From f173ec335533331f371e4bf83e06e393c013a5d8 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 31 May 2026 01:43:52 +0200
Subject: [PATCH 01/70] maintainers/README: fix wrong workflow reference

---
 maintainers/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/README.md b/maintainers/README.md
index 4c3e5cff9c2a..4959e6aa5892 100644
--- a/maintainers/README.md
+++ b/maintainers/README.md
@@ -160,7 +160,7 @@ Once approved, the team will have the right privileges to be pinged and requeste
 > [!TIP]
 > The team name should be as short as possible; because it is nested under the maintainers group, no -maintainers suffix is needed.
 
-After the first [weekly team sync](../.github/workflows/team-sync.yml) with the new team, it's then also possible to link it to the entry in `team-list.nix` by setting its `github` field to the GitHub team name.
+After the first [weekly team sync](../.github/workflows/teams.yml) with the new team, it's then also possible to link it to the entry in `team-list.nix` by setting its `github` field to the GitHub team name.
 
 # Maintainer scripts
 

From baf28478fc0be6d3f5b9f12a1d4eaa60786bd434 Mon Sep 17 00:00:00 2001
From: Jappie3 <jappie3+git@jappie.dev>
Date: Sat, 30 May 2026 20:14:57 +0200
Subject: [PATCH 02/70] nixos/dovecot: order non-attrs values first in rendered
 config

Co-authored-by: Katalin Rebhan <me@dblsaiko.net>
---
 nixos/modules/services/mail/dovecot.nix | 107 ++++++++++++++----------
 1 file changed, 61 insertions(+), 46 deletions(-)

diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index 2c00b3ee6529..48b0795c53c1 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -7,7 +7,6 @@
 
 let
   inherit (lib)
-    all
     attrsToList
     concatMapStringsSep
     concatStringsSep
@@ -19,7 +18,6 @@ let
     isBool
     isDerivation
     isInt
-    isList
     isPath
     isString
     listToAttrs
@@ -98,53 +96,67 @@ let
     i: n: v:
     "${i}${toString n} = ${v}";
 
-  formatKeyValue =
-    indent: n: v:
-    if (v == null) then
-      ""
-    else if isInt v then
-      toOption indent n (toString v)
+  isPrimitive = v: !isAttrs v || isDerivation v;
+
+  formatPrimitive =
+    v:
+    if isInt v then
+      toString v
     else if isBool v then
-      toOption indent n (yesOrNo v)
+      yesOrNo v
     else if isString v then
-      toOption indent n v
-    else if isList v then
-      if all isString v then
-        toOption indent n (concatStringsSep " " v)
-      else
-        map (formatKeyValue indent n) v
+      v
     else if isPath v || isDerivation v then
       # paths -> copy to store
       # derivations -> just use output path instead of looping over the attrs
-      toOption indent n "${v}"
-    else if isAttrs v && v ? _section then
-      let
-        sectionType = v._section.type;
-        sectionName = v._section.name;
-        sectionTitle = concatStringsSep " " (
-          filter (s: s != null) [
-            sectionType
-            sectionName
-          ]
-        );
-      in
-      concatStringsSep "\n" (
-        [
-          "${indent}${sectionTitle} {"
-        ]
-        ++ (mapAttrsToList (formatKeyValue "${indent}  ") (removeAttrs v [ "_section" ]))
-        ++ [ "${indent}}" ]
-      )
-    else if isAttrs v then
-      concatStringsSep "\n" (
-        [
-          "${indent}${n} {"
-        ]
-        ++ (mapAttrsToList (formatKeyValue "${indent}  ") v)
-        ++ [ "${indent}}" ]
-      )
+      "${v}"
     else
-      throw (traceSeq v "services.dovecot2.settings: unexpected type");
+      throw (traceSeq v "services.dovecot2.settings: unexpected primitive type");
+
+  formatSection =
+    indent: n: v:
+    let
+      sectionTitle =
+        if v ? _section then
+          concatStringsSep " " (
+            filter (s: s != null) [
+              v._section.type
+              v._section.name
+            ]
+          )
+        else
+          n;
+      inner = removeAttrs v [ "_section" ];
+    in
+    concatStringsSep "\n" (
+      [ "${indent}${sectionTitle} {" ]
+      ++ flatten (mapAttrsToList (primitiveLinesFor "${indent}  ") inner)
+      ++ flatten (mapAttrsToList (sectionLinesFor "${indent}  ") inner)
+      ++ [ "${indent}}" ]
+    );
+
+  # emit lines for a k=v pair only when the value is a primitive
+  primitiveLinesFor =
+    indent: n: v:
+    let
+      primitives = filter isPrimitive (flatten [ v ]);
+      hasOnlySections = primitives == [ ] && v != [ ];
+    in
+    # Only emit an empty list if the original entry was also an empty list.
+    # This is so that values like k = [{ ... }] will not produce an output
+    # here, but k = [] will, even though they result in the same
+    # primitives = [].
+    optional (!hasOnlySections && v != null) (
+      toOption indent n (concatMapStringsSep " " formatPrimitive primitives)
+    );
+
+  # emit lines for a k=v pair only when the value is *not* a primitive
+  sectionLinesFor =
+    indent: n: v:
+    let
+      sections = filter (e: !isPrimitive e) (flatten [ v ]);
+    in
+    map (e: formatSection indent n e) sections;
 
   doveConf =
     let
@@ -156,10 +168,13 @@ let
       ];
     in
     concatStringsSep "\n" (
-      optional (configVersion != null) (formatKeyValue "" "dovecot_config_version" configVersion)
-      ++ optional (storageVersion != null) (formatKeyValue "" "dovecot_storage_version" storageVersion)
+      optionals (configVersion != null) (primitiveLinesFor "" "dovecot_config_version" configVersion)
+      ++ optionals (storageVersion != null) (
+        primitiveLinesFor "" "dovecot_storage_version" storageVersion
+      )
       ++ optionals (cfg.includeFiles != [ ]) (map (f: "!include ${f}") cfg.includeFiles)
-      ++ flatten (mapAttrsToList (formatKeyValue "") remainingSettings)
+      ++ flatten (mapAttrsToList (primitiveLinesFor "") remainingSettings)
+      ++ flatten (mapAttrsToList (sectionLinesFor "") remainingSettings)
     );
 
   isPre24 = versionOlder cfg.package.version "2.4";

From 9bee562b8c8a4dbd40bd4e063328db793a95a24f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 12:20:26 +0200
Subject: [PATCH 03/70] python3Packages.openinference-semantic-conventions:
 init at 0.1.30

OpenTelemetry Semantic Conventions for AI Observability

https://github.com/Arize-ai/openinference
---
 .../default.nix                               | 45 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 ++
 2 files changed, 49 insertions(+)
 create mode 100644 pkgs/development/python-modules/openinference-semantic-conventions/default.nix

diff --git a/pkgs/development/python-modules/openinference-semantic-conventions/default.nix b/pkgs/development/python-modules/openinference-semantic-conventions/default.nix
new file mode 100644
index 000000000000..a7a129cc1cc3
--- /dev/null
+++ b/pkgs/development/python-modules/openinference-semantic-conventions/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  nix-update-script,
+  pytest-asyncio,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "openinference-semantic-conventions";
+  version = "0.1.30";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Arize-ai";
+    repo = "openinference";
+    tag = "python-openinference-semantic-conventions-v${finalAttrs.version}";
+    hash = "sha256-MkgajZknHOw4/qra6uZ99rtpiylpHhOj8tDfLGUSU74=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/python/${finalAttrs.pname}";
+
+  build-system = [ hatchling ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "openinference.semconv" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "OpenTelemetry Semantic Conventions for AI Observability";
+    homepage = "https://github.com/Arize-ai/openinference";
+    changelog = "https://github.com/Arize-ai/openinference/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index cb255c8fb62c..d5037dbcb8db 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11834,6 +11834,10 @@ self: super: with self; {
     }
   );
 
+  openinference-semantic-conventions =
+    callPackage ../development/python-modules/openinference-semantic-conventions
+      { };
+
   openmm = toPythonModule (
     pkgs.openmm.override {
       python3Packages = self;

From e2a645256b873e9b302075e781e8a98e60f13eff Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 12:36:43 +0200
Subject: [PATCH 04/70] python3Packages.openinference-instrumentation: init at
 0.1.53

OpenTelemetry Instrumentation for AI Observability

https://github.com/Arize-ai/openinference
---
 .../openinference-instrumentation/default.nix | 69 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 ++
 2 files changed, 73 insertions(+)
 create mode 100644 pkgs/development/python-modules/openinference-instrumentation/default.nix

diff --git a/pkgs/development/python-modules/openinference-instrumentation/default.nix b/pkgs/development/python-modules/openinference-instrumentation/default.nix
new file mode 100644
index 000000000000..6c2e2fbf3a3b
--- /dev/null
+++ b/pkgs/development/python-modules/openinference-instrumentation/default.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  jsonschema,
+  nix-update-script,
+  openai,
+  openinference-semantic-conventions,
+  opentelemetry-api,
+  opentelemetry-sdk,
+  pytest-asyncio,
+  pytest-vcr,
+  pytestCheckHook,
+  typing-extensions,
+  wrapt,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "openinference-instrumentation";
+  version = "0.1.53";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Arize-ai";
+    repo = "openinference";
+    tag = "python-openinference-instrumentation-v${finalAttrs.version}";
+    hash = "sha256-1FzAiO3Vxt2o9YCzwPfHOn4hwvOLDt9Luv3zQTJ6J2Q=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/python/${finalAttrs.pname}";
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    opentelemetry-api
+    opentelemetry-sdk
+    openinference-semantic-conventions
+    typing-extensions
+    wrapt
+  ];
+
+  nativeCheckInputs = [
+    jsonschema
+    openai
+    pytest-asyncio
+    pytest-vcr
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "openinference.instrumentation" ];
+
+  disabledTests = [
+    # Tests want to connect to OpenAI's API
+    "TestTracerLLMDecorator"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "OpenTelemetry Instrumentation for AI Observability";
+    homepage = "https://github.com/Arize-ai/openinference";
+    changelog = "https://github.com/Arize-ai/openinference/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d5037dbcb8db..4f2035834d92 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11834,6 +11834,10 @@ self: super: with self; {
     }
   );
 
+  openinference-instrumentation =
+    callPackage ../development/python-modules/openinference-instrumentation
+      { };
+
   openinference-semantic-conventions =
     callPackage ../development/python-modules/openinference-semantic-conventions
       { };

From 0598a8aa02bcb84789a18bdcbe842f47c6d66153 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 12:58:30 +0200
Subject: [PATCH 05/70] 
 python3Packages.openinference-instrumentation-claude-agent-sdk: init at 0.1.6

OpenInference Claude Agent SDK Instrumentation

https://github.com/Arize-ai/openinference
---
 .../default.nix                               | 74 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 +
 2 files changed, 78 insertions(+)
 create mode 100644 pkgs/development/python-modules/openinference-instrumentation-claude-agent-sdk/default.nix

diff --git a/pkgs/development/python-modules/openinference-instrumentation-claude-agent-sdk/default.nix b/pkgs/development/python-modules/openinference-instrumentation-claude-agent-sdk/default.nix
new file mode 100644
index 000000000000..e65aeb508cb3
--- /dev/null
+++ b/pkgs/development/python-modules/openinference-instrumentation-claude-agent-sdk/default.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  buildPythonPackage,
+  claude-agent-sdk,
+  fetchFromGitHub,
+  hatchling,
+  nix-update-script,
+  openinference-instrumentation,
+  openinference-semantic-conventions,
+  opentelemetry-api,
+  opentelemetry-instrumentation,
+  opentelemetry-semantic-conventions,
+  pytest-asyncio,
+  pytest-timeout,
+  pytestCheckHook,
+  pyyaml,
+  sniffio,
+  typing-extensions,
+  wrapt,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "openinference-instrumentation-claude-agent-sdk";
+  version = "0.1.6";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Arize-ai";
+    repo = "openinference";
+    tag = "python-openinference-instrumentation-claude-agent-sdk-v${finalAttrs.version}";
+    hash = "sha256-wmwqmN/rN521TaXVZfkaRzHPVhANSgKaBVc4rhXgIII=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/python/instrumentation/${finalAttrs.pname}";
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    opentelemetry-api
+    opentelemetry-instrumentation
+    opentelemetry-semantic-conventions
+    openinference-semantic-conventions
+    openinference-instrumentation
+    typing-extensions
+    wrapt
+  ];
+
+  optional-dependencies = {
+    instruments = [ claude-agent-sdk ];
+  };
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-timeout
+    pytestCheckHook
+    pyyaml
+    sniffio
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
+
+  pythonImportsCheck = [ "openinference.instrumentation.claude_agent_sdk" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "OpenInference Claude Agent SDK Instrumentation";
+    homepage = "https://github.com/Arize-ai/openinference";
+    changelog = "https://github.com/Arize-ai/openinference/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4f2035834d92..0e51df8e5721 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11838,6 +11838,10 @@ self: super: with self; {
     callPackage ../development/python-modules/openinference-instrumentation
       { };
 
+  openinference-instrumentation-claude-agent-sdk =
+    callPackage ../development/python-modules/openinference-instrumentation-claude-agent-sdk
+      { };
+
   openinference-semantic-conventions =
     callPackage ../development/python-modules/openinference-semantic-conventions
       { };

From 57d97b59acd9d63e44b2f9466fe2834b3ecc9738 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 13:11:51 +0200
Subject: [PATCH 06/70] python3Packages.openinference-instrumentation-openai:
 init at 0.1.52

