From d67d2c224b56cc16c919abd552390bf782c19a8b Mon Sep 17 00:00:00 2001
From: Guy Chronister <guychronister@outlook.com>
Date: Tue, 12 May 2026 13:22:43 +0000
Subject: [PATCH 001/100] scss-lint: update ffi dependency

---
 pkgs/by-name/sc/scss-lint/Gemfile.lock | 4 ++--
 pkgs/by-name/sc/scss-lint/gemset.nix   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/sc/scss-lint/Gemfile.lock b/pkgs/by-name/sc/scss-lint/Gemfile.lock
index 8f6ebd379216..7b9e58ae45e4 100644
--- a/pkgs/by-name/sc/scss-lint/Gemfile.lock
+++ b/pkgs/by-name/sc/scss-lint/Gemfile.lock
@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    ffi (1.17.2)
+    ffi (1.17.4)
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
@@ -20,4 +20,4 @@ DEPENDENCIES
   scss_lint
 
 BUNDLED WITH
-   2.7.1
+   2.7.2
diff --git a/pkgs/by-name/sc/scss-lint/gemset.nix b/pkgs/by-name/sc/scss-lint/gemset.nix
index 7300ead8b4b2..4a8ff7693705 100644
--- a/pkgs/by-name/sc/scss-lint/gemset.nix
+++ b/pkgs/by-name/sc/scss-lint/gemset.nix
@@ -4,10 +4,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19kdyjg3kv7x0ad4xsd4swy5izsbb1vl1rpb6qqcqisr5s23awi9";
+      sha256 = "1kqasqvy8d7r09ri4n6bkdwbk63j7afd9ilsw34nzlgh0qp69ldw";
       type = "gem";
     };
-    version = "1.17.2";
+    version = "1.17.4";
   };
   rb-fsevent = {
     groups = [ "default" ];

From ba6eca1dfc3c91716d357674f975e24ac225b3de Mon Sep 17 00:00:00 2001
From: Magi3r <jvd@outlook.de>
Date: Thu, 28 May 2026 00:59:59 +0200
Subject: [PATCH 002/100] webwormhole: 0-unstable-2023-11-15 ->
 0-unstable-2025-12-22

---
 pkgs/by-name/we/webwormhole/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/we/webwormhole/package.nix b/pkgs/by-name/we/webwormhole/package.nix
index 45b53957b34f..45e0fe8f204b 100644
--- a/pkgs/by-name/we/webwormhole/package.nix
+++ b/pkgs/by-name/we/webwormhole/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule {
   pname = "webwormhole";
-  version = "0-unstable-2023-11-15";
+  version = "0-unstable-2025-12-22";
 
   src = fetchFromGitHub {
     owner = "saljam";
     repo = "webwormhole";
-    rev = "6ceee76274ee881e828bd48c5cc15c758b9ad77c";
-    hash = "sha256-C9r6wFhP5BkIClgTQol7LyMUHXOzyrX9Pn91VqBaqFQ=";
+    rev = "abf852af0458ba79772d9c26ef01434165f217d8";
+    hash = "sha256-hP5MtIoGod3FS4TipNkgoyo43HWnywPintqpjmvrTc8=";
   };
 
-  vendorHash = "sha256-+7ctAm2wnjmfMd6CHXlcAUwiUMS7cH4koDAvlEUAXEg=";
+  vendorHash = "sha256-ULlaicl4o/YyHSS64Q2hsl5l5Mm3C6cBG8zaxrEijOU=";
 
   meta = {
     description = "Send files using peer authenticated WebRTC";

From 4b207b2ad9d4d7c7ea8cddd47be520a42cefce7c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 29 May 2026 09:59:02 +0200
Subject: [PATCH 003/100] python3Packages.pytenable: 1.9.1 -> 26.5.1

Changelog: https://github.com/tenable/pyTenable/releases/tag/26.5.1
---
 .../python-modules/pytenable/default.nix      | 61 +++++--------------
 1 file changed, 15 insertions(+), 46 deletions(-)

diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix
index 8b2f87c33dc4..4bf9d75941ab 100644
--- a/pkgs/development/python-modules/pytenable/default.nix
+++ b/pkgs/development/python-modules/pytenable/default.nix
@@ -1,74 +1,42 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
-
-  # build-system
-  setuptools,
-
-  # dependencies
   cryptography,
   defusedxml,
+  fetchFromGitHub,
   gql,
   graphql-core,
-  pydantic,
+  marshmallow,
   pydantic-extra-types,
-  python-box,
-  python-dateutil,
-  requests,
-  requests-toolbelt,
-  restfly,
-  semver,
-  typing-extensions,
-
-  # marshmallow build system
-  flit-core,
-
-  # tests
+  pydantic,
   pytest-cov-stub,
   pytest-datafiles,
   pytest-vcr,
   pytestCheckHook,
+  python-box,
+  python-dateutil,
   requests-pkcs12,
+  requests-toolbelt,
+  requests,
   responses,
+  restfly,
+  semver,
+  setuptools,
+  typing-extensions,
 }:
-let
-  marshmallow' = buildPythonPackage {
-    pname = "marshmallow";
-    version = "3.26.2";
-    pyproject = true;
 
-    src = fetchFromGitHub {
-      owner = "marshmallow-code";
-      repo = "marshmallow";
-      tag = "3.26.2";
-      hash = "sha256-ioe+aZHOW8r3wF3UknbTjAP0dEggd/NL9PTkPVQ46zM=";
-    };
-
-    build-system = [ flit-core ];
-
-    doCheck = false;
-
-    pythonImportsCheck = [ "marshmallow" ];
-  };
-in
 buildPythonPackage (finalAttrs: {
   pname = "pytenable";
-  version = "1.9.1";
+  version = "26.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tenable";
     repo = "pyTenable";
     tag = finalAttrs.version;
-    hash = "sha256-WAKZe1m6EaNE+y2B/1/k8qZsEftLfAVPVEvIkh2N/4g=";
+    hash = "sha256-o11Lq11btpIwzgZlPMcChHexNOZSFEFOsnaIv1n66uY=";
   };
 
-  pythonRelaxDeps = [
-    "cryptography"
-    "defusedxml"
-  ];
-
   build-system = [ setuptools ];
 
   dependencies = [
@@ -76,7 +44,7 @@ buildPythonPackage (finalAttrs: {
     defusedxml
     gql
     graphql-core
-    marshmallow'
+    marshmallow
     pydantic
     pydantic-extra-types
     python-box
@@ -115,6 +83,7 @@ buildPythonPackage (finalAttrs: {
     # Test requires network access
     "test_assets_list_vcr"
     "test_events_list_vcr"
+    "test_session_ssl_error"
     # https://github.com/tenable/pyTenable/issues/953
     "test_construct_query_str"
     "test_construct_query_stored_file"

From c39e2c50351fd73b1f4119496f66cd4fe5d1ea8c Mon Sep 17 00:00:00 2001
From: zspher <66728045+zspher@users.noreply.github.com>
Date: Wed, 17 Jun 2026 20:20:51 -0600
Subject: [PATCH 004/100] vscode-extensions.vadimcn.vscode-lldb: 1.12.1 ->
 1.12.2

---
 .../editors/vscode/extensions/vadimcn.vscode-lldb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
index b17bc1d76708..b7d085d332b8 100644
--- a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
@@ -16,7 +16,7 @@ assert lib.versionAtLeast python3.version "3.5";
 let
   publisher = "vadimcn";
   pname = "vscode-lldb";
-  version = "1.12.1";
+  version = "1.12.2";
 
   vscodeExtUniqueId = "${publisher}.${pname}";
   vscodeExtPublisher = publisher;
@@ -26,7 +26,7 @@ let
     owner = "vadimcn";
     repo = "codelldb";
     rev = "v${version}";
-    hash = "sha256-B8iCy4NXG7IzJVncbYm5VoAMfhMfxGF+HW7M5sVn5b0=";
+    hash = "sha256-7//+y02rfDloeNADpoM8tist7fPstBZ2Eqt4dM5dCaE=";
   };
 
   lldb = llvmPackages_19.lldb;

From 73ac6f0131b7408dc98c0dd701c8ed0998253029 Mon Sep 17 00:00:00 2001
From: zspher <66728045+zspher@users.noreply.github.com>
Date: Thu, 18 Jun 2026 12:43:26 -0600
Subject: [PATCH 005/100] vscode-extensions.vadimcn.vscode-lldb: remove
 r4v3n6101 from maintainers

---
 .../editors/vscode/extensions/vadimcn.vscode-lldb/default.nix   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
index b7d085d332b8..51f89e1e87c3 100644
--- a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
@@ -181,7 +181,7 @@ stdenv.mkDerivation {
     description = "Native debugger extension for VSCode based on LLDB";
     homepage = "https://github.com/vadimcn/vscode-lldb";
     license = [ lib.licenses.mit ];
-    maintainers = [ lib.maintainers.r4v3n6101 ];
+    maintainers = [ ];
     platforms = lib.platforms.all;
   };
 }

From 6bfbf7b56fd032bf1b13830f052cfdce0a173f43 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 20 Jun 2026 21:32:37 +0000
Subject: [PATCH 006/100] angie: 1.11.5 -> 1.11.8

---
 pkgs/servers/http/angie/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/http/angie/default.nix b/pkgs/servers/http/angie/default.nix
index ee4dd5c50979..fc468d763bdf 100644
--- a/pkgs/servers/http/angie/default.nix
+++ b/pkgs/servers/http/angie/default.nix
@@ -9,11 +9,11 @@
 
 callPackage ../nginx/generic.nix args rec {
   pname = "angie";
-  version = "1.11.5";
+  version = "1.11.8";
 
   src = fetchurl {
     url = "https://download.angie.software/files/angie-${version}.tar.gz";
-    hash = "sha256-tfKXxt8qdLnQCRp83XR//9LQ4dC+Q2MtphwcdTnbIEM=";
+    hash = "sha256-hJiXx495w7BNA1d440mTqSGI5r0sDDuozjrV6xUF69M=";
   };
 
   configureFlags = lib.optionals withAcme [

From 3d3d66646cb2b9f55f8da443f8e4942535766dc8 Mon Sep 17 00:00:00 2001
From: Grayson Tinker <graysontinker@gmail.com>
Date: Sun, 21 Jun 2026 21:15:56 -0700
Subject: [PATCH 007/100] rdup: 1.1.15 -> 1.1.16-unstable-2024-03-05

---
 pkgs/by-name/rd/rdup/package.nix | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/rd/rdup/package.nix b/pkgs/by-name/rd/rdup/package.nix
index 1649ad98882a..078aac483789 100644
--- a/pkgs/by-name/rd/rdup/package.nix
+++ b/pkgs/by-name/rd/rdup/package.nix
@@ -5,29 +5,38 @@
   pkg-config,
   autoreconfHook,
   glib,
-  pcre,
+  pcre2,
+  coreutils,
 }:
 
 stdenv.mkDerivation {
   pname = "rdup";
-  version = "1.1.15";
+  version = "1.1.16-unstable-2024-03-05";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+  enableParallelBuilding = true;
 
   src = fetchFromGitHub {
     owner = "miekg";
     repo = "rdup";
-    rev = "d66e4320cd0bbcc83253baddafe87f9e0e83caa6";
-    sha256 = "0bzyv6qmnivxnv9nw7lnfn46k0m1dlxcjj53zcva6v8y8084l1iw";
+    rev = "fa1c753a107c12b3797204c41779ce2c8d5da45a";
+    hash = "sha256-k+386SrXE0IULP02/aOa5E/F/HWhnD/ttGzFStric5M=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
+    glib
   ];
+
   buildInputs = [
     glib
-    pcre
+    pcre2
   ];
 
+  installFlags = [ "INSTALL=${coreutils}/bin/install" ];
+
   meta = {
     description = "Only backup program that doesn't make backups";
     homepage = "https://github.com/miekg/rdup";

From d7fbbb0ba22f1ca4ac4fdea8d880c4ca6e336054 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 08:56:54 +0000
Subject: [PATCH 008/100] vault: 1.21.4 -> 2.0.3

---
 pkgs/by-name/va/vault/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/va/vault/package.nix b/pkgs/by-name/va/vault/package.nix
index 034215dbe73b..ec92e58ba9d9 100644
--- a/pkgs/by-name/va/vault/package.nix
+++ b/pkgs/by-name/va/vault/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vault";
-  version = "1.21.4";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1yBvcGKzLZYFWlZJL1iJgDFkiT4g2f84iZCjWi2CwDg=";
+    hash = "sha256-s6Muogxe+jvre1qZYRiSGTDgMf0+BVsSOwyxF6+Aa2o=";
   };
 
-  vendorHash = "sha256-LxWqJroDfGqqCrTej+jkpxEO/+ipXuqSPB2R3bg2v10=";
+  vendorHash = "sha256-utF/CgWNtJNin5NIq7ZGjNc7YbjAuN5nm/G57uQal94=";
 
   proxyVendor = true;
 

From 29d2893ca38dd3efa838d1d4e1eb9336fa11ac4d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 15:04:55 +0000
Subject: [PATCH 009/100] stable-diffusion-cpp: master-703-bb90bfa ->
 master-719-f440ad9

---
 pkgs/by-name/st/stable-diffusion-cpp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/stable-diffusion-cpp/package.nix b/pkgs/by-name/st/stable-diffusion-cpp/package.nix
index db590a7f7fdf..3e72bad4ad3b 100644
--- a/pkgs/by-name/st/stable-diffusion-cpp/package.nix
+++ b/pkgs/by-name/st/stable-diffusion-cpp/package.nix
@@ -42,7 +42,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "stable-diffusion-cpp";
-  version = "master-703-bb90bfa";
+  version = "master-719-f440ad9";
 
   outputs = [
     "out"
@@ -52,8 +52,8 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "leejet";
     repo = "stable-diffusion.cpp";
-    rev = "master-703-bb90bfa";
-    hash = "sha256-5XRz7yO6N3Y7SN73smvuw/B1fhm2NrftKbL0W/lZrtE=";
+    rev = "master-719-f440ad9";
+    hash = "sha256-GkaEqBz5PR5hk1vMAVEAM32dYroHlZ0Qg/fISkhA8qs=";
     fetchSubmodules = true;
   };
 

From 70929cf74399fef46e903ae1bb61592bd1abbcef Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 15:09:39 +0000
Subject: [PATCH 010/100] stable-diffusion-cpp-vulkan: master-703-bb90bfa ->
 master-719-f440ad9

---
 pkgs/by-name/st/stable-diffusion-cpp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/stable-diffusion-cpp/package.nix b/pkgs/by-name/st/stable-diffusion-cpp/package.nix
index db590a7f7fdf..3e72bad4ad3b 100644
--- a/pkgs/by-name/st/stable-diffusion-cpp/package.nix
+++ b/pkgs/by-name/st/stable-diffusion-cpp/package.nix
@@ -42,7 +42,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "stable-diffusion-cpp";
-  version = "master-703-bb90bfa";
+  version = "master-719-f440ad9";
 
   outputs = [
     "out"
@@ -52,8 +52,8 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "leejet";
     repo = "stable-diffusion.cpp";
-    rev = "master-703-bb90bfa";
-    hash = "sha256-5XRz7yO6N3Y7SN73smvuw/B1fhm2NrftKbL0W/lZrtE=";
+    rev = "master-719-f440ad9";
+    hash = "sha256-GkaEqBz5PR5hk1vMAVEAM32dYroHlZ0Qg/fISkhA8qs=";
     fetchSubmodules = true;
   };
 

From 7c85452bdf5586f764f1f9a69a8f6f3ed6058586 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 15:45:32 +0000
Subject: [PATCH 011/100] stable-diffusion-cpp-cuda: master-703-bb90bfa ->
 master-719-f440ad9

---
 pkgs/by-name/st/stable-diffusion-cpp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/stable-diffusion-cpp/package.nix b/pkgs/by-name/st/stable-diffusion-cpp/package.nix
index db590a7f7fdf..3e72bad4ad3b 100644
--- a/pkgs/by-name/st/stable-diffusion-cpp/package.nix
+++ b/pkgs/by-name/st/stable-diffusion-cpp/package.nix
@@ -42,7 +42,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "stable-diffusion-cpp";
-  version = "master-703-bb90bfa";
+  version = "master-719-f440ad9";
 
   outputs = [
     "out"
@@ -52,8 +52,8 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "leejet";
     repo = "stable-diffusion.cpp";
-    rev = "master-703-bb90bfa";
-    hash = "sha256-5XRz7yO6N3Y7SN73smvuw/B1fhm2NrftKbL0W/lZrtE=";
+    rev = "master-719-f440ad9";
+    hash = "sha256-GkaEqBz5PR5hk1vMAVEAM32dYroHlZ0Qg/fISkhA8qs=";
     fetchSubmodules = true;
   };
 

From 8365be62c134d8d032a2a2baa23c1338443395b9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 29 Jun 2026 01:57:03 +0000
Subject: [PATCH 012/100] freelens-bin: 1.10.1 -> 1.10.2

---
 pkgs/by-name/fr/freelens-bin/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/fr/freelens-bin/package.nix b/pkgs/by-name/fr/freelens-bin/package.nix
index 19f61da6d001..adc3239312c1 100644
--- a/pkgs/by-name/fr/freelens-bin/package.nix
+++ b/pkgs/by-name/fr/freelens-bin/package.nix
@@ -16,24 +16,24 @@
 let
 
   pname = "freelens-bin";
-  version = "1.10.1";
+  version = "1.10.2";
 
   sources = {
     x86_64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-amd64.AppImage";
-      hash = "sha256-Hbu28vbgaSEjJTAVSfHJ3cZGd2PRU0ex7dNv0wo1SrI=";
+      hash = "sha256-l+6QnlDnNs2t4auJRS0MLy592OfQDd0tDNqiVH5xJ3g=";
     };
     aarch64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-arm64.AppImage";
-      hash = "sha256-JrApeOjMXNNi/wCq6vY6rYpPGgMWti0H+2i7QNEXaTc=";
+      hash = "sha256-Pw6RPa6T9jN7XAfOqj6lDFzTqhwOT1DgK35cANyBAOE=";
     };
     x86_64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-amd64.dmg";
-      hash = "sha256-BIBEaQFny/DvzrvsC38UPiIqBFaxUO/DOVQTIe2gL+Q=";
+      hash = "sha256-6qn/3Zly7nvj9XxihUdmkguLWw0a7Y321Xv7EnJzjkc=";
     };
     aarch64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-arm64.dmg";
-      hash = "sha256-5duswriuDmL92tXqLckBhH2RMPFDqFRG/WW9oYMClGY=";
+      hash = "sha256-ARIvUMkkdUK5O6xdplXJ/JkPdezO/16HvO2P21W6y8I=";
     };
   };
 

From c83f8ea010456291d6fea3dc6e422b4091838b12 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 29 Jun 2026 14:22:59 +0000
Subject: [PATCH 013/100] iroh-relay: 1.0.0 -> 1.0.1

---
 pkgs/tools/networking/iroh/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/networking/iroh/default.nix b/pkgs/tools/networking/iroh/default.nix
index d0dc19d8b749..90d79532ef82 100644
--- a/pkgs/tools/networking/iroh/default.nix
+++ b/pkgs/tools/networking/iroh/default.nix
@@ -12,16 +12,16 @@ let
     }:
     rustPlatform.buildRustPackage rec {
       pname = name;
-      version = "1.0.0";
+      version = "1.0.1";
 
       src = fetchFromGitHub {
         owner = "n0-computer";
         repo = "iroh";
         rev = "v${version}";
-        hash = "sha256-L5y2/u5Sxh0tnl1NJS5dcRVLHDExHMiF12p0gRY2fzM=";
+        hash = "sha256-Tk9QXg+5Pu+xmfmo1FZRlshG3VLr3jTycybjKvnP9DU=";
       };
 
-      cargoHash = "sha256-R6b1BfKlgFCcPSif0qMHCj/gZ6v2beawbF4P3knkROw=";
+      cargoHash = "sha256-iLN2PJkWNyFPSNkAD/kgtmPb5c2HmMrhN+rUNoAnIFY=";
 
       buildFeatures = cargoFeatures;
       cargoBuildFlags = [

From 21434813ad8e59944eca5af5aa9dc785f8a55f69 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 29 Jun 2026 21:22:17 +0200
Subject: [PATCH 014/100] ktailctl: 0.22.0 -> 0.22.1

Changelog: https://github.com/f-koehler/KTailctl/releases/tag/v0.22.1
Diff: https://github.com/f-koehler/KTailctl/compare/v0.22.0...v0.22.1
---
 pkgs/by-name/kt/ktailctl/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/kt/ktailctl/package.nix b/pkgs/by-name/kt/ktailctl/package.nix
index 739c374a00b4..d6e25dd9a379 100644
--- a/pkgs/by-name/kt/ktailctl/package.nix
+++ b/pkgs/by-name/kt/ktailctl/package.nix
@@ -11,13 +11,13 @@
 }:
 
 let
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
-    rev = "v${version}";
-    hash = "sha256-20hR/N3m1BsbMGiaWVV/SH/OHgfk7ZC1+WWhYqQpIls=";
+    tag = "v${version}";
+    hash = "sha256-BRkjVZaoxiMW8JltIkYDiCCE2kNGLDpRJd0iclQMcGY=";
   };
 
   goDeps =
@@ -74,6 +74,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "GUI to monitor and manage Tailscale on your Linux desktop";
+    changelog = "https://github.com/f-koehler/KTailctl/releases/tag/${src.tag}";
     homepage = "https://github.com/f-koehler/KTailctl";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ k900 ];

From ed9a503b474d17954bcfb9d0edb26c791005022e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 30 Jun 2026 09:22:46 +0200
Subject: [PATCH 015/100] music-assistant-desktop: 0.4.2 -> 0.4.4

Diff: https://github.com/music-assistant/desktop-app/compare/0.4.2...0.4.4

Changelog: https://github.com/music-assistant/desktop-app/releases/tag/0.4.3
Changelog: https://github.com/music-assistant/desktop-app/releases/tag/0.4.4
---
 pkgs/by-name/mu/music-assistant-desktop/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mu/music-assistant-desktop/package.nix b/pkgs/by-name/mu/music-assistant-desktop/package.nix
index 54179caddd17..24342160219b 100644
--- a/pkgs/by-name/mu/music-assistant-desktop/package.nix
+++ b/pkgs/by-name/mu/music-assistant-desktop/package.nix
@@ -30,13 +30,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "music-assistant-desktop";
-  version = "0.4.2";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "desktop-app";
     tag = finalAttrs.version;
-    hash = "sha256-AzKUv0lEpxM4lVEmgDV89RCD78YKcGNj1FTBs8spdyI=";
+    hash = "sha256-t63DUejUyNnOD7gIPow/xsCo2TcmDaK3C5R+TkoBZo8=";
   };
 
   patches = [
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-PevHpvDIlah0jQw/mZkDxQ5xY3t6KicGLlDYbtPco5A=";
+  cargoHash = "sha256-Z7iyPEEPvUhVLma4n20faoz47CK+PHAIB6epNDF5sUo=";
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";

From bf80cf0f2e8d5e3809931011d4c8c949d2b196d2 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 30 Jun 2026 13:55:16 +0200
Subject: [PATCH 016/100] ci/eval: Allow disallowed attrs to depend on other
 disallowed attrs

With a dependency chain like

    a -> b -> c

it was not possible to e.g. add a `meta.problems.removal` to b, because that would cause b to be entirely unavailable as a dependency.

