157f3566ced867b7c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 05:18:28 +0000
Subject: [PATCH 017/190] git-machete: 3.36.0 -> 3.36.1

---
 pkgs/by-name/gi/git-machete/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gi/git-machete/package.nix b/pkgs/by-name/gi/git-machete/package.nix
index ef60f119c4e5..06fd09c38bec 100644
--- a/pkgs/by-name/gi/git-machete/package.nix
+++ b/pkgs/by-name/gi/git-machete/package.nix
@@ -9,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.36.0";
+  version = "3.36.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = "git-machete";
     rev = "v${version}";
-    hash = "sha256-iSuOiQC+dKqcDCS4nTPMrNFpo3ipPUQhfoofM11UInI=";
+    hash = "sha256-uVzER0Ll7d5cFrwtr1KcWeI70iioHDE6kpZYAiOxPnE=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

From 4bd715690f656f97b61660a1c41085e1f6889dcc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 13:03:38 +0000
Subject: [PATCH 018/190] git-codereview: 1.15.0 -> 1.16.0

---
 pkgs/by-name/gi/git-codereview/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gi/git-codereview/package.nix b/pkgs/by-name/gi/git-codereview/package.nix
index 8adeea2c21d0..0505d2e2540c 100644
--- a/pkgs/by-name/gi/git-codereview/package.nix
+++ b/pkgs/by-name/gi/git-codereview/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "git-codereview";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "review";
     rev = "v${version}";
-    hash = "sha256-CMe7xnR/cCjphuSI0/I0zqHehkRFX6DhLFpQNKwFErU=";
+    hash = "sha256-xokVMjCtpIugdO9JIoKPMg0neajsULn3okMXW82nCQg=";
   };
 
   vendorHash = null;

From a5fa5508dbb03966a1e74012c57d13b7f5539335 Mon Sep 17 00:00:00 2001
From: Jade Lovelace <software@lfcode.ca>
Date: Wed, 9 Jul 2025 22:28:50 -0700
Subject: [PATCH 019/190] doc: Add necessary details to understand dep
 propagation

This section has been the subject of too many jokes about nixpkgs and nix
overall being incomprehensible among people I know. In lieu of adding to
the fray I've had a go at correcting the reasons I couldn't read it
myself.

I don't actually think the math is a problem; it's actually probably the
more understandable part of the section once you actually understand the
definitions. The missing definitions and leaving the truth table as an
exercise to the reader really was not working for me though.

I've also added what each dependency group is actually *for*. This
hopefully makes the section easier to understand how it applies in
practice.

I generated the initial version of the table before reformatting it and
removing pointless rows with:

```python
def mapOffset(h, t, i):
    return i + (h if i <= 0 else t - 1)

for h0 in (-1, 0, 1):
    for t0 in (-1, 0, 1):
        if t0 < h0: continue
        heading = f'{h0:3} | {t0:3}'
        for i in (-1, 0, 1):
            if h0 + i not in (-1, 0, 1):
                mapped = 'x'
            else:
                mapped = mapOffset(h0, t0, i)
            heading += f'  |  {mapped:>2}'
        print(heading)
```
---
 doc/stdenv/stdenv.chapter.md | 62 +++++++++++++++++++++++++++++-------
 1 file changed, 51 insertions(+), 11 deletions(-)

diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index bdaee3dbd482..172f4a7a57b4 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -327,18 +327,54 @@ Dependency propagation takes cross compilation into account, meaning that depend
 
 To determine the exact rules for dependency propagation, we start by assigning to each dependency a couple of ternary numbers (`-1` for `build`, `0` for `host`, and `1` for `target`) representing its [dependency type](#possible-dependency-types), which captures how its host and target platforms are each "offset" from the depending derivation’s host and target platforms. The following table summarize the different combinations that can be obtained:
 
-| `host → target`     | attribute name      | offset   |
-| ------------------- | ------------------- | -------- |
-| `build --> build`   | `depsBuildBuild`    | `-1, -1` |
-| `build --> host`    | `nativeBuildInputs` | `-1, 0`  |
-| `build --> target`  | `depsBuildTarget`   | `-1, 1`  |
-| `host --> host`     | `depsHostHost`      | `0, 0`   |
-| `host --> target`   | `buildInputs`       | `0, 1`   |
-| `target --> target` | `depsTargetTarget`  | `1, 1`   |
+| `host → target`     | attribute name      | offset   | typical purpose                               |
+| ------------------- | ------------------- | -------- | --------------------------------------------- |
+| `build --> build`   | `depsBuildBuild`    | `-1, -1` | compilers for build helpers                   |
+| `build --> host`    | `nativeBuildInputs` | `-1, 0`  | build tools, compilers, setup hooks           |
+| `build --> target`  | `depsBuildTarget`   | `-1, 1`  | compilers to build stdlibs to run on target   |
+| `host --> host`     | `depsHostHost`      | `0, 0`   | compilers to build C code at runtime (rare)   |
+| `host --> target`   | `buildInputs`       | `0, 1`   | libraries                                     |
+| `target --> target` | `depsTargetTarget`  | `1, 1`   | stdlibs to run on target                      |
 
 Algorithmically, we traverse propagated inputs, accumulating every propagated dependency’s propagated dependencies and adjusting them to account for the “shift in perspective” described by the current dependency’s platform offsets. This results is sort of a transitive closure of the dependency relation, with the offsets being approximately summed when two dependency links are combined. We also prune transitive dependencies whose combined offsets go out-of-bounds, which can be viewed as a filter over that transitive closure removing dependencies that are blatantly absurd.
 
-We can define the process precisely with [Natural Deduction](https://en.wikipedia.org/wiki/Natural_deduction) using the inference rules. This probably seems a bit obtuse, but so is the bash code that actually implements it! [^footnote-stdenv-find-inputs-location] They’re confusing in very different ways so… hopefully if something doesn’t make sense in one presentation, it will in the other!
+We can define the process precisely with [Natural Deduction](https://en.wikipedia.org/wiki/Natural_deduction) using the inference rules below. This probably seems a bit obtuse, but so is the bash code that actually implements it! [^footnote-stdenv-find-inputs-location] They’re confusing in very different ways so… hopefully if something doesn’t make sense in one presentation, it will in the other!
+
+**Definitions:**
+
+`dep(h_offset, t_offset, X, Y)`
+:    Package X has a direct dependency on Y in a position with host offset `h_offset` and target offset `t_offset`.
+
+     For example, `nativeBuildInputs = [ Y ]` means `dep(-1, 0, X, Y)`.
+
+`propagated-dep(h_offset, t_offset, X, Y)`
+:    Package X has a propagated dependency on Y in a position with host offset `h_offset` and target offset `t_offset`.
+
+     For example, `depsBuildTargetPropagated = [ Y ]` means `propagated-dep(-1, 1, X, Y)`.
+
+`mapOffset(h, t, i) = offs`
+:    In a package X with a dependency on Y in a position with host offset `h` and target offset `t`, Y's transitive dependency Z in a position with offset `i` is mapped to offset `offs` in X.
+
+
+::: {.example}
+# Truth table of `mapOffset(h, t, i)`
+
+`x` means that the dependency was discarded because `h + i ∉ {-1, 0, 1}`.
+
+<!-- This is written as an ascii art table because the CSS was introducing so much space it was unreadable and doesn't support double lines -->
+
+```
+  h |   t  || i=-1 |  i=0 |  i=1
+----|------||------|------|-----
+ -1 |  -1  ||   x  |  -1  |  -1
+ -1 |   0  ||   x  |  -1  |   0
+ -1 |   1  ||   x  |  -1  |   1
+  0 |   0  ||  -1  |   0  |   0
+  0 |   1  ||  -1  |   0  |   1
+  1 |   1  ||   0  |   1  |   x
+```
+
+:::
 
 ```
 let mapOffset(h, t, i) = i + (if i <= 0 then h else t - 1)
@@ -372,7 +408,7 @@ propagated-dep(h, t, A, B)
 dep(h, t, A, B)
 ```
 