OpenInference OpenAI SDK Instrumentation

https://github.com/Arize-ai/openinference
---
 .../default.nix                               | 84 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 +
 2 files changed, 88 insertions(+)
 create mode 100644 pkgs/development/python-modules/openinference-instrumentation-openai/default.nix

diff --git a/pkgs/development/python-modules/openinference-instrumentation-openai/default.nix b/pkgs/development/python-modules/openinference-instrumentation-openai/default.nix
new file mode 100644
index 000000000000..31a804841153
--- /dev/null
+++ b/pkgs/development/python-modules/openinference-instrumentation-openai/default.nix
@@ -0,0 +1,84 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  httpx,
+  nix-update-script,
+  openai,
+  openinference-instrumentation,
+  openinference-semantic-conventions,
+  opentelemetry-api,
+  opentelemetry-instrumentation-httpx,
+  opentelemetry-instrumentation,
+  opentelemetry-semantic-conventions,
+  pytest-asyncio,
+  pytest-vcr,
+  pytestCheckHook,
+  respx,
+  typing-extensions,
+  wrapt,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "openinference-instrumentation-openai";
+  version = "0.1.52";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Arize-ai";
+    repo = "openinference";
+    tag = "python-openinference-instrumentation-openai-v${finalAttrs.version}";
+    hash = "sha256-wmwqmN/rN521TaXVZfkaRzHPVhANSgKaBVc4rhXgIII=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/python/instrumentation/${finalAttrs.pname}";
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    opentelemetry-api
+    opentelemetry-instrumentation
+    opentelemetry-semantic-conventions
+    openinference-semantic-conventions
+    openinference-instrumentation
+    typing-extensions
+    wrapt
+  ];
+
+  optional-dependencies = {
+    instruments = [ openai ];
+  };
+
+  nativeCheckInputs = [
+    httpx
+    opentelemetry-instrumentation-httpx
+    pytest-asyncio
+    pytest-vcr
+    pytestCheckHook
+    respx
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
+
+  pythonImportsCheck = [ "openinference.instrumentation.openai" ];
+
+  disabledTests = [
+    # Tests want to connect to OpenAI's API
+    "test_cached_tokens"
+    "test_input_value"
+    "test_openai"
+    "test_tool_calls"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "OpenInference OpenAI SDK Instrumentation";
+    homepage = "https://github.com/Arize-ai/openinference";
+    changelog = "https://github.com/Arize-ai/openinference/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0e51df8e5721..eac8d943c031 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11842,6 +11842,10 @@ self: super: with self; {
     callPackage ../development/python-modules/openinference-instrumentation-claude-agent-sdk
       { };
 
+  openinference-instrumentation-openai =
+    callPackage ../development/python-modules/openinference-instrumentation-openai
+      { };
+
   openinference-semantic-conventions =
     callPackage ../development/python-modules/openinference-semantic-conventions
       { };

From 3025302a0067b78da605263f6dfe7d264e97d8cd Mon Sep 17 00:00:00 2001
From: Grayson Tinker <graysontinker@gmail.com>
Date: Mon, 22 Jun 2026 12:29:22 -0700
Subject: [PATCH 07/70] buildNimPackage: enable structuredAttrs by default

---
 pkgs/build-support/build-nim-package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/build-support/build-nim-package.nix b/pkgs/build-support/build-nim-package.nix
index 1e8489212cd6..ade88ea9d3db 100644
--- a/pkgs/build-support/build-nim-package.nix
+++ b/pkgs/build-support/build-nim-package.nix
@@ -15,6 +15,7 @@ let
   baseAttrs = {
     strictDeps = true;
     enableParallelBuilding = true;
+    __structuredAttrs = true;
     doCheck = true;
     configurePhase = ''
       runHook preConfigure

From 3fda0e37872c6ace46600373c94a774b51229ede Mon Sep 17 00:00:00 2001
From: Grayson Tinker <graysontinker@gmail.com>
Date: Mon, 22 Jun 2026 12:30:16 -0700
Subject: [PATCH 08/70] snekim: remove unnecessary strictDeps

This is automatically enabled by buildNimPackage
---
 pkgs/by-name/sn/snekim/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/sn/snekim/package.nix b/pkgs/by-name/sn/snekim/package.nix
index 8deefd7515d2..73a375ebc484 100644
--- a/pkgs/by-name/sn/snekim/package.nix
+++ b/pkgs/by-name/sn/snekim/package.nix
@@ -15,7 +15,6 @@ buildNimPackage (finalAttrs: {
     hash = "sha256-Qgvq4CkGvNppYFpITCCifOHtVQYRQJPEK3rTJXQkTvI=";
   };
 
-  strictDeps = true;
   lockFile = ./lock.json;
 
   nimFlags = [ "-d:nimraylib_now_shared" ];

From e229323c6dddd5c8d931574b8e950a87f27c0565 Mon Sep 17 00:00:00 2001
From: Grayson Tinker <graysontinker@gmail.com>
Date: Mon, 22 Jun 2026 13:29:12 -0700
Subject: [PATCH 09/70] auto-editor: fix tests with structuredAttrs

---
 pkgs/by-name/au/auto-editor/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/au/auto-editor/package.nix b/pkgs/by-name/au/auto-editor/package.nix
index 2d66a987d949..e260967f09ce 100644
--- a/pkgs/by-name/au/auto-editor/package.nix
+++ b/pkgs/by-name/au/auto-editor/package.nix
@@ -54,6 +54,8 @@ buildNimPackage rec {
     # buildNimPackage hack
     substituteInPlace ae.nimble \
       --replace-fail '"main=auto-editor"' '"main"'
+
+    mv tests/unit.nim tests/tunit.nim # buildNimPackage expects tests to start with t
   '';
 
   nativeCheckInputs = [
@@ -64,7 +66,7 @@ buildNimPackage rec {
   checkPhase = ''
     runHook preCheck
 
-    eval "nim r --nimcache:$NIX_BUILD_TOP/nimcache $nimFlags $src/tests/unit.nim"
+    nim_builder --phase:check
 
     substituteInPlace tests/test.py \
       --replace-fail '"./auto-editor"' "\"$out/bin/main\""

From e9e36f040322d2c081f79348885b383447809019 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 03:48:29 +0000
Subject: [PATCH 10/70] mongodb-ce: 8.2.7 -> 8.2.11

---
 pkgs/by-name/mo/mongodb-ce/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index 4fb2618f35b5..66b2d4306eaa 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mongodb-ce";
-  version = "8.2.7";
+  version = "8.2.11";
 
   src =
     finalAttrs.passthru.sources.${stdenv.hostPlatform.system}
@@ -53,19 +53,19 @@ stdenv.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2404-${finalAttrs.version}.tgz";
-        hash = "sha256-GYyWeVSoRXgrlQqx7R2chxH3+5S4ewbTefWJR9S2Frs=";
+        hash = "sha256-sqFkZ19eYZHQFwVX2zwaKaYXisvoqN25+8DFbyGU2H4=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://fastdl.mongodb.org/linux/mongodb-linux-aarch64-ubuntu2404-${finalAttrs.version}.tgz";
-        hash = "sha256-HTErVesWEWDjheedELdDOwlMrDvhV3JdVGtV3RuSeBI=";
+        hash = "sha256-5AX8pb1jInbQTuE0RqpqqcRXon6wKwdvoDCNDF70krE=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://fastdl.mongodb.org/osx/mongodb-macos-x86_64-${finalAttrs.version}.tgz";
-        hash = "sha256-DeD/v+NP2b8BTReV80+Lz0O9t6e3O9+52sJmTK5NtVY=";
+        hash = "sha256-BLIFrmToU8tFHdjAD+0q827cyeDHoYiXwtsds6e7NMA=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://fastdl.mongodb.org/osx/mongodb-macos-arm64-${finalAttrs.version}.tgz";
-        hash = "sha256-d8uulXczpq7ZEDmDsbb3o9kaZJ1IYzZ6MkgBLkNU4Mo=";
+        hash = "sha256-M3/x/d2rVKUmIZBQ9hVuT6W9ajZy/Ut5+8aDeXF+HwY=";
       };
     };
     updateScript =

From 6d26f1c9f3939faab05ce14be32e3aa027acec53 Mon Sep 17 00:00:00 2001
From: proitheus <me@mail.proitheus.top>
Date: Wed, 24 Jun 2026 04:14:39 +0800
Subject: [PATCH 11/70] shiru: add darwin support

---
 pkgs/by-name/sh/shiru/package.nix | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sh/shiru/package.nix b/pkgs/by-name/sh/shiru/package.nix
index c14c5a89bcb4..74532831db34 100644
--- a/pkgs/by-name/sh/shiru/package.nix
+++ b/pkgs/by-name/sh/shiru/package.nix
@@ -65,7 +65,12 @@ stdenv.mkDerivation (finalAttrs: {
 
     ./node_modules/.bin/electron-builder --dir \
       --c.electronDist=electron-dist \
-      --c.electronVersion=${electron.version}
+      --c.electronVersion=${electron.version} \
+      ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+        --c.npmRebuild=false \
+        --c.mac.identity=null \
+        --c.mac.notarize=false \
+      ''}
 
     runHook postBuild
   '';
@@ -73,6 +78,8 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
+  ''
+  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     mkdir -p "$out/share/lib/shiru"
     cp -r dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/shiru"
 
@@ -82,7 +89,18 @@ stdenv.mkDerivation (finalAttrs: {
       --add-flags "$out/share/lib/shiru/resources/app.asar" \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}" \
       --inherit-argv0
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p "$out/Applications"
+    cp -r dist/mac*/Shiru.app "$out/Applications/"
 
+    mkdir -p "$out/bin"
+    makeWrapper \
+      "$out/Applications/Shiru.app/Contents/MacOS/Shiru" \
+      "$out/bin/shiru" \
+      --set-default ELECTRON_IS_DEV 0
+  ''
+  + ''
     runHook postInstall
   '';
 
@@ -116,7 +134,10 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       naomieow
     ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-darwin"
+    ];
     mainProgram = "shiru";
   };
 })

From 090dfb61a2403f78e97e8c4812067c6b64411d25 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 02:20:44 +0000
Subject: [PATCH 12/70] mgmt: 1.0.2 -> 1.1.0

---
 pkgs/by-name/mg/mgmt/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mg/mgmt/package.nix b/pkgs/by-name/mg/mgmt/package.nix
index 6a4611a5918e..3928b2ed0c49 100644
--- a/pkgs/by-name/mg/mgmt/package.nix
+++ b/pkgs/by-name/mg/mgmt/package.nix
@@ -12,16 +12,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mgmt";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "purpleidea";
     repo = "mgmt";
     tag = finalAttrs.version;
-    hash = "sha256-nLk497gGrZ664VG9/yV6tqTtwAsN8EmuAEh5Vmq95hQ=";
+    hash = "sha256-jVFIVlytDvfTrAzWkX+pedAq/AcLrCDFtLPx0Wc+XjM=";
   };
 
-  vendorHash = "sha256-w4j9cJwW2tnjXSnd3w3v81TwHI8tGYiImjG3LZ+Pjuc=";
+  vendorHash = "sha256-mMRAlqySy6dpRG86p0BHSpYn2gzE8N4sZ3qHiyuttBA=";
 
   proxyVendor = true;
 

From 24358264956a503935a70c3ba6d43dc272a5ea2e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 06:00:47 +0000
Subject: [PATCH 13/70] sif: 0-unstable-2026-06-11 -> 0-unstable-2026-06-23

---
 pkgs/by-name/si/sif/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/si/sif/package.nix b/pkgs/by-name/si/sif/package.nix
index 0b33852a7892..8808910e606a 100644
--- a/pkgs/by-name/si/sif/package.nix
+++ b/pkgs/by-name/si/sif/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sif";
-  version = "0-unstable-2026-06-11";
+  version = "0-unstable-2026-06-23";
 
   src = fetchFromGitHub {
     owner = "vmfunc";
     repo = "sif";
-    rev = "d62919523abfecd06e07ba6528b15e9861bd747c";
-    hash = "sha256-T/HIvcXG3OpSK7xhZpYnCWv4KsRn0bnLhyouPjgwUoE=";
+    rev = "39b333320eab64f22392b2494a7cd18462d42b29";
+    hash = "sha256-1WdjmCxhd37gkb/HbgUfFZkcFumCMDQKAyG5nvfGAMU=";
   };
 
-  vendorHash = "sha256-rOAubGbeDPl0LJovksKRfYJmUvU6hmx3Ht12M7eLiOA=";
+  vendorHash = "sha256-R47Qz5tty+qvJKcWYMGZKYyRvpxN+mOdudT+cpUCT4s=";
 
   subPackages = [ "cmd/sif" ];
 

From abbfb09d2d7d90e3d3d720fabc7f401234905bf7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 23:26:38 +0000
Subject: [PATCH 14/70] defuddle: 0.18.1 -> 0.19.1

---
 pkgs/by-name/de/defuddle/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/de/defuddle/package.nix b/pkgs/by-name/de/defuddle/package.nix
index 16b78498174a..94131aac3c11 100644
--- a/pkgs/by-name/de/defuddle/package.nix
+++ b/pkgs/by-name/de/defuddle/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "defuddle";
-  version = "0.18.1";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "kepano";
     repo = "defuddle";
     tag = version;
-    hash = "sha256-e/+eigIzpP0g+ZqTeyZnF6mloaY6UeKcMWfqryCcLbM=";
+    hash = "sha256-Fn203XKjZ2qbM1o0zs6mgxCdjWLOwz9Na+s1WSQG9XM=";
   };
 
-  npmDepsHash = "sha256-1NFwhYEGTKpjzCdK/eHK0TWtOEpn67FA+B3QZ11w1Rs=";
+  npmDepsHash = "sha256-quqWhbcaSNj4Bk++4N4LYq3Y8U5nQqnwc+MqU0LLgso=";
 
   # jsdom is both a peerDependency and devDependency; pruning
   # devDependencies removes it, but the CLI needs it at runtime.