This PR slightly lifts that restriction by allowing both a and b to be marked with such a problem without causing a CI failure.

This is useful for:
- Having a problem on a package that needs to be removed but still has dependents (which then also need a problem)
- Having a problem on a package that is aliased under another attribute, which counts as a dependency
---
 ci/eval/default.nix        | 77 +++++++++++++++++++++++++-------------
 pkgs/top-level/default.nix | 40 ++++++++++++--------
 pkgs/top-level/stage.nix   | 10 ++---
 3 files changed, 80 insertions(+), 47 deletions(-)

diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 547fcf1f26be..8feaf5cf77aa 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -100,6 +100,7 @@ let
         myChunk=$2
         system=$3
         outputDir=$4
+        preEvalFile=$5
 
         # Default is 5, higher values effectively disable the warning.
         # This randomly breaks Eval.
@@ -121,12 +122,12 @@ let
           --show-trace \
           --arg chunkSize "$chunkSize" \
           --arg myChunk "$myChunk" \
-          --arg preEvalFile "${preEvalFile}" \
+          --arg preEvalFile "$preEvalFile" \
           --arg systems "[ \"$system\" ]" \
           --arg includeBroken ${lib.boolToString includeBroken} \
           --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
           -I ${nixpkgs} \
-          -I ${preEvalFile} \
+          -I "$preEvalFile" \
           > "$outputDir/result/$myChunk" \
           2> "$outputDir/stderr/$myChunk"
         exitCode=$?
@@ -164,12 +165,6 @@ let
         echo "System: $evalSystem"
         cores=$NIX_BUILD_CORES
         echo "Cores: $cores"
-        attrCount=$(jq '.paths | length' "${preEvalFile}")
-        echo "Attribute count: $attrCount"
-        echo "Chunk size: $chunkSize"
-        # Same as `attrCount / chunkSize` but rounded up
-        chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
-        echo "Chunk count: $chunkCount"
 
         mkdir -p $out/${evalSystem}
 
@@ -190,29 +185,61 @@ let
           done
         ) &
 
-        seq_end=$(( chunkCount - 1 ))
+        chunkedEval() {
+          local chunkOutputDir=$1
+          local preEvalFile=$2
 
-        ${lib.optionalString quickTest ''
-          seq_end=0
-        ''}
+          local attrCount=$(jq '.paths | length' "$preEvalFile")
+          echo "Attribute count: $attrCount"
+          echo "Chunk size: $chunkSize"
+          # Same as `attrCount / chunkSize` but rounded up
+          local chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
+          echo "Chunk count: $chunkCount"
 
-        chunkOutputDir=$(mktemp -d)
-        mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}
+          local seq_end=$(( chunkCount - 1 ))
+          ${lib.optionalString quickTest ''
+            seq_end=0
+          ''}
 
-        seq -w 0 "$seq_end" |
-          command time -f "%e" -o "$out/${evalSystem}/total-time" \
-          xargs -I{} -P"$cores" \
-          ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir"
+          mkdir -p "$chunkOutputDir"/{result,stats,timestats,stderr}
 
-        cp -r "$chunkOutputDir"/stats $out/${evalSystem}/stats-by-chunk
+          seq -w 0 "$seq_end" |
+            xargs -I{} -P"$cores" \
+            ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir" "$preEvalFile"
 
-        if (( chunkSize * chunkCount != attrCount )); then
-          # A final incomplete chunk would mess up the stats, don't include it
-          rm "$chunkOutputDir"/stats/"$seq_end"
-        fi
+          if (( chunkSize * chunkCount != attrCount )); then
+            # A final incomplete chunk would mess up the stats, don't include it
+            rm "$chunkOutputDir"/stats/"$seq_end"
+          fi
+        }
 
-        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
-        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
+        chunkOutputDirs=$(mktemp -d)
+
+        # Preparation for the second eval
+        disallowedAttributesPreEvalFile=$(mktemp)
+        jq '{
+          paths: (.attrPathsDisallowedForInternalUse | map(.attrPath)),
+          attrPathsDisallowedForInternalUse: []
+        }' ${preEvalFile} > "$disallowedAttributesPreEvalFile"
+
+        startEpoch=$(date +%s)
+
+        # The first eval evaluates only attributes that are not disallowed for internal Nixpkgs use, ensuring that they don't depend on disallowed attributes
+        # Because the first eval doesn't evaluate the disallowed attributes themselves, but we still want to check that they don't fail evaluation, we evaluate them separately in a second eval
+        # The reason we need two evals is because we want disallowed attributes to be able to depend on other disallowed attributes, which inherently needs a separate Nixpkgs instantiation
+        # And while we could interleave that instantiation into a single eval, that would ~double memory usage for all chunks, while doing it separately doesn't
+        echo "Evaluating the internally allowed attributes"
+        chunkedEval "$chunkOutputDirs"/allowed ${preEvalFile}
+        echo "Evaluating the internally disallowed attributes"
+        chunkedEval "$chunkOutputDirs"/disallowed "$disallowedAttributesPreEvalFile"
+
+        echo $(( $(date +%s) - startEpoch )) > "$out/${evalSystem}/total-time"
+
+        # We only use the stats from the allowed attrs eval, because the disallowed attrs are generally not even a full chunk
+        cp -r "$chunkOutputDirs"/allowed/stats $out/${evalSystem}/stats-by-chunk
+
+        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
+        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
       '';
 
   diff = callPackage ./diff.nix { };
diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix
index 4e19941441da..c9e888067a74 100644
--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@@ -216,27 +216,37 @@ let
 
   fixedPoint = boot stages;
 
+  removeInternallyDisallowedAttrPaths =
+    let
+      # Same as `lib.removeAttrs`, but can remove nested attributes (and order of arguments is fixed)
+      # TODO: Consider moving to lib.attrpaths.removeAttrPaths
+      removeAttrPaths =
+        attrPathsToRemove: set:
+        let
+          split = lib.partition (
+            attrPath:
+            assert attrPath != [ ];
+            lib.length attrPath == 1
+          ) attrPathsToRemove;
+          nestedApplied =
+            set
+            // lib.mapAttrs (name: attrPaths: removeAttrPaths (lib.map lib.tail attrPaths) set.${name}) (
+              lib.groupBy (attrPath: lib.head attrPath) split.wrong
+            );
+        in
+        lib.removeAttrs nestedApplied (lib.map lib.head split.right);
+    in
+    removeAttrPaths (map (x: x.attrPath) config.attrPathsDisallowedForInternalUse);
+
   pkgs =
     # Generally only set by CI, don't want to cause a performance hit for users
     if config.attrPathsDisallowedForInternalUse == [ ] then
       fixedPoint
     else
       # See ./stage.nix, which replaced config.attrPathsDisallowedForInternalUse with aborts.
-      # We replace these attribute paths with their original derivations again,
-      # because CI would just error out from the aborting attributes themselves.
-      # Internally all packages still see the aborting attributes if used as dependencies,
-      # because we do this here after the fixed-point is calculated.
-      # Note that we don't want to remove the attributes entirely like what aliases.nix does,
-      # because unlike aliases, CI still needs to check the packages to evaluate at all,
-      # which it wouldn't if they're removed entirely.
-      lib.updateManyAttrsByPath
-        (map (attrs: {
-          path = attrs.attrPath;
-          update =
-            _:
-            lib.getAttrFromPath attrs.attrPath fixedPoint.__internalBeforeInternallyDisallowedAttrPathsOverlay;
-        }) config.attrPathsDisallowedForInternalUse)
-        (removeAttrs fixedPoint [ "__internalBeforeInternallyDisallowedAttrPathsOverlay" ]);
+      # To prevent these attributes from causing CI failures we remove them entirely.
+      # These attrs are still evaluated but in a different way, see ci/eval/default.nix
+      removeInternallyDisallowedAttrPaths fixedPoint;
 
 in
 checked pkgs
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index bc50a3f24247..8a01dc2f6aa8 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -310,20 +310,16 @@ let
   };
 
   # Replaces the attributes in config.attrPathsDisallowedForInternalUse with aborts.
+  # Not warnings because those wouldn't give a backtrace, which is important for debugging
   # Not throws because those would be ignored by nix-env, which is what CI uses to evaluate everything
-  # See also ./default.nix, where these attributes are added back again so they're still checked by CI
+  # See also ./default.nix, which removes these attributes entirely from the end result
   internallyDisallowedAttrPathsOverlay =
     final: prev:
     # Generally only set by CI, don't want to cause a performance hit for users
     if config.attrPathsDisallowedForInternalUse == [ ] then
       { }
     else
-      {
-        # So that ./default.nix can add them back again outside the fixed point
-        # Don't use this in packages!
-        __internalBeforeInternallyDisallowedAttrPathsOverlay = prev;
-      }
-      // lib.updateManyAttrsByPath (map (
+      lib.updateManyAttrsByPath (map (
         { attrPath, reason }:
         {
           path = attrPath;

From e243d0c0a67edbb97c5ac9af17d096dd9b59868e Mon Sep 17 00:00:00 2001
From: anubis <BK_anubis_GG@proton.me>
Date: Tue, 30 Jun 2026 14:36:34 +0100
Subject: [PATCH 017/100] spotube: 5.1.1 -> 5.1.2

Signed-off-by: anubis <BK_anubis_GG@proton.me>
---
 pkgs/by-name/sp/spotube/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/sp/spotube/package.nix b/pkgs/by-name/sp/spotube/package.nix
index 1e7ad8ec566b..2cf5e96731a7 100644
--- a/pkgs/by-name/sp/spotube/package.nix
+++ b/pkgs/by-name/sp/spotube/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spotube";
-  version = "5.1.1";
+  version = "5.1.2";
 
   src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system};
 
@@ -87,19 +87,19 @@ stdenv.mkDerivation (finalAttrs: {
     {
       "aarch64-linux" = fetchArtifact {
         suffix = "linux-aarch64.deb";
-        hash = "sha256-Wn+eE8nkHXRBZYVw+sm+Nxf75nK/JJ8bnVK7YZ0O47A=";
+        hash = "sha256-cb9qPNJ1wB3zURvBCLEJIr+L4BGYwtgjAezSRm4QQDE=";
       };
       "x86_64-linux" = fetchArtifact {
         suffix = "linux-x86_64.deb";
-        hash = "sha256-jzi1HPJErDhZwt1Eu1lzG29QaAw3vL+PVRNDVBxn7ZQ=";
+        hash = "sha256-FEb5mPmGOAMw4nnFJ0kC+ymg4zBdUXWjvIO0sGOS6M0=";
       };
       "x86_64-darwin" = fetchArtifact {
         suffix = "macos-universal.dmg";
-        hash = "sha256-kUQdLWawtIVhzeO5NfUa435JOf7/SCVBhSKfQh3J96I=";
+        hash = "sha256-J2J9/UQZAECvGmumqGzcRFA5kpakOmFpQKlK5oesCRM=";
       };
       "aarch64-darwin" = fetchArtifact {
         suffix = "macos-universal.dmg";
-        hash = "sha256-kUQdLWawtIVhzeO5NfUa435JOf7/SCVBhSKfQh3J96I=";
+        hash = "sha256-J2J9/UQZAECvGmumqGzcRFA5kpakOmFpQKlK5oesCRM=";
       };
     };
 

From 7bd8e5f602d7aebbb8d1927674452daf2c935f1b Mon Sep 17 00:00:00 2001
From: Sam Pointon <sampointon@gmail.com>
Date: Wed, 24 Jun 2026 22:31:30 +0100
Subject: [PATCH 018/100] maintainers: add sepointon

---
 maintainers/maintainer-list.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2e92e5a4baf3..0c8f58f794c5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -25142,6 +25142,13 @@
     githubId = 35622998;
     name = "Suwon Park";
   };
+  sepointon = {
+    email = "sampointon@gmail.com";
+    github = "sepointon";
+    githubId = 209542026;
+    matrix = "sampointon:matrix.org";
+    name = "Sam Pointon";
+  };
   seppeljordan = {
     email = "sebastian.jordan.mail@googlemail.com";
     github = "seppeljordan";

From dd41f01aecfd10aa49e26c7709fbcd577717eb89 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Tue, 30 Jun 2026 18:55:36 +0200
Subject: [PATCH 019/100] python3Packages.granian: 2.7.5 -> 2.7.8

Changelog:
https://github.com/emmett-framework/granian/releases/tag/v2.7.8
https://github.com/emmett-framework/granian/releases/tag/v2.7.7
https://github.com/emmett-framework/granian/releases/tag/v2.7.6
---
 pkgs/development/python-modules/granian/default.nix    | 6 +++---
 pkgs/development/python-modules/granian/no-alloc.patch | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/granian/default.nix b/pkgs/development/python-modules/granian/default.nix
index aceaea74a293..b015bead770d 100644
--- a/pkgs/development/python-modules/granian/default.nix
+++ b/pkgs/development/python-modules/granian/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "granian";
-  version = "2.7.5";
+  version = "2.7.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "emmett-framework";
     repo = "granian";
     tag = "v${version}";
-    hash = "sha256-6NOag3PHI4BOi5JuulRqhKeyDWuMxxu0bfb8ViQxDWY=";
+    hash = "sha256-89Kl/MrotK0fv0oAayUuZXyLLG9PPM1km57ER+dM1jw=";
   };
 
   # Granian forces a custom allocator for all the things it runs,
@@ -40,7 +40,7 @@ buildPythonPackage rec {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-R4thKT3lMo/CFv+CokGSDzynTKOMCLRjVEy7Ojip4qA=";
+    hash = "sha256-mnqtzZ2+xuxUezhsgw+gr6MmWbi4Z4j0bHndys6vHFw=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/granian/no-alloc.patch b/pkgs/development/python-modules/granian/no-alloc.patch
index d6b01f9475b1..bd885bab87ed 100644
--- a/pkgs/development/python-modules/granian/no-alloc.patch
+++ b/pkgs/development/python-modules/granian/no-alloc.patch
@@ -1,5 +1,5 @@
 diff --git a/Cargo.toml b/Cargo.toml
-index e1b6a3d..8fe77cf 100644
+index a33fb2c..8426d66 100644
 --- a/Cargo.toml
 +++ b/Cargo.toml
 @@ -46,3 +46,2 @@ itertools = "0.14"
@@ -7,8 +7,8 @@ index e1b6a3d..8fe77cf 100644
 -mimalloc = { version = "0.1.49", default-features = false, features = ["local_dynamic_tls"], optional = true }
  mime_guess = "=2.0"
 @@ -58,3 +57,2 @@ socket2 = { version = "=0.6", features = ["all"] }
- sysinfo = "=0.38"
--tikv-jemallocator = { version = "0.6.0", default-features = false, features = ["disable_initial_exec_tls"], optional = true }
+ sysinfo = "=0.39"
+-tikv-jemallocator = { version = "=0.7", default-features = false, features = ["disable_initial_exec_tls"], optional = true }
  tls-listener = { version = "=0.11", git = "https://github.com/gi0baro/tls-listener.git", branch = "0.11.x", features = ["rustls-ring", "rustls-tls12"] }
 @@ -68,6 +66,2 @@ pyo3-build-config = "=0.27"
  

From a747337182437f4d05b31a0fc75991cbd44f808d Mon Sep 17 00:00:00 2001
From: Sam Pointon <sampointon@gmail.com>
Date: Wed, 17 Jun 2026 12:14:31 +0100
Subject: [PATCH 020/100] wasm-component-ld: init at 0.5.25

---
 pkgs/by-name/wa/wasm-component-ld/package.nix | 40 +++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 pkgs/by-name/wa/wasm-component-ld/package.nix

diff --git a/pkgs/by-name/wa/wasm-component-ld/package.nix b/pkgs/by-name/wa/wasm-component-ld/package.nix
new file mode 100644
index 000000000000..ccc96dd71141
--- /dev/null
+++ b/pkgs/by-name/wa/wasm-component-ld/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "wasm-component-ld";
+  version = "0.5.25";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bytecodealliance";
+    repo = "wasm-component-ld";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EQqNm3GRuMafbrOyzsdZ5e1pX4LH40wCyKVgSgm8A48=";
+  };
+
+  cargoHash = "sha256-1e54TLWGjfNORwr6uLIe/XhdDDOkbalw/6/0UGuBiPk=";
+
+  # Tests require a rustc that can target wasm32-wasip1, including std. This is awkward for
+  # Nixpkgs to provide at the same time as providing a rustc that's targetting the actual target.
+  # TODO: work around by patching the test suite to invoke pkgsBuildTarget.rustc rather than just looking in PATH for any old rustc
+  doCheck = false;
+
+  meta = {
+    description = "Command line linker for creating WebAssembly components";
+    homepage = "https://github.com/bytecodealliance/wasm-component-ld";
+    license = with lib.licenses; [
+      asl20
+      llvm-exception
+      mit
+    ];
+    maintainers = with lib.maintainers; [
+      sepointon
+    ];
+    mainProgram = "wasm-component-ld";
+  };
+})

From 296279566a60c62020c29c5e5e2bae9a1d58b455 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 30 Jun 2026 20:13:37 +0000
Subject: [PATCH 021/100] libdict: 1.0.5 -> 1.0.6

---
 pkgs/by-name/li/libdict/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libdict/package.nix b/pkgs/by-name/li/libdict/package.nix
index b5013a3df553..7558978c2f4b 100644
--- a/pkgs/by-name/li/libdict/package.nix
+++ b/pkgs/by-name/li/libdict/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdict";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "rtbrick";
     repo = "libdict";
     rev = finalAttrs.version;
-    hash = "sha256-604escyV5MVuYggs1awIrorCrdXSUj3IhjwXV2QdDMU=";
+    hash = "sha256-JO8gIZwSZ1vOigiM2IoGRYW2m2zoAa1af/eMBP3ZRjY=";
   };
 
   nativeBuildInputs = [

From 6b5822b1d9f4cecf8c50d62578663deae836b524 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 30 Jun 2026 22:01:14 +0200
Subject: [PATCH 022/100] wp-scanner: init at 2.0.1-unstable-2026-03-17

Wordpress Security Scanner and Auto Exploiter

https://github.com/Triotion/WP-Scanner
---
 pkgs/by-name/wp/wp-scanner/package.nix | 56 ++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 pkgs/by-name/wp/wp-scanner/package.nix

diff --git a/pkgs/by-name/wp/wp-scanner/package.nix b/pkgs/by-name/wp/wp-scanner/package.nix
new file mode 100644
index 000000000000..ea61d89e93ad
--- /dev/null
+++ b/pkgs/by-name/wp/wp-scanner/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  python3,
+}:
+
+python3.pkgs.buildPythonApplication (finalAttrs: {
+  pname = "wp-scanner";
+  version = "2.0.1-unstable-2026-03-17";
+  pyproject = false;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Triotion";
+    repo = "WP-Scanner";
+    rev = "1f75728384ca5422f69cf5f1d0a284c36b0ed45a";
+    hash = "sha256-gIfOxoiVdRKa2GGDy9GMi7+6u2Lh/yVdin/hY9lh4bs=";
+  };
+
+  dependencies = with python3.pkgs; [
+    beautifulsoup4
+    colorama
+    lxml
+    packaging
+    python-dateutil
+    requests
+    tqdm
+    urllib3
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -vD wp_scanner.py $out/bin/wp-scanner
+    install -vd $out/${python3.sitePackages}/
+    cp -R data modules $out/${python3.sitePackages}
+
+    runHook postInstall
+  '';
+
+  # Project has no tests
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Wordpress Security Scanner and Auto Exploiter";
+    homepage = "https://github.com/Triotion/WP-Scanner";
+    # https://github.com/Triotion/WP-Scanner/issues/2
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "wp-scanner";
+  };
+})

