From 67f0915d2b53b6b3285f0e51c91514b4474f4693 Mon Sep 17 00:00:00 2001
From: Volker Diels-Grabsch <v@njh.eu>
Date: Tue, 22 Jul 2025 20:08:31 +0200
Subject: [PATCH 01/36] junixsocket-common: init at 2.10.1

---
 pkgs/by-name/ju/junixsocket-common/package.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 pkgs/by-name/ju/junixsocket-common/package.nix

diff --git a/pkgs/by-name/ju/junixsocket-common/package.nix b/pkgs/by-name/ju/junixsocket-common/package.nix
new file mode 100644
index 000000000000..b1df42ca3104
--- /dev/null
+++ b/pkgs/by-name/ju/junixsocket-common/package.nix
@@ -0,0 +1,18 @@
+{
+  fetchMavenArtifact,
+  lib,
+}:
+
+fetchMavenArtifact {
+  groupId = "com.kohlschutter.junixsocket";
+  artifactId = "junixsocket-common";
+  version = "2.10.1";
+  hash = "sha256-GeX3YVrSKT81Mrw/mRsxOWwRYYNOidmmqgx975OcZyk=";
+  meta = {
+    homepage = "https://kohlschutter.github.io/junixsocket/";
+    description = "Java/JNI library that allows the use of Unix Domain Sockets (AF_UNIX sockets) and other socket types, such as AF_TIPC and AF_VSOCK, from Java, using the standard Socket API";
+    license = lib.licenses.asl20;
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    maintainers = [ lib.maintainers.vog ];
+  };
+}

From 72427e253359bfcd4474fbcb0b5d725c5d61555c Mon Sep 17 00:00:00 2001
From: Volker Diels-Grabsch <v@njh.eu>
Date: Tue, 22 Jul 2025 20:09:38 +0200
Subject: [PATCH 02/36] junixsocket-native-common: init at 2.10.1

---
 .../ju/junixsocket-native-common/package.nix     | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 pkgs/by-name/ju/junixsocket-native-common/package.nix

diff --git a/pkgs/by-name/ju/junixsocket-native-common/package.nix b/pkgs/by-name/ju/junixsocket-native-common/package.nix
new file mode 100644
index 000000000000..e28c1f3709c5
--- /dev/null
+++ b/pkgs/by-name/ju/junixsocket-native-common/package.nix
@@ -0,0 +1,16 @@
+{
+  fetchMavenArtifact,
+  junixsocket-common,
+  lib,
+}:
+
+fetchMavenArtifact {
+  groupId = "com.kohlschutter.junixsocket";
+  artifactId = "junixsocket-native-common";
+  inherit (junixsocket-common) version;
+  hash = "sha256-ASbOC68c61de9ReAfU0rFLnzLwYYAgThLsc6tKdyVno=";
+  meta = junixsocket-common.meta // {
+    description = "Binaries of the native JNI library for junixsocket for common platforms";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+}

From 3477ccbaae731d3ddf2cfcb838a9d73b4b4c0cdf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 Aug 2025 06:08:40 +0000
Subject: [PATCH 03/36] python3Packages.wat: 0.6.0 -> 0.7.0

---
 pkgs/development/python-modules/wat/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/wat/default.nix b/pkgs/development/python-modules/wat/default.nix
index 3cad48246313..916a516ec07e 100644
--- a/pkgs/development/python-modules/wat/default.nix
+++ b/pkgs/development/python-modules/wat/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "wat";
-  version = "0.6.0";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "igrek51";
     repo = "wat";
     rev = version;
-    hash = "sha256-vTq+R/EBkBm27qWR4S9Za6/ppfWD9CLE21SXhTabkhc=";
+    hash = "sha256-ns5eF5jsmwCvx9jnTLG9w0ujH3cPAjzy9bRMgQHVKj4=";
   };
 
   build-system = [ setuptools ];

From 6c0f69230d499e683d21dee452816d061d7aa6a4 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 29 Aug 2025 19:27:33 +0200
Subject: [PATCH 04/36] nixos/rust-motd: fix conf

After the package got upgraded to 2.0, this failed with `.conf` as
extension.

For now, I'm disabling the legacy warning, because that's an issue the
maintainer (i.e. me) needs to solve at some point rather than the folks
using the module.
---
 nixos/modules/programs/rust-motd.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/programs/rust-motd.nix b/nixos/modules/programs/rust-motd.nix
index 8d1eb4a7e5bf..994b5a61fb66 100644
--- a/nixos/modules/programs/rust-motd.nix
+++ b/nixos/modules/programs/rust-motd.nix
@@ -12,7 +12,7 @@ let
   # Order the sections in the TOML according to the order of sections
   # in `cfg.order`.
   motdConf =
-    pkgs.runCommand "motd.conf"
+    pkgs.runCommand "motd.toml"
       {
         __structuredAttrs = true;
         inherit (cfg) order settings;
@@ -154,6 +154,8 @@ in
     security.pam.services.sshd.showMotd = lib.mkIf cfg.enableMotdInSSHD true;
     users.motdFile = lib.mkIf cfg.enableMotdInSSHD "/var/lib/rust-motd/motd";
 
+    programs.rust-motd.settings.global.show_legacy_warning = false;
+
     services.openssh.extraConfig =
       lib.mkIf (cfg.settings ? last_login && cfg.settings.last_login != { })
         ''

From ed1833e8e3319bf30739437f5f83d62bdd699783 Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Sat, 30 Aug 2025 00:07:45 +0200
Subject: [PATCH 05/36] openbao: 2.3.2 -> 2.4.0

https://github.com/openbao/openbao/releases/tag/v2.4.0
---
 pkgs/by-name/op/openbao/package.nix | 18 +++---------------
 pkgs/by-name/op/openbao/ui.nix      |  2 +-
 2 files changed, 4 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/op/openbao/package.nix b/pkgs/by-name/op/openbao/package.nix
index 836848227e49..821a758a25f7 100644
--- a/pkgs/by-name/op/openbao/package.nix
+++ b/pkgs/by-name/op/openbao/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   buildGoModule,
   installShellFiles,
   versionCheckHook,
@@ -15,30 +14,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "openbao";
-  version = "2.3.2";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "openbao";
     repo = "openbao";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r3ZopogeRqsgaM/HEKlS6B0ipaDG/5mKUyzGET3P1e0=";
+    hash = "sha256-VJCKZYBuw6fenTqRDxvLVNMXlPuDEq43WB7TI2RNWvc=";
   };
 
-  vendorHash = "sha256-D4uZmQKe4VuSpuW8JD5NOOq7Nvx8HRXzyvgzkBhsKLQ=";
+  vendorHash = "sha256-4SWpWGWoesUCgSpgOpblkxOpPbBC/grC2S1m7R9qasY=";
 
   proxyVendor = true;
 
-  patches = [
-    (fetchpatch2 {
-      # Temporarily revert upstream raising the min go version to 1.24.6
-      # until that go version lands from staging in master.
-      name = "revert-Bump-to-Go-1.24.6.patch";
-      url = "https://github.com/openbao/openbao/commit/85504045ecf2d343b74be2c1cda6c2c0b0d6acff.patch?full_index=1";
-      revert = true;
-      hash = "sha256-tXSnnqrNxgnJ2ya4HjLSh4e+6hdyPgKRsFsmkMNfNRU=";
-    })
-  ];
-
   subPackages = [ "." ];
 
   tags = lib.optional withHsm "hsm" ++ lib.optional withUi "ui";
diff --git a/pkgs/by-name/op/openbao/ui.nix b/pkgs/by-name/op/openbao/ui.nix
index d104c8b979f1..31e229ae1eba 100644
--- a/pkgs/by-name/op/openbao/ui.nix
+++ b/pkgs/by-name/op/openbao/ui.nix
@@ -12,7 +12,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry_3.fetchYarnBerryDeps {
     inherit (finalAttrs) src sourceRoot;
-    hash = "sha256-/SKQC+i8tgpYNVJIem8XDp+v7olGbRRgW25UhhLpIu8=";
+    hash = "sha256-ZG/br4r2YzPPgsysx7MBy1WtUBkar1U84nkKecZ5bvU=";
   };
 
   nativeBuildInputs = [

From 178272b5b16de4487238a0f1d786a31f4d5f0ca4 Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Sat, 30 Aug 2025 00:09:08 +0200
Subject: [PATCH 06/36] openbao: add emilylange as maintainer

