From 6ac60038fe6e42b7a46cf4b5667a17ad6cd91518 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Oct 2025 20:07:11 +0000
Subject: [PATCH 01/74] python3Packages.ansible-pylibssh: 1.2.2 -> 1.3.0

---
 pkgs/development/python-modules/ansible-pylibssh/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ansible-pylibssh/default.nix b/pkgs/development/python-modules/ansible-pylibssh/default.nix
index 9ca0f8fefd12..1f0d93ce02c2 100644
--- a/pkgs/development/python-modules/ansible-pylibssh/default.nix
+++ b/pkgs/development/python-modules/ansible-pylibssh/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "ansible-pylibssh";
-  version = "1.2.2";
+  version = "1.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dT5XDc3OtquONi6RzA1Zk77ryT0oe4gXjbVVCfZCOrU=";
+    hash = "sha256-JD6hsJYrC2secXrA5p2sljbmHsZbNyYMMXsjYMbjDKc=";
   };
 
   # Remove after https://github.com/ansible/pylibssh/pull/502 is merged

From a02e976da24b7966d76eff4c243c609c3a56b015 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 19 Dec 2025 11:30:00 +0000
Subject: [PATCH 02/74] fastmail-desktop: 1.0.6 -> 1.0.7

---
 pkgs/by-name/fa/fastmail-desktop/sources.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/fa/fastmail-desktop/sources.nix b/pkgs/by-name/fa/fastmail-desktop/sources.nix
index 874ee15e85d2..4fd1a3f64b9c 100644
--- a/pkgs/by-name/fa/fastmail-desktop/sources.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/sources.nix
@@ -1,19 +1,19 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-12-06
+# Last updated: 2025-12-19
 { fetchurl, fetchzip }:
 {
   aarch64-darwin = {
-    version = "1.0.6";
+    version = "1.0.7";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.0.6-arm64-mac.zip";
-      hash = "sha512-viKPE0LS4dQQxw9jimEGjAl65uSE7XeAcuoLzq7n4i/BEfNo9QjzOzDMbxhwkGY0Ba92coddwJRXaSdx48fTTw==";
+      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.0.7-arm64-mac.zip";
+      hash = "sha512-pH6m2BxP/y/A/DaPVNgwmd5HHVbyCVefYhJENyImsKQAKzn8RY9EI/kaybMHlQjv6N0Gmixpskvm0K74k3LUqg==";
     };
   };
   x86_64-linux = {
-    version = "1.0.6";
+    version = "1.0.7";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/Fastmail-1.0.6.AppImage";
-      hash = "sha512-WKMhy7dLoFUqUkevkZAgxgxpz5jD4O9VVaKDYxQs0jXJVt5GUcIHDJ6aZIJG6jyinAC18NzF3vJnOftw8ZWdmg==";
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/Fastmail-1.0.7.AppImage";
+      hash = "sha512-MFVqBuuruqDVOkK9NC5E60BPJnIHdiL4MhitWqmmUB+NidlBxQbeDeWZu5Pwhh878UXrNvA0mVCgTZAOK7e2Ew==";
     };
   };
 }

From 61eb86f9103307e847a0d5127c999b6deac710c2 Mon Sep 17 00:00:00 2001
From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
Date: Tue, 23 Dec 2025 13:46:24 +0100
Subject: [PATCH 03/74] lasuite-docs: 4.1.0 -> 4.2.0

https://github.com/suitenumerique/docs/releases/tag/v4.2.0
https://github.com/suitenumerique/docs/compare/v4.1.0...v4.2.0
---
 pkgs/by-name/la/lasuite-docs/package.nix      |  6 +++--
 .../la/lasuite-docs/postgresql_fix.patch      | 27 +++++++++++++++++++
 2 files changed, 31 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/by-name/la/lasuite-docs/postgresql_fix.patch

diff --git a/pkgs/by-name/la/lasuite-docs/package.nix b/pkgs/by-name/la/lasuite-docs/package.nix
index d78fd1a44b7d..adb7060169d8 100644
--- a/pkgs/by-name/la/lasuite-docs/package.nix
+++ b/pkgs/by-name/la/lasuite-docs/package.nix
@@ -17,12 +17,12 @@ let
     };
   };
 
-  version = "4.1.0";
+  version = "4.2.0";
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
+    hash = "sha256-BQ2vJIEXS51dBkqdmKUuLB6hM8QRJW0zVDayYt8Pe+w=";
   };
 
   mail-templates = stdenv.mkDerivation {
@@ -58,6 +58,8 @@ python.pkgs.buildPythonApplication rec {
   patches = [
     # Support configuration throught environment variables for SECURE_*
     ./secure_settings.patch
+    # Fix creation of unsafe C function in postgresql migrations
+    ./postgresql_fix.patch
   ];
 
   build-system = with python.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/la/lasuite-docs/postgresql_fix.patch b/pkgs/by-name/la/lasuite-docs/postgresql_fix.patch
new file mode 100644
index 000000000000..562251015410
--- /dev/null
+++ b/pkgs/by-name/la/lasuite-docs/postgresql_fix.patch
@@ -0,0 +1,27 @@
+From 49c6138eab0a37d062c5e7d936535d1832b3e031 Mon Sep 17 00:00:00 2001
+From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
+Date: Tue, 23 Dec 2025 19:43:50 +0100
+Subject: [PATCH] fix: disable postgresql C function creation
+
+---
+ core/migrations/0027_auto_20251120_0956.py | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/core/migrations/0027_auto_20251120_0956.py b/core/migrations/0027_auto_20251120_0956.py
+index fe795ff5..0db2090c 100644
+--- a/core/migrations/0027_auto_20251120_0956.py
++++ b/core/migrations/0027_auto_20251120_0956.py
+@@ -11,11 +11,6 @@ class Migration(migrations.Migration):
+     operations = [
+         migrations.RunSQL(
+             sql="""
+-                CREATE OR REPLACE FUNCTION public.immutable_unaccent(regdictionary, text)
+-                RETURNS text
+-                LANGUAGE c IMMUTABLE PARALLEL SAFE STRICT AS
+-                '$libdir/unaccent', 'unaccent_dict';
+-
+                 CREATE OR REPLACE FUNCTION public.f_unaccent(text)
+                 RETURNS text
+                 LANGUAGE sql IMMUTABLE PARALLEL SAFE STRICT
+--
+2.50.1

From ecda4af6f30e4790ed1756456b88f813b7c5091a Mon Sep 17 00:00:00 2001
From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
Date: Tue, 23 Dec 2025 13:46:33 +0100
Subject: [PATCH 04/74] lasuite-docs-collaboration-server: 4.1.0 -> 4.2.0

https://github.com/suitenumerique/docs/releases/tag/v4.2.0
https://github.com/suitenumerique/docs/compare/v4.1.0...v4.2.0
---
 .../la/lasuite-docs-collaboration-server/package.nix        | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix b/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
index b40a48c5f2bd..cfa99a3af912 100644
--- a/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
+++ b/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
@@ -13,20 +13,20 @@
 
 stdenv.mkDerivation rec {
   pname = "lasuite-docs-collaboration-server";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
+    hash = "sha256-BQ2vJIEXS51dBkqdmKUuLB6hM8QRJW0zVDayYt8Pe+w=";
   };
 
   sourceRoot = "source/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-3yRKWIOPBRrOxBWUW3C5xFjb2dcA6c3cMOD8PZWjHNA=";
+    hash = "sha256-tttq1Tp6BZ30cJJgRBoHaBJesmqhkFNuk9tftitGNVw=";
   };
 
   nativeBuildInputs = [

From ac57c05e28c8eeb5c0cd674c9964a194b2117c69 Mon Sep 17 00:00:00 2001
From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
Date: Tue, 23 Dec 2025 13:46:40 +0100
Subject: [PATCH 05/74] lasuite-docs-frontend: 4.1.0 -> 4.2.0

https://github.com/suitenumerique/docs/releases/tag/v4.2.0
https://github.com/suitenumerique/docs/compare/v4.1.0...v4.2.0
---
 pkgs/by-name/la/lasuite-docs-frontend/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-docs-frontend/package.nix b/pkgs/by-name/la/lasuite-docs-frontend/package.nix
index c58deafdcac1..d250ae13ed21 100644
--- a/pkgs/by-name/la/lasuite-docs-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-docs-frontend/package.nix
@@ -12,20 +12,20 @@
 
 stdenv.mkDerivation rec {
   pname = "lasuite-docs-frontend";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
+    hash = "sha256-BQ2vJIEXS51dBkqdmKUuLB6hM8QRJW0zVDayYt8Pe+w=";
   };
 
   sourceRoot = "source/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-3yRKWIOPBRrOxBWUW3C5xFjb2dcA6c3cMOD8PZWjHNA=";
+    hash = "sha256-tttq1Tp6BZ30cJJgRBoHaBJesmqhkFNuk9tftitGNVw=";
   };
 
   nativeBuildInputs = [

From 8cc43331ad180ba8e06fd745114c21dc7ea31313 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Dec 2025 13:40:13 +0000
Subject: [PATCH 06/74] netbox: 4.4.8 -> 4.4.9

---
 pkgs/by-name/ne/netbox_4_4/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ne/netbox_4_4/package.nix b/pkgs/by-name/ne/netbox_4_4/package.nix
index ddb098392e8d..01ee99b882e6 100644
--- a/pkgs/by-name/ne/netbox_4_4/package.nix
+++ b/pkgs/by-name/ne/netbox_4_4/package.nix
@@ -16,14 +16,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "netbox";
-  version = "4.4.8";
+  version = "4.4.9";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "netbox-community";
     repo = "netbox";
     tag = "v${version}";
-    hash = "sha256-C7tzY6gp/jfoCf6uPGfAvO8+xHkGe7T0o0Dod+D6YRU=";
+    hash = "sha256-NA84Rcs27S68pyVdo+bif8P2sNmGkfuMPrCBn1YXubc=";
   };
 
   patches = [

From 7b6724640eff3cb08f4335f22d506a41c78f2f66 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Dec 2025 21:06:36 +0000
Subject: [PATCH 07/74] python3Packages.django-auth-ldap: 5.2.0 -> 5.3.0

---
 pkgs/development/python-modules/django-auth-ldap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django-auth-ldap/default.nix b/pkgs/development/python-modules/django-auth-ldap/default.nix
index 3c377c151182..1ee93ac481c0 100644
--- a/pkgs/development/python-modules/django-auth-ldap/default.nix
+++ b/pkgs/development/python-modules/django-auth-ldap/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "django-auth-ldap";
-  version = "5.2.0";
+  version = "5.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-auth-ldap";
     repo = "django-auth-ldap";
     tag = version;
-    hash = "sha256-/Wy5ZCRBIeEXOFqQW4e+GzQWpZyI9o39TfFAVb7OYeo=";
+    hash = "sha256-+ezadod2ZKrsNW7lVO1dVqQWUnzP1Mi9On8/RJ2qNfI=";
   };
 
   build-system = [ setuptools-scm ];

From 6760abbd3d6c2c8a1e4ff2e0fa9dbe8e61af3e30 Mon Sep 17 00:00:00 2001
From: 7c6f434c <7c6f434c@mail.ru>
Date: Sat, 3 Jan 2026 15:17:41 +0100
Subject: [PATCH 08/74] iprover: 3.8.1 -> 3.9.2

---
 pkgs/by-name/ip/iprover/package.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ip/iprover/package.nix b/pkgs/by-name/ip/iprover/package.nix
index 7546522b33a7..e211ee4eb5ee 100644
--- a/pkgs/by-name/ip/iprover/package.nix
+++ b/pkgs/by-name/ip/iprover/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation {
   pname = "iprover";
-  version = "3.8.1";
+  version = "3.9.2";
 
   src = fetchFromGitLab {
     owner = "korovin";
     repo = "iprover";
-    rev = "f61edb113b705606c7314dc4dce0687832c3169f";
-    hash = "sha256-XXqbEoYKjoktE3ZBEIEFjLhA1B75zhnfPszhe8SvbI8=";
+    rev = "v3.9.2";
+    hash = "sha256-CbqPtP2pKLFgo67EF0IhvIdv1dAog2vb3Es0asmmSyY=";
   };
 
   postPatch = ''
@@ -45,6 +45,10 @@ stdenv.mkDerivation {
 
   preConfigure = "patchShebangs .";
 