From 317071b55326320d38859db8ee8fa25f2e9c5d68 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 30 Jun 2026 22:17:02 +0100
Subject: [PATCH 023/100] diffoscope: 322 -> 323

Changes: https://diffoscope.org/news/diffoscope-323-released/
---
 .../fix-tests-with-zipdetails-4.006.patch     | 97 -------------------
 pkgs/by-name/di/diffoscope/package.nix        |  8 +-
 .../remove-flags-from-ocaml-diff.patch        | 27 ------
 3 files changed, 2 insertions(+), 130 deletions(-)
 delete mode 100644 pkgs/by-name/di/diffoscope/fix-tests-with-zipdetails-4.006.patch
 delete mode 100644 pkgs/by-name/di/diffoscope/remove-flags-from-ocaml-diff.patch

diff --git a/pkgs/by-name/di/diffoscope/fix-tests-with-zipdetails-4.006.patch b/pkgs/by-name/di/diffoscope/fix-tests-with-zipdetails-4.006.patch
deleted file mode 100644
index 04593b366e76..000000000000
--- a/pkgs/by-name/di/diffoscope/fix-tests-with-zipdetails-4.006.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From fade8d04bfdbf473f3930feba7183957372e7fa7 Mon Sep 17 00:00:00 2001
-From: Michael Daniels <mdaniels5757@gmail.com>
-Date: Sun, 28 Jun 2026 16:20:43 -0400
-Subject: [PATCH] fix tests with zipdetails 4.006
-
----
- tests/comparators/test_zip.py            |  3 ++-
- tests/data/zip2_zipdetails_expected_diff |  2 +-
- tests/data/zip_zipdetails_expected_diff  | 10 +++++-----
- 3 files changed, 8 insertions(+), 7 deletions(-)
-
-diff --git a/tests/comparators/test_zip.py b/tests/comparators/test_zip.py
-index 75ec38be..ecff1930 100644
---- a/tests/comparators/test_zip.py
-+++ b/tests/comparators/test_zip.py
-@@ -81,7 +81,7 @@ def differences2(zip1, zip3):
- 
- 
- @skip_unless_tools_exist("zipinfo", "zipdetails")
--@skip_unless_tool_is_at_least("zipdetails", zipdetails_version, "4.004")
-+@skip_unless_tool_is_at_least("zipdetails", zipdetails_version, "4.006")
- @skip_unless_tool_is_at_least("perl", io_compress_zip_version, "2.212")
- def test_metadata(differences):
-     assert_diff(differences[0], "zip_zipinfo_expected_diff")
-@@ -96,6 +96,7 @@ def test_compressed_files(differences):
- 
- 
- @skip_unless_tools_exist("zipinfo", "bsdtar", "zipdetails")
-+@skip_unless_tool_is_at_least("zipdetails", zipdetails_version, "4.006")
- @skip_unless_tool_is_at_least("perl", io_compress_zip_version, "2.212")
- def test_extra_fields(differences2):
-     assert_diff(differences2[0], "zip_bsdtar_expected_diff")
-diff --git a/tests/data/zip2_zipdetails_expected_diff b/tests/data/zip2_zipdetails_expected_diff
-index 291dca88..281cf6c5 100644
---- a/tests/data/zip2_zipdetails_expected_diff
-+++ b/tests/data/zip2_zipdetails_expected_diff
-@@ -5,7 +5,7 @@
-  #
-  0064 Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
-  0066   Length              0009 (9)
-- 0068   Flags               03 (3) 'Modification Access'
-+ 0068   Flags               03 (3) 'Modification & Access'
- -0069   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- -006D   Access Time         558AB45F (1435153503) 'Wed Jun 24 13:45:03 2015'
- +0069   Modification Time   41414141 (1094795585) 'Fri Sep 10 05:53:05 2004'
-diff --git a/tests/data/zip_zipdetails_expected_diff b/tests/data/zip_zipdetails_expected_diff
-index 978c2583..50df2696 100644
---- a/tests/data/zip_zipdetails_expected_diff
-+++ b/tests/data/zip_zipdetails_expected_diff
-@@ -23,7 +23,7 @@
-  #
-  0064 Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
-  0066   Length              0009 (9)
-- 0068   Flags               03 (3) 'Modification Access'
-+ 0068   Flags               03 (3) 'Modification & Access'
- -0069   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- +0069   Modification Time   558AB474 (1435153524) 'Wed Jun 24 13:45:24 2015'
-  006D   Access Time         558AB45F (1435153503) 'Wed Jun 24 13:45:03 2015'
-@@ -85,7 +85,7 @@
-  #
- -01BF Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- -01C1   Length              0005 (5)
---01C3   Flags               03 (3) 'Modification Access'
-+-01C3   Flags               03 (3) 'Modification & Access'
- -01C4   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- -01C8 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- -01CA   Length              000B (11)
-@@ -96,7 +96,7 @@
- -01D3   GID                 000003E8 (1000)
- +024E Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- +0250   Length              0005 (5)
--+0252   Flags               03 (3) 'Modification Access'
-++0252   Flags               03 (3) 'Modification & Access'
- +0253   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- +0257 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- +0259   Length              000B (11)
-@@ -163,7 +163,7 @@
-  #
- -020D Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- -020F   Length              0005 (5)
---0211   Flags               03 (3) 'Modification Access'
-+-0211   Flags               03 (3) 'Modification & Access'
- -0212   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- -0216 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- -0218   Length              000B (11)
-@@ -174,7 +174,7 @@
- -0221   GID                 000003E8 (1000)
- +029C Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- +029E   Length              0005 (5)
--+02A0   Flags               03 (3) 'Modification Access'
-++02A0   Flags               03 (3) 'Modification & Access'
- +02A1   Modification Time   558AB474 (1435153524) 'Wed Jun 24 13:45:24 2015'
- +02A5 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- +02A7   Length              000B (11)
--- 
-2.54.0
-
diff --git a/pkgs/by-name/di/diffoscope/package.nix b/pkgs/by-name/di/diffoscope/package.nix
index dc5169673518..5898aba19644 100644
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -109,12 +109,12 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "322";
+  version = "323";
   pyproject = true;
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-dina2JdbLL/jfo4eMuUo62KggST95w0b7oonY86zjgk=";
+    hash = "sha256-TFSeCS7D2D496rUrosYAWP4kHsu6x386c8AJ5c4aKYs=";
   };
 
   outputs = [
@@ -124,10 +124,6 @@ python.pkgs.buildPythonApplication rec {
 
   patches = [
     ./ignore_links.patch
-    # Remove flags output from an OCaml test's diff, as it's Debian-specific
-    ./remove-flags-from-ocaml-diff.patch
-    # https://salsa.debian.org/reproducible-builds/diffoscope/-/merge_requests/166
-    ./fix-tests-with-zipdetails-4.006.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/di/diffoscope/remove-flags-from-ocaml-diff.patch b/pkgs/by-name/di/diffoscope/remove-flags-from-ocaml-diff.patch
deleted file mode 100644
index 61138d263c6e..000000000000
--- a/pkgs/by-name/di/diffoscope/remove-flags-from-ocaml-diff.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 18cf9ab675691c7173a9b7fafd6d521c3ea75862 Mon Sep 17 00:00:00 2001
-From: Michael Daniels <mdaniels5757@gmail.com>
-Date: Sat, 20 Jun 2026 11:42:29 -0400
-Subject: [PATCH] tests/data/ocaml_expected_diff: remove flags from diff
-
-This output comes from a Debian-specific OCaml patch, see
-https://salsa.debian.org/ocaml-team/ocaml/-/blob/archive/debian/5.4.1-1/debian/patches/Print-.cmi-flags-in-objinfo.patch
----
- tests/data/ocaml_expected_diff | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/tests/data/ocaml_expected_diff b/tests/data/ocaml_expected_diff
-index 79631882..a48de841 100644
---- a/tests/data/ocaml_expected_diff
-+++ b/tests/data/ocaml_expected_diff
-@@ -1,7 +1,6 @@
--@@ -1,6 +1,6 @@
-+@@ -1,5 +1,5 @@
- -Unit name: Test1
- +Unit name: Test2
-- Flags: [ Alerts _ ]
-  Interfaces imported:
- -	351c2dc2fb4a56dac258b47c26262db6	Test1
- +	ac02205dc900024a67ede9f394c59d72	Test2
--- 
-2.54.0
-

From 2606a235af555f170d1564b67a6b7354318a81ba Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Wed, 1 Jul 2026 00:58:26 +0200
Subject: [PATCH 024/100] python3Packages.django-vtasks: 2.1.1 -> 2.1.2

Changelog: https://gitlab.com/glitchtip/django-vtasks/-/releases/v2.1.2
Diff: https://gitlab.com/glitchtip/django-vtasks/-/compare/v2.1.1...v2.1.2
---
 pkgs/development/python-modules/django-vtasks/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django-vtasks/default.nix b/pkgs/development/python-modules/django-vtasks/default.nix
index d890b5894ef3..f582ae5992e9 100644
--- a/pkgs/development/python-modules/django-vtasks/default.nix
+++ b/pkgs/development/python-modules/django-vtasks/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "django-vtasks";
-  version = "2.1.1";
+  version = "2.1.2";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "django-vtasks";
     tag = "v${version}";
-    hash = "sha256-f9x6atPMYgQQ/jpCJdDj33l+mhyei+6IWi4bqqVWxU8=";
+    hash = "sha256-L2desiA5ZSdW6KcWuJ4UmtqDVuvAFeRplLgJex7inVM=";
   };
 
   postPatch = ''

From 4a121cc25a66c3b9c11bd830f71be98367404829 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Wed, 1 Jul 2026 00:22:15 +0200
Subject: [PATCH 025/100] glitchtip: 6.1.8 -> 6.2.0

Changelog: https://gitlab.com/glitchtip/glitchtip-backend/-/blob/v6.2.0/CHANGELOG
Diff: https://gitlab.com/glitchtip/glitchtip-backend/-/compare/v6.1.8...v6.2.0
---
 pkgs/by-name/gl/glitchtip/frontend.nix       |  6 +--
 pkgs/by-name/gl/glitchtip/glitchtip-rust.nix | 42 ++++++++++++++++++++
 pkgs/by-name/gl/glitchtip/package.nix        |  9 +++--
 pkgs/by-name/gl/glitchtip/update.sh          |  1 +
 4 files changed, 52 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/by-name/gl/glitchtip/glitchtip-rust.nix

diff --git a/pkgs/by-name/gl/glitchtip/frontend.nix b/pkgs/by-name/gl/glitchtip/frontend.nix
index e57cd1aef060..86c37d73d166 100644
--- a/pkgs/by-name/gl/glitchtip/frontend.nix
+++ b/pkgs/by-name/gl/glitchtip/frontend.nix
@@ -10,13 +10,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "glitchtip-frontend";
-  version = "6.1.8";
+  version = "6.2.0";
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-frontend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y8NPj1xjGnGS9yBFaRjFRxLdTGrAq08T9N7cZN5IeSc=";
+    hash = "sha256-iKY1w9lmfuyvDblH/TlnUwAnda17qWGxmx1qtmQRENg=";
   };
 
   nodejs = nodejs_22;
@@ -25,7 +25,7 @@ buildNpmPackage (finalAttrs: {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src;
     npmDepsFetcherVersion = 3;
-    hash = "sha256-AIzPJpNvGV/U71UFAUwOqx8kb31s7LXhMha4bXV+oCU=";
+    hash = "sha256-V9aRKoJ6+BN/q7NS21eZBopzkWje8sOGGL1AgO4cUM0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/gl/glitchtip/glitchtip-rust.nix b/pkgs/by-name/gl/glitchtip/glitchtip-rust.nix
new file mode 100644
index 000000000000..455d00a4614a
--- /dev/null
+++ b/pkgs/by-name/gl/glitchtip/glitchtip-rust.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitLab,
+  rustPlatform,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "glitchtip-rust";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    owner = "glitchtip";
+    repo = "glitchtip-rust";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0FG+seIWqfyOG3JR0WF4ICnxMAPx9FO0JyFSB43CttU=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-14j7h4TgQhTE5oihnvjAxtGZhPajuTRD4Cga8xzN9Lg=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  pythonImportsCheck = [ "gt_rust" ];
+
+  meta = {
+    description = "Rust components of GlitchTip Backend";
+    homepage = "https://glitchtip.com";
+    changelog = "https://gitlab.com/glitchtip/glitchtip-rust/-/tags/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      defelo
+      felbinger
+    ];
+  };
+})
diff --git a/pkgs/by-name/gl/glitchtip/package.nix b/pkgs/by-name/gl/glitchtip/package.nix
index 60e7ef7aae3a..a623377e0b95 100644
--- a/pkgs/by-name/gl/glitchtip/package.nix
+++ b/pkgs/by-name/gl/glitchtip/package.nix
@@ -13,6 +13,7 @@ let
     self = python;
     packageOverrides = final: prev: {
       django = final.django_6;
+      glitchtip-rust = final.callPackage ./glitchtip-rust.nix { };
     };
   };
 
@@ -24,7 +25,6 @@ let
       arro3-core
       arro3-io
       boto3
-      brotli
       cxxfilt
       django
       django-allauth
@@ -46,8 +46,10 @@ let
       duckdb
       google-cloud-logging
       granian
+      glitchtip-rust
       mcp
       minidump
+      opentelemetry-proto
       orjson
       psycopg
       pydantic
@@ -77,14 +79,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glitchtip";
-  version = "6.1.8";
+  version = "6.2.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-backend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4RAZYGoS1tUbcPVv8L0sFWqFfBX05yXKZHFZDbEn0C0=";
+    hash = "sha256-E1YwJwfL5+Q68xRfnoi2Sg+vAZxGQa0IKfOSVuLVnK0=";
   };
 
   postPatch = ''
@@ -128,6 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     inherit frontend python;
+    inherit (python.pkgs) glitchtip-rust;
     tests = { inherit (nixosTests) glitchtip; };
     updateScript = ./update.sh;
   };
diff --git a/pkgs/by-name/gl/glitchtip/update.sh b/pkgs/by-name/gl/glitchtip/update.sh
index e0a5cf370e59..33816b26d0b3 100755
--- a/pkgs/by-name/gl/glitchtip/update.sh
+++ b/pkgs/by-name/gl/glitchtip/update.sh
@@ -7,3 +7,4 @@ version=$(curl ${GITLAB_TOKEN:+-H "Private-Token: $GITLAB_TOKEN"} -sL https://gi
 
 nix-update --version="$version" glitchtip
 nix-update --version="$version" glitchtip.frontend
+nix-update glitchtip.glitchtip-rust

From 84b180042ce809ee5651dad026c77d9965c25860 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 06:24:32 +0000
Subject: [PATCH 026/100] github-mcp-server: 1.4.0 -> 1.5.0

---
 pkgs/by-name/gi/github-mcp-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gi/github-mcp-server/package.nix b/pkgs/by-name/gi/github-mcp-server/package.nix
index 3cab6eaa7ee1..8789264aba3d 100644
--- a/pkgs/by-name/gi/github-mcp-server/package.nix
+++ b/pkgs/by-name/gi/github-mcp-server/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "github-mcp-server";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "github-mcp-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5INN7B/F1KcyZwZ3xeOBiCnfAdK1PXVnMZf3t8JIk6I=";
+    hash = "sha256-O8ooNaFmWXMhsn7UQITgo48VkdYbVTCC4WkHoU9abyo=";
   };
 
   vendorHash = "sha256-J1hC4hdEKLENXLJrsyV41TaJ9+2CuPz5KoIMm2mXvTE=";

From 33683c385ac9b95d137344370d33dc7431d3c093 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 10:11:41 +0200
Subject: [PATCH 027/100] python3Packages.selenium-wire-roadtx:
 0-unstable-2026-05-20 -> 5.2.4-unstable-2026-05-20

---
 .../development/python-modules/selenium-wire-roadtx/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/selenium-wire-roadtx/default.nix b/pkgs/development/python-modules/selenium-wire-roadtx/default.nix
index f3b333bd7bb7..c1f67db1995a 100644
--- a/pkgs/development/python-modules/selenium-wire-roadtx/default.nix
+++ b/pkgs/development/python-modules/selenium-wire-roadtx/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "selenium-wire-roadtx";
-  version = "0-unstable-2026-05-20";
+  version = "5.2.4-unstable-2026-05-20";
   pyproject = true;
 
   __structuredAttrs = true;

From 26c67f7ed3d69fd462d62d0316f231f10f07548c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 10:13:18 +0200
Subject: [PATCH 028/100] python3Packages.openinference-instrumentation: 0.1.53
 -> 0.1.54

Diff: https://github.com/Arize-ai/openinference/compare/python-openinference-instrumentation-v0.1.53...python-openinference-instrumentation-v0.1.54

Changelog: https://github.com/Arize-ai/openinference/releases/tag/python-openinference-instrumentation-v0.1.54
---
 .../python-modules/openinference-instrumentation/default.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/openinference-instrumentation/default.nix b/pkgs/development/python-modules/openinference-instrumentation/default.nix
index 6c2e2fbf3a3b..d86bfeefe993 100644
--- a/pkgs/development/python-modules/openinference-instrumentation/default.nix
+++ b/pkgs/development/python-modules/openinference-instrumentation/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "openinference-instrumentation";
-  version = "0.1.53";
+  version = "0.1.54";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Arize-ai";
     repo = "openinference";
     tag = "python-openinference-instrumentation-v${finalAttrs.version}";
-    hash = "sha256-1FzAiO3Vxt2o9YCzwPfHOn4hwvOLDt9Luv3zQTJ6J2Q=";
+    hash = "sha256-6GWZmgb9ZcT/yx7MvGUQlht5fljQGCKMHMpJWZQKpPI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python/${finalAttrs.pname}";

From 28b39eb67289dbe245b8b52d0653c953d544b9ad Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 11:04:07 +0000
Subject: [PATCH 029/100] checkstyle: 13.6.0 -> 13.7.0

---
 pkgs/by-name/ch/checkstyle/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ch/checkstyle/package.nix b/pkgs/by-name/ch/checkstyle/package.nix
index 5eb0d22fef51..acdc60aef140 100644
--- a/pkgs/by-name/ch/checkstyle/package.nix
+++ b/pkgs/by-name/ch/checkstyle/package.nix
@@ -8,17 +8,17 @@
 }:
 
 maven.buildMavenPackage (finalAttrs: {
-  version = "13.6.0";
+  version = "13.7.0";
   pname = "checkstyle";
 
   src = fetchFromGitHub {
     owner = "checkstyle";
     repo = "checkstyle";
     tag = "checkstyle-${finalAttrs.version}";
-    hash = "sha256-5E3GTE4fPmJYoSm2lK4tW1Dcu+SuyQKL396JLg3J22E=";
+    hash = "sha256-BrgjkqkVnLYMlouyopUoCTby2z4YWZl4UK7m3Ktm5bE=";
   };
 
-  mvnHash = "sha256-r0adD/80UguRCIznE6hGdhRifm29GxMhQRSmd2/nabc=";
+  mvnHash = "sha256-IKO61ugVjF03zA6pCwYKmwMVx/Ogy8hrt70ArOUm0NA=";
 
   nativeBuildInputs = [
     maven

From ebf6b493d68f492ce7805ba818bc7dd6e9fff443 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 11:10:34 +0000
Subject: [PATCH 030/100] fetchtastic: 0.10.10 -> 0.10.11

---
 pkgs/by-name/fe/fetchtastic/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fe/fetchtastic/package.nix b/pkgs/by-name/fe/fetchtastic/package.nix
index bbc80f11b9cc..6d17d5b252f3 100644
--- a/pkgs/by-name/fe/fetchtastic/package.nix
+++ b/pkgs/by-name/fe/fetchtastic/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "fetchtastic";
-  version = "0.10.10";
+  version = "0.10.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jeremiah-k";
     repo = "fetchtastic";
     tag = finalAttrs.version;
-    hash = "sha256-ImXBH1mvJE+Ae7fUqR/Z381TKGt6hq0BRHhdtOz3YO4=";
+    hash = "sha256-/kp9bfJJLffZp+9dEY7G+RQmE43XXwNozkDYjeAjPkc=";
   };
 
   pythonRelaxDeps = [ "platformdirs" ];

From 9ee6bef3f336aa69fb2623ad91593157dce2d1f2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 12:48:33 +0000
Subject: [PATCH 031/100] python3Packages.deebot-client: 18.3.0 -> 18.4.0