---
 pkgs/by-name/op/openbao/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/op/openbao/package.nix b/pkgs/by-name/op/openbao/package.nix
index 821a758a25f7..1b4ca17f9667 100644
--- a/pkgs/by-name/op/openbao/package.nix
+++ b/pkgs/by-name/op/openbao/package.nix
@@ -77,6 +77,9 @@ buildGoModule (finalAttrs: {
     changelog = "https://github.com/openbao/openbao/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mpl20;
     mainProgram = "bao";
-    maintainers = with lib.maintainers; [ brianmay ];
+    maintainers = with lib.maintainers; [
+      brianmay
+      emilylange
+    ];
   };
 })

From bfc220ababdc9731ae964f94f9264f785c6fa89e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 30 Aug 2025 02:41:15 +0200
Subject: [PATCH 07/36] python313Packages.yq: convert to pyproject, cleanup
 maintainers

---
 pkgs/development/python-modules/yq/default.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/yq/default.nix b/pkgs/development/python-modules/yq/default.nix
index e638a4d25897..8590db58b453 100644
--- a/pkgs/development/python-modules/yq/default.nix
+++ b/pkgs/development/python-modules/yq/default.nix
@@ -6,6 +6,7 @@
   jq,
   pytestCheckHook,
   pyyaml,
+  setuptools,
   setuptools-scm,
   replaceVars,
   tomlkit,
@@ -15,7 +16,7 @@
 buildPythonPackage rec {
   pname = "yq";
   version = "3.4.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -28,9 +29,12 @@ buildPythonPackage rec {
     })
   ];
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     argcomplete
     pyyaml
     tomlkit
@@ -48,7 +52,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/kislyuk/yq";
     license = licenses.asl20;
     maintainers = with maintainers; [
-      womfoo
       SuperSandro2000
     ];
     mainProgram = "yq";

From fca0259098da0ed2b7c4830cb5e7595f1e36462e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 30 Aug 2025 05:36:04 +0000
Subject: [PATCH 08/36] python3Packages.pytest-resource-path: 1.3.0 -> 1.4.0

---
 .../python-modules/pytest-resource-path/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-resource-path/default.nix b/pkgs/development/python-modules/pytest-resource-path/default.nix
index 557a9e9995a7..013a70e804bb 100644
--- a/pkgs/development/python-modules/pytest-resource-path/default.nix
+++ b/pkgs/development/python-modules/pytest-resource-path/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-resource-path";
-  version = "1.3.0";
+  version = "1.4.0";
   format = "setuptools";
   disabled = pythonOlder "3.5";
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "yukihiko-shinoda";
     repo = "pytest-resource-path";
     rev = "v${version}";
-    sha256 = "1siv3pk4fsabz254fdzr7c0pxy124habnbw4ym66pfk883fr96g2";
+    sha256 = "sha256-9OBO9b02RrXilXUucerQQMTaQIRXtbcKCHqwwp9tBto=";
   };
 
   postPatch = ''

From 0f2a209e040af53c783d28bbbdfa03e5ef0bed9d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 30 Aug 2025 06:27:44 +0000
Subject: [PATCH 09/36] 
 python3Packages.llama-index-indices-managed-llama-cloud: 0.9.0 -> 0.9.2

---
 .../llama-index-indices-managed-llama-cloud/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix b/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
index 4d4ebf6add42..cb0b7dda7b49 100644
--- a/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-indices-managed-llama-cloud";
-  version = "0.9.0";
+  version = "0.9.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_indices_managed_llama_cloud";
     inherit version;
-    hash = "sha256-+6rbauPucS2vQ5qpvjZ+3h+LGQAYtVAQ18NTddKc5Lc=";
+    hash = "sha256-Ga9V2o8SGNgDkPy+XN/vYQCsx1WwF3pAd6kkwxovs0U=";
   };
 
   pythonRelaxDeps = [ "llama-cloud" ];

From 5d588c174274eeb6f680c0b979ff6079f59811c9 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 30 Aug 2025 08:42:08 +0200
Subject: [PATCH 10/36] python313Packages.pytest-resource-path: refactor

---
 .../python-modules/pytest-resource-path/default.nix  | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-resource-path/default.nix b/pkgs/development/python-modules/pytest-resource-path/default.nix
index 013a70e804bb..d330e6c9ab68 100644
--- a/pkgs/development/python-modules/pytest-resource-path/default.nix
+++ b/pkgs/development/python-modules/pytest-resource-path/default.nix
@@ -6,19 +6,19 @@
   colorama,
   pytest,
   pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pytest-resource-path";
   version = "1.4.0";
-  format = "setuptools";
-  disabled = pythonOlder "3.5";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yukihiko-shinoda";
     repo = "pytest-resource-path";
-    rev = "v${version}";
-    sha256 = "sha256-9OBO9b02RrXilXUucerQQMTaQIRXtbcKCHqwwp9tBto=";
+    tag = "v${version}";
+    hash = "sha256-9OBO9b02RrXilXUucerQQMTaQIRXtbcKCHqwwp9tBto=";
   };
 
   postPatch = ''
@@ -26,9 +26,11 @@ buildPythonPackage rec {
       --replace "pytest-runner" ""
   '';
 
+  build-system = [ setuptools ];
+
   buildInputs = [ pytest ];
 
-  propagatedBuildInputs = [ colorama ];
+  dependencies = [ colorama ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 

From ddb544f3cadb89d7b5cf8ddee483b49919a18dd2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 30 Aug 2025 10:34:10 +0000
Subject: [PATCH 11/36] python3Packages.reconplogger: 4.17.1 -> 4.18.0

---
 pkgs/development/python-modules/reconplogger/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/reconplogger/default.nix b/pkgs/development/python-modules/reconplogger/default.nix
index 08714838c5e7..dbefc1929ba4 100644
--- a/pkgs/development/python-modules/reconplogger/default.nix
+++ b/pkgs/development/python-modules/reconplogger/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "reconplogger";
-  version = "4.17.1";
+  version = "4.18.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "omni-us";
     repo = "reconplogger";
     tag = "v${version}";
-    hash = "sha256-6oFnERueR8TQOFrMiQGbs05wP1NOhp/hqyFJ9ibquEw=";
+    hash = "sha256-awUGDE9yuPhWMZ4osCJKw8v5V1leoFF3DeCbluHeN70=";
   };
 
   build-system = [ setuptools ];

From 510532e9ae384493070086dc525bb6e7af2129d2 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 23 Aug 2025 20:03:55 +0200
Subject: [PATCH 12/36] linux_6_15: remove

EOL upstream.

We only have one hardened kernel at the moment now because
LTS == latest available. This situation would've also happened before
the cleanup since 6.13/6.14 were removed in June already[1].

[1] 23b573705de96bf400a30d22bc195acb0763ac12
---
 .../manual/configuration/linux-kernel.chapter.md  |  6 ++++++
 nixos/tests/kernel-generic.nix                    |  1 -
 .../linux/kernel/hardened/patches.json            | 10 ----------
 pkgs/os-specific/linux/kernel/kernels-org.json    |  5 -----
 pkgs/top-level/linux-kernels.nix                  | 15 ++++-----------
 5 files changed, 10 insertions(+), 27 deletions(-)

diff --git a/nixos/doc/manual/configuration/linux-kernel.chapter.md b/nixos/doc/manual/configuration/linux-kernel.chapter.md
index dcd47e0126e0..2046fd38d291 100644
--- a/nixos/doc/manual/configuration/linux-kernel.chapter.md
+++ b/nixos/doc/manual/configuration/linux-kernel.chapter.md
@@ -24,6 +24,12 @@ abandoned by the kernel developers, even on stable NixOS versions. If you
 pin your kernel onto a non-longterm version, expect your evaluation to fail as
 soon as the version is out of maintenance.
 