From f371b4a14d6883c898c57a08104a4011e1380385 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 07:43:57 +0000
Subject: [PATCH 15/70] n8n: 2.25.7 -> 2.27.4

---
 pkgs/by-name/n8/n8n/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 0e91e2fd604c..11e0fa4396a9 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -26,20 +26,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.25.7";
+  version = "2.27.4";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-V8CqEzCw4DcLPCao4HRXrJXFeID2+Ef8fNW1xd1b8Vs=";
+    hash = "sha256-Z8oAetoSJLTCO7UO+DrlSDFAIjLSLND9bQzrcLz0hYg=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-JS4OY6CmihsbJRyPszSlNUEViFKfLm2vu+G2upIoLW8=";
+    hash = "sha256-xTZlv8YZC8u9pzD/WroduyO2MVtRvZ7ajKTphsHfObs=";
   };
 
   nativeBuildInputs = [

From a4f31c71d7e0ee73d8235263f885303d7b52598c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 12:01:19 +0000
Subject: [PATCH 16/70] lunar-client: 3.7.6 -> 3.7.9

---
 pkgs/by-name/lu/lunar-client/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lu/lunar-client/package.nix b/pkgs/by-name/lu/lunar-client/package.nix
index ecf1bb7599e9..7714186e91c0 100644
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunarclient";
-  version = "3.7.6";
+  version = "3.7.9";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}-ow.AppImage";
-    hash = "sha512-+xC7hvpQfmXkZ+FndNAWIxgfWjodfdcCrHmPe5XqEC+3cBkT6KpOxvuw7o0qAebxo6VNN5tKuAPfibfZfeH+RQ==";
+    hash = "sha512-7rVPN/CmnaA91mnNQkuK4/pmPtHeLvsLeuzBlEBbRT2RrYtSxF3eEnHiFndlMzmRor8FWuFITz43QFPgFVMJpQ==";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 5773aa99c5a2e0cea5f375c2f59b46ab9168b1e8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 12:02:53 +0000
Subject: [PATCH 17/70] python3Packages.switchbot-api: 2.11.1 -> 2.12.0

---
 pkgs/development/python-modules/switchbot-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/switchbot-api/default.nix b/pkgs/development/python-modules/switchbot-api/default.nix
index 9839f490ee1c..deeab9eb65f6 100644
--- a/pkgs/development/python-modules/switchbot-api/default.nix
+++ b/pkgs/development/python-modules/switchbot-api/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "switchbot-api";
-  version = "2.11.1";
+  version = "2.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SeraphicCorp";
     repo = "py-switchbot-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xgfFpylMS8Xs3erM7vuJKun6fYOtJ6kfXgBVSkejbJI=";
+    hash = "sha256-mvGWuj+YpAqMg8dpICMwkY73vVwrvF6Klld2h2q1Mig=";
   };
 
   build-system = [ poetry-core ];

From a49e5ce8f0568677026fcc3ec31705c942eb7863 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 12:22:09 +0000
Subject: [PATCH 18/70] workcraft: 3.5.4 -> 3.5.5

---
 pkgs/by-name/wo/workcraft/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wo/workcraft/package.nix b/pkgs/by-name/wo/workcraft/package.nix
index 6012fabf47eb..fea071c44337 100644
--- a/pkgs/by-name/wo/workcraft/package.nix
+++ b/pkgs/by-name/wo/workcraft/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "workcraft";
-  version = "3.5.4";
+  version = "3.5.5";
 
   src = fetchurl {
     url = "https://github.com/workcraft/workcraft/releases/download/v${finalAttrs.version}/workcraft-v${finalAttrs.version}-linux.tar.gz";
-    hash = "sha256-+G4Z9GfyfdBL3qb8RqtmRPq6wC6et4P3S6Owy/L5sSU=";
+    hash = "sha256-zpuwNwVu9iH7JSHsSyGt3gl6swOHa2b9uDC8Ck2Mtno=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 407aea00ffb74fe4e07eab4dd433c021a072ac3f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 26 Jun 2026 15:11:33 +0200
Subject: [PATCH 19/70] feishin: pnpm_10_29_2 -> pnpm_10

---
 pkgs/by-name/fe/feishin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index 4e2f82063d42..f8a1a7ee214c 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -8,7 +8,7 @@
   mpv-unwrapped,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10_29_2,
+  pnpm_10,
   darwin,
   actool,
   copyDesktopItems,
@@ -42,7 +42,7 @@ buildNpmPackage {
       version
       src
       ;
-    pnpm = pnpm_10_29_2;
+    pnpm = pnpm_10;
     fetcherVersion = 3;
     hash = "sha256-zNOGJ24G0xcgsGK4DmbBm7d1PHTp7IJS+RTALGRtfDg=";
   };
@@ -50,7 +50,7 @@ buildNpmPackage {
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   nativeBuildInputs = [
-    pnpm_10_29_2
+    pnpm_10
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [

From 03abf4ac09895d7bd854de76ca9e1c6343050926 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 13:21:14 +0000
Subject: [PATCH 20/70] python3Packages.alibabacloud-ram20150501: 1.2.0 ->
 1.2.1

---
 .../python-modules/alibabacloud-ram20150501/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/alibabacloud-ram20150501/default.nix b/pkgs/development/python-modules/alibabacloud-ram20150501/default.nix
index ffa802f1a398..16d4c217e2f8 100644
--- a/pkgs/development/python-modules/alibabacloud-ram20150501/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-ram20150501/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-ram20150501";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -19,7 +19,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "alibabacloud_ram20150501";
     inherit (finalAttrs) version;
-    hash = "sha256-YlNRPIiAdp9P1bNv7d2zYqnKYorZrpwFwO6s9fvJW0I=";
+    hash = "sha256-dzFVfjw5oPAVm59dEMksDeZZXCf0VT3EWeA8zZpMIqU=";
   };
 
   build-system = [ setuptools ];

From efe0cdf744d661fb2a80f91937eaf45ec3880e3e Mon Sep 17 00:00:00 2001
From: Holiu <165534185+Holiu618@users.noreply.github.com>
Date: Fri, 26 Jun 2026 21:26:50 +0800
Subject: [PATCH 21/70] syft: 1.45.1 -> 1.46.0

---
 pkgs/by-name/sy/syft/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sy/syft/package.nix b/pkgs/by-name/sy/syft/package.nix
index f666eaa9dee8..c90ae32ded47 100644
--- a/pkgs/by-name/sy/syft/package.nix
+++ b/pkgs/by-name/sy/syft/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "syft";
-  version = "1.45.1";
+  version = "1.46.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "syft";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JYMauarf2GB6ZJXB5pDZAcYZFJXWqEkULF3KIE8WvJQ=";
+    hash = "sha256-gjVfsJQoE//u0i6lVQCEF2dSUvoepIOaqqCazOUgSwI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
   # hash mismatch with darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-KjbxAhjIb8h4F6kXfa38qUwWloK/3Rh6YU8G7rMIOtw=";
+  vendorHash = "sha256-t4L+Q82ohwBEXVh1Yy7OOrNhinnAXzOHO7mmFJQUZYM=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From dae05a7dd5aae8d50aceea41a6bbcf0000de62e8 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Fri, 26 Jun 2026 17:56:27 +0200
Subject: [PATCH 22/70] =?UTF-8?q?glab:=201.101.0=20=E2=86=92=201.105.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/gl/glab/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gl/glab/package.nix b/pkgs/by-name/gl/glab/package.nix
index 366d896bbacc..57f5b58c450f 100644
--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "glab";
-  version = "1.101.0";
+  version = "1.105.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K8QL9Ff5FHmiXyBEdsUE8kwhSF0camSFh08LbfJb3wo=";
+    hash = "sha256-MKb46PHgm+jfHGf2rEh0o7ghtb6JR4UE3Mam9z+2gw8=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-u1zvzMrQGyTVcl/lnIGK3dfisxGYRa2LGpDMBDq6rJk=";
+  vendorHash = "sha256-aFrTCqvxVaiEJFKa4zY0kFW1P6QDDD4UG5x+yHK6vZ8=";
 
   ldflags = [
     "-s"

From fdff66f505315add89b754d5e184e8af8c25b52b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 16:45:49 +0000
Subject: [PATCH 23/70] ddhx: 0.9.3 -> 0.10.0

---
 pkgs/by-name/dd/ddhx/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/dd/ddhx/package.nix b/pkgs/by-name/dd/ddhx/package.nix
index e69826b472ed..033080c49167 100644
--- a/pkgs/by-name/dd/ddhx/package.nix
+++ b/pkgs/by-name/dd/ddhx/package.nix
@@ -5,13 +5,13 @@
 }:
 buildDubPackage (finalAttrs: {
   pname = "ddhx";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "dd86k";
     repo = "ddhx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7sXXkn/B9iN8Iq4X/Rj7BufdHKDBS1aG3pXcInG+UaI=";
+    hash = "sha256-1dbY7xUOpwihrppuB+tyHuV2b12E4Yv2J69LXULxmg0=";
   };
 
   dubLock = ./dub-lock.json;

From 41af54d9b2140f9c460b0d0fc58e901e7b8ceca9 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Fri, 26 Jun 2026 12:56:23 -0700
Subject: [PATCH 24/70] buildVscode: enable strictDeps, __structuredAttrs

Encountered this while trying to repackage windsurf as devin-desktop.

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/applications/editors/vscode/generic.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index de93186c3db1..752ff76bf682 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -249,6 +249,9 @@ stdenv.mkDerivation (
       })
     ];
 
+    strictDeps = true;
+    __structuredAttrs = true;
+
     buildInputs = [
       libsecret
     ]

From a41d19f469e13ad9b832834dc15b40e507631a9a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 20:32:02 +0000
Subject: [PATCH 25/70] cargo-show-asm: 0.2.59 -> 0.2.62

---
 pkgs/by-name/ca/cargo-show-asm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-show-asm/package.nix b/pkgs/by-name/ca/cargo-show-asm/package.nix
index 5714316129c1..039fa3861b06 100644
--- a/pkgs/by-name/ca/cargo-show-asm/package.nix
+++ b/pkgs/by-name/ca/cargo-show-asm/package.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-show-asm";
-  version = "0.2.59";
+  version = "0.2.62";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-5RNfokTD86OFGzWRUyY29+d5P3sWWHmzGCGdIkzIK/g=";
+    hash = "sha256-gR1+Daz3EY6HtijWqbaCg6nD2B8gi6EYMYFspW39nlw=";
   };
 
-  cargoHash = "sha256-EcnxozYMjxFHwLpeYwh5dP18+1tiPsY6uQBie3SCg18=";
+  cargoHash = "sha256-QpitYFYRkzntVW15PJimVIX6AaIU+qVY7g3Y88GnKkA=";
 
   nativeBuildInputs = [
     installShellFiles

From 78499735365188b3e605abb1e3699993f42420eb Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Fri, 26 Jun 2026 15:50:18 -0700
Subject: [PATCH 26/70] kiro: fix build on Darwin

---
 pkgs/by-name/ki/kiro/package.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ki/kiro/package.nix b/pkgs/by-name/ki/kiro/package.nix
index 9c6e7361eebc..60d81bd99c69 100644
--- a/pkgs/by-name/ki/kiro/package.nix
+++ b/pkgs/by-name/ki/kiro/package.nix
@@ -5,6 +5,7 @@
   fetchurl,
   extraCommandLineArgs ? "",
   useVSCodeRipgrep ? stdenv.hostPlatform.isDarwin,
+  _7zz,
 }:
 
 let
@@ -31,7 +32,16 @@ in
     url = sources.url;
     hash = sources.hash;
   };
-  sourceRoot = "Kiro";
+
+  # Kiro.dmg is APFS formatted, unpack with 7zz
+  extraNativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ _7zz ];
+
+  sourceRoot = if stdenv.hostPlatform.isDarwin then "Kiro.app" else "Kiro";
+
+  sourceExecutableName = if stdenv.hostPlatform.isDarwin then "code" else "kiro";
+
+  dontFixup = stdenv.hostPlatform.isDarwin;
+
   patchVSCodePath = true;
 
   tests = { };

From 2b8a1f0842fbccebf45a016f96561853161c03cf Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 15:41:00 +0200
Subject: [PATCH 27/70] cai: init at 1.1.5-unstable-2026-06-05