---
 pkgs/development/python-modules/deebot-client/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/deebot-client/default.nix b/pkgs/development/python-modules/deebot-client/default.nix
index 6357af360a4f..3db4e12e229e 100644
--- a/pkgs/development/python-modules/deebot-client/default.nix
+++ b/pkgs/development/python-modules/deebot-client/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "deebot-client";
-  version = "18.3.0";
+  version = "18.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -31,12 +31,12 @@ buildPythonPackage (finalAttrs: {
     owner = "DeebotUniverse";
     repo = "client.py";
     tag = finalAttrs.version;
-    hash = "sha256-dQh98CIEbxpRga2BbB8X1KtGZ18jvVv4DhyJ1LFNNuw=";
+    hash = "sha256-SFOwIK1rjvbLw5W0d6vzXVUDlUOlBYOu/GMvlwwFDs0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-MNMLOF3j+bGEhDeRln5wLOG6gY+ssSQqrb8vdmyJdtA=";
+    hash = "sha256-mvHHwfeP7k8bvOMFcNTn7wZlumMJ8wx7H+p8SNreIuE=";
   };
 
   nativeBuildInputs = [

From 8f4a585ef78fec392aa9b33b73f595e7b3d660ba Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Wed, 1 Jul 2026 09:00:52 -0400
Subject: [PATCH 032/100] rdfind: autoreconf to fix build with gcc 16

the configure script in the tarball was generated with autoconf 2.72,
which tries to switch to c++11 and causes failing builds with gcc 16
(which defaults to c++20). an update to 1.8.0 does not fix this issue,
so we autoreconf using the version from Nixpkgs (presently autoconf
2.73).
---
 pkgs/by-name/rd/rdfind/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/rd/rdfind/package.nix b/pkgs/by-name/rd/rdfind/package.nix
index 107fc932af99..a88ebc058953 100644
--- a/pkgs/by-name/rd/rdfind/package.nix
+++ b/pkgs/by-name/rd/rdfind/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  autoreconfHook,
   nettle,
 }:
 
@@ -14,6 +15,11 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-eMRjFS4dnk/Rv+uDuckt9ef8TF+Tx9Qm+x9++ivk3yk=";
   };
 
+  # the built-in configure script was generated by autoconf 2.72 and
+  # passes -std=gnu++11 when using gcc 16 instead of the intended c++20.
+  # autoconf 2.73 fixes this, so we autoreconf to avoid this issue.
+  nativeBuildInputs = [ autoreconfHook ];
+
   buildInputs = [ nettle ];
 
   meta = {

From c4c4df133851c78434be4cbd7ba508258a05cc8a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 13:45:28 +0000
Subject: [PATCH 033/100] python3Packages.cvxpy: 1.9.1 -> 1.9.2

---
 pkgs/development/python-modules/cvxpy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cvxpy/default.nix b/pkgs/development/python-modules/cvxpy/default.nix
index 9fad43a2f257..90ff31cb0d2c 100644
--- a/pkgs/development/python-modules/cvxpy/default.nix
+++ b/pkgs/development/python-modules/cvxpy/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cvxpy";
-  version = "1.9.1";
+  version = "1.9.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
     owner = "cvxpy";
     repo = "cvxpy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xQ2WD0S4GiFLYqQlOE+3V23bIs7AqJY6Xn9m4sjc10I=";
+    hash = "sha256-nYfS9HXWTKcvVrq+wm5cgvB7keMAQPmKEe8bI0jngFg=";
   };
 
   postPatch =

From b6ad42103ade945e2eaec387cd7a731d87fcb0a1 Mon Sep 17 00:00:00 2001
From: Ryan Horiguchi <ryan.horiguchi@gmail.com>
Date: Wed, 1 Jul 2026 16:22:40 +0200
Subject: [PATCH 034/100] steam-lancache-prefill: 3.4.2 -> 3.5.1

---
 pkgs/by-name/st/steam-lancache-prefill/deps.json   | 4 ++--
 pkgs/by-name/st/steam-lancache-prefill/package.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/st/steam-lancache-prefill/deps.json b/pkgs/by-name/st/steam-lancache-prefill/deps.json
index 03ae8464bfbc..072c50f1a7da 100644
--- a/pkgs/by-name/st/steam-lancache-prefill/deps.json
+++ b/pkgs/by-name/st/steam-lancache-prefill/deps.json
@@ -136,8 +136,8 @@
   },
   {
     "pname": "Spectre.Console",
-    "version": "0.49.2-preview.0.67",
-    "hash": "sha256-e1BrfX8ME8Ob7ZVKx8VYExKNvLzHHxNJ1R+Yv2lVE3A="
+    "version": "0.51.1",
+    "hash": "sha256-FQAK07dEwEsNYVI1T3S488LHv8AXJ+ZeA9N2hPpWBoo="
   },
   {
     "pname": "Spectre.Console.Analyzer",
diff --git a/pkgs/by-name/st/steam-lancache-prefill/package.nix b/pkgs/by-name/st/steam-lancache-prefill/package.nix
index 9c4cc31e6018..db96a6b71858 100644
--- a/pkgs/by-name/st/steam-lancache-prefill/package.nix
+++ b/pkgs/by-name/st/steam-lancache-prefill/package.nix
@@ -10,13 +10,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "steam-lancache-prefill";
-  version = "3.4.2";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "tpill90";
     repo = "steam-lancache-prefill";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FD7rC73VF+jhdCrSPKEillRXAi7jbY+h+oHi0Bpng3k=";
+    hash = "sha256-BDJB4kubcA9Uu84CubZ0uyKYwYWQYq+pBJa0t0q481Y=";
     fetchSubmodules = true;
   };
 

From b92ab834b4fee01c351b02750a869a6676944820 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 14:24:19 +0000
Subject: [PATCH 035/100] flyctl: 0.4.60 -> 0.4.63

---
 pkgs/by-name/fl/flyctl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fl/flyctl/package.nix b/pkgs/by-name/fl/flyctl/package.nix
index c4251bf2aecb..5890e1c2af06 100644
--- a/pkgs/by-name/fl/flyctl/package.nix
+++ b/pkgs/by-name/fl/flyctl/package.nix
@@ -12,7 +12,7 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.4.60";
+  version = "0.4.63";
 
   src = fetchFromGitHub {
     owner = "superfly";
@@ -22,11 +22,11 @@ buildGoModule rec {
       cd "$out"
       git rev-parse HEAD > COMMIT
     '';
-    hash = "sha256-ToKKn3Scj++VLv0SCMNQHkbffs2aADto0tLv80aFqzc=";
+    hash = "sha256-dGqL6lKx67VzlfHvaCpOTpHtFao99zLIYXiORPHP5e8=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-XBpLOhC3fY18o0tQZXgyKrQRgd84U5SRo6Rrgkuq4f8=";
+  vendorHash = "sha256-X6cEAaUIHTJoNwoBlGFZUA4M8/AnRY3oTiWW7/03PXY=";
 
   subPackages = [ "." ];
 

From e33da78d58d221d54809ea02369b6d652a48a04e Mon Sep 17 00:00:00 2001
From: temidaradev <temidaradev@proton.me>
Date: Wed, 1 Jul 2026 17:12:35 +0300
Subject: [PATCH 036/100] kopuz: 0.6.0 -> 0.8.2

---
 pkgs/by-name/ko/kopuz/package.nix | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ko/kopuz/package.nix b/pkgs/by-name/ko/kopuz/package.nix
index 4ec960fb4865..28fa8650215e 100644
--- a/pkgs/by-name/ko/kopuz/package.nix
+++ b/pkgs/by-name/ko/kopuz/package.nix
@@ -4,6 +4,7 @@
   rustPlatform,
   pkg-config,
   cmake,
+  git,
   openssl,
   tailwindcss_4,
   dioxus-cli,
@@ -20,28 +21,30 @@
   xdotool,
   wayland,
   dbus,
+  libayatana-appindicator,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "kopuz";
-  version = "0.6.0";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "Kopuz-org";
     repo = "kopuz";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+HT76hfgTEkEVV1wn2r97PshoRJ08r4fTrExmQDuymg=";
+    hash = "sha256-d6wSefvx2KT1EyhLq2pn9MSDtW+AvDj7WVz27MJeTmg=";
   };
 
-  cargoHash = "sha256-lTGrwN2CGbmOgrjjbqrizNWPQoxWrEbDkcjhjMergoE=";
+  cargoHash = "sha256-fr65eE8wFWtW/PT5ZACGMcNCo/QNo9xf39LVBQMGLVk=";
 
   nativeBuildInputs = [
     pkg-config
     cmake
     tailwindcss_4
     dioxus-cli
+    git
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     wrapGAppsHook3
@@ -60,12 +63,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     xdotool
     wayland
     dbus
+    libayatana-appindicator
   ];
 
   buildPhase = ''
     runHook preBuild
 
-    tailwindcss -i tailwind.css -o kopuz/assets/tailwind.css --minify
+    tailwindcss -i tailwind.css -o crates/kopuz/assets/tailwind.css --minify
 
     ${lib.optionalString stdenv.hostPlatform.isDarwin ''
             mkdir -p "$TMPDIR/fake-bin"
@@ -95,11 +99,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
           install -Dm644 data/com.temidaradev.kopuz.desktop \
             $out/share/applications/com.temidaradev.kopuz.desktop
           substituteInPlace $out/share/applications/com.temidaradev.kopuz.desktop \
+            --replace-fail "Exec=kopuz" "Exec=$out/bin/kopuz"
 
           install -Dm644 data/com.temidaradev.kopuz.metainfo.xml \
             $out/share/metainfo/com.temidaradev.kopuz.metainfo.xml
 
-          install -Dm644 kopuz/assets/logo.png \
+          install -Dm644 crates/kopuz/assets/logo.png \
             $out/share/icons/hicolor/256x256/apps/com.temidaradev.kopuz.png
         ''
       else
@@ -119,6 +124,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     gappsWrapperArgs+=(
       --chdir $out/bin
       --prefix PATH : ${lib.makeBinPath [ yt-dlp ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libayatana-appindicator ]}
     )
   '';
 

From 7c103644dc00a6fa7ae18e9046a1926524cb6ae7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 15:36:27 +0000
Subject: [PATCH 037/100] allure: 2.43.0 -> 2.44.0

---
 pkgs/by-name/al/allure/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/allure/package.nix b/pkgs/by-name/al/allure/package.nix
index 0c85aa04c277..3f265620777a 100644
--- a/pkgs/by-name/al/allure/package.nix
+++ b/pkgs/by-name/al/allure/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "allure";
-  version = "2.43.0";
+  version = "2.44.0";
 
   src = fetchurl {
     url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
-    hash = "sha256-Hrp4vTrtdPNSRpMVCdQKBg9v8He6VyhHiThGiPMQdsg=";
+    hash = "sha256-cCGpCCjADNbsmSAnzOSOipS9h/rUPQwtysR5XK3BeNc=";
   };
 
   dontConfigure = true;

From 912907b3fea99ff4474128c41d83fdac6f0096fb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 16:03:32 +0000
Subject: [PATCH 038/100] jfrog-cli: 2.109.0 -> 2.112.0

---
 pkgs/by-name/jf/jfrog-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/jf/jfrog-cli/package.nix b/pkgs/by-name/jf/jfrog-cli/package.nix
index 4c75f009fb03..e83bd5b6d3df 100644
--- a/pkgs/by-name/jf/jfrog-cli/package.nix
+++ b/pkgs/by-name/jf/jfrog-cli/package.nix
@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "jfrog-cli";
-  version = "2.109.0";
+  version = "2.112.0";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jzQNwNdqNMcwDf3RgEdS4ACUPDL3ujlkGD5kFuHRd8Q=";
+    hash = "sha256-jqzjkUbCwR+EMA4Zrb4rZHDsQWD4YimPVhHA2GcLNF8=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-lI24KDC31yQaUYe9uV7ZiQLzwROSaFh7M1J0B7k0iWI=";
+  vendorHash = "sha256-Bw2g9bfuG+IgItrRh85G9lyFZP8oXNXxkZTcvSy0WWA=";
 
   checkFlags = "-skip=^(TestReleaseBundle|TestVisibilitySendUsage_RtCurl_E2E)";
 

From 05c11f7e28c950f8dba447dfcf2d28381c008e86 Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Thu, 7 May 2026 00:54:59 +0200
Subject: [PATCH 039/100] =?UTF-8?q?paperless-ngx:=20rec=20=E2=86=92=20fina?=
 =?UTF-8?q?lAttrs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/pa/paperless-ngx/package.nix | 56 +++++++++++------------
 1 file changed, 27 insertions(+), 29 deletions(-)

diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 084331ade53a..0a5a27b8d686 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -31,15 +31,6 @@
 let
   pnpm = pnpm_10;
 
-  version = "2.20.15";
-
-  src = fetchFromGitHub {
-    owner = "paperless-ngx";
-    repo = "paperless-ngx";
-    tag = "v${version}";
-    hash = "sha256-Czh4Knel0IIHsTc3kEnp1153Kv+3721GRCbTYTkeCDg=";
-  };
-
   python = python3.override {
     self = python;
     packageOverrides = final: prev: {
@@ -73,15 +64,25 @@ let
     poppler-utils
   ];
 
-  frontend = stdenv.mkDerivation (finalAttrs: {
+  nltkDataDir = symlinkJoin {
+    name = "paperless_ngx_nltk_data";
+    paths = with nltk-data; [
+      punkt-tab
+      snowball-data
+      stopwords
+    ];
+  };
+in
+python.pkgs.buildPythonApplication (finalAttrs: let
+  frontend = stdenv.mkDerivation (feAttrs: {
     pname = "paperless-ngx-frontend";
-    inherit version;
+    version = finalAttrs.version;
 
-    src = src + "/src-ui";
+    src = finalAttrs.src + "/src-ui";
 
     pnpmDeps = fetchPnpmDeps {
       inherit pnpm;
-      inherit (finalAttrs) pname version src;
+      inherit (feAttrs) pname version src;
       fetcherVersion = 3;
       hash = "sha256-HO+IDNB3NXWgvV0cvZ5zx46JuXv6Tgroz+YfVump5MA=";
     };
@@ -139,21 +140,18 @@ let
       runHook postInstall
     '';
   });
-
-  nltkDataDir = symlinkJoin {
-    name = "paperless_ngx_nltk_data";
-    paths = with nltk-data; [
-      punkt-tab
-      snowball-data
-      stopwords
-    ];
-  };
-in
-python.pkgs.buildPythonApplication rec {
+in {
   pname = "paperless-ngx";
   pyproject = true;
 
-  inherit version src;
+  version = "2.20.15";
+
+  src = fetchFromGitHub {
+    owner = "paperless-ngx";
+    repo = "paperless-ngx";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Czh4Knel0IIHsTc3kEnp1153Kv+3721GRCbTYTkeCDg=";
+  };
 
   postPatch = ''
     # pytest-xdist with to many threads makes the tests flaky
@@ -266,7 +264,7 @@ python.pkgs.buildPythonApplication rec {
 
   installPhase =
     let
-      pythonPath = python.pkgs.makePythonPath dependencies;
+      pythonPath = python.pkgs.makePythonPath finalAttrs.passthru.dependencies;
     in
     ''
       runHook preInstall
@@ -319,7 +317,7 @@ python.pkgs.buildPythonApplication rec {
     export PATH="${path}:$PATH"
     export HOME=$(mktemp -d)
     export XDG_DATA_DIRS="${liberation_ttf}/share:$XDG_DATA_DIRS"
-    export PAPERLESS_NLTK_DIR=${passthru.nltkDataDir}
+    export PAPERLESS_NLTK_DIR=${finalAttrs.passthru.nltkDataDir}
     # Limit threads per worker based on NIX_BUILD_CORES, capped at 256
     # ocrmypdf has an internal limit of 256 jobs and will fail with more:
     # https://github.com/ocrmypdf/OCRmyPDF/blob/66308c281306302fac3470f587814c3b212d0c40/src/ocrmypdf/cli.py#L234
@@ -364,7 +362,7 @@ python.pkgs.buildPythonApplication rec {
   meta = {
     description = "Tool to scan, index, and archive all of your physical documents";
     homepage = "https://docs.paperless-ngx.com/";
-    changelog = "https://github.com/paperless-ngx/paperless-ngx/releases/tag/${src.tag}";
+    changelog = "https://github.com/paperless-ngx/paperless-ngx/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     platforms = lib.platforms.unix;
     mainProgram = "paperless-ngx";
@@ -374,4 +372,4 @@ python.pkgs.buildPythonApplication rec {
       erikarvstedt
     ];
   };
-}
+})

From e97a92dc4a3a2a48aafa9338ba7772b087c8ba76 Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Thu, 7 May 2026 00:55:54 +0200
Subject: [PATCH 040/100] paperless-ngx: make python overrides injectable

---
 pkgs/by-name/pa/paperless-ngx/package.nix | 36 +++++++++++++----------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 0a5a27b8d686..aecd4b129ac4 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -27,30 +27,36 @@
   symlinkJoin,
   nltk-data,
   lndir,
+  extraPythonPackageOverrides ? (_final: _prev: { }),
 }:
 let
   pnpm = pnpm_10;
 
-  python = python3.override {
-    self = python;
-    packageOverrides = final: prev: {
-      django = prev.django_5;
+  defaultPythonPackageOverrides = final: prev: {
+    django = prev.django_5;
 
-      fido2 = prev.fido2.overridePythonAttrs {
+    fido2 = prev.fido2.overridePythonAttrs {
+      version = "1.2.0";
+
+      src = fetchPypi {
+        pname = "fido2";
         version = "1.2.0";
-
-        src = fetchPypi {
-          pname = "fido2";
-          version = "1.2.0";
-          hash = "sha256-45+VkgEi1kKD/aXlWB2VogbnBPpChGv6RmL4aqDTMzs=";
-        };
-
-        pytestFlags = [ ];
+        hash = "sha256-45+VkgEi1kKD/aXlWB2VogbnBPpChGv6RmL4aqDTMzs=";
       };
 
-      # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
-      ocrmypdf = prev.ocrmypdf_16.override { tesseract = tesseract5; };
+      pytestFlags = [ ];
     };
+
+    # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
+    ocrmypdf = prev.ocrmypdf_16.override { tesseract = tesseract5; };
+  };
+
+  python = python3.override {
+    self = python;
+    packageOverrides = lib.composeManyExtensions [
+      defaultPythonPackageOverrides
+      extraPythonPackageOverrides
+    ];
   };
 
   path = lib.makeBinPath [

From 8a2621bf52fae65966e68b28c01b59a24d6008af Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Thu, 7 May 2026 00:56:15 +0200
Subject: [PATCH 041/100] paperless-ngx: add nix-update-script

---
 pkgs/by-name/pa/paperless-ngx/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index aecd4b129ac4..a9be728390f9 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -27,6 +27,7 @@
   symlinkJoin,
   nltk-data,
   lndir,
+  nix-update-script,
   extraPythonPackageOverrides ? (_final: _prev: { }),
 }:
 let
@@ -363,6 +364,12 @@ in {
       tesseract5
       ;
     tests = { inherit (nixosTests) paperless; };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "frontend"
+      ];
+    };
   };
 
   meta = {

From 8a2f69744c6cf67793393ef7c1798ac7d72c2579 Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Wed, 1 Jul 2026 19:05:37 +0200
Subject: [PATCH 042/100] doc/python: state benefit of fixed point arguments

drop rec and theoretical introduction
just state the pattern that should be used
---
 doc/languages-frameworks/python.section.md | 24 +++++-----------------
 1 file changed, 5 insertions(+), 19 deletions(-)

diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 957037b95f4f..809f397407a7 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -204,25 +204,9 @@ following are specific to `buildPythonPackage`:
 * `setupPyGlobalFlags ? []`: List of flags passed to `setup.py` command.
 * `setupPyBuildFlags ? []`: List of flags passed to `setup.py build_ext` command.
 