+A kernel will be removed from nixpkgs when the first batch of stable kernels
+_after_ the final release is published. E.g. when 6.15.11 is the final release
+of the 6.15 series and is released together with 6.16.3 and 6.12.43, it will be
+removed on the release of 6.16.4 and 6.12.44. Custom kernel variants such
+as linux-hardened are also affected by this.
+
 Longterm versions of kernels will be removed before the next stable NixOS that will
 exceed the maintenance period of the kernel version.
 
diff --git a/nixos/tests/kernel-generic.nix b/nixos/tests/kernel-generic.nix
index 63e833dd7fb3..7d15e8bdc11a 100644
--- a/nixos/tests/kernel-generic.nix
+++ b/nixos/tests/kernel-generic.nix
@@ -36,7 +36,6 @@ let
   kernels = pkgs.linuxKernel.vanillaPackages // {
     inherit (pkgs.linuxKernel.packages)
       linux_6_12_hardened
-      linux_6_15_hardened
       linux_rt_5_4
       linux_rt_5_10
       linux_rt_5_15
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index aabd62a41379..ca2e040f3df0 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -8,15 +8,5 @@
         },
         "sha256": "09qfpxyxi3z8cd64r2r5mxvh54a5sx8p5mk4d50y4ga2k6pa66bb",
         "version": "6.12.41"
-    },
-    "6.15": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-v6.15.9-hardened1.patch",
-            "sha256": "132h0cgv8kzrlz7jprqvwcnragc2v793a759bhg0q6w3ninmncjc",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.15.9-hardened1/linux-hardened-v6.15.9-hardened1.patch"
-        },
-        "sha256": "0zcma8ycdwwzd4yci9752acsv85wh27lahclh5x2yc4jakw3lkz9",
-        "version": "6.15.9"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 76b51e7a95cf..89dc416b8c2e 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -33,11 +33,6 @@
         "hash": "sha256:1vmxywg11z946i806sg7rk7jr9px87spmwwbzjxpps2nsjybpjqg",
         "lts": true
     },
-    "6.15": {
-        "version": "6.15.11",
-        "hash": "sha256:14sxwrvw9p4ybizb8ky1rgahc62q0aw5qkmzqp3cpnavqfgldaw9",
-        "lts": false
-    },
     "6.16": {
         "version": "6.16.3",
         "hash": "sha256:118bg72mdrf75r36gki5zi18ynl2kcygrf24pwd58by1anh9nhw0",
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 92e7265ed62b..26829450d243 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -210,14 +210,6 @@ in
           ];
         };
 
-        linux_6_15 = callPackage ../os-specific/linux/kernel/mainline.nix {
-          branch = "6.15";
-          kernelPatches = [
-            kernelPatches.bridge_stp_helper
-            kernelPatches.request_key_helper
-          ];
-        };
-
         linux_6_16 = callPackage ../os-specific/linux/kernel/mainline.nix {
           branch = "6.16";
           kernelPatches = [
@@ -295,7 +287,6 @@ in
         linux_latest_libre = deblobKernel packageAliases.linux_latest.kernel;
 
         linux_6_12_hardened = hardenedKernelFor kernels.linux_6_12 { };
-        linux_6_15_hardened = hardenedKernelFor kernels.linux_6_15 { };
 
         linux_hardened = hardenedKernelFor packageAliases.linux_default.kernel { };
       }
@@ -306,6 +297,7 @@ in
         linux_6_11 = throw "linux 6.11 was removed because it has reached its end of life upstream";
         linux_6_13 = throw "linux 6.13 was removed because it has reached its end of life upstream";
         linux_6_14 = throw "linux 6.14 was removed because it has reached its end of life upstream";
+        linux_6_15 = throw "linux 6.15 was removed because it has reached its end of life upstream";
 
         linux_5_10_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
         linux_5_15_hardened = throw "linux_hardened on nixpkgs only contains latest stable and latest LTS";
@@ -319,6 +311,7 @@ in
         linux_6_11_hardened = throw "linux 6.11 was removed because it has reached its end of life upstream";
         linux_6_13_hardened = throw "linux 6.13 was removed because it has reached its end of life upstream";
         linux_6_14_hardened = throw "linux 6.14 was removed because it has reached its end of life upstream";
+        linux_6_15_hardened = throw "linux 6.15 was removed because it has reached its end of life upstream";
 
         linux_ham = throw "linux_ham has been removed in favour of the standard kernel packages";
       }
@@ -738,7 +731,6 @@ in
     linux_6_1 = recurseIntoAttrs (packagesFor kernels.linux_6_1);
     linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
     linux_6_12 = recurseIntoAttrs (packagesFor kernels.linux_6_12);
-    linux_6_15 = recurseIntoAttrs (packagesFor kernels.linux_6_15);
     linux_6_16 = recurseIntoAttrs (packagesFor kernels.linux_6_16);
   }
   // lib.optionalAttrs config.allowAliases {
@@ -748,6 +740,7 @@ in
     linux_6_11 = throw "linux 6.11 was removed because it reached its end of life upstream"; # Added 2025-03-23
     linux_6_13 = throw "linux 6.13 was removed because it reached its end of life upstream"; # Added 2025-06-22
     linux_6_14 = throw "linux 6.14 was removed because it reached its end of life upstream"; # Added 2025-06-22
+    linux_6_15 = throw "linux 6.15 was removed because it reached its end of life upstream"; # Added 2025-08-23
   };
 
   rtPackages = {
@@ -778,7 +771,6 @@ in
       linux_hardened = recurseIntoAttrs (packagesFor kernels.linux_hardened);
 
       linux_6_12_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_12_hardened);
-      linux_6_15_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_15_hardened);
 
       linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
       linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);
@@ -805,6 +797,7 @@ in
       linux_6_11_hardened = throw "linux 6.11 was removed because it has reached its end of life upstream";
       linux_6_13_hardened = throw "linux 6.13 was removed because it has reached its end of life upstream";
       linux_6_14_hardened = throw "linux 6.14 was removed because it has reached its end of life upstream";
+      linux_6_15_hardened = throw "linux 6.15 was removed because it has reached its end of life upstream";
       linux_ham = throw "linux_ham has been removed in favour of the standard kernel packages";
     }
   );

From 4a5b61bf51e47a48fa2edbcc5177c45daf920e60 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 30 Aug 2025 19:55:38 +0300
Subject: [PATCH 13/36] python3Packages.nfcpy: fix tests

---
 pkgs/development/python-modules/nfcpy/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/nfcpy/default.nix b/pkgs/development/python-modules/nfcpy/default.nix
index 35f32269f625..21886328854b 100644
--- a/pkgs/development/python-modules/nfcpy/default.nix
+++ b/pkgs/development/python-modules/nfcpy/default.nix
@@ -7,6 +7,7 @@
   ndeflib,
   pydes,
   pyserial,
+  pytest-tornasync,
   pytest-mock,
   pytestCheckHook,
   pythonOlder,
@@ -34,6 +35,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    pytest-tornasync
     mock
     pytest-mock
     pytestCheckHook

From 5cff030797ea231743deb9c4dfa88f44fadcc61d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 30 Aug 2025 18:32:47 +0000
Subject: [PATCH 14/36] python3Packages.meross-iot: 0.4.9.0 -> 0.4.9.1

---
 pkgs/development/python-modules/meross-iot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/meross-iot/default.nix b/pkgs/development/python-modules/meross-iot/default.nix
index fa1c7b10dbf0..d474b8a2b04a 100644
--- a/pkgs/development/python-modules/meross-iot/default.nix
+++ b/pkgs/development/python-modules/meross-iot/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "meross-iot";
-  version = "0.4.9.0";
+  version = "0.4.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "albertogeniola";
     repo = "MerossIot";
     tag = version;
-    hash = "sha256-EBsWEsP7SzhDbMayD2903T5Q2WDJKboVtyYY4xP8AOE=";
+    hash = "sha256-c9nUFCjbuqJaGk5Rqo+Nmr+IYQrWsVqb36mLmYTc47s=";
   };
 
   build-system = [ setuptools ];

From 0a050405d4328bc717c66661d4c34432a5170023 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 30 Aug 2025 22:11:52 +0200
Subject: [PATCH 15/36] nixos_render_docs: fix weird rendered UTF-8 arrows to
 ASCII ones

I have Wezterm and Nerdfonts and even with that the arrows render pretty
strange.
---
 .../src/nixos_render_docs/redirects.py                 | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
index 5669b0aa27b4..e8ddfee895ef 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
@@ -58,18 +58,18 @@ Keys of the redirects mapping must correspond to some identifier in the source.
 This can happen when an identifier was added, renamed, or removed.
 