-Some explanation of this monstrosity is in order. In the common case, the target offset of a dependency is the successor to the host offset: `t = h + 1`. That means that:
+Some explanation of this monstrosity is in order. In the common case of `nativeBuildInputs` or `buildInputs`, the target offset of a dependency is one greater than the host offset: `t = h + 1`. That means that:
 
 ```
 let f(h, t, i) = i + (if i <= 0 then h else t - 1)
@@ -383,7 +419,11 @@ let f(h, h + 1, i) = i + h
 
 This is where “sum-like” comes in from above: We can just sum all of the host offsets to get the host offset of the transitive dependency. The target offset is the transitive dependency is the host offset + 1, just as it was with the dependencies composed to make this transitive one; it can be ignored as it doesn’t add any new information.
 
-Because of the bounds checks, the uncommon cases are `h = t` and `h + 2 = t`. In the former case, the motivation for `mapOffset` is that since its host and target platforms are the same, no transitive dependency of it should be able to “discover” an offset greater than its reduced target offsets. `mapOffset` effectively “squashes” all its transitive dependencies’ offsets so that none will ever be greater than the target offset of the original `h = t` package. In the other case, `h + 1` is skipped over between the host and target offsets. Instead of squashing the offsets, we need to “rip” them apart so no transitive dependencies’ offset is that one.
+Because of the bounds checks, the uncommon cases are `h = t` (`depsBuildBuild`, etc) and `h + 2 = t` (`depsBuildTarget`).
+
+In the former case, the motivation for `mapOffset` is that since its host and target platforms are the same, no transitive dependency of it should be able to “discover” an offset greater than its reduced target offsets. `mapOffset` effectively “squashes” all its transitive dependencies’ offsets so that none will ever be greater than the target offset of the original `h = t` package.
+
+In the other case, `h + 1` (0) is skipped over between the host (-1) and target (1) offsets. Instead of squashing the offsets, we need to “rip” them apart so no transitive dependency’s offset is 0.
 
 Overall, the unifying theme here is that propagation shouldn’t be introducing transitive dependencies involving platforms the depending package is unaware of. \[One can imagine the depending package asking for dependencies with the platforms it knows about; other platforms it doesn’t know how to ask for. The platform description in that scenario is a kind of unforgeable capability.\] The offset bounds checking and definition of `mapOffset` together ensure that this is the case. Discovering a new offset is discovering a new platform, and since those platforms weren’t in the derivation “spec” of the needing package, they cannot be relevant. From a capability perspective, we can imagine that the host and target platforms of a package are the capabilities a package requires, and the depending package must provide the capability to the dependency.
 

From c5f91ea8108e69779a261e89f3a8db91603605b5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 22:41:06 +0000
Subject: [PATCH 020/190] chatbox: 1.14.3 -> 1.15.0

---
 pkgs/by-name/ch/chatbox/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ch/chatbox/package.nix b/pkgs/by-name/ch/chatbox/package.nix
index d90bf8cd73fe..c23611227e4e 100644
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.14.3";
+  version = "1.15.0";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-Qsf58SQANBic3LHY52vzCHO9W74cdP0EWtHB2uL45R0=";
+    hash = "sha256-TtYKOCnMuStoPSQfwXfLFli+qv2NVgiXJPCYylCgs6A=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };

From 42bdf169a79d405c21dfa70c68916a9d78574efa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 03:49:52 +0000
Subject: [PATCH 021/190] cargo-nextest: 0.9.99 -> 0.9.100

---
 pkgs/by-name/ca/cargo-nextest/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-nextest/package.nix b/pkgs/by-name/ca/cargo-nextest/package.nix
index 8fa6cf57bca1..b51e26c09c96 100644
--- a/pkgs/by-name/ca/cargo-nextest/package.nix
+++ b/pkgs/by-name/ca/cargo-nextest/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.99";
+  version = "0.9.100";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    hash = "sha256-I1m4dURisTa4qwUilb8s8bvTsfMSodbZQxRlNDViFeM=";
+    hash = "sha256-MbgX/n6TC5hz66gvRAc7A0xFWbF2Ec68gMxCgPFpeoQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-f75yHVvxC+QhNmn1PUafviONLjrXhcNmMitFU06yAaQ=";
+  cargoHash = "sha256-jRBFjJB38JI9whFpImYlMx0znQj1+cdeu4Nc+nYc7OI=";
 
   cargoBuildFlags = [
     "-p"

From 3468468e3c1f6b47f75785dbf84ad7312603eb96 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 05:45:13 +0000
Subject: [PATCH 022/190] fzf-git-sh: 0-unstable-2025-05-08 ->
 0-unstable-2025-07-10

---
 pkgs/by-name/fz/fzf-git-sh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fz/fzf-git-sh/package.nix b/pkgs/by-name/fz/fzf-git-sh/package.nix
index 7b1468af3ba1..cef62cca45cb 100644
--- a/pkgs/by-name/fz/fzf-git-sh/package.nix
+++ b/pkgs/by-name/fz/fzf-git-sh/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fzf-git-sh";
-  version = "0-unstable-2025-05-08";
+  version = "0-unstable-2025-07-10";
 
   src = fetchFromGitHub {
     owner = "junegunn";
     repo = "fzf-git.sh";
-    rev = "3ec3e97d1cc75ec97c0ab923ed5aa567aee01a5e";
-    hash = "sha256-hkxbFYCogrIhnAGs3lcqY8Zv51/TAfM6zB9G78UuYSA=";
+    rev = "79e10ccaa8b3bddff95cd1dcb44b0c30a39da71f";
+    hash = "sha256-5+rV3l1Jdy28IxGLMdmj0heLxmmpRwwobyg9sjdBRco=";
   };
 
   dontBuild = true;

From 55b7eea21aff422a42e76cb44b0926d715623303 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 06:37:11 +0000
Subject: [PATCH 023/190] cargo-tally: 1.0.65 -> 1.0.66

---
 pkgs/by-name/ca/cargo-tally/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-tally/package.nix b/pkgs/by-name/ca/cargo-tally/package.nix
index 129dd87cf991..0cb8651fc053 100644
--- a/pkgs/by-name/ca/cargo-tally/package.nix
+++ b/pkgs/by-name/ca/cargo-tally/package.nix
@@ -6,15 +6,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tally";
-  version = "1.0.65";
+  version = "1.0.66";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-cvMB/hMq0LCfuXHX1Gg0c3i69T1uQWKIddUru5dcg7g=";
+    hash = "sha256-PC/gscMO7oYcsd/cVcP5WZYweWRsh23Z7Do/qeGjAOc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ReVLeyQY08i1sH6IujeLK8y1+PfPm8BoYInzbTHHnlw=";
+  cargoHash = "sha256-00J8ip2fr/nphY0OXVOLKv7gaHitMziwsdJ4YBaYxog=";
 
   meta = {
     description = "Graph the number of crates that depend on your crate over time";

From 0cf28330f5f2c1945a458d2a7fbacf583d707343 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 08:07:10 +0000
Subject: [PATCH 024/190] mediawiki: 1.43.2 -> 1.44.0

---
 pkgs/by-name/me/mediawiki/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/me/mediawiki/package.nix b/pkgs/by-name/me/mediawiki/package.nix
index 788b901d2f1f..a8bacfe0ba9a 100644
--- a/pkgs/by-name/me/mediawiki/package.nix
+++ b/pkgs/by-name/me/mediawiki/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mediawiki";
-  version = "1.43.2";
+  version = "1.44.0";
 
   src = fetchurl {
     url = "https://releases.wikimedia.org/mediawiki/${lib.versions.majorMinor version}/mediawiki-${version}.tar.gz";
-    hash = "sha256-3ECvcM1O9Cd63DvgXHIijpjbI4vo5qo/Dln4XIAY504=";
+    hash = "sha256-eSF3gIw+CDGsy+IF1XtBMzma0UHw0KglRQohskAnWI8=";
   };
 
   postPatch = ''

From b618c517ee82a9e8b05e60b108c6e6042b85933f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 08:19:57 +0000
Subject: [PATCH 025/190] cargo-codspeed: 3.0.1 -> 3.0.2

---
 pkgs/by-name/ca/cargo-codspeed/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-codspeed/package.nix b/pkgs/by-name/ca/cargo-codspeed/package.nix
index c09a859ceefd..f16cc7d8cb2c 100644
--- a/pkgs/by-name/ca/cargo-codspeed/package.nix
+++ b/pkgs/by-name/ca/cargo-codspeed/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-codspeed";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "CodSpeedHQ";
     repo = "codspeed-rust";
     rev = "v${version}";
-    hash = "sha256-RlI4kfq9FS6f3o4mp6FF27S7ScK5oa61B+4+1f6XH1U=";
+    hash = "sha256-u/6pQSmm069IVXfk7Jy7zCYiGz8yNRz8z3XrBG/1Td0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Fu3A9v8Q6wSG8zmhIjQdWhbL1ygeFjOPY9lbQGnXFI8=";
+  cargoHash = "sha256-OdP01hgJfkxV9htGEoUs/xgbyWDEiyxT3NQLbAlt4K8=";
 
   nativeBuildInputs = [
     curl

From 2593d2eaa2967dc053096a2821e47787da458e85 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Thu, 10 Jul 2025 18:58:07 +0000
Subject: [PATCH 026/190] discord: 0.0.98 -> 0.0.101

---
 .../networking/instant-messengers/discord/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 814f697114d5..6722ca2b470f 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -9,7 +9,7 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.100";
+        stable = "0.0.101";
         ptb = "0.0.148";
         canary = "0.0.709";
         development = "0.0.81";
@@ -26,7 +26,7 @@ let
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-3trE9awddfB1ZasJQjbQc0xOoTqIRY0thEwL7Uz5+O8=";
+        hash = "sha256-FB6GiCM+vGyjZLtF0GjAIq8etK5FYyQVisWX6IzB4Zc=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";

From 218f3140de5d3fe8823c2d58662ff3f2432971c7 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Thu, 10 Jul 2025 18:59:49 +0000
Subject: [PATCH 027/190] discord-ptb: 0.0.148 -> 0.0.151

---
 .../networking/instant-messengers/discord/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 6722ca2b470f..f3b4917251f5 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -10,7 +10,7 @@ let
     if stdenv.hostPlatform.isLinux then
       {
         stable = "0.0.101";
-        ptb = "0.0.148";
+        ptb = "0.0.151";
         canary = "0.0.709";
         development = "0.0.81";
       }
@@ -30,7 +30,7 @@ let
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-VRhcnjbC42nFZ3DepKNX75pBl0GeDaSWM1SGXJpuQs0=";
+        hash = "sha256-7fQFCPUj59c/OfuNa4RDxGexAKZXLL7M+7n36WE5qDg=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";

From 2d33835da9a6247c662e206241e42c486a60dcfc Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Thu, 10 Jul 2025 19:00:55 +0000
Subject: [PATCH 028/190] discord-canary: 0.0.709 -> 0.0.716

---
 .../networking/instant-messengers/discord/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index f3b4917251f5..3ef665e03a1b 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -11,7 +11,7 @@ let
       {
         stable = "0.0.101";
         ptb = "0.0.151";
-        canary = "0.0.709";
+        canary = "0.0.716";
         development = "0.0.81";
       }
     else
@@ -34,7 +34,7 @@ let
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-2lzXTuE+nkyw+GG9nAMxIIloAlEngY9Q6OKfbrWgFiI=";
+        hash = "sha256-W7uPrJRKY4I6nsdj/TNxT8kHh5ssn9KyCArhOhAlaH4=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";

From dec9a5b6670ab998fad09d8e361c042b87dfacd6 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Thu, 10 Jul 2025 19:03:17 +0000
Subject: [PATCH 029/190] discord-development: 0.0.81 -> 0.0.83

---
 .../networking/instant-messengers/discord/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 3ef665e03a1b..54df4dfcac5b 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -12,7 +12,7 @@ let
         stable = "0.0.101";
         ptb = "0.0.151";
         canary = "0.0.716";
-        development = "0.0.81";
+        development = "0.0.83";
       }
     else
       {
@@ -38,7 +38,7 @@ let
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-njkuWtk+359feEYtWJSDukvbD5duXuRIr1m5cJVhNvs=";
+        hash = "sha256-KpZ90VekGf3KNpNpFfZlVXorv86yK1OuY0uqgBuWIQ4=";
       };
     };
     x86_64-darwin = {

From 4c4393dee8b09816f7e50f998208dc01f36a03bc Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Fri, 11 Jul 2025 16:36:40 +0000
Subject: [PATCH 030/190] pkgsCross.aarch64-darwin.discord: 0.0.350 -> 0.0.353

---
 .../networking/instant-messengers/discord/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 54df4dfcac5b..da370039c204 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -16,7 +16,7 @@ let
       }
     else
       {
-        stable = "0.0.350";
+        stable = "0.0.353";
         ptb = "0.0.179";
         canary = "0.0.808";
         development = "0.0.94";
@@ -44,7 +44,7 @@ let
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-Giz0bE16v2Q2jULcnZMI1AY8zyjZ03hw4KVpDPJOmCo=";
+        hash = "sha256-qHOLhPhHwN0fy1KiJroJvshlYExBDsuna2PddjtNyEI=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";

From 0f38240de752755fecbe3494fe79ca7eb82f0b82 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Fri, 11 Jul 2025 16:38:23 +0000
Subject: [PATCH 031/190] pkgsCross.aarch64-darwin.discord-ptb: 0.0.179 ->
 0.0.181

---
 .../networking/instant-messengers/discord/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index da370039c204..bde834bd33a6 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -17,7 +17,7 @@ let
     else
       {
         stable = "0.0.353";
-        ptb = "0.0.179";
+        ptb = "0.0.181";
         canary = "0.0.808";
         development = "0.0.94";
       };
@@ -48,7 +48,7 @@ let
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-tGE7HAcWLpGlv5oXO7NEELdRtNfbhlpQeNc5zB7ba1A=";
+        hash = "sha256-Q153X08crRpXZMMgNDYbADHnL7MiBPCakJxQe8Pl0Uo=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";

From a6a3d510f1b16af447fdbfdac58fe0810ce22cd4 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Fri, 11 Jul 2025 16:39:30 +0000
Subject: [PATCH 032/190] pkgsCross.aarch64-darwin.discord-canary: 0.0.808 ->
 0.0.823

---
 .../networking/instant-messengers/discord/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index bde834bd33a6..d27c5fa505bb 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -18,7 +18,7 @@ let
       {
         stable = "0.0.353";
         ptb = "0.0.181";
-        canary = "0.0.808";
+        canary = "0.0.823";
         development = "0.0.94";
       };
   version = versions.${branch};
@@ -52,7 +52,7 @@ let
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-Cu7U70yzHgOAJjtEx85T3x9f1oquNz7VNsX53ISbzKg=";
+        hash = "sha256-69Q8kTfenlmhjptVSQ9Y0AyeViRw+srMExOA7fAlaGw=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";

From c481da90f98f95d2410bffa0fc065f7ed2626b6d Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Fri, 11 Jul 2025 16:41:38 +0000
Subject: [PATCH 033/190] pkgsCross.aarch64-darwin.discord-development: 0.0.94
 -> 0.0.96

---
 .../networking/instant-messengers/discord/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index d27c5fa505bb..2f72810dce81 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -19,7 +19,7 @@ let
         stable = "0.0.353";
         ptb = "0.0.181";
         canary = "0.0.823";
-        development = "0.0.94";
+        development = "0.0.96";
       };
   version = versions.${branch};
   srcs = rec {
@@ -56,7 +56,7 @@ let
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-+bmzdkOSMpKnLGEoeXmAJSv2UHzirOLe1HDHAdHG2U8=";
+        hash = "sha256-fe7yE+dxEATIdfITg57evbaQkChCcoaLrzV+8KwEBws=";
       };
     };
     aarch64-darwin = x86_64-darwin;

From d01300927cc23b095c5cb9580ab429f72e433de1 Mon Sep 17 00:00:00 2001
From: Ivan Mincik <ivan.mincik@gmail.com>
Date: Fri, 11 Jul 2025 10:56:37 +0200
Subject: [PATCH 034/190] qscintilla: don't hardcode qt version in package name

This package is build for both Qt 5 and Qt 6.
---
 pkgs/development/libraries/qscintilla/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/qscintilla/default.nix b/pkgs/development/libraries/qscintilla/default.nix
index 3ac9899bc498..83df3a1fcddd 100644
--- a/pkgs/development/libraries/qscintilla/default.nix
+++ b/pkgs/development/libraries/qscintilla/default.nix
@@ -1,6 +1,7 @@
 {
-  stdenv,
   lib,
+  stdenv,
+
   fetchurl,
   unzip,
   qtbase,
@@ -9,8 +10,11 @@
   fixDarwinDylibNames,
 }:
 
+let
+  qtVersion = lib.versions.major qtbase.version;
+in
 stdenv.mkDerivation (finalAttrs: {
-  pname = "qscintilla-qt5";
+  pname = "qscintilla-qt${qtVersion}";
   version = "2.14.1";
 
   src = fetchurl {
@@ -34,7 +38,6 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup =
     let
       libExt = stdenv.hostPlatform.extensions.sharedLibrary;
-      qtVersion = lib.versions.major qtbase.version;
     in
     ''
       ln -s $out/lib/libqscintilla2_qt${qtVersion}${libExt} $out/lib/libqscintilla2${libExt}

From bec4860dbcd45a586f8aad8675b5f903e841f25b Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 11 Jul 2025 14:04:34 -0500
Subject: [PATCH 035/190] python3Packages.xeddsa: 1.1.0 -> 1.1.1

---
 pkgs/development/python-modules/xeddsa/default.nix | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/xeddsa/default.nix b/pkgs/development/python-modules/xeddsa/default.nix
index fba8c0793e66..ea6e648f3b94 100644
--- a/pkgs/development/python-modules/xeddsa/default.nix
+++ b/pkgs/development/python-modules/xeddsa/default.nix
@@ -7,26 +7,22 @@
   libsodium,
   libxeddsa,
   pytestCheckHook,
+  pytest-cov-stub,
   nix-update-script,
 }:
 
 buildPythonPackage rec {
   pname = "xeddsa";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Syndace";
     repo = "python-xeddsa";
     tag = "v${version}";
-    hash = "sha256-636zsJXD8EtLDXMIkJTON0g3sg0EPrMzcfR7SUrURac=";
+    hash = "sha256-5s6ERazWnwYEc0d5e+eSdvOCTklBQVrjzvlNifC2zKU=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools<74" "setuptools"
-  '';
-
   passthru.updateScript = nix-update-script { };
 
   build-system = [ setuptools ];
@@ -40,6 +36,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-cov-stub
   ];
 
   pythonImportsCheck = [ "xeddsa" ];

From d37715ad0e53dac4358206f8e2b2648ee764096a Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 11 Jul 2025 14:04:43 -0500
Subject: [PATCH 036/190] python3Packages.x3dh: 1.1.0 -> 1.2.0

---
 pkgs/development/python-modules/x3dh/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/x3dh/default.nix b/pkgs/development/python-modules/x3dh/default.nix
index 7dccc3edf2bb..1c2e2d6e1c16 100644
--- a/pkgs/development/python-modules/x3dh/default.nix
+++ b/pkgs/development/python-modules/x3dh/default.nix
@@ -9,17 +9,18 @@
   typing-extensions,
   pytestCheckHook,
   pytest-asyncio,
+  pytest-cov-stub,
 }:
 buildPythonPackage rec {
   pname = "x3dh";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Syndace";
     repo = "python-x3dh";
     tag = "v${version}";
-    hash = "sha256-/hC1Kze4yBOlgbWJcGddcYty9fqwZ08Lyi0IiqSDibI=";
+    hash = "sha256-NLuFfkutFtNrpBcLA/83QArCDrlrT+i85s2d6FHtuT0=";
   };
 
   strictDeps = true;
@@ -38,6 +39,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     pytest-asyncio
+    pytest-cov-stub
   ];
 
   pythonImportsCheck = [ "x3dh" ];

From 5c03d833fcdfed83728ef4ee227412187fbf035c Mon Sep 17 00:00:00 2001
From: Ivan Mincik <ivan.mincik@gmail.com>
Date: Fri, 11 Jul 2025 21:13:10 +0200
Subject: [PATCH 037/190] python3Packages.qscintilla-qt5/6: build package for
 both Qt 5 and Qt 6

---
 .../default.nix                               | 29 +++++++++++--------
 pkgs/top-level/python-packages.nix            |  6 +++-
 2 files changed, 22 insertions(+), 13 deletions(-)
 rename pkgs/development/python-modules/{qscintilla-qt5 => qscintilla}/default.nix (76%)

diff --git a/pkgs/development/python-modules/qscintilla-qt5/default.nix b/pkgs/development/python-modules/qscintilla/default.nix
similarity index 76%
rename from pkgs/development/python-modules/qscintilla-qt5/default.nix
rename to pkgs/development/python-modules/qscintilla/default.nix
index 3ba31569f4c3..d58b591c2aac 100644
--- a/pkgs/development/python-modules/qscintilla-qt5/default.nix
+++ b/pkgs/development/python-modules/qscintilla/default.nix
@@ -1,26 +1,27 @@
 {
   lib,
+  stdenv,
+
   pythonPackages,
+  qmake,
   qscintilla,
   qtbase,
-  qmake,
-  qtmacextras,
-  stdenv,
+  qtmacextras ? null,
 }:
 
 let
+  qtVersion = lib.versions.major qtbase.version;
+  pyQtPackage = pythonPackages."pyqt${qtVersion}";
+
   inherit (pythonPackages)
-    buildPythonPackage
     isPy3k
     python
     sip
-    sipbuild
-    pyqt5
     pyqt-builder
     ;
 in
-buildPythonPackage {
-  pname = "qscintilla-qt5";
+pythonPackages.buildPythonPackage {
+  pname = "qscintilla-qt${qtVersion}";
   version = qscintilla.version;
   src = qscintilla.src;
   format = "pyproject";
@@ -34,17 +35,21 @@ buildPythonPackage {
     qscintilla
     pythonPackages.setuptools
   ];
+
   buildInputs = [ qtbase ];
-  propagatedBuildInputs = [ pyqt5 ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ qtmacextras ];
+
+  propagatedBuildInputs = [
+    pyQtPackage
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ qtmacextras ];
 
   dontWrapQtApps = true;
 
   postPatch =
     ''
       cd Python
-      cp pyproject-qt5.toml pyproject.toml
+      cp pyproject-qt${qtVersion}.toml pyproject.toml
       echo '[tool.sip.project]' >> pyproject.toml
-      echo 'sip-include-dirs = [ "${pyqt5}/${python.sitePackages}/PyQt5/bindings"]' \
+      echo 'sip-include-dirs = [ "${pyQtPackage}/${python.sitePackages}/PyQt${qtVersion}/bindings"]' \
          >> pyproject.toml
     ''
     + lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -75,7 +80,7 @@ buildPythonPackage {
   # Checked using pythonImportsCheck
   doCheck = false;
 
-  pythonImportsCheck = [ "PyQt5.Qsci" ];
+  pythonImportsCheck = [ "PyQt${qtVersion}.Qsci" ];
 
   meta = with lib; {
     description = "Python binding to QScintilla, Qt based text editing control";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 77a5e85f11f1..d8a13076b3d8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -15142,7 +15142,11 @@ self: super: with self; {
 
   qscintilla = self.qscintilla-qt5;
 
-  qscintilla-qt5 = pkgs.libsForQt5.callPackage ../development/python-modules/qscintilla-qt5 {
+  qscintilla-qt5 = pkgs.libsForQt5.callPackage ../development/python-modules/qscintilla {
+    pythonPackages = self;
+  };
+
+  qscintilla-qt6 = pkgs.qt6Packages.callPackage ../development/python-modules/qscintilla {
     pythonPackages = self;
   };
 

From ef481bfb2babc8f508704d9adf7a6cacd1540dc8 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Fri, 11 Jul 2025 22:46:32 +0200
Subject: [PATCH 038/190] maintainers: drop d-xo

No activity for at least this year (2025), possibly up to a year (mid
2024).
---
 maintainers/maintainer-list.nix                          | 6 ------
 nixos/tests/bazarr.nix                                   | 1 -
 nixos/tests/wireguard/wg-quick.nix                       | 3 ---
 pkgs/by-name/ba/bazarr/package.nix                       | 1 -
 pkgs/by-name/bt/btc-rpc-explorer/package.nix             | 1 -
 pkgs/by-name/er/erigon/package.nix                       | 1 -
 pkgs/by-name/hs/hsd/package.nix                          | 1 -
 pkgs/by-name/ln/lndconnect/package.nix                   | 1 -
 pkgs/by-name/wi/wireguard-tools/package.nix              | 1 -
 pkgs/development/python-modules/ledgerwallet/default.nix | 1 -
 10 files changed, 17 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3259e4ac12b0..6f168b66eae3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5471,12 +5471,6 @@
     name = "Dima";
     keys = [ { fingerprint = "1C4E F4FE 7F8E D8B7 1E88 CCDF BAB1 D15F B7B4 D4CE"; } ];
   };
-  d-xo = {
-    email = "hi@d-xo.org";
-    github = "d-xo";
-    githubId = 6689924;
-    name = "David Terry";
-  };
   d3vil0p3r = {
     name = "Antonio Voza";
     email = "vozaanthony@gmail.com";
diff --git a/nixos/tests/bazarr.nix b/nixos/tests/bazarr.nix
index 48206ce6e2f4..0487a0d31514 100644
--- a/nixos/tests/bazarr.nix
+++ b/nixos/tests/bazarr.nix
@@ -5,7 +5,6 @@ let
 in
 {
   name = "bazarr";
-  meta.maintainers = with lib.maintainers; [ d-xo ];
 
   nodes.machine =
     { pkgs, ... }:
diff --git a/nixos/tests/wireguard/wg-quick.nix b/nixos/tests/wireguard/wg-quick.nix
index 981e741d32d2..be258e1e7ed1 100644
--- a/nixos/tests/wireguard/wg-quick.nix
+++ b/nixos/tests/wireguard/wg-quick.nix
@@ -18,9 +18,6 @@ import ../make-test-python.nix (
   in
   {
     name = "wg-quick";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ d-xo ];
-    };
 
     nodes = {
       peer0 = peer {
diff --git a/pkgs/by-name/ba/bazarr/package.nix b/pkgs/by-name/ba/bazarr/package.nix
index 847a73607540..2be266020229 100644
--- a/pkgs/by-name/ba/bazarr/package.nix
+++ b/pkgs/by-name/ba/bazarr/package.nix
@@ -66,7 +66,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.bazarr.media/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ d-xo ];
     mainProgram = "bazarr";
     platforms = platforms.all;
   };
diff --git a/pkgs/by-name/bt/btc-rpc-explorer/package.nix b/pkgs/by-name/bt/btc-rpc-explorer/package.nix
index 912c34f69ed8..26745f66b7af 100644
--- a/pkgs/by-name/bt/btc-rpc-explorer/package.nix
+++ b/pkgs/by-name/bt/btc-rpc-explorer/package.nix
@@ -43,7 +43,6 @@ buildNpmPackage rec {
     homepage = "https://github.com/janoside/btc-rpc-explorer";
     license = lib.licenses.mit;
     mainProgram = "btc-rpc-explorer";
-    maintainers = with lib.maintainers; [ d-xo ];
     broken = true;
     # At 2024-06-29
     # https://hydra.nixos.org/build/264232177/nixlog/1
diff --git a/pkgs/by-name/er/erigon/package.nix b/pkgs/by-name/er/erigon/package.nix
index af42b9c3e670..89c6479b35ca 100644
--- a/pkgs/by-name/er/erigon/package.nix
+++ b/pkgs/by-name/er/erigon/package.nix
@@ -67,7 +67,6 @@ buildGoModule {
       gpl3Plus
     ];
     maintainers = with maintainers; [
-      d-xo
       happysalada
     ];
   };
diff --git a/pkgs/by-name/hs/hsd/package.nix b/pkgs/by-name/hs/hsd/package.nix
index d259a7bf851d..278f9b6254e9 100644
--- a/pkgs/by-name/hs/hsd/package.nix
+++ b/pkgs/by-name/hs/hsd/package.nix
@@ -40,6 +40,5 @@ buildNpmPackage rec {
     description = "Implementation of the Handshake protocol";
     homepage = "https://github.com/handshake-org/hsd";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ d-xo ];
   };
 }
diff --git a/pkgs/by-name/ln/lndconnect/package.nix b/pkgs/by-name/ln/lndconnect/package.nix
index 1de170f5e8db..55db70b56405 100644
--- a/pkgs/by-name/ln/lndconnect/package.nix
+++ b/pkgs/by-name/ln/lndconnect/package.nix
@@ -25,7 +25,6 @@ buildGoModule rec {
     description = "Generate QRCode to connect apps to lnd Resources";
     license = licenses.mit;
     homepage = "https://github.com/LN-Zap/lndconnect";
-    maintainers = [ maintainers.d-xo ];
     platforms = platforms.linux;
     mainProgram = "lndconnect";
   };
diff --git a/pkgs/by-name/wi/wireguard-tools/package.nix b/pkgs/by-name/wi/wireguard-tools/package.nix
index 19e3585bca1d..4d47b0efd43f 100644
--- a/pkgs/by-name/wi/wireguard-tools/package.nix
+++ b/pkgs/by-name/wi/wireguard-tools/package.nix
@@ -92,7 +92,6 @@ stdenv.mkDerivation rec {
       zx2c4
       globin
       ma27
-      d-xo
     ];
     mainProgram = "wg";
     platforms = platforms.unix;
diff --git a/pkgs/development/python-modules/ledgerwallet/default.nix b/pkgs/development/python-modules/ledgerwallet/default.nix
index a6e87f00f8c7..912c762edf48 100644
--- a/pkgs/development/python-modules/ledgerwallet/default.nix
+++ b/pkgs/development/python-modules/ledgerwallet/default.nix
@@ -66,7 +66,6 @@ buildPythonPackage rec {
     mainProgram = "ledgerctl";
     license = licenses.mit;
     maintainers = with maintainers; [
-      d-xo
       erdnaxe
     ];
   };

From 9519ecce171570d12b1d34344fda9b4375fa55d5 Mon Sep 17 00:00:00 2001
From: Nadir Ishiguro <23151917+nadir-ishiguro@users.noreply.github.com>
Date: Fri, 11 Jul 2025 22:59:31 +0200
Subject: [PATCH 039/190] nom: 2.10.0 -> 2.13.0

---
 pkgs/by-name/no/nom/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index 3bf6887a388d..a69c3645c878 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.10.0";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     tag = "v${version}";
-    hash = "sha256-F1lKBfDufotQjVNJ1yMosRl1UlGMBlYCTHXdCzeVflg=";
+    hash = "sha256-dGQDxjvB5OX4ot22zt2zFu3T3h/clSRlfxhCpkPRePU=";
   };
 
   vendorHash = "sha256-d5KTDZKfuzv84oMgmsjJoXGO5XYLVKxOB5XehqgRvYw=";

From 90403f6ac2c53ca1a1568ece99896bd113e2368e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 23:13:05 +0000
Subject: [PATCH 040/190] cargo-leptos: 0.2.36 -> 0.2.38

---
 pkgs/by-name/ca/cargo-leptos/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-leptos/package.nix b/pkgs/by-name/ca/cargo-leptos/package.nix
index 0192ba3c2574..53fdabb0d3f6 100644
--- a/pkgs/by-name/ca/cargo-leptos/package.nix
+++ b/pkgs/by-name/ca/cargo-leptos/package.nix
@@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cargo-leptos";
-  version = "0.2.36";
+  version = "0.2.38";
 
   src = fetchFromGitHub {
     owner = "leptos-rs";
     repo = "cargo-leptos";
     rev = "v${version}";
-    hash = "sha256-ogX8kfCC+1sh9VXT9eYDJSNtX5WH/QF5LtOOkR90Snc=";
+    hash = "sha256-RrgWIT6pCD7MY8SwuVPNdlEl81iT5zhVbT6y9LcpY1Y=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-USMJeyNdxEOQctsVCvD1ImuEIzbzskVoz6rcU270AFg=";
+  cargoHash = "sha256-0XsSa8/Utsqug+6rQ13drXQGgxJ7bxDwmACaZCmErws=";
 
   nativeBuildInputs = [ pkg-config ];
 

From 7a5b7305c00be62fd9f67330ec484c3a40108353 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 23:31:37 +0000
Subject: [PATCH 041/190] kargo: 1.5.3 -> 1.6.1

---
 pkgs/by-name/ka/kargo/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ka/kargo/package.nix b/pkgs/by-name/ka/kargo/package.nix
index b50072c4024e..42fef092db88 100644
--- a/pkgs/by-name/ka/kargo/package.nix
+++ b/pkgs/by-name/ka/kargo/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "kargo";
-  version = "1.5.3";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "akuity";
     repo = "kargo";
     tag = "v${version}";
-    hash = "sha256-JjDlH3KqB0NEPFvOhKzUR24WvV/6lx7yXTwM10cIA2k=";
+    hash = "sha256-I1mOEI9F8qQU9g4iKZC6iE0Or2UA25qM4z+H1z2juRY=";
   };
 
-  vendorHash = "sha256-iZEAUDRqOHmG5u1FEtb14hSHp4p30FGzLEsCYJQCd8U=";
+  vendorHash = "sha256-K7/18Qk1sEmBW+Nt5VpO/eMKijDuXXx1+fIlXB1lUUM=";
 
   subPackages = [ "cmd/cli" ];
 

From a64c5bccd8777b43ee31266baca227b1e37e7c79 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 14:05:30 +0000
Subject: [PATCH 042/190] mydumper: 0.19.3-2 -> 0.19.3-3

---
 pkgs/by-name/my/mydumper/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/my/mydumper/package.nix b/pkgs/by-name/my/mydumper/package.nix
index 6298d806aefe..a282673f5243 100644
--- a/pkgs/by-name/my/mydumper/package.nix
+++ b/pkgs/by-name/my/mydumper/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mydumper";
-  version = "0.19.3-2";
+  version = "0.19.3-3";
 
   src = fetchFromGitHub {
     owner = "mydumper";
     repo = "mydumper";
     tag = "v${version}";
-    hash = "sha256-Vm2WOx35QmiGBHnOckNw0mMS95aHrcNO4c1ptCYF7c4=";
+    hash = "sha256-CrjI6jwktBxKn7hgL8+pCikbtCFUK6z90Do9fWmLZlQ=";
     # as of mydumper v0.16.5-1, mydumper extracted its docs into a submodule
     fetchSubmodules = true;
   };

From 44bd9a73f47038cb49f1f53c48421b9c95b527d0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 14:31:05 +0000
Subject: [PATCH 043/190] cargo-llvm-lines: 0.4.42 -> 0.4.43

---
 pkgs/by-name/ca/cargo-llvm-lines/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-llvm-lines/package.nix b/pkgs/by-name/ca/cargo-llvm-lines/package.nix
index 027ff4b7c512..eddc054a4ef3 100644
--- a/pkgs/by-name/ca/cargo-llvm-lines/package.nix
+++ b/pkgs/by-name/ca/cargo-llvm-lines/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-llvm-lines";
-  version = "0.4.42";
+  version = "0.4.43";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-llvm-lines";
     rev = version;
-    hash = "sha256-qKdxnISussiyp1ylahS7qOdMfOGwJnlbWrgEHf/L2y0=";
+    hash = "sha256-fYoVPm3RxR1LZ8wJQpXQG3g69Fh7LLFwXZXmj+kr8zc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Ppuc6Dx3Y4JJ8doEJPCbwnD1+dQSLRuPdWfab+3q2Ug=";
+  cargoHash = "sha256-yhZ2MKswFvzkMamI9np7CRsQO4D/sldumaLPzSNsHgA=";
 
   meta = with lib; {
     description = "Count the number of lines of LLVM IR across all instantiations of a generic function";

From b2f396c9465b46b75af03a666ded3d2749f6820e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 17:36:40 +0000
Subject: [PATCH 044/190] python3Packages.plugp100: 5.1.4 -> 5.1.5

---
 pkgs/development/python-modules/plugp100/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/plugp100/default.nix b/pkgs/development/python-modules/plugp100/default.nix
index 2164b86790bc..de9c7beb41cc 100644
--- a/pkgs/development/python-modules/plugp100/default.nix
+++ b/pkgs/development/python-modules/plugp100/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "plugp100";
-  version = "5.1.4";
+  version = "5.1.5";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "petretiandrea";
     repo = "plugp100";
     tag = version;
-    sha256 = "sha256-a/Rv5imVJOJNaLzPozK8+XMZZsR5HyIXbCmq2Flkd+I=";
+    sha256 = "sha256-bPjgyScHxiUke/M5S6BOw7df7wbNuSy5ouVIK5guWxw=";
   };
 
   propagatedBuildInputs = [

From 8c672052890c681561af0a52ba89ccb14e7d8bb6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 21:44:58 +0000
Subject: [PATCH 045/190] python3Packages.docling-parse: 4.0.5 -> 4.1.0

---
 pkgs/development/python-modules/docling-parse/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/docling-parse/default.nix b/pkgs/development/python-modules/docling-parse/default.nix
index a6e6fba0468c..ebca992e63b0 100644
--- a/pkgs/development/python-modules/docling-parse/default.nix
+++ b/pkgs/development/python-modules/docling-parse/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "docling-parse";
-  version = "4.0.5";
+  version = "4.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-parse";
     tag = "v${version}";
-    hash = "sha256-H8/T9gwQ6MeNsNcJ5I9cVnQVFEXHfmqYCxhkxszD8/w=";
+    hash = "sha256-1vl5Ij25NXAwhoXLJ35lcr5r479jrdKd9DxWhYbCApw=";
   };
 
   dontUseCmakeConfigure = true;

From fcb8eff2d30426b19d5cee73e9b2d4eee571ce61 Mon Sep 17 00:00:00 2001
From: Nadia Holmquist Pedersen <nadia@nhp.sh>
Date: Sun, 13 Jul 2025 02:05:59 +0200
Subject: [PATCH 046/190] ares: 144 -> 145

---
 pkgs/by-name/ar/ares/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ar/ares/package.nix b/pkgs/by-name/ar/ares/package.nix
index 84eaaf6f3d49..48a80bbf01b1 100644
--- a/pkgs/by-name/ar/ares/package.nix
+++ b/pkgs/by-name/ar/ares/package.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ares";
-  version = "144";
+  version = "145";
 
   src = fetchFromGitHub {
     owner = "ares-emulator";
     repo = "ares";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BpVyPdtsIUstLVf/HGO6vcAlLgJP5SgJbZtqEV/uJ2g=";
+    hash = "sha256-es+K5+qlK7FcJCFEIMcOsXCZSnoXEEmtS0yhpCvaILM";
   };
 
   nativeBuildInputs =

From 63239dadd4b0240979d44607b88a133a650b55c2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 02:27:38 +0000
Subject: [PATCH 047/190] tui-journal: 0.15.0 -> 0.16.0

---
 pkgs/by-name/tu/tui-journal/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tu/tui-journal/package.nix b/pkgs/by-name/tu/tui-journal/package.nix
index 079e09d45ec9..a81388e1a4ea 100644
--- a/pkgs/by-name/tu/tui-journal/package.nix
+++ b/pkgs/by-name/tu/tui-journal/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tui-journal";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "AmmarAbouZor";
     repo = "tui-journal";
     rev = "v${version}";
-    hash = "sha256-XbOKC+utKt53iFzNbm861tMGsNMZ2GQc+/J0Dm/SYS8=";
+    hash = "sha256-hZpS0r3ky18XtDj4x8croKAZ+css1NmVy98NUuhtR/s=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-gleNWRs9oCI9TH5ALS/wvC88OooMfSTJvz+UVWFYrs4=";
+  cargoHash = "sha256-XsrHNzTiYWqTDV9+soY5oC4UoE5OBC7Ow7qir2dKV/A=";
 
   nativeBuildInputs = [
     pkg-config

From 76c7afcae6d5225817a68d213ab37ecf10bd0c70 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 06:16:39 +0000
Subject: [PATCH 048/190] python3Packages.djangosaml2: 1.11.0 -> 1.11.1-1

---
 pkgs/development/python-modules/djangosaml2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/djangosaml2/default.nix b/pkgs/development/python-modules/djangosaml2/default.nix
index c3e130ba27a4..7d1c6d09e5f1 100644
--- a/pkgs/development/python-modules/djangosaml2/default.nix
+++ b/pkgs/development/python-modules/djangosaml2/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "djangosaml2";
-  version = "1.11.0";
+  version = "1.11.1-1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "IdentityPython";
     repo = "djangosaml2";
     tag = "v${version}";
-    hash = "sha256-AkyXxWcckBVWUZAhjuUru2b1/t4iwoCKxmTvvqSziV0=";
+    hash = "sha256-f7VgysfGpwt4opmXXaigRsOBS506XB/jZV1zRiYwZig=";
   };
 
   build-system = [ setuptools ];

From d2ec71253d3a0e873e7d5977e02e8e157549e10c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 07:52:39 +0000
Subject: [PATCH 049/190] airwindows: 0-unstable-2025-06-28 ->
 0-unstable-2025-07-06

---
 pkgs/by-name/ai/airwindows/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ai/airwindows/package.nix b/pkgs/by-name/ai/airwindows/package.nix
index 076461496102..6aceb886d9c1 100644
--- a/pkgs/by-name/ai/airwindows/package.nix
+++ b/pkgs/by-name/ai/airwindows/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation {
   pname = "airwindows";
-  version = "0-unstable-2025-06-28";
+  version = "0-unstable-2025-07-06";
 
   src = fetchFromGitHub {
     owner = "airwindows";
     repo = "airwindows";
-    rev = "8aedc304ed6fd44dd170cbfc6a43a3f138835af9";
-    hash = "sha256-pQOuhXypo55GqsoCmhpjQkSIsEOVL7y6xqmMqP8yzqI=";
+    rev = "4a19d80d3d2a64a8773ca319a5002ac5eefbf69c";
+    hash = "sha256-aMPe1D1/hIVY4DGKzmX/HUO04pZVBtivhVzoeG02emY=";
   };
 
   # we patch helpers because honestly im spooked out by where those variables

From e4e70e0c4b2e71f33f25d42cf71ab323f5605d5c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 08:34:46 +0000
Subject: [PATCH 050/190] ugs: 2.1.14 -> 2.1.15

---
 pkgs/by-name/ug/ugs/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ug/ugs/package.nix b/pkgs/by-name/ug/ugs/package.nix
index bb0c580863cd..de8cd6239ec4 100644
--- a/pkgs/by-name/ug/ugs/package.nix
+++ b/pkgs/by-name/ug/ugs/package.nix
@@ -19,11 +19,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ugs";
-  version = "2.1.14";
+  version = "2.1.15";
 
   src = fetchzip {
     url = "https://github.com/winder/Universal-G-Code-Sender/releases/download/v${version}/UniversalGcodeSender.zip";
-    hash = "sha256-yPamI5Ww56J+jQ3IZW2VKtyW19SHZ1Cxhq2dOAOiUMo=";
+    hash = "sha256-IzDcMe8seISyF4Eg4CPDsCj2DDFknFgCkajhLoL3YrM=";
   };
 
   dontUnpack = true;

From 8a67241058ef4b7d6fe8beb2a3c9c4811c62eee5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 09:29:34 +0000
Subject: [PATCH 051/190] cmctl: 2.2.0 -> 2.3.0

---
 pkgs/by-name/cm/cmctl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cm/cmctl/package.nix b/pkgs/by-name/cm/cmctl/package.nix
index a443b7df1faf..e0c1b044eac8 100644
--- a/pkgs/by-name/cm/cmctl/package.nix