-##### Using fixed-point arguments {#buildpythonpackage-fixed-point-arguments}
+##### Writing override-compatible packages {#buildpythonpackage-fixed-point-arguments}
 
-Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
-This allows you to reference the final attributes of the derivation.
-
-Instead of using `rec`:
-
-```nix
-buildPythonPackage rec {
-  pname = "pyspread";
-  version = "2.4";
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-...";
-  };
-}
-```
-
-You can use the `finalAttrs` pattern:
+Use `finalAttrs` to make a package easy to update and override:
 
 ```nix
 buildPythonPackage (finalAttrs: {
@@ -236,7 +220,9 @@ buildPythonPackage (finalAttrs: {
 })
 ```
 
-See the [general documentation on fixed-point arguments](#chap-build-helpers-finalAttrs) for more details on the benefits of this pattern.
+When a downstream callsite *overrides* `version` the override becomes visible as `finalAttrs.version`.
+
+Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
 
 ::: {.note}
 

From ceedd293cac800dd69c2a325fe1224ef546dcdcd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 17:06:46 +0000
Subject: [PATCH 043/100] itgmaniaPackages.itgmania-unwrapped: 1.2.1 -> 1.3.0

---
 pkgs/by-name/it/itgmania/unwrapped.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/it/itgmania/unwrapped.nix b/pkgs/by-name/it/itgmania/unwrapped.nix
index f0d65de916e3..6eced844d6a9 100644
--- a/pkgs/by-name/it/itgmania/unwrapped.nix
+++ b/pkgs/by-name/it/itgmania/unwrapped.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "itgmania";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "itgmania";
     repo = "itgmania";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-bTABfTflWasuXvX+YPciUIICAFVROk/SgeClgrTUjkQ=";
+    hash = "sha256-dwalGEQFNhjuKwUBBskCHDYzmyjuf0r9TYM2ex8wzio=";
   };
 
   nativeBuildInputs = [

From f861d868b40af34abd08db09539953be3ba45e55 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 17:07:24 +0000
Subject: [PATCH 044/100] itgmaniaPackages.itg3encore: 0-unstable-2026-06-22 ->
 0-unstable-2026-06-28

---
 pkgs/by-name/it/itgmania/themes/itg3encore.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/it/itgmania/themes/itg3encore.nix b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
index ae675009a8f9..76c915a9be1f 100644
--- a/pkgs/by-name/it/itgmania/themes/itg3encore.nix
+++ b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "itg3encore";
-  version = "0-unstable-2026-06-22";
+  version = "0-unstable-2026-06-28";
 
   src = fetchFromGitHub {
     owner = "DarkBahamut162";
     repo = "itg3encore";
-    rev = "c669a04ce6487a32263a2f617efa26bfd5eaf764";
-    hash = "sha256-CbqIzHcHmxICoi23z032Ti8AZyB5Ur/SPsolr1VjBhY=";
+    rev = "408a726f31287bfe98144fa62f64abac5a4fbb92";
+    hash = "sha256-6MGbwkU8dppAs/mg6hA2jmDjrHU7sgITouUjKh92ozE=";
   };
 
   postInstall = ''

From a14a77f04913f752939806a031480a1c12d69fcd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 17:07:34 +0000
Subject: [PATCH 045/100] itgmaniaPackages.digital-dance:
 1.1.3-unstable-2026-06-22 -> 1.1.4-unstable-2026-06-30

---
 pkgs/by-name/it/itgmania/themes/digital-dance.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/it/itgmania/themes/digital-dance.nix b/pkgs/by-name/it/itgmania/themes/digital-dance.nix
index 7a502dc9f249..f7ecc099fc25 100644
--- a/pkgs/by-name/it/itgmania/themes/digital-dance.nix
+++ b/pkgs/by-name/it/itgmania/themes/digital-dance.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "digital-dance";
-  version = "1.1.3-unstable-2026-06-22";
+  version = "1.1.4-unstable-2026-06-30";
 
   src = fetchFromCodeberg {
     owner = "JNero";
     repo = "Digital-Dance-ITGMania";
-    rev = "14d3d31a4f79f1557e3515de41a7907130d7b163";
-    hash = "sha256-e/lOhwI+Q4sMn0EL5sPMhCaxoN6eOLVLBs7bMOPJUxY=";
+    rev = "90087bfd1182d1240f22e48fb348df52f784e799";
+    hash = "sha256-iZ3N1+epG8EF8H9KViI3fgtHeayxmWaumxkOOK9qK0c=";
   };
 
   postInstall = ''

From e244aaf7aac7f24259b3f7b816bb65529359434f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 19:33:39 +0200
Subject: [PATCH 046/100] python3Packages.deebot-client: update disabled

---
 pkgs/development/python-modules/deebot-client/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/deebot-client/default.nix b/pkgs/development/python-modules/deebot-client/default.nix
index 3db4e12e229e..2d0a0e2670e5 100644
--- a/pkgs/development/python-modules/deebot-client/default.nix
+++ b/pkgs/development/python-modules/deebot-client/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage (finalAttrs: {
   version = "18.4.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.13";
+  disabled = pythonOlder "3.14";
 
   src = fetchFromGitHub {
     owner = "DeebotUniverse";

From db055ea31360242007d159e19421754838159de7 Mon Sep 17 00:00:00 2001
From: damidoug <contact@damidoug.dev>
Date: Sun, 28 Jun 2026 13:59:51 +0200
Subject: [PATCH 047/100] gamemac: init at 0.8.328

---
 pkgs/by-name/ga/gamemac/package.nix | 50 +++++++++++++++++++++++++++++
 pkgs/by-name/ga/gamemac/update.sh   | 32 ++++++++++++++++++
 2 files changed, 82 insertions(+)
 create mode 100644 pkgs/by-name/ga/gamemac/package.nix
 create mode 100755 pkgs/by-name/ga/gamemac/update.sh

diff --git a/pkgs/by-name/ga/gamemac/package.nix b/pkgs/by-name/ga/gamemac/package.nix
new file mode 100644
index 000000000000..4e0bd43b621a
--- /dev/null
+++ b/pkgs/by-name/ga/gamemac/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  undmg,
+  makeWrapper,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "gamemac";
+  version = "0.8.328";
+
+  src = fetchurl {
+    name = "GameHub_en_${finalAttrs.version}.dmg";
+    url = "https://gamehub-cdn.masnet.cn/uploads/upgrade/20260618/b616a96780c249a789d95f7b897333cb.dmg";
+    hash = "sha256-uo/kr9PAFREfbkXX9hpJJNT6OZDv3jnOuZgc2fwtSyM=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    undmg
+    makeWrapper
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications" "$out/bin"
+    mv GameHub.app "$out/Applications/"
+    makeWrapper "$out/Applications/GameHub.app/Contents/MacOS/GameHub" "$out/bin/GameHub"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Play mobile games natively on macOS";
+    homepage = "https://www.gamemac.com/en/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ damidoug ];
+    mainProgram = "GameHub";
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/ga/gamemac/update.sh b/pkgs/by-name/ga/gamemac/update.sh
new file mode 100755
index 000000000000..e12550fcc7d6
--- /dev/null
+++ b/pkgs/by-name/ga/gamemac/update.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash curl gnused nix
+
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+ROLLING_URL="https://api-international-gamehub.xiaoji.com/game/download/mac/en"
+UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
+
+# Resolve rolling URL to stable CDN URL (strip query string)
+DIRECT_URL=$(curl -fsSL -A "$UA" -w "%{url_effective}" -o /dev/null "$ROLLING_URL")
+CDN_URL="${DIRECT_URL%%\?*}"
+
+# Extract version from CDN filename (e.g. .../GameHub_en_0.8.328.dmg)
+VERSION=$(basename "$CDN_URL" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
+
+CURRENT=$(grep 'version = ' package.nix | head -1 | grep -oE '"[0-9.]+"' | tr -d '"')
+if [ "$VERSION" = "$CURRENT" ]; then
+  echo "Already at $VERSION"
+  exit 0
+fi
+
+HASH=$(nix-prefetch-url --name "GameHub_en_${VERSION}.dmg" --type sha256 "$CDN_URL")
+SRI=$(nix-hash --to-sri --type sha256 "$HASH")
+
+sed -i \
+  -e "s|version = \"[^\"]*\"|version = \"$VERSION\"|" \
+  -e "s|https://gamehub-cdn\.masnet\.cn/uploads/upgrade/[^\"]*|$CDN_URL|" \
+  -e "s|hash = \"sha256-[^\"]*\"|hash = \"$SRI\"|" \
+  package.nix
+
+echo "Updated $CURRENT -> $VERSION"

From ac9e8e635ab96615086ccfb8d398b493446ea33e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 17:58:49 +0000
Subject: [PATCH 048/100] google-cloud-sql-proxy: 2.22.1 -> 2.23.0

---
 pkgs/by-name/go/google-cloud-sql-proxy/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/google-cloud-sql-proxy/package.nix b/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
index 6b89b0bad4cf..30e2d43c064e 100644
--- a/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
+++ b/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
@@ -7,18 +7,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "google-cloud-sql-proxy";
-  version = "2.22.1";
+  version = "2.23.0";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "cloud-sql-proxy";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-vTTYQ1D42X1L03EE9c5Xz/SCRE3wWROT/daY+f0vLPI=";
+    hash = "sha256-hCnwNSOu9aSdWC5Gtr0nytmQQnkMS6i84pICBrN2VVg=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-lOT9GpZk6Bv5P8kiyMR4j+aHOO0be4pW4WvVux8hpnQ=";
+  vendorHash = "sha256-bM8BEdq5EY5RtsCNkRNTsc9dGgAEZkGHcUOip2LwKik=";
 
   checkFlags = [
     "-short"

From 86d3e4465e9df8e5bbc94d84b312e1dd2f77d41c Mon Sep 17 00:00:00 2001
From: Oleksii Filonenko <github@brightone.cloud>
Date: Wed, 1 Jul 2026 19:22:46 +0100
Subject: [PATCH 049/100] zennotes-desktop: 2.3.0 -> 2.8.0

Changelog: https://github.com/ZenNotes/zennotes/releases/tag/v2.8.0
---
 pkgs/by-name/ze/zennotes-desktop/package.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ze/zennotes-desktop/package.nix b/pkgs/by-name/ze/zennotes-desktop/package.nix
index 1a43598fbd3a..4264cd2d426c 100644
--- a/pkgs/by-name/ze/zennotes-desktop/package.nix
+++ b/pkgs/by-name/ze/zennotes-desktop/package.nix
@@ -13,14 +13,14 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "zennotes-desktop";
-  version = "2.3.0";
-  npmDepsHash = "sha256-7IpGnxVjaJvfSZyKjOylGMhFqa1bx8Ry5O1yqYfNnCE=";
+  version = "2.8.0";
+  npmDepsHash = "sha256-4YEBo/8HIMcvlj36ACv5r9iN995/QX2mc6vwTZh4AV8=";
 
   src = fetchFromGitHub {
     owner = "ZenNotes";
     repo = "zennotes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+tLPVnnMbtMa5blSwHav9ZMlnkUsrdG62mMGxhbmy6g=";
+    hash = "sha256-cVFiL1SNMmLZQyce83hNbE7NLuTPIQqNhDaeiUkK+mo=";
   };
 
   npmWorkspace = "apps/desktop";
@@ -86,7 +86,10 @@ buildNpmPackage (finalAttrs: {
     homepage = "https://zennotes.org/";
     changelog = "https://github.com/ZenNotes/zennotes/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ justkrysteq ];
+    maintainers = with lib.maintainers; [
+      justkrysteq
+      Br1ght0ne
+    ];
     mainProgram = "zennotes-desktop";
     platforms = lib.platforms.darwin ++ lib.platforms.linux;
   };

From cdbe58fd8b72df37c4692204a8cc870ff5d3738d Mon Sep 17 00:00:00 2001
From: "Peter H. Hoeg" <peter@hoeg.com>
Date: Wed, 1 Jul 2026 20:29:26 +0200
Subject: [PATCH 050/100] kdePackages.plasma-bigscreen: missing cec dep

---
 pkgs/kde/plasma/plasma-bigscreen/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/kde/plasma/plasma-bigscreen/default.nix b/pkgs/kde/plasma/plasma-bigscreen/default.nix
index 311a6e33a498..f6134e521251 100644
--- a/pkgs/kde/plasma/plasma-bigscreen/default.nix
+++ b/pkgs/kde/plasma/plasma-bigscreen/default.nix
@@ -1,9 +1,11 @@
 {
+  lib,
   mkKdeDerivation,
   plasma-workspace,
   pkg-config,
   qtwebengine,
   libcec,
+  libcec_platform,
   sdl3,
 }:
 
@@ -19,7 +21,7 @@ mkKdeDerivation {
   '';
 
   extraCmakeFlags = [
-    "-DQT_FIND_PRIVATE_MODULES=ON"
+    (lib.cmakeBool "QT_FIND_PRIVATE_MODULES" true)
   ];
 
   extraNativeBuildInputs = [
@@ -30,6 +32,7 @@ mkKdeDerivation {
     qtwebengine
 
     libcec
+    libcec_platform
     sdl3
   ];
 

From c2cb8bc9e35be81620ac308cbdc0f5829ee2e39e Mon Sep 17 00:00:00 2001
From: Sam Pointon <sampointon@gmail.com>
Date: Tue, 16 Jun 2026 12:39:45 +0100
Subject: [PATCH 051/100] wasilibc: 27 -> 32, clean up, modernise

---
 .../wasilibc/0000-relax-version-bounds.patch  | 39 +++++++++
 pkgs/by-name/wa/wasilibc/package.nix          | 82 +++++++++++--------
 2 files changed, 86 insertions(+), 35 deletions(-)
 create mode 100644 pkgs/by-name/wa/wasilibc/0000-relax-version-bounds.patch

diff --git a/pkgs/by-name/wa/wasilibc/0000-relax-version-bounds.patch b/pkgs/by-name/wa/wasilibc/0000-relax-version-bounds.patch
new file mode 100644
index 000000000000..3a11547a763e
--- /dev/null
+++ b/pkgs/by-name/wa/wasilibc/0000-relax-version-bounds.patch
@@ -0,0 +1,39 @@
+Commit ID: bf0251709e0440ff00036298d94177a72382979d
+Change ID: nukukykqkzqunwukokzxwlxrpxptuwzm
+Author   : Sam Pointon <sampointon@gmail.com> (2026-06-17 09:26:00)
+Committer: Sam Pointon <sampointon@gmail.com> (2026-06-17 09:27:26)
+
+    Relax strict version bounds on tools
+
+    Nixpkgs has more recent versions of these, and they work fine.
+
+diff --git a/cmake/bindings.cmake b/cmake/bindings.cmake
+index a629ecd006..14fdb8aed3 100644
+--- a/cmake/bindings.cmake
++++ b/cmake/bindings.cmake
+@@ -15,10 +15,6 @@
+     OUTPUT_VARIABLE WIT_BINDGEN_VERSION
+     OUTPUT_STRIP_TRAILING_WHITESPACE)
+ 
+-  if (NOT (WIT_BINDGEN_VERSION MATCHES "0\\.53\\.1"))
+-    message(WARNING "wit-bindgen version 0.53.1 is required, found: ${WIT_BINDGEN_VERSION}")
+-    set(WIT_BINDGEN_EXECUTABLE "")
+-  endif()
+ endif()
+ 
+ if (NOT WIT_BINDGEN_EXECUTABLE)
+diff --git a/cmake/wasi-wits.cmake b/cmake/wasi-wits.cmake
+index e21ab0258d..d72ed9bcc2 100644
+--- a/cmake/wasi-wits.cmake
++++ b/cmake/wasi-wits.cmake
+@@ -12,10 +12,6 @@
+     OUTPUT_VARIABLE WKG_VERSION
+     OUTPUT_STRIP_TRAILING_WHITESPACE)
+ 
+-  if (NOT (WKG_VERSION MATCHES "0\\.13\\.0"))
+-    message(WARNING "wkg version 0.13.0 is required, found: ${WKG_VERSION}")
+-    set(WKG_EXECUTABLE "")
+-  endif()
+ endif()
+ 
+ if (NOT WKG_EXECUTABLE)
diff --git a/pkgs/by-name/wa/wasilibc/package.nix b/pkgs/by-name/wa/wasilibc/package.nix
index 1745a80f2916..a33bdb040e25 100644
--- a/pkgs/by-name/wa/wasilibc/package.nix
+++ b/pkgs/by-name/wa/wasilibc/package.nix
@@ -1,24 +1,45 @@
 {
   stdenvNoLibc,
+  cmake,
   fetchFromGitHub,
   lib,
+  lld,
+  llvmPackages,
+  ninja,
+  wasm-tools,
+  wit-bindgen,
+  wkg,
   firefox-unwrapped,
   firefox-esr-unwrapped,
-  enablePosixThreads ? false,
 }:
 
 stdenvNoLibc.mkDerivation (finalAttrs: {
   pname = "wasilibc";
-  version = "27";
+  version = "32";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "wasi-libc";
     tag = "wasi-sdk-${finalAttrs.version}";
-    hash = "sha256-RIjph1XdYc1aGywKks5JApcLajbNFEuWm+Wy/GMHddg=";
+    hash = "sha256-iP/SFYvO8zQMwwbY4VvIboO+Kx195L9brpMq8cbsA7c=";
     fetchSubmodules = true;
   };
 
+  patches = [
+    ./0000-relax-version-bounds.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    lld
+    ninja
+    wasm-tools
+    wit-bindgen
+    wkg
+  ];
+
   # These flags break pkgsCross.wasi32.llvmPackages.libcxx
   hardeningDisable = [
     "libcxxhardeningfast"
@@ -28,45 +49,36 @@ stdenvNoLibc.mkDerivation (finalAttrs: {
   outputs = [
     "out"
     "dev"
-    "share"
   ];
 
-  # clang-13: error: argument unused during compilation: '-rtlib=compiler-rt' [-Werror,-Wunused-command-line-argument]
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace "-Werror" ""
-    patchShebangs scripts/
-  '';
-
-  preBuild = ''
-    export SYSROOT_LIB=${placeholder "out"}/lib
-    export SYSROOT_INC=${placeholder "dev"}/include
-    export SYSROOT_SHARE=${placeholder "share"}/share
-    mkdir -p "$SYSROOT_LIB" "$SYSROOT_INC" "$SYSROOT_SHARE"
-    makeFlagsArray+=(
-      "SYSROOT_LIB:=$SYSROOT_LIB"
-      "SYSROOT_INC:=$SYSROOT_INC"
-      "SYSROOT_SHARE:=$SYSROOT_SHARE"
-      "TARGET_TRIPLE:=${stdenvNoLibc.system}"
-      ${lib.strings.optionalString enablePosixThreads "THREAD_MODEL:=posix"}
-    )
-  '';
+  cmakeFlags = [
+    (lib.cmakeFeature "BUILTINS_LIB" "${llvmPackages.compiler-rt}/lib/${stdenvNoLibc.targetPlatform.parsed.kernel.name}/libclang_rt.builtins-wasm32.a")
+    #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
+    (lib.cmakeFeature "CMAKE_TRY_COMPILE_TARGET_TYPE" "STATIC_LIBRARY")
+    (lib.cmakeFeature "TARGET_TRIPLE" stdenvNoLibc.system)
+    # clang already knows to use wasm-component-ld to link
+    (lib.cmakeFeature "USE_WASM_COMPONENT_LD" "OFF")
+  ];
 
   enableParallelBuilding = true;
 
-  # We just build right into the install paths, per the `preBuild`.
-  dontInstall = true;
+  preFixup =
+    lib.optionalString (stdenvNoLibc.system != stdenvNoLibc.targetPlatform.rust.rustcTargetSpec)
+      ''
+        ln -s $out/lib/${stdenvNoLibc.system} $out/lib/${stdenvNoLibc.targetPlatform.rust.rustcTargetSpec}
+      '';
 
-  preFixup = ''
-    ln -s $share/share/undefined-symbols.txt $out/lib/wasi.imports
-    ln -s $out/lib $out/lib/${stdenvNoLibc.system}
-  ''
-  + lib.optionalString (stdenvNoLibc.system != stdenvNoLibc.targetPlatform.rust.rustcTargetSpec) ''
-    ln -s $out/lib $out/lib/${stdenvNoLibc.targetPlatform.rust.rustcTargetSpec}
-  '';
+  # TODO: run wasilibc tests. Nixpkgs never runs the check phase during cross compiles
+  # (sensibly), but this package is always cross compiled due to its nature, and the tests
+  # expect to be run in a cross-compilation environment. There are instructions on how to run
+  # them but I don't understand enough about Nixpkgs' CMake set-up to work out how to apply them.
 
-  passthru.tests = {
-    inherit firefox-unwrapped firefox-esr-unwrapped;
+  passthru = {
+    incdir = "/include/${stdenvNoLibc.system}";
+    libdir = "/lib/${stdenvNoLibc.system}";
+    tests = {
+      inherit firefox-unwrapped firefox-esr-unwrapped;
+    };
   };
 
   meta = {

From 37bc783497a811bae3f6cd524a76adff0735ed8d Mon Sep 17 00:00:00 2001
From: Sam Pointon <sampointon@gmail.com>
Date: Tue, 30 Jun 2026 17:32:00 +0100
Subject: [PATCH 052/100] wasilibc: re-enable hardening options

These were disabled in https://github.com/NixOS/nixpkgs/pull/455043,
but, with the wasilibc bump, are no longer needed to build libcxx.
---
 pkgs/by-name/wa/wasilibc/package.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/by-name/wa/wasilibc/package.nix b/pkgs/by-name/wa/wasilibc/package.nix
index a33bdb040e25..a9dcd85aed88 100644
--- a/pkgs/by-name/wa/wasilibc/package.nix
+++ b/pkgs/by-name/wa/wasilibc/package.nix
@@ -40,12 +40,6 @@ stdenvNoLibc.mkDerivation (finalAttrs: {
     wkg
   ];
 
-  # These flags break pkgsCross.wasi32.llvmPackages.libcxx
-  hardeningDisable = [
-    "libcxxhardeningfast"
-    "libcxxhardeningextensive"
-  ];
-
   outputs = [
     "out"
     "dev"

From 2ed1be538e3b18b8c924cbe0b1900ba104b4a66f Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Fri, 15 May 2026 17:55:13 +0200
Subject: [PATCH 053/100] nixos/tinc: chown the network state directory itself

The preStart chowned `hosts/` and `invitations/` to `tinc-<network>`
but left `/etc/tinc/<network>/` itself owned by root (or a stale UID
after a `tinc-<network>` UID reassignment). Fine while tinc 1.0 only
read config there, but tinc 1.1+ and tincr write a per-peer address
bootstrap cache into the network directory, so the daemon needs to
write it. When it can't, the save fails (tincr logs "Permission
denied", tinc 1.1pre18 swallows it), the cache stays empty and
reconnects fall back to DNS instead of the last-known IP.