     Added new content?
-        $ redirects add-content ❬identifier❭ ❬path❭
+        $ redirects add-content <identifier> <path>
     often:
-        $ redirects add-content ❬identifier❭ index.html
+        $ redirects add-content <identifier> index.html
 
     Moved existing content to a different output path?
-        $ redirects move-content ❬identifier❭ ❬path❭
+        $ redirects move-content <identifier> <path>
 
     Renamed existing identifiers?
-        $ redirects rename-identifier ❬old-identifier❭ ❬new-identifier❭
+        $ redirects rename-identifier <old-identifier> <new-identifier>
 
     Removed content? Redirect to alternatives or relevant release notes.
-        $ redirects remove-and-redirect ❬identifier❭ ❬target-identifier❭
+        $ redirects remove-and-redirect <identifier> <target-identifier>
 
     NOTE: Run the right nix-shell to make this command available.
         Nixpkgs:

From a65acb53019972998e2d62970bcfbf45e2a3197c Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 07:24:37 +0800
Subject: [PATCH 16/36] vigra: add updateScript

---
 pkgs/development/libraries/vigra/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/libraries/vigra/default.nix b/pkgs/development/libraries/vigra/default.nix
index 7f73bf4eee89..fa49017c431b 100644
--- a/pkgs/development/libraries/vigra/default.nix
+++ b/pkgs/development/libraries/vigra/default.nix
@@ -12,6 +12,9 @@
   libtiff,
   openexr,
   python3,
+  writeShellScript,
+  jq,
+  nix-update,
 }:
 
 let
@@ -69,6 +72,10 @@ stdenv.mkDerivation (finalAttrs: {
         doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
       });
     };
+    updateScript = writeShellScript "update-vigra" ''
+      latestVersion=$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --fail --silent https://api.github.com/repos/ukoethe/vigra/releases/latest | ${lib.getExe jq} --raw-output .tag_name | sed -E 's/Version-([0-9]+)-([0-9]+)-([0-9]+)/\1.\2.\3/')
+      ${lib.getExe nix-update} vigra --version $latestVersion
+    '';
   };
 
   meta = with lib; {

From 913de6a9babf35c083782c521f2001ded8aa1c3e Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 07:25:17 +0800
Subject: [PATCH 17/36] vigra: 1.12.1 -> 1.12.2

---
 pkgs/development/libraries/vigra/default.nix  | 10 ++-------
 .../libraries/vigra/fix-llvm-19-1.patch       | 22 -------------------
 .../libraries/vigra/fix-llvm-19-2.patch       | 22 -------------------
 3 files changed, 2 insertions(+), 52 deletions(-)
 delete mode 100644 pkgs/development/libraries/vigra/fix-llvm-19-1.patch
 delete mode 100644 pkgs/development/libraries/vigra/fix-llvm-19-2.patch

diff --git a/pkgs/development/libraries/vigra/default.nix b/pkgs/development/libraries/vigra/default.nix
index fa49017c431b..04115bc7a536 100644
--- a/pkgs/development/libraries/vigra/default.nix
+++ b/pkgs/development/libraries/vigra/default.nix
@@ -22,21 +22,15 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vigra";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "ukoethe";
     repo = "vigra";
     tag = "Version-${lib.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
-    hash = "sha256-ZmHj1BSyoMBCuxI5hrRiBEb5pDUsGzis+T5FSX27UN8=";
+    hash = "sha256-E+O5NbDX1ycDJTht6kW8JzYnhEL6Wd1xp0rcLpdm2HQ=";
   };
 
-  patches = [
-    # Patches to fix compiling on LLVM 19 from https://github.com/ukoethe/vigra/pull/592
-    ./fix-llvm-19-1.patch
-    ./fix-llvm-19-2.patch
-  ];
-
   nativeBuildInputs = [ cmake ];
   buildInputs = [
     boost
diff --git a/pkgs/development/libraries/vigra/fix-llvm-19-1.patch b/pkgs/development/libraries/vigra/fix-llvm-19-1.patch
deleted file mode 100644
index 543f0752e84f..000000000000
--- a/pkgs/development/libraries/vigra/fix-llvm-19-1.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From c04362c082f35e87afbc9441dd2b3821de179055 Mon Sep 17 00:00:00 2001
-From: Lukas N Wirz <lnwirz@chem.helsinki.fi>
-Date: Sat, 9 Nov 2024 23:15:40 +0200
-Subject: [PATCH] fix --this typo
-
----
- include/vigra/multi_iterator_coupled.hxx | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/vigra/multi_iterator_coupled.hxx b/include/vigra/multi_iterator_coupled.hxx
-index 6831dad5d..9e6ca3c62 100644
---- a/include/vigra/multi_iterator_coupled.hxx
-+++ b/include/vigra/multi_iterator_coupled.hxx
-@@ -490,7 +490,7 @@ class CoupledScanOrderIterator<N, HANDLES, 0>
-     CoupledScanOrderIterator operator--(int)
-     {
-         CoupledScanOrderIterator res(*this);
--        --this;
-+        std::advance(this, -1);
-         return res;
-     }
- 
diff --git a/pkgs/development/libraries/vigra/fix-llvm-19-2.patch b/pkgs/development/libraries/vigra/fix-llvm-19-2.patch
deleted file mode 100644
index 92e730655fb7..000000000000
--- a/pkgs/development/libraries/vigra/fix-llvm-19-2.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From 191c09c2b086e1b0ab0ca1088e48e35fe492c620 Mon Sep 17 00:00:00 2001
-From: Lukas N Wirz <lnwirz@chem.helsinki.fi>
-Date: Sun, 10 Nov 2024 16:01:46 +0200
-Subject: [PATCH] typo
-
----
- include/vigra/multi_iterator_coupled.hxx | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/vigra/multi_iterator_coupled.hxx b/include/vigra/multi_iterator_coupled.hxx
-index 9e6ca3c62..1cb401897 100644
---- a/include/vigra/multi_iterator_coupled.hxx
-+++ b/include/vigra/multi_iterator_coupled.hxx
-@@ -490,7 +490,7 @@ class CoupledScanOrderIterator<N, HANDLES, 0>
-     CoupledScanOrderIterator operator--(int)
-     {
-         CoupledScanOrderIterator res(*this);
--        std::advance(this, -1);
-+        std::advance(*this, -1);
-         return res;
-     }
- 

From 94acab182af6c6624dc853e161ad56405c1df482 Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 07:25:45 +0800
Subject: [PATCH 18/36] vigra: remove with lib

---
 pkgs/development/libraries/vigra/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/vigra/default.nix b/pkgs/development/libraries/vigra/default.nix
index 04115bc7a536..a0d7b89a2e5e 100644
--- a/pkgs/development/libraries/vigra/default.nix
+++ b/pkgs/development/libraries/vigra/default.nix
@@ -72,12 +72,12 @@ stdenv.mkDerivation (finalAttrs: {
     '';
   };
 
-  meta = with lib; {
+  meta = {
     description = "Novel computer vision C++ library with customizable algorithms and data structures";
     mainProgram = "vigra-config";
     homepage = "https://hci.iwr.uni-heidelberg.de/vigra";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ShamrockLee ];
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ShamrockLee ];
+    platforms = lib.platforms.unix;
   };
 })

From ca3872f194eb62f8e07d8b4dd144d2e97c63e1e6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Aug 2025 01:04:29 +0000
Subject: [PATCH 19/36] cdncheck: 1.1.33 -> 1.1.34

---
 pkgs/by-name/cd/cdncheck/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index 07441d7667f1..ba8c03eb2cdd 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.1.33";
+  version = "1.1.34";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-T00lM/jA0+3z5RViQkzACNyUqsgSzYtdgGwNli+nm7w=";
+    hash = "sha256-I/wmKKrXFjaha2sq9l/zFJkkDf6DNNeSAOBcKmnOZNg=";
   };
 
   vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";

From b9aefa960eee38a8dfb549db5024757be86065db Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 10:06:08 +0800
Subject: [PATCH 20/36] maintainers: add kyehn

---
 maintainers/maintainer-list.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d072e72875e8..c7d635db9d81 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14026,6 +14026,11 @@
     githubId = 2422454;
     name = "Kai Wohlfahrt";
   };
+  kyehn = {
+    name = "kyehn";
+    github = "kyehn";
+    githubId = 228304369;
+  };
   kylecarbs = {
     name = "Kyle Carberry";
     email = "kyle@carberry.com";

From eb60a3b59a8926b4d70580cb93756c85f588b3c2 Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 10:08:22 +0800
Subject: [PATCH 21/36] vigra: add kyehn as maintainer