Framework for AI Security

https://github.com/aliasrobotics/cai
---
 pkgs/by-name/ca/cai/package.nix | 131 ++++++++++++++++++++++++++++++++
 1 file changed, 131 insertions(+)
 create mode 100644 pkgs/by-name/ca/cai/package.nix

diff --git a/pkgs/by-name/ca/cai/package.nix b/pkgs/by-name/ca/cai/package.nix
new file mode 100644
index 000000000000..2bc457a2ccfd
--- /dev/null
+++ b/pkgs/by-name/ca/cai/package.nix
@@ -0,0 +1,131 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+  writableTmpDirAsHomeHook,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "cai";
+  version = "1.1.5-unstable-2026-06-05";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "aliasrobotics";
+    repo = "cai";
+    rev = "1c79507140845d0c57455e3b623e489680fd80e8";
+    hash = "sha256-LcU9GoUulpeAaaBZr2Mg/C+UmjZ74UL+SGqdB0P9JtA=";
+  };
+
+  pythonRemoveDeps = [
+    "cryptography"
+    "dotenv"
+    "openinference-instrumentation-openai"
+    "pypdf2"
+  ];
+
+  pythonRelaxDeps = [ "openai" ];
+
+  build-system = with python3Packages; [ hatchling ];
+
+  dependencies = with python3Packages; [
+    cryptography
+    curl-cffi
+    dnspython
+    docker
+    fastapi
+    flask
+    folium
+    graphviz
+    griffe
+    litellm
+    mako
+    matplotlib
+    mcp
+    mkdocs
+    mkdocs-material
+    nest-asyncio
+    networkx
+    numpy
+    numpy
+    openai
+    openinference-instrumentation-openai
+    pandas
+    paramiko
+    prompt-toolkit
+    pydantic
+    pypdf
+    python-dotenv
+    questionary
+    requests
+    rich
+    textual
+    trafilatura
+    types-requests
+    typing-extensions
+    wasabi
+    websockets
+  ];
+
+  nativeInstallCheckInputs = with python3Packages; [
+    inline-snapshot
+    litellm
+    pytest-asyncio
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  pythonImportsCheck = [ "cai" ];
+
+  disabledTestPaths = [
+    # Exclude examples
+    "examples/"
+    # API key is required
+    "tests/agents/test_agent_inference.py"
+    "tests/agents/test_agent_one_tool.py"
+    "tests/agents/test_blue_teamer_gctr.py"
+    "tests/api/test_api.py"
+    "tests/cli/test_cli_headless_cancellation.py"
+    "tests/commands/"
+    "tests/integration/"
+    "tests/refusals/"
+    "tests/test_unified_pattern.py"
+    "tools/tpm_test.py"
+    # openai 2.x API changes
+    "tests/cli/test_cli_streaming.py"
+    "tests/core/test_openai_chatcompletions.py"
+    "tests/core/test_openai_chatcompletions_stream.py"
+    "tests/mcp/test_runner_calls_mcp.py"
+    "tests/tracing/test_agent_tracing.py"
+    "tests/tracing/test_responses_tracing.py"
+    "tests/tracing/test_tracing.py"
+    "tests/tracing/test_tracing_errors.py"
+    "tests/tracing/test_tracing_errors_streamed.py"
+    "tests/voice/test_workflow.py"
+    # Missing symbols (version mismatch)
+    "tests/core/test_auto_compact.py"
+    "tests/core/test_context_optimization.py"
+    # Probing the live interpreter outside sandbox
+    "tests/continuous_ops/test_wizard_worker_python_bin.py"
+    # Tests requires live CTF infrastructure
+    "tests/ctfs/test_ctf.py"
+    # Other error
+    "tests/test_cli_print_deduplication.py"
+    "tests/tools/test_output_tool.py"
+    "tests/util/test_wait_hints_compact.py"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Framework for AI Security";
+    homepage = "https://github.com/aliasrobotics/cai";
+    changelog = "https://github.com/aliasrobotics/cai/releases/tag/${finalAttrs.src.rev}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "cai";
+  };
+})

From de1c0631189ff3c2455de84dab9d5c6af2f5811b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 15:46:46 +0200
Subject: [PATCH 28/70] python3Packages.opentelemetry-instrumentation: migrate
 to finalAttrs

---
 .../opentelemetry-instrumentation/default.nix          | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
index 80c5e8536de1..d8534e95f7f5 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
@@ -10,7 +10,7 @@
   wrapt,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "opentelemetry-instrumentation";
   version = "0.55b0";
   pyproject = true;
@@ -19,11 +19,11 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-python-contrib";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-UM9ezCh3TVwyj257O0rvTCIgfrddobWcVIgJmBUj/Vo=";
   };
 
-  sourceRoot = "${src.name}/opentelemetry-instrumentation";
+  sourceRoot = "${finalAttrs.src.name}/opentelemetry-instrumentation";
 
   build-system = [ hatchling ];
 
@@ -53,8 +53,8 @@ buildPythonPackage rec {
   meta = {
     description = "Instrumentation Tools & Auto Instrumentation for OpenTelemetry Python";
     homepage = "https://github.com/open-telemetry/opentelemetry-python-contrib/tree/main/opentelemetry-instrumentation";
-    changelog = "https://github.com/open-telemetry/opentelemetry-python-contrib/releases/tag/v${version}";
+    changelog = "https://github.com/open-telemetry/opentelemetry-python-contrib/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.natsukium ];
   };
-}
+})

From d754d06167cad3a7b76d31697af22fb420807ce5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 26 Jun 2026 23:59:57 +0200
Subject: [PATCH 29/70] python313Packages.opentelemetry-instrumentation-httpx:
 disable test on Python 3.14

---
 .../opentelemetry-instrumentation-httpx/default.nix         | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation-httpx/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation-httpx/default.nix
index 4fe687d399dd..4cf08c1aa584 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation-httpx/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation-httpx/default.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   buildPythonPackage,
   hatchling,
   httpx,
@@ -6,7 +7,9 @@
   opentelemetry-instrumentation,
   opentelemetry-util-http,
   opentelemetry-test-utils,
+  opentelemetry-semantic-conventions,
   pytestCheckHook,
+  pythonOlder,
   respx,
 }:
 
@@ -23,6 +26,7 @@ buildPythonPackage {
     httpx
     opentelemetry-api
     opentelemetry-instrumentation
+    opentelemetry-semantic-conventions
     opentelemetry-util-http
   ];
 
@@ -32,6 +36,8 @@ buildPythonPackage {
     respx
   ];
 
+  doCheck = pythonOlder "3.14";
+
   pythonImportsCheck = [ "opentelemetry.instrumentation.httpx" ];
 
   meta = opentelemetry-instrumentation.meta // {

From 169a00e8d10b519a54a4e9f7763ee315532d3650 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 01:34:03 +0000
Subject: [PATCH 30/70] 
 home-assistant-custom-lovelace-modules.material-you-utilities: 2.1.15 ->
 2.1.16

---
 .../material-you-utilities/package.nix                      | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
index 0e886d89926d..af26077a697e 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "material-you-utilities";
-  version = "2.1.15";
+  version = "2.1.16";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "material-you-utilities";
     tag = version;
-    hash = "sha256-fqs2+OEBOJDO3Y3QO7+R93TCNg+FooZVgilTxcDcNjo=";
+    hash = "sha256-s8VVV2KmiJ3auQPRwVRWHonYlVWkExC3quRANfW295U=";
   };
 
-  npmDepsHash = "sha256-1Cv90vnfhAY+XaiN523APShl6al/RkFbcVUiNayg+FE=";
+  npmDepsHash = "sha256-D18gwO8zO7lKbaRhj+QaeGzkE7zqXc3KGvz9am4rrFY=";
 
   installPhase = ''
     runHook preInstall

From 956f005a7e2cb62b82021f592c9a7c3957514af3 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 22:47:46 -0500
Subject: [PATCH 31/70] =?UTF-8?q?yaziPlugins.toggle-pane:=200-unstable-202?=
 =?UTF-8?q?6-05-07=20=E2=86=92=200-unstable-2026-06-26?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Compare: https://github.com/yazi-rs/plugins/compare/4ffa48f33465c22cce48c5d506295a3eb27c1979...39aaf6dc77e546fe7f7836f102a6c57f96d15365
---
 pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix b/pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix
index 939c16325536..8322d78c35ef 100644
--- a/pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "toggle-pane.yazi";
-  version = "0-unstable-2026-05-07";
+  version = "0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "yazi-rs";
     repo = "plugins";
-    rev = "4ffa48f33465c22cce48c5d506295a3eb27c1979";
-    hash = "sha256-wr5QL493A175dRjYSyYpMMJax1RKWaZ3jAdFdL3XXTw=";
+    rev = "39aaf6dc77e546fe7f7836f102a6c57f96d15365";
+    hash = "sha256-rl8EA8aymVQU1296IVsEZ2WR9xBxQTYBK+VUCic/K3k=";
   };
 
   meta = {

From 8f4dedd2cdfb4d1c9540d871498aad1e686db18a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 05:14:34 +0000
Subject: [PATCH 32/70] immich-go: 0.31.0 -> 0.32.0

---
 pkgs/by-name/im/immich-go/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/im/immich-go/package.nix b/pkgs/by-name/im/immich-go/package.nix
index bb2900f0ab30..9dc8babd6be0 100644
--- a/pkgs/by-name/im/immich-go/package.nix
+++ b/pkgs/by-name/im/immich-go/package.nix
@@ -9,13 +9,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "immich-go";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "simulot";
     repo = "immich-go";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u+laNZ0/UncwH+3Ylk7g40DB99dAbQRrBNOVk80FrMc=";
+    hash = "sha256-bMbLMlLZpzFP7Zh9kqWzEELt3MdOR8HMkH0gTU8qD9U=";
 
     # Inspired by: https://github.com/NixOS/nixpkgs/blob/f2d7a289c5a5ece8521dd082b81ac7e4a57c2c5c/pkgs/applications/graphics/pdfcpu/default.nix#L20-L32
     # The intention here is to write the information into files in the `src`'s
@@ -32,7 +32,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-C6IQ6g5vdGqv8mzdTzLicZqP5lh3l2uNH2gIZELNAHg=";
+  vendorHash = "sha256-BwrP+eG+XPcTAbSKhJk0BOrfBlNeLHEeRhq49ZkQhwY=";
 
   # options used by upstream:
   # https://github.com/simulot/immich-go/blob/v0.25.0/.goreleaser.yaml

From b291d78e7501bbe327176016a378b81eff075d9d Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 22:55:16 -0500
Subject: [PATCH 33/70] luaPackages.fzf-lua: 0.0.2658-1 -> 0.0.2661-1

---
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 09ba666c16c2..973004b1d2d9 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1040,15 +1040,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "fzf-lua";
-      version = "0.0.2658-1";
+      version = "0.0.2661-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.2658-1.rockspec";
-          sha256 = "1dibv791x3yvw4ib56661r4g1v0lmfbwssj0x0jbwsjwnrnqis14";
+          url = "mirror://luarocks/fzf-lua-0.0.2661-1.rockspec";
+          sha256 = "0gw3q50zxawk81bnaxpj9n9n6fvv9qmyykvnxlha33bz0wvc13cq";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/267f5db2aa2202b9f6cc7a50783f0ccd2121766c.zip";
-        sha256 = "1a4yy3wj0xq0jyrx8qnj6i29v5c8vvi52sbrk8112xy66qlysmm8";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/b6f0392fe1645973c795b5bbbd8d6db466a5a25a.zip";
+        sha256 = "17mr5nnsx86isk8zqknpc172hpg86nxvmplcwwnk67qg1y8a8jwa";
       };
 
       disabled = luaOlder "5.1";

From d7cc6de0c6c40621575b194d6bb325d9fcf9f51b Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 22:56:54 -0500
Subject: [PATCH 34/70] luaPackages.grug-far-nvim: 1.6.71-1 -> 1.6.72-1

---
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 973004b1d2d9..12d8b6a3dccf 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1137,15 +1137,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "grug-far.nvim";
-      version = "1.6.71-1";
+      version = "1.6.72-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.6.71-1.rockspec";
-          sha256 = "1gvwjg617qimb8i737hvdr423py7ry8c0lsna9chpxaks3j0cf4n";
+          url = "mirror://luarocks/grug-far.nvim-1.6.72-1.rockspec";
+          sha256 = "1ky24vksn0wvv058pvv03r163ba07s8b051mwi99qna2y77js2ds";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/c995bbacf8229dc096ec1c3d60f8531059c86c1b.zip";
-        sha256 = "15wv6hvkiqi0rdg59y7dgaz7g6nz3141fdmkdggrc1h8aadky9zr";
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/c69859c1d5427ab5fc7ed12380ab521b4e336691.zip";
+        sha256 = "0yp64zp64zk5skf3blx359dmchy9wwfv4nf30hhdagvm8phbkkpx";
       };
 
       disabled = luaOlder "5.1";

From a19e6f82cca0e1750c412b9f7655664a600d7a26 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 22:59:07 -0500
Subject: [PATCH 35/70] luaPackages.kulala-nvim: 6.15.3-1 -> 6.17.0-1

---
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 12d8b6a3dccf..26528d92737f 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1322,15 +1322,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "kulala.nvim";
-      version = "6.15.3-1";
+      version = "6.17.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/kulala.nvim-6.15.3-1.rockspec";
-          sha256 = "00ghq3ph0vykphhiilj2k8643hdm5glz3h9iwpnsbahpgwpwppzy";
+          url = "mirror://luarocks/kulala.nvim-6.17.0-1.rockspec";
+          sha256 = "1m2i088p9gdkvh2s1pgzwq7j2wi2n97k2qdwggi5g22c20ph9370";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mistweaverco/kulala.nvim/archive/v6.15.3.zip";
-        sha256 = "1friyckh8bxsixsql1r3h1ljfr3a13w061hnw5z7rj92inyx5536";
+        url = "https://github.com/mistweaverco/kulala.nvim/archive/v6.17.0.zip";
+        sha256 = "03iilwmi10v6d849nxi47rgfg65qzir4h7h28iw2ga3l3f33h2gy";
       };
 
       disabled = luaOlder "5.1";

From b92a3029b56c947ce909c5fb51a62796855567a7 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 23:29:17 -0500
Subject: [PATCH 36/70] luaPackages.mini-test: 0.17.0-1 -> 0.18.0-1

---
 pkgs/development/lua-modules/generated-packages.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 26528d92737f..bf81a8f8e457 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -4712,21 +4712,21 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "mini.test";
-      version = "0.17.0-1";
+      version = "0.18.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/mini.test-0.17.0-1.rockspec";
-          sha256 = "0k9qvizfb3if0r20zid8had91ckkfy061lznvmi4r9hyy421dwfw";
+          url = "mirror://luarocks/mini.test-0.18.0-1.rockspec";
+          sha256 = "0k0pdp5qalfhcmdaqi0mz3s0p7rwq88bjcs6b7s5z80rqrhji67k";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/echasnovski/mini.test/archive/v0.17.0.zip";
-        sha256 = "0hffg59cn8dlhnjnkcfs9vannf10n2j33lna2d8zbaxajxaa8jks";
+        url = "https://github.com/nvim-mini/mini.test/archive/v0.18.0.zip";
+        sha256 = "1q1qy3f0mxrqx96gq4q3h4w2qip40lqkyd9vs65zc76wj9wx37hw";
       };
 
       disabled = luaOlder "5.1";
 
       meta = {
-        homepage = "https://github.com/echasnovski/mini.test";
+        homepage = "https://github.com/nvim-mini/mini.test";
         license = lib.licenses.mit;
         description = "Test neovim plugins. Part of the mini.nvim suite.";
       };