+  env = {
+    NIX_CFLAGS_COMPILE = "-std=gnu17";
+  };
+
   installPhase = ''
     runHook preInstall
     mkdir -p "$out/bin"

From d116c4ddfbf4ae13be355a1285bc8beaed6ae2ba Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sat, 3 Jan 2026 15:38:23 +0100
Subject: [PATCH 09/74] exatorrent: fix build with gcc15

---
 pkgs/by-name/ex/exatorrent/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/ex/exatorrent/package.nix b/pkgs/by-name/ex/exatorrent/package.nix
index e9b3be4104b9..0893501f2a9d 100644
--- a/pkgs/by-name/ex/exatorrent/package.nix
+++ b/pkgs/by-name/ex/exatorrent/package.nix
@@ -63,6 +63,11 @@ buildGoModule (finalAttrs: {
     "-extldflags '-static'"
   ];
 
+  # Fix build with GCC 15
+  # from vendor/github.com/anacrolix/go-libutp/callbacks.go:4:
+  # ./utp_types.h:120:15: error: two or more data types in declaration specifiers
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   buildInputs = lib.optionals stdenv.hostPlatform.isGnu [
     stdenv.cc.libc.static
   ];

From cdfc90c4e5b56c615d40dc502f3cd9ef81e70d27 Mon Sep 17 00:00:00 2001
From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
Date: Tue, 23 Dec 2025 19:50:04 +0100
Subject: [PATCH 10/74] nixos/lasuite-docs: add systemd service to create
 postgresql unaccent function

It is unsafe for a non-superadmin user to create a C functin
in postgresql, so we need to create the function via the
superadmin postgres user. This function (immutable unaccent) is
needed by lasuite-docs since 4.2.0 and is used to search for keys
without accents.

https://github.com/suitenumerique/docs/releases/tag/v4.2.0
https://github.com/suitenumerique/docs/compare/v4.1.0...v4.2.0
---
 .../services/web-apps/lasuite-docs.nix        | 50 +++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/nixos/modules/services/web-apps/lasuite-docs.nix b/nixos/modules/services/web-apps/lasuite-docs.nix
index c6a1b0c2ae40..c5f1a4ed6a3b 100644
--- a/nixos/modules/services/web-apps/lasuite-docs.nix
+++ b/nixos/modules/services/web-apps/lasuite-docs.nix
@@ -346,6 +346,56 @@ in
   };
 
   config = mkIf cfg.enable {
+    systemd.services.lasuite-docs-postgresql-setup = mkIf cfg.postgresql.createLocally {
+      wantedBy = [ "lasuite-docs.target" ];
+      requiredBy = [ "lasuite-docs.service" ];
+      before = [ "lasuite-docs.service" ];
+      after = [ "postgresql-setup.service" ];
+
+      serviceConfig = {
+        Slice = "system-lasuite-docs.slice";
+        Type = "oneshot";
+        User = "postgres";
+
+        # lasuite-docs user cannot create a C function as it is unsafe.
+        ExecStart = ''
+          ${lib.getExe' config.services.postgresql.package "psql"} --port=${toString config.services.postgresql.settings.port} -d lasuite-docs -c "CREATE OR REPLACE FUNCTION public.immutable_unaccent(regdictionary, text) RETURNS text LANGUAGE c IMMUTABLE PARALLEL SAFE STRICT AS '$libdir/unaccent', 'unaccent_dict';"
+        '';
+
+        # hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        UMask = "0077";
+      };
+
+    };
+
     systemd.services.lasuite-docs = {
       description = "Docs from SuiteNumérique";
       after = [

From 36e2d53799987d8b0b64a3514b62e7260e839914 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 9 Jan 2026 09:42:45 +0000
Subject: [PATCH 11/74] oh-my-posh: 26.23.6 -> 29.0.2

---
 pkgs/by-name/oh/oh-my-posh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/oh/oh-my-posh/package.nix b/pkgs/by-name/oh/oh-my-posh/package.nix
index f126bf25c82f..4e7fbe6502e5 100644
--- a/pkgs/by-name/oh/oh-my-posh/package.nix
+++ b/pkgs/by-name/oh/oh-my-posh/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "26.23.6";
+  version = "29.0.2";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = "oh-my-posh";
     tag = "v${version}";
-    hash = "sha256-4Po4QKPetRmTfmgq7lTK300h1Nn7spxNxRB9q58yrzo=";
+    hash = "sha256-Ir7E8EyQ1pnDQG4bzn5ZCEkWNpoF/WXBCa8mWqz/66M=";
   };
 
-  vendorHash = "sha256-R1MNLBATbivhP27VfWLGNnZ8uJWzKhx4XhNILc7FCmE=";
+  vendorHash = "sha256-cCeKP1uWVYIfJKMUNk7Hf5voCQdzq9u5gTETgbc86N0=";
 
   sourceRoot = "${src.name}/src";
 

From 3458462336398a2ddc13b208eb8998d9ef999da3 Mon Sep 17 00:00:00 2001
From: jaredmontoya <49511278+jaredmontoya@users.noreply.github.com>
Date: Sat, 10 Jan 2026 22:09:23 +0100
Subject: [PATCH 12/74] wg-access-server: use finalAttrs

---
 pkgs/by-name/wg/wg-access-server/package.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/wg/wg-access-server/package.nix b/pkgs/by-name/wg/wg-access-server/package.nix
index ff3160091133..4c915fd9f310 100644
--- a/pkgs/by-name/wg/wg-access-server/package.nix
+++ b/pkgs/by-name/wg/wg-access-server/package.nix
@@ -8,14 +8,14 @@
   nixosTests,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "wg-access-server";
   version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "freifunkMUC";
     repo = "wg-access-server";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-AhFqEmHrx9MCdjnB/YA3qU7KsaMyLO+vo53VWUrcL8I=";
   };
 
@@ -34,12 +34,12 @@ buildGoModule rec {
   checkFlags = [ "-skip=TestDNSProxy_ServeDNS" ];
 
   ui = buildNpmPackage {
-    inherit version src;
+    inherit (finalAttrs) version src;
     pname = "wg-access-server-ui";
 
     npmDepsHash = "sha256-04AkSDSKsr20Jbx5BJy36f8kWNlzzplu/xnoDTkU8OQ=";
 
-    sourceRoot = "${src.name}/website";
+    sourceRoot = "${finalAttrs.src.name}/website";
 
     installPhase = ''
       mv build $out
@@ -48,11 +48,11 @@ buildGoModule rec {
 
   postPatch = ''
     substituteInPlace internal/services/website_router.go \
-        --replace-fail 'website/build' "${ui}"
+        --replace-fail 'website/build' "${finalAttrs.ui}"
   '';
 
   preBuild = ''
-    VERSION=v${version} go generate buildinfo/buildinfo.go
+    VERSION=v${finalAttrs.version} go generate buildinfo/buildinfo.go
   '';
 
   postInstall = ''
@@ -72,4 +72,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ xanderio ];
     mainProgram = "wg-access-server";
   };
-}
+})

From 4bd9c5cc52805643c46ad997e023eb2f8ac75230 Mon Sep 17 00:00:00 2001
From: jaredmontoya <49511278+jaredmontoya@users.noreply.github.com>
Date: Sat, 10 Jan 2026 22:13:22 +0100
Subject: [PATCH 13/74] wg-access-server: pin nodejs_22

---
 pkgs/by-name/wg/wg-access-server/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/wg/wg-access-server/package.nix b/pkgs/by-name/wg/wg-access-server/package.nix
index 4c915fd9f310..0a0dc6bac438 100644
--- a/pkgs/by-name/wg/wg-access-server/package.nix
+++ b/pkgs/by-name/wg/wg-access-server/package.nix
@@ -6,6 +6,7 @@
   makeWrapper,
   iptables,
   nixosTests,
+  nodejs_22,
 }:
 
 buildGoModule (finalAttrs: {
@@ -37,6 +38,8 @@ buildGoModule (finalAttrs: {
     inherit (finalAttrs) version src;
     pname = "wg-access-server-ui";
 
+    nodejs = nodejs_22;
+
     npmDepsHash = "sha256-04AkSDSKsr20Jbx5BJy36f8kWNlzzplu/xnoDTkU8OQ=";
 
     sourceRoot = "${finalAttrs.src.name}/website";

From 3bf597c14d1171cde46508940b85fa1e9d606f80 Mon Sep 17 00:00:00 2001
From: jaredmontoya <49511278+jaredmontoya@users.noreply.github.com>
Date: Sat, 10 Jan 2026 22:26:45 +0100
Subject: [PATCH 14/74] wg-access-server: 0.12.1 -> 0.13.1

---
 pkgs/by-name/wg/wg-access-server/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/wg/wg-access-server/package.nix b/pkgs/by-name/wg/wg-access-server/package.nix
index 0a0dc6bac438..387e84735ec3 100644
--- a/pkgs/by-name/wg/wg-access-server/package.nix
+++ b/pkgs/by-name/wg/wg-access-server/package.nix
@@ -11,17 +11,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "wg-access-server";
-  version = "0.12.1";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "freifunkMUC";
     repo = "wg-access-server";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-AhFqEmHrx9MCdjnB/YA3qU7KsaMyLO+vo53VWUrcL8I=";
+    hash = "sha256-x4QNEn5SR6D1YIiv+mKnQlZ94jZ7BrdIxiLxBqhtBjg=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-YwFq0KxUctU3ElZBo/b68pyp4lJnFGL9ClKIwUzdngM=";
+  vendorHash = "sha256-pjQeF1+1gr/0pF76KNdK7GDX3pYBTqqY3xbJeMLsJIM=";
 
   env.CGO_ENABLED = 1;
 
@@ -40,7 +40,7 @@ buildGoModule (finalAttrs: {
 
     nodejs = nodejs_22;
 
-    npmDepsHash = "sha256-04AkSDSKsr20Jbx5BJy36f8kWNlzzplu/xnoDTkU8OQ=";
+    npmDepsHash = "sha256-UntV5+9E2lyp8IQGKbbnBNdd0JLvM5NsfkLvCSOgyGo=";
 
     sourceRoot = "${finalAttrs.src.name}/website";
 

From ed0496f11a26dbe6c97490d631afca6d96354b41 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 12 Jan 2026 02:36:23 +0000
Subject: [PATCH 15/74] dstask: 0.26 -> 1.0.1

---
 pkgs/by-name/ds/dstask/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ds/dstask/package.nix b/pkgs/by-name/ds/dstask/package.nix
index 0d137096898b..a92f5f92718d 100644
--- a/pkgs/by-name/ds/dstask/package.nix
+++ b/pkgs/by-name/ds/dstask/package.nix
@@ -6,21 +6,21 @@
 
 buildGoModule rec {
   pname = "dstask";
-  version = "0.26";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "naggie";
     repo = "dstask";
     rev = "v${version}";
-    sha256 = "sha256-xZFQQDK+yGAv4IbuNe2dvNa3GDASeJY2mOYw94goAIM=";
+    sha256 = "sha256-/SXQz+HDkKWGrIArqEjti93mo6Els9haitV0FfWfVTQ=";
   };
 
-  # Set vendorHash to null because dstask vendors its dependencies (meaning
+  # Set vendorHash to "sha256-HSqAbxkkjuMulFymeqApWr/JZ+a7OUTu5EYLGPL/j2U=" because dstask vendors its dependencies (meaning
   # that third party dependencies are stored in the repository).
   #
   # Ref <https://github.com/NixOS/nixpkgs/pull/87383#issuecomment-633204382>
   # and <https://github.com/NixOS/nixpkgs/blob/d4226e3a4b5fcf988027147164e86665d382bbfa/pkgs/development/go-modules/generic/default.nix#L18>
-  vendorHash = null;
+  vendorHash = "sha256-HSqAbxkkjuMulFymeqApWr/JZ+a7OUTu5EYLGPL/j2U=";
 
   doCheck = false;
 

From 660fab09e5e50d4252216c9c12c278d22e0b0653 Mon Sep 17 00:00:00 2001
From: Misaka13514 <Misaka13514@gmail.com>
Date: Mon, 12 Jan 2026 13:34:58 +0800
Subject: [PATCH 16/74] better-adb-sync: init at 1.4.0