---
 pkgs/development/libraries/vigra/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/vigra/default.nix b/pkgs/development/libraries/vigra/default.nix
index a0d7b89a2e5e..46d4965c105f 100644
--- a/pkgs/development/libraries/vigra/default.nix
+++ b/pkgs/development/libraries/vigra/default.nix
@@ -77,7 +77,10 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "vigra-config";
     homepage = "https://hci.iwr.uni-heidelberg.de/vigra";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ ShamrockLee ];
+    maintainers = with lib.maintainers; [
+      ShamrockLee
+      kyehn
+    ];
     platforms = lib.platforms.unix;
   };
 })

From b904b38a4a820b38c4dc5a607e4a9a4e353666f1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Aug 2025 02:24:23 +0000
Subject: [PATCH 22/36] python3Packages.govee-local-api: 2.1.0 -> 2.2.0

---
 pkgs/development/python-modules/govee-local-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/govee-local-api/default.nix b/pkgs/development/python-modules/govee-local-api/default.nix
index 59fc90f1b53f..dbcd90d96609 100644
--- a/pkgs/development/python-modules/govee-local-api/default.nix
+++ b/pkgs/development/python-modules/govee-local-api/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "govee-local-api";
-  version = "2.1.0";
+  version = "2.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Galorhallen";
     repo = "govee-local-api";
     tag = "v${version}";
-    hash = "sha256-a5x4RbZ5+ryByr6/yGJw2/dNJBR7/JTYBcvA+Eqygqc=";
+    hash = "sha256-DjerH/51ta0Q3by47+Xo0Fp3nk4igum00mSZeoswYxM=";
   };
 
   postPatch = ''

From b47cef454f9afd70ac4a5e9dfb851b7eafabc15e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Aug 2025 02:58:55 +0000
Subject: [PATCH 23/36] python3Packages.turrishw: 1.0.0 -> 1.1.0

---
 pkgs/development/python-modules/turrishw/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/turrishw/default.nix b/pkgs/development/python-modules/turrishw/default.nix
index 8f5378f6ef4e..ce949a2b680f 100644
--- a/pkgs/development/python-modules/turrishw/default.nix
+++ b/pkgs/development/python-modules/turrishw/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "turrishw";
-  version = "1.0.0";
+  version = "1.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "turris-cz";
     repo = "turrishw";
     tag = "v${version}";
-    hash = "sha256-elu2f54asdzdn7wQT2CKo8kVYnc1KTakRyr8Nxu+XNw=";
+    hash = "sha256-LQ1ebcVQo7jixAKOPg/oNBnRU8AZebHANfDU4lamB8g=";
   };
 
   build-system = [ hatchling ];

From b947ddcede2263f75c491f58981db258c355d24c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Aug 2025 03:13:18 +0000
Subject: [PATCH 24/36] python3Packages.pytransportnswv2: 0.9.0 -> 2.0.0

---
 pkgs/development/python-modules/pytransportnswv2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytransportnswv2/default.nix b/pkgs/development/python-modules/pytransportnswv2/default.nix
index 201e2dc259b1..2ef7b645e3af 100644
--- a/pkgs/development/python-modules/pytransportnswv2/default.nix
+++ b/pkgs/development/python-modules/pytransportnswv2/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pytransportnswv2";
-  version = "0.9.0";
+  version = "2.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyTransportNSWv2";
     inherit version;
-    hash = "sha256-J3OW8fWldbkKzCDlXSv7nucVdyEnDFx8uCicF+ELQkQ=";
+    hash = "sha256-+JJ36cUzeK25pWF9eEvgB5G8HGmHmsL7QY3s+AnrjmY=";
   };
 
   build-system = [ setuptools ];

From 8a4752b7cf4a63c861389b3fc0ce0a872daa4fac Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Aug 2025 03:26:26 +0000
Subject: [PATCH 25/36] python3Packages.crontab: 3.2.0 -> 3.3.0

---
 pkgs/development/python-modules/crontab/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/crontab/default.nix b/pkgs/development/python-modules/crontab/default.nix
index 31cbafc2c8a4..990cdb15a681 100644
--- a/pkgs/development/python-modules/crontab/default.nix
+++ b/pkgs/development/python-modules/crontab/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "crontab";
-  version = "3.2.0";
+  version = "3.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "doctormo";
     repo = "python-crontab";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OZalqh/A4pBM1Hat4t76Odk2cTmKLwaHGY7pndgIgss=";
+    hash = "sha256-eJXtvTRwokbewWrTArHJ2FXGDLvlkGA/5ZZR01koMW8=";
   };
 
   build-system = [ setuptools ];

From 60b8a041c88f1fda8f9e31f1eddf55adb7db95ce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Aug 2025 05:52:47 +0000
Subject: [PATCH 26/36] phase-cli: 1.19.3 -> 1.19.6

---
 pkgs/by-name/ph/phase-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ph/phase-cli/package.nix b/pkgs/by-name/ph/phase-cli/package.nix
index 7dfea80603d3..445231c0ec40 100644
--- a/pkgs/by-name/ph/phase-cli/package.nix
+++ b/pkgs/by-name/ph/phase-cli/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "phase-cli";
-  version = "1.19.3";
+  version = "1.19.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "phasehq";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-bKbhSV7Xa5LYjHVBlsboQGY0nCtLmAJaFhGpe4ZCb0s=";
+    hash = "sha256-SOFMTetw5kEduV7ufY1v2vnv3exDEmnCFBr9q83YVTo=";
   };
 
   build-system = with python3Packages; [

From 6e48dcf9ec8bf1f02bd393552e23682070669b64 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Aug 2025 05:52:50 +0000
Subject: [PATCH 27/36] python3Packages.elmax-api: 0.0.6.4rc0 -> 0.0.6.3

---
 pkgs/development/python-modules/elmax-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/elmax-api/default.nix b/pkgs/development/python-modules/elmax-api/default.nix
index 1223908209ec..706d76da02a0 100644
--- a/pkgs/development/python-modules/elmax-api/default.nix
+++ b/pkgs/development/python-modules/elmax-api/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "elmax-api";
-  version = "0.0.6.4rc0";
+  version = "0.0.6.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "albertogeniola";
     repo = "elmax-api";
     tag = "v${version}";
-    hash = "sha256-BYVfP8B+p4J4gW+64xh9bT9sDcu/lk0R+MvLsYLwRfQ=";
+    hash = "sha256-jnm1AFnPxZIgD815ZFxV/i9ar4cZfsYJ0+xDpM3hKmg=";
   };
 
   build-system = [ setuptools ];

From 27fcc80c3a8fe575d6db06d02d1bc1e40758f9e9 Mon Sep 17 00:00:00 2001
From: Tristan Ross <tristan.ross@midstall.com>
Date: Wed, 30 Jul 2025 21:11:28 -0700
Subject: [PATCH 28/36] rustc: fix pkgsLLVM

Fixes `libunwind` from not being included due to improper usage of
`lib.optional` by passing a list instead of a single item. Drops the
hack for `llvmPackages` since just passing it through works now.
---
 pkgs/development/compilers/rust/1_89.nix  | 45 +----------------------
 pkgs/development/compilers/rust/rustc.nix | 11 +-----
 2 files changed, 2 insertions(+), 54 deletions(-)

diff --git a/pkgs/development/compilers/rust/1_89.nix b/pkgs/development/compilers/rust/1_89.nix
index d9acb3b17096..5690db67d8c3 100644
--- a/pkgs/development/compilers/rust/1_89.nix
+++ b/pkgs/development/compilers/rust/1_89.nix
@@ -55,50 +55,7 @@ import ./default.nix
     llvmShared = llvmSharedFor pkgsHostTarget;
 
     # Expose llvmPackages used for rustc from rustc via passthru for LTO in Firefox
-    llvmPackages =
-      if (stdenv.targetPlatform.useLLVM or false) then
-        callPackage (
-          {
-            pkgs,
-            bootBintoolsNoLibc ? if stdenv.targetPlatform.linker == "lld" then null else pkgs.bintoolsNoLibc,
-            bootBintools ? if stdenv.targetPlatform.linker == "lld" then null else pkgs.bintools,
-          }:
-          let
-            llvmPackages = llvmPackages_20;
-
-            setStdenv =
-              pkg:
-              pkg.override {
-                stdenv = stdenv.override {
-                  allowedRequisites = null;
-                  cc = pkgsBuildHost.llvmPackages_20.clangUseLLVM;
-                };
-              };
-          in
-          rec {
-            inherit (llvmPackages) bintools;
-
-            libunwind = setStdenv llvmPackages.libunwind;
-            llvm = setStdenv llvmPackages.llvm;
-
-            libcxx = llvmPackages.libcxx.override {
-              stdenv = stdenv.override {
-                allowedRequisites = null;
-                cc = pkgsBuildHost.llvmPackages_20.clangNoLibcxx;
-                hostPlatform = stdenv.hostPlatform // {
-                  useLLVM = !stdenv.hostPlatform.isDarwin;
-                };
-              };
-              inherit libunwind;
-            };
-
-            clangUseLLVM = llvmPackages.clangUseLLVM.override { inherit libcxx; };
-
-            stdenv = overrideCC args.stdenv clangUseLLVM;
-          }
-        ) { }
-      else
-        llvmPackages_20;
+    llvmPackages = llvmPackages_20;
 