From 3efe3c35b5ae432bca177e26554dc3f2ee210b4c Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 23:43:20 -0500
Subject: [PATCH 37/70] luaPackages.teal-language-server: 0.1.3-1 -> 0.1.4-1

---
 pkgs/development/lua-modules/generated-packages.nix | 12 +++++-------
 pkgs/development/lua-modules/overrides.nix          |  6 +++---
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index bf81a8f8e457..def14215c9b5 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -5937,7 +5937,6 @@ final: prev: {
       buildLuarocksPackage,
       fetchFromGitHub,
       fetchurl,
-      inspect,
       ltreesitter,
       lua-cjson,
       luafilesystem,
@@ -5947,22 +5946,21 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "teal-language-server";
-      version = "0.1.3-1";
+      version = "0.1.4-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/teal-language-server-0.1.3-1.rockspec";
-          sha256 = "1mqg294rgzcfbfam0qdab3z93j7gsx250hs9f271337gqki34848";
+          url = "mirror://luarocks/teal-language-server-0.1.4-1.rockspec";
+          sha256 = "0hgjlpyc90r3m4n4y6k8vjf5cdkv1q5b1mrfc31pssrhfwplq5hq";
         }).outPath;
       src = fetchFromGitHub {
         owner = "teal-language";
         repo = "teal-language-server";
-        tag = "0.1.3";
-        hash = "sha256-XuHm6AbcBmv0fyQjlJlBMWqJlGYoveW7BEEN+axMRhw=";
+        tag = "0.1.4";
+        hash = "sha256-5SdKjE690zxLAl2Kwcy2Bk49KUrpkYBPviK+mrQnMec=";
       };
 
       propagatedBuildInputs = [
         argparse
-        inspect
         ltreesitter
         lua-cjson
         luafilesystem
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 6819850eef40..0bbadc0ac269 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -1178,9 +1178,9 @@ in
     '';
     postConfigure = (old.postConfigure or "") + ''
       substituteInPlace ''${rockspecFilename} \
-        --replace-fail '"ltreesitter == 0.1.0",' '"ltreesitter >= 0.2.0",' \
-        --replace-fail '"luv == 1.51.0",' '"luv >= 1.51.0",' \
-        --replace-fail '"tl == 0.24.5",' '"tl >= 0.24.5",'
+        --replace-fail '"ltreesitter == 0.3.0",' '"ltreesitter >= 0.3.0",' \
+        --replace-fail '"luv == 1.52.1",' '"luv >= 1.52.1",' \
+        --replace-fail '"tl == 0.24.8",' '"tl >= 0.24.8",'
     '';
   });
 

From a2bb7f10685284679519c9d991bcdb0b1e8ec787 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 23:44:08 -0500
Subject: [PATCH 38/70] luaPackages.telescope-nvim:
 scm-1-9377230aa5305d9e9aca4ed8dadf1070fb4aa9fc ->
 scm-1-427b576c16792edad01a92b89721d923c19ad60f

---
 pkgs/development/lua-modules/generated-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index def14215c9b5..23c348d7a46c 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -6032,8 +6032,8 @@ final: prev: {
       src = fetchFromGitHub {
         owner = "nvim-telescope";
         repo = "telescope.nvim";
-        rev = "9377230aa5305d9e9aca4ed8dadf1070fb4aa9fc";
-        hash = "sha256-iFHYx+5Rf3ol7CjVLjqVu+VNjdGfeC8V8nS/1THO+cQ=";
+        rev = "427b576c16792edad01a92b89721d923c19ad60f";
+        hash = "sha256-/GycCrepwDer0UvBN/f84pJUSvNp+ZfTIUPv0psl+IQ=";
       };
 
       disabled = lua.luaversion != "5.1";

From dc50dcfdead7beb457498c99b35a35374fedfc20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 22:47:34 -0700
Subject: [PATCH 39/70] lemmy-ui: use pnpm_11

---
 pkgs/servers/web-apps/lemmy/pin.json | 2 +-
 pkgs/servers/web-apps/lemmy/ui.nix   | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/servers/web-apps/lemmy/pin.json b/pkgs/servers/web-apps/lemmy/pin.json
index d419fa5b0c1e..b7e07bc4303b 100644
--- a/pkgs/servers/web-apps/lemmy/pin.json
+++ b/pkgs/servers/web-apps/lemmy/pin.json
@@ -4,5 +4,5 @@
   "serverHash": "sha256-JcJV1dEWlFsbv9eH2yQMGYEZEFB/Pe1xtL1UNtKI6c4=",
   "serverCargoHash": "sha256-cwmz8Gf7T1IsCRyxo3ap+byX+Aj7+iCTHmZ/IeMN2no=",
   "uiHash": "sha256-67OMwzOGl+dMX5YNPPBG/QwKOVerkSa7ICbrQl4YBp4=",
-  "uiPNPMDepsHash": "sha256-T7vHfeewwT8fCH6AM6u2GFRkd+KWsp4lKj5I7I+yJAo="
+  "uiPNPMDepsHash": "sha256-50IUUymGyaCAeMnWbYJlBytcULr9lvuY9kLVSEqHGL0="
 }
diff --git a/pkgs/servers/web-apps/lemmy/ui.nix b/pkgs/servers/web-apps/lemmy/ui.nix
index 787000960efe..b44e20f314b4 100644
--- a/pkgs/servers/web-apps/lemmy/ui.nix
+++ b/pkgs/servers/web-apps/lemmy/ui.nix
@@ -3,7 +3,7 @@
   stdenvNoCC,
   libsass,
   nodejs,
-  pnpm_9,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   fetchFromGitHub,
@@ -31,7 +31,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpm_11
   ];
 
   buildInputs = [
@@ -42,8 +42,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   extraBuildInputs = [ libsass ];
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
     hash = pinData.uiPNPMDepsHash;
   };
 

From ed033eb3a2fef68087c5208ad2fd7a3e89e3d712 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 05:56:31 +0000
Subject: [PATCH 40/70] oh-my-posh: 29.18.0 -> 29.19.0

---
 pkgs/by-name/oh/oh-my-posh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/oh/oh-my-posh/package.nix b/pkgs/by-name/oh/oh-my-posh/package.nix
index c068bd32779e..93fbf33e6a40 100644
--- a/pkgs/by-name/oh/oh-my-posh/package.nix
+++ b/pkgs/by-name/oh/oh-my-posh/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "oh-my-posh";
-  version = "29.18.0";
+  version = "29.19.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = "oh-my-posh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A01LX+UvPlnQy/GoRoLVIBl8TrIB6XGjvpr3fCB5Jsg=";
+    hash = "sha256-KhE0JWOY9j4rSmVZOmUxC9pQbjSpISph+6RyntlryFs=";
   };
 
-  vendorHash = "sha256-cuVkJjaeLBECeEBPSB1hyRcBs4AhXkG4br0ehjZ0pjI=";
+  vendorHash = "sha256-SI2FjnRlWSsS9Uju8R+FW6/IpqewXsiOwKXfueZ7KPY=";
 
   sourceRoot = "${finalAttrs.src.name}/src";
 

From 6ba6b67a9c491b82ab4d9468e36840b9163270d3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 06:02:07 +0000
Subject: [PATCH 41/70] python3Packages.python-smarttub: 0.0.47 -> 0.0.48

---
 pkgs/development/python-modules/python-smarttub/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-smarttub/default.nix b/pkgs/development/python-modules/python-smarttub/default.nix
index 4bca217d6b6f..92d69807e2ae 100644
--- a/pkgs/development/python-modules/python-smarttub/default.nix
+++ b/pkgs/development/python-modules/python-smarttub/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "python-smarttub";
-  version = "0.0.47";
+  version = "0.0.48";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mdz";
     repo = "python-smarttub";
     tag = "v${version}";
-    hash = "sha256-jKNXViqyRFPeHmoUGL9BGUUcVTQ1w3uJy7J8OlFikPw=";
+    hash = "sha256-+iaRZO4jPpVnE8Tj8SwjMUXS3xB7vd/ztRYNE2B48Ro=";
   };
 
   build-system = [

From 062e157d63fa4596ef866ac6b34c4958d5de849c Mon Sep 17 00:00:00 2001
From: Lein Matsumaru <applePrincess@applePrincess.io>
Date: Sat, 27 Jun 2026 07:35:50 +0000
Subject: [PATCH 42/70] textlint: 15.2.1 -> 15.7.1

---
 pkgs/by-name/te/textlint/package.nix          | 14 ++++++-------
 .../te/textlint/remove-overrides.patch        | 20 +++++++++++++++----
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/te/textlint/package.nix b/pkgs/by-name/te/textlint/package.nix
index ddb43b9e6b20..5d18f749d5b4 100644
--- a/pkgs/by-name/te/textlint/package.nix
+++ b/pkgs/by-name/te/textlint/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   makeWrapper,
   nodejs-slim,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   versionCheckHook,
@@ -29,13 +29,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "textlint";
-  version = "15.2.1";
+  version = "15.7.1";
 
   src = fetchFromGitHub {
     owner = "textlint";
     repo = "textlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xjtmYz+O+Sn697OrBkPddv1Ma5UsOkO5v4SGlhsaYWA=";
+    hash = "sha256-Dt0AprnI/ixezMwU6JG6WhfJTU1xTRu2M4xwbY4uOko=";
   };
 
   patches = [
@@ -57,16 +57,16 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-TYMhAcmfWHbj/0yLNYiJXWd1GiYb+zqBLj2/83cGbzg=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-dWcLm8cTo8LC6IqMEe1zDxVJ7ioytKigEwYna6hiO8A=";
   };
 
   nativeBuildInputs = [
     makeWrapper
     nodejs-slim
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
   ];
 
   buildPhase = ''
diff --git a/pkgs/by-name/te/textlint/remove-overrides.patch b/pkgs/by-name/te/textlint/remove-overrides.patch
index 0d6737107c0e..8fa5d4108d09 100644
--- a/pkgs/by-name/te/textlint/remove-overrides.patch
+++ b/pkgs/by-name/te/textlint/remove-overrides.patch
@@ -1,10 +1,10 @@
 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index 1f0e8f8b..68a9c06a 100644
+index 9ee6370f6..552beed1b 100644
 --- a/pnpm-lock.yaml
 +++ b/pnpm-lock.yaml
-@@ -4,9 +4,6 @@ settings:
-   autoInstallPeers: true
-   excludeLinksFromLockfile: false
+@@ -295,9 +295,6 @@ catalogs:
+       specifier: ^3.25.76
+       version: 3.25.76
  
 -overrides:
 -  '@textlint/ast-node-types': workspace:*
@@ -12,3 +12,15 @@ index 1f0e8f8b..68a9c06a 100644
  importers:
  
    .:
+diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
+index 300a519e0..bf41d5370 100644
+--- a/pnpm-workspace.yaml
++++ b/pnpm-workspace.yaml
+@@ -130,7 +130,5 @@ minimumReleaseAgeExclude:
+ # Force all @textlint/ast-node-types references to use the workspace version
+ # This prevents version conflicts where some packages might reference old versions (e.g., 13.4.1)
+ # that cause TypeScript type incompatibility errors in monorepo
+-overrides:
+-  "@textlint/ast-node-types": "workspace:*"
+ # https://pnpm.io/settings#verifydepsbeforerun
+ verifyDepsBeforeRun: "install"

From af3fbfd8f39eae8303ee44e0871cd5a16cbe732e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 09:58:09 +0200
Subject: [PATCH 43/70] python3Packages.iamdata: 0.1.202606261 -> 0.1.202606271

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202606261...v0.1.202606271

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202606271
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 0a749b9892d9..6bedcafffc37 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606261";
+  version = "0.1.202606271";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gxtJMcDyez94n1JVc0KZo2ygtskcPgudSLdUzgfCJjw=";
+    hash = "sha256-EdU6fcNXufK/GK7tz43+SDox/Cms4uVT5DEzyIv93OQ=";
   };
 
   __darwinAllowLocalNetworking = true;

From d31c61f700b1a65b8e374f9d57de091228831c82 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:01:14 +0200
Subject: [PATCH 44/70] python3Packages.python-smarttub: migrate to finalAttrs

---
 .../python-modules/python-smarttub/default.nix            | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/python-smarttub/default.nix b/pkgs/development/python-modules/python-smarttub/default.nix
index 92d69807e2ae..f705b32a1940 100644
--- a/pkgs/development/python-modules/python-smarttub/default.nix
+++ b/pkgs/development/python-modules/python-smarttub/default.nix
@@ -13,7 +13,7 @@
   python-dateutil,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-smarttub";
   version = "0.0.48";
   pyproject = true;
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mdz";
     repo = "python-smarttub";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-+iaRZO4jPpVnE8Tj8SwjMUXS3xB7vd/ztRYNE2B48Ro=";
   };
 
@@ -48,8 +48,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python API for SmartTub enabled hot tubs";
     homepage = "https://github.com/mdz/python-smarttub";
-    changelog = "https://github.com/mdz/python-smarttub/releases/tag/v${version}";
+    changelog = "https://github.com/mdz/python-smarttub/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From 6d8c9047d3a34145cb5dc84e8e909797103aac4b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 08:01:24 +0000
Subject: [PATCH 45/70] attic-client: 0-unstable-2026-06-14 ->
 0-unstable-2026-06-26