+++ b/pkgs/by-name/cm/cmctl/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cmctl";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cmctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Kr7vwVW6v08QRbJDs2u0vK241ljNfhLVYIQCBl31QSs=";
+    hash = "sha256-yX3A63MU1PaFQmAemp62F5sHlgWpkInhbIIZx7HfdEc=";
   };
 
-  vendorHash = "sha256-SYCWvt2K3MEow4cDKxLSK+Bp0hZG9rNI9PoXdPcPESg=";
+  vendorHash = "sha256-LDmhlSWa6/Z4KyXnF9OFVkgTksV7TL+m1os0NW89ZpY=";
 
   ldflags = [
     "-s"

From 1ecb30f4fb1ec55b3afe80c6bcc2bb083f75124c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 09:32:17 +0000
Subject: [PATCH 052/190] frida-tools: 14.4.0 -> 14.4.1

---
 pkgs/by-name/fr/frida-tools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/frida-tools/package.nix b/pkgs/by-name/fr/frida-tools/package.nix
index c55458108dd0..4f56d016ce93 100644
--- a/pkgs/by-name/fr/frida-tools/package.nix
+++ b/pkgs/by-name/fr/frida-tools/package.nix
@@ -6,12 +6,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "frida-tools";
-  version = "14.4.0";
+  version = "14.4.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ACiznCkOZvnPUSB+Xcs4IZfbPGyknr193gLok0FrzqA=";
+    hash = "sha256-Zb6Pk6c7QbJLsb4twhdVgaUWtxCy/Vff5PKIno9B/b4=";
   };
 
   build-system = with python3Packages; [

From 7ffe7b4323ab28b2a0377b985ec5c20edb6da78e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 12:12:46 +0000
Subject: [PATCH 053/190] git-recent: 2.0.2 -> 2.0.4

---
 pkgs/applications/version-management/git-recent/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/git-recent/default.nix b/pkgs/applications/version-management/git-recent/default.nix
index 05fb6eded1f4..6dfd8460d658 100644
--- a/pkgs/applications/version-management/git-recent/default.nix
+++ b/pkgs/applications/version-management/git-recent/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-recent";
-  version = "2.0.2";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "paulirish";
     repo = "git-recent";
     rev = "v${version}";
-    sha256 = "sha256-BwnSDIBGjhfQ9mA/29NfWYaVZGXzZudX9LsCdRlnT0I=";
+    sha256 = "sha256-b6AWLEXCOza+lIHlvyYs3M6yHGr2StYXzl7OsA9gv/k=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 02f7b8e2b89c09ab43b5aaa436c526963d689fda Mon Sep 17 00:00:00 2001
From: Nadir Ishiguro <23151917+nadir-ishiguro@users.noreply.github.com>
Date: Fri, 11 Jul 2025 23:39:56 +0200
Subject: [PATCH 054/190] nom: tidy up

 - add version ldflag
 - add nix-update-script passthru
 - add changelog reference
 - remove meta with lib
---
 pkgs/by-name/no/nom/package.nix | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/no/nom/package.nix b/pkgs/by-name/no/nom/package.nix
index a69c3645c878..ddc0f4b1ddfa 100644
--- a/pkgs/by-name/no/nom/package.nix
+++ b/pkgs/by-name/no/nom/package.nix
@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
 }:
 buildGoModule rec {
   pname = "nom";
@@ -16,12 +17,19 @@ buildGoModule rec {
 
   vendorHash = "sha256-d5KTDZKfuzv84oMgmsjJoXGO5XYLVKxOB5XehqgRvYw=";
 
-  meta = with lib; {
+  ldflags = [
+    "-X 'main.version=${version}'"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     homepage = "https://github.com/guyfedwards/nom";
+    changelog = "https://github.com/guyfedwards/nom/releases/tag/v${version}";
     description = "RSS reader for the terminal";
-    platforms = platforms.linux ++ platforms.darwin;
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
       nadir-ishiguro
       matthiasbeyer
     ];

From 1e2877d7f7b001381a8c9e6a0663205eebdcd6e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 13 Jul 2025 12:07:51 -0700
Subject: [PATCH 055/190] imagemagick: 7.1.1-47 -> 7.1.2-0

Diff: https://github.com/ImageMagick/ImageMagick/compare/refs/tags/7.1.1-47...refs/tags/7.1.2-0

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
---
 pkgs/applications/graphics/ImageMagick/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 1e6f6195c234..aed3d2193ff5 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-47";
+  version = "7.1.2-0";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-lRPGVGv86vH7Q1cLoLp8mOAkxcHTHgUrx0mmKgl1oEc=";
+    hash = "sha256-4x0+yELmXstv9hPuwzMGcKiTa1rZtURZgwSSVIhzAkE=";
   };
 
   outputs = [

From 1ea6ebe86dd46d75182d557005150e427395f773 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 19:28:21 +0000
Subject: [PATCH 056/190] beeper: 4.0.779 -> 4.0.821

---
 pkgs/by-name/be/beeper/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/be/beeper/package.nix b/pkgs/by-name/be/beeper/package.nix
index daefaaaa76b3..4dc3036ae59b 100644
--- a/pkgs/by-name/be/beeper/package.nix
+++ b/pkgs/by-name/be/beeper/package.nix
@@ -9,10 +9,10 @@
 }:
 let
   pname = "beeper";
-  version = "4.0.779";
+  version = "4.0.821";
   src = fetchurl {
     url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}.AppImage";
-    hash = "sha256-eRA/9OAWcYsn1C8xuC6NFj2/HxOHT0YISDC9Kp8H/Yg=";
+    hash = "sha256-bBQUCZ9v2MrGpziaSTVNRootXln51arO3NeuIRiMwZA=";
   };
   appimageContents = appimageTools.extract {
     inherit pname version src;

From f6d5a9bc1aac77a9bf6b9500ae734c6c7ccfcb12 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 23:22:39 +0000
Subject: [PATCH 057/190] immich-public-proxy: 1.11.3 -> 1.11.5

---
 pkgs/by-name/im/immich-public-proxy/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/im/immich-public-proxy/package.nix b/pkgs/by-name/im/immich-public-proxy/package.nix
index 42126fa6023b..516547bc9c0b 100644
--- a/pkgs/by-name/im/immich-public-proxy/package.nix
+++ b/pkgs/by-name/im/immich-public-proxy/package.nix
@@ -8,17 +8,17 @@
 }:
 buildNpmPackage rec {
   pname = "immich-public-proxy";
-  version = "1.11.3";
+  version = "1.11.5";
   src = fetchFromGitHub {
     owner = "alangrainger";
     repo = "immich-public-proxy";
     tag = "v${version}";
-    hash = "sha256-rroccsVgPsBOTQ/2Mb+BoqOm59LdjqSqKsL40n7NXss=";
+    hash = "sha256-jSAQbACWEt/gyZbr4sOM17t3KZoxPOM0RZFbsLZfcRM=";
   };
 
   sourceRoot = "${src.name}/app";
 
-  npmDepsHash = "sha256-9zuw24lPFsDWHrplShsCQDrUpBa6U+NeRVJNSI4OJHA=";
+  npmDepsHash = "sha256-av+XKzrTl+8xizYFZwCTmaLNsbBnusf03I1Uvkp0sF8=";
 
   # patch in absolute nix store paths so the process doesn't need to cwd in $out
   postPatch = ''

From a95b4a1c57fcb83e953ae64c71c3a3d79389b8e0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 01:18:38 +0000
Subject: [PATCH 058/190] icewm: 3.8.0 -> 3.8.1

---
 pkgs/by-name/ic/icewm/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ic/icewm/package.nix b/pkgs/by-name/ic/icewm/package.nix
index 0b9ccda46f30..bf4ed18659e3 100644
--- a/pkgs/by-name/ic/icewm/package.nix
+++ b/pkgs/by-name/ic/icewm/package.nix
@@ -41,13 +41,13 @@
 
 gccStdenv.mkDerivation (finalAttrs: {
   pname = "icewm";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = "icewm";
     tag = finalAttrs.version;
-    hash = "sha256-PHbBjwGxFxHnecuXXX2nT8SwmgJD0DzThiFEwKKDASU=";
+    hash = "sha256-ESq8ojGA5iF+VI4B+MIGWz7V2YIROorju8mJ4MV0gOo=";
   };
 
   strictDeps = true;

From 899f83016113825868e883229b6406dfc398058c Mon Sep 17 00:00:00 2001
From: iqubic <avi.caspe@gmail.com>
Date: Sun, 13 Jul 2025 20:05:25 -0700
Subject: [PATCH 059/190] maintainers: add iqubic

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 67a635615292..e0029916a8d0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10946,6 +10946,12 @@
     githubId = 16307070;
     name = "iosmanthus";
   };
+  iqubic = {
+    email = "sophia.b.caspe@gmail.com";
+    github = "iqubic";
+    githubId = 22628816;
+    name = "Sophia Caspe";
+  };
   iquerejeta = {
     github = "iquerejeta";
     githubId = 31273774;

From 3856851416938f3108f15ca989c5143f77f745d7 Mon Sep 17 00:00:00 2001
From: iqubic <avi.caspe@gmail.com>
Date: Sun, 13 Jul 2025 20:11:29 -0700
Subject: [PATCH 060/190] archipelago: 0.6.1 -> 0.6.2

---
 pkgs/by-name/ar/archipelago/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ar/archipelago/package.nix b/pkgs/by-name/ar/archipelago/package.nix
index 4140936fc5e7..07414957532e 100644
--- a/pkgs/by-name/ar/archipelago/package.nix
+++ b/pkgs/by-name/ar/archipelago/package.nix
@@ -7,10 +7,10 @@
 }:
 let
   pname = "archipelago";
-  version = "0.6.1";
+  version = "0.6.2";
   src = fetchurl {
     url = "https://github.com/ArchipelagoMW/Archipelago/releases/download/${version}/Archipelago_${version}_linux-x86_64.AppImage";
-    hash = "sha256-8mPlR5xVnHL9I0rV4bMFaffSJv7dMlCcPHrLkM/pyVU=";
+    hash = "sha256-DdlfHb8iTCfTGGBUYQeELYh2NF/2GcamtuJzeYb2A5M=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };

From 5bfca71fd2b36f9535aab78d65983a2e243fe4ec Mon Sep 17 00:00:00 2001
From: iqubic <avi.caspe@gmail.com>
Date: Sun, 13 Jul 2025 21:02:59 -0700
Subject: [PATCH 061/190] archipelago: add iqubic as a maintainer

---
 pkgs/by-name/ar/archipelago/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ar/archipelago/package.nix b/pkgs/by-name/ar/archipelago/package.nix
index 07414957532e..e0cd0fcaac95 100644
--- a/pkgs/by-name/ar/archipelago/package.nix
+++ b/pkgs/by-name/ar/archipelago/package.nix
@@ -40,7 +40,10 @@ appimageTools.wrapType2 {
     changelog = "https://github.com/ArchipelagoMW/Archipelago/releases/tag/${version}";
     license = lib.licenses.mit;
     mainProgram = "archipelago";
-    maintainers = with lib.maintainers; [ pyrox0 ];
+    maintainers = with lib.maintainers; [
+      pyrox0
+      iqubic
+    ];
     platforms = lib.platforms.linux;
   };
 }

From a848492351d62aad97e4c4494390f6aeeac1f61b Mon Sep 17 00:00:00 2001
From: Savyasachee Jha <genghizkhan91@hawkradius.com>
Date: Thu, 10 Jul 2025 08:04:36 +0200
Subject: [PATCH 062/190] firefly-iii-data-importer: 1.7.3 -> 1.7.6

---
 pkgs/by-name/fi/firefly-iii-data-importer/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
index 381408cd8e5d..3be092be7ca3 100644
--- a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
+++ b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii-data-importer";
-  version = "1.7.3";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "data-importer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CUotqHmVXKKkbAS4a7YWoVjs1GRhxrA5Y5rXtMx/mCo=";
+    hash = "sha256-2QjflXnusdqg63S1RgSbDsYHk9U4Xjf59wkvvo9n+Zo=";
   };
 
   buildInputs = [ php84 ];
@@ -38,12 +38,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   composerStrictValidation = true;
   strictDeps = true;
 
-  vendorHash = "sha256-JN9HaX056+AhYkMyZ7KO7c6z43ynbRyORAOvW+6eVO8=";
+  vendorHash = "sha256-j0KjjmaDyFBFWnz6e4Bkrb3gkitfSKsj9UB2j/G19do=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     name = "${finalAttrs.pname}-npm-deps";
-    hash = "sha256-0vMxwm6NOdhCQcVeO93QNGB1BlqVckXzHkpCVvDB9ms=";
+    hash = "sha256-4bDSEGg5vGoam1PLRfaxJK0aQ+MLBTF+GP0AZQjHvVw=";
   };
 
   composerRepository = php84.mkComposerRepository {

From 2302a4bb5de7a8f47ba1bb8aae80460906649da5 Mon Sep 17 00:00:00 2001
From: Savyasachee Jha <genghizkhan91@hawkradius.com>
Date: Thu, 10 Jul 2025 08:05:18 +0200
Subject: [PATCH 063/190] nixosTests.firefly-iii-data-importer: Added
 meta.platforms so that tests are skipped appropriately

---
 nixos/tests/firefly-iii-data-importer.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/firefly-iii-data-importer.nix b/nixos/tests/firefly-iii-data-importer.nix
index d43a30650bc2..a068ff2d025e 100644
--- a/nixos/tests/firefly-iii-data-importer.nix
+++ b/nixos/tests/firefly-iii-data-importer.nix
@@ -1,7 +1,10 @@
 { lib, ... }:
 {
   name = "firefly-iii-data-importer";
-  meta.maintainers = [ lib.maintainers.savyajha ];
+  meta = {
+    maintainers = [ lib.maintainers.savyajha ];
+    platforms = lib.platforms.linux;
+  };
 
   nodes.dataImporter =
     { ... }:

From 67e952fbac731109300f65d76f306943d4fcf331 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 14 Jul 2025 18:24:00 +0300
Subject: [PATCH 064/190] lasuite-meet: 0.1.27 -> 0.1.28

Diff: https://github.com/suitenumerique/meet/compare/refs/tags/v0.1.27...refs/tags/v0.1.28

Changelog: https://github.com/suitenumerique/meet/blob/v0.1.28/CHANGELOG.md
---
 pkgs/by-name/la/lasuite-meet/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index a7cdc837ed96..d8d0468d7ac1 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -13,14 +13,14 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "lasuite-meet";
-  version = "0.1.27";
+  version = "0.1.28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-EMhsQPrONaQmNJ/FFoYlP5KKXT8vm7LwUHmEZd0oZeE=";
+    hash = "sha256-zB27doGkWch3e1Lc0Q3TurQeplV7vOdzJ+G+MFZI3Og=";
   };
 
   sourceRoot = "source/src/backend";

From 4ab15e0809468fd9473b059eed4b751f6d59c2df Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 14 Jul 2025 18:27:00 +0300
Subject: [PATCH 065/190] lasuite-meet-frontend: 0.1.27 -> 0.1.28

Diff: https://github.com/suitenumerique/meet/compare/refs/tags/v0.1.27...refs/tags/v0.1.28

Changelog: https://github.com/suitenumerique/meet/blob/v0.1.28/CHANGELOG.md
---
 pkgs/by-name/la/lasuite-meet-frontend/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-meet-frontend/package.nix b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
index 62735ff11cee..f939cd296278 100644
--- a/pkgs/by-name/la/lasuite-meet-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "lasuite-meet-frontend";
-  version = "0.1.27";
+  version = "0.1.28";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-EMhsQPrONaQmNJ/FFoYlP5KKXT8vm7LwUHmEZd0oZeE=";
+    hash = "sha256-zB27doGkWch3e1Lc0Q3TurQeplV7vOdzJ+G+MFZI3Og=";
   };
 
   sourceRoot = "source/src/frontend";
@@ -21,7 +21,7 @@ buildNpmPackage rec {
   npmDeps = fetchNpmDeps {
     inherit version src;
     sourceRoot = "source/src/frontend";
-    hash = "sha256-7wXzcn6aGAkRUOCI6MU0AlPGngBWJtdbAfnZZDaMWec=";
+    hash = "sha256-ajN3mDIUn8uX+xc3zZmzsFWY8Y5ss9gVeV0s5kJV3fs=";
   };
 
   buildPhase = ''

From f3096232c9f76dbae269da536584c55a1c9594dd Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 14 Jul 2025 18:27:29 +0300
Subject: [PATCH 066/190] lasuite-meet: add PKCE option

---
 pkgs/by-name/la/lasuite-meet/package.nix |  2 ++
 pkgs/by-name/la/lasuite-meet/pkce.patch  | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 pkgs/by-name/la/lasuite-meet/pkce.patch

diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index d8d0468d7ac1..6df4b9622dbd 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -28,6 +28,8 @@ python.pkgs.buildPythonApplication rec {
   patches = [
     # Support configuration throught environment variables for SECURE_*
     ./secure_settings.patch
+    # Add PKCE option
+    ./pkce.patch
   ];
 
   build-system = with python.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/la/lasuite-meet/pkce.patch b/pkgs/by-name/la/lasuite-meet/pkce.patch
new file mode 100644
index 000000000000..968a38eb3d7b
--- /dev/null
+++ b/pkgs/by-name/la/lasuite-meet/pkce.patch
@@ -0,0 +1,20 @@
+--- a/meet/settings.py
++++ b/meet/settings.py
+@@ -430,6 +430,17 @@ class Base(Configuration):
+     OIDC_RP_SCOPES = values.Value(
+         "openid email", environ_name="OIDC_RP_SCOPES", environ_prefix=None
+     )
++    OIDC_USE_PKCE = values.BooleanValue(
++        default=False, environ_name="OIDC_USE_PKCE", environ_prefix=None
++    )
++    OIDC_PKCE_CODE_CHALLENGE_METHOD = values.Value(
++        default="S256",
++        environ_name="OIDC_PKCE_CODE_CHALLENGE_METHOD",
++        environ_prefix=None,
++    )
++    OIDC_PKCE_CODE_VERIFIER_SIZE = values.IntegerValue(
++        default=64, environ_name="OIDC_PKCE_CODE_VERIFIER_SIZE", environ_prefix=None
++    )
+     LOGIN_REDIRECT_URL = values.Value(
+         None, environ_name="LOGIN_REDIRECT_URL", environ_prefix=None
+     )

From e26c09f33c31811ce9804191d47ab7f648822bbb Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Mon, 14 Jul 2025 14:06:52 -0400
Subject: [PATCH 067/190] vscode-extensions.ethersync.ethersync: init at 0.2.1

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 .../editors/vscode/extensions/default.nix     |  2 ++
 .../ethersync.ethersync/default.nix           | 22 +++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/applications/editors/vscode/extensions/ethersync.ethersync/default.nix

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 98806af52a85..37d213f6d611 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1789,6 +1789,8 @@ let
         };
       };
 
+      ethersync.ethersync = callPackage ./ethersync.ethersync { };
+
       eugleo.magic-racket = callPackage ./eugleo.magic-racket { };
 
       ExiaHuang.dictionary = buildVscodeMarketplaceExtension {
diff --git a/pkgs/applications/editors/vscode/extensions/ethersync.ethersync/default.nix b/pkgs/applications/editors/vscode/extensions/ethersync.ethersync/default.nix
new file mode 100644
index 000000000000..1eae53b8a780
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/ethersync.ethersync/default.nix
@@ -0,0 +1,22 @@
+{
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    publisher = "ethersync";
+    name = "ethersync";
+    version = "0.2.1";
+    hash = "sha256-/oRpoYMWSpkAEM89KlJnSJ7TWwcGloYHXh80Ml+vz+M=";
+  };
+
+  meta = {
+    description = "Extension for real-time co-editing of local text files";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ethersync.ethersync";
+    homepage = "https://github.com/ethersync/ethersync/tree/main/vscode-plugin";
+    license = lib.licenses.agpl3Plus;
+    maintainers = [ lib.maintainers.ethancedwards8 ];
+    teams = [ lib.teams.ngi ];
+  };
+}

From 6a32ecb90dcb3e0805eb965f41e2a3867892463e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 14 Jul 2025 12:10:03 -0700
Subject: [PATCH 068/190] libdeltachat: 1.160.0 -> 2.2.0

Diff: https://github.com/chatmail/core/compare/refs/tags/v1.160.0...refs/tags/v2.2.0

Changelog: https://github.com/chatmail/core/blob/v2.2.0/CHANGELOG.md
---
 pkgs/by-name/li/libdeltachat/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libdeltachat/package.nix b/pkgs/by-name/li/libdeltachat/package.nix
index 9eff15d6faa4..912712cb42f3 100644
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.160.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "chatmail";
     repo = "core";
     tag = "v${version}";
-    hash = "sha256-F88mDic6cnSa8mHhr+uX2WORFgJOu9LChLIS6DqWc40=";
+    hash = "sha256-Evk2g2fqEmo/cd6+Sd76U0Byj6OEm99OZuUkoxTELbM=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoVendor {
     pname = "deltachat-core-rust";
     inherit version src;
-    hash = "sha256-pZwCcAOYLKR6wfncIyuisYccNSGK+lqUg6lkyfKPgFk=";
+    hash = "sha256-vnnROLmsAh6mSPuQzTSbYSgxGfrKaanuLcADFE+kQeM=";
   };
 
   nativeBuildInputs =

From 44c0690eb767726a73a26ed04f00f678bfb7b192 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 14 Jul 2025 13:58:10 -0700
Subject: [PATCH 069/190] python3Packages.rclone-python: hardcode path to
 rclone executable

---
 .../python-modules/rclone-python/default.nix  |  8 +-
 .../rclone-python/hardcode-rclone-path.patch  | 99 +++++++++++++++++++
 2 files changed, 106 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/python-modules/rclone-python/hardcode-rclone-path.patch

diff --git a/pkgs/development/python-modules/rclone-python/default.nix b/pkgs/development/python-modules/rclone-python/default.nix
index 1b6be818b936..01ac0b3c4b7a 100644
--- a/pkgs/development/python-modules/rclone-python/default.nix
+++ b/pkgs/development/python-modules/rclone-python/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  replaceVars,
   setuptools,
   rich,
   rclone,
@@ -19,10 +20,15 @@ buildPythonPackage rec {
     hash = "sha256-vvsiXS3uI0TcL+X8+75BQmycrF+EGIgQE1dmGef35rI=";
   };
 
+  patches = [
+    (replaceVars ./hardcode-rclone-path.patch {
+      rclone = lib.getExe rclone;
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
-    rclone
     rich
   ];
 
diff --git a/pkgs/development/python-modules/rclone-python/hardcode-rclone-path.patch b/pkgs/development/python-modules/rclone-python/hardcode-rclone-path.patch
new file mode 100644
index 000000000000..5edd6e24b9e6
--- /dev/null
+++ b/pkgs/development/python-modules/rclone-python/hardcode-rclone-path.patch
@@ -0,0 +1,99 @@
+diff --git a/rclone_python/rclone.py b/rclone_python/rclone.py
+index da399b4..e05365a 100644
+--- a/rclone_python/rclone.py
++++ b/rclone_python/rclone.py
+@@ -43,7 +43,7 @@ def is_installed() -> bool:
+     """
+     :return: True if rclone is correctly installed on the system.
+     """
+-    return which("rclone") is not None
++    return True
+ 
+ 
+ @__check_installed
+@@ -199,7 +199,7 @@ def copy(
+         in_path,
+         out_path,
+         ignore_existing=ignore_existing,
+-        command="rclone copy",
++        command="@rclone@ copy",
+         command_descr="Copying",
+         show_progress=show_progress,
+         listener=listener,
+@@ -234,7 +234,7 @@ def copyto(
+         in_path,
+         out_path,
+         ignore_existing=ignore_existing,
+-        command="rclone copyto",
++        command="@rclone@ copyto",
+         command_descr="Copying",
+         show_progress=show_progress,
+         listener=listener,
+@@ -269,7 +269,7 @@ def move(
+         in_path,
+         out_path,
+         ignore_existing=ignore_existing,
+-        command="rclone move",
++        command="@rclone@ move",
+         command_descr="Moving",
+         show_progress=show_progress,
+         listener=listener,
+@@ -304,7 +304,7 @@ def moveto(
+         in_path,
+         out_path,
+         ignore_existing=ignore_existing,
+-        command="rclone moveto",
++        command="@rclone@ moveto",
+         command_descr="Moving",
+         show_progress=show_progress,
+         listener=listener,
+@@ -336,7 +336,7 @@ def sync(
+     _rclone_transfer_operation(
+         src_path,
+         dest_path,
+-        command="rclone sync",
++        command="@rclone@ sync",
+         command_descr="Syncing",
+         show_progress=show_progress,
+         listener=listener,
+diff --git a/rclone_python/scripts/get_version.py b/rclone_python/scripts/get_version.py
+index b1d30fd..bc00cad 100644
+--- a/rclone_python/scripts/get_version.py
++++ b/rclone_python/scripts/get_version.py
+@@ -2,6 +2,6 @@ from subprocess import check_output
+ 
+ 
+ def get_version():
+-    stdout = check_output("rclone version", shell=True, encoding="utf8")
++    stdout = check_output("@rclone@ version", shell=True, encoding="utf8")
+ 
+     return stdout.split("\n")[0].replace("rclone ", "")
+diff --git a/rclone_python/scripts/update_hash_types.py b/rclone_python/scripts/update_hash_types.py
+index 92fbd0a..ef963cf 100644
+--- a/rclone_python/scripts/update_hash_types.py
++++ b/rclone_python/scripts/update_hash_types.py
+@@ -14,7 +14,7 @@ def update_hashes(output_path: str):
+     """
+ 
+     # get all supported backends
+-    rclone_output = sp.check_output("rclone hashsum", shell=True, encoding="utf8")
++    rclone_output = sp.check_output("@rclone@ hashsum", shell=True, encoding="utf8")
+     lines = rclone_output.splitlines()
+ 
+     hashes = []
+diff --git a/rclone_python/utils.py b/rclone_python/utils.py
+index d4a8413..1b29bd8 100644
+--- a/rclone_python/utils.py
++++ b/rclone_python/utils.py
+@@ -66,9 +66,9 @@ def run_rclone_cmd(
+     # otherwise the default rclone config path is used:
+     config = Config()
+     if config.config_path is not None:
+-        base_command = f"rclone --config={config.config_path}"
++        base_command = f"@rclone@ --config={config.config_path}"
+     else:
+-        base_command = "rclone"
++        base_command = "@rclone@"
+ 
+     # add optional arguments and flags to the command
+     args_str = args2string(args)

From e6dce4ad3e4966ad89b57539cbc26a4b89f619b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 14 Jul 2025 14:29:54 -0700
Subject: [PATCH 070/190] python3Packages.rclone-python: run tests

---
 .../python-modules/rclone-python/default.nix  | 26 ++++++++++++++--
 .../rclone-python/hardcode-rclone-path.patch  | 30 +++++++++++++++++++
 2 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rclone-python/default.nix b/pkgs/development/python-modules/rclone-python/default.nix
index 01ac0b3c4b7a..b4469d714dbc 100644
--- a/pkgs/development/python-modules/rclone-python/default.nix
+++ b/pkgs/development/python-modules/rclone-python/default.nix
@@ -2,10 +2,12 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pytestCheckHook,
   replaceVars,
   setuptools,
   rich,
   rclone,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
@@ -32,8 +34,28 @@ buildPythonPackage rec {
     rich
   ];
 
-  # tests require working internet connection
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  preCheck = ''
+    # Unlike upstream we don't actually run an S3 server for testing.
+    # See https://github.com/Johannes11833/rclone_python/blob/master/launch_test_server.sh
+    mkdir -p "$HOME/.config/rclone"
+    cat > "$HOME/.config/rclone/rclone.conf" <<EOF
+    [test_server_s3]
+    type = combine
+    upstreams = "testdir=$(mktemp -d)"
+    EOF
+  '';
+
+  disabledTestPaths = [
+    # test requires a remote that supports public links
+    "tests/test_link.py"
+    # test looks up latest version on rclone.org
+    "tests/test_version.py"
+  ];
 
   pythonImportsCheck = [ "rclone_python" ];
 
diff --git a/pkgs/development/python-modules/rclone-python/hardcode-rclone-path.patch b/pkgs/development/python-modules/rclone-python/hardcode-rclone-path.patch
index 5edd6e24b9e6..238f92c619d0 100644
--- a/pkgs/development/python-modules/rclone-python/hardcode-rclone-path.patch
+++ b/pkgs/development/python-modules/rclone-python/hardcode-rclone-path.patch
@@ -97,3 +97,33 @@ index d4a8413..1b29bd8 100644
  
      # add optional arguments and flags to the command
      args_str = args2string(args)
+diff --git a/tests/test_copy.py b/tests/test_copy.py
+index 4ded5fa..1cae53b 100644
+--- a/tests/test_copy.py
++++ b/tests/test_copy.py
+@@ -45,11 +45,11 @@ def create_local_file(
+ @pytest.mark.parametrize(
+     "wrapper_command,rclone_command",
+     [
+-        (rclone.copy, "rclone copy"),
+-        (rclone.copyto, "rclone copyto"),
+-        (rclone.sync, "rclone sync"),
+-        (rclone.move, "rclone move"),
+-        (rclone.moveto, "rclone moveto"),
++        (rclone.copy, "@rclone@ copy"),
++        (rclone.copyto, "@rclone@ copyto"),
++        (rclone.sync, "@rclone@ sync"),
++        (rclone.move, "@rclone@ move"),
++        (rclone.moveto, "@rclone@ moveto"),
+     ],
+ )
+ def test_rclone_command_called(wrapper_command: Callable, rclone_command: str):
+@@ -62,7 +62,7 @@ def test_rclone_command_called(wrapper_command: Callable, rclone_command: str):
+         rclone.utils.subprocess,
+         "Popen",
+         return_value=subprocess.Popen(
+-            "rclone help", stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True
++            "@rclone@ help", stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True
+         ),
+     ) as mock:
+         wrapper_command("nothing/not_a.file", "fake_remote:unicorn/folder")

From fff1654707aa6ede731b94306a80bfc2461ec101 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 02:02:16 +0000
Subject: [PATCH 071/190] balena-cli: 22.1.1 -> 22.1.2

---
 pkgs/by-name/ba/balena-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ba/balena-cli/package.nix b/pkgs/by-name/ba/balena-cli/package.nix
index 97415391a338..a5fa301abcf0 100644
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -22,16 +22,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "22.1.1";
+  version = "22.1.2";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-KEYzYIrcJdpicu4L09UVAU25fC8bWbIYJOuSpCHU3K4=";
+    hash = "sha256-akrZca9bRKqEVgmTKS0n1XliVhDq2eeH1Bo5ubjpYnc=";
   };
 
-  npmDepsHash = "sha256-jErFmkOQ3ySdLLXDh0Xl2tcWlfxnL2oob+x7QDuLJ8w=";
+  npmDepsHash = "sha256-Xq5pp1NNOXyCXnq1mNDaxktbjSzz3T0vOYsYZ7drUNQ=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json

From 9859213b3dac0ef6b972303993f75a0383ac1ae6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 06:42:58 +0000
Subject: [PATCH 072/190] shopify-cli: 3.82.0 -> 3.82.1

---
 .../sh/shopify-cli/manifests/package-lock.json       | 12 ++++++------
 pkgs/by-name/sh/shopify-cli/manifests/package.json   |  4 ++--
 pkgs/by-name/sh/shopify-cli/package.nix              |  4 ++--
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json b/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json
index 1bffe72ed0e0..772386febedf 100644
--- a/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json
+++ b/pkgs/by-name/sh/shopify-cli/manifests/package-lock.json
@@ -1,14 +1,14 @@
 {
   "name": "shopify",
-  "version": "3.82.0",
+  "version": "3.82.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "shopify",
-      "version": "3.82.0",
+      "version": "3.82.1",
       "dependencies": {
-        "@shopify/cli": "3.82.0"
+        "@shopify/cli": "3.82.1"
       },
       "bin": {
         "shopify": "node_modules/@shopify/cli/bin/run.js"
@@ -579,9 +579,9 @@
       }
     },
     "node_modules/@shopify/cli": {
-      "version": "3.82.0",
-      "resolved": "https://registry.npmjs.org/@shopify/cli/-/cli-3.82.0.tgz",
-      "integrity": "sha512-y+Sq21Zr+vJVQu7z2wNKXXI4NnkACuh/Tt/KrAX7C+NntmKLXl7CZEaVesmJ5shpksG2up1iY1MgMYsDPoNpUA==",
+      "version": "3.82.1",
+      "resolved": "https://registry.npmjs.org/@shopify/cli/-/cli-3.82.1.tgz",
+      "integrity": "sha512-iIABwasf+aMSBIjaPsKlVSaLp3vcOIPcfiitdoMUJKQhjIVbq8KdwaAa/MLUMe5B+l230zjq/xGB8U3JeJY0eg==",
       "license": "MIT",
       "os": [
         "darwin",
diff --git a/pkgs/by-name/sh/shopify-cli/manifests/package.json b/pkgs/by-name/sh/shopify-cli/manifests/package.json
index 33d2d489ab47..f8fef2a1630d 100644
--- a/pkgs/by-name/sh/shopify-cli/manifests/package.json
+++ b/pkgs/by-name/sh/shopify-cli/manifests/package.json
@@ -1,11 +1,11 @@
 {
   "name": "shopify",
-  "version": "3.82.0",
+  "version": "3.82.1",
   "private": true,
   "bin": {
     "shopify": "node_modules/@shopify/cli/bin/run.js"
   },
   "dependencies": {
-    "@shopify/cli": "3.82.0"
+    "@shopify/cli": "3.82.1"
   }
 }
diff --git a/pkgs/by-name/sh/shopify-cli/package.nix b/pkgs/by-name/sh/shopify-cli/package.nix
index 6bbd087f8a04..1b64c8313477 100644
--- a/pkgs/by-name/sh/shopify-cli/package.nix
+++ b/pkgs/by-name/sh/shopify-cli/package.nix
@@ -5,7 +5,7 @@
   shopify-cli,
 }:
 let
-  version = "3.82.0";
+  version = "3.82.1";
 in
 buildNpmPackage {
   pname = "shopify";
@@ -13,7 +13,7 @@ buildNpmPackage {
 
   src = ./manifests;
 
-  npmDepsHash = "sha256-liqEE0AXbj9L23xR6cpNK6b7CdL2pWvFFjL2S1lwKwQ=";
+  npmDepsHash = "sha256-s0wlJxA3DUXRGBlLvyesLr9H/nbDc9yHBBWBLjQd8vE=";
   dontNpmBuild = true;
 
   passthru = {

From cbe06e74106761ecb8f22642c83eee3c52d3129b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 09:06:49 +0000
Subject: [PATCH 073/190] nuclei-templates: 10.2.4 -> 10.2.5

---
 pkgs/by-name/nu/nuclei-templates/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nu/nuclei-templates/package.nix b/pkgs/by-name/nu/nuclei-templates/package.nix
index ac700113531e..179385cb77fe 100644
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nuclei-templates";
-  version = "10.2.4";
+  version = "10.2.5";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     tag = "v${version}";
-    hash = "sha256-RBZjtKkUk+kOob2VBFh1rPrVuUsIBMAetUhMClOZY6s=";
+    hash = "sha256-fJykVJHfuSmnSuR/Sxup8pr+KKwqQoYqLeNLoXMau4E=";
   };
 
   installPhase = ''

From cde2fae828a3d3396934d69d5a2e24a28523bd40 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 09:48:13 +0000
Subject: [PATCH 074/190] amp-cli: 0.0.1750924878-gfee7d7 ->
 0.0.1752566512-ga67426

---
 pkgs/by-name/am/amp-cli/package-lock.json | 10 +++++-----
 pkgs/by-name/am/amp-cli/package.nix       |  6 +++---
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/am/amp-cli/package-lock.json b/pkgs/by-name/am/amp-cli/package-lock.json
index 172af7d3f9a7..d4a5e1b037d5 100644
--- a/pkgs/by-name/am/amp-cli/package-lock.json
+++ b/pkgs/by-name/am/amp-cli/package-lock.json
@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@sourcegraph/amp": "^0.0.1750924878-gfee7d7"
+        "@sourcegraph/amp": "^0.0.1752566512-ga67426"
       }
     },
     "node_modules/@colors/colors": {
@@ -29,9 +29,9 @@
       }
     },
     "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1750924878-gfee7d7",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1750924878-gfee7d7.tgz",
-      "integrity": "sha512-3TZRSPaQY1eSIyAy4m/wSmW8CUq33r1oZfxguq2IWBLYdud90vPoLgOf6Hl9ZX3bkiLVRiU34oXXMmhb2Z5nzA==",
+      "version": "0.0.1752566512-ga67426",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1752566512-ga67426.tgz",
+      "integrity": "sha512-nz+iPJwZs0ONCnh/pCX2sfm47nCCegl9OLMUx2Z3ZW604ZTQ8w0IeiBs1Gzjlt8EnXlBR8tWY6f5ff+DT8UihA==",
       "dependencies": {
         "@vscode/ripgrep": "1.15.11",
         "commander": "^11.1.0",
@@ -43,7 +43,7 @@
         "xdg-basedir": "^5.1.0"
       },
       "bin": {
-        "amp": "dist/amp.js"
+        "amp": "dist/main.js"
       },
       "engines": {
         "node": ">=18"
diff --git a/pkgs/by-name/am/amp-cli/package.nix b/pkgs/by-name/am/amp-cli/package.nix
index b996cab50b1e..2cd9ba71ddf7 100644
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@@ -9,11 +9,11 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1750924878-gfee7d7";
+  version = "0.0.1752566512-ga67426";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-scp4Nw6fwn8uB5oLPg6eWkT7+YGFV/B5VlQbbFimsLg=";
+    hash = "sha256-TgSqpczEFIW6doWzgfPg2y+o+64ntPMbTJ0FVzCGNOg=";
   };
 
   postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
     chmod +x bin/amp-wrapper.js
   '';
 
-  npmDepsHash = "sha256-INH8Pulds05pZm6DeaFYfZR+1derav2ZjQC6aPx+8qA=";
+  npmDepsHash = "sha256-avgj8q1pyepWSt4RFK1+9Fqwtc7Z1Voz2RUYKuViZA0=";
 
   propagatedBuildInputs = [
     ripgrep

From e7036499c61eb30e4c26d47facd7dd3847043984 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 09:55:18 +0000
Subject: [PATCH 075/190] zsh-abbr: 6.2.1 -> 6.3.2

---
 pkgs/by-name/zs/zsh-abbr/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/zs/zsh-abbr/package.nix b/pkgs/by-name/zs/zsh-abbr/package.nix
index f19a155067a8..95c215a88092 100644
--- a/pkgs/by-name/zs/zsh-abbr/package.nix
+++ b/pkgs/by-name/zs/zsh-abbr/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "zsh-abbr";
-  version = "6.2.1";
+  version = "6.3.2";
 
   src = fetchFromGitHub {
     owner = "olets";
     repo = "zsh-abbr";
     tag = "v${version}";
-    hash = "sha256-idwCtAwXa7qNZlKE8KdS9cUgEOCSdf6tec0YuXINcl8=";
+    hash = "sha256-XSmDcAMovQ4sDLp6e1PeRlvU7bY6rl7wbCh66VsUBD0=";
     fetchSubmodules = true;
   };
 

From 0fd5640602b40f741d03ea71995b02d1b525fb05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 15 Jul 2025 13:24:46 +0200
Subject: [PATCH 076/190] gitea: 1.24.2 -> 1.24.3

Diff: https://github.com/go-gitea/gitea/compare/refs/tags/v1.24.2...refs/tags/v1.24.3
---
 pkgs/by-name/gi/gitea/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gi/gitea/package.nix b/pkgs/by-name/gi/gitea/package.nix
index a4237f3685f2..e49fd9044f34 100644
--- a/pkgs/by-name/gi/gitea/package.nix
+++ b/pkgs/by-name/gi/gitea/package.nix
@@ -35,13 +35,13 @@ let
 in
 buildGoModule rec {
   pname = "gitea";
-  version = "1.24.2";
+  version = "1.24.3";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     tag = "v${gitea.version}";
-    hash = "sha256-NQSilSF/W69j1qEYYmlQfu2T0OefB+8yf9rCHAL8a6c=";
+    hash = "sha256-z9GaUkBh/hfDKkygi/1U0tK725mj39eBR906QKn3MWU=";
   };
 
   proxyVendor = true;

From 2867b465b57a40ab34e146519828e53eb698687e Mon Sep 17 00:00:00 2001
From: Florian Brandes <florian.brandes@posteo.de>
Date: Tue, 15 Jul 2025 14:11:04 +0200
Subject: [PATCH 077/190] zabbix: fix build for zabbix74

add conditional for pcre2 starting at version 7.4

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
---
 pkgs/servers/monitoring/zabbix/agent.nix  | 3 ++-
 pkgs/servers/monitoring/zabbix/agent2.nix | 3 ++-
 pkgs/servers/monitoring/zabbix/proxy.nix  | 3 ++-
 pkgs/servers/monitoring/zabbix/server.nix | 3 ++-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/monitoring/zabbix/agent.nix b/pkgs/servers/monitoring/zabbix/agent.nix
index ae6e5618167d..aeae46821891 100644
--- a/pkgs/servers/monitoring/zabbix/agent.nix
+++ b/pkgs/servers/monitoring/zabbix/agent.nix
@@ -6,6 +6,7 @@
   libiconv,
   openssl,
   pcre,
+  pcre2,
 }:
 
 import ./versions.nix (
@@ -23,7 +24,7 @@ import ./versions.nix (
     buildInputs = [
       libiconv
       openssl
-      pcre
+      (if (lib.versions.major version >= "7" && lib.versions.minor version >= "4") then pcre2 else pcre)
     ];
 
     configureFlags = [
diff --git a/pkgs/servers/monitoring/zabbix/agent2.nix b/pkgs/servers/monitoring/zabbix/agent2.nix
index e4e009cc64a7..1bd5bae89d3a 100644
--- a/pkgs/servers/monitoring/zabbix/agent2.nix
+++ b/pkgs/servers/monitoring/zabbix/agent2.nix
@@ -7,6 +7,7 @@
   libiconv,
   openssl,
   pcre,
+  pcre2,
   zlib,
 }:
 
@@ -36,7 +37,7 @@ import ./versions.nix (
     buildInputs = [
       libiconv
       openssl
-      pcre
+      (if (lib.versions.major version >= "7" && lib.versions.minor version >= "4") then pcre2 else pcre)
       zlib
     ];
 
diff --git a/pkgs/servers/monitoring/zabbix/proxy.nix b/pkgs/servers/monitoring/zabbix/proxy.nix
index 65cc2c024e1a..cd66c2997046 100644
--- a/pkgs/servers/monitoring/zabbix/proxy.nix
+++ b/pkgs/servers/monitoring/zabbix/proxy.nix
@@ -8,6 +8,7 @@
   libiconv,
   openssl,
   pcre,
+  pcre2,
   zlib,
   buildPackages,
   odbcSupport ? true,
@@ -61,7 +62,7 @@ import ./versions.nix (
         libevent
         libiconv
         openssl
-        pcre
+        (if (lib.versions.major version >= "7" && lib.versions.minor version >= "4") then pcre2 else pcre)
         zlib
       ]
       ++ optional odbcSupport unixODBC
diff --git a/pkgs/servers/monitoring/zabbix/server.nix b/pkgs/servers/monitoring/zabbix/server.nix
index 54968b0bd4ff..a45d0a52eda9 100644
--- a/pkgs/servers/monitoring/zabbix/server.nix
+++ b/pkgs/servers/monitoring/zabbix/server.nix
@@ -10,6 +10,7 @@
   libxml2,
   openssl,
   pcre,
+  pcre2,
   zlib,
   jabberSupport ? true,
   iksemel,
@@ -58,7 +59,7 @@ import ./versions.nix (
         libiconv
         libxml2
         openssl
-        pcre
+        (if (lib.versions.major version >= "7" && lib.versions.minor version >= "4") then pcre2 else pcre)
         zlib
       ]
       ++ optional odbcSupport unixODBC

From 2433050fb7e8130a9b421f09cad2daca19414fe1 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 13 Jul 2025 21:11:43 +0200
Subject: [PATCH 078/190] ci/github-script: use real @actions/core

This allows building markdown summaries, which is hard to mock.
---
 ci/github-script/.npmrc            |  1 +
 ci/github-script/package-lock.json |  1 +
 ci/github-script/package.json      |  1 +
 ci/github-script/run               | 15 +++------------
 4 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/ci/github-script/.npmrc b/ci/github-script/.npmrc
index f91a336f47b6..fb41d64f4679 100644
--- a/ci/github-script/.npmrc
+++ b/ci/github-script/.npmrc