Co-authored-by: Lucas Hoffmann <lucc@posteo.de>
Co-authored-by: Yohann Boniface <edhyjox@gmail.com>
---
 pkgs/by-name/be/better-adb-sync/package.nix | 41 +++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 pkgs/by-name/be/better-adb-sync/package.nix

diff --git a/pkgs/by-name/be/better-adb-sync/package.nix b/pkgs/by-name/be/better-adb-sync/package.nix
new file mode 100644
index 000000000000..dc0fb89a7dd6
--- /dev/null
+++ b/pkgs/by-name/be/better-adb-sync/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  android-tools,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "better-adb-sync";
+  version = "1.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jb2170";
+    repo = "better-adb-sync";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ghOpcnQEZiAEZOiVWhrHa66WgiyyYQZgTJEokJFKMRs=";
+  };
+
+  build-system = with python3Packages; [ setuptools ];
+
+  # The tool relies on the `adb` binary being available in the system
+  makeWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [ android-tools ]}"
+  ];
+
+  pythonImportsCheck = [
+    "BetterADBSync"
+  ];
+
+  meta = {
+    description = "Synchronize files between a PC and an Android device using ADB (Android Debug Bridge)";
+    homepage = "https://github.com/jb2170/better-adb-sync";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      lucc
+      Misaka13514
+    ];
+    mainProgram = "adbsync";
+  };
+})

From fe08782fcac26e7db7283c2442d60f07a04a32cd Mon Sep 17 00:00:00 2001
From: Kenichi Kamiya <kachick1@gmail.com>
Date: Thu, 8 Jan 2026 17:03:14 +0900
Subject: [PATCH 17/74] lichess-bot: add versionCheckHook

---
 pkgs/by-name/li/lichess-bot/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/li/lichess-bot/package.nix b/pkgs/by-name/li/lichess-bot/package.nix
index 4f0326d14a03..d62441204bec 100644
--- a/pkgs/by-name/li/lichess-bot/package.nix
+++ b/pkgs/by-name/li/lichess-bot/package.nix
@@ -2,6 +2,7 @@
   lib,
   python3Packages,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 python3Packages.buildPythonApplication {
@@ -43,6 +44,12 @@ python3Packages.buildPythonApplication {
     runHook postInstall
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--disable_auto_logging";
+  doInstallCheck = true;
+
   meta = {
     description = "Bridge between lichess.org and bots";
     homepage = "https://github.com/lichess-bot-devs/lichess-bot";

From 8d3051e0e48bc24bd4062afbb03ea068787d6f1a Mon Sep 17 00:00:00 2001
From: Kenichi Kamiya <kachick1@gmail.com>
Date: Thu, 8 Jan 2026 17:03:14 +0900
Subject: [PATCH 18/74] lichess-bot: add updateScript

---
 pkgs/by-name/li/lichess-bot/package.nix | 28 +++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/pkgs/by-name/li/lichess-bot/package.nix b/pkgs/by-name/li/lichess-bot/package.nix
index d62441204bec..447202dca3e3 100644
--- a/pkgs/by-name/li/lichess-bot/package.nix
+++ b/pkgs/by-name/li/lichess-bot/package.nix
@@ -3,6 +3,10 @@
   python3Packages,
   fetchFromGitHub,
   versionCheckHook,
+  writeShellApplication,
+  curl,
+  jq,
+  common-updater-scripts,
 }:
 
 python3Packages.buildPythonApplication {
@@ -50,6 +54,30 @@ python3Packages.buildPythonApplication {
   versionCheckProgramArg = "--disable_auto_logging";
   doInstallCheck = true;
 
+  passthru = {
+    updateScript = lib.getExe (writeShellApplication {
+      name = "lichess-bot-update-script";
+
+      runtimeInputs = [
+        curl
+        jq
+        common-updater-scripts
+      ];
+
+      text = ''
+        commit_msg='^Auto update version to (?<ver>[0-9.]+)$'
+        commit="$(
+          curl -s 'https://api.github.com/repos/lichess-bot-devs/lichess-bot/commits?path=lib/versioning.yml' | \
+          jq -c "map(select(.commit.message | test(\"$commit_msg\"))) | first"
+        )"
+        rev="$(jq -r '.sha' <<< "$commit")"
+        version="$(jq -r ".commit.message | capture(\"$commit_msg\") | .ver" <<< "$commit")"
+
+        update-source-version lichess-bot "$version" --rev="$rev"
+      '';
+    });
+  };
+
   meta = {
     description = "Bridge between lichess.org and bots";
     homepage = "https://github.com/lichess-bot-devs/lichess-bot";

From 2da1c6a3d08e97b2405bba72c2f84e03c0ad9bbb Mon Sep 17 00:00:00 2001
From: Kenichi Kamiya <kachick1@gmail.com>
Date: Thu, 8 Jan 2026 08:13:32 +0000
Subject: [PATCH 19/74] lichess-bot: 2025.12.23.1 -> 2026.1.7.1

Diff: https://github.com/lichess-bot-devs/lichess-bot/compare/6ea42dfaffa65efea0da09d94b058853d724a989...c2a71a74357386e2219a87da311950e432fcaf2d
---
 pkgs/by-name/li/lichess-bot/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/lichess-bot/package.nix b/pkgs/by-name/li/lichess-bot/package.nix
index 447202dca3e3..19c01bc5ca71 100644
--- a/pkgs/by-name/li/lichess-bot/package.nix
+++ b/pkgs/by-name/li/lichess-bot/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "lichess-bot";
-  version = "2025.12.23.1";
+  version = "2026.1.7.1";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "lichess-bot-devs";
     repo = "lichess-bot";
-    rev = "6ea42dfaffa65efea0da09d94b058853d724a989";
-    hash = "sha256-G8DiW96mRnvmmmRALRcYDnjLilQIRqH5m6+aTluhohI=";
+    rev = "c2a71a74357386e2219a87da311950e432fcaf2d";
+    hash = "sha256-dzpU4VAuOlzBk4bn7iUxJ1hdqYfxb0XqTbtNhTjGWLI=";
   };
 
   propagatedBuildInputs = with python3Packages; [

From 1c7e94b2450d22cfd9f035aa7798da2a8d373e1d Mon Sep 17 00:00:00 2001
From: Kenichi Kamiya <kachick1@gmail.com>
Date: Tue, 13 Jan 2026 04:58:09 +0000
Subject: [PATCH 20/74] lichess-bot: 2026.1.7.1 -> 2026.1.11.1

Diff: https://github.com/lichess-bot-devs/lichess-bot/compare/c2a71a74357386e2219a87da311950e432fcaf2d...96afce91316ba1243290408f2eeb6cd89778e8ff
---
 pkgs/by-name/li/lichess-bot/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/lichess-bot/package.nix b/pkgs/by-name/li/lichess-bot/package.nix
index 19c01bc5ca71..2cf5fa711c8b 100644
--- a/pkgs/by-name/li/lichess-bot/package.nix
+++ b/pkgs/by-name/li/lichess-bot/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "lichess-bot";
-  version = "2026.1.7.1";
+  version = "2026.1.11.1";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "lichess-bot-devs";
     repo = "lichess-bot";
-    rev = "c2a71a74357386e2219a87da311950e432fcaf2d";
-    hash = "sha256-dzpU4VAuOlzBk4bn7iUxJ1hdqYfxb0XqTbtNhTjGWLI=";
+    rev = "96afce91316ba1243290408f2eeb6cd89778e8ff";
+    hash = "sha256-eE6b4VWhBqWjrF028om0NE/UN9+4sI7PoZp4eV6hRcE=";
   };
 
   propagatedBuildInputs = with python3Packages; [

From 1b83abc5c931499a14d5346114f931f0568137ce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 13 Jan 2026 07:39:46 +0000
Subject: [PATCH 21/74] vokoscreen-ng: 4.8.1 -> 4.8.3

---
 pkgs/by-name/vo/vokoscreen-ng/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vo/vokoscreen-ng/package.nix b/pkgs/by-name/vo/vokoscreen-ng/package.nix
index 0e4c5258ca3d..69e030f55d4b 100644
--- a/pkgs/by-name/vo/vokoscreen-ng/package.nix
+++ b/pkgs/by-name/vo/vokoscreen-ng/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vokoscreen-ng";
-  version = "4.8.1";
+  version = "4.8.3";
 
   src = fetchFromGitHub {
     owner = "vkohaupt";
     repo = "vokoscreenNG";
     tag = version;
-    hash = "sha256-3tyAJxWspyvFmy1Ye1FUSCE4Pbo0cSGux8r0qFmA+NM=";
+    hash = "sha256-D2E4G6rq6kFZbwjYhoccl/aROCdpuS8UJu0JKGc8wKU=";
   };
 
   qmakeFlags = [ "src/vokoscreenNG.pro" ];

From ea443042a9edd46d3ef962d247547f480442c901 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dyego=20Aur=C3=A9lio?= <dyegoaurelio@gmail.com>
Date: Tue, 13 Jan 2026 09:13:12 -0300
Subject: [PATCH 22/74] flatpak: 1.16.1 -> 1.16.2

Changes: https://github.com/flatpak/flatpak/releases/tag/1.16.2
---
 pkgs/by-name/fl/flatpak/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fl/flatpak/package.nix b/pkgs/by-name/fl/flatpak/package.nix
index 69f71b3a40ff..e1bf5f0e0b1c 100644
--- a/pkgs/by-name/fl/flatpak/package.nix
+++ b/pkgs/by-name/fl/flatpak/package.nix
@@ -80,7 +80,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flatpak";
-  version = "1.16.1";
+  version = "1.16.2";
 
   # TODO: split out lib once we figure out what to do with triggerdir
   outputs = [
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
-    hash = "sha256-K0fo8tkNNdKTOe144abquzbu+pz6WlyjsNHydQLENnU=";
+    hash = "sha256-aRctGw2Fxo+B5t3wEV+OGwXXOxsBD+qNnssDvIrYQ+s=";
   };
 
   patches = [

From c9111a02eab8b9ce606403aba2ee1eee27c6cabd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 13 Jan 2026 12:39:00 +0000
Subject: [PATCH 23/74] frr: 10.4.1 -> 10.5.1

---
 pkgs/by-name/fr/frr/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/frr/package.nix b/pkgs/by-name/fr/frr/package.nix
index b5d5a9ddf6ad..fd0dc3eebf34 100644
--- a/pkgs/by-name/fr/frr/package.nix
+++ b/pkgs/by-name/fr/frr/package.nix
@@ -80,13 +80,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "frr";
-  version = "10.4.1";
+  version = "10.5.1";
 
   src = fetchFromGitHub {
     owner = "FRRouting";
     repo = "frr";
     rev = "frr-${finalAttrs.version}";
-    hash = "sha256-pEnMOy1/gIs8a/XCGixF3ZkSwUZ1PPuaSFBminY86DA=";
+    hash = "sha256-sTPYIaaF/OfmBMIRS4nRV2Pay03u8R1nUsqMjFH4cFo=";
   };
 
   # Without the std explicitly set, we may run into abseil-cpp

From a99c4effd24281827a86bd5913c5a1c6ca9e7422 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 13 Jan 2026 16:41:38 +0000
Subject: [PATCH 24/74] python3Packages.coinmetrics-api-client: 2025.12.16.20
 -> 2026.1.5.19

---
 .../python-modules/coinmetrics-api-client/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/coinmetrics-api-client/default.nix b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
index 40cdeffdb9f5..56846c9d8723 100644
--- a/pkgs/development/python-modules/coinmetrics-api-client/default.nix
+++ b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "coinmetrics-api-client";
-  version = "2025.12.16.20";
+  version = "2026.1.5.19";
   pyproject = true;
 
   __darwinAllowLocalNetworking = true;
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "coinmetrics_api_client";
-    hash = "sha256-FnoaLUU+x6uOlGdFhx02z/rlpqrHHt7T8TTPmeE0I68=";
+    hash = "sha256-q8uimYYpoEJ2503SLMAROFg4ZwqPpmQJSff7W6D5R6Y=";
   };
 
   pythonRelaxDeps = [ "typer" ];

From 2ac49c8efbbfe1436ed301acc566b2b46cba733d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 13 Jan 2026 17:17:45 +0000
Subject: [PATCH 25/74] talhelper: 3.0.45 -> 3.1.0

---
 pkgs/by-name/ta/talhelper/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ta/talhelper/package.nix b/pkgs/by-name/ta/talhelper/package.nix
index a338ec1ea609..33c15ed5c1e6 100644
--- a/pkgs/by-name/ta/talhelper/package.nix
+++ b/pkgs/by-name/ta/talhelper/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talhelper";
-  version = "3.0.45";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "budimanjojo";
     repo = "talhelper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9oZM6vIyJH8Vw/QhE9SIbrMa4r2LCZdIDRFztFYVVk0=";
+    hash = "sha256-pvJQ6l/Zh5TpGiWe3SXWsUOwFK5WUoGTu76MPyZcXRo=";
   };
 