---
 pkgs/by-name/at/attic-client/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/at/attic-client/package.nix b/pkgs/by-name/at/attic-client/package.nix
index 51fa7cbe75da..5a23514ca537 100644
--- a/pkgs/by-name/at/attic-client/package.nix
+++ b/pkgs/by-name/at/attic-client/package.nix
@@ -21,13 +21,13 @@ in
 
 rustPlatform.buildRustPackage {
   pname = "attic";
-  version = "0-unstable-2026-06-14";
+  version = "0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "zhaofengli";
     repo = "attic";
-    rev = "6b22d76ca351c5a07a5e5a60b95bc23320f7e791";
-    hash = "sha256-sboz+gG8z0KX+q0kkvLloNcogXYLwiY5iw2xwN36rFo=";
+    rev = "b7c905657cb81b8ec9c26b0d9f53aa2e4f231810";
+    hash = "sha256-//gQFVLVFhwHyI9yrpPqX0MQJGYqS6nE/iLV872K+PU=";
   };
 
   nativeBuildInputs = [
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage {
   buildInputs = lib.optional needNixInclude nix ++ [ boost ];
 
   cargoBuildFlags = lib.concatMapStrings (c: "-p ${c} ") crates;
-  cargoHash = "sha256-LqE4jOIasxIG4DAhgZJMlTSyt/a900QR06wBFtRNRO8=";
+  cargoHash = "sha256-fYWRlgP3uwntULe6o2MC1yB/ea2x+27m1Op7o2wUd+U=";
 
   env = {
     ATTIC_DISTRIBUTOR = "nixpkgs";

From f727724f2c81d46b13f9f02fc79bf344ed6c2d25 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Wed, 17 Jun 2026 22:09:51 -0400
Subject: [PATCH 46/70] windsurf: rename to devin-desktop, bump to 3.3.18

Announcement: https://cognition.com/blog/introducing-devin-desktop

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/de/devin-desktop/info.json       | 14 +++++++++++++
 .../windsurf => de/devin-desktop}/package.nix | 20 +++++++++----------
 .../devin-desktop}/update/.gitignore          |  0
 .../devin-desktop}/update/package.json        |  0
 .../devin-desktop}/update/tsconfig.json       |  0
 .../devin-desktop}/update/update.mts          |  9 ++++-----
 pkgs/by-name/wi/windsurf/info.json            | 20 -------------------
 pkgs/top-level/aliases.nix                    |  1 +
 8 files changed, 29 insertions(+), 35 deletions(-)
 create mode 100644 pkgs/by-name/de/devin-desktop/info.json
 rename pkgs/by-name/{wi/windsurf => de/devin-desktop}/package.nix (73%)
 rename pkgs/by-name/{wi/windsurf => de/devin-desktop}/update/.gitignore (100%)
 rename pkgs/by-name/{wi/windsurf => de/devin-desktop}/update/package.json (100%)
 rename pkgs/by-name/{wi/windsurf => de/devin-desktop}/update/tsconfig.json (100%)
 rename pkgs/by-name/{wi/windsurf => de/devin-desktop}/update/update.mts (84%)
 delete mode 100644 pkgs/by-name/wi/windsurf/info.json

diff --git a/pkgs/by-name/de/devin-desktop/info.json b/pkgs/by-name/de/devin-desktop/info.json
new file mode 100644
index 000000000000..5c45c061197d
--- /dev/null
+++ b/pkgs/by-name/de/devin-desktop/info.json
@@ -0,0 +1,14 @@
+{
+  "aarch64-darwin": {
+    "version": "3.3.18",
+    "vscodeVersion": "1.110.1",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/16737566f57f3b53bde136375fe0544eca12fac4/Devin-darwin-arm64-3.3.18.zip",
+    "sha256": "7ac789baa5d818b09f6a62315d34b55dde02b0a409a22903d0228a819ea734e7"
+  },
+  "x86_64-linux": {
+    "version": "3.3.18",
+    "vscodeVersion": "1.110.1",
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/16737566f57f3b53bde136375fe0544eca12fac4/Devin-linux-x64-3.3.18.tar.gz",
+    "sha256": "05c7fa988c324a1633038ebe90e217d17a7f188197a5070f397460864ef41292"
+  }
+}
diff --git a/pkgs/by-name/wi/windsurf/package.nix b/pkgs/by-name/de/devin-desktop/package.nix
similarity index 73%
rename from pkgs/by-name/wi/windsurf/package.nix
rename to pkgs/by-name/de/devin-desktop/package.nix
index 6f5e6c97c769..d33b5d803dbf 100644
--- a/pkgs/by-name/wi/windsurf/package.nix
+++ b/pkgs/by-name/de/devin-desktop/package.nix
@@ -16,15 +16,16 @@ buildVscode {
   inherit commandLineArgs useVSCodeRipgrep;
 
   inherit (info) version vscodeVersion;
-  pname = "windsurf";
 
-  executableName = "windsurf";
-  longName = "Windsurf";
-  shortName = "windsurf";
-  libraryName = "windsurf";
-  iconName = "windsurf";
+  pname = "devin-desktop";
 
-  sourceRoot = if stdenv.hostPlatform.isDarwin then "Windsurf.app" else "Windsurf";
+  executableName = "devin-desktop";
+  longName = "devin-desktop";
+  shortName = "devin-desktop";
+  libraryName = "devin-desktop";
+  iconName = "devin-desktop";
+
+  sourceRoot = if stdenv.hostPlatform.isDarwin then "Devin.app" else "Devin";
 
   src = fetchurl { inherit (info) url sha256; };
 
@@ -41,9 +42,9 @@ buildVscode {
     description = "Agentic IDE powered by AI Flow paradigm";
     longDescription = ''
       The first agentic IDE, and then some.
-      The Windsurf Editor is where the work of developers and AI truly flow together, allowing for a coding experience that feels like literal magic.
+      Devin Desktop is where the work of developers and AI truly flow together, allowing for a coding experience that feels like literal magic.
     '';
-    homepage = "https://codeium.com/windsurf";
+    homepage = "https://devin.ai/desktop";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
       sarahec
@@ -51,7 +52,6 @@ buildVscode {
     ];
     platforms = [
       "aarch64-darwin"
-      "x86_64-darwin"
       "x86_64-linux"
     ];
     sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
diff --git a/pkgs/by-name/wi/windsurf/update/.gitignore b/pkgs/by-name/de/devin-desktop/update/.gitignore
similarity index 100%
rename from pkgs/by-name/wi/windsurf/update/.gitignore
rename to pkgs/by-name/de/devin-desktop/update/.gitignore
diff --git a/pkgs/by-name/wi/windsurf/update/package.json b/pkgs/by-name/de/devin-desktop/update/package.json
similarity index 100%
rename from pkgs/by-name/wi/windsurf/update/package.json
rename to pkgs/by-name/de/devin-desktop/update/package.json
diff --git a/pkgs/by-name/wi/windsurf/update/tsconfig.json b/pkgs/by-name/de/devin-desktop/update/tsconfig.json
similarity index 100%
rename from pkgs/by-name/wi/windsurf/update/tsconfig.json
rename to pkgs/by-name/de/devin-desktop/update/tsconfig.json
diff --git a/pkgs/by-name/wi/windsurf/update/update.mts b/pkgs/by-name/de/devin-desktop/update/update.mts
similarity index 84%
rename from pkgs/by-name/wi/windsurf/update/update.mts
rename to pkgs/by-name/de/devin-desktop/update/update.mts
index 64fad0bbd59f..f10048bfdbd4 100755
--- a/pkgs/by-name/wi/windsurf/update/update.mts
+++ b/pkgs/by-name/de/devin-desktop/update/update.mts
@@ -17,7 +17,7 @@ interface LatestInfo {
   readonly productVersion: string;
 }
 
-const platforms = ["aarch64-darwin", "x86_64-darwin", "x86_64-linux"] as const;
+const platforms = ["aarch64-darwin", "x86_64-linux"] as const;
 type Platform = (typeof platforms)[number];
 type InfoMap = Record<
   Platform,
@@ -29,7 +29,7 @@ type InfoMap = Record<
   }
 >;
 
-async function getInfo(targetSystem: "darwin-arm64" | "darwin-x64" | "linux-x64") {
+async function getInfo(targetSystem: "darwin-arm64" | "linux-x64") {
   const url =
     `https://windsurf-stable.codeium.com/api/update/${targetSystem}/stable/latest` as const;
 
@@ -57,7 +57,6 @@ async function main() {
 
   const info: InfoMap = {
     "aarch64-darwin": await getInfo("darwin-arm64"),
-    "x86_64-darwin": await getInfo("darwin-x64"),
     "x86_64-linux": await getInfo("linux-x64"),
   };
   if (JSON.stringify(oldInfo) === JSON.stringify(info)) {
@@ -66,7 +65,7 @@ async function main() {
   }
   for (const platform of platforms) {
     console.log(
-      `[update] Updating Windsurf ${platform} ${oldInfo[platform].version} -> ${info[platform].version}`,
+      `[update] Updating Devin Desktop ${platform} ${oldInfo[platform].version} -> ${info[platform].version}`,
     );
   }
   await fsPromises.writeFile(
@@ -74,7 +73,7 @@ async function main() {
     JSON.stringify(info, null, 2) + "\n",
     "utf-8",
   );
-  console.log("[update] Updating Windsurf complete");
+  console.log("[update] Updating Devin Desktop complete");
 }
 
 if (process.argv[1] === __filename) {
diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
deleted file mode 100644
index 52ac71b50298..000000000000
--- a/pkgs/by-name/wi/windsurf/info.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "aarch64-darwin": {
-    "version": "2.3.9",
-    "vscodeVersion": "1.110.1",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/a5d3f1ff990cabc0e8001cce6642bdb7ad429e73/Windsurf-darwin-arm64-2.3.9.zip",
-    "sha256": "35b11cd7307588fa11d4ec4690c2a5da8639e37659d68939e3a1dd46d9a105e3"
-  },
-  "x86_64-darwin": {
-    "version": "2.3.9",
-    "vscodeVersion": "1.110.1",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/a5d3f1ff990cabc0e8001cce6642bdb7ad429e73/Windsurf-darwin-x64-2.3.9.zip",
-    "sha256": "63a515c68f322653b901f1472184ca688102f9b8c0b598dec590eb648ead4211"
-  },
-  "x86_64-linux": {
-    "version": "2.3.9",
-    "vscodeVersion": "1.110.1",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/a5d3f1ff990cabc0e8001cce6642bdb7ad429e73/Windsurf-linux-x64-2.3.9.tar.gz",
-    "sha256": "874024744cd853b7c350fe514be19b0060fac39586253c3b7602d6869473eadc"
-  }
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f8623d3b89d7..986a37e07249 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2350,6 +2350,7 @@ mapAliases {
   wifi-password = throw "'wifi-password' has been removed as it was unmaintained upstream"; # Added 2025-08-29
   win-pvdrivers = throw "'win-pvdrivers' has been removed as it was subject to the Xen build machine compromise (XSN-01) and has open security vulnerabilities (XSA-468)"; # Added 2025-08-29
   win-virtio = throw "'win-virtio' has been renamed to/replaced by 'virtio-win'"; # Converted to throw 2025-10-27
+  windsurf = warnAlias "'windsurf' has been rebranded and replaced as 'devin-desktop'" devin-desktop;
   wineWayland = throw "'wineWayland' has been renamed to/replaced by 'wine-wayland'"; # Converted to throw 2025-10-27
   wineWowPackages =
     warnAlias

From 871635694326d93bc4328d6511db936f89f34dd0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 08:27:28 +0000
Subject: [PATCH 47/70] dbeaver-bin: 26.1.0 -> 26.1.1

---
 pkgs/by-name/db/dbeaver-bin/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index c68ca12af343..cb4cf4679e46 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -19,7 +19,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "26.1.0";
+  version = "26.1.1";
 
   src =
     let
@@ -32,10 +32,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-zAkHddh5xm9SHMV6OcJpl2A3+lS4GMJDbZ/+zg/5PzE=";
-        aarch64-linux = "sha256-0Tv45N+nZ2lRgn/Lo5HpPjuGigI0X2CJIIV96UO0bs8=";
-        x86_64-darwin = "sha256-INfXvR9FJZcruC8KeRtc0SIHUUHc0p3jjDNk4eBk7Lo=";
-        aarch64-darwin = "sha256-s+NQ5hp3NiQpJ/b3mp7Fdjh5rEmf1UnSz/Ai5Z43qEg=";
+        x86_64-linux = "sha256-atbQ00lq589FlNem85NgzTKGyhTRpFII8OSfVfYQuD0=";
+        aarch64-linux = "sha256-Sde0q31hXMqX2oxfhgj5EcpeUYYFZJy61usaJVpZkLM=";
+        x86_64-darwin = "sha256-EmTHuzEc4beM52hC2T7poZ1SOKa9kO2Rp3NnctlsBYo=";
+        aarch64-darwin = "sha256-PwuFwEE+aBEG/ykwNrEBl20yfrade8BdUUHdLJGBkwc=";
       };
     in
     fetchurl {

From cda2ff95ecc3b5bfda1f0eef4cf5c6337d58bb5f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 08:31:41 +0000
Subject: [PATCH 48/70] terraform-providers.cloudflare_cloudflare: 5.20.0 ->
 5.21.1

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index dcc45bb855cc..1a49fccc3bbc 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -209,13 +209,13 @@
     "vendorHash": "sha256-rCWeetM6nhNb1I1PmB66E5K1ku9ODRqN87MU9y6W/dc="
   },
   "cloudflare_cloudflare": {
-    "hash": "sha256-y3GAU5wLLETSrmYqGZs2I0qg8jnGcu32Xt/UHGS1NTA=",
+    "hash": "sha256-SHEK/NJrs1ZkyDc8jSnb39dT/wX7ixSsHc//cwhTfz8=",
     "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
     "owner": "cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v5.20.0",
+    "rev": "v5.21.1",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-LGibxg94dOiMfNynQfBoxQ6zR8A7xDfGNTujmEJcu14="
+    "vendorHash": "sha256-YLgIcohvOYBVt/GOkiqxdJVThhcphG2l8Lha1MwU9L4="
   },
   "cloudfoundry-community_cloudfoundry": {
     "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",