@@ -1 +1,2 @@
 package-lock-only = true
+save-exact = true
diff --git a/ci/github-script/package-lock.json b/ci/github-script/package-lock.json
index 538083dcea93..0dcc9b68e259 100644
--- a/ci/github-script/package-lock.json
+++ b/ci/github-script/package-lock.json
@@ -6,6 +6,7 @@
     "": {
       "dependencies": {
         "@actions/artifact": "2.3.2",
+        "@actions/core": "1.11.1",
         "@actions/github": "6.0.1",
         "bottleneck": "2.19.5",
         "commander": "14.0.0"
diff --git a/ci/github-script/package.json b/ci/github-script/package.json
index 4671dd41f0cd..860bb09cdd95 100644
--- a/ci/github-script/package.json
+++ b/ci/github-script/package.json
@@ -2,6 +2,7 @@
   "private": true,
   "dependencies": {
     "@actions/artifact": "2.3.2",
+    "@actions/core": "1.11.1",
     "@actions/github": "6.0.1",
     "bottleneck": "2.19.5",
     "commander": "14.0.0"
diff --git a/ci/github-script/run b/ci/github-script/run
index cbf3ea9315e0..03309352aeee 100755
--- a/ci/github-script/run
+++ b/ci/github-script/run
@@ -4,6 +4,7 @@ import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { program } from 'commander'
+import * as core from '@actions/core'
 import { getOctokit } from '@actions/github'
 
 async function run(action, owner, repo, pull_number, dry) {
@@ -22,6 +23,7 @@ async function run(action, owner, repo, pull_number, dry) {
   const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
   try {
     process.env.GITHUB_WORKSPACE = tmp
+    process.env['INPUT_GITHUB-TOKEN'] = token
     process.chdir(tmp)
 
     await action({
@@ -33,18 +35,7 @@ async function run(action, owner, repo, pull_number, dry) {
           repo,
         },
       },
-      core: {
-        getInput() {
-          return token
-        },
-        error: console.error,
-        info: console.log,
-        notice: console.log,
-        setFailed(msg) {
-          console.error(msg)
-          process.exitCode = 1
-        },
-      },
+      core,
       dry,
     })
   } finally {

From e24f68dedda761bbb24b4650c778fd76b6b652af Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Tue, 15 Jul 2025 12:49:30 +0200
Subject: [PATCH 079/190] pkgsStatic.difftastic: fix build

---
 pkgs/by-name/di/difftastic/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/di/difftastic/package.nix b/pkgs/by-name/di/difftastic/package.nix
index 5f51ce0129d0..fc0d2406a5a1 100644
--- a/pkgs/by-name/di/difftastic/package.nix
+++ b/pkgs/by-name/di/difftastic/package.nix
@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  stdenv,
   versionCheckHook,
   nix-update-script,
 }:
@@ -20,6 +21,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   useFetchCargoVendor = true;
   cargoHash = "sha256-1u3oUbqhwHXD90ld70pjK2XPJe5hpUbJtU78QpIjAE8=";
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isStatic { RUSTFLAGS = "-C relocation-model=static"; };
+
   # skip flaky tests
   checkFlags = [ "--skip=options::tests::test_detect_display_width" ];
 

From e6aa81233242767159d32ed93c4c6d4d32be38cd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 14:55:48 +0000
Subject: [PATCH 080/190] python3Packages.tree-sitter-language-pack: 0.8.0 ->
 0.9.0

---
 .../python-modules/tree-sitter-language-pack/default.nix      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tree-sitter-language-pack/default.nix b/pkgs/development/python-modules/tree-sitter-language-pack/default.nix
index be1a41e8b307..5886de216ee8 100644
--- a/pkgs/development/python-modules/tree-sitter-language-pack/default.nix
+++ b/pkgs/development/python-modules/tree-sitter-language-pack/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "tree-sitter-language-pack";
-  version = "0.8.0";
+  version = "0.9.0";
   pyproject = true;
 
   # Using the GitHub sources necessitates fetching the treesitter grammar parsers by using a vendored script.
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "tree_sitter_language_pack";
     inherit version;
-    hash = "sha256-Sar+Mi61nvTURXV3IQ+yDBjFU1saQrjnU6ppntO/nu0=";
+    hash = "sha256-kA6zvYLBvPXPIO2FKxtv3H6uieQKhg+l4iGnlmh8NZo=";
   };
 
   # Upstream bumped the setuptools and typing-extensions dependencies, but we can still use older versions

From eed9bd2ce2f9f3017f1a9ef3e0f9f16eb4e44ce7 Mon Sep 17 00:00:00 2001
From: Antonio <vozaanthony@gmail.com>
Date: Tue, 15 Jul 2025 12:16:47 +0200
Subject: [PATCH 081/190] pdfid: 0.2.8 -> 0.2.10

---
 pkgs/by-name/pd/pdfid/package.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/pd/pdfid/package.nix b/pkgs/by-name/pd/pdfid/package.nix
index 321f7ad9f076..18dfd9bfe582 100644
--- a/pkgs/by-name/pd/pdfid/package.nix
+++ b/pkgs/by-name/pd/pdfid/package.nix
@@ -8,12 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pdfid";
-  version = "0.2.8";
+  version = "0.2.10";
   format = "other";
 
   src = fetchzip {
-    url = "https://didierstevens.com/files/software/pdfid_v0_2_8.zip";
-    hash = "sha256-ZLyhBMF2KMX0c1oCvuSCjEjHTnm2gFhJtasaTD9Q1BI=";
+    url = "https://didierstevens.com/files/software/pdfid_v${
+      builtins.replaceStrings [ "." ] [ "_" ] version
+    }.zip";
+    hash = "sha256-GxQOwIwCVaKEruFO+kxXciOiFcXtBO0vvCwb6683lGU=";
     stripRoot = false;
   };
 
@@ -25,7 +27,8 @@ python3Packages.buildPythonApplication rec {
     runHook preInstall
     mkdir -p $out/{bin,share/pdfid}
     cp -a * $out/share/pdfid/
-    makeBinaryWrapper ${lib.getExe python3} $out/bin/${meta.mainProgram} \
+    makeWrapper ${lib.getExe python3} $out/bin/pdfid \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
       --add-flags "$out/share/pdfid/pdfid.py"
     runHook postInstall
   '';

From 17bb1b74d52ec6353e928dc614aa919f72d3ccdf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 16:50:55 +0000
Subject: [PATCH 082/190] python3Packages.nicegui: 2.20.0 -> 2.21.1

---
 pkgs/development/python-modules/nicegui/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/nicegui/default.nix b/pkgs/development/python-modules/nicegui/default.nix
index 9b5605bd6ed0..d7fd18e67dac 100644
--- a/pkgs/development/python-modules/nicegui/default.nix
+++ b/pkgs/development/python-modules/nicegui/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "nicegui";
-  version = "2.20.0";
+  version = "2.21.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zauberzeug";
     repo = "nicegui";
     tag = "v${version}";
-    hash = "sha256-XCOFRfG+EkgSKz5Z7Ds9F2Vwl1+7GH7ojxuE6ruvO3Y=";
+    hash = "sha256-pQh3kFFlqfktpW5UtX7smb7qXubX5bMeM46hX8jhtTA=";
   };
 
   pythonRelaxDeps = [ "requests" ];

From 780511f79b9af53c8915e19f0c362dc83755b1ff Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 18:05:26 +0000
Subject: [PATCH 083/190] awscli2: 2.27.49 -> 2.27.50

---
 pkgs/by-name/aw/awscli2/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/aw/awscli2/package.nix b/pkgs/by-name/aw/awscli2/package.nix
index 18473f29f191..dcf23d26e92d 100644
--- a/pkgs/by-name/aw/awscli2/package.nix
+++ b/pkgs/by-name/aw/awscli2/package.nix
@@ -65,14 +65,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.27.49"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.27.50"; # N.B: if you change this, check if overrides are still up-to-date
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     tag = version;
-    hash = "sha256-fg4UMAsylJJ0Xy8s84Qr7OdiFrzMIP9RsAH+pYDThrU=";
+    hash = "sha256-ITiZ144YFhwuRcfhulLF0jxpp1OgznEE8frx4Yn4V+A=";
   };
 
   postPatch = ''

From 83af4a9aed805366fc92a249eaf6d8e6617733d5 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 14 Jul 2025 00:58:45 +0200
Subject: [PATCH 084/190] nixos/postsrsd: migrate to rfc42 settings

Allow a freeform configuration approach to satisfy different
configuration complexities.

Remove confinement options and make its hardening options more explicit
and removed the deprecated PermissionStartOnly= option.
---
 nixos/modules/services/mail/postsrsd.nix | 221 ++++++++++++++++++-----
 1 file changed, 173 insertions(+), 48 deletions(-)

diff --git a/nixos/modules/services/mail/postsrsd.nix b/nixos/modules/services/mail/postsrsd.nix
index bc91edbbe000..2ff28f96d97b 100644
--- a/nixos/modules/services/mail/postsrsd.nix
+++ b/nixos/modules/services/mail/postsrsd.nix
@@ -7,32 +7,59 @@
 let
 
   cfg = config.services.postsrsd;
-  runtimeDirectoryName = "postsrsd";
-  runtimeDirectory = "/run/${runtimeDirectoryName}";
-  # TODO: follow RFC 42, but we need a libconfuse format first:
-  #       https://github.com/NixOS/nixpkgs/issues/401565
-  # Arrays in `libconfuse` look like this: {"Life", "Universe", "Everything"}
-  # See https://www.nongnu.org/confuse/tutorial-html/ar01s03.html.
-  #
-  # Note: We're using `builtins.toJSON` to escape strings, but JSON strings
-  # don't have exactly the same semantics as libconfuse strings. For example,
-  # "${F}" gets treated as an env var reference, see above issue for details.
-  libconfuseDomains = "{ " + lib.concatMapStringsSep ", " builtins.toJSON cfg.domains + " }";
-  configFile = pkgs.writeText "postsrsd.conf" ''
-    secrets-file = "''${CREDENTIALS_DIRECTORY}/secrets-file"
-    domains = ${libconfuseDomains}
-    separator = "${cfg.separator}"
-    socketmap = "unix:${cfg.socketPath}"
 
-    # Disable postsrsd's jailing in favor of confinement with systemd.
-    unprivileged-user = ""
-    chroot-dir = ""
-  '';
+  inherit (lib)
+    concatMapStringsSep
+    concatMapAttrsStringSep
+    isBool
+    isFloat
+    isInt
+    isPath
+    isString
+    isList
+    mkRemovedOptionModule
+    mkRenamedOptionModule
+    ;
 
+  # This is a implementation of a simple libconfuse config renderer sufficient
+  # for the postsrsd configuration file complexity.
+  # TODO: Replace with pkgs.formats.libconfuse, once implemented (https://github.com/NixOS/nixpkgs/issues/401565)
+  renderValue =
+    value:
+    if isBool value then
+      if value then "true" else "false"
+    else if isString value || isPath value then
+      builtins.toJSON value # for escaping
+    else if isInt value || isFloat value then
+      toString value
+    else if isList value then
+      "{${concatMapStringsSep "," renderValue value}}"
+    else
+      throw "postsrsd: unsupported value type in settings option";
+
+  renderAttr =
+    attrs: concatMapAttrsStringSep "\n" (name: value: "${name} = ${renderValue value}") attrs;
+
+  configFile = pkgs.writeText "postsrsd.conf" (
+    renderAttr (lib.filterAttrsRecursive (_: v: v != null) cfg.settings)
+  );
 in
 {
   imports =
-    map
+    [
+      (mkRemovedOptionModule [ "services" "postsrsd" "socketPath" ] ''
+        Configure/reference `services.postsrsd.settings.socketmap` instead. Note that its now required to start with the `inet:` or `unix:` prefix.
+      '')
+      (mkRenamedOptionModule
+        [ "services" "postsrsd" "domains" ]
+        [ "services" "postsrsd" "settings" "domains" ]
+      )
+      (mkRenamedOptionModule
+        [ "services" "postsrsd" "separator" ]
+        [ "services" "postsrsd" "settings" "separator" ]
+      )
+    ]
+    ++ map
       (
         name:
         lib.mkRemovedOptionModule [ "services" "postsrsd" name ] ''
@@ -62,24 +89,125 @@ in
       secretsFile = lib.mkOption {
         type = lib.types.path;
         default = "/var/lib/postsrsd/postsrsd.secret";
-        description = "Secret keys used for signing and verification";
+        description = ''
+          Secret keys used for signing and verification.
+
+          ::: {.note}
+          The secret will be generated, if it does not exist at the given path.
+          :::
+        '';
       };
 
-      domains = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        description = "Domain names for rewrite";
-        default = [ config.networking.hostName ];
-        defaultText = lib.literalExpression "[ config.networking.hostName ]";
-      };
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType =
+            with lib.types;
+            attrsOf (oneOf [
+              bool
+              float
+              int
+              path
+              str
+              (listOf str)
+            ]);
 
-      separator = lib.mkOption {
-        type = lib.types.enum [
-          "-"
-          "="
-          "+"
-        ];
-        default = "=";
-        description = "First separator character in generated addresses";
+          options = {
+            domains = lib.mkOption {
+              type = with lib.types; listOf str;
+              default = [ ];
+              example = [ "example.com" ];
+              description = ''
+                List of local domains, that do not require rewriting.
+              '';
+            };
+
+            secrets-file = lib.mkOption {
+              type = lib.types.str;
+              default = "\${CREDENTIALS_DIRECTORY}/secrets-file";
+              readOnly = true;
+              description = ''
+                Path to the file containing the secret keys.
+
+                ::: {.note}
+                Secrets are passed using `LoadCredential=` on the systemd unit,
+                so this options is read-only.
+
+                Configure {option}`services.postsrsd.secretsFile` instead.
+              '';
+            };
+
+            separator = lib.mkOption {
+              type = lib.types.enum [
+                "-"
+                "="
+                "+"
+              ];
+              default = "=";
+              description = ''
+                SRS tag separator used in generated sender addresses.
+
+                Unless you have a very good reason, you should leave this
+                setting at its default.
+              '';
+            };
+
+            srs-domain = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              example = "srs.example.com";
+              description = ''
+                Dedicated mail domain used for ephemeral SRS envelope addresses.
+
+                Recommended to configure, when hosting multiple unrelated mail
+                domains (e.g. for different customers), to prevent privacy
+                issues.
+
+                Set to `null` to not configure any `srs-domain`.
+              '';
+            };
+
+            socketmap = lib.mkOption {
+              type = lib.types.strMatching "^(unix|inet):.+";
+              default = "unix:/run/postsrsd/socket";
+              example = "inet:localhost:10003";
+              description = ''
+                Listener configuration in socket map format native to Postfix configuration.
+              '';
+            };
+
+            chroot-dir = lib.mkOption {
+              type = lib.types.str;
+              default = "";
+              readOnly = true;
+              description = ''
+                Path to chroot into at runtime as an additional layer of protection.
+
+                ::: {.note}
+                We confine the runtime environment through systemd hardening instead, so this option is read-only.
+                :::
+              '';
+            };
+
+            unprivileged-user = lib.mkOption {
+              type = lib.types.str;
+              default = "";
+              readOnly = true;
+              description = ''
+                Unprivileged user to drop privileges to.
+
+                ::: {.note}
+                Our systemd unit never runs postsrsd as a privileged process, so this option is read-only.
+                :::
+              '';
+            };
+          };
+        };
+        default = { };
+        description = ''
+          Configuration options for the postsrsd.conf file.
+
+          See the [example configuration](https://github.com/roehling/postsrsd/blob/main/doc/postsrsd.conf) for possible values.
+        '';
       };
 
       user = lib.mkOption {
@@ -93,15 +221,6 @@ in
         default = "postsrsd";
         description = "Group for the daemon";
       };
-
-      socketPath = lib.mkOption {
-        type = lib.types.path;
-        default = "${runtimeDirectory}/socket";
-        readOnly = true;
-        description = ''
-          Path to the Unix socket for connecting to postsrsd.
-          Read-only, intended for usage when integrating postsrsd into other NixOS config.'';
-      };
     };
   };
 
@@ -143,15 +262,21 @@ in
       before = [ "postfix.service" ];
       wantedBy = [ "multi-user.target" ];
       requires = [ "postsrsd-generate-secrets.service" ];
-      confinement.enable = true;
 
       serviceConfig = {
         ExecStart = "${lib.getExe pkgs.postsrsd} -C ${configFile}";
         User = cfg.user;
         Group = cfg.group;
-        PermissionsStartOnly = true;
-        RuntimeDirectory = runtimeDirectoryName;
+        RuntimeDirectory = "postsrsd";
         LoadCredential = "secrets-file:${cfg.secretsFile}";
+
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
       };
     };
   };

From 819c34cb7f485c4f813e0dd87f6ba842970c864b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 14 Jul 2025 01:21:08 +0200
Subject: [PATCH 085/190] nixos/postsrsd: harden and modernize systemd unit

This replaces the previous confinement settings with a more complete and
context-sensitive hardening setup.

Also exposes the current config at /etc/postsrsd.conf, which makes it
easily inspectable.
---
 nixos/modules/services/mail/postsrsd.nix | 93 +++++++++++++++++++++++-
 1 file changed, 92 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/mail/postsrsd.nix b/nixos/modules/services/mail/postsrsd.nix
index 2ff28f96d97b..34e7b15e2d17 100644
--- a/nixos/modules/services/mail/postsrsd.nix
+++ b/nixos/modules/services/mail/postsrsd.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  utils,
   ...
 }:
 let
@@ -253,6 +254,8 @@ in
       };
     };
 
+    environment.etc."postsrsd.conf".source = configFile;
+
     systemd.services.postsrsd = {
       description = "PostSRSd SRS rewriting server";
       after = [
@@ -262,21 +265,109 @@ in
       before = [ "postfix.service" ];
       wantedBy = [ "multi-user.target" ];
       requires = [ "postsrsd-generate-secrets.service" ];
+      restartTriggers = [ configFile ];
 
       serviceConfig = {
-        ExecStart = "${lib.getExe pkgs.postsrsd} -C ${configFile}";
+        ExecStart = toString [
+          (lib.getExe pkgs.postsrsd)
+          "-C"
+          "/etc/postsrsd.conf"
+        ];
         User = cfg.user;
         Group = cfg.group;
         RuntimeDirectory = "postsrsd";
+        RuntimeDirectoryMode = "0750";
         LoadCredential = "secrets-file:${cfg.secretsFile}";
 
+        CapabilityBoundingSet = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateMounts = true;
+        PrivateNetwork = lib.hasPrefix "unix:" cfg.settings.socketmap;
         PrivateTmp = true;
         PrivateUsers = true;
         ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        RemoveIPC = true;
+        RestrictAddressFamilies =
+          if lib.hasPrefix "unix:" cfg.settings.socketmap then
+            [ "AF_UNIX" ]
+          else
+            [
+              "AF_INET"
+              "AF_INET6"
+            ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @resources"
+        ];
+        UMask = "0027";
+        before = [ "postfix.service" ];
+        wantedBy = [ "multi-user.target" ];
+        requires = [ "postsrsd-generate-secrets.service" ];
+        restartTriggers = [ configFile ];
+        serviceConfig = {
+          ExecStart = utils.escapeSystemdExecArgs [
+            (lib.getExe cfg.package)
+            "-C"
+            "/etc/postsrsd.conf"
+          ];
+          User = cfg.user;
+          Group = cfg.group;
+          RuntimeDirectory = "postsrsd";
+          RuntimeDirectoryMode = "0750";
+          LoadCredential = "secrets-file:${cfg.secretsFile}";
+
+          CapabilityBoundingSet = [ "" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          PrivateNetwork = lib.hasPrefix "unix:" cfg.settings.socketmap;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = "strict";
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          RemoveIPC = true;
+          RestrictAddressFamilies =
+            if lib.hasPrefix "unix:" cfg.settings.socketmap then
+              [ "AF_UNIX" ]
+            else
+              [
+                "AF_INET"
+                "AF_INET6"
+              ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged @resources"
+          ];
+          UMask = "0027";
+        };
       };
     };
   };

From 9783bde2f4bfa5bcf65423925520118c38e08300 Mon Sep 17 00:00:00 2001
From: matthewcroughan <matt@croughan.sh>
Date: Tue, 15 Jul 2025 19:16:41 +0100
Subject: [PATCH 086/190] nixos/sheep-net: init

---
 nixos/modules/hardware/sheep-net.nix | 35 ++++++++++++++++++++++++++++
 nixos/modules/module-list.nix        |  1 +
 2 files changed, 36 insertions(+)
 create mode 100644 nixos/modules/hardware/sheep-net.nix

diff --git a/nixos/modules/hardware/sheep-net.nix b/nixos/modules/hardware/sheep-net.nix
new file mode 100644
index 000000000000..3df6f5840efa
--- /dev/null
+++ b/nixos/modules/hardware/sheep-net.nix
@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.hardware.sheep_net;
+in
+{
+  options.hardware.sheep_net = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enables sheep_net udev rules, ensures 'sheep_net' group exists, and adds
+        sheep-net to boot.kernelModules and boot.extraModulePackages
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services.udev.extraRules = ''
+      KERNEL=="sheep_net", GROUP="sheep_net"
+    '';
+    boot.kernelModules = [
+      "sheep_net"
+    ];
+    boot.extraModulePackages = [
+      config.boot.kernelPackages.sheep-net
+    ];
+    users.groups.sheep_net = { };
+  };
+  meta.maintainers = with lib.maintainers; [ matthewcroughan ];
+}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d0831c02e6d7..250313621698 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -103,6 +103,7 @@
   ./hardware/sata.nix
   ./hardware/sensor/hddtemp.nix
   ./hardware/sensor/iio.nix
+  ./hardware/sheep-net.nix
   ./hardware/steam-hardware.nix
   ./hardware/system-76.nix
   ./hardware/tuxedo-drivers.nix

From 338121d8754466a9c69a878b9d07e77edc9eab2a Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Tue, 15 Jul 2025 10:49:02 -0700
Subject: [PATCH 087/190] tor: sandbox is no longer broken on aarch64-linux

This was fixed in https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/574 by @delroth.
---
 pkgs/by-name/to/tor/package.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/to/tor/package.nix b/pkgs/by-name/to/tor/package.nix
index 006c0f204029..c4df65ea12d6 100644
--- a/pkgs/by-name/to/tor/package.nix
+++ b/pkgs/by-name/to/tor/package.nix
@@ -90,13 +90,8 @@ stdenv.mkDerivation (finalAttrs: {
     # https://gitlab.torproject.org/tpo/onion-services/onion-support/-/wikis/Documentation/PoW-FAQ#compiling-c-tor-with-the-pow-defense
     [ "--enable-gpl" ]
     ++
-      # cross compiles correctly but needs the following
-      lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--disable-tool-name-check" ]
-    ++
-      # sandbox is broken on aarch64-linux https://gitlab.torproject.org/tpo/core/tor/-/issues/40599
-      lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
-        "--disable-seccomp"
-      ];
+    # cross compiles correctly but needs the following
+    lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--disable-tool-name-check" ];
 
   NIX_CFLAGS_LINK = lib.optionalString stdenv.cc.isGNU "-lgcc_s";
 

From 3cf7dc230744f7667d2ec1a2c951d8e610172ba9 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Tue, 15 Jul 2025 11:24:15 -0700
Subject: [PATCH 088/190] tor.updateScript: use callPackage

---
 pkgs/by-name/to/tor/package.nix | 29 ++++-------------------------
 1 file changed, 4 insertions(+), 25 deletions(-)

diff --git a/pkgs/by-name/to/tor/package.nix b/pkgs/by-name/to/tor/package.nix
index c4df65ea12d6..7c78a5bee9fd 100644
--- a/pkgs/by-name/to/tor/package.nix
+++ b/pkgs/by-name/to/tor/package.nix
@@ -1,5 +1,8 @@
 {
   lib,
+  callPackage,
+  coreutils,
+  gnugrep,
   stdenv,
   fetchurl,
   pkg-config,
@@ -16,17 +19,6 @@
   nixosTests,
   writeShellScript,
   versionCheckHook,
-
-  # for update.nix
-  writeScript,
-  common-updater-scripts,
-  bash,
-  coreutils,
-  curl,
-  gnugrep,
-  gnupg,
-  gnused,
-  nix,
 }:
 
 let
@@ -121,20 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     tests.tor = nixosTests.tor;
-    updateScript = import ./update.nix {
-      inherit lib;
-      inherit
-        writeScript
-        common-updater-scripts
-        bash
-        coreutils
-        curl
-        gnupg
-        gnugrep
-        gnused
-        nix
-        ;
-    };
+    updateScript = callPackage ./update.nix { };
   };
 
   meta = {

From 3a501b6a430182bc2cdd289b4633fb54ba9cb2f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=99=BE=E5=9C=B0=20=E5=B8=8C=E7=95=99=E8=80=B6?=
 <65301509+KiruyaMomochi@users.noreply.github.com>
Date: Wed, 16 Jul 2025 02:24:25 +0800
Subject: [PATCH 089/190] python3Packages.aider-chat: disable additional tests
 that require network access

---
 pkgs/development/python-modules/aider-chat/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/aider-chat/default.nix b/pkgs/development/python-modules/aider-chat/default.nix
index 4bcd0efece97..11cbaaa39908 100644
--- a/pkgs/development/python-modules/aider-chat/default.nix
+++ b/pkgs/development/python-modules/aider-chat/default.nix
@@ -264,6 +264,7 @@ let
     disabledTestPaths = [
       # Tests require network access
       "tests/scrape/test_scrape.py"
+      "tests/basic/test_repomap.py"
       # Expected 'mock' to have been called once
       "tests/help/test_help.py"
     ];
@@ -273,6 +274,7 @@ let
         # Tests require network
         "test_urls"
         "test_get_commit_message_with_custom_prompt"
+        "test_cmd_tokens_output"
         # FileNotFoundError
         "test_get_commit_message"
         # Expected 'launch_gui' to have been called once

From 9a9073fc8971a700fb08bb105adc2100fd3fc26f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 14 Jul 2025 01:49:02 +0200
Subject: [PATCH 090/190] nixos/postsrsd: integrate with postfix by default

---
 .../manual/release-notes/rl-2511.section.md   |   2 +
 nixos/modules/services/mail/postsrsd.nix      | 150 +++++++-----------
 2 files changed, 63 insertions(+), 89 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 4b0a2c4395d1..be57fec927a0 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -120,6 +120,8 @@
 
 - `services.ntpd-rs` now performs configuration validation.
 
+- `services.postsrsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.postsrsd.configurePostfix](#opt-services.postsrsd.configurePostfix) option.
+
 - `services.monero` now includes the `environmentFile` option for adding secrets to the Monero daemon config.
 
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
diff --git a/nixos/modules/services/mail/postsrsd.nix b/nixos/modules/services/mail/postsrsd.nix
index 34e7b15e2d17..f790403864f5 100644
--- a/nixos/modules/services/mail/postsrsd.nix
+++ b/nixos/modules/services/mail/postsrsd.nix
@@ -211,6 +211,14 @@ in
         '';
       };
 
+      configurePostfix = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to configure the required settings to use postsrsd in the local Postfix instance.
+        '';
+      };
+
       user = lib.mkOption {
         type = lib.types.str;
         default = "postsrsd";
@@ -225,103 +233,67 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable {
-    users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
-      postsrsd = {
-        group = cfg.group;
-        uid = config.ids.uids.postsrsd;
-      };
-    };
-
-    users.groups = lib.optionalAttrs (cfg.group == "postsrsd") {
-      postsrsd.gid = config.ids.gids.postsrsd;
-    };
-
-    systemd.services.postsrsd-generate-secrets = {
-      path = [ pkgs.coreutils ];
-      script = ''
-        if [ -e "${cfg.secretsFile}" ]; then
-          echo "Secrets file exists. Nothing to do!"
-        else
-          echo "WARNING: secrets file not found, autogenerating!"
-          DIR="$(dirname "${cfg.secretsFile}")"
-          install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
-          install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
-        fi
-      '';
-      serviceConfig = {
-        Type = "oneshot";
-      };
-    };
-
-    environment.etc."postsrsd.conf".source = configFile;
-
-    systemd.services.postsrsd = {
-      description = "PostSRSd SRS rewriting server";
-      after = [
-        "network.target"
-        "postsrsd-generate-secrets.service"
-      ];
-      before = [ "postfix.service" ];
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "postsrsd-generate-secrets.service" ];
-      restartTriggers = [ configFile ];
-
-      serviceConfig = {
-        ExecStart = toString [
-          (lib.getExe pkgs.postsrsd)
-          "-C"
-          "/etc/postsrsd.conf"
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && cfg.configurePostfix && config.services.postfix.enable) {
+      services.postfix.config = {
+        # https://github.com/roehling/postsrsd#configuration
+        sender_canonical_maps = "socketmap:${cfg.settings.socketmap}:forward";
+        sender_canonical_classes = "envelope_sender";
+        recipient_canonical_maps = "socketmap:${cfg.settings.socketmap}:reverse";
+        recipient_canonical_classes = [
+          "envelope_recipient"
+          "header_recipient"
         ];
-        User = cfg.user;
-        Group = cfg.group;
-        RuntimeDirectory = "postsrsd";
-        RuntimeDirectoryMode = "0750";
-        LoadCredential = "secrets-file:${cfg.secretsFile}";
+      };
 
-        CapabilityBoundingSet = [ "" ];
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
-        PrivateDevices = true;
-        PrivateMounts = true;
-        PrivateNetwork = lib.hasPrefix "unix:" cfg.settings.socketmap;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectSystem = "strict";
-        ProtectProc = "invisible";
-        ProcSubset = "pid";
-        RemoveIPC = true;
-        RestrictAddressFamilies =
-          if lib.hasPrefix "unix:" cfg.settings.socketmap then
-            [ "AF_UNIX" ]
+      users.users.postfix.extraGroups = [ cfg.group ];
+    })
+
+    (lib.mkIf cfg.enable {
+      users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
+        postsrsd = {
+          group = cfg.group;
+          uid = config.ids.uids.postsrsd;
+        };
+      };
+
+      users.groups = lib.optionalAttrs (cfg.group == "postsrsd") {
+        postsrsd.gid = config.ids.gids.postsrsd;
+      };
+
+      systemd.services.postsrsd-generate-secrets = {
+        path = [ pkgs.coreutils ];
+        script = ''
+          if [ -e "${cfg.secretsFile}" ]; then
+            echo "Secrets file exists. Nothing to do!"
           else
-            [
-              "AF_INET"
-              "AF_INET6"
-            ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged @resources"
+            echo "WARNING: secrets file not found, autogenerating!"
+            DIR="$(dirname "${cfg.secretsFile}")"
+            install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
+            install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
+          fi
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+        };
+      };
+
+      environment.etc."postsrsd.conf".source = configFile;
+
+      systemd.services.postsrsd = {
+        description = "PostSRSd SRS rewriting server";
+        after = [
+          "network.target"
+          "postsrsd-generate-secrets.service"
         ];
-        UMask = "0027";
         before = [ "postfix.service" ];
         wantedBy = [ "multi-user.target" ];
         requires = [ "postsrsd-generate-secrets.service" ];
         restartTriggers = [ configFile ];
+
         serviceConfig = {
           ExecStart = utils.escapeSystemdExecArgs [
-            (lib.getExe cfg.package)
+            (lib.getExe pkgs.postsrsd)
             "-C"
             "/etc/postsrsd.conf"
           ];
@@ -369,6 +341,6 @@ in
           UMask = "0027";
         };
       };
-    };
-  };
+    })
+  ];
 }

From c915f104b0c8f231855a451d71678085ca9eab01 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 15 Jul 2025 00:08:08 +0200
Subject: [PATCH 091/190] nixos/postsrsd: add package option, migrate enable
 option

---
 nixos/modules/services/mail/postsrsd.nix | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/services/mail/postsrsd.nix b/nixos/modules/services/mail/postsrsd.nix
index f790403864f5..b264d17a1911 100644
--- a/nixos/modules/services/mail/postsrsd.nix
+++ b/nixos/modules/services/mail/postsrsd.nix
@@ -18,6 +18,8 @@ let
     isPath
     isString
     isList
+    mkEnableOption
+    mkPackageOption
     mkRemovedOptionModule
     mkRenamedOptionModule
     ;
@@ -81,11 +83,9 @@ in
 
   options = {
     services.postsrsd = {
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to enable the postsrsd SRS server for Postfix.";
-      };
+      enable = mkEnableOption "the postsrsd SRS server for Postfix.";
+
+      package = mkPackageOption pkgs "postsrsd" { };
 
       secretsFile = lib.mkOption {
         type = lib.types.path;
@@ -207,7 +207,7 @@ in
         description = ''
           Configuration options for the postsrsd.conf file.
 
-          See the [example configuration](https://github.com/roehling/postsrsd/blob/main/doc/postsrsd.conf) for possible values.
+          See the [example configuration](https://github.com/roehling/postsrsd/blob/${cfg.package.version}/doc/postsrsd.conf) for possible values.
         '';
       };
 
@@ -293,7 +293,7 @@ in
 
         serviceConfig = {
           ExecStart = utils.escapeSystemdExecArgs [
-            (lib.getExe pkgs.postsrsd)
+            (lib.getExe cfg.package)
             "-C"
             "/etc/postsrsd.conf"
           ];
@@ -343,4 +343,7 @@ in
       };
     })
   ];
+
+  # package version referenced in option documentation
+  meta.buildDocsInSandbox = false;
 }

From f7b948a4da244c8083a725f4e3bcf63b1ff3767a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 18:41:37 +0000
Subject: [PATCH 092/190] pluto: 5.21.8 -> 5.22.0

---
 pkgs/by-name/pl/pluto/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pl/pluto/package.nix b/pkgs/by-name/pl/pluto/package.nix
index 7867e3af7a6b..ce3398e80c31 100644
--- a/pkgs/by-name/pl/pluto/package.nix
+++ b/pkgs/by-name/pl/pluto/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.21.8";
+  version = "5.22.0";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    hash = "sha256-41ud7SRaivhmtBY6ekKIpRijTuLqJ/tLi0dTHDsGAps=";
+    hash = "sha256-fqN6uj/YL/sch16mmB/smJtbzCFlUa9yvCLa8sXJ/u4=";
   };
 
-  vendorHash = "sha256-4kiLgwr8wr/L4anxgZVAE6IFdbBvTgcUlf5KIcT+lRk=";
+  vendorHash = "sha256-59mRVfQ2rduTvIJE1l/j3K+PY3OEMfNpjjYg3hqNUhs=";
 
   ldflags = [
     "-w"

From 1f4c9bb1a68701c50a88069da1d22ff35a6767dd Mon Sep 17 00:00:00 2001
From: Malo Bourgon <mbourgon@gmail.com>
Date: Tue, 15 Jul 2025 11:45:49 -0700
Subject: [PATCH 093/190] python3Packages.posthog: add missing dep
 `typing-extensions`

---
 pkgs/development/python-modules/posthog/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index 8cdbe2b964dc..99103bf5404e 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -15,6 +15,7 @@
   requests,
   setuptools,
   six,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
@@ -38,6 +39,7 @@ buildPythonPackage rec {
     python-dateutil
     requests
     six
+    typing-extensions
   ];
 
   nativeCheckInputs = [

From e5d9fa401609cbacc89440be2847710e4a67930a Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Tue, 15 Jul 2025 21:11:37 +0200
Subject: [PATCH 094/190] chromium,chromedriver: 138.0.7204.100 ->
 138.0.7204.157

https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html

This update includes 6 security fixes. Google is aware that an exploit
for CVE-2025-6558 exists in the wild.

CVEs:
CVE-2025-7656 CVE-2025-6558 CVE-2025-7657
---
 .../networking/browsers/chromium/info.json    | 28 +++++++++----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 41e0be5b3cc3..c07051ce3f4e 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "138.0.7204.100",
+    "version": "138.0.7204.157",
     "chromedriver": {
-      "version": "138.0.7204.101",
-      "hash_darwin": "sha256-ow+R2jcfm5tryB6UfnUNklVfLGc2Tzj2W6Nul6pRglI=",
-      "hash_darwin_aarch64": "sha256-GGcDoSkH8Z4N8yOL77nNMtz3BY4lNwlD10SPhEBRpJI="
+      "version": "138.0.7204.158",
+      "hash_darwin": "sha256-rNd7glDAVNkd4CNn4k3rdpb//yD/ccpebnGhDv1EGb8=",
+      "hash_darwin_aarch64": "sha256-oUMFW09mp2aUgplboMHaKvTVbKtqAy5C0KsA7DXbElc="
     },
     "deps": {
       "depot_tools": {
@@ -20,8 +20,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "5f45b4744e3d5ba82c2ca6d942f1e7a516110752",
-        "hash": "sha256-bI75IXPl6YeauK2oTnUURh1ch1H7KKw/QzKYZ/q6htI=",
+        "rev": "e533e98b1267baa1f1c46d666b120e64e5146aa9",
+        "hash": "sha256-LbZ8/6Lvz1p3ydRL4fXtd7RL426PU3jU01Hx+DP5QYQ=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -96,8 +96,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "df15136b959fc60c230265f75ee7fc75c96e8250",
-        "hash": "sha256-b4bGxhtrsfmVdJo/5QT4/mtQ6hqxmfpmcrieqaT9/ls="
+        "rev": "e1dc0a7ab5d1f1f2edaa7e41447d873895e083bf",
+        "hash": "sha256-tkHvTkqbm4JtWnh41iu0aJ9Jo34hYc7aOKuuMQmST4c="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -131,8 +131,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "86772f20cca54b46f62b65ece1ef61224aef09db",
-        "hash": "sha256-N9DVbQE56WWBmJ/PJlYhU+pr8I+PFf/7FzMLCNqx3hg="
+        "rev": "1fde167ae683982d77b9ca7e1308bf9f498291e8",
+        "hash": "sha256-PbDTKSU19jn2hLDoazceYB/Rd6/qu6npPSrjOdeXFuU="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -246,8 +246,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "a6dbe06dafbad00ef4b0ea139ece1a94a5e2e6d8",
-        "hash": "sha256-XkyJFRxo3ZTBGfKdTwSIo14SLNPQAKQvY4lEX03j6LM="
+        "rev": "4cca0aa00c4915947f1081014d5cfa2e83d357fa",
+        "hash": "sha256-pVNr8NB5U/Uf688oOvPLpu81isCn/WmjJky01A000a4="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -796,8 +796,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "e5b4c78b54e8b033b2701db3df0bf67d3030e4c1",
-        "hash": "sha256-5y/yNZopnwtDrG+BBU6fMEi0yJJoYvsygQR+fl6vS/Y="
+        "rev": "de9d0f8b56ae61896e4d2ac577fc589efb14f87d",
+        "hash": "sha256-/T5fisjmN80bs3PtQrCRfH3Bo9dRSd3f+xpPLDh1RTY="
       }
     }
   },

From ed5d1cd52f28286176253f647b254a8a09b8a094 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 19:11:57 +0000
Subject: [PATCH 095/190] python3Packages.django-types: 0.20.0 -> 0.22.0

---
 pkgs/development/python-modules/django-types/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django-types/default.nix b/pkgs/development/python-modules/django-types/default.nix
index d9f4776bf293..326a0bb2a860 100644