-  vendorHash = "sha256-jn5zwEvFqasjQt6FTQpcX8qJ11lM03aMhGyapOOjclA=";
+  vendorHash = "sha256-AkCUKg5oA2XvvDtE0m9fQdeqowx5A1SnnimF7F/CORg=";
 
   ldflags = [
     "-s"

From ba0dff3eb39f365000285c613c2ce7fcb7dd49b7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 13 Jan 2026 23:14:33 +0000
Subject: [PATCH 26/74] python3Packages.langgraph-prebuilt: 1.0.5 -> 1.0.6

---
 .../development/python-modules/langgraph-prebuilt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langgraph-prebuilt/default.nix b/pkgs/development/python-modules/langgraph-prebuilt/default.nix
index 246ccccb5f2b..90f5a5f7bf10 100644
--- a/pkgs/development/python-modules/langgraph-prebuilt/default.nix
+++ b/pkgs/development/python-modules/langgraph-prebuilt/default.nix
@@ -31,14 +31,14 @@
 # It exists so the langgraph team can iterate on it without having to rebuild langgraph.
 buildPythonPackage rec {
   pname = "langgraph-prebuilt";
-  version = "1.0.5";
+  version = "1.0.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "prebuilt==${version}";
-    hash = "sha256-Vytt5c1GZyQAILs09Z40n80XDoSKXyAb+cFwjK5JySY=";
+    hash = "sha256-IE9Y+kFkDN49SuwvTNwa2kK+Hig18sJPZmZCqHUP3DM=";
   };
 
   sourceRoot = "${src.name}/libs/prebuilt";

From afbcf8cbcc84e232effb54e110a3901de4d208df Mon Sep 17 00:00:00 2001
From: transcaffeine <transcaffeine@finally.coffee>
Date: Tue, 13 Jan 2026 19:06:47 +0100
Subject: [PATCH 27/74] matrix-synapse: 1.144.0 -> 1.145.0

Release notes: https://github.com/element-hq/synapse/releases/tag/v1.145.0
Full changelog: https://github.com/element-hq/synapse/compare/v1.144.0...v1.145.0
---
 .../ma/matrix-synapse-unwrapped/package.nix   | 27 ++++++++++---------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
index 64c7c375c63a..3317a0b118ea 100644
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@@ -14,31 +14,29 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.144.0";
+  version = "1.145.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-7m0VHiTNx00bgWFbbdXX6tX9pN89IXHbvx04pp2IwnE=";
+    hash = "sha256-JFMxnp4//Q8t6LZf6L2jJxaShE51r4MY7eJvD9JhhVo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-CKvdWo9/f8Uhi5idgRhyuZwYua6gQzoKz21XNMaXdl0=";
+    hash = "sha256-CnytwGtv/ZoJl03XFLLMTHDiRhWDgWlJD8L/QRiebyM=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools_rust>=1.3,<=1.11.1" "setuptools_rust<=1.12,>=1.3" \
-      --replace-fail "poetry-core>=2.0.0,<=2.1.3" "poetry-core>=2.0.0,<=2.3.0"
-  '';
-
-  build-system = with python3Packages; [
-    poetry-core
-    setuptools-rust
-  ];
+  build-system =
+    with python3Packages;
+    [
+      poetry-core
+    ]
+    ++ [
+      rustPlatform.maturinBuildHook
+    ];
 
   nativeBuildInputs = [
     rustPlatform.cargoSetupHook
@@ -80,8 +78,11 @@ python3Packages.buildPythonApplication rec {
       pydantic
       pymacaroons
       pyopenssl
+      pyparsing
+      pyrsistent
       pyyaml
       service-identity
+      setuptools-rust
       signedjson
       sortedcontainers
       treq

From 6ea749caf9c48b2eaf629cd57930b6eadf0c9178 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 14 Jan 2026 21:15:15 +0000
Subject: [PATCH 28/74] vscode-extensions.charliermarsh.ruff: 2025.32.0 ->
 2026.34.0

---
 .../vscode/extensions/charliermarsh.ruff/default.nix   | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix b/pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix
index 18dc7cd09d39..04cf86d939b0 100644
--- a/pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix
@@ -12,26 +12,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-oN7pb/KKhzx7LgODvEh5GyX9Nismtz1lsDcGsDlmaO0=";
+          hash = "sha256-Mm0OXz9yURDyi8liVhbzrAAFB+atfSu4YKaanxsLN1s=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-MeX4waPhX4/hmQH+iYs+RZlRGC/giXOtXG31zSAzcKI=";
+          hash = "sha256-wWIve2qM3qXcuuCA63Xc5S69UdOTvNDWjyQfaBsRruA=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-pALbGD8Gikfyn4wNjCK9CTwZzaK/LjfHfJmFW0ns+yo=";
+          hash = "sha256-1ckD1nc2K/hJHZPXDZ/eCE2zIQGkvDJGyDiFD/3V/xs=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-Tr6KjEDTtCH3EgSKK0WqU/5w8gjSz3azhxHVHlXwZTw=";
+          hash = "sha256-T6+9h5pn/NI7ZDvl9hmCu8KWrleRiZ8qLEfsKPXO56A=";
         };
       };
     in
     {
       name = "ruff";
       publisher = "charliermarsh";
-      version = "2025.32.0";
+      version = "2026.34.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

From 0e3a70315ff7dff67b2aa895f6130cc8313ff18d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Dec 2025 17:34:32 +0000
Subject: [PATCH 29/74] python3Packages.sdbus: 0.14.1.post0 -> 0.14.2

---
 pkgs/development/python-modules/sdbus/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sdbus/default.nix b/pkgs/development/python-modules/sdbus/default.nix
index 73e56df93037..f94786379a0a 100644
--- a/pkgs/development/python-modules/sdbus/default.nix
+++ b/pkgs/development/python-modules/sdbus/default.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "sdbus";
-  version = "0.14.1.post0";
+  version = "0.14.2";
 in
 buildPythonPackage {
   format = "setuptools";
@@ -19,7 +19,7 @@ buildPythonPackage {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rjkVqz4/ChFmMuHlh235krlSnoKwtJIAbrIvh5Htbes=";
+    hash = "sha256-T10TsZbh4d41MR67JWOjLeeRRRow9bmkiUUouph2ZBI=";
   };
 
   meta = {

From 868e6e5f2ac6dd4a1770637d4f1ee9a76f731453 Mon Sep 17 00:00:00 2001
From: natsukium <tomoya.otabi@gmail.com>
Date: Thu, 15 Jan 2026 10:04:03 +0900
Subject: [PATCH 30/74] python3Packages.sdbus: modernize

---
 .../python-modules/sdbus/default.nix          | 42 +++++++++++++------
 1 file changed, 30 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/sdbus/default.nix b/pkgs/development/python-modules/sdbus/default.nix
index f94786379a0a..f5f9b193c265 100644
--- a/pkgs/development/python-modules/sdbus/default.nix
+++ b/pkgs/development/python-modules/sdbus/default.nix
@@ -2,31 +2,49 @@
   pkgs,
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   pkg-config,
+  dbus,
+  setuptools,
+  pytestCheckHook,
 }:
 
-let
+buildPythonPackage (finalAttrs: {
   pname = "sdbus";
   version = "0.14.2";
-in
-buildPythonPackage {
-  format = "setuptools";
-  inherit pname version;
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "python-sdbus";
+    repo = "python-sdbus";
+    tag = finalAttrs.version;
+    hash = "sha256-vRz7RTSI5QjI48YnaC20mbOKl6+yXk/TrFicQ0MDR9Q=";
+  };
+
+  build-system = [ setuptools ];
 
   nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [ pkgs.systemd ];
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-T10TsZbh4d41MR67JWOjLeeRRRow9bmkiUUouph2ZBI=";
-  };
+  pythonImportsCheck = [ "sdbus" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    dbus
+  ];
+
+  disabledTestPaths = [
+    # try to access /var/lib/dbus/machine-id
+    "test/test_proxies.py::TestFreedesktopDbus::test_connection"
+    "test/test_sdbus_block.py::TestSync::test_sync"
+  ];
 
   meta = {
     description = "Modern Python library for D-Bus";
     homepage = "https://github.com/python-sdbus/python-sdbus";
-    license = lib.licenses.lgpl2;
+    license = lib.licenses.lgpl2Plus;
     maintainers = with lib.maintainers; [ camelpunch ];
     platforms = lib.platforms.linux;
   };
-}
+})

From a6806394328c0a76c05dcc70951be5b2a67ba2b6 Mon Sep 17 00:00:00 2001
From: crapStone <me@crapstone.dev>
Date: Thu, 15 Jan 2026 22:43:17 +0100
Subject: [PATCH 31/74] magnetic-catppuccin-gtk: 0-unstable-2025-04-25 ->
 0-unstable-2026-01-15

The upstream repo got updated and new colors are available now.
See the options in the README: https://github.com/Fausto-Korpsvart/Catppuccin-GTK-Theme?tab=readme-ov-file#options
---
 .../ma/magnetic-catppuccin-gtk/package.nix    | 23 ++++++++++++-------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/ma/magnetic-catppuccin-gtk/package.nix b/pkgs/by-name/ma/magnetic-catppuccin-gtk/package.nix
index b05514106395..8c3580076fcb 100644
--- a/pkgs/by-name/ma/magnetic-catppuccin-gtk/package.nix
+++ b/pkgs/by-name/ma/magnetic-catppuccin-gtk/package.nix
@@ -13,14 +13,21 @@
 let
   validAccents = [
     "default"
-    "purple"
+    "blue"
+    "flamingo"
+    "green"
+    "grey"
+    "lavender"
+    "maroon"
+    "mauve"
+    "peach"
     "pink"
     "red"
-    "orange"
-    "yellow"
-    "green"
+    "rosewater"
+    "sapphire"
+    "sky"
     "teal"
-    "grey"
+    "yellow"
     "all"
   ];
   validShades = [
@@ -59,13 +66,13 @@ lib.checkListOfEnum "${pname} Valid theme accent(s)" validAccents accent lib.che
   stdenv.mkDerivation
   {
     pname = "magnetic-${lib.toLower pname}";
-    version = "0-unstable-2025-04-25";
+    version = "0-unstable-2026-01-15";
 
     src = fetchFromGitHub {
       owner = "Fausto-Korpsvart";
       repo = "Catppuccin-GTK-Theme";
-      rev = "c961826d027ed93fae12a9a309616e36d140e6b9";
-      hash = "sha256-7F4FrhM+kBFPeLp2mjmYkoDiF9iKDUkC27LUBuFyz7g=";
+      rev = "f25d8cf688d8f224f0ce396689ffcf5767eb647e";
+      hash = "sha256-W+NGyPnOEKoicJPwnftq26iP7jya1ZKq38lMjx/k9ss=";
     };
 
     nativeBuildInputs = [

From 9f701e21a8ebafcbd038c73dd007e6829a825006 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 16 Jan 2026 04:06:32 +0000
Subject: [PATCH 32/74] firefly-iii-data-importer: 2.0.2 -> 2.0.4

---
 pkgs/by-name/fi/firefly-iii-data-importer/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
index d7e651d17baf..f1098d2df592 100644
--- a/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
+++ b/pkgs/by-name/fi/firefly-iii-data-importer/package.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii-data-importer";
-  version = "2.0.2";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "data-importer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+oc6FJwlixJ6PNQmZoZxUveR3h+zRopptMYm6ef9r/I=";
+    hash = "sha256-PeJf0b15865iz6q3vPNIIEg8UggP7OTukyRn3yLI25o=";
   };
 
   buildInputs = [ php84 ];
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   composerStrictValidation = true;
   strictDeps = true;
 
-  vendorHash = "sha256-y8tGv5dgGHV2moBgYKSvBoc0SfHvt7HbSrctoAdMQGE=";
+  vendorHash = "sha256-hNapeTzqsDqfnG3iea6+bOdb6wd/6fgyfMpEnj5lhB4=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;