From dd82718270994cdb9b57401cb2a07022a7723308 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:35:27 +0200
Subject: [PATCH 49/70] python3Packages.pybase62: 0.5.0 -> 1.0.0

Changelog: https://github.com/suminb/base62/releases/tag/vv1.0.0
---
 pkgs/development/python-modules/pybase62/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pybase62/default.nix b/pkgs/development/python-modules/pybase62/default.nix
index eb0128481761..3b9cc45ed37b 100644
--- a/pkgs/development/python-modules/pybase62/default.nix
+++ b/pkgs/development/python-modules/pybase62/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pybase62";
-  version = "0.5.0";
+  version = "1.0.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "suminb";
     repo = "base62";
-    tag = finalAttrs.version;
+    tag = "v${finalAttrs.version}";
     hash = "sha256-/H16MT3mKCdXItoeOn1LWTHlgWmtwJdQHUaCp18eMz0=";
   };
 
@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Module for base62 encoding";
     homepage = "https://github.com/suminb/base62";
-    changelog = "https://github.com/suminb/base62/releases/tag/${finalAttrs.src.tag}";
+    changelog = "https://github.com/suminb/base62/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.bsd2WithViews;
     maintainers = with lib.maintainers; [ fab ];
   };

From 4f9bbfc5a8f392c4231ec5d5522b0c1a74d6a35d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:38:20 +0200
Subject: [PATCH 50/70] python3Packages.google-cloud-webrisk: 1.21.0 -> 1.22.0

Changelog: https://github.com/googleapis/google-cloud-python/blob/google-cloud-webrisk-v1.22.0/packages/google-cloud-webrisk/CHANGELOG.md
---
 .../python-modules/google-cloud-webrisk/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-webrisk/default.nix b/pkgs/development/python-modules/google-cloud-webrisk/default.nix
index e99b9f90c206..b1bd9f39a93e 100644
--- a/pkgs/development/python-modules/google-cloud-webrisk/default.nix
+++ b/pkgs/development/python-modules/google-cloud-webrisk/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-webrisk";
-  version = "1.21.0";
+  version = "1.22.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_webrisk";
     inherit (finalAttrs) version;
-    hash = "sha256-/PcV2opz3zaGerJk6rCOQNwZbxV2FqY/3BLMNQzO8Pc=";
+    hash = "sha256-OjJcQDXpbtq4RB8Cev6UgCqvDByOXmoJ306oFlQtryQ=";
   };
 
   build-system = [ setuptools ];

From 54a72d01670a85d287d8442538de2deac4169966 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:39:08 +0200
Subject: [PATCH 51/70] python3Packages.google-cloud-workflows: 1.22.0 ->
 1.23.0

Changelog: https://github.com/googleapis/google-cloud-python/blob/google-cloud-workflows-v1.23.0/packages/google-cloud-workflows/CHANGELOG.md
---
 .../python-modules/google-cloud-workflows/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-workflows/default.nix b/pkgs/development/python-modules/google-cloud-workflows/default.nix
index 8c8ac097930f..5c147f3c176b 100644
--- a/pkgs/development/python-modules/google-cloud-workflows/default.nix
+++ b/pkgs/development/python-modules/google-cloud-workflows/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-workflows";
-  version = "1.22.0";
+  version = "1.23.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_workflows";
     inherit (finalAttrs) version;
-    hash = "sha256-9+uHMI2CPzwNWcn9Kci7ze+Oi5E4MhgHTIMf2Sfr4y0=";
+    hash = "sha256-vo4IpdE0GG2834Z8BbFZrYrH3jtkJbIb76q39PJY1Kg=";
   };
 
   build-system = [ setuptools ];

From e86ee0c868e515e3acadb806ed17aec6a526a89f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 27 Jun 2026 11:39:19 +0300
Subject: [PATCH 52/70] qui: 1.20.0 -> 1.21.0

---
 pkgs/by-name/qu/qui/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/qu/qui/package.nix b/pkgs/by-name/qu/qui/package.nix
index 4d24190dc46a..f5a749d4ff0c 100644
--- a/pkgs/by-name/qu/qui/package.nix
+++ b/pkgs/by-name/qu/qui/package.nix
@@ -14,12 +14,12 @@
 }:
 buildGo126Module (finalAttrs: {
   pname = "qui";
-  version = "1.20.0";
+  version = "1.21.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "qui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-h1OIz+4oVuHg7bKWSKgkEwouX1oJKJmOC1VI+nrPwmI=";
+    hash = "sha256-3LExp17AGxZjAXXF0GoiTW7I1wluZf3uoZnXNF6WNYg=";
   };
 
   qui-web = stdenvNoCC.mkDerivation (finalAttrs': {
@@ -44,7 +44,7 @@ buildGo126Module (finalAttrs: {
         ;
       pnpm = pnpm_11;
       fetcherVersion = 4;
-      hash = "sha256-nSlW06//r/olVgSBgHc8LGWWfNXewAF5cZXfoZemC+w=";
+      hash = "sha256-53bj1QlfihIyKsQK5o3FsA9qWZJrNPWEJ441UK9nWR0=";
     };
 
     postBuild = ''
@@ -56,7 +56,7 @@ buildGo126Module (finalAttrs: {
     '';
   });
 
-  vendorHash = "sha256-4HQOoBDjV3Pt4O/KMu8c3aeUB5evceIdlAnsixO1Pjs=";
+  vendorHash = "sha256-n+CCRQk46j/ljAfFap3mgwxs4JF9Qr/TLqZILghgbU4=";
 
   preBuild = ''
     cp -r ${finalAttrs.qui-web}/* web/dist

From 68e4176ee6d959a076ac8af8e2c2d75b3acc8880 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:40:47 +0200
Subject: [PATCH 53/70] python3Packages.google-cloud-vpc-access: 1.16.0 ->
 1.17.0

Changelog: https://github.com/googleapis/google-cloud-python/blob/google-cloud-vpc-access-v1.17.0/packages/google-cloud-vpc-access/CHANGELOG.md
---
 .../python-modules/google-cloud-vpc-access/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-vpc-access/default.nix b/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
index 7eadd4c1912e..3a9b138595d6 100644
--- a/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
+++ b/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-vpc-access";
-  version = "1.16.0";
+  version = "1.17.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_vpc_access";
     inherit (finalAttrs) version;
-    hash = "sha256-cVJ8Ok3K1dKGuTsBhDJUqhYEimNTEqOjfVSTqxke0NQ=";
+    hash = "sha256-c5HvaQIykWRNAuDSBhv72kHZs8qgMY8cyvn5N7mahY4=";
   };
 
   build-system = [ setuptools ];

From acf28333f7c4155aacbf9df7c88cdc4b32b8691d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:41:39 +0200
Subject: [PATCH 54/70] python3Packages.govee-ble: 1.2.0 -> 1.4.0

Diff: https://github.com/Bluetooth-Devices/govee-ble/compare/v1.2.0...v1.4.0

Changelog: https://github.com/bluetooth-devices/govee-ble/blob/v1.4.0/CHANGELOG.md
---
 pkgs/development/python-modules/govee-ble/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/govee-ble/default.nix b/pkgs/development/python-modules/govee-ble/default.nix
index 5831629f8e20..0277781145fd 100644
--- a/pkgs/development/python-modules/govee-ble/default.nix
+++ b/pkgs/development/python-modules/govee-ble/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "govee-ble";
-  version = "1.2.0";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = "govee-ble";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+qzSNwV+2h75LVly7kZaaulKQp5Hp0N8k05BauN1TXo=";
+    hash = "sha256-Y1iSU6G/+0qSLgFQNKeCuhpVv6mJYXivk0wNGNMBd6U=";
   };
 
   build-system = [ poetry-core ];

From f58d28f73fcf63fc23c9e1b52b6f301f6809ec63 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:45:30 +0200
Subject: [PATCH 55/70] python3Packages.microsoft-kiota-abstractions: 1.10.3 ->
 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-abstractions-v1.11.6...microsoft-kiota-abstractions-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-abstractions-v1.11.6
---
 .../microsoft-kiota-abstractions/default.nix           | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
index 88930abfb5e8..c2f1d0baa7f1 100644
--- a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
@@ -2,31 +2,31 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
+  gitUpdater,
   opentelemetry-api,
   opentelemetry-sdk,
   pytest-asyncio,
   pytest-mock,
   pytestCheckHook,
   std-uritemplate,
-  gitUpdater,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-abstractions";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-abstractions-v${finalAttrs.version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/abstractions/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [
     opentelemetry-api

From 3cedbfd22c44d9c100e4fe8a33a490886d81e1c9 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:49:26 +0200
Subject: [PATCH 56/70] python3Packages.microsoft-kiota-authentication-azure:
 1.10.3 -> 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-authentication-azure-v1.10.3...microsoft-kiota-authentication-azure-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-authentication-azure-microsoft-kiota-authentication-azure-v1.11.6
---
 .../microsoft-kiota-authentication-azure/default.nix      | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix b/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
index 6205839229ba..0fa9c9743652 100644
--- a/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
@@ -4,7 +4,7 @@
   azure-core,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
   microsoft-kiota-abstractions,
   opentelemetry-api,
   opentelemetry-sdk,
@@ -16,19 +16,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-authentication-azure";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-authentication-azure-v${finalAttrs.version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/authentication/azure/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [
     aiohttp

From 5eac6bee3fcb35cd942684557771b8091a391bb8 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:50:33 +0200
Subject: [PATCH 57/70] python3Packages.microsoft-kiota-http: 1.10.3 -> 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-http-v1.10.3...microsoft-kiota-http-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-http-v1.11.6
---
 .../python-modules/microsoft-kiota-http/default.nix       | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-http/default.nix b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
index 245d7935a741..128abade58b3 100644
--- a/pkgs/development/python-modules/microsoft-kiota-http/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
   httpx,
   microsoft-kiota-abstractions,
   opentelemetry-api,
@@ -16,19 +16,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-http";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-http-v${finalAttrs.version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/http/httpx/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [
     httpx

From 9a289861be27be2c9bd206a0441475c67a673266 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:52:57 +0200
Subject: [PATCH 58/70] python3Packages.microsoft-kiota-serialization-json:
 1.10.3 -> 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-serialization-json-v1.10.3...microsoft-kiota-serialization-json-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-serialization-json-microsoft-kiota-serialization-json-v1.11.6
---
 .../microsoft-kiota-serialization-json/default.nix        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
index d0b08a6286d5..ca39e6a8824f 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
   microsoft-kiota-abstractions,
   pendulum,
   pytest-asyncio,
@@ -13,19 +13,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-serialization-json";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-json-v${finalAttrs.version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/serialization/json/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [
     microsoft-kiota-abstractions

From 764bdaec8dd1978bb68f16819ae236c4596798f1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:53:12 +0200
Subject: [PATCH 59/70] 
 python3Packages.microsoft-kiota-serialization-multipart: 1.10.3 -> 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-serialization-multipart-v1.10.3...microsoft-kiota-serialization-multipart-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-serialization-multipart-microsoft-kiota-serialization-multipart-v1.11.6
---
 .../microsoft-kiota-serialization-multipart/default.nix   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
index 5cd49138df9e..1b081aa9a210 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
   microsoft-kiota-abstractions,
   microsoft-kiota-serialization-json,
   pytest-asyncio,
@@ -13,19 +13,19 @@
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-multipart";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-multipart-v${version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${src.name}/packages/serialization/multipart/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [ microsoft-kiota-abstractions ];
 

From bdd24ff79f66ef8c8a695799982779fdccb36c7d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:53:29 +0200
Subject: [PATCH 60/70] python3Packages.microsoft-kiota-serialization-text:
 1.10.3 -> 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-serialization-text-v1.10.3...microsoft-kiota-serialization-text-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-serialization-text-microsoft-kiota-serialization-text-v1.11.6
---
 .../microsoft-kiota-serialization-text/default.nix        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
index 800a324d4bc8..bae91e5e83ec 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
   microsoft-kiota-abstractions,
   pytest-asyncio,
   pytest-mock,
@@ -13,19 +13,19 @@
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-text";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-text-v${version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${src.name}/packages/serialization/text/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [
     microsoft-kiota-abstractions

From bf4f3d5c857c1826ab4869da5312d50ce38ca14f Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sat, 27 Jun 2026 07:58:27 +0200
Subject: [PATCH 61/70] reticulum-group-chat: init at 1.11.0

---
 .../re/reticulum-group-chat/package.nix       | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 pkgs/by-name/re/reticulum-group-chat/package.nix

diff --git a/pkgs/by-name/re/reticulum-group-chat/package.nix b/pkgs/by-name/re/reticulum-group-chat/package.nix
new file mode 100644
index 000000000000..862703889ab1
--- /dev/null
+++ b/pkgs/by-name/re/reticulum-group-chat/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "reticulum-group-chat";
+  version = "1.11.0";
+  __structuredAttrs = true;
+  __darwinAllowLocalNetworking = true;
+
+  src = fetchFromGitHub {
+    owner = "thatSFguy";
+    repo = "reticulum-group-chat";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LWHYIKnkEPrlDIEruP2ctuMQGnrL1uofOWAsZ4E5guw=";
+  };
+
+  vendorHash = "sha256-qMmEi7OYv2xzYOoeBWQ0omeIrcTyhxylw2qvv9kd9dk=";
+
+  ldflags = [ "-s" ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Pure-Go LXMF group-chat hub for the Reticulum network — a single static binary that relays many-to-many encrypted text chat over LoRa, TCP/IP, and mixed meshes. No Python, no third-party RNS library";
+    homepage = "https://github.com/thatSFguy/reticulum-group-chat";
+    changelog = "https://github.com/thatSFguy/reticulum-group-chat/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "fwdsvc";
+  };
+})