--- a/pkgs/development/python-modules/django-types/default.nix
+++ b/pkgs/development/python-modules/django-types/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "django-types";
-  version = "0.20.0";
+  version = "0.22.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "django_types";
     inherit version;
-    hash = "sha256-TlXSxWFV49addd756x2VqJEwPyrBn8z2/oBW2kKT+uc=";
+    hash = "sha256-TOzJ7uhG5/8qOYvsnf5lQ+du+5IqeljF1gZLyw5qPcU=";
   };
 
   build-system = [ poetry-core ];

From 3ef5cc311650f366cfa59904e5f672621f4d0db1 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Tue, 15 Jul 2025 12:08:00 -0700
Subject: [PATCH 096/190] python3Packages.fabric: fix build

Build from github source, disable two outdated tests
---
 .../python-modules/fabric/default.nix           | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/fabric/default.nix b/pkgs/development/python-modules/fabric/default.nix
index fbf4528d5d39..cc77add86616 100644
--- a/pkgs/development/python-modules/fabric/default.nix
+++ b/pkgs/development/python-modules/fabric/default.nix
@@ -3,14 +3,13 @@
   buildPythonPackage,
   decorator,
   deprecated,
-  fetchPypi,
+  fetchFromGitHub,
   icecream,
   invoke,
   mock,
   paramiko,
   pytest-relaxed,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
 }:
 
@@ -19,11 +18,11 @@ buildPythonPackage rec {
   version = "3.2.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-h4PKQuOwB28IsmkBqsa52bHxnEEAdOesz6uQLBhP9KM=";
+  src = fetchFromGitHub {
+    owner = "fabric";
+    repo = "fabric";
+    tag = version;
+    hash = "sha256-7qC2UuI0RP5xlKIYSz1sLyK/nQYegXOou1mlJYFk7M0=";
   };
 
   build-system = [ setuptools ];
@@ -58,6 +57,10 @@ buildPythonPackage rec {
     "preserves_remote_mode_by_default"
     "proxy_jump"
     "raises_TypeError_for_disallowed_kwargs"
+    # Assertion failures on mocks
+    # https://github.com/fabric/fabric/issues/2341
+    "client_defaults_to_a_new_SSHClient"
+    "defaults_to_auto_add"
   ];
 
   meta = {

From beeaae4d20587aa6dbf246d390d8f7b8f3daf304 Mon Sep 17 00:00:00 2001
From: Guy Chronister <guychronister@outlook.com>
Date: Tue, 15 Jul 2025 14:16:27 -0500
Subject: [PATCH 097/190] kcollectd: migrate to by-name

kcollectd: treefmt
---
 .../kc/kcollectd/package.nix}                 | 62 +++++++++----------
 pkgs/top-level/all-packages.nix               |  2 -
 2 files changed, 29 insertions(+), 35 deletions(-)
 rename pkgs/{tools/misc/kcollectd/default.nix => by-name/kc/kcollectd/package.nix} (60%)

diff --git a/pkgs/tools/misc/kcollectd/default.nix b/pkgs/by-name/kc/kcollectd/package.nix
similarity index 60%
rename from pkgs/tools/misc/kcollectd/default.nix
rename to pkgs/by-name/kc/kcollectd/package.nix
index a730185d2e4d..edcfc716e802 100644
--- a/pkgs/tools/misc/kcollectd/default.nix
+++ b/pkgs/by-name/kc/kcollectd/package.nix
@@ -2,29 +2,20 @@
   lib,
   fetchFromGitLab,
   stdenv,
-  wrapQtAppsHook,
-  qtbase,
   cmake,
-  kconfig,
-  kio,
-  kiconthemes,
-  kxmlgui,
-  ki18n,
-  kguiaddons,
-  extra-cmake-modules,
   boost,
   shared-mime-info,
   rrdtool,
-  breeze-icons,
+  kdePackages,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "kcollectd";
   version = "0.12.2";
   src = fetchFromGitLab {
     owner = "aerusso";
-    repo = pname;
-    rev = "v${version}";
+    repo = "kcollectd";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-35zb5Kx0tRP5l0hILdomCu2YSQfng02mbyyAClm4uZs=";
   };
 
@@ -32,26 +23,31 @@ stdenv.mkDerivation rec {
     substituteInPlace kcollectd/rrd_interface.cc --replace-fail 'char *arg[] =' 'const char *arg[] ='
   '';
 
-  nativeBuildInputs = [
-    wrapQtAppsHook
-    cmake
-    extra-cmake-modules
-    shared-mime-info
-  ];
+  nativeBuildInputs =
+    [
+      shared-mime-info
+      cmake
+    ]
+    ++ (with kdePackages; [
+      wrapQtAppsHook
+      extra-cmake-modules
+    ]);
 
-  buildInputs = [
-    qtbase
-    kconfig
-    kio
-    kxmlgui
-    kiconthemes
-    ki18n
-    kguiaddons
-    boost
-    rrdtool
-    # otherwise some buttons are blank
-    breeze-icons
-  ];
+  buildInputs =
+    [
+      boost
+      rrdtool
+    ]
+    ++ (with kdePackages; [
+      qtbase
+      kconfig
+      kio
+      kxmlgui
+      kiconthemes
+      ki18n
+      kguiaddons
+      breeze-icons
+    ]);
 
   meta = with lib; {
     description = "Graphical frontend to collectd";
@@ -61,4 +57,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.linux;
     mainProgram = "kcollectd";
   };
-}
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b9b1e511533c..2ba325d0030a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3580,8 +3580,6 @@ with pkgs;
 
   node2nix = nodePackages.node2nix;
 
-  kcollectd = kdePackages.callPackage ../tools/misc/kcollectd { };
-
   ktailctl = kdePackages.callPackage ../applications/networking/ktailctl { };
 
   ldapdomaindump = with python3Packages; toPythonApplication ldapdomaindump;

From fbc56958afdf83f0b1bc3be6d9540bcc0deb0971 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 15 Jul 2025 20:08:24 +0200
Subject: [PATCH 098/190] nixos/pfix-srsd: migrate postfix integration from
 postfix module

The postfix module is too big to host every individual integration option
and moving it here has no downside.
---
 .../manual/release-notes/rl-2511.section.md   |  2 +
 nixos/modules/services/mail/pfix-srsd.nix     | 57 +++++++++++++------
 nixos/modules/services/mail/postfix.nix       | 15 +----
 3 files changed, 43 insertions(+), 31 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index be57fec927a0..683724e11fc7 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -122,6 +122,8 @@
 
 - `services.postsrsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.postsrsd.configurePostfix](#opt-services.postsrsd.configurePostfix) option.
 
+- `services.pfix-srsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.pfix-srsd.configurePostfix](#opt-services.pfix-srsd.configurePostfix) option.
+
 - `services.monero` now includes the `environmentFile` option for adding secrets to the Monero daemon config.
 
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
diff --git a/nixos/modules/services/mail/pfix-srsd.nix b/nixos/modules/services/mail/pfix-srsd.nix
index fb6a395e3ab8..035f331dcf6d 100644
--- a/nixos/modules/services/mail/pfix-srsd.nix
+++ b/nixos/modules/services/mail/pfix-srsd.nix
@@ -4,6 +4,10 @@
   pkgs,
   ...
 }:
+
+let
+  cfg = config.services.pfix-srsd;
+in
 {
 
   ###### interface
@@ -32,27 +36,46 @@
         type = lib.types.path;
         default = "/var/lib/pfix-srsd/secrets";
       };
+
+      configurePostfix = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to configure the required settings to use pfix-srsd in the local Postfix instance.
+        '';
+      };
     };
   };
 
   ###### implementation
 
-  config = lib.mkIf config.services.pfix-srsd.enable {
-    environment = {
-      systemPackages = [ pkgs.pfixtools ];
-    };
-
-    systemd.services.pfix-srsd = {
-      description = "Postfix sender rewriting scheme daemon";
-      before = [ "postfix.service" ];
-      #note that we use requires rather than wants because postfix
-      #is unable to process (almost) all mail without srsd
-      requiredBy = [ "postfix.service" ];
-      serviceConfig = {
-        Type = "forking";
-        PIDFile = "/run/pfix-srsd.pid";
-        ExecStart = "${pkgs.pfixtools}/bin/pfix-srsd -p /run/pfix-srsd.pid -I ${config.services.pfix-srsd.domain} ${config.services.pfix-srsd.secretsFile}";
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && cfg.configurePostfix && config.services.postfix.enable) {
+      services.postfix.config = {
+        sender_canonical_maps = [ "tcp:127.0.0.1:10001" ];
+        sender_canonical_classes = [ "envelope_sender" ];
+        recipient_canonical_maps = [ "tcp:127.0.0.1:10002" ];
+        recipient_canonical_classes = [ "envelope_recipient" ];
       };
-    };
-  };
+    })
+
+    (lib.mkIf cfg.enable {
+      environment = {
+        systemPackages = [ pkgs.pfixtools ];
+      };
+
+      systemd.services.pfix-srsd = {
+        description = "Postfix sender rewriting scheme daemon";
+        before = [ "postfix.service" ];
+        #note that we use requires rather than wants because postfix
+        #is unable to process (almost) all mail without srsd
+        requiredBy = [ "postfix.service" ];
+        serviceConfig = {
+          Type = "forking";
+          PIDFile = "/run/pfix-srsd.pid";
+          ExecStart = "${pkgs.pfixtools}/bin/pfix-srsd -p /run/pfix-srsd.pid -I ${config.services.pfix-srsd.domain} ${config.services.pfix-srsd.secretsFile}";
+        };
+      };
+    })
+  ];
 }
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 7b2d62e1fc97..710f2d381e6a 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -785,12 +785,6 @@ in
         description = "Maps to be compiled and placed into /var/lib/postfix/conf.";
       };
 
-      useSrs = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to enable sender rewriting scheme";
-      };
-
     };
 
   };
@@ -808,8 +802,6 @@ in
           systemPackages = [ pkgs.postfix ];
         };
 
-        services.pfix-srsd.enable = config.services.postfix.useSrs;
-
         services.mail.sendmailSetuidWrapper = lib.mkIf config.services.postfix.setSendmail {
           program = "sendmail";
           source = "${pkgs.postfix}/bin/sendmail";
@@ -1002,12 +994,6 @@ in
             ] ++ lib.optional haveAliases "$alias_maps";
           }
           // lib.optionalAttrs (cfg.dnsBlacklists != [ ]) { smtpd_client_restrictions = clientRestrictions; }
-          // lib.optionalAttrs cfg.useSrs {
-            sender_canonical_maps = [ "tcp:127.0.0.1:10001" ];
-            sender_canonical_classes = [ "envelope_sender" ];
-            recipient_canonical_maps = [ "tcp:127.0.0.1:10002" ];
-            recipient_canonical_classes = [ "envelope_recipient" ];
-          }
           // lib.optionalAttrs cfg.enableHeaderChecks {
             header_checks = [ "regexp:/etc/postfix/header_checks" ];
           }
@@ -1190,5 +1176,6 @@ in
       [ "services" "postfix" "config" "smtp_tls_security_level" ]
       (config: lib.mkIf config.services.postfix.useDane "dane")
     )
+    (lib.mkRenamedOptionModule [ "services" "postfix" "useSrs" ] [ "services" "pfix-srsd" "enable" ])
   ];
 }

From 2c661b090025096cdc412837ca15ec1f37acbfff Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 20:20:29 +0000
Subject: [PATCH 099/190] cdncheck: 1.1.26 -> 1.1.27

---
 pkgs/by-name/cd/cdncheck/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index 4309bda90b6c..649d4fe66485 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.1.26";
+  version = "1.1.27";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-mqCQ8CxV9N2lml/zPX/Ksf1kKmXWhjWth3KviTcxiRA=";
+    hash = "sha256-8TLsotEUnZyyeaJaAHjJT+Sk3GFztnJei3I9QHJ8raM=";
   };
 
   vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";

From 3586f415fff32b9f6b4a182c3164123fe8bb77ba Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 15 Jul 2025 23:20:45 +0300
Subject: [PATCH 100/190] jdk8: disable structuredAttrs

I don't know why this helps. I don't WANT to know why this helps.
This is a horrible hack.
---
 pkgs/development/compilers/openjdk/generic.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/generic.nix b/pkgs/development/compilers/openjdk/generic.nix
index a6913dc9bdc8..3daca22c905d 100644
--- a/pkgs/development/compilers/openjdk/generic.nix
+++ b/pkgs/development/compilers/openjdk/generic.nix
@@ -427,8 +427,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildFlags = if atLeast17 then [ "images" ] else [ "all" ];
 
-  separateDebugInfo = true;
-  __structuredAttrs = true;
+  separateDebugInfo = atLeast11;
+  __structuredAttrs = atLeast11;
 
   # -j flag is explicitly rejected by the build system:
   #     Error: 'make -jN' is not supported, use 'make JOBS=N'

From d54698c0cb2106aa65a5d59d3829e1bbe7688a7b Mon Sep 17 00:00:00 2001
From: Kirill Radzikhovskyy <kirillrdy@gmail.com>
Date: Wed, 16 Jul 2025 06:48:14 +1000
Subject: [PATCH 101/190] ruby_3_4: 3.4.4 -> 3.4.5

Release: https://github.com/ruby/ruby/releases/tag/v3_4_5
---
 pkgs/development/interpreters/ruby/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index f73069809378..3167b2e7c0a4 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -434,8 +434,8 @@ in
   };
 
   ruby_3_4 = generic {
-    version = rubyVersion "3" "4" "4" "";
-    hash = "sha256-oFl7/fMS4BDv0e/6qNfx14MxRv3BeVDKqBWP+j3L+oU=";
+    version = rubyVersion "3" "4" "5" "";
+    hash = "sha256-HYjYontEL93kqgbcmehrC78LKIlj2EMxEt1frHmP1e4=";
     cargoHash = "sha256-5Tp8Kth0yO89/LIcU8K01z6DdZRr8MAA0DPKqDEjIt0=";
   };
 }

From db33c32e8949ad4b4ba2efcb4994a514fd7d2340 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 21:12:53 +0000
Subject: [PATCH 102/190] gatekeeper: 3.19.2 -> 3.19.3

---
 pkgs/by-name/ga/gatekeeper/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ga/gatekeeper/package.nix b/pkgs/by-name/ga/gatekeeper/package.nix
index ccf0a13a6832..7621c2984653 100644
--- a/pkgs/by-name/ga/gatekeeper/package.nix
+++ b/pkgs/by-name/ga/gatekeeper/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gatekeeper";
-  version = "3.19.2";
+  version = "3.19.3";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "gatekeeper";
     tag = "v${version}";
-    hash = "sha256-ksspmNq42Wn/4Uzi8omvzCCprP+ELHVGBImgi8GrMSk=";
+    hash = "sha256-FQ5Q9S/YvJQaa2mUWXv8huTK89SZ31UaFbBCEduGsyg=";
   };
 
   vendorHash = null;

From 74c6279d5b8040f5c05adae12483e1d3666c8777 Mon Sep 17 00:00:00 2001
From: isabel <isabel@isabelroses.com>
Date: Tue, 15 Jul 2025 22:56:58 +0100
Subject: [PATCH 103/190] pds: 0.4.107 -> 0.4.158

Diff: https://github.com/bluesky-social/pds/compare/refs/tags/v0.4.107...refs/tags/v0.4.158
---
 pkgs/by-name/pd/pds/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pd/pds/package.nix b/pkgs/by-name/pd/pds/package.nix
index efc4fdf95d0f..ece0d582c89f 100644
--- a/pkgs/by-name/pd/pds/package.nix
+++ b/pkgs/by-name/pd/pds/package.nix
@@ -20,13 +20,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pds";
-  version = "0.4.107";
+  version = "0.4.158";
 
   src = fetchFromGitHub {
     owner = "bluesky-social";
     repo = "pds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cS9BVR14CAqT1dMw8afd3jVygG1h9bdF0QZ7mBVlIe8=";
+    hash = "sha256-TesrTKAP2wIQ+H6srvVbS6GF/7Be2xJa1dn/krScPOs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/service";
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
       sourceRoot
       ;
     fetcherVersion = 1;
-    hash = "sha256-KyHa7pZaCgyqzivI0Y7E6Y4yBRllYdYLnk1s0o0dyHY=";
+    hash = "sha256-+ESVGrgXNCQWOhqH4PM5lKQKcxE/5zxRmIboDZxgxcc=";
   };
 
   buildPhase = ''

From bdc55154156812fffd7b42ddc3991485f6a02706 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Camille=20Favier?= <n@monade.li>
Date: Tue, 15 Jul 2025 23:58:21 +0200
Subject: [PATCH 104/190] tela-icon-theme: add propagated dependency on breeze,
 adwaita

The theme inherits those icon themes: https://github.com/vinceliuice/Tela-icon-theme/blob/2025-02-10/src/index.theme#L4
---
 pkgs/by-name/te/tela-icon-theme/package.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/te/tela-icon-theme/package.nix b/pkgs/by-name/te/tela-icon-theme/package.nix
index c202c013adec..315c1eb05897 100644
--- a/pkgs/by-name/te/tela-icon-theme/package.nix
+++ b/pkgs/by-name/te/tela-icon-theme/package.nix
@@ -4,6 +4,8 @@
   fetchFromGitHub,
   gtk3,
   jdupes,
+  adwaita-icon-theme,
+  libsForQt5,
   hicolor-icon-theme,
 }:
 
@@ -23,7 +25,11 @@ stdenvNoCC.mkDerivation rec {
     jdupes
   ];
 
-  propagatedBuildInputs = [ hicolor-icon-theme ];
+  propagatedBuildInputs = [
+    adwaita-icon-theme
+    libsForQt5.breeze-icons
+    hicolor-icon-theme
+  ];
 
   dontDropIconThemeCache = true;
 

From 9fab7d37f52565f327c995d155edee16a80c5110 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Camille=20Favier?= <n@monade.li>
Date: Tue, 15 Jul 2025 23:59:36 +0200
Subject: [PATCH 105/190] tela-icon-theme: don't check for broken symlinks

This takes an hour because there are 600k+ symlinks.
---
 pkgs/by-name/te/tela-icon-theme/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/te/tela-icon-theme/package.nix b/pkgs/by-name/te/tela-icon-theme/package.nix
index 315c1eb05897..149e88d07928 100644
--- a/pkgs/by-name/te/tela-icon-theme/package.nix
+++ b/pkgs/by-name/te/tela-icon-theme/package.nix
@@ -36,6 +36,7 @@ stdenvNoCC.mkDerivation rec {
   # These fixup steps are slow and unnecessary.
   dontPatchELF = true;
   dontRewriteSymlinks = true;
+  dontCheckForBrokenSymlinks = true;
 
   installPhase = ''
     runHook preInstall

From 364d351e266764902980e4a533986b692aceab14 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 22:08:14 +0000
Subject: [PATCH 106/190] python3Packages.edk2-pytool-library: 0.23.4 -> 0.23.6

---
 .../python-modules/edk2-pytool-library/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/edk2-pytool-library/default.nix b/pkgs/development/python-modules/edk2-pytool-library/default.nix
index de76fbc3825a..820008e94ea7 100644
--- a/pkgs/development/python-modules/edk2-pytool-library/default.nix
+++ b/pkgs/development/python-modules/edk2-pytool-library/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "edk2-pytool-library";
-  version = "0.23.4";
+  version = "0.23.6";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "tianocore";
     repo = "edk2-pytool-library";
     tag = "v${version}";
-    hash = "sha256-7wjNOwrTXhieUI7Etn6AdiNedoPKSIADtC7dc4Bdlxc=";
+    hash = "sha256-62uWRr1n3C51OeHeCKKJrB1KLcjRGnwBCgpC0RPWum8=";
   };
 
   build-system = [

From 74a4f8c287ed2c0b8bd1b244e63ba7f30ca33a85 Mon Sep 17 00:00:00 2001
From: isabel <isabel@isabelroses.com>
Date: Wed, 16 Jul 2025 00:01:16 +0100
Subject: [PATCH 107/190] moonlight: 1.3.22 -> 1.3.23

Diff: https://github.com/moonlight-mod/moonlight/compare/refs/tags/v1.3.22...refs/tags/v1.3.23

Changelog: https://raw.githubusercontent.com/moonlight-mod/moonlight/refs/tags/v1.3.23/CHANGELOG.md
---
 pkgs/by-name/mo/moonlight/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index ea7d0ad147f9..27bfe293adcf 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "1.3.22";
+  version = "1.3.23";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mn6f4ci5C2jkyxgmBHQ4dI9V0/20DlyS6EbQz4w7znc=";
+    hash = "sha256-LVXO+V182R2KmNfTJjpYx/yYk97+Kvzul7gzSM72JJM=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     buildInputs = [ nodejs_22 ];
 
     fetcherVersion = 1;
-    hash = "sha256-vrSfrAnLc30kba+8VOPawdp8KaQVUhsD6mUq+YdAJTY=";
+    hash = "sha256-gmv0W4PluHoiZRSAJuBTDo3CjmJOM1ZHFbxrt7CsJaE=";
   };
 
   env = {

From 6e76213ffea796998af420f2817f5295d94cada5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 23:58:15 +0000
Subject: [PATCH 108/190] bento: 1.8.2 -> 1.9.0

---
 pkgs/by-name/be/bento/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/be/bento/package.nix b/pkgs/by-name/be/bento/package.nix
index 3769dc5d2e26..f660f06f2c0b 100644
--- a/pkgs/by-name/be/bento/package.nix
+++ b/pkgs/by-name/be/bento/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "bento";
-  version = "1.8.2";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "warpstreamlabs";
     repo = "bento";
     tag = "v${version}";
-    hash = "sha256-EAEeyMWXL/OL/LGgOQxvXtwrrVXtqY05AMeU5z86tks=";
+    hash = "sha256-rAm9Jn1elux02W0sbMOvQmYyg9ONuSqyStVt1ieTFBk=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-N3YkY1wfxdPnwbEXDxHi/J3Oi3qiNtDMOwvSThX6cf0=";
+  vendorHash = "sha256-Dwf4q5lXO2gtvfB0Ib5LmaXg/MSNir+RzLU4rfE/mB4=";
 
   subPackages = [
     "cmd/bento"

From c8adab7afc510a58907089eb3bd3aa80801c61b8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 00:14:48 +0000
Subject: [PATCH 109/190] audacious-bare: 4.4.2 -> 4.5

---
 pkgs/by-name/au/audacious-bare/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/au/audacious-bare/package.nix b/pkgs/by-name/au/audacious-bare/package.nix
index 543f213b3826..8397e3797c4a 100644
--- a/pkgs/by-name/au/audacious-bare/package.nix
+++ b/pkgs/by-name/au/audacious-bare/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "audacious";
-  version = "4.4.2";
+  version = "4.5";
 
   src = fetchFromGitHub {
     owner = "audacious-media-player";
     repo = "audacious";
     rev = "${pname}-${version}";
-    hash = "sha256-Vh39uY15Pj2TbPk8gU55YykhFf5ytSUxN2gJ0VlC3tQ=";
+    hash = "sha256-oYssIeVAvz2nx/3GRxgmsUjp2mnEFMem0WNPJG9l14E=";
   };
 
   nativeBuildInputs = [

From bbc5f300fd0bc88483216a60484523e0fa7dfc69 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 00:20:29 +0000
Subject: [PATCH 110/190] audacious: 4.4.2 -> 4.5

---
 pkgs/by-name/au/audacious-bare/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/au/audacious-bare/package.nix b/pkgs/by-name/au/audacious-bare/package.nix
index 543f213b3826..8397e3797c4a 100644
--- a/pkgs/by-name/au/audacious-bare/package.nix
+++ b/pkgs/by-name/au/audacious-bare/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "audacious";
-  version = "4.4.2";
+  version = "4.5";
 
   src = fetchFromGitHub {
     owner = "audacious-media-player";
     repo = "audacious";
     rev = "${pname}-${version}";
-    hash = "sha256-Vh39uY15Pj2TbPk8gU55YykhFf5ytSUxN2gJ0VlC3tQ=";
+    hash = "sha256-oYssIeVAvz2nx/3GRxgmsUjp2mnEFMem0WNPJG9l14E=";
   };
 
   nativeBuildInputs = [

From e8ff439e4eda48ad937e2af5eadf8a90a1d76e9a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 01:41:53 +0000
Subject: [PATCH 111/190] hmcl: 3.6.13 -> 3.6.14

---
 pkgs/by-name/hm/hmcl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix
index cb9fb8de7f4b..e810da871057 100644
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.6.13";
+  version = "3.6.14";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/release-${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-rqfesqt3yYDU6koDLFbE9FJpA6iNzDTNG6lWGA2bBYo=";
+    hash = "sha256-8AviAYAMm74uJeMvgESPNHbT5b91mDTxDgLYh+8VHb8=";
   };
 
   icon = fetchurl {

From 57020c8a24508332ee6b4420dc5093429fe7cf6d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 01:50:26 +0000
Subject: [PATCH 112/190] inputplumber: 0.59.2 -> 0.60.2

---
 pkgs/by-name/in/inputplumber/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/in/inputplumber/package.nix b/pkgs/by-name/in/inputplumber/package.nix
index 2555fe1c6b7e..5c10d9519ed7 100644
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "inputplumber";
-  version = "0.59.2";
+  version = "0.60.2";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     tag = "v${version}";
-    hash = "sha256-IAopZnGU0NOfpViLLetAm5BycTXyYL1fJ5WJW8qVnwA=";
+    hash = "sha256-zcy9scs7oRRLKm/FL6BfO64IstWY4HmTRxG/jJG0jLw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-m/U9fYio39hkjcVDO3VlK5yJF9nWL9Y5B8D0FgD7LKk=";
+  cargoHash = "sha256-fw7pM6HSy/8fNTYu7MqKiTl/2jdyDOLDBNhd0rpzb6M=";
 
   nativeBuildInputs = [
     pkg-config

From 909511f5157a6e98b4305e76a04fe3ad22266d2e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 01:51:14 +0000
Subject: [PATCH 113/190] gowebly: 3.0.4 -> 3.0.5

---
 pkgs/by-name/go/gowebly/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/gowebly/package.nix b/pkgs/by-name/go/gowebly/package.nix
index df52ccb128e6..9dca725798f0 100644
--- a/pkgs/by-name/go/gowebly/package.nix
+++ b/pkgs/by-name/go/gowebly/package.nix
@@ -8,16 +8,16 @@
 
 buildGo124Module rec {
   pname = "gowebly";
-  version = "3.0.4";
+  version = "3.0.5";
 
   src = fetchFromGitHub {
     owner = "gowebly";
     repo = "gowebly";
     tag = "v${version}";
-    hash = "sha256-oz/O5scGJigWjrmA2wnagDbf+epvwuyRI2CaSQY8K5I=";
+    hash = "sha256-r1yyMbnpt0sDgqkm/EqaYysQnm48uIXzQHqJObVpT9g=";
   };
 
-  vendorHash = "sha256-BDdH6cFicbjT2WOldNRc8NcFKrIaeqy+mw113PRnwa8=";
+  vendorHash = "sha256-N48/67fMPsylNGr6ixay4si+9ifUryxkIJxKDYU46+o=";
 
   env.CGO_ENABLED = 0;
 

From 1fc68917415080b32068d545748b202ef5076fc3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 15 Jul 2025 19:18:16 -0700
Subject: [PATCH 114/190] aider-chat: move to top-level

It does not provide a public Python API.
---
 .../ai}/aider-chat/fix-flake8-invoke.patch    |   0
 .../ai/aider-chat/package.nix}                | 132 ++----------------
 pkgs/top-level/all-packages.nix               |  22 +--
 pkgs/top-level/python-packages.nix            |   2 -
 4 files changed, 16 insertions(+), 140 deletions(-)
 rename pkgs/{development/python-modules => by-name/ai}/aider-chat/fix-flake8-invoke.patch (100%)
 rename pkgs/{development/python-modules/aider-chat/default.nix => by-name/ai/aider-chat/package.nix} (76%)

diff --git a/pkgs/development/python-modules/aider-chat/fix-flake8-invoke.patch b/pkgs/by-name/ai/aider-chat/fix-flake8-invoke.patch
similarity index 100%
rename from pkgs/development/python-modules/aider-chat/fix-flake8-invoke.patch
rename to pkgs/by-name/ai/aider-chat/fix-flake8-invoke.patch
diff --git a/pkgs/development/python-modules/aider-chat/default.nix b/pkgs/by-name/ai/aider-chat/package.nix
similarity index 76%
rename from pkgs/development/python-modules/aider-chat/default.nix
rename to pkgs/by-name/ai/aider-chat/package.nix
index 11cbaaa39908..60ca5809d185 100644
--- a/pkgs/development/python-modules/aider-chat/default.nix
+++ b/pkgs/by-name/ai/aider-chat/package.nix
@@ -1,140 +1,30 @@
 {
   lib,
   stdenv,
-  buildPythonPackage,
+  python312Packages,
   fetchFromGitHub,
   replaceVars,
   gitMinimal,
   portaudio,
   playwright-driver,
-  pythonOlder,
-  pythonAtLeast,
-  setuptools-scm,
-  aiohappyeyeballs,
-  aiohttp,
-  aiosignal,
-  annotated-types,
-  anyio,
-  attrs,
-  backoff,
-  beautifulsoup4,
-  cachetools,
-  certifi,
-  cffi,
-  charset-normalizer,
-  click,
-  configargparse,
-  diff-match-patch,
-  diskcache,
-  distro,
-  filelock,
-  flake8,
-  frozenlist,
-  fsspec,
-  gitdb,
-  gitpython,
-  google-ai-generativelanguage,
-  google-generativeai,
-  grep-ast,
-  h11,
-  hf-xet,
-  httpcore,
-  httpx,
-  huggingface-hub,
-  idna,
-  importlib-resources,
-  jinja2,
-  jiter,
-  json5,
-  jsonschema,
-  jsonschema-specifications,
-  litellm,
-  markdown-it-py,
-  markupsafe,
-  mccabe,
-  mdurl,
-  multidict,
-  networkx,
-  numpy,
-  openai,
-  oslex,
-  packaging,
-  pathspec,
-  pexpect,
-  pillow,
-  prompt-toolkit,
-  psutil,
-  ptyprocess,
-  pycodestyle,
-  pycparser,
-  pydantic,
-  pydantic-core,
-  pydub,
-  pyflakes,
-  pygments,
-  pypandoc,
-  pyperclip,
-  python-dotenv,
-  pyyaml,
-  referencing,
-  regex,
-  requests,
-  rich,
-  rpds-py,
-  scipy,
-  shtab,
-  smmap,
-  sniffio,
-  sounddevice,
-  socksio,
-  soundfile,
-  soupsieve,
-  tiktoken,
-  tokenizers,
-  tqdm,
-  tree-sitter,
-  tree-sitter-language-pack,
-  typing-extensions,
-  typing-inspection,
-  urllib3,
-  watchfiles,
-  wcwidth,
-  yarl,
-  zipp,
-  pip,
-  mixpanel,
-  monotonic,
-  posthog,
-  propcache,
-  python-dateutil,
-  pytestCheckHook,
-  greenlet,
-  playwright,
-  pyee,
-  streamlit,
-  llama-index-core,
-  llama-index-embeddings-huggingface,
-  torch,
-  nltk,
-  boto3,
   nix-update-script,
 }:
 
 let
-  aider-nltk-data = nltk.dataDir (d: [
+  # dont support python 3.13 (Aider-AI/aider#3037)
+  python3Packages = python312Packages;
+
+  aider-nltk-data = python3Packages.nltk.dataDir (d: [
     d.punkt-tab
     d.stopwords
   ]);
 
   version = "0.85.1";
-  aider-chat = buildPythonPackage {
+  aider-chat = python3Packages.buildPythonApplication {
     pname = "aider-chat";
     inherit version;
     pyproject = true;
 
-    # dont support python 3.13 (Aider-AI/aider#3037)
-    disabled = pythonOlder "3.10" || pythonAtLeast "3.13";
-
     src = fetchFromGitHub {
       owner = "Aider-AI";
       repo = "aider";
@@ -144,9 +34,9 @@ let
 
     pythonRelaxDeps = true;
 
-    build-system = [ setuptools-scm ];
+    build-system = with python3Packages; [ setuptools-scm ];
 
-    dependencies = [
+    dependencies = with python3Packages; [
       aiohappyeyeballs
       aiohttp
       aiosignal
@@ -251,13 +141,13 @@ let
     buildInputs = [ portaudio ];
 
     nativeCheckInputs = [
-      pytestCheckHook
+      python3Packages.pytestCheckHook
       gitMinimal
     ];
 
     patches = [
       (replaceVars ./fix-flake8-invoke.patch {
-        flake8 = lib.getExe flake8;
+        flake8 = lib.getExe python3Packages.flake8;
       })
     ];
 
@@ -308,7 +198,7 @@ let
       export AIDER_ANALYTICS="false"
     '';
 
-    optional-dependencies = {
+    optional-dependencies = with python3Packages; {
       playwright = [
         greenlet
         playwright
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b9b1e511533c..c4200ba6028b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -201,27 +201,15 @@ with pkgs;
     } ../build-support/setup-hooks/add-bin-to-path.sh
   ) { };
 
-  aider-chat = with python312Packages; toPythonApplication aider-chat;
+  aider-chat-with-playwright = aider-chat.withOptional { withPlaywright = true; };
 
-  aider-chat-with-playwright =
-    with python312Packages;
-    toPythonApplication (aider-chat.withOptional { withPlaywright = true; });
+  aider-chat-with-browser = aider-chat.withOptional { withBrowser = true; };
 
-  aider-chat-with-browser =
-    with python312Packages;
-    toPythonApplication (aider-chat.withOptional { withBrowser = true; });
+  aider-chat-with-help = aider-chat.withOptional { withHelp = true; };
 
-  aider-chat-with-help =
-    with python312Packages;
-    toPythonApplication (aider-chat.withOptional { withHelp = true; });
+  aider-chat-with-bedrock = aider-chat.withOptional { withBedrock = true; };
 
-  aider-chat-with-bedrock =
-    with python312Packages;
-    toPythonApplication (aider-chat.withOptional { withBedrock = true; });
-
-  aider-chat-full =
-    with python312Packages;
-    toPythonApplication (aider-chat.withOptional { withAll = true; });
+  aider-chat-full = aider-chat.withOptional { withAll = true; };
 
   autoreconfHook = callPackage (
     {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 86cadaed9737..e0aee70d2471 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -144,8 +144,6 @@ self: super: with self; {
 
   ahocorasick-rs = callPackage ../development/python-modules/ahocorasick-rs { };
 
-  aider-chat = callPackage ../development/python-modules/aider-chat { };
-
   aigpy = callPackage ../development/python-modules/aigpy { };
 
   ailment = callPackage ../development/python-modules/ailment { };

From 98d8c2c1fc74beb14c21471559094e19b45b1cc0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 02:24:58 +0000
Subject: [PATCH 115/190] rockcraft: 1.12.0 -> 1.13.0

---
 pkgs/by-name/ro/rockcraft/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ro/rockcraft/package.nix b/pkgs/by-name/ro/rockcraft/package.nix
index be29de5fcc69..3e88c80b4092 100644
--- a/pkgs/by-name/ro/rockcraft/package.nix
+++ b/pkgs/by-name/ro/rockcraft/package.nix
@@ -10,13 +10,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "rockcraft";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "rockcraft";
     rev = version;
-    hash = "sha256-yv+TGDSUBKJf5X+73Do9KrAcCodeBPqpIHgpYZslR3o=";
+    hash = "sha256-pIOCgOC969Fj3lNnmsb6QTEV8z1KWxrUSsdl6Aogd4Q=";
   };
 
   pyproject = true;

From 8270f9a3eb6a1641d5aed823488bd7e79946ab28 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 02:47:18 +0000
Subject: [PATCH 116/190] cargo-sonar: 1.3.0 -> 1.3.1

---
 pkgs/by-name/ca/cargo-sonar/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-sonar/package.nix b/pkgs/by-name/ca/cargo-sonar/package.nix
index 7cf2c74ec0bd..a0e8d74bf3da 100644
--- a/pkgs/by-name/ca/cargo-sonar/package.nix
+++ b/pkgs/by-name/ca/cargo-sonar/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-sonar";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitLab {
     owner = "woshilapin";
     repo = "cargo-sonar";
     tag = finalAttrs.version;
-    hash = "sha256-f319hi6mrnlHTvsn7kN2wFHyamXtplLZ8A6TN0+H3jY=";
+    hash = "sha256-QK5hri+H1sphk+/0gU5iGrFo6POP/sobq0JL7Q+rJcc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-KLw6kAR2pF5RFhRDfsL093K+jk3oiSHLZ2CQvrBuhWY=";
+  cargoHash = "sha256-d6LXzWjt2Esbxje+gc8gRA72uxHE2kTUNKdhDlAP0K0=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

From 30b23cd88ff8406e97d25ce07dad87c05c92e6b4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 03:49:49 +0000
Subject: [PATCH 117/190] polarity: latest-unstable-2025-07-06 ->
 latest-unstable-2025-07-15

---
 pkgs/by-name/po/polarity/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/po/polarity/package.nix b/pkgs/by-name/po/polarity/package.nix
index 0dc56dbf950a..22f702f68936 100644
--- a/pkgs/by-name/po/polarity/package.nix
+++ b/pkgs/by-name/po/polarity/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "polarity";
-  version = "latest-unstable-2025-07-06";
+  version = "latest-unstable-2025-07-15";
 
   src = fetchFromGitHub {
     owner = "polarity-lang";
     repo = "polarity";
-    rev = "f95159a91c712984a51103ea6b6f32ed7f59f4df";
-    hash = "sha256-iKhxvJtVeTIFQUgtlLPBH9Swvw8om61FxwahOov9xDs=";
+    rev = "83bd1bd5bc461421115333e423f45a7735782638";
+    hash = "sha256-+l3pS8IpPvebpX++ezcC05X06f+NnBZBsNVXEHTYh6A=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bQVZEYQ9KRiG+DAl1XAEjhuXg+Rtt65srwL9yXBYhf0=";
+  cargoHash = "sha256-SXGuf/JaBfPZgbCAfRmC2Gd82kOn54VQrc7FdmVJRuA=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 

From bbb9e7bc731e49942ad57c47c892b9174b816fc3 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Wed, 16 Jul 2025 00:31:10 -0400
Subject: [PATCH 118/190] emacsPackages.lsp-bridge: 0-unstable-2025-02-10 ->
 0-unstable-2025-06-28

---
 .../elisp-packages/manual-packages/lsp-bridge/default.nix | 6 +++---
 .../lsp-bridge/hardcode-dependencies.patch                | 8 +++++---
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
index 422c7758d0cd..ccae9ed6c393 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
@@ -32,13 +32,13 @@ let
 in
 melpaBuild {
   pname = "lsp-bridge";
-  version = "0-unstable-2025-02-10";
+  version = "0-unstable-2025-06-28";
 
   src = fetchFromGitHub {
     owner = "manateelazycat";
     repo = "lsp-bridge";
-    rev = "4401d1396dce89d1fc5dc5414565818dd1c30ae0";
-    hash = "sha256-lWbFbYwJoy4UAezKUK7rnjQlDcnszHQwK5I7fuHfE8Y=";
+    rev = "3b37a04bd1b6bbcdc2b0ad7a5c388ad027eb7a25";
+    hash = "sha256-0pjRihJapljd/9nR7G+FC+gCqD82YGITPK2mcJcI7ZI=";
   };
 
   patches = [
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/hardcode-dependencies.patch b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/hardcode-dependencies.patch
index 2fa57207ec38..7cb545851f42 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/hardcode-dependencies.patch
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/hardcode-dependencies.patch
@@ -1,8 +1,8 @@
 diff --git a/lsp-bridge.el b/lsp-bridge.el
-index 278c27e..f0c67c2 100644
+index d3e2ff7..1b1d745 100644
 --- a/lsp-bridge.el
 +++ b/lsp-bridge.el
-@@ -340,19 +340,7 @@ Setting this to nil or 0 will turn off the indicator."
+@@ -417,21 +417,7 @@ LSP-Bridge will enable completion inside string literals."
    "Name of LSP-Bridge buffer."
    :type 'string)
  
@@ -13,7 +13,9 @@ index 278c27e..f0c67c2 100644
 -                                                   "python3.exe")
 -                                                  ((executable-find "python.exe")
 -                                                   "python.exe")))
--                                           (t (cond ((executable-find "pypy3")
+-                                           (t (cond ((executable-find "python-lsp-bridge")
+-                                                     "python-lsp-bridge")
+-                                                    ((executable-find "pypy3")
 -                                                     "pypy3")
 -                                                    ((executable-find "python3")
 -                                                     "python3")

From 64b3184ee24d7973f8c6098165557b3af3d6220a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 04:55:31 +0000
Subject: [PATCH 119/190] python3Packages.elevenlabs: 2.5.0 -> 2.7.1

---
 pkgs/development/python-modules/elevenlabs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/elevenlabs/default.nix b/pkgs/development/python-modules/elevenlabs/default.nix
index e1744be1aba1..a1f3fe145dfb 100644
--- a/pkgs/development/python-modules/elevenlabs/default.nix
+++ b/pkgs/development/python-modules/elevenlabs/default.nix
@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "2.5.0";
+  version = "2.7.1";
   tag = "v${version}";
 in
 buildPythonPackage {
@@ -25,7 +25,7 @@ buildPythonPackage {
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     inherit tag;
-    hash = "sha256-GA+CQR5QPbXWpOMOp+P6fOjBiJemI2vOctM7zCnfmk4=";
+    hash = "sha256-QbjVd+cVe6Y/deTeO31bwjGHNl9ykOrWFdFhOepFnxY=";
   };
 
   build-system = [ poetry-core ];

From c5fd704443f445e67fed65ffd700457318de6378 Mon Sep 17 00:00:00 2001
From: Zexin Yuan <git@yzx9.xyz>
Date: Wed, 16 Jul 2025 13:07:15 +0800
Subject: [PATCH 120/190] zoneminder: set platforms to linux

---
 pkgs/by-name/zo/zoneminder/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/zo/zoneminder/package.nix b/pkgs/by-name/zo/zoneminder/package.nix
index f58c5e7de804..345984657772 100644
--- a/pkgs/by-name/zo/zoneminder/package.nix
+++ b/pkgs/by-name/zo/zoneminder/package.nix
@@ -246,6 +246,6 @@ stdenv.mkDerivation rec {
     homepage = "https://zoneminder.com";
     license = licenses.gpl3;
     maintainers = [ ];
-    platforms = platforms.unix;
+    platforms = platforms.linux;
   };
 }

From 82c97886e6ea076f22f97dc888d90b7a5924036d Mon Sep 17 00:00:00 2001
From: Mahyar Mirrashed <mah.mirr@gmail.com>
Date: Mon, 14 Jul 2025 14:52:28 -0500
Subject: [PATCH 121/190] vimPlugins.jdd-nvim: use correct package

---
 pkgs/applications/editors/vim/plugins/overrides.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index f151c6b51499..9c35b2dd1eb6 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1509,7 +1509,7 @@ in
     dependencies = [ self.nvim-treesitter ];
   };
 
-  jdd-nvim = super.lazyjj-nvim.overrideAttrs {
+  jdd-nvim = super.jdd-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
 

From a3beea842d63eee116ed7caf6eb6aeb153a916ee Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 22:12:44 +0000
Subject: [PATCH 122/190] plasma-plugin-blurredwallpaper: 3.2.1 -> 3.3.1

---
 pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix b/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix
index cebcd29e5a77..75866f2be064 100644
--- a/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix
+++ b/pkgs/by-name/pl/plasma-plugin-blurredwallpaper/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plasma-plugin-blurredwallpaper";
-  version = "3.2.1";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "bouteillerAlan";
     repo = "blurredwallpaper";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-P/N7g/cl2K0R4NKebfqZnr9WQkHPSvHNbKbWiOxs76k=";