Chown the network directory alongside hosts/ and invitations/. Use a
single `install -d` so existing directories with a stale owner get
fixed too, which plain `mkdir -p` would skip.

Assisted-by: Claude Code (claude-opus-4-7)
---
 nixos/modules/services/networking/tinc.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index e082214b5eca..22398f2ff5b0 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -421,10 +421,7 @@ in
               ExecStart = "${data.package}/bin/tincd -D -U tinc-${network} -n ${network} ${optionalString (data.chroot) "-R"} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}";
             };
             preStart = ''
-              mkdir -p /etc/tinc/${network}/hosts
-              chown tinc-${network} /etc/tinc/${network}/hosts
-              mkdir -p /etc/tinc/${network}/invitations
-              chown tinc-${network} /etc/tinc/${network}/invitations
+              install -d -o tinc-${network} /etc/tinc/${network} /etc/tinc/${network}/hosts /etc/tinc/${network}/invitations
 
               # Determine how we should generate our keys
               if type tinc >/dev/null 2>&1; then

From df54a0c2970d677c359f61a2e719caa322392e08 Mon Sep 17 00:00:00 2001
From: AsciiMoth <ascii@moth.contact>
Date: Mon, 2 Mar 2026 21:52:51 +0400
Subject: [PATCH 054/100] aaa: 1.1.1 -> 2.1.0

---
 pkgs/by-name/aa/aaa/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/aa/aaa/package.nix b/pkgs/by-name/aa/aaa/package.nix
index b9c5e18dc0d7..64bf894ee5a4 100644
--- a/pkgs/by-name/aa/aaa/package.nix
+++ b/pkgs/by-name/aa/aaa/package.nix
@@ -6,19 +6,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aaa";
-  version = "1.1.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "asciimoth";
     repo = "aaa";
-    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-gIOlPjZOcmVLi9oOn4gBv6F+3Eq6t5b/3fKzoFqxclw=";
+    tag = "${finalAttrs.version}";
+    sha256 = "sha256-z8PXkX6Bh3oD8tRf+tsLJHbx5wIz2mBYhJSEL88hBDc=";
   };
 
-  cargoHash = "sha256-CHX+Ugy4ND36cpxNEFpnqid6ALHMPXmfXi+D4aktPRk=";
+  cargoHash = "sha256-dt3nbVS8i075O8m9x+FsDi3VeihVKVIV0wnPqyYUaIk=";
 
   meta = {
-    description = "Terminal viewer for 3a format";
+    description = "Swiss Army knife for animated ascii art";
     homepage = "https://github.com/asciimoth/aaa";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ asciimoth ];

From 31876af59c9cc71384dcd74571e047de96094171 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 18:58:52 +0000
Subject: [PATCH 055/100] python3Packages.pyhomee: 1.4.0 -> 1.4.1

---
 pkgs/development/python-modules/pyhomee/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyhomee/default.nix b/pkgs/development/python-modules/pyhomee/default.nix
index e2f91641c678..89393645b849 100644
--- a/pkgs/development/python-modules/pyhomee/default.nix
+++ b/pkgs/development/python-modules/pyhomee/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyhomee";
-  version = "1.4.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Taraman17";
     repo = "pyHomee";
     tag = "v${version}";
-    hash = "sha256-kFsg1abnH9aL5dwSNwQ1WHPdZ6EApc48j8si92kR8ts=";
+    hash = "sha256-SH31V/9Z1fw63K7SLQeBQcpQ0DnDVOrngggBNsG5Kk4=";
   };
 
   build-system = [ setuptools ];

From 1acf7f6f3eb8bc96351c239d3863083690ba90fd Mon Sep 17 00:00:00 2001
From: Mauricio Collares <mauricio@collares.org>
Date: Wed, 1 Jul 2026 15:28:42 -0300
Subject: [PATCH 056/100] sage: tweak cpu threshold to decrease test flakiness

---
 .../patches/lower-sleep2-test-threshold.patch | 32 +++++++++++++++++++
 pkgs/by-name/sa/sage/sage-src.nix             |  3 ++
 2 files changed, 35 insertions(+)
 create mode 100644 pkgs/by-name/sa/sage/patches/lower-sleep2-test-threshold.patch

diff --git a/pkgs/by-name/sa/sage/patches/lower-sleep2-test-threshold.patch b/pkgs/by-name/sa/sage/patches/lower-sleep2-test-threshold.patch
new file mode 100644
index 000000000000..1ac7f5571baf
--- /dev/null
+++ b/pkgs/by-name/sa/sage/patches/lower-sleep2-test-threshold.patch
@@ -0,0 +1,32 @@
+diff --git a/src/sage/doctest/test.py b/src/sage/doctest/test.py
+index 812f8167c12..a4822642f0c 100644
+--- a/src/sage/doctest/test.py
++++ b/src/sage/doctest/test.py
+@@ -49,11 +49,11 @@ Check that :issue:`2235` has been fixed::
+ 
+ Check slow doctest warnings are correctly raised::
+ 
+-    sage: subprocess.call(["python3", "-m", "sage.doctest", "--warn-long",     # long time
++    sage: subprocess.call(["python3", "-m", "sage.doctest", "--warn-long", "0.2",     # long time
+     ....:       "--random-seed=0", "--optional=sage", "sleep2.rst"], **kwds)
+     Running doctests...
+     Doctesting 1 file.
+-    ... --warn-long --random-seed=0 sleep2.rst
++    ... --warn-long 0.2 --random-seed=0 sleep2.rst
+     **********************************************************************
+     File "sleep2.rst", line 4, in sage.doctest.tests.sleep2
+     Warning: slow doctest:
+@@ -66,11 +66,11 @@ Check slow doctest warnings are correctly raised::
+     ----------------------------------------------------------------------
+     ...
+     0
+-    sage: subprocess.call(["python3", "-m", "sage.doctest", "--format=github", "--warn-long",     # long time
++    sage: subprocess.call(["python3", "-m", "sage.doctest", "--format=github", "--warn-long", "0.2",    # long time
+     ....:       "--random-seed=0", "--optional=sage", "sleep2.rst"], **kwds)
+     Running doctests...
+     Doctesting 1 file.
+-    ... --warn-long --random-seed=0 sleep2.rst
++    ... --warn-long 0.2 --random-seed=0 sleep2.rst
+     **********************************************************************
+     ::warning title=Warning: slow doctest:,file=sleep2.rst,line=4::slow doctest:: Test ran for ...s cpu, ...s wall%0ACheck ran for ...s cpu, ...s wall%0A
+         while walltime(t) < 2: pass
diff --git a/pkgs/by-name/sa/sage/sage-src.nix b/pkgs/by-name/sa/sage/sage-src.nix
index eae82d4c9d6e..7362bf8f3897 100644
--- a/pkgs/by-name/sa/sage/sage-src.nix
+++ b/pkgs/by-name/sa/sage/sage-src.nix
@@ -78,6 +78,9 @@ stdenv.mkDerivation rec {
     # a more conservative version of https://github.com/sagemath/sage/pull/37951
     ./patches/gap-element-crash.patch
 
+    # https://github.com/sagemath/sage/issues/42473
+    ./patches/lower-sleep2-test-threshold.patch
+
     # https://github.com/sagemath/sage/pull/42009, landed in 10.10.beta0
     (fetchpatch2 {
       name = "gap-root-paths.patch";

From 73f14bddfff4a5ad01fcc76042a06be08a2cc21a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 19:28:41 +0000
Subject: [PATCH 057/100] tofu-ls: 0.5.0 -> 0.5.1

---
 pkgs/by-name/to/tofu-ls/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/to/tofu-ls/package.nix b/pkgs/by-name/to/tofu-ls/package.nix
index 00c2ba918d7a..e881984bea59 100644
--- a/pkgs/by-name/to/tofu-ls/package.nix
+++ b/pkgs/by-name/to/tofu-ls/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "tofu-ls";
-  version = "0.5.0";
+  version = "0.5.1";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
     owner = "opentofu";
     repo = "tofu-ls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v6oqCRsiTAOGqhVZD6Zwhq0/bSl55PhH9+aEYxjlQcA=";
+    hash = "sha256-lmTvFtgXV8u4GNR3Bof+bfLMoq+luFdT1YeQq7ooLg8=";
   };
 
-  vendorHash = "sha256-vugyEaOD7diOiymo9nDEfIez++mPYWq1qVj3a9wCqoc=";
+  vendorHash = "sha256-+yG4Tz29NJ3m2is0ERMqW8vC/HJv4uudyDg9KSA/z/o=";
 
   ldflags = [
     "-s"

From 9800cfc08b24d54beab6b987de7905c671699c89 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <mweinelt@users.noreply.github.com>
Date: Wed, 1 Jul 2026 21:33:59 +0200
Subject: [PATCH 058/100] Revert "ctranslate2: don't set default nvcc arch
 flags"

---
 pkgs/by-name/ct/ctranslate2/package.nix | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/pkgs/by-name/ct/ctranslate2/package.nix b/pkgs/by-name/ct/ctranslate2/package.nix
index 35e175647aaf..812a6d88286f 100644
--- a/pkgs/by-name/ct/ctranslate2/package.nix
+++ b/pkgs/by-name/ct/ctranslate2/package.nix
@@ -51,13 +51,6 @@ stdenv'.mkDerivation (finalAttrs: {
         'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)'
 
     sed -e '1i #include <cstdint>' -i third_party/cxxopts/include/cxxopts.hpp
-
-    # Prevent setting the default nvcc arch flags, which can be
-    # ones that don't work with the current CUDA version
-    substituteInPlace CMakeLists.txt \
-      --replace-fail \
-        'list(APPEND CUDA_NVCC_FLAGS ''${ARCH_FLAGS})' \
-        ""
   '';
 
   nativeBuildInputs = [

From f339648a1d9fa28176ae16ce9b9456025a690fec Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 19:38:08 +0000
Subject: [PATCH 059/100] bitcomet: 2.19.2 -> 2.21.2

---
 pkgs/by-name/bi/bitcomet/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bi/bitcomet/package.nix b/pkgs/by-name/bi/bitcomet/package.nix
index 515c995451b9..bbcd2a03bc74 100644
--- a/pkgs/by-name/bi/bitcomet/package.nix
+++ b/pkgs/by-name/bi/bitcomet/package.nix
@@ -13,7 +13,7 @@
 
 let
   pname = "bitcomet";
-  version = "2.19.2";
+  version = "2.21.2";
 
   meta = {
     homepage = "https://www.bitcomet.com";
@@ -45,8 +45,8 @@ let
       fetchurl {
         url = "https://download.bitcomet.com/linux/${arch}/BitComet-${version}-${arch}.deb";
         hash = selectSystem {
-          x86_64-linux = "sha256-26hpKNCetqV0whfzNo950EAmK+LKC1RsN5f/9HU9zKs=";
-          aarch64-linux = "sha256-VrrjQ4dcj0XL2xmNspo2mJ+3BVy9vKyVw6QaHkha0LY=";
+          x86_64-linux = "sha256-qHPr4G921W1Pl7n0Wv98yLRbsAkJBrOcyg9kHHjtBGc=";
+          aarch64-linux = "sha256-VC/dvAGmhqlmZT5XB41x/fTGvMZjYCuz/tSp9MYFUHo=";
         };
       };
 

From f71b8a5c7d25f082f96687e56ae1b54723a2437f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 1 Jul 2026 22:05:23 +0200
Subject: [PATCH 060/100] python3Packages.pillow: 12.2.0 -> 12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Fixes:
CVE-2026-55798, CVE-2026-54059, CVE-2026-54060, CVE-2026-55379,
CVE-2026-55380
---
 pkgs/development/python-modules/pillow/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index e2c0b2eb75ad..e19a87b695eb 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "pillow";
-  version = "12.2.0";
+  version = "12.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-pillow";
     repo = "pillow";
     tag = version;
-    hash = "sha256-7w6FbZLTAoUMvLtSPvafk3wSRv8TrkAAfgZ/dfu3HpA=";
+    hash = "sha256-kmUlgR+f75Y8DAKKPdEbchLLgg0m95oyVP53WTQni88=";
   };
 
   build-system = [

From 11c76393b7a4cec2f7f535604d558418229b1837 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 1 Jul 2026 15:12:37 +0000
Subject: [PATCH 061/100] python3Packages.torchsnapshot: use finalAttrs

---
 pkgs/development/python-modules/torchsnapshot/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/torchsnapshot/default.nix b/pkgs/development/python-modules/torchsnapshot/default.nix
index 017494ba6ff5..1d90101eb231 100644
--- a/pkgs/development/python-modules/torchsnapshot/default.nix
+++ b/pkgs/development/python-modules/torchsnapshot/default.nix
@@ -21,7 +21,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "torchsnapshot";
   version = "0.1.0";
   pyproject = true;
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "torchsnapshot";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-F8OaxLH8BL6MPNLFv1hBuVmeEdnEQ5w2Qny6by1wP6k=";
   };
 
@@ -74,7 +74,7 @@ buildPythonPackage rec {
   meta = {
     description = "Performant, memory-efficient checkpointing library for PyTorch applications, designed with large, complex distributed workloads in mind";
     homepage = "https://github.com/pytorch/torchsnapshot/";
-    changelog = "https://github.com/pytorch/torchsnapshot/releases/tag/${version}";
+    changelog = "https://github.com/pytorch/torchsnapshot/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ GaetanLepage ];
     badPlatforms = [
@@ -82,4 +82,4 @@ buildPythonPackage rec {
       lib.systems.inspect.patterns.isDarwin
     ];
   };
-}
+})

From 59170b8937b60ff2baf1b00208fff3e5e8f4960b Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 1 Jul 2026 15:09:36 +0000
Subject: [PATCH 062/100] python3Packages.torchsnapshot: cleanup, add missing
 dependency

---
 pkgs/development/python-modules/torchsnapshot/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/torchsnapshot/default.nix b/pkgs/development/python-modules/torchsnapshot/default.nix
index 1d90101eb231..154e10b15dd2 100644
--- a/pkgs/development/python-modules/torchsnapshot/default.nix
+++ b/pkgs/development/python-modules/torchsnapshot/default.nix
@@ -11,6 +11,7 @@
   aiohttp,
   importlib-metadata,
   nest-asyncio,
+  numpy,
   psutil,
   pyyaml,
   torch,
@@ -52,6 +53,7 @@ buildPythonPackage (finalAttrs: {
     aiohttp
     importlib-metadata
     nest-asyncio
+    numpy
     psutil
     pyyaml
     torch

From d454b8b972e51720607c102bd17ff631ae4117f2 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 1 Jul 2026 20:21:13 +0000
Subject: [PATCH 063/100] python3Packages.torchsnapshot: enable
 __structuredAttrs

---
 pkgs/development/python-modules/torchsnapshot/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/torchsnapshot/default.nix b/pkgs/development/python-modules/torchsnapshot/default.nix
index 154e10b15dd2..701edf400d0d 100644
--- a/pkgs/development/python-modules/torchsnapshot/default.nix
+++ b/pkgs/development/python-modules/torchsnapshot/default.nix
@@ -26,6 +26,7 @@ buildPythonPackage (finalAttrs: {
   pname = "torchsnapshot";
   version = "0.1.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "pytorch";

From 34b8c9eb3320273925c5d5ae57dd5f6ec43fa7ce Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 1 Jul 2026 09:40:07 +0000
Subject: [PATCH 064/100] python3Packages.torchtune: 0.6.2-unstable-2026-02-19
 -> 0.6.1-unstable-2026-04-23

---
 .../python-modules/torchtune/default.nix      | 65 ++++++++++++++++++-
 1 file changed, 62 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/torchtune/default.nix b/pkgs/development/python-modules/torchtune/default.nix
index 04e344e4195a..b6ec79556151 100644
--- a/pkgs/development/python-modules/torchtune/default.nix
+++ b/pkgs/development/python-modules/torchtune/default.nix
@@ -28,29 +28,82 @@
 
   # tests
   comet-ml,
+  expecttest,
   mlflow,
   pytest-integration,
   pytest-mock,
   pytestCheckHook,
+  tensorboard,
   writableTmpDirAsHomeHook,
+
+  # passthru
+  nix-update-script,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "torchtune";
-  version = "0.6.2-unstable-2026-02-19";
+  version = "0.6.1-unstable-2026-04-23";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "meta-pytorch";
     repo = "torchtune";
-    rev = "6f2aa7254458145f99d7004cbd6ebc8e53a06404";
-    hash = "sha256-ryR5iO3IwkoLdMLSFGhHCLl0P8yD+GQdZFEE6M/EYh0=";
+    rev = "bd2a0fc7c31430972728494fa01aaeeb0ebf1ba1";
+    hash = "sha256-6jE8+ZCm46qyoSOCkBjxsXNvtVEOUP6v3NEmMh+ocl8=";
   };
 
+  postPatch = ''
+    substituteInPlace \
+      tests/torchtune/modules/low_precision/test_nf4_dispatch_registration.py \
+      torchtune/modules/low_precision/_register_nf4_dispatch_ops.py \
+      torchtune/modules/low_precision/nf4_linear.py \
+      torchtune/modules/peft/dora.py \
+      torchtune/modules/peft/lora.py \
+      --replace-fail \
+        "from torchao.quantization import to_nf4" \
+        "from torchao.dtypes import to_nf4" \
+
+    substituteInPlace \
+      tests/torchtune/models/llama2/test_lora_llama2.py \
+      tests/torchtune/models/phi3/test_lora_phi3.py \
+      tests/torchtune/modules/low_precision/test_nf4_linear.py \
+      tests/torchtune/training/test_distributed.py \
+      torchtune/modules/common_utils.py \
+      torchtune/training/_activation_offloading.py \
+      --replace-fail \
+        "from torchao.quantization import NF4Tensor" \
+        "from torchao.dtypes.nf4tensor import NF4Tensor"
+
+    substituteInPlace \
+      tests/torchtune/modules/peft/test_dora.py \
+      tests/torchtune/modules/peft/test_lora.py \
+      torchtune/training/_distributed.py \
+      --replace-fail \
+        "from torchao.quantization import NF4Tensor, to_nf4" \
+        "from torchao.dtypes.nf4tensor import NF4Tensor, to_nf4"
+
+    substituteInPlace \
+      torchtune/modules/low_precision/nf4_linear.py \
+      torchtune/modules/peft/dora.py \
+      torchtune/modules/peft/lora.py \
+      --replace-fail \
+        "from torchao.quantization.quantize_.workflows.nf4.nf4_tensor import linear_nf4" \
+        "from torchao.dtypes.nf4tensor import linear_nf4"
+
+    substituteInPlace torchtune/modules/low_precision/_register_nf4_dispatch_ops.py \
+      --replace-fail \
+        "from torchao.quantization.quantize_.workflows.nf4.nf4_tensor import implements as nf4_tensor_impl" \
+        "from torchao.dtypes.nf4tensor import implements as nf4_tensor_impl"
+  '';
+
   build-system = [
     setuptools
   ];
 
+  pythonRelaxDeps = [
+    "pyarrow"
+  ];
   dependencies = [
     blobfile
     datasets
@@ -77,10 +130,12 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     comet-ml
+    expecttest
     mlflow
     pytest-integration
     pytest-mock
     pytestCheckHook
+    tensorboard
     writableTmpDirAsHomeHook
   ];
 
@@ -157,6 +212,10 @@ buildPythonPackage (finalAttrs: {
     "tests/torchtune/utils"
   ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
   meta = {
     description = "PyTorch native post-training library";
     homepage = "https://github.com/meta-pytorch/torchtune";

From 891b3c13a49a57795904cf910ba04a35c314196f Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 1 Jul 2026 20:44:10 +0000
Subject: [PATCH 065/100] python3Packages.torchsnapshot: skip failing test on
 aarch64-linux

---
 pkgs/development/python-modules/torchsnapshot/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/torchsnapshot/default.nix b/pkgs/development/python-modules/torchsnapshot/default.nix
index 701edf400d0d..abef8ccc4f34 100644
--- a/pkgs/development/python-modules/torchsnapshot/default.nix
+++ b/pkgs/development/python-modules/torchsnapshot/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -72,6 +73,11 @@ buildPythonPackage (finalAttrs: {
     # torch.distributed.elastic.multiprocessing.errors.ChildFailedError:
     # AssertionError: "Socket Timeout" does not match "wait timeout after 5000ms
     "test_linear_barrier_timeout"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox:
+    # RuntimeError: Failed to initialize cpuinfo!
+    "test_tensor_copy"
   ];
 
   meta = {

From c20d90de3a2442f7590589e361e9316ec9180bd5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 22:58:00 +0200
Subject: [PATCH 066/100] audiness: relax pytenable

---
 pkgs/by-name/au/audiness/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/au/audiness/package.nix b/pkgs/by-name/au/audiness/package.nix
index 1db6cc238282..c21b1fc6e6fc 100644
--- a/pkgs/by-name/au/audiness/package.nix
+++ b/pkgs/by-name/au/audiness/package.nix
@@ -17,6 +17,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   };
 
   pythonRelaxDeps = [
+    "pytenable"
     "typer"
     "validators"
   ];