From 1edcb6de1ef6c4263f8a9c3f16ebf97356cfb1f7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 16 Jan 2026 08:31:49 +0000
Subject: [PATCH 33/74] owi: 0.2-unstable-2025-12-22 -> 0.2-unstable-2026-01-12

---
 pkgs/by-name/ow/owi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ow/owi/package.nix b/pkgs/by-name/ow/owi/package.nix
index b94a14af7dc9..a2571d2788a6 100644
--- a/pkgs/by-name/ow/owi/package.nix
+++ b/pkgs/by-name/ow/owi/package.nix
@@ -15,14 +15,14 @@ let
 in
 ocamlPackages.buildDunePackage {
   pname = "owi";
-  version = "0.2-unstable-2025-12-22";
+  version = "0.2-unstable-2026-01-12";
 
   src = fetchFromGitHub {
     owner = "ocamlpro";
     repo = "owi";
-    rev = "014840cd9d87c912577822b171407bf7453373f0";
+    rev = "fcfafe953edbf73a1be00e029564c65193f2ad4b";
     fetchSubmodules = true;
-    hash = "sha256-Mjd2XyPmAsonCcV98L8p9S0yYlJV8OEg2TPjZhzVBj8=";
+    hash = "sha256-Vnty6fZNSmgFTNjWPiqLu5jdtomPuirBz8i9tWBSBR8=";
   };
 
   nativeBuildInputs = with ocamlPackages; [

From 54b185e3526f4c564516beb099f825b336316952 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 16 Jan 2026 13:21:23 +0100
Subject: [PATCH 34/74] knot-dns: 3.5.2 -> 3.5.3

https://gitlab.nic.cz/knot/knot-dns/-/releases/v3.5.3#knot-dns-353-2026-01-16
---
 pkgs/by-name/kn/knot-dns/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/kn/knot-dns/package.nix b/pkgs/by-name/kn/knot-dns/package.nix
index 09bf158893bc..c149b3d7faf3 100644
--- a/pkgs/by-name/kn/knot-dns/package.nix
+++ b/pkgs/by-name/kn/knot-dns/package.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.5.2";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "6f577c247ef870a55fe3377246bc1c2d643c673cd32de6c26231ff51d3fc7093";
+    sha256 = "e003ad1eef229c4e65a6cac876ee773e25a06177ecdc83795a26617a6eebe471";
   };
 
   outputs = [

From 07db9279c06c4fca9f3b4468638a048b0bb1bb57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 16 Jan 2026 13:25:34 +0100
Subject: [PATCH 35/74] knot-dns: add knot-resolver-manager_6 to
 .passthru.tests

---
 pkgs/by-name/kn/knot-dns/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/kn/knot-dns/package.nix b/pkgs/by-name/kn/knot-dns/package.nix
index c149b3d7faf3..b047cd0d7d7e 100644
--- a/pkgs/by-name/kn/knot-dns/package.nix
+++ b/pkgs/by-name/kn/knot-dns/package.nix
@@ -27,6 +27,7 @@
   autoreconfHook,
   nixosTests,
   knot-resolver_5,
+  knot-resolver-manager_6,
   knot-dns,
   runCommandLocal,
 }:
@@ -116,6 +117,7 @@ stdenv.mkDerivation rec {
     inherit knot-resolver_5;
   }
   // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    inherit knot-resolver-manager_6; # not very reliable on non-Linux yet
     inherit (nixosTests) knot kea;
     prometheus-exporter = nixosTests.prometheus-exporters.knot;
     # Some dependencies are very version-sensitive, so the might get dropped

From 65ac39ad70e653a707115c10ffded3bd361a5374 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 16 Jan 2026 13:37:59 +0100
Subject: [PATCH 36/74] python3Packages.libknot: 3.5.1 -> 3.5.3

---
 pkgs/development/python-modules/libknot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/libknot/default.nix b/pkgs/development/python-modules/libknot/default.nix
index ea102d8f55a6..900e6b9e7bed 100644
--- a/pkgs/development/python-modules/libknot/default.nix
+++ b/pkgs/development/python-modules/libknot/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "libknot";
-  version = "3.5.1";
+  version = "3.5.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-O4kMd07Tmiy+q/klMCoeSp23EkZNoKKeuUHMhzn+118=";
+    hash = "sha256-jnJ7xWO29V04Xln8xSZ+ky5ravQ2rEpSRx8Xh6PWbyw=";
   };
 
   postPatch = ''

From 1cbca60e46fc1798b21db260961ebc362dc86cd3 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 16 Jan 2026 13:38:42 +0100
Subject: [PATCH 37/74] prometheus-knot-exporter: 3.5.1 -> 3.5.3

---
 pkgs/servers/monitoring/prometheus/knot-exporter.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/monitoring/prometheus/knot-exporter.nix b/pkgs/servers/monitoring/prometheus/knot-exporter.nix
index 838512a71545..b02cfe0ddedc 100644
--- a/pkgs/servers/monitoring/prometheus/knot-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/knot-exporter.nix
@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "knot-exporter";
-  version = "3.5.1";
+  version = "3.5.3";
   pyproject = true;
 
   src = fetchPypi {
     pname = "knot_exporter";
     inherit version;
-    hash = "sha256-BsNjzqGSH5Pn+deL2rM0XMVvpGdRfzuo4vzbG4I5Mtw=";
+    hash = "sha256-sCmzYS6mjEUHomA25HRxJs2X+9Uv50ll4tqR2BAj0ro=";
   };
 
   build-system = [

From 89d96b84d6e28414473f8547c86719248a6cb5b2 Mon Sep 17 00:00:00 2001
From: Wim de With <wf@dewith.io>
Date: Fri, 16 Jan 2026 19:33:08 +0100
Subject: [PATCH 38/74] python3Packages.ansible-pylibssh: add maintainer
 wfdewith

---
 pkgs/development/python-modules/ansible-pylibssh/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/ansible-pylibssh/default.nix b/pkgs/development/python-modules/ansible-pylibssh/default.nix
index 8d8bf4947bb4..46836601965e 100644
--- a/pkgs/development/python-modules/ansible-pylibssh/default.nix
+++ b/pkgs/development/python-modules/ansible-pylibssh/default.nix
@@ -44,5 +44,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/ansible/pylibssh";
     changelog = "https://github.com/ansible/pylibssh/releases/tag/v${version}";
     license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ wfdewith ];
   };
 }

From 9b6bd8036273c338d78a1e69e4f3a38cb288e746 Mon Sep 17 00:00:00 2001
From: Wim de With <wf@dewith.io>
Date: Fri, 16 Jan 2026 19:34:20 +0100
Subject: [PATCH 39/74] python3Packages.ansible-pylibssh: remove unnecessary
 patching

---
 pkgs/development/python-modules/ansible-pylibssh/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/development/python-modules/ansible-pylibssh/default.nix b/pkgs/development/python-modules/ansible-pylibssh/default.nix
index 46836601965e..9f8cda72a65c 100644
--- a/pkgs/development/python-modules/ansible-pylibssh/default.nix
+++ b/pkgs/development/python-modules/ansible-pylibssh/default.nix
@@ -21,11 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-dT5XDc3OtquONi6RzA1Zk77ryT0oe4gXjbVVCfZCOrU=";
   };
 
-  # Remove after https://github.com/ansible/pylibssh/pull/502 is merged
-  postPatch = ''
-    sed -i "/setuptools_scm_git_archive/d" pyproject.toml
-  '';
-
   build-system = [
     cython
     expandvars

From c03e9b1efe6422b6c7c028675d6feef8820c29ba Mon Sep 17 00:00:00 2001
From: Oli <oli@olillin.com>
Date: Fri, 16 Jan 2026 21:07:44 +0100
Subject: [PATCH 40/74] oh-my-posh: add olillin as maintainer

---
 pkgs/by-name/oh/oh-my-posh/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/oh/oh-my-posh/package.nix b/pkgs/by-name/oh/oh-my-posh/package.nix
index 6b53349e9ea1..26e1f8a5fcf4 100644
--- a/pkgs/by-name/oh/oh-my-posh/package.nix
+++ b/pkgs/by-name/oh/oh-my-posh/package.nix
@@ -53,6 +53,7 @@ buildGoModule rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       lucperkins
+      olillin
     ];
   };
 }

From b58ffd268c1efbe387cc0673911f759017333ccc Mon Sep 17 00:00:00 2001
From: Tom Vincent <git@tlvince.com>
Date: Fri, 16 Jan 2026 18:18:25 +0000
Subject: [PATCH 41/74] vimPlugins.vim-waikiki: init at 0-unstable-2020-09-19

https://github.com/fcpg/vim-waikiki
---
 pkgs/applications/editors/vim/plugins/generated.nix | 13 +++++++++++++
 .../editors/vim/plugins/vim-plugin-names            |  1 +
 2 files changed, 14 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ae9cad30b8d7..04326c4c71c5 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -22118,6 +22118,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vim-waikiki = buildVimPlugin {
+    pname = "vim-waikiki";
+    version = "0-unstable-2020-09-19";
+    src = fetchFromGitHub {
+      owner = "fcpg";
+      repo = "vim-waikiki";
+      rev = "7af1879a8ea0e4a0a7bd181ed17ad3d37478215e";
+      hash = "sha256-8zMKrmCV4Erp0Q4WyuqyyKgZS5JGu1dXSzrhftdmNFE=";
+    };
+    meta.homepage = "https://github.com/fcpg/vim-waikiki/";
+    meta.hydraPlatforms = [ ];
+  };
+
   vim-wakatime = buildVimPlugin {
     pname = "vim-wakatime";
     version = "11.3.0-unstable-2025-08-31";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index daaa5dd2b5e9..aad3e13cc25e 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1698,6 +1698,7 @@ https://github.com/hrsh7th/vim-vsnip/,,
 https://github.com/hrsh7th/vim-vsnip-integ/,,
 https://github.com/posva/vim-vue/,,
 https://github.com/leafOfTree/vim-vue-plugin/,HEAD,
+https://github.com/fcpg/vim-waikiki/,HEAD,
 https://github.com/wakatime/vim-wakatime/,,
 https://github.com/osyo-manga/vim-watchdogs/,,
 https://github.com/jasonccox/vim-wayland-clipboard/,,

From ab729870ff8ce21297d4e027d0464f9395e702a7 Mon Sep 17 00:00:00 2001
From: Liam McDermott <liam@woolwichweb.works>
Date: Mon, 29 Dec 2025 15:28:08 -0500
Subject: [PATCH 42/74] build-support/php: fix composer hook defaults and
 lockfile handling

---
 .../builders/v2/build-composer-project.nix    | 19 ++++++----
 .../php/builders/v2/build-composer-vendor.nix | 16 ++++----
 .../v2/hooks/composer-install-hook.sh         | 38 ++++++++++++++-----
 .../builders/v2/hooks/composer-vendor-hook.sh |  7 ++--
 4 files changed, 51 insertions(+), 29 deletions(-)

diff --git a/pkgs/build-support/php/builders/v2/build-composer-project.nix b/pkgs/build-support/php/builders/v2/build-composer-project.nix
index 4eae35d8081f..b22750a75eac 100644
--- a/pkgs/build-support/php/builders/v2/build-composer-project.nix
+++ b/pkgs/build-support/php/builders/v2/build-composer-project.nix
@@ -9,14 +9,14 @@ let
   buildComposerProjectOverride =
     finalAttrs:
     {
-      php ? finalAttrs.php or toplevel.php,
-      composer ? finalAttrs.php.packages.composer or toplevel.php.packages.composer,
-      composerLock ? finalAttrs.composerLock or null,
-      vendorHash ? finalAttrs.vendorHash or "",
-      composerNoDev ? finalAttrs.composerNoDev or true,
-      composerNoPlugins ? finalAttrs.composerNoPlugins or true,
-      composerNoScripts ? finalAttrs.composerNoScripts or true,
-      composerStrictValidation ? finalAttrs.composerStrictValidation or true,
+      php ? toplevel.php,
+      composer ? php.packages.composer,
+      composerLock ? null,
+      vendorHash ? "",
+      composerNoDev ? true,
+      composerNoPlugins ? true,
+      composerNoScripts ? true,
+      composerStrictValidation ? true,
       buildInputs ? [ ],
       nativeBuildInputs ? [ ],
       strictDeps ? true,
@@ -35,6 +35,9 @@ let
         doCheck
         doInstallCheck
         dontCheckForBrokenSymlinks
+        composerNoDev
+        composerNoPlugins
+        composerNoScripts
         ;
 