+    hash = "sha256-hXuJhSS5QEgKWn60ctF3N+avfez8Ktrne3re/FY/VMU=";
   };
 
   installPhase = ''

From bd16676f18040e23761b54a98e9d906a962220ae Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 16 Jul 2025 06:54:52 +0100
Subject: [PATCH 123/190] mdbook: 0.4.51 -> 0.4.52

Changes: https://github.com/rust-lang/mdBook/compare/v0.4.50...v0.4.51
---
 pkgs/by-name/md/mdbook/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/md/mdbook/package.nix b/pkgs/by-name/md/mdbook/package.nix
index ded486367aec..c8ad396b347b 100644
--- a/pkgs/by-name/md/mdbook/package.nix
+++ b/pkgs/by-name/md/mdbook/package.nix
@@ -7,7 +7,7 @@
   installShellFiles,
 }:
 let
-  version = "0.4.51";
+  version = "0.4.52";
 in
 rustPlatform.buildRustPackage rec {
   inherit version;
@@ -17,11 +17,11 @@ rustPlatform.buildRustPackage rec {
     owner = "rust-lang";
     repo = "mdBook";
     tag = "v${version}";
-    hash = "sha256-d211IEXtHiRhD+rXGUaDAbcDwKJZqr0fmkxTgN4RkC0=";
+    hash = "sha256-a3GSMz1+8Ve5cp4x1NjBlsCU/wMC4Jl3/H9qx7+1XlI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3VI9WZiFiyfQRQk7gZBLXA/RRfCuEBze/MWI7OUGBmc=";
+  cargoHash = "sha256-wvTixSVHXglJM+nBMulZNZKF8pZfNd2G8Z+1PlAWmpk=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From b3c1f47452061613315064a4b6ed2b2cbf23495e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 06:06:47 +0000
Subject: [PATCH 124/190] openstack-rs: 0.12.3 -> 0.12.4

---
 pkgs/by-name/op/openstack-rs/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/openstack-rs/package.nix b/pkgs/by-name/op/openstack-rs/package.nix
index 9a8fbbe612f5..840f99191b8d 100644
--- a/pkgs/by-name/op/openstack-rs/package.nix
+++ b/pkgs/by-name/op/openstack-rs/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "openstack-rs";
-  version = "0.12.3";
+  version = "0.12.4";
   src = fetchFromGitHub {
     owner = "gtema";
     repo = "openstack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bl6Gxoqy9DJf3fwozLSQheL24hHqRCt4Kwb0mvhGhSs=";
+    hash = "sha256-UEnvKqnAY7QHeeEayTk5aBBxHcOrAr7LisvaOiRhRMQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-miwBqy4CPvFgfwlEht3LUd6yrUkARfP5Ed4oWrFDg8U=";
+  cargoHash = "sha256-YytlhN1UtNnB5ZgCEVyBfiPTnhABjCaA87ejkHJsIOk=";
 
   nativeBuildInputs = [
     installShellFiles

From 8a84087de6e322bb049b5c6f7e0d741d188d5757 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 06:22:34 +0000
Subject: [PATCH 125/190] rqlite: 8.38.3 -> 8.39.1

---
 pkgs/by-name/rq/rqlite/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/rq/rqlite/package.nix b/pkgs/by-name/rq/rqlite/package.nix
index 059b83479fcf..eae9df1c9deb 100644
--- a/pkgs/by-name/rq/rqlite/package.nix
+++ b/pkgs/by-name/rq/rqlite/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "rqlite";
-  version = "8.38.3";
+  version = "8.39.1";
 
   src = fetchFromGitHub {
     owner = "rqlite";
     repo = "rqlite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OAR6HJ4eQqUPaFbiL4T3ledH8chCM2xr6ZNeBzjqjhw=";
+    hash = "sha256-x/J8W+lAC7d6rE3Zzc7vXVvbonCXn33Of2pKljuWpq0=";
   };
 
   vendorHash = "sha256-fj4YyxCIZG6ttmNVZm12xKk3+OcownrqXKc9LCAWk7U=";

From 3794b8a20b196aa08ef8b6a46f042ff5031b2cb3 Mon Sep 17 00:00:00 2001
From: Saterfield990 <traysaterfield@outlook.com>
Date: Wed, 16 Jul 2025 09:35:50 +0300
Subject: [PATCH 126/190] mdbtools: fix build failure

---
 pkgs/by-name/md/mdbtools/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/md/mdbtools/package.nix b/pkgs/by-name/md/mdbtools/package.nix
index 381245fef2c7..77703f590ead 100644
--- a/pkgs/by-name/md/mdbtools/package.nix
+++ b/pkgs/by-name/md/mdbtools/package.nix
@@ -10,6 +10,7 @@
   autoreconfHook,
   txt2man,
   which,
+  gettext,
 }:
 
 stdenv.mkDerivation rec {
@@ -41,6 +42,10 @@ stdenv.mkDerivation rec {
     readline
   ];
 
+  postUnpack = ''
+    cp -v ${gettext}/share/gettext/m4/lib-{link,prefix,ld}.m4 source/m4
+  '';
+
   enableParallelBuilding = true;
 
   meta = with lib; {

From c8f05bbd5cfbfd6cfcb92c5b6312a11c69a2629c Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Wed, 16 Jul 2025 14:09:07 +0800
Subject: [PATCH 127/190] vscode: 1.101.2 -> 1.102.0

---
 pkgs/applications/editors/vscode/vscode.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 8940d99462e4..8c434e2d68c7 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -36,22 +36,22 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-72KrCDUBe+xJjnSY/nnrNH92EP4tp71x1fadh0Pe0DM=";
-      x86_64-darwin = "sha256-Ua3oh0Hv0oiW15u3Rb0pSYu+JD8m1oYMAm5pEzXD6Rw=";
-      aarch64-linux = "sha256-5L0ZArj+7M5dhZDGzYj6NaxYYZEb8q89Vhngvjuw7wQ=";
-      aarch64-darwin = "sha256-uWOF/QGgXocKZAkFMN4Kh7HjiQTSIi+PVPy3V90wrAA=";
-      armv7l-linux = "sha256-FyGPvQeVz8yLhLjFGtCXPTVPvCB0/EX6pRe5RCAmXTU=";
+      x86_64-linux = "sha256-zgrNohvsmhcRQmkX7Io2/U3qbVWdcqwT7VK7Y3ENb9g=";
+      x86_64-darwin = "sha256-depSpPZm6bMQv9yvLUJ6yacCwTDtcpoFu15b67oiFJY=";
+      aarch64-linux = "sha256-Fo2X4VAWcyySQ+CE/bt+lJneLoEKVl6tLwPSW5LwvFY=";
+      aarch64-darwin = "sha256-WdYmlopeVsFCndnTALKiQgx2O4zzkDtotR/qj7A56bY=";
+      armv7l-linux = "sha256-OF4qjhgQiagpQP8p9gV63I/B8s/CSl8KlA+FoNhl3/c=";
     }
     .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.101.2";
+  version = "1.102.0";
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
   # This is used for VS Code - Remote SSH test
-  rev = "2901c5ac6db8a986a5666c3af51ff804d05af0d4";
+  rev = "cb0c47c0cfaad0757385834bd89d410c78a856c0";
 
   executableName = "code" + lib.optionalString isInsiders "-insiders";
   longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -75,7 +75,7 @@ callPackage ./generic.nix rec {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-Bocoiz8pxQNAZxmWdOgh+y44QTnqvDjcqFCodny7VoY=";
+      hash = "sha256-Hf/pukcQf7PaHORItWO74gC54TWto+nHiKaCHzD0TmI=";
     };
     stdenv = stdenvNoCC;
   };

From 1c82e688dc81a11c9d5eeacb65e4b7f24032b45a Mon Sep 17 00:00:00 2001
From: Saterfield990 <traysaterfield@outlook.com>
Date: Wed, 16 Jul 2025 09:38:01 +0300
Subject: [PATCH 128/190] mdbtools: improve

---
 pkgs/by-name/md/mdbtools/package.nix | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/md/mdbtools/package.nix b/pkgs/by-name/md/mdbtools/package.nix
index 77703f590ead..9a581078b72a 100644
--- a/pkgs/by-name/md/mdbtools/package.nix
+++ b/pkgs/by-name/md/mdbtools/package.nix
@@ -11,17 +11,19 @@
   txt2man,
   which,
   gettext,
+  nix-update-script,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mdbtools";
   version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "mdbtools";
     repo = "mdbtools";
-    rev = "v${version}";
-    sha256 = "sha256-XWkFgQZKx9/pjVNEqfp9BwgR7w3fVxQ/bkJEYUvCXPs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XWkFgQZKx9/pjVNEqfp9BwgR7w3fVxQ/bkJEYUvCXPs=";
   };
 
   configureFlags = [ "--disable-scrollkeeper" ];
@@ -48,14 +50,21 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/mdb-ver";
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/mdbtools/mdbtools/releases/tag/v${finalAttrs.version}";
     description = ".mdb (MS Access) format tools";
-    license = with licenses; [
+    homepage = "https://mdbtools.github.io/";
+    license = with lib.licenses; [
       gpl2Plus
       lgpl2
     ];
-    maintainers = [ ];
-    platforms = platforms.unix;
-    inherit (src.meta) homepage;
+    platforms = lib.platforms.unix;
   };
-}
+})

From 4763c0969483b517212c7e1ada89943b4977d249 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 07:11:04 +0000
Subject: [PATCH 129/190] fselect: 0.8.12 -> 0.9.0

---
 pkgs/by-name/fs/fselect/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fs/fselect/package.nix b/pkgs/by-name/fs/fselect/package.nix
index 7262a0bc40e4..03aa791026cf 100644
--- a/pkgs/by-name/fs/fselect/package.nix
+++ b/pkgs/by-name/fs/fselect/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fselect";
-  version = "0.8.12";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "jhspetersson";
     repo = "fselect";
     rev = version;
-    sha256 = "sha256-tvc6Ume9VoPsVFH0AdaQejyRG2M3VapG073a3aYDp7o=";
+    sha256 = "sha256-uR0AElAjzvxymA9K/JySfYpPK59G2SaLTfZpdFtTg/g=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-cLskCSeMLe1aryBVhnAQAVbdKiF0pVFRi9JqcUR1Q6I=";
+  cargoHash = "sha256-j/c2+I/KIYgNxYiHE2oWIq5frNPFtXE5wELWsog8dsc=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;

From 429401d7e5b8bb9da5a464bc84a7c61e14f87673 Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Wed, 16 Jul 2025 15:47:07 +0800
Subject: [PATCH 130/190] python3Packages.docling-ibm-models: 3.4.4 -> 3.8.1

---
 .../python-modules/docling-ibm-models/default.nix          | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/docling-ibm-models/default.nix b/pkgs/development/python-modules/docling-ibm-models/default.nix
index 16b6122db933..166ae7e7c5bc 100644
--- a/pkgs/development/python-modules/docling-ibm-models/default.nix
+++ b/pkgs/development/python-modules/docling-ibm-models/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -15,6 +14,7 @@
   opencv-python-headless,
   pillow,
   pydantic,
+  rtree,
   safetensors,
   torch,
   torchvision,
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "docling-ibm-models";
-  version = "3.4.4";
+  version = "3.8.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-ibm-models";
     tag = "v${version}";
-    hash = "sha256-a2y4vXgALPRtLhdH0Tqqht1gpdcfa1Gv4puthKDMk7U=";
+    hash = "sha256-Yogg71CXQTdF5OUbdbma1rQxtLudTLjyOIFe2LS9CpI=";
   };
 
   build-system = [
@@ -51,6 +51,7 @@ buildPythonPackage rec {
     opencv-python-headless
     pillow
     pydantic
+    rtree
     safetensors
     torch
     torchvision

From 6c88746b3ef830565b10d24587a7e5ff741dea7c Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Wed, 16 Jul 2025 00:07:06 +0200
Subject: [PATCH 131/190] spek: unpin autoconf

---
 pkgs/applications/audio/spek/autoconf.patch | 12 ++++++++++++
 pkgs/applications/audio/spek/default.nix    |  4 ++++
 pkgs/top-level/all-packages.nix             |  4 +---
 3 files changed, 17 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/applications/audio/spek/autoconf.patch

diff --git a/pkgs/applications/audio/spek/autoconf.patch b/pkgs/applications/audio/spek/autoconf.patch
new file mode 100644
index 000000000000..e566f465044d
--- /dev/null
+++ b/pkgs/applications/audio/spek/autoconf.patch
@@ -0,0 +1,12 @@
+diff --git a/configure.ac b/configure.ac
+index 5a80c6b..07c37bf 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -3,6 +3,7 @@ AC_CONFIG_SRCDIR([src/spek.cc])
+ AC_CONFIG_HEADERS([config.h])
+ AM_INIT_AUTOMAKE([1.11.1 foreign no-dist-gzip dist-xz serial-tests])
+ AM_SILENT_RULES([yes])
++AC_CONFIG_MACRO_DIRS([m4])
+ 
+ AC_LANG([C++])
+ AM_PROG_AR
diff --git a/pkgs/applications/audio/spek/default.nix b/pkgs/applications/audio/spek/default.nix
index ad1c2ff5b7e2..721afb7766d4 100644
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@@ -22,6 +22,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VYt2so2k3Rk3sLSV1Tf1G2pESYiXygrKr9Koop8ChCg=";
   };
 
+  patches = [
+    ./autoconf.patch
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     intltool
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b9b1e511533c..863764b87add 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13797,9 +13797,7 @@ with pkgs;
 
   sonic-visualiser = libsForQt5.callPackage ../applications/audio/sonic-visualiser { };
 
-  spek = callPackage ../applications/audio/spek {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
+  spek = callPackage ../applications/audio/spek { };
 
   squeezelite-pulse = callPackage ../by-name/sq/squeezelite/package.nix {
     audioBackend = "pulse";

From 1c844362864edc2f449e98564a3dd7ac7ee6e5f3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 05:19:47 +0000
Subject: [PATCH 132/190] plantuml: 1.2025.3 -> 1.2025.4

---
 pkgs/by-name/pl/plantuml/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pl/plantuml/package.nix b/pkgs/by-name/pl/plantuml/package.nix
index 8c5d89cce5d4..ce4d2eb35de7 100644
--- a/pkgs/by-name/pl/plantuml/package.nix
+++ b/pkgs/by-name/pl/plantuml/package.nix
@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plantuml";
-  version = "1.2025.3";
+  version = "1.2025.4";
 
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml/releases/download/v${finalAttrs.version}/plantuml-pdf-${finalAttrs.version}.jar";
-    hash = "sha256-o8bBO9Crcrf2XLuLbakSiUp4WcIanJJTRwlDr4ydL0I=";
+    hash = "sha256-86qUpDvGLbD3Epr7Iis/vijggqFKpIW5X1zBpP4/lJ8=";
   };
 
   nativeBuildInputs = [

From 26066e3f3fd4ad9bc76cc7a59e60be92cd87c485 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 07:49:36 +0000
Subject: [PATCH 133/190] python3Packages.posthog: 6.0.2 -> 6.1.0

---
 pkgs/development/python-modules/posthog/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index 99103bf5404e..c7513cadeaf2 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "posthog";
-  version = "6.0.2";
+  version = "6.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
     tag = "v${version}";
-    hash = "sha256-6ZSQFcwuHDgCv301D/7/3QjF9+ZaxXPItvoA+6x0O4U=";
+    hash = "sha256-u4qCQYCpMfM/JCyyKOfTTN7vwh3EvlGnxuslUy/d9Bs=";
   };
 
   build-system = [ setuptools ];

From 2134b7b44120c3b440d7bf081ec9c6ad0a88d5a8 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Wed, 16 Jul 2025 09:34:19 +0200
Subject: [PATCH 134/190] gimp: fix build with gettext 0.25

---
 pkgs/applications/graphics/gimp/2.0/default.nix | 5 +++++
 pkgs/top-level/all-packages.nix                 | 1 -
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/graphics/gimp/2.0/default.nix b/pkgs/applications/graphics/gimp/2.0/default.nix
index d91dd67a1913..e28e084ccb60 100644
--- a/pkgs/applications/graphics/gimp/2.0/default.nix
+++ b/pkgs/applications/graphics/gimp/2.0/default.nix
@@ -89,6 +89,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./force-enable-libheif.patch
   ];
 
+  # error: possibly undefined macro: AM_NLS
+  preAutoreconf = ''
+    cp ${gettext}/share/gettext/m4/nls.m4 m4macros
+  '';
+
   nativeBuildInputs =
     [
       autoreconfHook # hardcode-plugin-interpreters.patch changes Makefile.am
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 863764b87add..051406104167 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12402,7 +12402,6 @@ with pkgs;
   );
 
   gimp = callPackage ../applications/graphics/gimp/2.0 {
-    autoreconfHook = buildPackages.autoreconfHook269;
     lcms = lcms2;
   };
 

From b0c674021e3876c066aaad5889a4f9c308637961 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Wed, 16 Jul 2025 10:05:16 +0200
Subject: [PATCH 135/190] kitty: 0.42.1 -> 0.42.2

Changelog: https://github.com/kovidgoyal/kitty/releases/tag/v0.42.2
Diff: https://github.com/kovidgoyal/kitty/compare/v0.42.1...v0.42.2
---
 pkgs/by-name/ki/kitty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ki/kitty/package.nix b/pkgs/by-name/ki/kitty/package.nix
index b3c795d14947..41baa10af466 100644
--- a/pkgs/by-name/ki/kitty/package.nix
+++ b/pkgs/by-name/ki/kitty/package.nix
@@ -50,21 +50,21 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.42.1";
+  version = "0.42.2";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     tag = "v${version}";
-    hash = "sha256-dW6WgIi+3GJE4OlwxrnY8SUMCQ37eG19UGNfAU4Ts1o=";
+    hash = "sha256-YDfKYzj5LRx1XaKUpBKo97CMW4jPhVQq0aXx/Qfcdzo=";
   };
 
   goModules =
     (buildGo124Module {
       pname = "kitty-go-modules";
       inherit src version;
-      vendorHash = "sha256-gTzonKFXo1jhTU+bX3+4/5wvvLGDHE/ppUg1ImkVpAs=";
+      vendorHash = "sha256-q5LMyogAqgUFfln7LVkhuXzYSMuYmOif5sj15KkOjB4=";
     }).goModules;
 
   buildInputs =

From ebd4b7c9ab413858bbf94c561b17d6587a2f0ddc Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Wed, 16 Jul 2025 10:05:46 +0200
Subject: [PATCH 136/190] libeufin: update deps

Resolves this issue that was preventing the package from building:

> Could not find org.jetbrains.kotlin:kotlin-stdlib:1.9.0.
---
 pkgs/by-name/li/libeufin/deps.json | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libeufin/deps.json b/pkgs/by-name/li/libeufin/deps.json
index 1019bab940f7..d4055e8af5a9 100644
--- a/pkgs/by-name/li/libeufin/deps.json
+++ b/pkgs/by-name/li/libeufin/deps.json
@@ -813,8 +813,8 @@
   "org/bouncycastle/bcutil-jdk18on/maven-metadata": {
    "xml": {
     "groupId": "org.bouncycastle",
-    "lastUpdated": "20250114201150",
-    "release": "1.80"
+    "lastUpdated": "20250604080934",
+    "release": "1.81"
    }
   },
   "org/checkerframework#checker-qual/3.48.3": {
@@ -1076,6 +1076,10 @@
   "org/jetbrains/kotlin#kotlin-stdlib-common/1.8.20": {
    "pom": "sha256-YFWRuJs3ISfmspxpMl+i9qjEb0aMRdCUEOeOtZ/IChc="
   },
+  "org/jetbrains/kotlin#kotlin-stdlib-common/1.9.0": {
+   "jar": "sha256-KDJ0IEvXwCB4nsRvj45yr0JE1/VQszkqV+XKAGrXqiw=",
+   "pom": "sha256-NmDTanD+s6vknxG5BjPkHTYnNXbwcbDhCdqbOg3wgqU="
+  },
   "org/jetbrains/kotlin#kotlin-stdlib-common/2.0.20": {
    "module": "sha256-tZe3Be/U4tgnFCCQw2BUJlVI7VG09SN38r+JxFlNU28=",
    "pom": "sha256-o11/wINw+TE6S5U7zu7d2F4OHnLTEGLTe/jHeBs/b18="
@@ -1092,6 +1096,10 @@
    "jar": "sha256-45i2eXdiJxi/GP+ZtznH2doGDzP7RYouJSAyIcFq8BA=",
    "pom": "sha256-OkYiFKM26ZVod2lTGx43sMgdjhDJlJzV6nrh14A6AjI="
   },
+  "org/jetbrains/kotlin#kotlin-stdlib/1.9.0": {
+   "jar": "sha256-Na7/vi21qkRgcs7lD87ki3+p4vxRyjfAzH19C8OdlS4=",
+   "pom": "sha256-N3UiY/Ysw+MlCFbiiO5Kc9QQLXJqd2JwNPlIBsjBCso="
+  },
   "org/jetbrains/kotlin#kotlin-stdlib/2.0.20": {
    "jar": "sha256-+xaVlmWaUYNXxLLBb0PcdascSYBWXtS0oxegUOXjkAY=",
    "module": "sha256-3AUdwExqGW8tBtDTya8zufErybT+E5rhKQFAUII2tns=",

From b7657a9acd98caf35916d97ce90d68166f5d3b08 Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Wed, 16 Jul 2025 16:56:19 +0800
Subject: [PATCH 137/190] python3Packages.docling-core: 2.31.2 -> 2.43.0

---
 pkgs/development/python-modules/docling-core/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/docling-core/default.nix b/pkgs/development/python-modules/docling-core/default.nix
index f667e2ac0aa4..8690c2289623 100644
--- a/pkgs/development/python-modules/docling-core/default.nix
+++ b/pkgs/development/python-modules/docling-core/default.nix
@@ -5,6 +5,7 @@
 
   # build-system
   poetry-core,
+  setuptools,
 
   # dependencies
   jsonref,
@@ -28,18 +29,19 @@
 
 buildPythonPackage rec {
   pname = "docling-core";
-  version = "2.31.2";
+  version = "2.43.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-core";
     tag = "v${version}";
-    hash = "sha256-O0GfEoWImDjehCPb8erBdY2gYalj2im8rxdJKEsbUs4=";
+    hash = "sha256-c9TaX4INfTfR3ZpmXbOteHr2R2jAbVzvMk8tO1XV4Nc=";
   };
 
   build-system = [
     poetry-core
+    setuptools
   ];
 
   dependencies = [
@@ -59,7 +61,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "pillow"
-    "typer"
   ];
 
   pythonImportsCheck = [

From 5420ae11ea6a0925e2b6a9e1155a96531e789ab6 Mon Sep 17 00:00:00 2001
From: Alex Martens <alex@thinglab.org>
Date: Wed, 14 May 2025 17:32:05 -0700
Subject: [PATCH 138/190] nixos/minio: harden service

---
 nixos/modules/services/web-servers/minio.nix | 38 ++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/nixos/modules/services/web-servers/minio.nix b/nixos/modules/services/web-servers/minio.nix
index 1f1a595f8700..ec31d06a3924 100644
--- a/nixos/modules/services/web-servers/minio.nix
+++ b/nixos/modules/services/web-servers/minio.nix
@@ -135,6 +135,44 @@ in
                 (legacyCredentials cfg)
               else
                 null;
+
+            # hardening
+            DevicePolicy = "closed";
+            CapabilityBoundingSet = "";
+            RestrictAddressFamilies = [
+              "AF_INET"
+              "AF_INET6"
+              "AF_NETLINK"
+              "AF_UNIX"
+            ];
+            DeviceAllow = "";
+            NoNewPrivileges = true;
+            PrivateDevices = true;
+            PrivateMounts = true;
+            PrivateTmp = true;
+            PrivateUsers = true;
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            MemoryDenyWriteExecute = true;
+            LockPersonality = true;
+            RemoveIPC = true;
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            SystemCallArchitectures = "native";
+            SystemCallFilter = [
+              "@system-service"
+              "~@privileged"
+            ];
+            ProtectProc = "invisible";
+            ProtectHostname = true;
+            UMask = "0077";
+            # minio opens /proc/mounts on startup
+            ProcSubset = "all";
           };
           environment = {
             MINIO_REGION = "${cfg.region}";

From f22b522642dae1e65a370b5a79605e6b9ba98643 Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Wed, 16 Jul 2025 17:21:34 +0800
Subject: [PATCH 139/190] docling: 2.31.2 -> 2.41.0

---
 pkgs/development/python-modules/docling/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/docling/default.nix b/pkgs/development/python-modules/docling/default.nix
index e8d7bd7654bf..42e4900744da 100644
--- a/pkgs/development/python-modules/docling/default.nix
+++ b/pkgs/development/python-modules/docling/default.nix
@@ -52,14 +52,14 @@
 
 buildPythonPackage rec {
   pname = "docling";
-  version = "2.31.2";
+  version = "2.41.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling";
     tag = "v${version}";
-    hash = "sha256-a2PZORT4Umf6AI3yEDDcUD0tm22Ahzm7Dwij/5ZUjNs=";
+    hash = "sha256-GD052HCqBLs+KUkOUOVdlXxS6+PD2pthGtz+zdQ6QnM=";
   };
 
   build-system = [
@@ -102,7 +102,6 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "pillow"
-    "typer"
   ];
 
   optional-dependencies = {
@@ -160,10 +159,14 @@ buildPythonPackage rec {
     "test_convert_stream"
     "test_compare_legacy_output"
     "test_ocr_coverage_threshold"
+    "test_formula_conversion_with_page_range"
 
     # requires network access
     "test_page_range"
     "test_parser_backends"
+    "test_confidence"
+    "test_e2e_webp_conversions"
+    "test_asr_pipeline_conversion"
 
     # AssertionError: pred_itxt==true_itxt
     "test_e2e_valid_csv_conversions"

From 42e21ee3fef148e0fc4fd48b0d754caabe8a2578 Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Wed, 16 Jul 2025 17:32:43 +0800
Subject: [PATCH 140/190] python3Packages.docling-serve: 0.11.0 -> 0.14.0

---
 pkgs/development/python-modules/docling-serve/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/docling-serve/default.nix b/pkgs/development/python-modules/docling-serve/default.nix
index d0c27dd14a5a..07c5e977dcf3 100644
--- a/pkgs/development/python-modules/docling-serve/default.nix
+++ b/pkgs/development/python-modules/docling-serve/default.nix
@@ -13,6 +13,7 @@
   uvicorn,
   websockets,
   tesserocr,
+  typer,
   rapidocr-onnxruntime,
   onnxruntime,
   torch,
@@ -28,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "docling-serve";
-  version = "0.11.0";
+  version = "0.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-serve";
     tag = "v${version}";
-    hash = "sha256-dPCD7Ovc6Xiga+gYOwg0mJIIhHywVOyxKIAFF5XUsYw=";
+    hash = "sha256-R8W/FXKj2wLJOcjwIsna/2wFOLGM80Qr3WlYPJTTSNU=";
   };
 
   postPatch = ''
@@ -53,7 +54,7 @@ buildPythonPackage rec {
   ];
 
   pythonRemoveDeps = [
-    "mlx-vlm" # not yet avainable on nixpkgs
+    "mlx-vlm" # not yet available on nixpkgs
   ];
 
   dependencies =
@@ -63,6 +64,7 @@ buildPythonPackage rec {
       httpx
       pydantic-settings
       python-multipart
+      typer
       uvicorn
       websockets
     ]

From fa9a2b5e1378fb5f345ccf91f7acc0d452ffdc21 Mon Sep 17 00:00:00 2001
From: Luflosi <luflosi@luflosi.de>
Date: Tue, 15 Jul 2025 23:12:26 +0200
Subject: [PATCH 141/190] kubo: fix source hash

The tarball was changed for some reason. I compared the two archives and the only difference I could find were newer timestamps.
---
 pkgs/by-name/ku/kubo/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ku/kubo/package.nix b/pkgs/by-name/ku/kubo/package.nix
index 72e95894d686..4c887e9c1dc2 100644
--- a/pkgs/by-name/ku/kubo/package.nix
+++ b/pkgs/by-name/ku/kubo/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
   # Kubo makes changes to its source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-KrNP3JMkyTo6hghLLGWerH1Oz3HsnTI5jCfqRbp6AR8=";
+    hash = "sha256-JbWt6d1cX3F2lmivjszcxcyE+wKYk+Sy03xhb4E3oHw=";
   };
 
   # tarball contains multiple files/directories

From ff86cbb5c2d89dcd0cbbc5e7fd0de780ab65a59f Mon Sep 17 00:00:00 2001
From: Gliczy <129636582+Gliczy@users.noreply.github.com>
Date: Sun, 13 Jul 2025 19:11:19 +0200
Subject: [PATCH 142/190] scx.full: 1.0.13 -> 1.0.14

---
 pkgs/os-specific/linux/scx/scx_cscheds.nix | 4 ++++
 pkgs/os-specific/linux/scx/version.json    | 6 +++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/scx/scx_cscheds.nix b/pkgs/os-specific/linux/scx/scx_cscheds.nix
index 6d97e12447fa..d262c8b0d513 100644
--- a/pkgs/os-specific/linux/scx/scx_cscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_cscheds.nix
@@ -67,6 +67,10 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     cp ${finalAttrs.fetchLibbpf} meson-scripts/fetch_libbpf
     substituteInPlace meson.build \
       --replace-fail '[build_bpftool' "['${misbehaviorBash}', build_bpftool"
+
+    # TODO: Remove in next release.
+    substituteInPlace lib/scxtest/overrides.h \
+      --replace-fail '#define __builtin_preserve_enum_value(x,y,z) 1' '#define __builtin_preserve_enum_value(x,y) 1'
   '';
 
   nativeBuildInputs =
diff --git a/pkgs/os-specific/linux/scx/version.json b/pkgs/os-specific/linux/scx/version.json
index f517f6679ee3..822e674361ed 100644
--- a/pkgs/os-specific/linux/scx/version.json
+++ b/pkgs/os-specific/linux/scx/version.json
@@ -1,8 +1,8 @@
 {
   "scx": {
-    "version": "1.0.13",
-    "hash": "sha256-uSYkAsDZEWJ7sB6jd7PZrwYepeLlTdiTi4kAgSDeVsU=",
-    "cargoHash": "sha256-+JDe7l4wX2balOUD11M9z60JSaRyMaIO7Pw1NrjnE30="
+    "version": "1.0.14",
+    "hash": "sha256-Wh+8vaQO93Erj+z8S2C633UDmUrFjQc3Bg+Nm7EML0E=",
+    "cargoHash": "sha256-6uiDx2/5ZcYkz8x8vuOTEUclIttzxVMvh1Q6QHg9N6E="
   },
   "bpftool": {
     "rev": "183e7010387d1fc9f08051426e9a9fbd5f8d409e",

From a15f79a5d2abace70512fe3bdd2b7338baa85c1d Mon Sep 17 00:00:00 2001
From: John Titor <50095635+JohnRTitor@users.noreply.github.com>
Date: Wed, 16 Jul 2025 14:19:19 +0530
Subject: [PATCH 143/190] scx.cscheds: fix build

by doing this in postFixup, we hopefully don't create a cycle
here obviously this is a dirty fix, but better solutions can be
thought later
Closes https://github.com/NixOS/nixpkgs/issues/425498

Signed-off-by: John Titor <50095635+JohnRTitor@users.noreply.github.com>
---
 pkgs/os-specific/linux/scx/scx_cscheds.nix    | 7 +++----
 pkgs/os-specific/linux/scx/scx_rustscheds.nix | 3 +--
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/os-specific/linux/scx/scx_cscheds.nix b/pkgs/os-specific/linux/scx/scx_cscheds.nix
index d262c8b0d513..e024239ccb50 100644
--- a/pkgs/os-specific/linux/scx/scx_cscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_cscheds.nix
@@ -118,10 +118,9 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
 
   # We copy the compiled header files to the dev output
   # These are needed for the rust schedulers
-  preInstall = ''
-    mkdir -p ${placeholder "dev"}/libbpf ${placeholder "dev"}/bpftool
-    cp -r libbpf/* ${placeholder "dev"}/libbpf/
-    cp -r bpftool/* ${placeholder "dev"}/bpftool/
+  postFixup = ''
+    mkdir -p ${placeholder "dev"}
+    cp -r libbpf ${placeholder "dev"}
   '';
 
   outputs = [
diff --git a/pkgs/os-specific/linux/scx/scx_rustscheds.nix b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
index ed58e7bc7726..5678a8a788ba 100644
--- a/pkgs/os-specific/linux/scx/scx_rustscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
@@ -20,8 +20,7 @@ rustPlatform.buildRustPackage {
 
   # Copy compiled headers and libs from scx.cscheds
   postPatch = ''
-    mkdir bpftool libbpf
-    cp -r ${scx.cscheds.dev}/bpftool/* bpftool/
+    mkdir libbpf
     cp -r ${scx.cscheds.dev}/libbpf/* libbpf/
   '';
 

From b46cb23251b43bd963ea48fd414fd2cf9ac739f6 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 13 Jul 2025 19:42:12 +0200
Subject: [PATCH 144/190] ci/github-script/commits: init from
 ci/check-cherry-picks

This turns the check-cherry-pick script into a github-script based
JavaScript program. This makes it much easier to extend to check reverts
or merge commits later on.
---
 .github/workflows/check.yml                  |  37 +---
 ci/check-cherry-picks.sh                     | 152 --------------
 ci/github-script/.gitignore                  |   1 +
 ci/github-script/README.md                   |   4 +
 ci/{ => github-script}/check-cherry-picks.md |   0
 ci/github-script/commits.js                  | 199 +++++++++++++++++++
 ci/github-script/run                         |  58 ++++--
 ci/github-script/withRateLimit.js            |   2 +
 8 files changed, 252 insertions(+), 201 deletions(-)
 delete mode 100755 ci/check-cherry-picks.sh
 rename ci/{ => github-script}/check-cherry-picks.md (100%)
 create mode 100644 ci/github-script/commits.js

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index d77bbceb07f1..04f38641323c 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -45,42 +45,25 @@ jobs:
           filter: tree:0
           path: trusted
 
-      - name: Check cherry-picks
-        id: check
-        continue-on-error: true
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          ./trusted/ci/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA" checked-cherry-picks.md
+      - name: Install dependencies
+        run: npm install bottleneck
 
       - name: Log current API rate limits
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh api /rate_limit | jq
 
-      - name: Prepare review
-        if: steps.check.outcome == 'failure'
+      - name: Check cherry-picks
+        id: check
+        continue-on-error: true
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
-            const { readFile, writeFile } = require('node:fs/promises')
-
-            const job_url = (await github.rest.actions.listJobsForWorkflowRun({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              run_id: context.runId
-            })).data.jobs[0].html_url + '?pr=' + context.payload.pull_request.number
-
-            const header = await readFile('trusted/ci/check-cherry-picks.md')
-            const body = await readFile('checked-cherry-picks.md')
-            const footer =
-              `\n_Hint: The full diffs are also available in the [runner logs](${job_url}) with slightly better highlighting._`
-
-            const review = header + body + footer
-            await writeFile('review.md', review)
-            core.summary.addRaw(review)
-            core.summary.write()
+            require('./trusted/ci/github-script/commits.js')({
+              github,
+              context,
+              core,
+            })
 
       - name: Request changes
         if: ${{ github.event_name == 'pull_request_target' && steps.check.outcome == 'failure' }}
diff --git a/ci/check-cherry-picks.sh b/ci/check-cherry-picks.sh
deleted file mode 100755
index 113828f6ee1c..000000000000
--- a/ci/check-cherry-picks.sh
+++ /dev/null
@@ -1,152 +0,0 @@
-#!/usr/bin/env bash
-# Find alleged cherry-picks
-
-set -euo pipefail
-
-if [[ $# != "2" && $# != "3" ]] ; then
-  echo "usage: check-cherry-picks.sh base_rev head_rev [markdown_file]"
-  exit 2
-fi
-
-markdown_file="$(realpath ${3:-/dev/null})"
-[ -v 3 ] && rm -f "$markdown_file"
-
-# Make sure we are inside the nixpkgs repo, even when called from outside
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-PICKABLE_BRANCHES="master staging release-??.?? staging-??.?? haskell-updates python-updates staging-next staging-next-??.??"
-problem=0
-
-# Not everyone calls their remote "origin"
-remote="$(git remote -v | grep -i 'NixOS/nixpkgs' | head -n1 | cut -f1 || true)"
-
-commits="$(git rev-list --reverse "$1..$2")"
-
-log() {
-  type="$1"
-  shift 1
-
-  local -A prefix
-  prefix[success]="  ✔ "
-  if [ -v GITHUB_ACTIONS ]; then
-    prefix[warning]="::warning::"
-    prefix[error]="::error::"
-  else
-    prefix[warning]="  ⚠ "
-    prefix[error]="  ✘ "
-  fi
-
-  echo "${prefix[$type]}$@"
-
-  # Only logging errors and warnings, which allows comparing the markdown file
-  # between pushes to the PR. Even if a new, proper cherry-pick, commit is added
-  # it won't change the markdown file's content and thus not trigger another comment.
-  if [ "$type" != "success" ]; then
-    local -A alert
-    alert[warning]="WARNING"
-    alert[error]="CAUTION"
-    echo >> $markdown_file
-    echo "> [!${alert[$type]}]" >> $markdown_file
-    echo "> $@" >> $markdown_file
-  fi
-}
-
-endgroup() {
-  if [ -v GITHUB_ACTIONS ] ; then
-    echo ::endgroup::
-  fi
-}
-
-while read -r new_commit_sha ; do
-  if [ -v GITHUB_ACTIONS ] ; then
-    echo "::group::Commit $new_commit_sha"
-  else
-    echo "================================================="
-  fi
-  git rev-list --max-count=1 --format=medium "$new_commit_sha"
-  echo "-------------------------------------------------"
-
-  # Using the last line with "cherry" + hash, because a chained backport
-  # can result in multiple of those lines. Only the last one counts.
-  original_commit_sha=$(
-    git rev-list --max-count=1 --format=format:%B "$new_commit_sha" \
-    | grep -Ei "cherry.*[0-9a-f]{40}" | tail -n1 \
-    | grep -Eoi -m1 '[0-9a-f]{40}' || true
-  )
-  if [ -z "$original_commit_sha" ] ; then
-    endgroup
-    log warning "Couldn't locate original commit hash in message of $new_commit_sha."
-    problem=1
-    continue
-  fi
-
-  set -f # prevent pathname expansion of patterns
-  for pattern in $PICKABLE_BRANCHES ; do
-    set +f # re-enable pathname expansion
-
-    # Reverse sorting by refname and taking one match only means we can only backport
-    # from unstable and the latest stable. That makes sense, because even right after
-    # branch-off, when we have two supported stable branches, we only ever want to cherry-pick
-    # **to** the older one, but never **from** it.
-    # This makes the job significantly faster in the case when commits can't be found,
-    # because it doesn't need to iterate through 20+ branches, which all need to be fetched.
-    branches="$(git for-each-ref --sort=-refname --format="%(refname)" \
-      "refs/remotes/${remote:-origin}/$pattern" | head -n1)"
-
-    while read -r picked_branch ; do
-      if git merge-base --is-ancestor "$original_commit_sha" "$picked_branch" ; then
-        range_diff_common='git --no-pager range-diff
-          --no-notes
-          --creation-factor=100
-          '"$original_commit_sha~..$original_commit_sha"'
-          '"$new_commit_sha~..$new_commit_sha"'
-        '
-
-        if $range_diff_common --no-color 2> /dev/null | grep -E '^ {4}[+-]{2}' > /dev/null ; then
-          log success "$original_commit_sha present in branch $picked_branch"
-          endgroup
-          log warning "Difference between $new_commit_sha and original $original_commit_sha may warrant inspection."
-
-          # First line contains commit SHAs, which we already printed.
-          $range_diff_common --color | tail -n +2
-
-          echo -e "> <details><summary>Show diff</summary>\n>" >> $markdown_file
-          echo '> ```diff' >> $markdown_file
-          # The output of `git range-diff` is indented with 4 spaces, which we need to match with the
-          # code blocks indent to get proper syntax highlighting on GitHub.
-          diff="$($range_diff_common | tail -n +2 | sed -Ee 's/^ {4}/> /g')"
-          # Also limit the output to 10k bytes (and remove the last, potentially incomplete line), because
-          # GitHub comments are limited in length. The value of 10k is arbitrary with the assumption, that
-          # after the range-diff becomes a certain size, a reviewer is better off reviewing the regular diff
-          # in GitHub's UI anyway, thus treating the commit as "new" and not cherry-picked.
-          # Note: This could still lead to a too lengthy comment with multiple commits touching the limit. We
-          # consider this too unlikely to happen, to deal with explicitly.
-          max_length=10000
-          if [ "${#diff}" -gt $max_length ]; then
-            printf -v diff "%s\n>\n> [...truncated...]" "$(echo "$diff" | head -c $max_length | head -n-1)"
-          fi
-          echo "$diff" >> $markdown_file
-          echo '> ```' >> $markdown_file
-          echo "> </details>" >> $markdown_file
-
-          problem=1
-        else
-          log success "$original_commit_sha present in branch $picked_branch"
-          log success "$original_commit_sha highly similar to $new_commit_sha"
-          $range_diff_common --color
-          endgroup
-        fi
-
-        # move on to next commit
-        continue 3
-      fi
-    done <<< "$branches"
-  done
-
-  endgroup
-  log error "$original_commit_sha given in $new_commit_sha not found in any pickable branch."
-
-  problem=1
-done <<< "$commits"
-
-exit $problem
diff --git a/ci/github-script/.gitignore b/ci/github-script/.gitignore
index 3c3629e647f5..6b8a37657bc7 100644
--- a/ci/github-script/.gitignore
+++ b/ci/github-script/.gitignore
@@ -1 +1,2 @@
 node_modules
+step-summary.md
diff --git a/ci/github-script/README.md b/ci/github-script/README.md
index caf52eb5bba3..52b78c79d79f 100644
--- a/ci/github-script/README.md
+++ b/ci/github-script/README.md
@@ -8,6 +8,10 @@ To run any of the scripts locally:
 - Enter `nix-shell` in `./ci/github-script`.
 - Ensure `gh` is authenticated.
 
+## Check commits
+
+Run `./run commits OWNER REPO PR`, where OWNER is your username or "NixOS", REPO is the name of your fork or "nixpkgs" and PR is the number of the pull request to check.
+
 ## Labeler
 
 Run `./run labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
diff --git a/ci/check-cherry-picks.md b/ci/github-script/check-cherry-picks.md
similarity index 100%
rename from ci/check-cherry-picks.md
rename to ci/github-script/check-cherry-picks.md
diff --git a/ci/github-script/commits.js b/ci/github-script/commits.js
new file mode 100644
index 000000000000..99e969591045
--- /dev/null
+++ b/ci/github-script/commits.js
@@ -0,0 +1,199 @@
+module.exports = async function ({ github, context, core }) {
+  const { execFileSync } = require('node:child_process')
+  const { readFile, writeFile } = require('node:fs/promises')
+  const { join } = require('node:path')
+  const { classify } = require('../supportedBranches.js')
+  const withRateLimit = require('./withRateLimit.js')
+
+  await withRateLimit({ github, core }, async (stats) => {
+    stats.prs = 1
+
+    const job_url =
+      context.runId &&
+      (
+        await github.rest.actions.listJobsForWorkflowRun({
+          ...context.repo,
+          run_id: context.runId,
+        })
+      ).data.jobs[0].html_url +
+        '?pr=' +