From e637509aa21a028df0df6d741a53a717768aed34 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:01:10 +0200
Subject: [PATCH 067/100] faraday-agent-dispatcher: relax pytenable

---
 pkgs/by-name/fa/faraday-agent-dispatcher/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix b/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
index b371db2fd199..362e06aa4615 100644
--- a/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
+++ b/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
@@ -21,6 +21,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
       --replace-fail '"pytest-runner",' ""  '';
 
   pythonRelaxDeps = [
+    "pytenable"
     "python-socketio"
   ];
 

From 31aa4e108dc867944f0ea0b72b336681f5baf106 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 1 Jul 2026 09:37:14 +0000
Subject: [PATCH 068/100] python3Packages.torchdata: add missing test
 dependency

---
 pkgs/development/python-modules/torchdata/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/torchdata/default.nix b/pkgs/development/python-modules/torchdata/default.nix
index 07c376e92679..c4a6bc997a29 100644
--- a/pkgs/development/python-modules/torchdata/default.nix
+++ b/pkgs/development/python-modules/torchdata/default.nix
@@ -16,6 +16,7 @@
 
   # tests
   datasets,
+  expecttest,
   parameterized,
   pytest-xdist,
   pytestCheckHook,
@@ -51,6 +52,7 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     datasets
+    expecttest
     parameterized
     pytest-xdist
     pytestCheckHook

From d26c99622b72808b1a773fc0354c21b6b62c9181 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 1 Jul 2026 09:35:20 +0000
Subject: [PATCH 069/100] python3Packages.torchdata: enable __strcturedAttrs

---
 pkgs/development/python-modules/torchdata/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/torchdata/default.nix b/pkgs/development/python-modules/torchdata/default.nix
index c4a6bc997a29..ae6516a3d887 100644
--- a/pkgs/development/python-modules/torchdata/default.nix
+++ b/pkgs/development/python-modules/torchdata/default.nix
@@ -27,6 +27,7 @@ buildPythonPackage (finalAttrs: {
   pname = "torchdata";
   version = "0.11.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "meta-pytorch";

From 30488602e99d4aefb3f29a4c3668eb0cd40c29e7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:11:17 +0200
Subject: [PATCH 070/100] python3Packages.faraday-agent-parameters-types:
 clean-up

---
 .../fa/faraday-agent-dispatcher/package.nix   | 20 ++++-------
 .../default.nix                               | 33 +++++++------------
 2 files changed, 17 insertions(+), 36 deletions(-)

diff --git a/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix b/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
index 362e06aa4615..7229bcf79d0a 100644
--- a/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
+++ b/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   python3,
+  writableTmpDirAsHomeHook,
 }:
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
@@ -29,13 +30,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "python-owasp-zap-v2.4"
   ];
 
-  build-system = with python3.pkgs; [
-    setuptools-scm
-  ];
+  build-system = with python3.pkgs; [ setuptools-scm ];
 
-  nativeBuildInputs = [
-    python3.pkgs.python-owasp-zap-v2-4
-  ];
+  nativeBuildInputs = with python3.pkgs; [ python-owasp-zap-v2-4 ];
 
   dependencies = with python3.pkgs; [
     aiohttp
@@ -58,12 +55,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   nativeCheckInputs = with python3.pkgs; [
     pytest-asyncio
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d);
-  '';
-
   disabledTests = [
     "test_execute_agent"
     "SSL"
@@ -75,14 +69,12 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "tests/unittests/test_import_official_executors.py"
   ];
 
-  pythonImportsCheck = [
-    "faraday_agent_dispatcher"
-  ];
+  pythonImportsCheck = [ "faraday_agent_dispatcher" ];
 
   meta = {
     description = "Tool to send result from tools to the Faraday Platform";
     homepage = "https://github.com/infobyte/faraday_agent_dispatcher";
-    changelog = "https://github.com/infobyte/faraday_agent_dispatcher/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/infobyte/faraday_agent_dispatcher/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "faraday-dispatcher";
diff --git a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
index acfc96d9db60..6f2a1f3d3678 100644
--- a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
+++ b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
@@ -3,31 +3,13 @@
   buildPythonPackage,
   fetchFromGitHub,
   flit-core,
+  marshmallow,
   packaging,
   pytestCheckHook,
   setuptools,
   validators,
 }:
-let
-  marshmallow' = buildPythonPackage {
-    pname = "marshmallow";
-    version = "3.26.2";
-    pyproject = true;
 
-    src = fetchFromGitHub {
-      owner = "marshmallow-code";
-      repo = "marshmallow";
-      tag = "3.26.2";
-      hash = "sha256-ioe+aZHOW8r3wF3UknbTjAP0dEggd/NL9PTkPVQ46zM=";
-    };
-
-    build-system = [ flit-core ];
-
-    doCheck = false;
-
-    pythonImportsCheck = [ "marshmallow" ];
-  };
-in
 buildPythonPackage (finalAttrs: {
   pname = "faraday-agent-parameters-types";
   version = "1.9.1";
@@ -40,7 +22,10 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-Oe/9/zKOoCLK3JHMacOhk2+d91MrhzkBTW3POoFm71M=";
   };
 
-  pythonRelaxDeps = [ "validators" ];
+  pythonRelaxDeps = [
+    "marshmallow"
+    "validators"
+  ];
 
   postPatch = ''
     substituteInPlace setup.py \
@@ -50,7 +35,7 @@ buildPythonPackage (finalAttrs: {
   build-system = [ setuptools ];
 
   dependencies = [
-    marshmallow'
+    marshmallow
     packaging
     validators
   ];
@@ -65,12 +50,16 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # assert 'Version requested not valid' in "Invalid version: 'hola'"
     "test_incorrect_version_requested"
+    # Tests are outdated
+    "test_deserialize"
+    "test_invalid_data"
+    "test_serialize"
   ];
 
   meta = {
     description = "Collection of Faraday agent parameters types";
     homepage = "https://github.com/infobyte/faraday_agent_parameters_types";
-    changelog = "https://github.com/infobyte/faraday_agent_parameters_types/blob/${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/infobyte/faraday_agent_parameters_types/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ fab ];
   };

From b39e765aca948ddc74df0f81872e44e8d22c92f9 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:25:54 +0200
Subject: [PATCH 071/100] nerva: 1.30.0 -> 1.36.0

Diff: https://github.com/praetorian-inc/nerva/compare/v1.30.0...v1.36.0

Changelog: https://github.com/praetorian-inc/nerva/blob/v1.36.0/CHANGELOG.md
---
 pkgs/by-name/ne/nerva/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ne/nerva/package.nix b/pkgs/by-name/ne/nerva/package.nix
index 4b1d57c903a5..eb5599180716 100644
--- a/pkgs/by-name/ne/nerva/package.nix
+++ b/pkgs/by-name/ne/nerva/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nerva";
-  version = "1.30.0";
+  version = "1.36.0";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "nerva";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kiVZFByiNCyubtzDryVwi6x/Xo1StEtlnOTlD9MfwP0=";
+    hash = "sha256-akGiZ5KolHOzZddgAYA3zWcFG0VSqHe6cFiB6AvRyhg=";
   };
 
   vendorHash = "sha256-Z0MSD+1/1VzrJ+pz5x0JvxrCxtJe59ckaTqHK/+TVN8=";

From 6c55bac908fc5972a6c45a208def52e5eb85a68b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:36:39 +0200
Subject: [PATCH 072/100] cnspec: 13.25.0 -> 13.27.0

Diff: https://github.com/mondoohq/cnspec/compare/v13.25.0...v13.27.0

Changelog: https://github.com/mondoohq/cnspec/releases/tag/v13.27.0
---
 pkgs/by-name/cn/cnspec/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index fed41ef87222..9574fd82a314 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "cnspec";
-  version = "13.25.0";
+  version = "13.27.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6DyF9gOXZfN5wUpUtTO/Pj8wOcHbTRbZbTCYF3t9clE=";
+    hash = "sha256-t/ugT15QxiwMJybX2mIwgx0wGQETLFJWplxNEosTq4A=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-q9ur5wbiJGZ8K0dI3xjpB4RsnEkoQetZu6Kj7IB7kEc=";
+  vendorHash = "sha256-M2f2HApngE8GJRXy53u7bif1puNTE6BV6oxmnvSSS6Y=";
 
   subPackages = [ "apps/cnspec" ];
 

From 46a6171bb72db4547c8ad252178d23264ae39d77 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:37:37 +0200
Subject: [PATCH 073/100] greenmask: 0.2.21 -> 0.2.22

Diff: https://github.com/GreenmaskIO/greenmask/compare/v0.2.21...v0.2.22

Changelog: https://github.com/GreenmaskIO/greenmask/releases/tag/v0.2.22
---
 pkgs/by-name/gr/greenmask/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gr/greenmask/package.nix b/pkgs/by-name/gr/greenmask/package.nix
index 8a9a72457091..1b0f2f0799a9 100644
--- a/pkgs/by-name/gr/greenmask/package.nix
+++ b/pkgs/by-name/gr/greenmask/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "greenmask";
-  version = "0.2.21";
+  version = "0.2.22";
 
   src = fetchFromGitHub {
     owner = "GreenmaskIO";
     repo = "greenmask";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QlNw2kCh5Rd8kwuA/BiNHXaw0p5qCfn4hzo9dgN45lU=";
+    hash = "sha256-bmKy3naQiLG4z3+VNkUck3UNVh2Oi8faXRz20qjwL9g=";
   };
 
-  vendorHash = "sha256-zVbSppCgLil0qS4WYhkzQZxbBx6L/0gbexY//I+GzwQ=";
+  vendorHash = "sha256-PsGeh7PzZFFhzQClW56GfvsGp8T7dccyErdnOv3urhs=";
 
   subPackages = [ "cmd/greenmask/" ];
 

From 9b468164daec3b894fa83fbda2ef65b8fbe64854 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:38:29 +0200
Subject: [PATCH 074/100] python3Packages.alibabacloud-ecs20140526: 7.8.7 ->
 7.9.0

---
 .../python-modules/alibabacloud-ecs20140526/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix b/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
index cb33051d3649..92ac4d69c58a 100644
--- a/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-ecs20140526";
-  version = "7.8.7";
+  version = "7.9.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "alibabacloud_ecs20140526";
     inherit (finalAttrs) version;
-    hash = "sha256-78QeY9Qpcwf71EelPt0wP+KUg3foUUSynhCcn+ofbGc=";
+    hash = "sha256-m1eaDj6VLGwJwfF3Dg6nN+YISHQuY+ij7uJ1KMFKvDU=";
   };
 
   build-system = [ setuptools ];

From e00ecf96431f6934d6ee275e60f1980ddf2954f5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:43:18 +0200
Subject: [PATCH 075/100] qovery-cli: 1.166.0 -> 1.166.2

Diff: https://github.com/Qovery/qovery-cli/compare/v1.166.0...v1.166.2

Changelog: https://github.com/Qovery/qovery-cli/releases/tag/v1.166.2
---
 pkgs/by-name/qo/qovery-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/qo/qovery-cli/package.nix b/pkgs/by-name/qo/qovery-cli/package.nix
index 60c9f5d0b35a..47a33f715938 100644
--- a/pkgs/by-name/qo/qovery-cli/package.nix
+++ b/pkgs/by-name/qo/qovery-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "qovery-cli";
-  version = "1.166.0";
+  version = "1.166.2";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-orNVII6Y82YVtgEKpQnEpNXVWsg6P3sHluW1FGU20DA=";
+    hash = "sha256-GjfgdW5A2afQ46GfT3wjj+foxQEXsmI83NBaxU19uig=";
   };
 
   vendorHash = "sha256-fZqzHJa5VFC1z5ZaHCXNyIKbwLjb3pSEb9FHs4YhWZg=";

From cc4ee642cdefba7ef586b9c575cce4a4f59344fd Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:43:54 +0200
Subject: [PATCH 076/100] python3Packages.env-canada: 0.15.0 -> 0.16.0

Diff: https://github.com/michaeldavie/env_canada/compare/v0.15.0...v0.16.0

Changelog: https://github.com/michaeldavie/env_canada/blob/v0.16.0/CHANGELOG.md
---
 pkgs/development/python-modules/env-canada/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index d7bdcb34d671..f87f56c944ee 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "env-canada";
-  version = "0.15.0";
+  version = "0.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "michaeldavie";
     repo = "env_canada";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iiNsbXvZPLCJ0BzPYCs6UEZIm1S0tEqi3ClY7vX6le4=";
+    hash = "sha256-99kf2A8nkxWZmhgD/x3YipYpxAJej5RjBTGomS/U8EQ=";
   };
 
   build-system = [ setuptools ];

From 9d97fa5c04df86cd4ebf5d78be0f99396549f7fa Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:44:26 +0200
Subject: [PATCH 077/100] python3Packages.iocx: 0.7.4.1 -> 0.7.5

Diff: https://github.com/iocx-dev/iocx/compare/v0.7.4.1...v0.7.5

Changelog: https://github.com/iocx-dev/iocx/releases/tag/v0.7.5
---
 pkgs/development/python-modules/iocx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iocx/default.nix b/pkgs/development/python-modules/iocx/default.nix
index 15f6d1537c75..c66f5013ab83 100644
--- a/pkgs/development/python-modules/iocx/default.nix
+++ b/pkgs/development/python-modules/iocx/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iocx";
-  version = "0.7.4.1";
+  version = "0.7.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iocx-dev";
     repo = "iocx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bSfmAAsVgtyCapcc9k4ky+nAFZV6GUf/EX1Ht8TOEg4=";
+    hash = "sha256-j7GApoKh0LBTWMLnapqzRncDFLu+89wLeNmSHxflcks=";
   };
 
   build-system = [ setuptools ];

From 1e68b909e4ac21c4338fd10824b9646f646ee490 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:48:22 +0200
Subject: [PATCH 078/100] python3Packages.slack-sdk: 3.42.0 -> 3.43.0

Diff: https://github.com/slackapi/python-slack-sdk/compare/v3.42.0...v3.43.0

Changelog: https://github.com/slackapi/python-slack-sdk/releases/tag/v3.43.0
---
 pkgs/development/python-modules/slack-sdk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index b6eeaa14fc7e..a434650c1ed3 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "slack-sdk";
-  version = "3.42.0";
+  version = "3.43.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slackapi";
     repo = "python-slack-sdk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-d0XuzBhn2Ex57xjeAF1q5RcwoWVsFWnlsWUufB3Um4g=";
+    hash = "sha256-slgf9U/Rm0pSV84CZR/8gGhvEi1zowjzE7YG9FsqwKk=";
   };
 
   build-system = [ setuptools ];

From 8962fff412e7f71904a195715fa8bab892a3a245 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:51:54 +0200
Subject: [PATCH 079/100] python3Packages.yaswfp: modernize

---
 pkgs/development/python-modules/yaswfp/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/yaswfp/default.nix b/pkgs/development/python-modules/yaswfp/default.nix
index f0c7998a453f..6ed211dd9a0b 100644
--- a/pkgs/development/python-modules/yaswfp/default.nix
+++ b/pkgs/development/python-modules/yaswfp/default.nix
@@ -6,9 +6,9 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "yaswfp";
-  version = "unstable-20210331";
+  version = "0.9.3-unstable-20210331";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -28,9 +28,9 @@ buildPythonPackage {
 
   meta = {
     description = "Python SWF Parser";
-    mainProgram = "swfparser";
     homepage = "https://github.com/facundobatista/yaswfp";
-    license = with lib.licenses; [ gpl3Only ];
+    license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "swfparser";
   };
-}
+})

From 67c4b2ed5c0a748a616a486da887da9ff718e858 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:56:39 +0200
Subject: [PATCH 080/100] python3Packages.mypy-boto3-cloud9: 1.43.0 -> 1.43.39

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index d39b1d63dd10..371818f636ce 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -211,8 +211,8 @@ in
       "sha256-m7y4NwYn4tNtJ2V8wlXSkOMdhTrNFZUWXc8g1yqLFGA=";
 
   mypy-boto3-cloud9 =
-    buildMypyBoto3Package "cloud9" "1.43.0"
-      "sha256-76N3xUFKaU+cepHviRw2SWdjptNmVZkg6giAF7B1b5s=";
+    buildMypyBoto3Package "cloud9" "1.43.39"
+      "sha256-n+O246n0LbH1Tc8QK93YRO2Cxj9pz8nfAetvq1lidj8=";
 
   mypy-boto3-cloudcontrol =
     buildMypyBoto3Package "cloudcontrol" "1.43.0"

From 7f31af9631117cdc2d5fcfc379f86be77ac9e383 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:56:50 +0200
Subject: [PATCH 081/100] python3Packages.mypy-boto3-connect: 1.43.38 ->
 1.43.39

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 371818f636ce..8510dca20a60 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -335,8 +335,8 @@ in
       "sha256-6FyB/VCGsMYDBFUu0VzWpge94lASfg6CVewhkmpxycQ=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.43.38"
-      "sha256-EpBR0OFb96qnM0+ToMfr9KyB7oTy7FkNAZqqIbEKG9w=";
+    buildMypyBoto3Package "connect" "1.43.39"
+      "sha256-yu5th3IYwC4kGT/DnRy9A3MXR/XxxtpeQomeRQoD7ck=";
 
   mypy-boto3-connect-contact-lens =
     buildMypyBoto3Package "connect-contact-lens" "1.43.0"

From 15a9b07a489b8535d4b5fe49cc7f56324530f157 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:56:59 +0200
Subject: [PATCH 082/100] python3Packages.mypy-boto3-ec2: 1.43.38 -> 1.43.39

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 8510dca20a60..01ef85d7892e 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -443,8 +443,8 @@ in
       "sha256-dXNkOcMonYrBh4yzeubd+v3mW42s9XpmpfvgbtgoJgY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.43.38"
-      "sha256-nPuU8WL2p1bFewTf+X+V5joyTJ3wWRnaYYgIoAjt0Vw=";
+    buildMypyBoto3Package "ec2" "1.43.39"
+      "sha256-iatW0Ijl1hGkkP3tOwC49kvmO3r3BdYfvRclRw+pmbA=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.43.0"

From bf0b3432665c0002dc53c47319bd9cae778a1029 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:57:29 +0200
Subject: [PATCH 083/100] python3Packages.mypy-boto3-mediaconvert: 1.43.24 ->
 1.43.39

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 01ef85d7892e..bf7c089434cf 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -858,8 +858,8 @@ in
       "sha256-ZlvcxMsMtkPwzyBpxGWffcD2g73aNIU6WG7jYn66ZjU=";
 
   mypy-boto3-mediaconvert =
-    buildMypyBoto3Package "mediaconvert" "1.43.24"
-      "sha256-VaGwdqgERTszcGip4FytIsm6r9mADouitpOWVmBFBko=";
+    buildMypyBoto3Package "mediaconvert" "1.43.39"
+      "sha256-3s5d1ZZ+XoVjYP3uZ2zuaAjH76fbj0j0a5v2H3Ji8vA=";
 
   mypy-boto3-medialive =
     buildMypyBoto3Package "medialive" "1.43.27"

From e8dd0e8038c73f820617fdc76a079dac5f671001 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:57:33 +0200
Subject: [PATCH 084/100] python3Packages.mypy-boto3-meteringmarketplace:
 1.43.0 -> 1.43.39

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index bf7c089434cf..dd9d5327e27d 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -898,8 +898,8 @@ in
       "sha256-13fAVct/Icy2iWt9z+fFyHLbp+7X6kZjLCtiiqC8Emc=";
 
   mypy-boto3-meteringmarketplace =
-    buildMypyBoto3Package "meteringmarketplace" "1.43.0"
-      "sha256-+gJkfsKfgRQbXovoZwas++rwAFxKlkGUdjqVGgE9jvA=";
+    buildMypyBoto3Package "meteringmarketplace" "1.43.39"
+      "sha256-HIHcM0wk4B50OYDf9Dsb81hsfrXYnZ7WyQ9R6BBvjNk=";
 
   mypy-boto3-mgh =
     buildMypyBoto3Package "mgh" "1.43.0"

From fc40bec0ba08ba2bb2b7365b05750edcaec1c84b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:57:38 +0200
Subject: [PATCH 085/100] python3Packages.mypy-boto3-opensearch: 1.43.34 ->
 1.43.39

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index dd9d5327e27d..d0bdadd2851d 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -966,8 +966,8 @@ in
       "sha256-1wQApBLsMnKRZ3lJZdd2W0+2Zz50QFdzYAhrOvEzByM=";
 
   mypy-boto3-opensearch =
-    buildMypyBoto3Package "opensearch" "1.43.34"
-      "sha256-MCgsSuTTm5JpFVTCWYOqi4usXhqThxyda6Q8dd4FiLA=";
+    buildMypyBoto3Package "opensearch" "1.43.39"
+      "sha256-ML0Y1a5twHRFUmR0MppMRopU2RG9n6y0HpQj4jUb/Dk=";
 
   mypy-boto3-opensearchserverless =
     buildMypyBoto3Package "opensearchserverless" "1.43.17"

From c8d6f44c22e38fc7452c5e6ff44da4e30e827dfa Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:57:50 +0200
Subject: [PATCH 086/100] python3Packages.mypy-boto3-quicksight: 1.43.35 ->
 1.43.39