       nativeBuildInputs = nativeBuildInputs ++ [
diff --git a/pkgs/build-support/php/builders/v2/build-composer-vendor.nix b/pkgs/build-support/php/builders/v2/build-composer-vendor.nix
index 6aac194e23b0..58d147b2738d 100644
--- a/pkgs/build-support/php/builders/v2/build-composer-vendor.nix
+++ b/pkgs/build-support/php/builders/v2/build-composer-vendor.nix
@@ -8,14 +8,14 @@ let
   mkComposerVendorOverride =
     finalAttrs:
     {
-      php ? finalAttrs.php or toplevel.php,
-      composer ? finalAttrs.php.packages.composer or toplevel.php.packages.composer,
-      composerLock ? finalAttrs.composerLock or null,
-      vendorHash ? finalAttrs.vendorHash or "",
-      composerNoDev ? finalAttrs.composerNoDev or true,
-      composerNoPlugins ? finalAttrs.composerNoPlugins or true,
-      composerNoScripts ? finalAttrs.composerNoScripts or true,
-      composerStrictValidation ? finalAttrs.composerStrictValidation or true,
+      php ? toplevel.php,
+      composer ? php.packages.composer,
+      composerLock ? null,
+      vendorHash ? "",
+      composerNoDev ? true,
+      composerNoPlugins ? true,
+      composerNoScripts ? true,
+      composerStrictValidation ? true,
       buildInputs ? [ ],
       nativeBuildInputs ? [ ],
       dontPatchShebangs ? true,
diff --git a/pkgs/build-support/php/builders/v2/hooks/composer-install-hook.sh b/pkgs/build-support/php/builders/v2/hooks/composer-install-hook.sh
index 19783d08fb1c..1a4f32f63cc8 100644
--- a/pkgs/build-support/php/builders/v2/hooks/composer-install-hook.sh
+++ b/pkgs/build-support/php/builders/v2/hooks/composer-install-hook.sh
@@ -11,9 +11,9 @@ declare -g composerNoScripts
 
 declare -ga composerFlags=()
 
-[[ 1 == "${composerNoDev:-1}" ]] && composerFlags+=(--no-dev)
-[[ 1 == "${composerNoPlugins:-1}" ]] && composerFlags+=(--no-plugins)
-[[ 1 == "${composerNoScripts:-1}" ]] && composerFlags+=(--no-scripts)
+[[ -n "${composerNoDev-1}" ]] && composerFlags+=(--no-dev)
+[[ -n "${composerNoPlugins-1}" ]] && composerFlags+=(--no-plugins)
+[[ -n "${composerNoScripts-1}" ]] && composerFlags+=(--no-scripts)
 
 preConfigureHooks+=(composerInstallConfigureHook)
 preBuildHooks+=(composerInstallBuildHook)
@@ -57,13 +57,31 @@ composerInstallBuildHook() {
   cp -r "${composerVendor}/${COMPOSER_VENDOR_DIR}" .
   chmod -R +w "${COMPOSER_VENDOR_DIR}"
 
-  echo -e "\e[32mGenerating optimized autoloader and restoring 'bin' directory...\e[0m"
-  COMPOSER_DISABLE_NETWORK=1 composer \
-    "${composerFlags[@]}" \
-    --no-interaction \
-    --no-progress \
-    --optimize-autoloader \
-    install
+  mapfile -t installer_paths < <(jq -r -c 'try((.extra."installer-paths") | keys[])' composer.json)
+  for installer_path in "${installer_paths[@]}"; do
+    # Remove everything after {$name} placeholder
+    installer_path="${installer_path/\{\$name\}*/}"
+    if [[ -e "${composerVendor}/${installer_path}" ]]; then
+      echo -e "\e[32mRestoring custom installer path: ${installer_path}\e[0m"
+      mkdir -p "$(dirname "${installer_path}")"
+      cp -ar "${composerVendor}/${installer_path}" "${installer_path}"
+      # Strip out the git repositories
+      find "${installer_path}" -name .git -type d -prune -print -exec rm -rf {} ";" || true
+      chmod -R +w "${installer_path}"
+    fi
+  done
+
+  # Run this only if composer.lock is available.
+  # e.g., php-codesniffer doesn't need a composer.lock file.
+  if [[ -f "composer.lock" ]]; then
+    echo -e "\e[32mEnsuring Composer dependencies are locked to 'composer.lock'...\e[0m"
+    composer \
+      --no-cache \
+      --no-interaction \
+      --no-progress \
+      "${composerFlags[@]}" \
+      install
+  fi
 
   echo "Finished phase: composerInstallBuildHook"
 }
diff --git a/pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh b/pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh
index f14a53778a90..6916ff51075f 100644
--- a/pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh
+++ b/pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh
@@ -10,9 +10,10 @@ declare -g composerNoPlugins
 declare -g composerNoScripts
 
 declare -ga composerFlags=()
-[[ 1 == "${composerNoDev:-1}" ]] && composerFlags+=(--no-dev)
-[[ 1 == "${composerNoPlugins:-1}" ]] && composerFlags+=(--no-plugins)
-[[ 1 == "${composerNoScripts:-1}" ]] && composerFlags+=(--no-scripts)
+
+[[ -n "${composerNoDev-1}" ]] && composerFlags+=(--no-dev)
+[[ -n "${composerNoPlugins-1}" ]] && composerFlags+=(--no-plugins)
+[[ -n "${composerNoScripts-1}" ]] && composerFlags+=(--no-scripts)
 
 preConfigureHooks+=(composerVendorConfigureHook)
 preBuildHooks+=(composerVendorBuildHook)

From 61235fc36a4f8c73b02293f6b29c882cf7c376b0 Mon Sep 17 00:00:00 2001
From: Liam McDermott <liam@woolwichweb.works>
Date: Fri, 2 Jan 2026 19:03:38 -0500
Subject: [PATCH 43/74] drupal: update composer fod hash

---
 pkgs/by-name/dr/drupal/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/dr/drupal/package.nix b/pkgs/by-name/dr/drupal/package.nix
index 77ec96ab2fdd..4eefb854808a 100644
--- a/pkgs/by-name/dr/drupal/package.nix
+++ b/pkgs/by-name/dr/drupal/package.nix
@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerNoPlugins = false;
-  vendorHash = "sha256-CAntERLTmR9Gf/e+qBLJqqebdXZ0E9k8ifDh75ASoRo=";
+  vendorHash = "sha256-7FwwkPTKc/miStdHv1wfLoZhV4Gku1KwNgSlWdpPG8g=";
 
   passthru = {
     tests = {

From 6797226ba160c29a6b7d71c75090c37d957c6f4b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 17 Jan 2026 00:28:39 +0000
Subject: [PATCH 44/74] python3Packages.chromadb: 1.4.0 -> 1.4.1

---
 pkgs/development/python-modules/chromadb/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index ae5cc6d03206..057a2aed279f 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -68,14 +68,14 @@
 
 buildPythonPackage rec {
   pname = "chromadb";
-  version = "1.4.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chroma-core";
     repo = "chroma";
     tag = version;
-    hash = "sha256-1saQEMaGuhXT+3bSlxl7yCXYptsOiYh3Uyn4Izn5Q4M=";
+    hash = "sha256-mtUxyuLiwA4l9u+pTPVIsYcvsLPPCI6c8iWK6Lgbwjc=";
   };
 
   # https://github.com/chroma-core/chroma/issues/5996
@@ -83,7 +83,7 @@ buildPythonPackage rec {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-zqE3NhTYrHol5Y6/CRMPQeq43Wo+ofic9SrMLqyJJPs=";
+    hash = "sha256-WdWc/8vNzcEtdxmAAbBDWxhMamxSnK2YaZPWwQ2zzU4=";
   };
 
   # Can't use fetchFromGitHub as the build expects a zipfile

From 4f4305abc51387f161723d6f05f65b54010b51b7 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Fri, 31 Oct 2025 17:23:24 -0400
Subject: [PATCH 45/74] buildMozillaMach: fix comment typo

---
 pkgs/build-support/build-mozilla-mach/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 58502c3ed32f..1545c9335cdd 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -163,7 +163,7 @@ in
   geolocationSupport ? !privacySupport,
   webrtcSupport ? !privacySupport,
 
-  # digital rights managemewnt
+  # digital rights management
 
   # This flag controls whether Firefox will show the nagbar, that allows
   # users at runtime the choice to enable Widevine CDM support when a site

From 80a81a80707477df9aadceaec78f256af54d7fa8 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Fri, 31 Oct 2025 17:26:57 -0400
Subject: [PATCH 46/74] buildMozillaMach: enable LTO for Darwin

---
 pkgs/build-support/build-mozilla-mach/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 1545c9335cdd..ad35fb74295d 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -130,7 +130,9 @@ in
   jemallocSupport ? !stdenv.hostPlatform.isMusl,
   jemalloc,
   ltoSupport ? (
-    stdenv.hostPlatform.isLinux && stdenv.hostPlatform.is64bit && !stdenv.hostPlatform.isRiscV
+    (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin)
+    && stdenv.hostPlatform.is64bit
+    && !stdenv.hostPlatform.isRiscV
   ),
   overrideCC,
   buildPackages,
@@ -466,7 +468,7 @@ buildStdenv.mkDerivation {
     "--host=${buildStdenv.buildPlatform.config}"
     "--target=${buildStdenv.hostPlatform.config}"
   ]
-  # LTO is done using clang and lld on Linux.
+  # LTO is done using clang and lld.
   ++ lib.optionals ltoSupport [
     "--enable-lto=cross,full" # Cross-Language LTO
     "--enable-linker=lld"

From 637e158045878dde9e024e7214d17d606a0e0c6b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 17 Jan 2026 03:18:01 +0000
Subject: [PATCH 47/74] home-assistant-custom-components.tuya_local: 2025.12.3
 -> 2026.1.1

---
 .../home-assistant/custom-components/tuya_local/package.nix   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
index 07fcd391686f..a4860be1b4bc 100644
--- a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "make-all";
   domain = "tuya_local";
-  version = "2025.12.3";
+  version = "2026.1.1";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "tuya-local";
     tag = version;
-    hash = "sha256-KKBon2SC7rW7Vgr/8r77mRvb+ii/ZnuJLHW9DQoqN5o=";
+    hash = "sha256-8dtzGAp7i5vKP371XaOX96WilBxLMxHn4Sc/XfrhDo0=";
   };
 
   dependencies = [

From 289acac329ef61df462d007e4b03d8fae38df99e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 17 Jan 2026 08:34:11 +0000
Subject: [PATCH 48/74] bento: 1.14.0 -> 1.14.1

---
 pkgs/by-name/be/bento/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/be/bento/package.nix b/pkgs/by-name/be/bento/package.nix
index 45889d77b3bf..20e339cad61d 100644
--- a/pkgs/by-name/be/bento/package.nix
+++ b/pkgs/by-name/be/bento/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "bento";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "warpstreamlabs";
     repo = "bento";
     tag = "v${version}";
-    hash = "sha256-60hWz6DgJk5PJR/W19lFVxIubZBPLZ3SENc/3bpA9hs=";
+    hash = "sha256-hnDWnN07sf8ymSbwrVIQJrgiEKr81osswcGi8emSGac=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-G9slXTly5cJT93wQrD8eITsF0rVdrpRW4r/YTYqW/Mc=";
+  vendorHash = "sha256-pCfDRnCoEjeuFuLthk6zQ1Gh4Cb+Ix9J+lh1sqA1Bf8=";
 
   subPackages = [
     "cmd/bento"

From 724228b5be8aa7d74943368be98aaf6191163d4b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 17 Jan 2026 10:00:03 +0100
Subject: [PATCH 49/74] libsignal-ffi: 0.86.8 -> 0.86.12

ChangeLog:
* https://github.com/signalapp/libsignal/releases/tag/v0.86.9
* https://github.com/signalapp/libsignal/releases/tag/v0.86.10
* https://github.com/signalapp/libsignal/releases/tag/v0.86.11
* https://github.com/signalapp/libsignal/releases/tag/v0.86.12
---
 pkgs/by-name/li/libsignal-ffi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libsignal-ffi/package.nix b/pkgs/by-name/li/libsignal-ffi/package.nix
index 35a236399004..a9fabb98beb8 100644
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@@ -21,14 +21,14 @@ rustPlatform.buildRustPackage rec {
   pname = "libsignal-ffi";
   # must match the version used in mautrix-signal
   # see https://github.com/mautrix/signal/issues/401
-  version = "0.86.8";
+  version = "0.86.12";
 
   src = fetchFromGitHub {
     fetchSubmodules = true;
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${version}";
-    hash = "sha256-+GFuwS4y8yr86ETVIjlz/6HocAamASmBOIjkTLtCIag=";
+    hash = "sha256-XVq1fvhUF0WqSs1lJRCBRuhOW4idY6Nm21UdX4/6TE8=";
   };
 
   nativeBuildInputs = [
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage rec {
   env.BORING_BSSL_PATH = "${boringssl-wrapper}";
   env.NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
 