     # Note: the version MUST be the same version that we are building. Upstream
     # ensures that each released compiler can compile itself:
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 29c584e86c6a..6528c44d1d7d 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -94,7 +94,6 @@ stdenv.mkDerivation (finalAttrs: {
         (stdenv.hostPlatform.isLinux && !withBundledLLVM && !stdenv.targetPlatform.isFreeBSD && useLLVM)
         "--push-state --as-needed -L${llvmPackages.libcxx}/lib -lc++ -lc++abi -lLLVM-${lib.versions.major llvmPackages.llvm.version} --pop-state"
     ++ optional (stdenv.hostPlatform.isDarwin && !withBundledLLVM) "-lc++ -lc++abi"
-    ++ optional stdenv.hostPlatform.isFreeBSD "-rpath ${llvmPackages.libunwind}/lib"
     ++ optional stdenv.hostPlatform.isDarwin "-rpath ${llvmSharedForHost.lib}/lib"
   );
 
@@ -385,15 +384,7 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ]
   ++ optional (!withBundledLLVM) llvmShared.lib
-  ++ optional (useLLVM && !withBundledLLVM && !stdenv.targetPlatform.isFreeBSD) [
-    llvmPackages.libunwind
-    # Hack which is used upstream https://github.com/gentoo/gentoo/blob/master/dev-lang/rust/rust-1.78.0.ebuild#L284
-    (runCommandLocal "libunwind-libgcc" { } ''
-      mkdir -p $out/lib
-      ln -s ${llvmPackages.libunwind}/lib/libunwind.so $out/lib/libgcc_s.so
-      ln -s ${llvmPackages.libunwind}/lib/libunwind.so $out/lib/libgcc_s.so.1
-    '')
-  ];
+  ++ optional (useLLVM && !withBundledLLVM) llvmPackages.libunwind;
 
   outputs = [
     "out"

From 06c99c29c95b33260b3513adfaa7c0c144d00a56 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 30 Aug 2025 21:31:40 -0700
Subject: [PATCH 29/36] nixos/nextcloud: remove X-XSS-Protection

see https://github.com/nextcloud/server/pull/53476
---
 nixos/modules/services/web-apps/nextcloud.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index eac2d9622c4e..0572b9529c04 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -1531,7 +1531,6 @@ in
             index index.php index.html /index.php$request_uri;
             ${lib.optionalString (cfg.nginx.recommendedHttpHeaders) ''
               add_header X-Content-Type-Options nosniff;
-              add_header X-XSS-Protection "1; mode=block";
               add_header X-Robots-Tag "noindex, nofollow";
               add_header X-Permitted-Cross-Domain-Policies none;
               add_header X-Frame-Options sameorigin;

From 718503e01be11bd73a3d700724210a3ffe9de8f4 Mon Sep 17 00:00:00 2001
From: Peter Simons <simons@cryp.to>
Date: Sun, 31 Aug 2025 10:45:36 +0200
Subject: [PATCH 30/36] vcsh: pin automake to version 1.16 to fix the build

---
 pkgs/top-level/all-packages.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fe5094154213..c575a19ce684 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6450,6 +6450,10 @@ with pkgs;
 
   or1k-newlib = callPackage ../development/misc/or1k/newlib.nix { };
 
+  vcsh = callPackage ../by-name/vc/vcsh/package.nix {
+    automake = automake116x;
+  };
+
   ### DEVELOPMENT / TOOLS
 
   inherit (callPackage ../development/tools/alloy { })

From b7853bc357d6b7fc829e6dae5d4bd67030746538 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Aug 2025 09:20:22 +0000
Subject: [PATCH 31/36] geographiclib: 2.5.1 -> 2.5.2

---
 pkgs/by-name/ge/geographiclib/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ge/geographiclib/package.nix b/pkgs/by-name/ge/geographiclib/package.nix
index b178db335ad2..e2dce865eeb2 100644
--- a/pkgs/by-name/ge/geographiclib/package.nix
+++ b/pkgs/by-name/ge/geographiclib/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "geographiclib";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "geographiclib";
     repo = "geographiclib";
     tag = "v${version}";
-    hash = "sha256-ZXIRLLvCsVp8RnChjLiAfD38CJFqV8sv/PAEORsF6oc=";
+    hash = "sha256-bFErzgjxBCtN12UNtnGPuS6bg1sI31gR7WZjawsY3Yo=";
   };
 
   outputs = [

From b1dd99fee54435c2a9924e310a721fae30b36dda Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 Aug 2025 09:43:24 +0000
Subject: [PATCH 32/36] python3Packages.extruct: 0.17.0 -> 0.18.0

---
 pkgs/development/python-modules/extruct/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/extruct/default.nix b/pkgs/development/python-modules/extruct/default.nix
index 9abce5642181..eb48a31b9f59 100644
--- a/pkgs/development/python-modules/extruct/default.nix
+++ b/pkgs/development/python-modules/extruct/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "extruct";
-  version = "0.17.0";
+  version = "0.18.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "scrapinghub";
     repo = "extruct";
     tag = "v${version}";
-    hash = "sha256-CfhIqbhrZkJ232grhHxrmj4H1/Bq33ZXe8kovSOWSK0=";
+    hash = "sha256-hUSlIlWxrsxGLCE8/DAGSqxx9+7TEkynmXrVnXGjDQ8=";
   };
 
   nativeBuildInputs = [ setuptools ];

From 401f4264e08c19ae718e68f88dc84f002be6c6d4 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Sun, 31 Aug 2025 14:20:33 +0400
Subject: [PATCH 33/36] geographiclib: add geospatial team

---
 pkgs/by-name/ge/geographiclib/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ge/geographiclib/package.nix b/pkgs/by-name/ge/geographiclib/package.nix
index e2dce865eeb2..a936f7017e75 100644
--- a/pkgs/by-name/ge/geographiclib/package.nix
+++ b/pkgs/by-name/ge/geographiclib/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://geographiclib.sourceforge.io/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ sikmir ];
+    teams = [ lib.teams.geospatial ];
     platforms = lib.platforms.unix;
   };
 }

From 37ff64b7108517f8b6ba5705ee5085eac636a249 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 29 Aug 2025 08:39:01 +0000
Subject: [PATCH 34/36] crosvm: 0-unstable-2025-08-18 -> 0-unstable-2025-08-28

---
 pkgs/by-name/cr/crosvm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cr/crosvm/package.nix b/pkgs/by-name/cr/crosvm/package.nix
index ca06e8b50472..582eb7ae3f0e 100644
--- a/pkgs/by-name/cr/crosvm/package.nix
+++ b/pkgs/by-name/cr/crosvm/package.nix
@@ -21,12 +21,12 @@
 
 rustPlatform.buildRustPackage {
   pname = "crosvm";
-  version = "0-unstable-2025-08-18";
+  version = "0-unstable-2025-08-28";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "44659aa08a8c89c3dad2e468ff57cdb639c80732";
-    hash = "sha256-bYTZ1R/WPUUZoxmdreFGaRt9epAI+mcIrEvs5RJPUeA=";
+    rev = "ce1281988c5639f2a6a4cc6c20c03eb44751de07";
+    hash = "sha256-zorrj6sENcjV+pa2VYhunu8LhxT3oOyDRreHX78HckI=";
     fetchSubmodules = true;
   };
 

From 3cecdee81e74ee3e7b5b4ad23daf264247fd3c36 Mon Sep 17 00:00:00 2001
From: dramforever <dramforever@live.com>
Date: Sun, 31 Aug 2025 02:05:17 +0800
Subject: [PATCH 35/36] linuxPackages.evdi: Fix flags

Since #402198 kernel modules are no longer built with wrapped compilers.