+        context.payload.pull_request.number
+
+    async function handle({ sha, commit }) {
+      // Using the last line with "cherry" + hash, because a chained backport
+      // can result in multiple of those lines. Only the last one counts.
+      const match = Array.from(
+        commit.message.matchAll(/cherry.*([0-9a-f]{40})/g),
+      ).at(-1)
+
+      if (!match)
+        return {
+          sha,
+          commit,
+          severity: 'warning',
+          message: `Couldn't locate original commit hash in message of ${sha}.`,
+        }
+
+      const original_sha = match[1]
+
+      let branches
+      try {
+        branches = (
+          await github.request({
+            // This is an undocumented endpoint to fetch the branches a commit is part of.
+            // There is no equivalent in neither the REST nor the GraphQL API.
+            // The endpoint itself is unlikely to go away, because GitHub uses it to display
+            // the list of branches on the detail page of a commit.
+            url: `https://github.com/${context.repo.owner}/${context.repo.repo}/branch_commits/${original_sha}`,
+            headers: {
+              accept: 'application/json',
+            },
+          })
+        ).data.branches
+          .map(({ branch }) => branch)
+          .filter((branch) => classify(branch).type.includes('development'))
+      } catch (e) {
+        // For some unknown reason a 404 error comes back as 500 without any more details in a GitHub Actions runner.
+        // Ignore these to return a regular error message below.
+        if (![404, 500].includes(e.status)) throw e
+      }
+      if (!branches?.length)
+        return {
+          sha,
+          commit,
+          severity: 'error',
+          message: `${original_sha} given in ${sha} not found in any pickable branch.`,
+        }
+
+      const diff = execFileSync('git', [
+        '-C',
+        __dirname,
+        'range-diff',
+        '--no-color',
+        '--no-notes',
+        '--creation-factor=100',
+        `${original_sha}~..${original_sha}`,
+        `${sha}~..${sha}`,
+      ])
+        .toString()
+        .split('\n')
+        // First line contains commit SHAs, which we'll print separately.
+        .slice(1)
+        // # The output of `git range-diff` is indented with 4 spaces, but we'll control indentation manually.
+        .map((line) => line.replace(/^ {4}/, ''))
+
+      if (!diff.some((line) => line.match(/^[+-]{2}/)))
+        return {
+          sha,
+          commit,
+          severity: 'info',
+          message: `✔ ${original_sha} is highly similar to ${sha}.`,
+        }
+
+      const colored_diff = execFileSync('git', [
+        '-C',
+        __dirname,
+        'range-diff',
+        '--color',
+        '--no-notes',
+        '--creation-factor=100',
+        `${original_sha}~..${original_sha}`,
+        `${sha}~..${sha}`,
+      ]).toString()
+
+      return {
+        sha,
+        commit,
+        diff,
+        colored_diff,
+        severity: 'warning',
+        message: `Difference between ${sha} and original ${original_sha} may warrant inspection.`,
+      }
+    }
+
+    const commits = await github.paginate(github.rest.pulls.listCommits, {
+      ...context.repo,
+      pull_number: context.payload.pull_request.number,
+    })
+
+    const results = await Promise.all(commits.map(handle))
+
+    // Log all results without truncation and with better highlighting to the job log.
+    results.forEach(({ sha, commit, severity, message, colored_diff }) => {
+      core.startGroup(`Commit ${sha}`)
+      core.info(`Author: ${commit.author.name} ${commit.author.email}`)
+      core.info(`Date: ${new Date(commit.author.date)}`)
+      core[severity](message)
+      core.endGroup()
+      if (colored_diff) core.info(colored_diff)
+    })
+
+    // Only create step summary below in case of warnings or errors.
+    if (results.every(({ severity }) => severity == 'info')) return
+    else process.exitCode = 1
+
+    core.summary.addRaw(
+      await readFile(join(__dirname, 'check-cherry-picks.md'), 'utf-8'),
+      true,
+    )
+    results.forEach(({ severity, message, diff }) => {
+      if (severity == 'info') return
+
+      // The docs for markdown alerts only show examples with markdown blockquote syntax, like this:
+      //   > [!WARNING]
+      //   > message
+      // However, our testing shows that this also works with a `<blockquote>` html tag, as long as there
+      // is an empty line:
+      //   <blockquote>
+      //
+      //   [!WARNING]
+      //   message
+      //   </blockquote>
+      // Whether this is intended or just an implementation detail is unclear.
+      core.summary.addRaw('<blockquote>')
+      core.summary.addRaw(
+        `\n\n[!${severity == 'warning' ? 'WARNING' : 'CAUTION'}]`,
+        true,
+      )
+      core.summary.addRaw(`${message}`, true)
+
+      if (diff) {
+        // Limit the output to 10k bytes and remove the last, potentially incomplete line, because GitHub
+        // comments are limited in length. The value of 10k is arbitrary with the assumption, that after
+        // the range-diff becomes a certain size, a reviewer is better off reviewing the regular diff in
+        // GitHub's UI anyway, thus treating the commit as "new" and not cherry-picked.
+        // Note: if multiple commits are close to the limit, this approach could still lead to a comment
+        // that's too long. We think this is unlikely to happen, and so don't deal with it explicitly.
+        const truncated = []
+        let total_length = 0
+        for (line of diff) {
+          total_length += line.length
+          if (total_length > 10000) {
+            truncated.push('', '[...truncated...]')
+            break
+          } else {
+            truncated.push(line)
+          }
+        }
+
+        core.summary.addRaw('<details><summary>Show diff</summary>')
+        core.summary.addRaw('\n\n```diff', true)
+        core.summary.addRaw(truncated.join('\n'), true)
+        core.summary.addRaw('```', true)
+        core.summary.addRaw('</details>')
+      }
+
+      core.summary.addRaw('</blockquote>')
+    })
+
+    if (job_url)
+      core.summary.addRaw(
+        `\n\n_Hint: The full diffs are also available in the [runner logs](${job_url}) with slightly better highlighting._`,
+      )
+
+    // Write to disk temporarily for next step in GHA.
+    await writeFile('review.md', core.summary.stringify())
+
+    core.summary.write()
+  })
+}
diff --git a/ci/github-script/run b/ci/github-script/run
index 03309352aeee..3fe6e189eb96 100755
--- a/ci/github-script/run
+++ b/ci/github-script/run
@@ -1,13 +1,13 @@
 #!/usr/bin/env -S node --import ./run
 import { execSync } from 'node:child_process'
-import { mkdtempSync, rmSync } from 'node:fs'
+import { closeSync, mkdtempSync, openSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { program } from 'commander'
 import * as core from '@actions/core'
 import { getOctokit } from '@actions/github'
 
-async function run(action, owner, repo, pull_number, dry) {
+async function run(action, owner, repo, pull_number, dry = true) {
   const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
 
   const github = getOctokit(token)
@@ -20,29 +20,36 @@ async function run(action, owner, repo, pull_number, dry) {
     })).data
   }
 
-  const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
-  try {
-    process.env.GITHUB_WORKSPACE = tmp
-    process.env['INPUT_GITHUB-TOKEN'] = token
-    process.chdir(tmp)
+  process.env['INPUT_GITHUB-TOKEN'] = token
 
-    await action({
-      github,
-      context: {
-        payload,
-        repo: {
-          owner,
-          repo,
-        },
+  closeSync(openSync('step-summary.md', 'w'))
+  process.env.GITHUB_STEP_SUMMARY = 'step-summary.md'
+
+  await action({
+    github,
+    context: {
+      payload,
+      repo: {
+        owner,
+        repo,
       },
-      core,
-      dry,
-    })
-  } finally {
-    rmSync(tmp, { recursive: true })
-  }
+    },
+    core,
+    dry,
+  })
 }
 
+program
+  .command('commits')
+  .description('Check commit structure of a pull request.')
+  .argument('<owner>', 'Owner of the GitHub repository to check (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to check (Example: nixpkgs)')
+  .argument('<pr>', 'Number of the Pull Request to check')
+  .action(async (owner, repo, pr) => {
+    const commits = (await import('./commits.js')).default
+    run(commits, owner, repo, pr)
+  })
+
 program
   .command('labels')
   .description('Manage labels on pull requests.')
@@ -52,7 +59,14 @@ program
   .option('--no-dry', 'Make actual modifications')
   .action(async (owner, repo, pr, options) => {
     const labels = (await import('./labels.js')).default
-    run(labels, owner, repo, pr, options.dry)
+    const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
+    try {
+      process.env.GITHUB_WORKSPACE = tmp
+      process.chdir(tmp)
+      run(labels, owner, repo, pr, options.dry)
+    } finally {
+      rmSync(tmp, { recursive: true })
+    }
   })
 
 await program.parse()
diff --git a/ci/github-script/withRateLimit.js b/ci/github-script/withRateLimit.js
index 03fbd54291a8..ff97c7173fcf 100644
--- a/ci/github-script/withRateLimit.js
+++ b/ci/github-script/withRateLimit.js
@@ -20,6 +20,8 @@ module.exports = async function ({ github, core }, callback) {
   // Pause between mutative requests
   const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
   github.hook.wrap('request', async (request, options) => {
+    // Requests to a different host do not count against the rate limit.
+    if (options.url.startsWith('https://github.com')) return request(options)
     // Requests to the /rate_limit endpoint do not count against the rate limit.
     if (options.url == '/rate_limit') return request(options)
     // Search requests are in a different resource group, which allows 30 requests / minute.

From 3c51f84b8b24e17033dff4ab4036728f9a7015be Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 10:23:24 +0000
Subject: [PATCH 145/190] reaper: 7.41 -> 7.42

---
 pkgs/applications/audio/reaper/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index de30231efad5..727ac9c201f8 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -38,17 +38,17 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "7.41";
+  version = "7.42";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
     hash =
       if stdenv.hostPlatform.isDarwin then
-        "sha256-A4MM+hcpyhw6zE18fSSHBu38A0cYiXzjmM5wqj0Cgzk="
+        "sha256-3K2cgOwBRwm/S4MRcymKCxRhUMkcfuWzWn1G2m3Dbf4="
       else
         {
-          x86_64-linux = "sha256-9M3WZijLTeKt2Asg3cE1OgS6tm1T4V0Cer9J4GPfTh4=";
-          aarch64-linux = "sha256-/Ir1UFUOZOEZPkTG3ykHy6PcOuDf/rbvxOeRt5iJzls=";
+          x86_64-linux = "sha256-XxVcy3s3gOnh6uhv9r0yJFwBMCxhrnT/swaUY4t1CpY=";
+          aarch64-linux = "sha256-3DKVyooYi6aSBzP4DSnIchGyHKbCANjX0TPspKf5dXU=";
         }
         .${stdenv.hostPlatform.system};
   };

From 3689b5e9ae6482af742dda2367956ef41fa5f7ee Mon Sep 17 00:00:00 2001
From: "Alexander V. Nikolaev" <avn@avnik.info>
Date: Mon, 2 Jun 2025 20:32:00 +0300
Subject: [PATCH 146/190] wine64Packages.{unstable,staging}: 10.7 -> 10.9

---
 pkgs/applications/emulators/wine/sources.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 5763deb79b98..c5e76d91535f 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -132,9 +132,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.7";
+    version = "10.9";
     url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-dRNnoxCZkNcD5ZDi21MBh8Th39Lo5hNzq4S0L+EbGPo=";
+    hash = "sha256-wrruO0SGgicFYFz9EVn5YPMZ8O7jPAqnw4CumDtwzO4=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -144,7 +144,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-4doo7B3eEoQaml6KX02OhcLGGiLcgNhYq4ry/iB7kLc=";
+      hash = "sha256-ijHy/Q/FRgWEFLHxZVC8H8IxBZutGrge/3I1zxTWEqU=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";

From e23883f0175ec1ec268c4042c0fba94fedc71408 Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Sat, 12 Jul 2025 16:54:12 +0200
Subject: [PATCH 147/190] meli: include notmuch in LD_LIBRARY_PATH by default

---
 pkgs/by-name/me/meli/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/me/meli/package.nix b/pkgs/by-name/me/meli/package.nix
index d713ff827a6e..9866542ac963 100644
--- a/pkgs/by-name/me/meli/package.nix
+++ b/pkgs/by-name/me/meli/package.nix
@@ -21,6 +21,9 @@
   # runtime deps
   gpgme,
   gnum4,
+
+  withNotmuch ? true,
+  notmuch,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -66,7 +69,9 @@ rustPlatform.buildRustPackage rec {
     installManPage meli/docs/*.{1,5,7}
 
     wrapProgram $out/bin/meli \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gpgme ]} \
+      --prefix LD_LIBRARY_PATH : ${
+        lib.makeLibraryPath ([ gpgme ] ++ lib.optional withNotmuch notmuch)
+      } \
       --prefix PATH : ${lib.makeBinPath [ gnum4 ]}
   '';
 

From d42173f88bfc1324f5b000d5972eeea5d2c66c85 Mon Sep 17 00:00:00 2001
From: "Alexander V. Nikolaev" <avn@avnik.info>
Date: Sun, 15 Jun 2025 18:20:06 +0300
Subject: [PATCH 148/190] wine64Packages.{unstable,staging}: 10.9 -> 10.10

---
 pkgs/applications/emulators/wine/sources.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index c5e76d91535f..186951e6038f 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -132,9 +132,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.9";
+    version = "10.10";
     url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-wrruO0SGgicFYFz9EVn5YPMZ8O7jPAqnw4CumDtwzO4=";
+    hash = "sha256-52Rmpcoxl/OZ3fgGmwp55est/+Wzt9uetyciiDMMhZY=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -144,7 +144,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-ijHy/Q/FRgWEFLHxZVC8H8IxBZutGrge/3I1zxTWEqU=";
+      hash = "sha256-+aZG8VCoeo9sNgZiEnvpRaik/Mvsj95q1uRbRv576xA=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";
@@ -167,9 +167,9 @@ rec {
 
     ## see http://wiki.winehq.org/Mono
     mono = fetchurl rec {
-      version = "10.0.0";
+      version = "10.1.0";
       url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-26ynPl0J96OnwVetBCia+cpHw87XAS1GVEpgcEaQK4c=";
+      hash = "sha256-yIwkMYkLwyys7I1+pw5Tpa5LlcjFXKbnXvjbDkzPEHA=";
     };
 
     updateScript = writeShellScript "update-wine-unstable" ''

From 0d86e4614ba4d746b6338b60a2112bd896d2572e Mon Sep 17 00:00:00 2001
From: "Alexander V. Nikolaev" <avn@avnik.info>
Date: Mon, 30 Jun 2025 20:28:23 +0300
Subject: [PATCH 149/190] wine64Packages.{unstable,staging}: 10.10 -> 10.11

---
 pkgs/applications/emulators/wine/sources.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 186951e6038f..fa8ca0ec687d 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -132,9 +132,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.10";
+    version = "10.11";
     url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-52Rmpcoxl/OZ3fgGmwp55est/+Wzt9uetyciiDMMhZY=";
+    hash = "sha256-GFvphpm5FLwp5yRDCUeYa7eKhn5i5CLwDHU0GTK2eM4=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -144,7 +144,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-+aZG8VCoeo9sNgZiEnvpRaik/Mvsj95q1uRbRv576xA=";
+      hash = "sha256-TnUqKi4VXaA67UnF2wPULDCO1lPxO6Sk0wgofbvz6L4=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";

From 415a341b8ad3e0973053d246b6625dfd66e8b6ec Mon Sep 17 00:00:00 2001
From: "Alexander V. Nikolaev" <avn@avnik.info>
Date: Tue, 15 Jul 2025 13:14:35 +0300
Subject: [PATCH 150/190] wine64Packages.{unstable,staging}: 10.11 -> 10.12

---
 pkgs/applications/emulators/wine/sources.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index fa8ca0ec687d..3c87299d12b3 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -132,9 +132,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.11";
+    version = "10.12";
     url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-GFvphpm5FLwp5yRDCUeYa7eKhn5i5CLwDHU0GTK2eM4=";
+    hash = "sha256-zVcscaPXLof5hJCyKMfCaq6z/eON2eefw7VjkdWZ1r8=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -144,7 +144,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-TnUqKi4VXaA67UnF2wPULDCO1lPxO6Sk0wgofbvz6L4=";
+      hash = "sha256-a5Vw9UVawx/vvTeu6SGxf4C1GwvdmpPJDyuW0PCUob8=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";

From 4e8394cfa77c9e26dbd7ca070f3c33901c31a767 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 16 Jul 2025 13:17:40 +0200
Subject: [PATCH 151/190] esphome: 2025.6.3 -> 2025.7.0

https://github.com/esphome/esphome/releases/tag/2025.7.0
---
 pkgs/by-name/es/esphome/package.nix | 25 +++++--------------------
 1 file changed, 5 insertions(+), 20 deletions(-)

diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 28a769b5bff1..018a519aa37c 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -34,14 +34,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.6.3";
+  version = "2025.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = version;
-    hash = "sha256-3Xcxn12QKQg0jxdOPP7y01YaikvxmPPX9JL2JBvdsUM=";
+    hash = "sha256-EUnptlO9Ya6GWLP7FU3gWOAs2O5xzrHhyHr8LpomapY=";
   };
 
   build-system = with python.pkgs; [
@@ -82,6 +82,7 @@ python.pkgs.buildPythonApplication rec {
     esphome-glyphsets
     freetype-py
     icmplib
+    jinja2
     kconfiglib
     packaging
     paho-mqtt
@@ -135,25 +136,9 @@ python.pkgs.buildPythonApplication rec {
     ]
     ++ [ versionCheckHook ];
 
-  disabledTests = [
-    # race condition, also visible in upstream tests
-    # tests/dashboard/test_web_server.py:78: IndexError
-    "test_devices_page"
-
+  disabledTestPaths = [
     # platformio builds; requires networking for dependency resolution
-    "test_api_message_size_batching"
-    "test_host_mode_basic"
-    "test_host_mode_batch_delay"
-    "test_host_mode_empty_string_options"
-    "test_host_mode_entity_fields"
-    "test_host_mode_fan_preset"
-    "test_host_mode_many_entities"
-    "test_host_mode_many_entities_multiple_connections"
-    "test_host_mode_noise_encryption"
-    "test_host_mode_noise_encryption_wrong_key"
-    "test_host_mode_reconnect"
-    "test_host_mode_with_sensor"
-    "test_large_message_batching"
+    "tests/integration"
   ];
 
   preCheck = ''

From d709e7915788297f013d382b3c821f7d5187b21a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 15 Jul 2025 09:26:36 +0200
Subject: [PATCH 152/190] nix-ld: 2.0.4 -> 2.0.5

nix-ld: 2.0.4 -> 2.0.5
---
 pkgs/by-name/ni/nix-ld/package.nix     |  9 +++----
 pkgs/by-name/ni/nix-ld/rust-1.88.patch | 33 --------------------------
 2 files changed, 3 insertions(+), 39 deletions(-)
 delete mode 100644 pkgs/by-name/ni/nix-ld/rust-1.88.patch

diff --git a/pkgs/by-name/ni/nix-ld/package.nix b/pkgs/by-name/ni/nix-ld/package.nix
index dd659a0aeebc..c82819d3554e 100644
--- a/pkgs/by-name/ni/nix-ld/package.nix
+++ b/pkgs/by-name/ni/nix-ld/package.nix
@@ -8,20 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nix-ld";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nix-ld";
     rev = version;
-    hash = "sha256-ULoitJD5bMu0pFvh35cY5EEYywxj4e2fYOpqZwKB1lk=";
+    hash = "sha256-7ev9V128h7ZWi9JsFje6X1OzE5maJfmBMkxohxQysOA=";
   };
 
-  # Submitted upstream: https://github.com/nix-community/nix-ld/pull/169
-  patches = [ ./rust-1.88.patch ];
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-cDbszVjZcomag0HZvXM+17SjDiGS07iPj78zgsXstHc=";
+  cargoHash = "sha256-YR7j2dvZHMBUe0lW7GYFxJV11ZM+gX13NHj2uf3UEbQ=";
 
   hardeningDisable = [ "stackprotector" ];
 
diff --git a/pkgs/by-name/ni/nix-ld/rust-1.88.patch b/pkgs/by-name/ni/nix-ld/rust-1.88.patch
deleted file mode 100644
index dac1fcfa1c8b..000000000000
--- a/pkgs/by-name/ni/nix-ld/rust-1.88.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-diff --git a/src/arch.rs b/src/arch.rs
-index a998697..45ec2cb 100644
---- a/src/arch.rs
-+++ b/src/arch.rs
-@@ -140,7 +140,7 @@ cfg_match! {
-     target_arch = "x86_64" => {
-         pub const ENTRY_TRAMPOLINE: Option<unsafe extern "C" fn() -> !> = Some(entry_trampoline);
- 
--        #[naked]
-+        #[unsafe(naked)]
-         unsafe extern "C" fn entry_trampoline() -> ! {
-             core::arch::naked_asm!(
-                 "lea r10, [rip + {context}]",
-@@ -159,7 +159,7 @@ cfg_match! {
-     target_arch = "aarch64" => {
-         pub const ENTRY_TRAMPOLINE: Option<unsafe extern "C" fn() -> !> = Some(entry_trampoline);
- 
--        #[naked]
-+        #[unsafe(naked)]
-         unsafe extern "C" fn entry_trampoline() -> ! {
-             core::arch::naked_asm!(
-                 "adrp x8, {context}",
-diff --git a/src/sys.rs b/src/sys.rs
-index 109d809..bf085d9 100644
---- a/src/sys.rs
-+++ b/src/sys.rs
-@@ -181,6 +181,5 @@ pub fn new_slice_leak(size: usize) -> Option<&'static mut [u8]> {
- 
- #[cfg(not(test))]
- #[lang = "eh_personality"]
--#[no_mangle]
- pub extern fn rust_eh_personality() {
- }

From 2de11e1e9620fb7695abc3d8f40ae0b0f3dea444 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 16 Jul 2025 13:38:58 +0200
Subject: [PATCH 153/190] buildComposerProject: Drop moreutils dependency

---
 pkgs/build-support/php/builders/v1/hooks/default.nix | 4 ----
 pkgs/build-support/php/builders/v2/hooks/default.nix | 3 ---
 2 files changed, 7 deletions(-)

diff --git a/pkgs/build-support/php/builders/v1/hooks/default.nix b/pkgs/build-support/php/builders/v1/hooks/default.nix
index d10ff7806727..d04d57725dc8 100644
--- a/pkgs/build-support/php/builders/v1/hooks/default.nix
+++ b/pkgs/build-support/php/builders/v1/hooks/default.nix
@@ -3,7 +3,6 @@
   makeSetupHook,
   jq,
   writeShellApplication,
-  moreutils,
   cacert,
   buildPackages,
 }:
@@ -20,7 +19,6 @@ in
     name = "composer-repository-hook.sh";
     propagatedBuildInputs = [
       jq
-      moreutils
       cacert
     ];
     substitutions = {
@@ -32,7 +30,6 @@ in
     name = "composer-install-hook.sh";
     propagatedBuildInputs = [
       jq
-      moreutils
       cacert
     ];
     substitutions = {
@@ -47,7 +44,6 @@ in
     name = "composer-with-plugin-vendor-hook.sh";
     propagatedBuildInputs = [
       jq
-      moreutils
       cacert
     ];
     substitutions = {
diff --git a/pkgs/build-support/php/builders/v2/hooks/default.nix b/pkgs/build-support/php/builders/v2/hooks/default.nix
index e4d6dcd8ffc7..fad926efcf5f 100644
--- a/pkgs/build-support/php/builders/v2/hooks/default.nix
+++ b/pkgs/build-support/php/builders/v2/hooks/default.nix
@@ -3,7 +3,6 @@
   makeSetupHook,
   jq,
   writeShellApplication,
-  moreutils,
   cacert,
   buildPackages,
 }:
@@ -20,7 +19,6 @@ in
     name = "composer-vendor-hook.sh";
     propagatedBuildInputs = [
       jq
-      moreutils
       cacert
     ];
     substitutions = {
@@ -32,7 +30,6 @@ in
     name = "composer-install-hook.sh";
     propagatedBuildInputs = [
       jq
-      moreutils
       cacert
     ];
     substitutions = {

From feb978d508076c09bfa217b878bd79c11e35d8ce Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Wed, 16 Jul 2025 10:48:30 +0200
Subject: [PATCH 154/190] holo-cli: 0.5.0 -> 0.5.0-unstable-2025-07-01

---
 pkgs/by-name/ho/holo-cli/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ho/holo-cli/package.nix b/pkgs/by-name/ho/holo-cli/package.nix
index 6816036a48f1..a37f02d39378 100644
--- a/pkgs/by-name/ho/holo-cli/package.nix
+++ b/pkgs/by-name/ho/holo-cli/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "holo-cli";
-  version = "0.5.0";
+  version = "0.5.0-unstable-2025-07-01";
 
   src = fetchFromGitHub {
     owner = "holo-routing";
     repo = "holo-cli";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-f34M3U7pitWuH1UQa4uJ/scIOAZiUtDXijOk8wZEm+c=";
+    rev = "f04c1d0dcd6d800e079f33b8431b17fa00afeeb1";
+    hash = "sha256-ZJeXGT5oajynk44550W4qz+OZEx7y52Wwy+DYzrHZig=";
   };
 
-  cargoHash = "sha256-s2em9v4SRQdC0aCD4ZXyhNNYnVKkg9XFzxkOlEFHmL0=";
-  passthru.updateScript = nix-update-script { };
+  cargoHash = "sha256-bsoxWjOMzRRtFGEaaqK0/adhGpDcejCIY0Pzw1HjQ5U=";
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
   # Use rust nightly features
   RUSTC_BOOTSTRAP = 1;

From 0f964599a57346d0408372e4df7652908cac6abe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 16 Jul 2025 14:14:03 +0200
Subject: [PATCH 155/190] nixos/nginx: remove usage of recommendedZstdSettings
 and zstd settings duplication

---
 nixos/modules/services/web-servers/nginx/default.nix | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 3eaed22f3d35..6eeca99434e1 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -171,14 +171,6 @@ let
           quic_bpf on;
         ''}
 
-        ${optionalString cfg.experimentalZstdSettings ''
-          zstd on;
-          zstd_comp_level 9;
-          zstd_min_length 256;
-          zstd_static on;
-          zstd_types ${lib.concatStringsSep " " compressMimeTypes};
-        ''}
-
         ${cfg.config}
 
         ${optionalString (cfg.eventsConfig != "" || cfg.config == "") ''
@@ -250,7 +242,7 @@ let
               ''
             }
 
-            ${optionalString cfg.recommendedZstdSettings ''
+            ${optionalString cfg.experimentalZstdSettings ''
               zstd on;
               zstd_comp_level 9;
               zstd_min_length 256;

From 59c6bfcfaa069d22194e8def4ec361cb61c701ca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 12:17:30 +0000
Subject: [PATCH 156/190] mongodb-atlas-cli: 1.45.1 -> 1.46.2

---
 pkgs/by-name/mo/mongodb-atlas-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
index f89270b5432a..949160710bda 100644
--- a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
+++ b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
@@ -10,15 +10,15 @@
 
 buildGoModule rec {
   pname = "mongodb-atlas-cli";
-  version = "1.45.1";
+  version = "1.46.2";
 
-  vendorHash = "sha256-4qkB2PdMiMtyxdHodwR+w9Lbt1JaT1/wUS+h23ajDD4=";
+  vendorHash = "sha256-z42tJJD/iK9GDnYxdeMYogaMviGABizxX9fdWL8vVik=";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongodb-atlas-cli";
     rev = "refs/tags/atlascli/v${version}";
-    sha256 = "sha256-Pk7C8CzhRB1XRkqHPECIeaFSwWEWZqJ4sTONTEiqZvg=";
+    sha256 = "sha256-yg6GSG4TXPj4n8s4TK/i7NveJXMAQczONSrLn39PKVI=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

From 475668d3541748e75722b2f1429e60894043a2aa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 12:38:00 +0000
Subject: [PATCH 157/190] httpx: 1.7.0 -> 1.7.1

---
 pkgs/by-name/ht/httpx/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ht/httpx/package.nix b/pkgs/by-name/ht/httpx/package.nix
index 4fcea02b4f22..df91324520be 100644
--- a/pkgs/by-name/ht/httpx/package.nix
+++ b/pkgs/by-name/ht/httpx/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "httpx";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "httpx";
     tag = "v${version}";
-    hash = "sha256-V4OTIUm7KSUSKgQczkOtIw8HlkLEMgvX53a4caQP5IU=";
+    hash = "sha256-PJN7Pmor2pZauW70QDAs4U8Q5kjBrjfyWqEgkUNK+MQ=";
   };
 
-  vendorHash = "sha256-lwk/ajywAJ969U5gpYQgIg8+u1xKARFH+HTk2+OgY4A=";
+  vendorHash = "sha256-loxc8ddnape3d0TVvmAw76oqKJOJ6uFKNnPkPbEXEJ8=";
 
   subPackages = [ "cmd/httpx" ];
 

From 228ceaaa7f775cc0d5e8387b8955f56c550566d9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 12:59:02 +0000
Subject: [PATCH 158/190] syslogng: 4.8.3 -> 4.9.0

---
 pkgs/by-name/sy/syslogng/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sy/syslogng/package.nix b/pkgs/by-name/sy/syslogng/package.nix
index adb58f52b316..f16d1f3bbef0 100644
--- a/pkgs/by-name/sy/syslogng/package.nix
+++ b/pkgs/by-name/sy/syslogng/package.nix
@@ -66,13 +66,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "syslog-ng";
-  version = "4.8.3";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "syslog-ng";
     repo = "syslog-ng";
     rev = "syslog-ng-${finalAttrs.version}";
-    hash = "sha256-eYcDdNbUYDsM4k/BDABj/8aV7tZty52XzZ4nqXRC39M=";
+    hash = "sha256-/hLrUwJhA0jesOl7gmWHfTVO2M7IG8QNPRzc/TIGTH4=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [

From ff93fe234660fe9c878ba1dff30963554cc16dbb Mon Sep 17 00:00:00 2001
From: cinereal <cinereal@riseup.net>
Date: Wed, 28 May 2025 15:03:03 +0200
Subject: [PATCH 159/190] python3Packages.django-pydantic-field: init at 0.3.13

---
 .../django-pydantic-field/default.nix         | 59 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 61 insertions(+)
 create mode 100644 pkgs/development/python-modules/django-pydantic-field/default.nix

diff --git a/pkgs/development/python-modules/django-pydantic-field/default.nix b/pkgs/development/python-modules/django-pydantic-field/default.nix
new file mode 100644
index 000000000000..267988b86056
--- /dev/null
+++ b/pkgs/development/python-modules/django-pydantic-field/default.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  django,
+  dj-database-url,
+  inflection,
+  pydantic,
+  pytestCheckHook,
+  pytest-django,
+  djangorestframework,
+  pyyaml,
+  setuptools,
+  syrupy,
+  uritemplate,
+}:
+
+buildPythonPackage rec {
+  pname = "django-pydantic-field";
+  version = "0.3.13";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "surenkov";
+    repo = "django-pydantic-field";
+    tag = "v${version}";
+    hash = "sha256-RxZxDQZdFiT67YcAQtf4t42XU3XfzT3KS7ZCyfHZUOs=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    django
+    pydantic
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-django
+    djangorestframework
+    dj-database-url
+    inflection
+    pyyaml
+    syrupy
+    uritemplate
+  ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE=tests.settings.django_test_settings
+  '';
+
+  meta = with lib; {
+    changelog = "https://github.com/surenkov/django-pydantic-field/releases/tag/${src.tag}";
+    description = "Django JSONField with Pydantic models as a Schema";
+    homepage = "https://github.com/surenkov/django-pydantic-field";
+    maintainers = with lib.maintainers; [ kiara ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 946865d79763..19e90659a3aa 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3971,6 +3971,8 @@ self: super: with self; {
 
   django-pwa = callPackage ../development/python-modules/django-pwa { };
 
+  django-pydantic-field = callPackage ../development/python-modules/django-pydantic-field { };
+
   django-q2 = callPackage ../development/python-modules/django-q2 { };
 
   django-ranged-response = callPackage ../development/python-modules/django-ranged-response { };

From bdb2e09e486a7e5052676575ad334fd6cdb11ae1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 16:41:50 +0000
Subject: [PATCH 160/190] dnscontrol: 4.21.0 -> 4.22.0

---
 pkgs/by-name/dn/dnscontrol/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/dn/dnscontrol/package.nix b/pkgs/by-name/dn/dnscontrol/package.nix
index 6811e0df0e7f..e0ce8ce31bf0 100644
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "4.21.0";
+  version = "4.22.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = "dnscontrol";
     tag = "v${version}";
-    hash = "sha256-M1Ertf/0GBICci8CV/LyfuubsVTvQ1dql7hDKuHGM6k=";
+    hash = "sha256-5K2o0qa+19ur6axDrVkhDDoTMzRO/oNYIGJciIKGvII=";
   };
 
-  vendorHash = "sha256-BTysXvuE+LOHkUhsV+p8+5VOFcMUidz2i7uo2fdzyXg=";
+  vendorHash = "sha256-hniL/pFbYOjpLuAHdH0gD0kFKnW9d/pN7283m9V3e/0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -27,7 +27,7 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X=main.version=${version}"
+    "-X=github.com/StackExchange/dnscontrol/v4/pkg/version.version=${version}"
   ];
 
   postInstall = ''

From c58a266a1eafa8711e33729ccea15c40fa6b7ba0 Mon Sep 17 00:00:00 2001
From: matthewcroughan <matt@croughan.sh>
Date: Tue, 15 Jul 2025 19:16:48 +0100
Subject: [PATCH 161/190] sheep_net: init

Co-authored-by: bloxx12 <charlie@charlieroot.dev>
Co-authored-by: Alyssa Ross <hi@alyssa.is>
---
 nixos/modules/hardware/sheep-net.nix         |  1 -
 pkgs/os-specific/linux/sheep-net/default.nix | 31 ++++++++++++++++++++
 pkgs/top-level/linux-kernels.nix             |  2 ++
 3 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/os-specific/linux/sheep-net/default.nix

diff --git a/nixos/modules/hardware/sheep-net.nix b/nixos/modules/hardware/sheep-net.nix
index 3df6f5840efa..47c64b6a4dbf 100644
--- a/nixos/modules/hardware/sheep-net.nix
+++ b/nixos/modules/hardware/sheep-net.nix
@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 
diff --git a/pkgs/os-specific/linux/sheep-net/default.nix b/pkgs/os-specific/linux/sheep-net/default.nix
new file mode 100644
index 000000000000..115e73b1eb35
--- /dev/null
+++ b/pkgs/os-specific/linux/sheep-net/default.nix
@@ -0,0 +1,31 @@
+{
+  kernel,
+  kernelModuleMakeFlags,
+  stdenv,
+  basiliskii,
+  lib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  name = "sheep_net";
+  version = basiliskii.version;
+  src = basiliskii.src;
+  sourceRoot = "${finalAttrs.src.name}/BasiliskII/src/Unix/Linux/NetDriver";
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/lib/modules/${kernel.modDirVersion}/drivers/net
+    install -Dm444 sheep_net.ko $out/lib/modules/${kernel.modDirVersion}/drivers/net/sheep_net.ko
+    runHook postInstall
+  '';
+
+  meta = {
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index d9949207ece9..eaede2fc88bb 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -599,6 +599,8 @@ in
 
         rr-zen_workaround = callPackage ../development/tools/analysis/rr/zen_workaround.nix { };
 
+        sheep-net = callPackage ../os-specific/linux/sheep-net { };
+
         shufflecake = callPackage ../os-specific/linux/shufflecake { };
 
         sysdig = callPackage ../os-specific/linux/sysdig { };

From 233710fd297d543ca77b606af55ddee77bcf1829 Mon Sep 17 00:00:00 2001
From: matthewcroughan <matt@croughan.sh>
Date: Wed, 16 Jul 2025 14:17:51 +0100
Subject: [PATCH 162/190] basiliskii: add sheep_net comment to src

---
 pkgs/by-name/ba/basiliskii/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ba/basiliskii/package.nix b/pkgs/by-name/ba/basiliskii/package.nix
index a6e77d3e5232..da69d76e1e2c 100644
--- a/pkgs/by-name/ba/basiliskii/package.nix
+++ b/pkgs/by-name/ba/basiliskii/package.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "basiliskii";
   version = "unstable-2022-09-30";
 
+  # This src is also used to build pkgs/os-specific/linux/sheep-net
+  # Therefore changes to it may effect the sheep-net package
   src = fetchFromGitHub {
     owner = "kanjitalk755";
     repo = "macemu";

From 33260f2ea02e6bf2703eef8d42ddc4835e06e6a5 Mon Sep 17 00:00:00 2001
From: matthewcroughan <matt@croughan.sh>
Date: Wed, 16 Jul 2025 14:23:31 +0100
Subject: [PATCH 163/190] basiliskii: unstable-2022-09-30 ->
 unstable-2025-07-16

---
 pkgs/by-name/ba/basiliskii/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ba/basiliskii/package.nix b/pkgs/by-name/ba/basiliskii/package.nix
index da69d76e1e2c..b6b5f257f45b 100644
--- a/pkgs/by-name/ba/basiliskii/package.nix
+++ b/pkgs/by-name/ba/basiliskii/package.nix
@@ -11,15 +11,15 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "basiliskii";
-  version = "unstable-2022-09-30";
+  version = "unstable-2025-07-16";
 
   # This src is also used to build pkgs/os-specific/linux/sheep-net
   # Therefore changes to it may effect the sheep-net package
   src = fetchFromGitHub {
     owner = "kanjitalk755";
     repo = "macemu";
-    rev = "2fa17a0783cf36ae60b77b5ed930cda4dc1824af";
-    sha256 = "+jkns6H2YjlewbUzgoteGSQYWJL+OWVu178aM+BtABM=";
+    rev = "030599cf8d31cb80afae0e1b086b5706dbdd2eea";
+    sha256 = "sha256-gxaj+2ymelH6uWmjMLXi64xMNrToo6HZcJ7RW7sVMzo=";
   };
   sourceRoot = "${finalAttrs.src.name}/BasiliskII/src/Unix";
   patches = [ ./remove-redhat-6-workaround-for-scsi-sg.h.patch ];

From 3e2c2cd8f45e8b360fd09e44ae6c95b511fc2fa5 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 16 Jul 2025 15:45:36 +0200
Subject: [PATCH 164/190] buildComposerProject: change propagatedBuildInputs to
 propagatedNativeBuildInputs

---
 pkgs/build-support/php/builders/v1/hooks/default.nix | 6 +++---
 pkgs/build-support/php/builders/v2/hooks/default.nix | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/php/builders/v1/hooks/default.nix b/pkgs/build-support/php/builders/v1/hooks/default.nix
index d04d57725dc8..20c81442c834 100644
--- a/pkgs/build-support/php/builders/v1/hooks/default.nix
+++ b/pkgs/build-support/php/builders/v1/hooks/default.nix
@@ -17,7 +17,7 @@ in
 {
   composerRepositoryHook = makeSetupHook {
     name = "composer-repository-hook.sh";
-    propagatedBuildInputs = [
+    propagatedNativeBuildInputs = [
       jq
       cacert
     ];
@@ -28,7 +28,7 @@ in
 
   composerInstallHook = makeSetupHook {
     name = "composer-install-hook.sh";
-    propagatedBuildInputs = [
+    propagatedNativeBuildInputs = [
       jq
       cacert
     ];
@@ -42,7 +42,7 @@ in
 
   composerWithPluginVendorHook = makeSetupHook {
     name = "composer-with-plugin-vendor-hook.sh";
-    propagatedBuildInputs = [
+    propagatedNativeBuildInputs = [
       jq
       cacert
     ];
diff --git a/pkgs/build-support/php/builders/v2/hooks/default.nix b/pkgs/build-support/php/builders/v2/hooks/default.nix
index fad926efcf5f..093cea6fd197 100644
--- a/pkgs/build-support/php/builders/v2/hooks/default.nix
+++ b/pkgs/build-support/php/builders/v2/hooks/default.nix
@@ -17,7 +17,7 @@ in
 {
   composerVendorHook = makeSetupHook {
     name = "composer-vendor-hook.sh";
-    propagatedBuildInputs = [
+    propagatedNativeBuildInputs = [
       jq
       cacert
     ];
@@ -28,7 +28,7 @@ in
 
   composerInstallHook = makeSetupHook {
     name = "composer-install-hook.sh";
-    propagatedBuildInputs = [
+    propagatedNativeBuildInputs = [
       jq
       cacert
     ];

From 1c840ff21d41136e3e7c6aa880a9f10ef4376a07 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 16 Jul 2025 15:59:07 +0200
Subject: [PATCH 165/190] makeSetupHook: add propagatedNativeBuildInputs
 argument

---
 pkgs/build-support/trivial-builders/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 809dc8e93555..7af40f9f002e 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -740,6 +740,7 @@ rec {
       name ? lib.warn "calling makeSetupHook without passing a name is deprecated." "hook",
       # hooks go in nativeBuildInputs so these will be nativeBuildInputs
       propagatedBuildInputs ? [ ],
+      propagatedNativeBuildInputs ? [ ],
       # these will be buildInputs
       depsTargetTargetPropagated ? [ ],
       meta ? { },
@@ -758,6 +759,7 @@ rec {
           inherit meta;
           inherit depsTargetTargetPropagated;
           inherit propagatedBuildInputs;
+          inherit propagatedNativeBuildInputs;
           strictDeps = true;
           # TODO 2023-01, no backport: simplify to inherit passthru;
           passthru =

From 75ec16f97e572c110af0200615ef7dae8bd4b697 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 14:25:00 +0000
Subject: [PATCH 166/190] esp-generate: 0.4.0 -> 0.5.0

---