-  cargoHash = "sha256-uiMct9ygg1c1rQb6RsM2AoibuKCExPy9P75C7jDX8Cs=";
+  cargoHash = "sha256-vat7vjL9HDY/m7CLUJNpU3NZ79nCVHxLO5tEtaEDBnE=";
 
   cargoBuildFlags = [
     "-p"

From 53470819fd581448f09fd05a9dde3d860da394b4 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 17 Jan 2026 10:01:17 +0100
Subject: [PATCH 50/74] mautrix-signal: 25.12 -> 26.01

ChangeLog: https://github.com/mautrix/signal/releases/tag/v0.2601.0
---
 pkgs/by-name/ma/mautrix-signal/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ma/mautrix-signal/package.nix b/pkgs/by-name/ma/mautrix-signal/package.nix
index f20cc2881c08..fbe14a54991c 100644
--- a/pkgs/by-name/ma/mautrix-signal/package.nix
+++ b/pkgs/by-name/ma/mautrix-signal/package.nix
@@ -20,14 +20,14 @@ let
 in
 buildGoModule rec {
   pname = "mautrix-signal";
-  version = "25.12";
-  tag = "v0.2512.0";
+  version = "26.01";
+  tag = "v0.2601.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "signal";
     inherit tag;
-    hash = "sha256-qD3kehVZINfAg6ZitYlkabo19Zfn7X//5BoMbub9Y60=";
+    hash = "sha256-zvB0CbSzrLcUJiEIj3vtDq2C0XEYUNRbaUAn+636+uk=";
   };
 
   buildInputs =
@@ -44,7 +44,7 @@ buildGoModule rec {
 
   CGO_LDFLAGS = lib.optional withGoolm [ cppStdLib ];
 
-  vendorHash = "sha256-zfe3mdM3azHe+NssRKJqjaP7A0wrvHyIVnqUWJMsylw=";
+  vendorHash = "sha256-Eo7T/63ywNnn/t0RzjwkSYRmrL0IMdIsv4wqrQFv+5U=";
 
   ldflags = [
     "-X"

From 3ecc17c822ef0e9cacc303e72e5f1f2999bf14fd Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 17 Jan 2026 10:02:49 +0100
Subject: [PATCH 51/74] mautrix-whatsapp: 25.12 -> 26.01

ChangeLog: https://github.com/mautrix/whatsapp/releases/tag/v0.2601.0
---
 pkgs/by-name/ma/mautrix-whatsapp/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ma/mautrix-whatsapp/package.nix b/pkgs/by-name/ma/mautrix-whatsapp/package.nix
index 7f11da789617..b44e5998cc4e 100644
--- a/pkgs/by-name/ma/mautrix-whatsapp/package.nix
+++ b/pkgs/by-name/ma/mautrix-whatsapp/package.nix
@@ -14,20 +14,20 @@
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "25.12";
-  tag = "v0.2512.0";
+  version = "26.01";
+  tag = "v0.2601.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     inherit tag;
-    hash = "sha256-gVQSACXQ384MYOptRKGSIzCjOgyWW+8/YrxKCaCqhuA=";
+    hash = "sha256-CNrAQSZgF0t5oo2xRsVdif3LIGOnTe2ea996icVkCjE=";
   };
 
   buildInputs = lib.optional (!withGoolm) olm;
   tags = lib.optional withGoolm "goolm";
 
-  vendorHash = "sha256-eyukS+rEysjhaywxzgqKP11IJF2SY9FSluQIOESZ6mk=";
+  vendorHash = "sha256-Jvd3NgDRCyLrRV+6+kmcUSPCSSaxaKLD9EdrSyFwm1M=";
 
   ldflags = [
     "-s"

From 9545595242b35b4aacdad248eccf4c13867366f2 Mon Sep 17 00:00:00 2001
From: sweenu <contact@sweenu.xyz>
Date: Mon, 29 Sep 2025 13:39:51 +0200
Subject: [PATCH 52/74] nixos-container: add --use-host-network option

---
 .../ni/nixos-container/nixos-container.pl     | 78 +++++++++++--------
 1 file changed, 47 insertions(+), 31 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-container/nixos-container.pl b/pkgs/by-name/ni/nixos-container/nixos-container.pl
index 9cc5176b4f44..3e4d50c903db 100755
--- a/pkgs/by-name/ni/nixos-container/nixos-container.pl
+++ b/pkgs/by-name/ni/nixos-container/nixos-container.pl
@@ -43,6 +43,7 @@ Usage: nixos-container list
          [--port <port>]
          [--host-address <string>]
          [--local-address <string>]
+         [--use-host-network]
        nixos-container destroy <container-name>
        nixos-container restart <container-name>
        nixos-container start <container-name>
@@ -74,6 +75,7 @@ my $signal;
 my $configFile;
 my $hostAddress;
 my $localAddress;
+my $useHostNetwork = 0;
 my $flake;
 my $flakeAttr = "container";
 
@@ -106,6 +108,7 @@ GetOptions(
     "config-file=s" => \$configFile,
     "host-address=s" => \$hostAddress,
     "local-address=s" => \$localAddress,
+    "use-host-network" => \$useHostNetwork,
     "flake=s" => \$flake,
     # Nix passthru options.
     "log-format=s" => \&copyNixFlags1,
@@ -127,6 +130,10 @@ if (defined $hostAddress and !defined $localAddress or defined $localAddress and
     die "With --host-address set, --local-address is required as well!";
 }
 
+if ($useHostNetwork && (defined $hostAddress || defined $localAddress)) {
+    die "--use-host-network cannot be used with --host-address or --local-address!";
+}
+
 my $action = $ARGV[0] or die "$0: no action specified\n";
 
 if (defined $configFile and defined $extraConfig) {
@@ -231,36 +238,44 @@ if ($action eq "create") {
     # be restricted too.
     die "$0: container name ‘$containerName’ is too long\n" if length $containerName > 11;
 
-    # Get an unused IP address.
-    my %usedIPs;
-    foreach my $confFile2 (glob "$configurationDirectory/*.conf") {
-        # Filter libpod configuration files
-        # From 22.05 and onwards this is not an issue any more as directories dont clash
-        if($confFile2 eq "/etc/containers/libpod.conf" || $confFile2 eq "/etc/containers/containers.conf" || $confFile2 eq "/etc/containers/registries.conf") {
-            next
-        }
-        my $s = read_file($confFile2) or die;
-        $usedIPs{$1} = 1 if $s =~ /^HOST_ADDRESS=([0-9\.]+)$/m;
-        $usedIPs{$1} = 1 if $s =~ /^LOCAL_ADDRESS=([0-9\.]+)$/m;
-    }
-
-    unless (defined $hostAddress) {
-        my $ipPrefix;
-        for (my $nr = 1; $nr < 255; $nr++) {
-            $ipPrefix = "10.233.$nr";
-            $hostAddress = "$ipPrefix.1";
-            $localAddress = "$ipPrefix.2";
-            last unless $usedIPs{$hostAddress} || $usedIPs{$localAddress};
-            $ipPrefix = undef;
-        }
-
-        die "$0: out of IP addresses\n" unless defined $ipPrefix;
-    }
-
     my @conf;
-    push @conf, "PRIVATE_NETWORK=1\n";
-    push @conf, "HOST_ADDRESS=$hostAddress\n";
-    push @conf, "LOCAL_ADDRESS=$localAddress\n";
+
+    if ($useHostNetwork) {
+        push @conf, "PRIVATE_NETWORK=0\n";
+        print STDERR "using host network\n";
+    } else {
+        # Get an unused IP address.
+        my %usedIPs;
+        foreach my $confFile2 (glob "$configurationDirectory/*.conf") {
+            # Filter libpod configuration files
+            # From 22.05 and onwards this is not an issue any more as directories dont clash
+            if($confFile2 eq "/etc/containers/libpod.conf" || $confFile2 eq "/etc/containers/containers.conf" || $confFile2 eq "/etc/containers/registries.conf") {
+                next
+            }
+            my $s = read_file($confFile2) or die;
+            $usedIPs{$1} = 1 if $s =~ /^HOST_ADDRESS=([0-9\.]+)$/m;
+            $usedIPs{$1} = 1 if $s =~ /^LOCAL_ADDRESS=([0-9\.]+)$/m;
+        }
+
+        unless (defined $hostAddress) {
+            my $ipPrefix;
+            for (my $nr = 1; $nr < 255; $nr++) {
+                $ipPrefix = "10.233.$nr";
+                $hostAddress = "$ipPrefix.1";
+                $localAddress = "$ipPrefix.2";
+                last unless $usedIPs{$hostAddress} || $usedIPs{$localAddress};
+                $ipPrefix = undef;
+            }
+
+            die "$0: out of IP addresses\n" unless defined $ipPrefix;
+        }
+
+        push @conf, "PRIVATE_NETWORK=1\n";
+        push @conf, "HOST_ADDRESS=$hostAddress\n";
+        push @conf, "LOCAL_ADDRESS=$localAddress\n";
+        print STDERR "host IP is $hostAddress, container IP is $localAddress\n";
+    }
+
     push @conf, "HOST_BRIDGE=$bridge\n";
     push @conf, "HOST_PORT=$port\n";
     push @conf, "AUTO_START=$autoStart\n";
@@ -269,8 +284,6 @@ if ($action eq "create") {
 
     close($lock);
 
-    print STDERR "host IP is $hostAddress, container IP is $localAddress\n";
-
     # The per-container directory is restricted to prevent users on
     # the host from messing with guest users who happen to have the
     # same uid.
@@ -517,6 +530,9 @@ elsif ($action eq "run") {
 
 elsif ($action eq "show-ip") {
     my $s = read_file($confFile) or die;
+    if ($s =~ /^PRIVATE_NETWORK=0$/m) {
+        die "$0: container uses host network, no separate IP address\n";
+    }
     $s =~ /^LOCAL_ADDRESS=([0-9\.]+)(\/[0-9]+)?$/m
         or $s =~ /^LOCAL_ADDRESS6=([0-9a-f:]+)(\/[0-9]+)?$/m
         or die "$0: cannot get IP address\n";

From ec0d4a304ef1e8dd2fb0d8e7c00089d1e815379b Mon Sep 17 00:00:00 2001
From: Lin Xianyi <iynaix@gmail.com>
Date: Sat, 17 Jan 2026 18:43:55 +0800
Subject: [PATCH 53/74] hyprland: fix incorrect substituteInPlace pattern

Fixes plugin compilation due to incorrect paths. #480513
---
 pkgs/by-name/hy/hyprland/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hy/hyprland/package.nix b/pkgs/by-name/hy/hyprland/package.nix
index 215cc6a4560b..4367c0017790 100644
--- a/pkgs/by-name/hy/hyprland/package.nix
+++ b/pkgs/by-name/hy/hyprland/package.nix
@@ -108,9 +108,9 @@ customStdenv.mkDerivation (finalAttrs: {
 
     # Remove extra @PREFIX@ to fix pkg-config paths
     substituteInPlace hyprland.pc.in \
-      --replace-fail  @PREFIX@ ""
+      --replace-fail  "@PREFIX@/" ""
     substituteInPlace example/hyprland.desktop.in \
-      --replace-fail  @PREFIX@ ""
+      --replace-fail  "@PREFIX@/" ""
   '';
 
   # variables used by CMake, and shown in `hyprctl version`

From 13ef7bc125682c5a6b2ae08a813ef615df209e8b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 17 Jan 2026 11:29:28 +0000
Subject: [PATCH 54/74] waywall: 0.2025.12.30 -> 0.2026.01.11