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index d0bdadd2851d..a2761d3eb7ad 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -1070,8 +1070,8 @@ in
       "sha256-YrrEKl3aGz//5Z5JGapHhWtk6hBXQ4cuRQmLqGYztzg=";
 
   mypy-boto3-quicksight =
-    buildMypyBoto3Package "quicksight" "1.43.35"
-      "sha256-47+AzLZ3ovvK0wLQ4xFoFkMocEjP1Kv44z+X1Ad4aYs=";
+    buildMypyBoto3Package "quicksight" "1.43.39"
+      "sha256-xjqIi2ZTAZusw3FDL2AQx871Yg0VM++K32w+ht74F34=";
 
   mypy-boto3-ram =
     buildMypyBoto3Package "ram" "1.43.0"

From d7e9b59c620ba521f06f2dfad700314e31bbe1e3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 1 Jul 2026 23:58:22 +0200
Subject: [PATCH 087/100] python3Packages.boto3-stubs: 1.43.38 -> 1.43.39

---
 pkgs/development/python-modules/boto3-stubs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index a3b4e459a23d..6360263fefa4 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.38";
+  version = "1.43.39";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-VXAQCPqRDWCqKlk6owfRIchakaiSyyQYK8+OxB8pqfU=";
+    hash = "sha256-PzXmBl1uo+oNEuh1PFJ3BDqQiPRjL7vzF8DE9eBx5mM=";
   };
 
   build-system = [ setuptools ];

From 8b266eba3a0771c00461183d9b4ca4a59bdd9be2 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Wed, 1 Jul 2026 17:56:20 -0400
Subject: [PATCH 088/100] google-chrome: 149.0.7827.200 -> 150.0.7871.46

Release note: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
---
 pkgs/by-name/go/google-chrome/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index a0b030218353..e639b0005187 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -179,11 +179,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "149.0.7827.200";
+    version = "150.0.7871.46";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-HDCPrhH44nKTr6Fzm9SqAV/Vdmtyx1znIZXsPkGmEqg=";
+      hash = "sha256-abQBOftzoCGnSfMvzeCFP7F4G286izyvFzrY9nR/qnw=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly

From 5a9cb67b6e53a26e2b2dd937769e5573ce89712d Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Thu, 7 May 2026 00:57:37 +0200
Subject: [PATCH 089/100] paperless-ngx: factor frontend into separate file

---
 pkgs/by-name/pa/paperless-ngx/frontend.nix | 88 ++++++++++++++++++++++
 pkgs/by-name/pa/paperless-ngx/package.nix  | 88 ++--------------------
 2 files changed, 95 insertions(+), 81 deletions(-)
 create mode 100644 pkgs/by-name/pa/paperless-ngx/frontend.nix

diff --git a/pkgs/by-name/pa/paperless-ngx/frontend.nix b/pkgs/by-name/pa/paperless-ngx/frontend.nix
new file mode 100644
index 000000000000..20f2843c7793
--- /dev/null
+++ b/pkgs/by-name/pa/paperless-ngx/frontend.nix
@@ -0,0 +1,88 @@
+{
+  stdenv,
+  lib,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  pnpm_10,
+  nodejs,
+  node-gyp,
+  pkg-config,
+  python3,
+  pango,
+  giflib,
+  xcbuild,
+  src,
+  version,
+  meta,
+}:
+let
+  pnpm = pnpm_10;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "paperless-ngx-frontend";
+  inherit version;
+
+  src = src + "/src-ui";
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit pnpm;
+    inherit (finalAttrs) pname version src;
+    fetcherVersion = 3;
+    hash = "sha256-HO+IDNB3NXWgvV0cvZ5zx46JuXv6Tgroz+YfVump5MA=";
+  };
+
+  nativeBuildInputs = [
+    node-gyp
+    nodejs
+    pkg-config
+    pnpmConfigHook
+    pnpm
+    python3
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    xcbuild
+  ];
+
+  buildInputs = [
+    pango
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    giflib
+  ];
+
+  CYPRESS_INSTALL_BINARY = "0";
+  NG_CLI_ANALYTICS = "false";
+
+  buildPhase = ''
+    runHook preBuild
+
+    pushd node_modules/canvas
+    node-gyp rebuild
+    popd
+
+    # cat forcefully disables angular cli's spinner which doesn't work with nix' tty which is 0x0
+    pnpm run build --configuration production | cat
+
+    runHook postBuild
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+
+    pnpm run test | cat
+
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/paperless-ui
+    mv ../src/documents/static/frontend $out/lib/paperless-ui/
+
+    runHook postInstall
+  '';
+
+  inherit meta;
+})
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index a9be728390f9..641da02e2848 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -3,12 +3,10 @@
   stdenv,
   fetchFromGitHub,
   fetchPypi,
-  node-gyp,
-  nodejs,
+  callPackage,
   nixosTests,
   gettext,
   python3,
-  giflib,
   ghostscript_headless,
   imagemagickBig,
   jbig2enc,
@@ -16,14 +14,8 @@
   pngquant,
   qpdf,
   tesseract5,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  pnpm_10,
   poppler-utils,
   liberation_ttf,
-  xcbuild,
-  pango,
-  pkg-config,
   symlinkJoin,
   nltk-data,
   lndir,
@@ -31,8 +23,6 @@
   extraPythonPackageOverrides ? (_final: _prev: { }),
 }:
 let
-  pnpm = pnpm_10;
-
   defaultPythonPackageOverrides = final: prev: {
     django = prev.django_5;
 
@@ -80,74 +70,7 @@ let
     ];
   };
 in
-python.pkgs.buildPythonApplication (finalAttrs: let
-  frontend = stdenv.mkDerivation (feAttrs: {
-    pname = "paperless-ngx-frontend";
-    version = finalAttrs.version;
-
-    src = finalAttrs.src + "/src-ui";
-
-    pnpmDeps = fetchPnpmDeps {
-      inherit pnpm;
-      inherit (feAttrs) pname version src;
-      fetcherVersion = 3;
-      hash = "sha256-HO+IDNB3NXWgvV0cvZ5zx46JuXv6Tgroz+YfVump5MA=";
-    };
-
-    nativeBuildInputs = [
-      node-gyp
-      nodejs
-      pkg-config
-      pnpmConfigHook
-      pnpm
-      python3
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      xcbuild
-    ];
-
-    buildInputs = [
-      pango
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      giflib
-    ];
-
-    CYPRESS_INSTALL_BINARY = "0";
-    NG_CLI_ANALYTICS = "false";
-
-    buildPhase = ''
-      runHook preBuild
-
-      pushd node_modules/canvas
-      node-gyp rebuild
-      popd
-
-      # cat forcefully disables angular cli's spinner which doesn't work with nix' tty which is 0x0
-      pnpm run build --configuration production | cat
-
-      runHook postBuild
-    '';
-
-    doCheck = true;
-    checkPhase = ''
-      runHook preCheck
-
-      pnpm run test | cat
-
-      runHook postCheck
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/lib/paperless-ui
-      mv ../src/documents/static/frontend $out/lib/paperless-ui/
-
-      runHook postInstall
-    '';
-  });
-in {
+python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "paperless-ngx";
   pyproject = true;
 
@@ -278,7 +201,7 @@ in {
 
       mkdir -p $out/lib/paperless-ngx/static/frontend
       cp -r {src,static,LICENSE} $out/lib/paperless-ngx
-      lndir -silent ${frontend}/lib/paperless-ui/frontend $out/lib/paperless-ngx/static/frontend
+      lndir -silent ${finalAttrs.passthru.frontend}/lib/paperless-ui/frontend $out/lib/paperless-ngx/static/frontend
       chmod +x $out/lib/paperless-ngx/src/manage.py
       makeWrapper $out/lib/paperless-ngx/src/manage.py $out/bin/paperless-ngx \
         --prefix PYTHONPATH : "${pythonPath}" \
@@ -356,8 +279,11 @@ in {
   doCheck = !stdenv.hostPlatform.isDarwin;
 
   passthru = {
+    frontend = callPackage ./frontend.nix {
+      inherit (finalAttrs) src version;
+      meta = removeAttrs finalAttrs.meta [ "mainProgram" ];
+    };
     inherit
-      frontend
       nltkDataDir
       path
       python

From 49951091aad9219dcc6bfc422eb554114efd98e8 Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Wed, 1 Jul 2026 18:22:24 +0200
Subject: [PATCH 090/100] nixos/paperless: use package.passthru.dependencies
 for PYTHONPATH

---
 nixos/modules/services/misc/paperless.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 9df4e99ff9a5..f7ca6c2717bc 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -621,7 +621,7 @@ in
             PrivateNetwork = false;
           };
           environment = env // {
-            PYTHONPATH = "${cfg.package.python.pkgs.makePythonPath cfg.package.propagatedBuildInputs}:${cfg.package}/lib/paperless-ngx/src";
+            PYTHONPATH = "${cfg.package.python.pkgs.makePythonPath cfg.package.passthru.dependencies}:${cfg.package}/lib/paperless-ngx/src";
           };
           # Allow the web interface to access the private /tmp directory of the server.
           # This is required to support uploading files via the web interface.

From f8dda7d7c0ce1e901921d4d3ac5c02d57f198c95 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 2 Jul 2026 00:07:22 +0200
Subject: [PATCH 091/100] python3Packages.pycfmodel: 1.2.0 -> 2.1.1

Changelog: https://github.com/Skyscanner/pycfmodel/releases/tag/v2.1.1
---
 .../python-modules/pycfmodel/default.nix          | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index 750256d81f59..4b6d7d5559b7 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -6,23 +6,27 @@
   pydantic,
   pytestCheckHook,
   setuptools,
+  setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "pycfmodel";
-  version = "1.2.0";
+  version = "2.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = "pycfmodel";
     tag = "v${version}";
-    hash = "sha256-ta6kS+MiSa2DZx18EQr7hvWYrK55j48hSBACtcklCpI=";
+    hash = "sha256-fI6CeBJc1ry0vbXCxq7sfGiNDIrb3TiyimNacoOg8Lw=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];
 
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   dependencies = [ pydantic ];
 
@@ -43,6 +47,11 @@ buildPythonPackage rec {
     "test_raise_error_if_invalid_fields_in_resource"
   ];
 
+  disabledTestPaths = [
+    # Test requires network access
+    "tests/test_resource_generator.py"
+  ];
+
   pythonImportsCheck = [ "pycfmodel" ];
 
   meta = {

From 3803eeb718e0b1cf2a0b804002d376d4fa13c84b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 2 Jul 2026 00:08:19 +0200
Subject: [PATCH 092/100] python3Packages.pycfmodel: migrate to finalAttrs

---
 pkgs/development/python-modules/pycfmodel/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index 4b6d7d5559b7..4bd9057b9d9b 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -9,7 +9,7 @@
   setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pycfmodel";
   version = "2.1.1";
   pyproject = true;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = "pycfmodel";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-fI6CeBJc1ry0vbXCxq7sfGiNDIrb3TiyimNacoOg8Lw=";
   };
 
@@ -57,8 +57,8 @@ buildPythonPackage rec {
   meta = {
     description = "Model for Cloud Formation scripts";
     homepage = "https://github.com/Skyscanner/pycfmodel";
-    changelog = "https://github.com/Skyscanner/pycfmodel/releases/tag/${src.tag}";
+    changelog = "https://github.com/Skyscanner/pycfmodel/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From e4bb7470aa36247a240428e6f56246067aeb9dbb Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 2 Jul 2026 00:09:01 +0200
Subject: [PATCH 093/100] cfripper: 1.20.1 -> 1.21.0

Changelog: https://github.com/Skyscanner/cfripper/releases/tag/v1.21.0
---
 pkgs/by-name/cf/cfripper/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cf/cfripper/package.nix b/pkgs/by-name/cf/cfripper/package.nix
index b5e915bb043f..93e0ce49fcf0 100644
--- a/pkgs/by-name/cf/cfripper/package.nix
+++ b/pkgs/by-name/cf/cfripper/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "cfripper";
-  version = "1.20.1";
+  version = "1.21.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = "cfripper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HE9n28q1HX1HRSiXyEuUrAJGp4d5i1e0lROcsqpsobA=";
+    hash = "sha256-psuUG8Kk+pl9Qv9vpH7yCn2X6leciftgFN1Ft+zEgtg=";
   };
 
   pythonRelaxDeps = [

From 6c2d6b218e481a8470ffb44439f3c848a7644e16 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 2 Jul 2026 00:26:11 +0200
Subject: [PATCH 094/100] python3Packages.ngff-zarr: 0.36.0 -> 0.37.0

Changelog: https://github.com/fideus-labs/ngff-zarr/releases/tag/py-v0.37.0
---
 pkgs/development/python-modules/ngff-zarr/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ngff-zarr/default.nix b/pkgs/development/python-modules/ngff-zarr/default.nix
index dd1d3284aa05..0eee8e95bc0c 100644
--- a/pkgs/development/python-modules/ngff-zarr/default.nix
+++ b/pkgs/development/python-modules/ngff-zarr/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ngff-zarr";
-  version = "0.36.0";
+  version = "0.37.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fideus-labs";
     repo = "ngff-zarr";
     tag = "py-v${finalAttrs.version}";
-    hash = "sha256-TsPyW815ITcBtAvRyQgEqgHhp9MqtRlkmKLFNVdnKR8=";
+    hash = "sha256-v747oBJMKORiEgy3fVzzgl35+9uRbyGvtor+Ga4UkNI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/py/";
@@ -130,6 +130,9 @@ buildPythonPackage (finalAttrs: {
     "test_3d_zyx"
     "test_smaller_dask_graph"
     "test_tensorstore_compression"
+    # Test requires network access
+    "test_cli_orientation_preset_end_to_end"
+    "test_cli_itk_input_writes_orientation_automatically"
   ];
 
   meta = {

From fe86804fdbac7a86b9fdbcfb1bad983aaf2e8699 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 2 Jul 2026 00:32:21 +0200
Subject: [PATCH 095/100] python3Packages.slack-bolt: 1.28.0 -> 1.29.0

Diff: https://github.com/slackapi/bolt-python/compare/v1.28.0...v1.29.0

Changelog: https://github.com/slackapi/bolt-python/releases/tag/v1.29.0
---
 pkgs/development/python-modules/slack-bolt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/slack-bolt/default.nix b/pkgs/development/python-modules/slack-bolt/default.nix
index 93e5b09cd7e4..4588046e0c26 100644
--- a/pkgs/development/python-modules/slack-bolt/default.nix
+++ b/pkgs/development/python-modules/slack-bolt/default.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "slack-bolt";
-  version = "1.28.0";
+  version = "1.29.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slackapi";
     repo = "bolt-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1AJO7+7YG/NFh6Rmqwkm6yua2LWdYQ9Rv1oadfHAlhE=";
+    hash = "sha256-3U15V++q/x73LuEgw9uWaIGWulJmPkmkpUxxK1EXuzU=";
   };
 
   build-system = [ setuptools ];

From 774f85f0091f260ef05a2c2c05a67a5f55d4134f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 7 Jun 2026 12:04:01 +0200
Subject: [PATCH 096/100] yscan: init at 0.1.0

TUI IP and Port Scanner

https://github.com/yetidevworks/yscan
---
 pkgs/by-name/ys/yscan/package.nix | 45 +++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 pkgs/by-name/ys/yscan/package.nix

diff --git a/pkgs/by-name/ys/yscan/package.nix b/pkgs/by-name/ys/yscan/package.nix
new file mode 100644
index 000000000000..287154072164
--- /dev/null
+++ b/pkgs/by-name/ys/yscan/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch2,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "yscan";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "yetidevworks";
+    repo = "yscan";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dIRtqn6vismwgQUwfK5KzApBDBlAmOt+mfdBY8sr47g=";
+  };
+
+  __structuredAttrs = true;
+
+  cargoPatches = [
+    # https://github.com/yetidevworks/yscan/pull/2
+    (fetchpatch2 {
+      name = "cargo-lock.patch";
+      url = "https://github.com/yetidevworks/yscan/commit/54c0d9f008e0a9205ff639db8223c0a89fe72f34.patch?full_index=1";
+      hash = "sha256-n1JthKGLAS+Rx4BiLNwtRNZ4NHpS0Azv6uThjQgWqJg=";
+    })
+  ];
+
+  cargoHash = "sha256-nQV0vtx2hwKxysSHNB6j9d6JSuFlFFqtZr2hPciyo40=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  meta = {
+    description = "TUI IP and Port Scanner";
+    homepage = "https://github.com/yetidevworks/yscan";
+    changelog = "https://github.com/yetidevworks/yscan/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "yscan";
+  };
+})

From 5ade122efad02e6efc1af449f2bfbe54650a1b62 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 00:23:59 +0200
Subject: [PATCH 097/100] pretix: 2026.5.3 -> 2026.6.0

https://pretix.eu/about/en/blog/20260701-release-2026-6-0/
https://github.com/pretix/pretix/compare/v2026.5.3...v2026.6.0
---
 pkgs/by-name/pr/pretix/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 4ca8a8995841..22f3855b68e9 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -54,14 +54,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "pretix";
-  version = "2026.5.3";
+  version = "2026.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R77jPwcRgu5+NBR9H0tD14QfbUtoHme6z9maYzDVmPg=";
+    hash = "sha256-yKJGJziMpOB8ttz0n4USay03wJTId77bYT7id4OgoIE=";
   };
 
   patches = [
@@ -87,7 +87,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-Gkcz/QJCNuvhIdZnP/mPx5GD0EOJzxoP1dGI43pyOro=";
+    hash = "sha256-DJCvNcgDIY71Q9qg4Ng7SAM9i9wHhHOdJonpt5t/Xx8=";
   };
 
   nativeBuildInputs = [

From be7ff532045690baa3514aa2779ce05750ed7113 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 01:01:05 +0200
Subject: [PATCH 098/100] pretix.plugins.fontpack-free: init at 1.11.1

---
 .../pretix/plugins/fontpack-free/package.nix  | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix

diff --git a/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix b/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix
new file mode 100644
index 000000000000..2c4b91cc706f
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pretix-plugin-build,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pretix-fontpack-free";
+  version = "1.11.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "pretix";
+    repo = "pretix-fontpack-free";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eeU8awLf/PSsLuAOobZhXVyQ3KM7jOEIz1ZLt4eDxzQ=";
+  };
+
+  build-system = [
+    pretix-plugin-build
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "pretix_fontpackfree"
+  ];
+
+  meta = {
+    description = "Set of free fonts for pretix";
+    homepage = "https://github.com/pretix/pretix-fontpack-free";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})

From 840882f722280f053950a359ba5e1a2e2a4fe5ca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 23:01:25 +0000
Subject: [PATCH 099/100] ocrmypdf: 17.7.1 -> 17.8.0

---
 pkgs/development/python-modules/ocrmypdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 33cebeede2e8..265ede72e8aa 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "17.7.1";
+  version = "17.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-LHNaWpnx11EGKvmudicMFCQJzTQMB2+Rz5JgHJN7lFk=";
+    hash = "sha256-E6SheIepSXQPxTCf6/vWeGpUs0x7VO+h86JhtSxK6e0=";
   };
 
   patches = [

From ee83756eecff7095b88eb706025dd6a8d5208fa7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 2 Jul 2026 00:33:33 +0200
Subject: [PATCH 100/100] python3Packages.mediapy: 1.2.5 -> 1.2.7

https://github.com/google/mediapy/releases/tag/v1.2.7
---
 .../python-modules/mediapy/default.nix        | 42 ++++++++++++++-----
 1 file changed, 32 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/mediapy/default.nix b/pkgs/development/python-modules/mediapy/default.nix
index de5dc2ed90eb..1081b0cc331e 100644
--- a/pkgs/development/python-modules/mediapy/default.nix
+++ b/pkgs/development/python-modules/mediapy/default.nix
@@ -1,40 +1,62 @@
 {
   lib,
+  bash,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   flit-core,
   ipython,
   matplotlib,
   numpy,
   pillow,
+  absl-py,
+  ffmpeg-headless,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "mediapy";
-  version = "1.2.5";
+  version = "1.2.7";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-LHpMUXBLJmQnNxkKbl++qCYLAn/enZnGRKZwJVquhg8=";
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "mediapy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+p88Zc7YuN0P4i1AzTQfQqCFo6Uc6hpDKgoDpdJxMaI=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  postPatch = ''
+    substituteInPlace mediapy_test.py \
+      --replace-fail "/bin/bash" "${lib.getExe bash}"
+  '';
 
-  propagatedBuildInputs = [
+  build-system = [ flit-core ];
+
+  dependencies = [
     ipython
     matplotlib
     numpy
     pillow
   ];
 
+  nativeCheckInputs = [
+    absl-py
+    ffmpeg-headless
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # AssertionError: np.float64(148.75258355982479) not less than 51.2
+    "test_video_read_write_10bit"
+  ];
+
   pythonImportsCheck = [ "mediapy" ];
 
   meta = {
     description = "Read/write/show images and videos in an IPython notebook";
     homepage = "https://github.com/google/mediapy";
-    changelog = "https://github.com/google/mediapy/releases/tag/v${version}";
+    changelog = "https://github.com/google/mediapy/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ mcwitt ];
   };
-}
+})