Firstly, NIX_CFLAGS_COMPILE is no longer effective, so we change that to
CFLAGS, which is used in the Makefile for evdi.

Secondly, we still need to use the wrapped compiler for userspace stuff,
so separate that out in postBuild.

Fixes #437311
---
 pkgs/os-specific/linux/evdi/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix
index efb6dd966ec1..4baba4c5f7d8 100644
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -26,12 +26,17 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-xB3AHg9t/X8vw5p7ohFQ+WuMjb1P8DAP3pROiwWkVPs=";
   };
 
-  env.NIX_CFLAGS_COMPILE = toString [
+  env.CFLAGS = toString [
     "-Wno-error"
     "-Wno-error=discarded-qualifiers" # for Linux 4.19 compatibility
     "-Wno-error=sign-compare"
   ];
 
+  postBuild = ''
+    # Don't use makeFlags for userspace stuff
+    make library pyevdi
+  '';
+
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   buildInputs = [
@@ -43,6 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = kernelModuleMakeFlags ++ [
     "KVER=${kernel.modDirVersion}"
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "module"
   ];
 
   hardeningDisable = [

From 7922dc5527a2cdcd1b84c412356f7973d06a7008 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 29 Aug 2025 13:52:48 +0200
Subject: [PATCH 36/36] fwupd: 2.0.13 -> 2.0.14

Diff: https://github.com/fwupd/fwupd/compare/2.0.13...2.0.14

Changelog: https://github.com/fwupd/fwupd/releases/tag/2.0.14
---
 ...d-option-for-installation-sysconfdir.patch | 85 +++++++++++--------
 .../fw/fwupd/install-fwupdplugin-to-out.patch |  6 +-
 .../fw/fwupd/installed-tests-path.patch       | 28 +++---
 pkgs/by-name/fw/fwupd/package.nix             |  4 +-
 4 files changed, 67 insertions(+), 56 deletions(-)

diff --git a/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch b/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch
index 99799f10e717..17adf9687a47 100644
--- a/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch
@@ -1,41 +1,42 @@
-commit e798ff19cd36daaed68b86edc7ebdb9dcfe1c057
+commit 448e265ad3fef9a5ef0ff57593dd5a9164118852
 Author: r-vdp <ramses@well-founded.dev>
 Date:   Tue Oct 15 11:46:38 2024 +0200
 
     Add option for installation sysconfdir
 
 diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
-index b0ff5b106..29b60a3be 100644
+index 3f1cb3574..acbdccb61 100644
 --- a/data/bios-settings.d/meson.build
 +++ b/data/bios-settings.d/meson.build
-@@ -1,5 +1,5 @@
+@@ -1,6 +1,6 @@
  if build_standalone and host_machine.system() == 'linux'
  install_data('README.md',
+   install_tag: 'doc',
 -  install_dir: join_paths(sysconfdir, 'fwupd', 'bios-settings.d')
 +  install_dir: join_paths(datadir, 'fwupd', 'bios-settings.d')
  )
  endif
 diff --git a/data/meson.build b/data/meson.build
-index 9db5cd756..cf3181c8b 100644
+index 78f54bd83..aae01ed56 100644
 --- a/data/meson.build
 +++ b/data/meson.build
-@@ -27,7 +27,7 @@ endif
- 
+@@ -28,7 +28,7 @@ endif
  if build_standalone
    install_data(['fwupd.conf'],
+     install_tag: 'runtime',
 -    install_dir: join_paths(sysconfdir, 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'fwupd'),
      install_mode: 'rw-r-----',
    )
    plugin_quirks += files([
 diff --git a/data/pki/meson.build b/data/pki/meson.build
-index 686064195..72ae401bd 100644
+index 9b1e6b372..5c80ba564 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
-@@ -7,13 +7,13 @@ install_data([
-     'GPG-KEY-Linux-Foundation-Firmware',
+@@ -8,14 +8,14 @@ install_data([
      'GPG-KEY-Linux-Vendor-Firmware-Service',
    ],
+   install_tag: 'runtime',
 -  install_dir: join_paths(sysconfdir, 'pki', 'fwupd')
 +  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd')
  )
@@ -43,120 +44,130 @@ index 686064195..72ae401bd 100644
      'GPG-KEY-Linux-Foundation-Metadata',
      'GPG-KEY-Linux-Vendor-Firmware-Service',
    ],
+   install_tag: 'runtime',
 -  install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata')
 +  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
  )
  endif
  
-@@ -21,11 +21,11 @@ if supported_pkcs7
- install_data([
+@@ -24,12 +24,12 @@ install_data([
      'LVFS-CA.pem',
    ],
+   install_tag: 'runtime',
 -  install_dir: join_paths(sysconfdir, 'pki', 'fwupd')
 +  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd')
  )
  install_data([
      'LVFS-CA.pem',
    ],
+   install_tag: 'runtime',
 -  install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata')
 +  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
  )
  endif
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index 10201bc9a..fba712491 100644
+index 77285cafa..7d2cb8f58 100644
 --- a/data/remotes.d/meson.build
 +++ b/data/remotes.d/meson.build
-@@ -11,14 +11,14 @@ if build_standalone and get_option('lvfs') != 'false'
-     output: 'lvfs.conf',
+@@ -12,7 +12,7 @@ if build_standalone and get_option('lvfs') != 'false'
      configuration: con3,
      install: true,
+     install_tag: 'runtime',
 -    install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +    install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
    )
    configure_file(
      input: 'lvfs-testing.conf',
-     output: 'lvfs-testing.conf',
+@@ -20,7 +20,7 @@ if build_standalone and get_option('lvfs') != 'false'
      configuration: con3,
      install: true,
+     install_tag: 'runtime',
 -    install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +    install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
    )
    i18n.merge_file(
      input: 'lvfs.metainfo.xml',
-@@ -52,12 +52,12 @@ configure_file(
-   output: 'vendor.conf',
+@@ -58,7 +58,7 @@ configure_file(
    configuration: con2,
    install: get_option('vendor_metadata'),
+   install_tag: 'runtime',
 -  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
  configure_file(
    input: 'vendor-directory.conf',
-   output: 'vendor-directory.conf',
+@@ -66,5 +66,5 @@ configure_file(
    configuration: con2,
    install: true,
+   install_tag: 'runtime',
 -  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/docs/meson.build b/docs/meson.build
-index 5693edcc8..181c359a4 100644
+index c1e483f4f..684ec3fbe 100644
 --- a/docs/meson.build
 +++ b/docs/meson.build
-@@ -124,7 +124,7 @@ if build_docs
-     ],
+@@ -127,7 +127,7 @@ if build_docs
      build_by_default: true,
      install: true,
+     install_tag: 'doc',
 -    install_dir: join_paths(datadir, 'doc'),
 +    install_dir: join_paths(sysconfdir_install, 'doc'),
    )
  
    subdir('hsi-tests.d')
-@@ -182,7 +182,7 @@ if build_docs
-     ],
+@@ -186,7 +186,7 @@ if build_docs
      build_by_default: true,
      install: true,
+     install_tag: 'doc',
 -    install_dir: join_paths(datadir, 'doc'),
 +    install_dir: join_paths(sysconfdir_install, 'doc'),
    )
    man_cmd = []
    foreach man: man_md
-@@ -196,7 +196,7 @@ if build_docs
-       man_cmd,
+@@ -201,31 +201,31 @@ if build_docs
      ],
      install: true,
+     install_tag: 'doc',
 -    install_dir: join_paths(datadir, 'doc', 'fwupd')
 +    install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd')
    )
    if hsi
      install_data(['hsi.html'],
-@@ -204,18 +204,18 @@ if build_docs
+       install_tag: 'doc',
+-      install_dir : join_paths(datadir, 'doc', 'fwupd')
++      install_dir : join_paths(sysconfdir_install, 'doc', 'fwupd')
      )
    endif
    install_data(['urlmap_fwupd.js'],
+     install_tag: 'doc',
 -    install_dir: join_paths(datadir, 'doc', 'libfwupd')
 +    install_dir: join_paths(sysconfdir_install, 'doc', 'libfwupd')
    )
    install_data(['urlmap_fwupdplugin.js'],
+     install_tag: 'doc',
 -    install_dir: join_paths(datadir, 'doc', 'libfwupdplugin')
 +    install_dir: join_paths(sysconfdir_install, 'doc', 'libfwupdplugin')
    )
    #make devhelp work
    install_symlink('libfwupd',
+     install_tag: 'doc',
 -    install_dir: join_paths(datadir, 'doc', 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd'),
      pointing_to: join_paths('..', 'libfwupd'),
    )
    install_symlink('libfwupdplugin',
+     install_tag: 'doc',
 -    install_dir: join_paths(datadir, 'doc', 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd'),
      pointing_to: join_paths('..', 'libfwupdplugin'),
    )
  endif
 diff --git a/meson.build b/meson.build
-index 2ceaf531c..e4e764b97 100644
+index 4faedcc0b..980f9bb0c 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -201,6 +201,12 @@ endif
+@@ -212,6 +212,12 @@ endif
  mandir = join_paths(prefix, get_option('mandir'))
  localedir = join_paths(prefix, get_option('localedir'))
  