 pkgs/by-name/es/esp-generate/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/es/esp-generate/package.nix b/pkgs/by-name/es/esp-generate/package.nix
index b0cc10b7d621..54005d424256 100644
--- a/pkgs/by-name/es/esp-generate/package.nix
+++ b/pkgs/by-name/es/esp-generate/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "esp-generate";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "esp-rs";
     repo = "esp-generate";
     rev = "v${version}";
-    hash = "sha256-4RF0XcDpUcMQ0u2FTRBnZdQDM7DlaI7pl5HukMbbbBE=";
+    hash = "sha256-rvgmmG0LhRb+eRdqmlCf514lzV0QGWPaJ8pnlTnxfvo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-c/BYf6SXOdI/K4t3fT4ycuILkIYCiSbHafLprSMvK8E=";
+  cargoHash = "sha256-ai8FUKHK/iHeUEgklZEDAMKoorXVDxGSZVrB7LahVV8=";
 
   meta = {
     description = "Template generation tool to create no_std applications targeting Espressif's chips";

From f754332301d564c2b456d122da352295d6f9c428 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Wed, 16 Jul 2025 16:35:44 +0200
Subject: [PATCH 167/190] extractpdfmark: fix build with gettext 0.25

---
 .../ex/extractpdfmark/gettext-0.25.patch       | 15 +++++++++++++++
 pkgs/by-name/ex/extractpdfmark/package.nix     | 18 ++++++++++++------
 2 files changed, 27 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/by-name/ex/extractpdfmark/gettext-0.25.patch

diff --git a/pkgs/by-name/ex/extractpdfmark/gettext-0.25.patch b/pkgs/by-name/ex/extractpdfmark/gettext-0.25.patch
new file mode 100644
index 000000000000..e3ee1dc7cfaa
--- /dev/null
+++ b/pkgs/by-name/ex/extractpdfmark/gettext-0.25.patch
@@ -0,0 +1,15 @@
+diff --git a/configure.ac b/configure.ac
+index 2e7d562..c8dd741 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -7,6 +7,10 @@ AC_INIT([Extract PDFmark], [1.1.1], , [extractpdfmark],
+ AM_INIT_AUTOMAKE([foreign])
+ AC_CONFIG_SRCDIR([src/main.cc])
+ AC_CONFIG_HEADERS([config.h])
++AC_CONFIG_MACRO_DIRS([m4])
++
++AM_GNU_GETTEXT_VERSION([0.25])
++AM_GNU_GETTEXT([external])
+ 
+ PACKAGE_COPYRIGHT="Copyright (C) 2016-2022 Masamichi Hosoda"
+ PACKAGE_LICENSE="License: GPL3+"
diff --git a/pkgs/by-name/ex/extractpdfmark/package.nix b/pkgs/by-name/ex/extractpdfmark/package.nix
index 8594820134f3..fd4820b872bc 100644
--- a/pkgs/by-name/ex/extractpdfmark/package.nix
+++ b/pkgs/by-name/ex/extractpdfmark/package.nix
@@ -20,22 +20,28 @@ stdenv.mkDerivation rec {
     hash = "sha256-pNc/SWAtQWMbB2+lIQkJdBYSZ97iJXK71mS59qQa7Hs=";
   };
 
+  patches = [
+    ./gettext-0.25.patch
+  ];
+
+  strictDeps = true;
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
   ];
+
   buildInputs = [
-    ghostscript
     poppler
-    texlive.combined.scheme-minimal
   ];
 
-  postPatch = ''
-    touch config.rpath
-  '';
-
   doCheck = true;
 
+  nativeCheckInputs = [
+    ghostscript
+    texlive.combined.scheme-minimal
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/trueroad/extractpdfmark";
     description = "Extract page mode and named destinations as PDFmark from PDF";

From 6b5d556b4f6823062f362280969aba6b48f8549c Mon Sep 17 00:00:00 2001
From: nikolaiser <mail@nikolaiser.com>
Date: Wed, 16 Jul 2025 16:57:51 +0200
Subject: [PATCH 168/190] vectorchord: update for rust 1.88.0

---
 .../0003-select_unpredictable-on-bool.diff    | 65 -------------------
 .../postgresql/ext/vectorchord/package.nix    |  5 --
 2 files changed, 70 deletions(-)
 delete mode 100644 pkgs/servers/sql/postgresql/ext/vectorchord/0003-select_unpredictable-on-bool.diff

diff --git a/pkgs/servers/sql/postgresql/ext/vectorchord/0003-select_unpredictable-on-bool.diff b/pkgs/servers/sql/postgresql/ext/vectorchord/0003-select_unpredictable-on-bool.diff
deleted file mode 100644
index 3a0bdbf7121e..000000000000
--- a/pkgs/servers/sql/postgresql/ext/vectorchord/0003-select_unpredictable-on-bool.diff
+++ /dev/null
@@ -1,65 +0,0 @@
-diff --git a/crates/algorithm/src/operator.rs b/crates/algorithm/src/operator.rs
-index 7de8d07..c496dcd 100644
---- a/crates/algorithm/src/operator.rs
-+++ b/crates/algorithm/src/operator.rs
-@@ -672,7 +672,7 @@ impl Operator for Op<VectOwned<f32>, L2> {
-                 use std::iter::zip;
-                 let dims = vector.dims();
-                 let t = zip(&code.1, centroid.slice())
--                    .map(|(&sign, &num)| std::hint::select_unpredictable(sign, num, -num))
-+                    .map(|(&sign, &num)| sign.select_unpredictable(num, -num))
-                     .sum::<f32>()
-                     / (dims as f32).sqrt();
-                 let sum_of_x_2 = code.0.dis_u_2;
-@@ -763,7 +763,7 @@ impl Operator for Op<VectOwned<f32>, Dot> {
-                 use std::iter::zip;
-                 let dims = vector.dims();
-                 let t = zip(&code.1, centroid.slice())
--                    .map(|(&sign, &num)| std::hint::select_unpredictable(sign, num, -num))
-+                    .map(|(&sign, &num)| sign.select_unpredictable(num, -num))
-                     .sum::<f32>()
-                     / (dims as f32).sqrt();
-                 let sum_of_x_2 = code.0.dis_u_2;
-@@ -854,7 +854,7 @@ impl Operator for Op<VectOwned<f16>, L2> {
-                 use std::iter::zip;
-                 let dims = vector.dims();
-                 let t = zip(&code.1, centroid.slice())
--                    .map(|(&sign, &num)| std::hint::select_unpredictable(sign, num, -num).to_f32())
-+                    .map(|(&sign, &num)| sign.select_unpredictable(num, -num).to_f32())
-                     .sum::<f32>()
-                     / (dims as f32).sqrt();
-                 let sum_of_x_2 = code.0.dis_u_2;
-@@ -945,7 +945,7 @@ impl Operator for Op<VectOwned<f16>, Dot> {
-                 use std::iter::zip;
-                 let dims = vector.dims();
-                 let t = zip(&code.1, centroid.slice())
--                    .map(|(&sign, &num)| std::hint::select_unpredictable(sign, num, -num).to_f32())
-+                    .map(|(&sign, &num)| sign.select_unpredictable(num, -num).to_f32())
-                     .sum::<f32>()
-                     / (dims as f32).sqrt();
-                 let sum_of_x_2 = code.0.dis_u_2;
-diff --git a/crates/simd/src/rotate.rs b/crates/simd/src/rotate.rs
-index 7a211e5..0fcd955 100644
---- a/crates/simd/src/rotate.rs
-+++ b/crates/simd/src/rotate.rs
-@@ -31,18 +31,17 @@ pub fn givens(lhs: &mut [f32], rhs: &mut [f32]) {
- pub mod flip {
-     #[crate::multiversion("v4", "v3", "v2", "a2")]
-     pub fn flip(bits: &[u64; 1024], result: &mut [f32]) {
--        use std::hint::select_unpredictable;
-         let result: &mut [u32] = unsafe { std::mem::transmute(result) };
-         let (slice, remainder) = result.as_chunks_mut::<64>();
-         let n = slice.len();
-         assert!(n <= 1024);
-         for i in 0..n {
-             for j in 0..64 {
--                slice[i][j] ^= select_unpredictable((bits[i] & (1 << j)) != 0, 0x80000000, 0);
-+                slice[i][j] ^= ((bits[i] & (1 << j)) != 0).select_unpredictable(0x80000000, 0);
-             }
-         }
-         for j in 0..remainder.len() {
--            remainder[j] ^= select_unpredictable((bits[n] & (1 << j)) != 0, 0x80000000, 0);
-+            remainder[j] ^= ((bits[n] & (1 << j)) != 0).select_unpredictable(0x80000000, 0);
-         }
-     }
- }
diff --git a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
index ea71102357fc..fe024e7092d9 100644
--- a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
@@ -44,11 +44,6 @@ buildPgrxExtension (finalAttrs: {
     })
     # Add feature flags needed for features not yet stabilised in rustc stable
     ./0002-add-feature-flags.diff
-    # The select_predictable function has been moved from std::bool to std::hint before it has been stabilized.
-    # This move isn't present in rustc 1.87, but upstream is using nightly so they have already updated their code.
-    # This patch changes the code to use the function on std::bool instead.
-    # See https://github.com/rust-lang/rust/pull/139726
-    ./0003-select_unpredictable-on-bool.diff
   ];
 
   buildInputs = lib.optionals (useSystemJemalloc) [

From 4d3c5d0dc3217d356c123080ac0c5ca58002c031 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Camille=20Favier?= <n@monade.li>
Date: Wed, 16 Jul 2025 15:00:46 +0200
Subject: [PATCH 169/190] agda: use `getBin Agda` instead of `Agda.bin`

Makes the wrapper work if `enableSeparateBinOutput` is off.
---
 pkgs/build-support/agda/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/agda/default.nix b/pkgs/build-support/agda/default.nix
index 45fa66ad4587..1722e3df5f0e 100644
--- a/pkgs/build-support/agda/default.nix
+++ b/pkgs/build-support/agda/default.nix
@@ -65,10 +65,10 @@ let
       }
       ''
         mkdir -p $out/bin
-        makeWrapper ${Agda.bin}/bin/agda $out/bin/agda \
+        makeWrapper ${lib.getBin Agda}/bin/agda $out/bin/agda \
           ${lib.optionalString (ghc != null) ''--add-flags "--with-compiler=${ghc}/bin/ghc"''} \
           --add-flags "--library-file=${library-file}"
-        ln -s ${Agda.bin}/bin/agda-mode $out/bin/agda-mode
+        ln -s ${lib.getBin Agda}/bin/agda-mode $out/bin/agda-mode
       '';
 
   withPackages = arg: if isAttrs arg then withPackages' arg else withPackages' { pkgs = arg; };

From 4c3870b23dded4e75292be48bdb03cd870fb1719 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 16 Jul 2025 18:51:35 +0300
Subject: [PATCH 170/190] mesa: 25.1.5 -> 25.1.6

Diff: https://gitlab.freedesktop.org/mesa/mesa/-/compare/mesa-25.1.5...mesa-25.1.6

Changelog: https://docs.mesa3d.org/relnotes/25.1.6.html
---
 pkgs/development/libraries/mesa/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
index d6377d6de7da..18f999dd8359 100644
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "25.1.5";
+  version = "25.1.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-AZAd1/wiz8d0lXpim9obp6/K7ySP12rGFe8jZrc9Gl0=";
+    hash = "sha256-SHYYezt2ez9awvIATEC6wVMZMuJUsOYXxlugs1Q6q7U=";
   };
 
   meta = {

From 0e7fd3eb2ca6427fc5bdf73e2974de2065876e97 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Thu, 17 Jul 2025 00:04:31 +0800
Subject: [PATCH 171/190] mint-themes: 2.2.6 -> 2.3.0

https://github.com/linuxmint/mint-themes/compare/2.2.6...2.3.0
---
 pkgs/by-name/mi/mint-themes/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/mint-themes/package.nix b/pkgs/by-name/mi/mint-themes/package.nix
index e9f7044f0f26..0cc872ee5e62 100644
--- a/pkgs/by-name/mi/mint-themes/package.nix
+++ b/pkgs/by-name/mi/mint-themes/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-themes";
-  version = "2.2.6";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-themes";
     rev = version;
-    hash = "sha256-O1ky967RWrd5L2RGl7SC2ZsvaM8FMmSmroJKcItD+ck=";
+    hash = "sha256-5nYD4fBZlCQvCwtckjW4ELg4zdKofXhWGmD3nsvHoO8=";
   };
 
   nativeBuildInputs = [

From cde1ef6d8822a87f4de8d9a1fb8b2b3125e14565 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 14:39:23 +0000
Subject: [PATCH 172/190] python3Packages.inequality: 1.1.1 -> 1.1.2

---
 pkgs/development/python-modules/inequality/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/inequality/default.nix b/pkgs/development/python-modules/inequality/default.nix
index cfdecec90b17..80fc679f5b6a 100644
--- a/pkgs/development/python-modules/inequality/default.nix
+++ b/pkgs/development/python-modules/inequality/default.nix
@@ -16,15 +16,15 @@
 
 buildPythonPackage rec {
   pname = "inequality";
-  version = "1.1.1";
+  version = "1.1.2";
   pyproject = true;
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "pysal";
     repo = "inequality";
     tag = "v${version}";
-    hash = "sha256-JVim2u+VF35dvD+y14WbA2+G4wktAGpin/GMe0uGhjc=";
+    hash = "sha256-GMl/hHwaHPozdLhV9/CPYIMY5lFYeo0X0SPDg4RT1zo=";
   };
 
   build-system = [ setuptools-scm ];

From 30cee69bb9ccfb280a9edafbb39b7eef713de47b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Camille=20Favier?= <n@monade.li>
Date: Wed, 16 Jul 2025 18:08:26 +0200
Subject: [PATCH 173/190] haskellPackages.Agda: set `mainProgram`

---
 pkgs/build-support/agda/default.nix                    | 4 ++--
 pkgs/development/haskell-modules/configuration-nix.nix | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/agda/default.nix b/pkgs/build-support/agda/default.nix
index 1722e3df5f0e..b4609940fedc 100644
--- a/pkgs/build-support/agda/default.nix
+++ b/pkgs/build-support/agda/default.nix
@@ -65,10 +65,10 @@ let
       }
       ''
         mkdir -p $out/bin
-        makeWrapper ${lib.getBin Agda}/bin/agda $out/bin/agda \
+        makeWrapper ${lib.getExe Agda} $out/bin/agda \
           ${lib.optionalString (ghc != null) ''--add-flags "--with-compiler=${ghc}/bin/ghc"''} \
           --add-flags "--library-file=${library-file}"
-        ln -s ${lib.getBin Agda}/bin/agda-mode $out/bin/agda-mode
+        ln -s ${lib.getExe' Agda "agda-mode"} $out/bin/agda-mode
       '';
 
   withPackages = arg: if isAttrs arg then withPackages' arg else withPackages' { pkgs = arg; };
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 795b769677a2..75d88b4cca92 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -1362,6 +1362,8 @@ builtins.intersectAttrs super {
     # very useful.
     # Flag added in Agda 2.6.4.1, was always enabled before
     (enableCabalFlag "debug")
+    # Set the main program
+    (overrideCabal { mainProgram = "agda"; })
     # Split outputs to reduce closure size
     enableSeparateBinOutput
   ];

From 6dc62c11dd5e7365d9f7af25da0e238db5b74f32 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 17:16:46 +0000
Subject: [PATCH 174/190] bilibili: 1.16.5-2 -> 1.16.5-4

---
 pkgs/by-name/bi/bilibili/sources.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bi/bilibili/sources.nix b/pkgs/by-name/bi/bilibili/sources.nix
index 465768a2cc08..0e438b2fddb8 100644
--- a/pkgs/by-name/bi/bilibili/sources.nix
+++ b/pkgs/by-name/bi/bilibili/sources.nix
@@ -1,6 +1,6 @@
 # Generated by ./update.sh - do not update manually!
 {
-  version = "1.16.5-2";
-  arm64-hash = "sha256-7zbiswG0Q7cRMkJI22uk7VIpA8s5XS1CRL9nDyqUfq0=";
-  x86_64-hash = "sha256-zTbHNrd75w0x2dYOfxyH37GlgG8HT0YExUxZQU+1M/Q=";
+  version = "1.16.5-4";
+  arm64-hash = "sha256-8APk13cLzhOaPXCpkdX5OLpXM/EV93uR2LHuMaBeUb0=";
+  x86_64-hash = "sha256-S7R4XmBnqyXugwf5henOZG5TzGUw4IrU42SXINm6Wcw=";
 }

From 6a74f3839d0d4a5440822af3b9d9348a00a2070f Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 16 Jul 2025 18:25:36 +0100
Subject: [PATCH 175/190] gccNGPackages_15.gcc: drop unused `libelf` dependency

This mirrors the https://github.com/NixOS/nixpkgs/pull/187234 change
where `libelf` was removed from `gcc` packages. `libelf` is not used
by `gcc` since `4.6.0` version.
---
 pkgs/development/compilers/gcc/ng/common/gcc/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/compilers/gcc/ng/common/gcc/default.nix b/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
index 76454ebcaa99..36cc0da952f3 100644
--- a/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
@@ -23,7 +23,6 @@
   gmp,
   libmpc,
   mpfr,
-  libelf,
   perl,
   texinfo,
   which,
@@ -78,7 +77,6 @@ stdenv.mkDerivation (finalAttrs: {
       gmp
       libmpc
       mpfr
-      libelf
     ]
     ++ lib.optional (isl != null) isl
     ++ lib.optional (zlib != null) zlib;

From cd90ef358f5110d305e441973c9cb7a7f6db5511 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 17:31:56 +0000
Subject: [PATCH 176/190] simplex-chat-desktop: 6.3.7 -> 6.4.0

---
 pkgs/by-name/si/simplex-chat-desktop/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/si/simplex-chat-desktop/package.nix b/pkgs/by-name/si/simplex-chat-desktop/package.nix
index 7f9bf30a0796..f93e8a5daacd 100644
--- a/pkgs/by-name/si/simplex-chat-desktop/package.nix
+++ b/pkgs/by-name/si/simplex-chat-desktop/package.nix
@@ -7,11 +7,11 @@
 
 let
   pname = "simplex-chat-desktop";
-  version = "6.3.7";
+  version = "6.4.0";
 
   src = fetchurl {
     url = "https://github.com/simplex-chat/simplex-chat/releases/download/v${version}/simplex-desktop-x86_64.AppImage";
-    hash = "sha256-PsUSSs6HTV3gGbdH+hPifZ2Ak6j1vNSAHsqaL5U1lbY=";
+    hash = "sha256-QTq2hBuFfuCvQ9EDcSW5M7bpkBvhYjYXCkKaRqLyblg=";
   };
 
   appimageContents = appimageTools.extract {

From 2b78f5e2ca2aea5e4b28dc7a507500c96295acf8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 17:34:25 +0000
Subject: [PATCH 177/190] tailwindcss-language-server: 0.14.24 -> 0.14.25

---
 pkgs/by-name/ta/tailwindcss-language-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ta/tailwindcss-language-server/package.nix b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
index 1d769564d0bc..a279b1d6e298 100644
--- a/pkgs/by-name/ta/tailwindcss-language-server/package.nix
+++ b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tailwindcss-language-server";
-  version = "0.14.24";
+  version = "0.14.25";
 
   src = fetchFromGitHub {
     owner = "tailwindlabs";
     repo = "tailwindcss-intellisense";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FlPrDoCGV7w3RBAZPP8gT/RGze9LDYQeAIVVPQA4Na4=";
+    hash = "sha256-uY5hOMuDfLpPFkVoZyISexb/RVtaOK/UpN1WRQ0uDQY=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {

From e316a7450b5dd7733f5769c5282746e464c042c3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 17:54:14 +0000
Subject: [PATCH 178/190] renode-unstable: 1.15.3+20250707gita02ab2a10 ->
 1.15.3+20250711gitb35bde0fb

---
 pkgs/by-name/re/renode-unstable/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index 85ab1af50016..d7b3b3247a3c 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -7,11 +7,11 @@
 renode.overrideAttrs (
   finalAttrs: _: {
     pname = "renode-unstable";
-    version = "1.15.3+20250707gita02ab2a10";
+    version = "1.15.3+20250711gitb35bde0fb";
 
     src = fetchurl {
       url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-dotnet.tar.gz";
-      hash = "sha256-T5ptBT0xuxCRwPOR9YnCvVSgrj6aJh7YVeRgRsjJhvI=";
+      hash = "sha256-jjs8e8+ipyrF96c/lKwS8S6JXyiRLy9Lf1RYsU+Tk6s=";
     };
 
     passthru.updateScript =

From 986e3436154332d40b0be336471e38515cc6e677 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 16:43:50 +0000
Subject: [PATCH 179/190] python3Packages.coffea: 2025.3.0 -> 2025.7.0

---
 pkgs/development/python-modules/coffea/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/coffea/default.nix b/pkgs/development/python-modules/coffea/default.nix
index 9f304d6fe416..c58b288fba7d 100644
--- a/pkgs/development/python-modules/coffea/default.nix
+++ b/pkgs/development/python-modules/coffea/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "coffea";
-  version = "2025.3.0";
+  version = "2025.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CoffeaTeam";
     repo = "coffea";
     tag = "v${version}";
-    hash = "sha256-NZ3r/Dyw5bB4qOO29DUAARPzdJJxgR9OO9LxVu3YbNo=";
+    hash = "sha256-Lbhxgn9aBtR/wmyxMJjyP813miG9FjaJ+rdHM6oTcvw=";
   };
 
   build-system = [
@@ -113,7 +113,7 @@ buildPythonPackage rec {
   meta = {
     description = "Basic tools and wrappers for enabling not-too-alien syntax when running columnar Collider HEP analysis";
     homepage = "https://github.com/CoffeaTeam/coffea";
-    changelog = "https://github.com/CoffeaTeam/coffea/releases/tag/v${version}";
+    changelog = "https://github.com/CoffeaTeam/coffea/releases/tag/${src.tag}";
     license = with lib.licenses; [ bsd3 ];
     maintainers = with lib.maintainers; [ veprbl ];
   };

From 85181ed1b4ccd3186a1fe762a77c97aa90073e80 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 18:17:37 +0000
Subject: [PATCH 180/190] hypercore: 11.10.0 -> 11.11.0

---
 pkgs/by-name/hy/hypercore/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hy/hypercore/package.nix b/pkgs/by-name/hy/hypercore/package.nix
index c642f53fb10a..ba387549e07e 100644
--- a/pkgs/by-name/hy/hypercore/package.nix
+++ b/pkgs/by-name/hy/hypercore/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "hypercore";
-  version = "11.10.0";
+  version = "11.11.0";
 
   src = fetchFromGitHub {
     owner = "holepunchto";
     repo = "hypercore";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6Z6HbolPa3b4EKjUwNGw7gDAg4ijFadBDwpt3l6GUqo=";
+    hash = "sha256-fv/m/AicHW3cdatpsSAvv+PBo+2J1mE8pK+IWysY7D0=";
   };
 
   npmDepsHash = "sha256-ZJxVmQWKgHyKkuYfGIlANXFcROjI7fibg6mxIhDZowM=";

From 1506db4391909e932cbfa4704dbaa773f1b18db6 Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Wed, 16 Jul 2025 12:24:27 +0200
Subject: [PATCH 181/190] electron-source.electron_35: 35.7.1 -> 35.7.2

- Changelog: https://github.com/electron/electron/releases/tag/v35.7.2
- Diff: https://github.com/electron/electron/compare/refs/tags/v35.7.1...v35.7.2
---
 pkgs/development/tools/electron/info.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json
index 22ae2b01ece1..cb99b3c7f0e0 100644
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -57,10 +57,10 @@
             },
             "src/electron": {
                 "args": {
-                    "hash": "sha256-jdLAmuRf4nw/N8J7FDZwdG/+BXcoD2zVLsur+iNT4gM=",
+                    "hash": "sha256-8dTfWg8fn3KIwk88/Bm01To1G+6UQGjQ/4lMUQvl0Js=",
                     "owner": "electron",
                     "repo": "electron",
-                    "tag": "v35.7.1"
+                    "tag": "v35.7.2"
                 },
                 "fetcher": "fetchFromGitHub"
             },
@@ -1303,10 +1303,10 @@
                 "fetcher": "fetchFromGitiles"
             }
         },
-        "electron_yarn_hash": "1p9gs8s1zhwxvvmi9zb76k5nn1wly4yq0i12ibr0wvw5ls8bbars",
+        "electron_yarn_hash": "0knjrmn5kcr72s8zz642fyy0g1f8780v15f8pb8xbhs5bwa3c4m8",
         "modules": "133",
         "node": "22.16.0",
-        "version": "35.7.1"
+        "version": "35.7.2"
     },
     "36": {
         "chrome": "136.0.7103.177",

From f4a288b1439f0b8104c58793b3c4b40f09f4196a Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Wed, 16 Jul 2025 12:31:56 +0200
Subject: [PATCH 182/190] electron-source.electron_37: 37.2.1 -> 37.2.2

- Changelog: https://github.com/electron/electron/releases/tag/v37.2.2
- Diff: https://github.com/electron/electron/compare/refs/tags/v37.2.1...v37.2.2
---
 pkgs/development/tools/electron/info.json | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json
index cb99b3c7f0e0..bccecd057e11 100644
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -2634,7 +2634,7 @@
         "version": "36.7.1"
     },
     "37": {
-        "chrome": "138.0.7204.97",
+        "chrome": "138.0.7204.100",
         "chromium": {
             "deps": {
                 "gn": {
@@ -2644,15 +2644,15 @@
                     "version": "2025-05-21"
                 }
             },
-            "version": "138.0.7204.97"
+            "version": "138.0.7204.100"
         },
         "chromium_npm_hash": "sha256-8d5VTHutv51libabhxv7SqPRcHfhVmGDSOvTSv013rE=",
         "deps": {
             "src": {
                 "args": {
-                    "hash": "sha256-jBRcCFsjel8zBJfcgrYy59SzyYphm01zscYtGo0YFhM=",
+                    "hash": "sha256-No95HLCZzwbnG1vSTl/e1hftLDBo6CYIb2qTPs9AobU=",
                     "postFetch": "rm -r $out/third_party/blink/web_tests; rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
-                    "tag": "138.0.7204.97",
+                    "tag": "138.0.7204.100",
                     "url": "https://chromium.googlesource.com/chromium/src.git"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -2691,10 +2691,10 @@
             },
             "src/electron": {
                 "args": {
-                    "hash": "sha256-iJiKkKLDbcXnWDi0ZHq6xHB65cm1GsU1gffCPQSNc3Q=",
+                    "hash": "sha256-xd96/h+3ECAN6pooHU5tcAsL7bcLHrifWreP+lRFfJk=",
                     "owner": "electron",
                     "repo": "electron",
-                    "tag": "v37.2.1"
+                    "tag": "v37.2.2"
                 },
                 "fetcher": "fetchFromGitHub"
             },
@@ -2988,8 +2988,8 @@
             },
             "src/third_party/devtools-frontend/src": {
                 "args": {
-                    "hash": "sha256-7ygnGBAeiLxwbTx5s7LRs9+ZOe06tr8VFcSY5cVHnS4=",
-                    "rev": "f8dfe8b36e516cef8a5a169e88d16480d8abdc68",
+                    "hash": "sha256-XkyJFRxo3ZTBGfKdTwSIo14SLNPQAKQvY4lEX03j6LM=",
+                    "rev": "a6dbe06dafbad00ef4b0ea139ece1a94a5e2e6d8",
                     "url": "https://chromium.googlesource.com/devtools/devtools-frontend"
                 },
                 "fetcher": "fetchFromGitiles"
@@ -3961,9 +3961,9 @@
                 "fetcher": "fetchFromGitiles"
             }
         },
-        "electron_yarn_hash": "10n86jnzcq8kh0nk29ljw9wi1fgj13f07h92b009i1dryagliyrs",
+        "electron_yarn_hash": "167apz9905pfmvq1i34dzcjbzmg3i8jbm27al2xs9lka0rr2qr07",
         "modules": "136",
         "node": "22.17.0",
-        "version": "37.2.1"
+        "version": "37.2.2"
     }
 }

From 10ac3beb9089e5e164a508e84e3d2a20241ea2b1 Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Wed, 16 Jul 2025 12:32:12 +0200
Subject: [PATCH 183/190] electron_35-bin: 35.7.1 -> 35.7.2

- Changelog: https://github.com/electron/electron/releases/tag/v35.7.2
- Diff: https://github.com/electron/electron/compare/refs/tags/v35.7.1...v35.7.2
---
 pkgs/development/tools/electron/binary/info.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/tools/electron/binary/info.json b/pkgs/development/tools/electron/binary/info.json
index e731d8bd9dde..27b61d1041bd 100644
--- a/pkgs/development/tools/electron/binary/info.json
+++ b/pkgs/development/tools/electron/binary/info.json
@@ -23,14 +23,14 @@
     },
     "35": {
         "hashes": {
-            "aarch64-darwin": "3330a8d349689a341cf0f5f126388ce2c1678c6f8760ba6456eb92d6a6fb87c4",
-            "aarch64-linux": "148ede01556ac18a24d97db60a13346115993a73da40963968da2e951260474f",
-            "armv7l-linux": "fd5fda4137cf9d617c50315eb16710849419b5c60d9cc304b7b5615d8f0fa47f",
+            "aarch64-darwin": "bb266a3687a82e60a97e96ef86c8e6339770d55ab18bc7db6fdf772f212b8f3a",
+            "aarch64-linux": "75f83326b0a5e0c3b04a8286b5dd1c9802d0d5d74f14ae2beba309c474ab4747",
+            "armv7l-linux": "84c8e6dfd311ce62cc9481d3e179ed05fc898c8edf02775ef1749e36b54042b1",
             "headers": "1w8qcgsbii6gizv31i1nkbhaipcr6r1x384wkwnxp60dk9a6cl59",
-            "x86_64-darwin": "517a770abc9072b2f5335cc0af763fe2e2953fa89d9564640eb75f0eccb2794a",
-            "x86_64-linux": "bddc5a6a1e496e9b87819315dcf188b9b0f7ea8f389d2f4b8326b8d7e0afe956"
+            "x86_64-darwin": "63125423f0ec39dce4d116ff1b56333f24b865e179a3369eff285d42744ca16b",
+            "x86_64-linux": "3aad1702f4c542b637915cdff330281b458417ab099f90c6ef0b30b4df2451d3"
         },
-        "version": "35.7.1"
+        "version": "35.7.2"
     },
     "36": {
         "hashes": {

From be2dca5a9d0a52b72a14816f54181a18a6ef5fbc Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Wed, 16 Jul 2025 12:32:14 +0200
Subject: [PATCH 184/190] electron-chromedriver_35: 35.7.1 -> 35.7.2

- Changelog: https://github.com/electron/electron/releases/tag/v35.7.2
- Diff: https://github.com/electron/electron/compare/refs/tags/v35.7.1...v35.7.2
---
 .../tools/electron/chromedriver/info.json            | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/tools/electron/chromedriver/info.json b/pkgs/development/tools/electron/chromedriver/info.json
index e7054bf8ef0c..faebde3ea4c0 100644
--- a/pkgs/development/tools/electron/chromedriver/info.json
+++ b/pkgs/development/tools/electron/chromedriver/info.json
@@ -23,14 +23,14 @@
     },
     "35": {
         "hashes": {
-            "aarch64-darwin": "2760c01ae0a292a1d20d3d2fab52120800d5734156e71671b458c6539fd24eee",
-            "aarch64-linux": "038555b79c6f0fdf287cbd1943f9c8109e24c88290d6c4b2947159287129daca",
-            "armv7l-linux": "1b9350313d5fdf4774a51d7b8a4149d49d3ca86e789e682794b0499b54e9ae3f",
+            "aarch64-darwin": "392ec250c65a1448871369318ca15f50c1de1f2afe886fc9e23b31a6484dfaf9",
+            "aarch64-linux": "7f2d0c92979972becbd437b70927c2ee3e42b4ee0dd40fa80e5bb25df2ac9969",
+            "armv7l-linux": "c6a334186af0ac33c81ac8212c99eeb5f67604d0aa84adb574cdc3fc9065a355",
             "headers": "1w8qcgsbii6gizv31i1nkbhaipcr6r1x384wkwnxp60dk9a6cl59",
-            "x86_64-darwin": "f9ff3b3eb747a2fa0e98e6c408a52e4272d05e477aaa3442debc587e823b385d",
-            "x86_64-linux": "29d379865c8b72645b3d81585af308ebb96cca0c500191bfd042f844d01fa9b8"
+            "x86_64-darwin": "d40fdfa7b7ae6e558b036b38e3fddf090b0685e5f40d7dce335a5fa350fb8fb5",
+            "x86_64-linux": "c8bc2c6beba2654e7ec39e8b8e2e2375bbff411d8c501c933aed27af6c6c1f8b"
         },
-        "version": "35.7.1"
+        "version": "35.7.2"
     },
     "36": {
         "hashes": {

From 5744938bfa4237a3a060096e97c2b4473762f85c Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Wed, 16 Jul 2025 12:32:24 +0200
Subject: [PATCH 185/190] electron_37-bin: 37.2.1 -> 37.2.2

- Changelog: https://github.com/electron/electron/releases/tag/v37.2.2
- Diff: https://github.com/electron/electron/compare/refs/tags/v37.2.1...v37.2.2
---
 pkgs/development/tools/electron/binary/info.json | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/tools/electron/binary/info.json b/pkgs/development/tools/electron/binary/info.json
index 27b61d1041bd..f51700cdfa6c 100644
--- a/pkgs/development/tools/electron/binary/info.json
+++ b/pkgs/development/tools/electron/binary/info.json
@@ -45,13 +45,13 @@
     },
     "37": {
         "hashes": {
-            "aarch64-darwin": "2f381bb274fc0cb8d3a2bfeadc5dfd84b044305cdd02c7d19234e40e90ac03a9",
-            "aarch64-linux": "fa2a494dd7541ef1184f20ebb56508c84f00e716ce43583cf62c4ba47d4dfcad",
-            "armv7l-linux": "f50dc1e573bee739e2a22ffde1ae503b806e38a09a2ade448374e5181a4edf89",
-            "headers": "18w6pjbs29aqvdiscwl55ajvpib63y4q7g7y4q7hy0nr2vvzycja",
-            "x86_64-darwin": "04112012bae4566b04f636e3101d2ced4522b2c60357a83eaec7cdbda7c036d2",
-            "x86_64-linux": "8f61fba601660839be53625197d836d0e8c8066a54ecc7be468093e4fb6c824b"
+            "aarch64-darwin": "8c8f393de428c03062a35d945f6cf4dc2ad41a98bae5c644fb973473cd13552f",
+            "aarch64-linux": "ccd19d8cbb8efc876c52345eefa884fc618f6a375f0764dc71c1b4341c6b378e",
+            "armv7l-linux": "632f7babe954f4293c45414f7f72ff8d1f76c344e10d2b795a08e93a2bba62b9",
+            "headers": "07n5hlb93l3v6f1x122yhnbn2x0a8cin3is7jqjfky0lacvl0bwa",
+            "x86_64-darwin": "924b1a15398c296eac196e96caf6bf76a236b38e3f23f14b898d8eb902f68ddd",
+            "x86_64-linux": "30bb4de4a63af55615c292aaac025f4c8422b67db7d6b4b8cfd82ee97ad939f8"
         },
-        "version": "37.2.1"
+        "version": "37.2.2"
     }
 }

From 841eeeb702a1aa32b78b8e1ff7e0e9d3d787264b Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Wed, 16 Jul 2025 12:32:28 +0200
Subject: [PATCH 186/190] electron-chromedriver_37: 37.2.1 -> 37.2.2

- Changelog: https://github.com/electron/electron/releases/tag/v37.2.2
- Diff: https://github.com/electron/electron/compare/refs/tags/v37.2.1...v37.2.2
---
 .../tools/electron/chromedriver/info.json          | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/tools/electron/chromedriver/info.json b/pkgs/development/tools/electron/chromedriver/info.json
index faebde3ea4c0..4e8e46075888 100644
--- a/pkgs/development/tools/electron/chromedriver/info.json
+++ b/pkgs/development/tools/electron/chromedriver/info.json
@@ -45,13 +45,13 @@
     },
     "37": {
         "hashes": {
-            "aarch64-darwin": "20a854527dac40c643faefa3bd96cc7edc633399da825ff89b67ab5b03728b42",
-            "aarch64-linux": "9b9810af731ca62c75ba49339943e4b251ccba8b0890f0933dfa831333a778ff",
-            "armv7l-linux": "5b36d24fe9c6b26b4734ac70f35f6fd50098175acb207fc87187be4fb38ebb4e",
-            "headers": "18w6pjbs29aqvdiscwl55ajvpib63y4q7g7y4q7hy0nr2vvzycja",
-            "x86_64-darwin": "8398fa0578a60eebb90436749d66d09e23bf4a0c705117bbfa455cb4a5b19746",
-            "x86_64-linux": "413b3e0fb051953d97c920a480ebe364bcd668f31a5ae51c3472d4007bfe4dc5"
+            "aarch64-darwin": "64e21bee8c6f203879a64c90e7b0601809ecaad0e8760d00c427e12d8959f244",
+            "aarch64-linux": "4c497c05b2abf7a1323302f35df68612cab3f957be9152d939aa6defd0f4e3dc",
+            "armv7l-linux": "01d05956b313457795fe1c3450558cb9bf9d68cc26720b91d89ce4554b1f3060",
+            "headers": "07n5hlb93l3v6f1x122yhnbn2x0a8cin3is7jqjfky0lacvl0bwa",
+            "x86_64-darwin": "2682d646495cb7d0fadde52e52c5ac64bf98677563f7f688f32169c7efee43ba",
+            "x86_64-linux": "40c0bbb6a4a2630ea7e0fbcfaa24f62d06ab56991bb7cb4a508936d82f456543"
         },
-        "version": "37.2.1"
+        "version": "37.2.2"
     }
 }

From 4ee1354ae6ae144d43f60e062387450f56eb3e82 Mon Sep 17 00:00:00 2001
From: June Stepp <git@junestepp.me>
Date: Tue, 15 Jul 2025 17:23:13 -0500
Subject: [PATCH 187/190] nixos/peertube: only include whisper when
 transcription is enabled

`whisper-ctranslate2` has a large closure size with unique dependencies.
---
 nixos/modules/services/web-apps/peertube.nix | 35 ++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/peertube.nix b/nixos/modules/services/web-apps/peertube.nix
index 2a676fd06673..76e95cfe52e0 100644
--- a/nixos/modules/services/web-apps/peertube.nix
+++ b/nixos/modules/services/web-apps/peertube.nix
@@ -165,7 +165,39 @@ in
     };
 
     settings = lib.mkOption {
-      type = settingsFormat.type;
+      type = lib.types.submodule (
+        { config, ... }:
+        {
+          freeformType = settingsFormat.type;
+          options = {
+            video_transcription = {
+              enabled = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+                description = "Enable automatic transcription of videos.";
+              };
+              engine_path = lib.mkOption {
+                type = with lib.types; either path str;
+                default =
+                  if config.video_transcription.enabled then
+                    lib.getExe pkgs.whisper-ctranslate2
+                  else
+                    # This will be in the error message when someone enables
+                    # transcription manually in the web UI and tries to run a
+                    # transcription job.
+                    "Set `services.peertube.settings.video_transcription.enabled = true`.";
+                defaultText = lib.literalExpression ''
+                  if config.services.peertube.settings.video_transcription.enabled then
+                    lib.getExe pkgs.whisper-ctranslate2
+                  else
+                    "Set `services.peertube.settings.video_transcription.enabled = true`."
+                '';
+                description = "Custom engine path for local transcription.";
+              };
+            };
+          };
+        }
+      );
       example = lib.literalExpression ''
         {
           listen = {
@@ -424,7 +456,6 @@ in
         };
         video_transcription = {
           engine = lib.mkDefault "whisper-ctranslate2";
-          engine_path = lib.mkDefault (lib.getExe pkgs.whisper-ctranslate2);
         };
       }
       (lib.mkIf cfg.redis.enableUnixSocket {

From bd0cf0c3302234f3e43042a107e24dc0a7a75fec Mon Sep 17 00:00:00 2001
From: PhiliPdB <phlpdbrn@gmail.com>
Date: Wed, 16 Jul 2025 21:52:55 +0200
Subject: [PATCH 188/190] vscode: 1.102.0 -> 1.102.1

---
 pkgs/applications/editors/vscode/vscode.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 8c434e2d68c7..86ba77433807 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -36,22 +36,22 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-zgrNohvsmhcRQmkX7Io2/U3qbVWdcqwT7VK7Y3ENb9g=";
-      x86_64-darwin = "sha256-depSpPZm6bMQv9yvLUJ6yacCwTDtcpoFu15b67oiFJY=";
-      aarch64-linux = "sha256-Fo2X4VAWcyySQ+CE/bt+lJneLoEKVl6tLwPSW5LwvFY=";
-      aarch64-darwin = "sha256-WdYmlopeVsFCndnTALKiQgx2O4zzkDtotR/qj7A56bY=";
-      armv7l-linux = "sha256-OF4qjhgQiagpQP8p9gV63I/B8s/CSl8KlA+FoNhl3/c=";
+      x86_64-linux = "sha256-rUAu69aUjLQsDT5hK8E5yWiMdVfNFqwx9aA8op1ZYj8=";
+      x86_64-darwin = "sha256-BOrLjZsA9QFtcsvgsohZbCRRRqTHhn043HHIpl40kPA=";
+      aarch64-linux = "sha256-DBthRZDeJF6xksMWGvXIC7vdTkQCyjt+oHUI+FbLBrU=";
+      aarch64-darwin = "sha256-TWa2jMRBR0a0SOUkrnZw6Ej3cRGdZd0Gw5Obt11M45k=";
+      armv7l-linux = "sha256-SYrXdEzIYG/2ih3vqCTfIo+6jTvMJe+rIOzNQXfd+es=";
     }
     .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.102.0";
+  version = "1.102.1";
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
   # This is used for VS Code - Remote SSH test
-  rev = "cb0c47c0cfaad0757385834bd89d410c78a856c0";
+  rev = "7adae6a56e34cb64d08899664b814cf620465925";
 
   executableName = "code" + lib.optionalString isInsiders "-insiders";
   longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -75,7 +75,7 @@ callPackage ./generic.nix rec {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-Hf/pukcQf7PaHORItWO74gC54TWto+nHiKaCHzD0TmI=";
+      hash = "sha256-EP5xCkCSMROB60OmDFWVWF9qHqW8pjKWPh6mSUU5E7A=";
     };
     stdenv = stdenvNoCC;
   };

From 18ccbfa9214d24cfd02b7c8488e07dc25cad27e7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Jul 2025 20:22:54 +0000
Subject: [PATCH 189/190] ledger-live-desktop: 2.118.1 -> 2.120.1

---
 pkgs/by-name/le/ledger-live-desktop/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/le/ledger-live-desktop/package.nix b/pkgs/by-name/le/ledger-live-desktop/package.nix
index d62fdcda95da..c94bb46d7d32 100644
--- a/pkgs/by-name/le/ledger-live-desktop/package.nix
+++ b/pkgs/by-name/le/ledger-live-desktop/package.nix
@@ -8,11 +8,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.118.1";
+  version = "2.120.1";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-FG1vlcLUjQpXfoEczvTOyqLFuCYU/72KeAdsg/SMjLQ=";
+    hash = "sha256-zr+m0ytG5wcdI6IvCklpcQVmiaTUaQb5a90lRl1+YxQ=";
   };
 
   appimageContents = appimageTools.extractType2 {

From 432b7b8b6b2f5f54d3a94f9cda8b98d4f62a42c3 Mon Sep 17 00:00:00 2001
From: Pavol Rusnak <pavol@rusnak.io>
Date: Wed, 16 Jul 2025 23:53:19 +0200
Subject: [PATCH 190/190] hashcat: use CUDA 12.4

to fix the following error:

ptxas application ptx input, line 9; fatal   : Unsupported .version 8.7; current version is '8.4'
---
 pkgs/by-name/ha/hashcat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ha/hashcat/package.nix b/pkgs/by-name/ha/hashcat/package.nix
index 994c6daa561a..442b46b4d974 100644
--- a/pkgs/by-name/ha/hashcat/package.nix
+++ b/pkgs/by-name/ha/hashcat/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   addDriverRunpath,
   config,
-  cudaPackages ? { },
+  cudaPackages_12_4 ? { },
   cudaSupport ? config.cudaSupport,
   fetchurl,
   makeWrapper,
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
           "${ocl-icd}/lib"
         ]
         ++ lib.optionals cudaSupport [
-          "${cudaPackages.cudatoolkit}/lib"
+          "${cudaPackages_12_4.cudatoolkit}/lib"
         ]
       );
     in