From c85eb5f9faaec8dfba051b1facb8e77bb472b737 Mon Sep 17 00:00:00 2001
From: Katsumi Takeuchi <contact@hibi.day>
Date: Sat, 27 Jun 2026 18:14:09 +0900
Subject: [PATCH 62/70] blesh: 0.4.0-devel3-unstable-2026-06-21 ->
 0.4.0-devel3-unstable-2026-06-27

---
 pkgs/by-name/bl/blesh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bl/blesh/package.nix b/pkgs/by-name/bl/blesh/package.nix
index c9e3b727dbf4..38f0304d1509 100644
--- a/pkgs/by-name/bl/blesh/package.nix
+++ b/pkgs/by-name/bl/blesh/package.nix
@@ -10,14 +10,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "blesh";
-  version = "0.4.0-devel3-unstable-2026-06-21";
+  version = "0.4.0-devel3-unstable-2026-06-27";
 
   src = fetchFromGitHub {
     owner = "akinomyoga";
     repo = "ble.sh";
-    rev = "6cffa910eccce252fa391875c7c03c94fb6f1b09";
+    rev = "5d39ebe6db67a46de4195f8ce8186e34cd2618d1";
     fetchSubmodules = true;
-    hash = "sha256-CUIHfK1m00p6rBBNp/XqXifeRcG7BKpkdF7kl4+2tZY=";
+    hash = "sha256-12aSZl0qx0CwaIq/U77pCFz9Ij2CrzhojQuBngc7oag=";
   };
 
   nativeBuildInputs = [

From a530361ef2b70186ea6dec789790ac57de1f58f4 Mon Sep 17 00:00:00 2001
From: Katsumi Takeuchi <contact@hibi.day>
Date: Sat, 27 Jun 2026 18:19:08 +0900
Subject: [PATCH 63/70] blesh: patch build helper shebangs

Assisted-by: Codex CLI with gpt-5.5 default (OpenAI)
---
 pkgs/by-name/bl/blesh/package.nix                     |  8 ++++----
 pkgs/by-name/bl/blesh/skip-readonly-runtime-dir.patch | 10 ----------
 2 files changed, 4 insertions(+), 14 deletions(-)
 delete mode 100644 pkgs/by-name/bl/blesh/skip-readonly-runtime-dir.patch

diff --git a/pkgs/by-name/bl/blesh/package.nix b/pkgs/by-name/bl/blesh/package.nix
index 38f0304d1509..74fba950d70b 100644
--- a/pkgs/by-name/bl/blesh/package.nix
+++ b/pkgs/by-name/bl/blesh/package.nix
@@ -28,10 +28,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # Fix the cache invalidation not working; see
     # https://github.com/NixOS/nixpkgs/pull/521218#issuecomment-4641313131
     ./fix-cache-invalidation.patch
-    # ble.sh reaches a runtime-dir fallback under the install base when the
-    # others are unusable (always on WSL); see
-    # https://github.com/NixOS/nixpkgs/pull/521218#issuecomment-4686973408
-    ./skip-readonly-runtime-dir.patch
   ];
 
   # ble.sh embeds the commit id, normally read from .git, which fetchFromGitHub omits.
@@ -41,6 +37,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     "BLE_GIT_BRANCH=master"
   ];
 
+  postPatch = ''
+    patchShebangs --build make_command.sh make
+  '';
+
   doCheck = true;
   # auto-detection runs `make -n check` without makeFlags, which fails without BLE_GIT_COMMIT_ID
   checkTarget = "check";
diff --git a/pkgs/by-name/bl/blesh/skip-readonly-runtime-dir.patch b/pkgs/by-name/bl/blesh/skip-readonly-runtime-dir.patch
deleted file mode 100644
index e03f56fc2646..000000000000
--- a/pkgs/by-name/bl/blesh/skip-readonly-runtime-dir.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/ble.pp
-+++ b/ble.pp
-@@ -1934,6 +1934,7 @@
- function ble/base/initialize-runtime-directory/.base {
-   local tmp_dir=$_ble_base/run
-   if [[ ! -d $tmp_dir ]]; then
-+    [[ -w $_ble_base ]] || return 1
-     ble/bin/mkdir -p "$tmp_dir" || return 1
-     ble/bin/chmod a+rwxt "$tmp_dir" || return 1
-   fi

From 651f3b12fd44a5c920a5d91bb8bff12c79fe7598 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sat, 27 Jun 2026 11:44:48 +0200
Subject: [PATCH 64/70] mongodb-ce: unbreak on darwin

Co-Authored-By: FlameFlag <git@ps1.sh>
---
 pkgs/by-name/mo/mongodb-ce/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index 66b2d4306eaa..2a73f1a2a0df 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -49,6 +49,11 @@ stdenv.mkDerivation (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/bin/mongod";
 
+  # Apple's LibreSSL tries to read this while running `mongod --version`
+  sandboxProfile = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    (allow file-read* (literal "/private/etc/ssl/openssl.cnf"))
+  '';
+
   passthru = {
     sources = {
       "x86_64-linux" = fetchurl {

From d1c6c4f6eab656f47b4db44d06ae73e49f1a108a Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sat, 27 Jun 2026 11:45:10 +0200
Subject: [PATCH 65/70] mongodb-ce: add `__structuredAttrs`, `strictDeps`

---
 pkgs/by-name/mo/mongodb-ce/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index 2a73f1a2a0df..5a7fe772b5e5 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -18,6 +18,8 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "mongodb-ce";
   version = "8.2.11";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src =
     finalAttrs.passthru.sources.${stdenv.hostPlatform.system}

From 78581b87cd0b96d2cd1a36aa5d20aad57b9a1d4e Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 27 Jun 2026 11:45:19 +0200
Subject: [PATCH 66/70] perlPackages.BytesRandomSecureTiny: add patch for
 CVE-2026-11702

---
 pkgs/top-level/perl-packages.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3cf8a274f583..484d4c88d6c8 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -2907,6 +2907,17 @@ with self;
       url = "mirror://cpan/authors/id/D/DA/DAVIDO/Bytes-Random-Secure-Tiny-1.011.tar.gz";
       hash = "sha256-A9lntfgoRpCRN9WrmYSsVwrBCkQB4MYC89IgjEZayYI=";
     };
+    patches = [
+      (fetchpatch {
+        name = "CVE-2026-11702.patch";
+        url = "https://security.metacpan.org/patches/B/Bytes-Random-Secure-Tiny/1.011/CVE-2026-11702-r1.patch";
+        hash = "sha256-81wvVdtQsF5YeRhjAeaOFa7aE1cgdCni+G28LA7ZLqM=";
+      })
+    ];
+    preCheck = ''
+      # Remove test that CVE patch breaks: "Attempt to access disallowed key '_rng' in a restricted hash"
+      rm t/35-mrie-cover.t
+    '';
     meta = {
       description = "Tiny Perl extension to generate cryptographically-secure random bytes";
       license = with lib.licenses; [

From f74dae849727a177dafb8686c1d573b945ff69ff Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 27 Jun 2026 11:59:49 +0200
Subject: [PATCH 67/70] perlPackages.BytesRandomSecure: add patch for
 CVE-2026-11625

---
 pkgs/top-level/perl-packages.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3cf8a274f583..0d4219bcf385 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -2886,6 +2886,13 @@ with self;
       url = "mirror://cpan/authors/id/D/DA/DAVIDO/Bytes-Random-Secure-0.29.tar.gz";
       hash = "sha256-U7vTOeahHvygfGGaYVx8GIpouyvoSaHLfvw91Nmuha4=";
     };
+    patches = [
+      (fetchpatch {
+        name = "CVE-2026-11625.patch";
+        url = "https://security.metacpan.org/patches/B/Bytes-Random-Secure/0.29/CVE-2026-11625-r1.patch";
+        hash = "sha256-EDPFvFjqGtN5/TiJlarqKMrtH6kEQD6rOA7B2moBkiA=";
+      })
+    ];
     propagatedBuildInputs = [
       CryptRandomSeed
       MathRandomISAAC

From 4dc1b0419428e13eb04856b65c4cda198d788d3a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 10:37:21 +0000
Subject: [PATCH 68/70] telemt: 3.4.18 -> 3.4.19

---
 pkgs/by-name/te/telemt/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/telemt/package.nix b/pkgs/by-name/te/telemt/package.nix
index b47d915d88a7..4f0a6495e014 100644
--- a/pkgs/by-name/te/telemt/package.nix
+++ b/pkgs/by-name/te/telemt/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "telemt";
-  version = "3.4.18";
+  version = "3.4.19";
 
   src = fetchFromGitHub {
     owner = "telemt";
     repo = "telemt";
     tag = version;
-    hash = "sha256-++EO+gkr6q+y8e0uwYyD04cFGyhwS2DW4JON4LOx0s0=";
+    hash = "sha256-3Vpz61/mEQ43zOEUtUBQw16D/LBvWymreJp4q1uDydM=";
   };
 
-  cargoHash = "sha256-n25cjncocDv5gNftqv4TO0HRCoZEakiGzfLZqvT1ya4=";
+  cargoHash = "sha256-uQVL4k+/6L2vUTWbpTC9RvWQHC84P5fuCSrBLtoDdz8=";
 
   checkFlags = [
     # flaky: races between MiddleClientWriterCancelled and TrafficBudgetWaitCancelled observation paths

From 8d8350a77bfeef2d6915648c438ffd96a7bc6aa5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 10:46:10 +0000
Subject: [PATCH 69/70] protoc-gen-grpc-java: 1.81.0 -> 1.82.1

---
 pkgs/by-name/pr/protoc-gen-grpc-java/data.nix | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
index 0274f88a3c0a..694bd75a468d 100644
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
@@ -1,14 +1,14 @@
 {
-  version = "1.81.0";
+  version = "1.82.1";
   hashes = {
-    linux-aarch_64 = "sha256-BhO92wlj0L3M8H4CGuB4NRZkjN9zPuFM/E2NAkn6d1o=";
-    linux-ppcle_64 = "sha256-Y1YC+C/AxdYiB7gcaerVhE383+8rPOiEI8+r/BxkeXk=";
-    linux-s390_64 = "sha256-cVjZl+ju8e+yroYOttrgIBGSBWDPw1jz1dOLdr58Bmc=";
-    linux-x86_32 = "sha256-I10buzyicR0aVI3BKDvtly6NwfjSP2hLOD1eY5NJFZc=";
-    linux-x86_64 = "sha256-T3WWxgoTdSS1TysR2Vb6IA8/6XZ43hzd2CfRCVQlD30=";
-    osx-aarch_64 = "sha256-c359UvEa+J85KV6KFOXMuUWCYmyB5VkTfmLfj8J81qQ=";
-    osx-x86_64 = "sha256-c359UvEa+J85KV6KFOXMuUWCYmyB5VkTfmLfj8J81qQ=";
-    windows-x86_32 = "sha256-mMRY0dLrPpLcQUeK5GqeOrBFqlghBC7FgqqoRWHdjYs=";
-    windows-x86_64 = "sha256-18mnbuYxoqnQLYHPWC2m2+TW5pJmX/O2OkQLG5xyND0=";
+    linux-aarch_64 = "sha256-VTDKjBMzFj5CocdqK1EEIOBsdTIckXMrNGOlRyByCc8=";
+    linux-ppcle_64 = "sha256-/NCzmrhbTDaYhJBntW6n6yA5tvtsvdVldMlK7WfV6RY=";
+    linux-s390_64 = "sha256-Bk83rw8iGsniyNcivgQRjx/GOWB0kv4Wo01b4YTG0Pk=";
+    linux-x86_32 = "sha256-Ai7h2w1ZGWlS/tAdiT/dpd6wt3VM4rpPiQuv5rDbfCY=";
+    linux-x86_64 = "sha256-OnXRqIuP5E9KHVy48ixz+PzI1WOu2QV/9epISyLNry8=";
+    osx-aarch_64 = "sha256-hm3WySlSQu/J5rg8pWlpOStcPnODqn1b7pKL1N5CkSQ=";
+    osx-x86_64 = "sha256-hm3WySlSQu/J5rg8pWlpOStcPnODqn1b7pKL1N5CkSQ=";
+    windows-x86_32 = "sha256-CWZAubE98Aftf7Mjd2caROxsWSxS+JQGf4YB+FEwiwo=";
+    windows-x86_64 = "sha256-XmhjMhJ/djRizOkSh+i7PtZn2RL9jVV5PcBkgwpYw0o=";
   };
 }

From 1501c08af3cc131e2eb77439584b73f3a4ba7b1d Mon Sep 17 00:00:00 2001
From: Leonard-Orlando Menzel <79226837+lomenzel@users.noreply.github.com>
Date: Sat, 27 Jun 2026 10:48:25 +0000
Subject: [PATCH 70/70] nixos/kubo: fix typo in fuseAllowOther setting

---
 nixos/modules/services/network-filesystems/kubo.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/network-filesystems/kubo.nix b/nixos/modules/services/network-filesystems/kubo.nix
index 4e676b80a1aa..9c08028a0842 100644
--- a/nixos/modules/services/network-filesystems/kubo.nix
+++ b/nixos/modules/services/network-filesystems/kubo.nix
@@ -334,7 +334,7 @@ in
 
     programs.fuse = {
       enable = lib.mkIf cfg.autoMount true;
-      userAllowOther = lib.mkIf cfg.settings.Mounts.fuseAllowOther true;
+      userAllowOther = lib.mkIf cfg.settings.Mounts.FuseAllowOther true;
     };
 
     users.users = lib.mkIf (cfg.user == "ipfs") {