@@ -167,10 +178,10 @@ index 2ceaf531c..e4e764b97 100644
 +endif
 +
  diffcmd = find_program('diff')
- gio = dependency('gio-2.0', version: '>= 2.72.0')
- giounix = dependency('gio-unix-2.0', version: '>= 2.72.0', required: false)
+ gio = dependency('gio-2.0', version: '>= 2.68.0') # limited by RHEL-9, which has v2.68.4
+ giounix = dependency('gio-unix-2.0', version: '>= 2.68.0', required: false)
 diff --git a/meson_options.txt b/meson_options.txt
-index a4a211fbb..6197fe502 100644
+index 63c8d288d..04f6651e6 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -7,6 +7,11 @@ option('bluez',
@@ -186,22 +197,22 @@ index a4a211fbb..6197fe502 100644
    type: 'combo',
    choices: [
 diff --git a/plugins/uefi-capsule/meson.build b/plugins/uefi-capsule/meson.build
-index 2dfc4d2f0..e5ac73edd 100644
+index 647ace53e..4ee0192df 100644
 --- a/plugins/uefi-capsule/meson.build
 +++ b/plugins/uefi-capsule/meson.build
-@@ -20,7 +20,7 @@ if host_machine.system() == 'linux'
-     output: '35_fwupd',
+@@ -23,7 +23,7 @@ if host_machine.system() == 'linux'
      configuration: con2,
      install: true,
+     install_tag: 'runtime',
 -    install_dir: join_paths(sysconfdir, 'grub.d')
 +    install_dir: join_paths(sysconfdir_install, 'grub.d')
    )
  elif host_machine.system() == 'freebsd'
-   backend_srcs += 'fu-uefi-backend-freebsd.c'
-@@ -93,7 +93,7 @@ if get_option('plugin_uefi_capsule_splash')
-       '--out', '@OUTPUT@',
+   backend_srcs += 'fu-uefi-capsule-backend-freebsd.c'
+@@ -98,7 +98,7 @@ if get_option('plugin_uefi_capsule_splash')
      ],
      install: true,
+     install_tag: 'runtime',
 -    install_dir: join_paths(datadir, 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'fwupd'),
    )
diff --git a/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch b/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch
index 78d6b25b195b..57726af3bc69 100644
--- a/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch
+++ b/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch
@@ -1,14 +1,14 @@
-commit 50827b154728a97e5dfcb7d41e5c7155752919c3
+commit 1b7f8b3ad7df9a5911fbc45608d9b40e0787baca
 Author: r-vdp <ramses@well-founded.dev>
 Date:   Mon Oct 28 12:07:51 2024 +0100
 
     Install fwupdplugin to out
 
 diff --git a/meson.build b/meson.build
-index 250b76107..62c127c35 100644
+index 747d1b385..312513d75 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -553,7 +553,7 @@ if build_standalone
+@@ -548,7 +548,7 @@ if build_standalone
  if host_machine.system() == 'windows'
    libdir_pkg = bindir
  else
diff --git a/pkgs/by-name/fw/fwupd/installed-tests-path.patch b/pkgs/by-name/fw/fwupd/installed-tests-path.patch
index 3b1ded1a31f5..afcd9f4905c6 100644
--- a/pkgs/by-name/fw/fwupd/installed-tests-path.patch
+++ b/pkgs/by-name/fw/fwupd/installed-tests-path.patch
@@ -1,27 +1,27 @@
-commit 2fa1d39bb54d448ffe59bf6a8358c01f786a1cce
+commit abaf36af96c7dfc966110c5342d5a8814c0df492
 Author: r-vdp <ramses@well-founded.dev>
 Date:   Tue Oct 15 14:49:53 2024 +0200
 
     Add output for installed tests
 
 diff --git a/data/tests/meson.build b/data/tests/meson.build
-index a22a989f3..cbd135cfa 100644
+index da9524677..505d7a80e 100644
 --- a/data/tests/meson.build
 +++ b/data/tests/meson.build
-@@ -105,7 +105,7 @@ configure_file(
-   output: 'fwupd-tests.conf',
+@@ -131,7 +131,7 @@ configure_file(
    configuration: con2,
    install: true,
+   install_tag: 'tests',
 -  install_dir: join_paths(datadir, 'fwupd', 'remotes.d'),
 +  install_dir: join_paths(get_option('installed_test_prefix'), 'etc', 'fwupd', 'remotes.d'),
  )
  
  if umockdev_integration_tests.allowed()
 diff --git a/meson.build b/meson.build
-index 5a35cfda1..40ef142f0 100644
+index 312513d75..4faedcc0b 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -194,8 +194,8 @@ else
+@@ -205,8 +205,8 @@ else
    datadir = join_paths(prefix, get_option('datadir'))
    sysconfdir = join_paths(prefix, get_option('sysconfdir'))
    localstatedir = join_paths(prefix, get_option('localstatedir'))
@@ -32,7 +32,7 @@ index 5a35cfda1..40ef142f0 100644
    daemon_dir = join_paths(libexecdir, 'fwupd')
  endif
  mandir = join_paths(prefix, get_option('mandir'))
-@@ -545,6 +545,7 @@ gnome = import('gnome')
+@@ -536,6 +536,7 @@ gnome = import('gnome')
  i18n = import('i18n')
  
  conf.set_quoted('FWUPD_PREFIX', prefix)
@@ -41,12 +41,12 @@ index 5a35cfda1..40ef142f0 100644
  conf.set_quoted('FWUPD_LIBDIR', libdir)
  conf.set_quoted('FWUPD_LIBEXECDIR', libexecdir)
 diff --git a/meson_options.txt b/meson_options.txt
-index e04bb37c9..b1060ddb8 100644
+index 40103c03e..63c8d288d 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -333,6 +333,10 @@ option('systemd_syscall_filter',
-   value: 'true',
-   description: 'Enable systemd syscall filter',
+@@ -174,6 +174,10 @@ option('systemd_unit_user',
+   value: 'fwupd-refresh',
+   description: 'User account to use for fwupd-refresh.service (empty for DynamicUser)',
  )
 +option('installed_test_prefix',
 +  type: 'string',
@@ -56,13 +56,13 @@ index e04bb37c9..b1060ddb8 100644
    type: 'boolean',
    value: true,
 diff --git a/src/tests/host-emulate/meson.build b/src/tests/host-emulate/meson.build
-index 4bc02e46e..17bc2270d 100644
+index 0a67d70e8..7e07c0a49 100644
 --- a/src/tests/host-emulate/meson.build
 +++ b/src/tests/host-emulate/meson.build
-@@ -9,7 +9,7 @@ if build_standalone
-       capture: true,
+@@ -10,7 +10,7 @@ if build_standalone
        command: [gzip, '-k', '--stdout', '@INPUT@'],
        install: true,
+       install_tag: 'tests',
 -      install_dir: join_paths(datadir, 'fwupd', 'host-emulate.d'),
 +      install_dir: join_paths(get_option('installed_test_prefix'), 'etc', 'fwupd', 'host-emulate.d'),
      )
diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index 4d0f12f4a495..3028c49a384c 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -133,7 +133,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "2.0.13";
+  version = "2.0.14";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -151,7 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     tag = finalAttrs.version;
-    hash = "sha256-iarQfen2MCgQUDST5c81+KBd8gxBqM9EO6f0fN4fZbI=";
+    hash = "sha256-VUpLYl7SKJqwbM3Lna22txTeMwqtpQieiw1DLX/4xtA=";
   };
 
   patches = [