---
 pkgs/by-name/wa/waywall/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wa/waywall/package.nix b/pkgs/by-name/wa/waywall/package.nix
index 6ee54a18ef1a..8224a4f7b5bf 100644
--- a/pkgs/by-name/wa/waywall/package.nix
+++ b/pkgs/by-name/wa/waywall/package.nix
@@ -19,13 +19,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "waywall";
-  version = "0.2025.12.30";
+  version = "0.2026.01.11";
 
   src = fetchFromGitHub {
     owner = "tesselslate";
     repo = "waywall";
     tag = finalAttrs.version;
-    hash = "sha256-idtlOXT3RGjAOMgZ+e5vwZnxd33snc4sIjq0G6TU7HU=";
+    hash = "sha256-VOtwVFMGgUvsGnD1CnflKtUy5tTKqK2C/qNsWwgbyEU=";
   };
 
   nativeBuildInputs = [

From 9c00dceb00b4c178bf2961cd0140c2ce8a98e700 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 17 Jan 2026 11:33:45 +0000
Subject: [PATCH 55/74] slade: 3.2.10 -> 3.2.11

---
 pkgs/by-name/sl/slade/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sl/slade/package.nix b/pkgs/by-name/sl/slade/package.nix
index 3dd90e566256..321d040a510b 100644
--- a/pkgs/by-name/sl/slade/package.nix
+++ b/pkgs/by-name/sl/slade/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slade";
-  version = "3.2.10";
+  version = "3.2.11";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
     tag = finalAttrs.version;
-    hash = "sha256-r1tfp0NomZEETY41wXIDvZbgCbBFEh4oW0qcnr/t/9E=";
+    hash = "sha256-kZ6KyhI2oZH0SeymcHge9+rbq/ZGfhKXGdfOlje2zqM=";
   };
 
   nativeBuildInputs = [

From 51198b882d7b8879e36d19bf87f93f29a8259775 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 17 Jan 2026 11:05:21 +0100
Subject: [PATCH 56/74] python313Packages.chromadb: migrate to finalAttrs

---
 .../python-modules/chromadb/default.nix       | 20 +++++++++----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 057a2aed279f..aa10d25bd9f2 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -66,7 +66,7 @@
   nix-update-script,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "chromadb";
   version = "1.4.1";
   pyproject = true;
@@ -74,7 +74,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "chroma-core";
     repo = "chroma";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-mtUxyuLiwA4l9u+pTPVIsYcvsLPPCI6c8iWK6Lgbwjc=";
   };
 
@@ -82,7 +82,7 @@ buildPythonPackage rec {
   disabled = pythonAtLeast "3.14";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-WdWc/8vNzcEtdxmAAbBDWxhMamxSnK2YaZPWwQ2zzU4=";
   };
 
@@ -95,7 +95,7 @@ buildPythonPackage rec {
   postPatch = ''
     # Nixpkgs is taking the version from `chromadb_rust_bindings` which is versioned independently
     substituteInPlace pyproject.toml \
-      --replace-fail "dynamic = [\"version\"]" "version = \"${version}\""
+      --replace-fail "dynamic = [\"version\"]" "version = \"${finalAttrs.version}\""
 
     # Flip anonymized telemetry to opt in versus current opt-in out for privacy
     substituteInPlace chromadb/config.py \
@@ -108,9 +108,7 @@ buildPythonPackage rec {
     "posthog"
   ];
 
-  build-system = [
-    rustPlatform.maturinBuildHook
-  ];
+  build-system = [ rustPlatform.maturinBuildHook ];
 
   nativeBuildInputs = [
     cargo
@@ -177,14 +175,14 @@ buildPythonPackage rec {
 
   # Disable on aarch64-linux due to broken onnxruntime
   # https://github.com/microsoft/onnxruntime/issues/10038
-  pythonImportsCheck = lib.optionals doCheck [ "chromadb" ];
+  pythonImportsCheck = lib.optionals finalAttrs.doCheck [ "chromadb" ];
 
   # Test collection breaks on aarch64-linux
   doCheck = with stdenv.buildPlatform; !(isAarch && isLinux);
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
-    SWAGGER_UI_DOWNLOAD_URL = "file://${swagger-ui}";
+    SWAGGER_UI_DOWNLOAD_URL = "file://${finalAttrs.swagger-ui}";
   };
 
   pytestFlags = [
@@ -269,7 +267,7 @@ buildPythonPackage rec {
   meta = {
     description = "AI-native open-source embedding database";
     homepage = "https://github.com/chroma-core/chroma";
-    changelog = "https://github.com/chroma-core/chroma/releases/tag/${version}";
+    changelog = "https://github.com/chroma-core/chroma/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       fab
@@ -277,4 +275,4 @@ buildPythonPackage rec {
     ];
     mainProgram = "chroma";
   };
-}
+})

From 5f5f4c6a7c9dfdff26f1c237224aa1ad6e8e2380 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 17 Jan 2026 13:38:32 +0100
Subject: [PATCH 57/74] freerdp: 3.20.0 -> 3.20.2

Fixes:
* CVE-2026-22851
* CVE-2026-22852
* CVE-2026-22853
* CVE-2026-22854
* CVE-2026-22855
* CVE-2026-22856
* CVE-2026-22857
* CVE-2026-22858
* CVE-2026-22859

Fixes #481006
Fixes #481005

Changes:
https://www.freerdp.com/2026/01/14/3_20_1-release
https://www.freerdp.com/2026/01/14/3_20_2-release
---
 pkgs/by-name/fr/freerdp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/freerdp/package.nix b/pkgs/by-name/fr/freerdp/package.nix
index 6372d6e676f1..b9aff2fc0a35 100644
--- a/pkgs/by-name/fr/freerdp/package.nix
+++ b/pkgs/by-name/fr/freerdp/package.nix
@@ -70,13 +70,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freerdp";
-  version = "3.20.0";
+  version = "3.20.2";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     rev = finalAttrs.version;
-    hash = "sha256-/v6M3r0qELpKvDmM8p3SnOmstyqfYNzyS7gw6HBOSd0=";
+    hash = "sha256-IcEWlNh0AI3Vkqf2FzQYOIq64J6iWJxWlUfYkcBpGUU=";
   };
 
   postPatch = ''

From ea4f9d5fde841206c0d1e86878af647f71d3fe81 Mon Sep 17 00:00:00 2001
From: Yiyu Zhou <yiyu@yiyuzhou.io>
Date: Fri, 16 Jan 2026 22:06:01 -0800
Subject: [PATCH 58/74] firefox-unwrapped: 147.0 -> 147.0.1

https://www.firefox.com/en-US/firefox/147.0.1/releasenotes/
---
 .../networking/browsers/firefox/packages/firefox.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
index a80c51af84d6..53921e0dbf90 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "147.0";
+  version = "147.0.1";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "ac9017b1a2da7b2f139392c394c36341fd3476e3d4ea1a3c7e5e7bf100dc30d185132ef9256be7e6b0f9dbfc69234ac571ea1fc6db9d84543b15772f4ec85161";
+    sha512 = "f1e1bc486451254f33b000fb4513fd948a5a6e84841980ee767c42d326e1856f44a8437c8fdbff2cb34d177fea2b1907fcd72dd33bcec3f06ddb8d88151853a8";
   };
 
   meta = {

From 4a15db1fb5408cca5a3b25f45d34ee88b2e28ec3 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 17 Jan 2026 14:02:55 +0100
Subject: [PATCH 59/74] wireshark: 4.6.2 -> 4.6.3

Fixes:
https://www.wireshark.org/security/wnpa-sec-2026-01.html
https://www.wireshark.org/security/wnpa-sec-2026-02.html
https://www.wireshark.org/security/wnpa-sec-2026-03.html
https://www.wireshark.org/security/wnpa-sec-2026-04.html

Changes:
https://www.wireshark.org/docs/relnotes/wireshark-4.6.3.html
---
 pkgs/applications/networking/sniffers/wireshark/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index a965f4734fc5..338fb7055b78 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -58,7 +58,7 @@ assert withQt -> qt6 != null;
 
 stdenv.mkDerivation rec {
   pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.6.2";
+  version = "4.6.3";
 
   outputs = [
     "out"
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     repo = "wireshark";
     owner = "wireshark";
     rev = "v${version}";
-    hash = "sha256-fojQ0D7v6xSDltpL3Y6iIzLj6pRZU/0U0ww+sVaWDZ8=";
+    hash = "sha256-DthYkAW6UYnsDLQf2h3jgJB8RZoasjREWV1NTtZv7PQ=";
   };
 
   patches = [

From f9b6465bdf7c1e76aeed9f21cf01063e031cb7cf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 17 Jan 2026 13:41:51 +0000
Subject: [PATCH 60/74] hysteria: 2.6.5 -> 2.7.0

---
 pkgs/by-name/hy/hysteria/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/hy/hysteria/package.nix b/pkgs/by-name/hy/hysteria/package.nix
index df03c2da236a..a4cde3865d02 100644
--- a/pkgs/by-name/hy/hysteria/package.nix
+++ b/pkgs/by-name/hy/hysteria/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "hysteria";
-  version = "2.6.5";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = "hysteria";
     rev = "app/v${version}";
-    hash = "sha256-EiucZQ8poLmWVGd7MElZ4FWhDdDuM0/8CiomN+TKolw=";
+    hash = "sha256-eObMqyYCyrt5TemNK5AVZlO01wPjb5QscV6BSnAhQF8=";
   };
 
-  vendorHash = "sha256-ho5AC9kehhvPVS3CoB2Yucbk5vCVqWAe1MZGInusKk8=";
+  vendorHash = "sha256-K1RWbZHZUvPezPRoGSd0e8b+J1UREHWPLHWEWD5cpRc=";
   proxyVendor = true;
 
   ldflags =

From faba2c2510c33b27bc5ba2baab50e310ca0fa543 Mon Sep 17 00:00:00 2001
From: "Peter H. Hoeg" <peter@hoeg.com>
Date: Sat, 17 Jan 2026 14:49:38 +0100
Subject: [PATCH 61/74] kdePackages.kguiaddons: fix kdeconnect clipboard crash

---
 pkgs/kde/generated/sources/frameworks.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/kde/generated/sources/frameworks.json b/pkgs/kde/generated/sources/frameworks.json
index 9662006aaaf3..1b11d8a02ba0 100644
--- a/pkgs/kde/generated/sources/frameworks.json
+++ b/pkgs/kde/generated/sources/frameworks.json
@@ -145,9 +145,9 @@
     "hash": "sha256-My4749CsKuyOeGQZweh1obM66EuKraMoNjnezMb/1Ng="
   },
   "kguiaddons": {
-    "version": "6.22.0",
-    "url": "mirror://kde/stable/frameworks/6.22/kguiaddons-6.22.0.tar.xz",
-    "hash": "sha256-t2Urzr6/yMH9ook8Gu/0E2xYbud//G5YnjY08OVTnu8="
+    "version": "6.22.1",
+    "url": "mirror://kde/stable/frameworks/6.22/kguiaddons-6.22.1.tar.xz",
+    "hash": "sha256-o/WWMtdY753x2uPqQ8it9GFT+aN+Awk48TX6n5gW1bk="
   },
   "kholidays": {
     "version": "6.22.0",

From f4aaf9b4e420a3702b442f5e21db4c06cc738e78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Chocholat=C3=BD?= <chocholaty.david@protonmail.com>
Date: Sat, 17 Jan 2026 13:06:36 +0100
Subject: [PATCH 62/74] yaziPlugins.jjui: init at 0-unstable-2026-01-17

---
 pkgs/by-name/ya/yazi/plugins/jjui/default.nix | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 pkgs/by-name/ya/yazi/plugins/jjui/default.nix

diff --git a/pkgs/by-name/ya/yazi/plugins/jjui/default.nix b/pkgs/by-name/ya/yazi/plugins/jjui/default.nix
new file mode 100644
index 000000000000..656f58bc808a
--- /dev/null
+++ b/pkgs/by-name/ya/yazi/plugins/jjui/default.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  fetchFromGitHub,
+  mkYaziPlugin,
+}:
+mkYaziPlugin {
+  pname = "jjui.yazi";
+  version = "0-unstable-2026-01-17";
+
+  src = fetchFromGitHub {
+    owner = "Adda0";
+    repo = "jjui.yazi";
+    rev = "a41b2e17a4d256bc06868079efb375716e07cd28";
+    hash = "sha256-r2XWSu0voQmQj6jI2Jh17FiNwbvQcEwM6LNDqX7qCOQ=";
+  };
+
+  meta = {
+    description = "jjui plugin for yazi";
+    homepage = "https://github.com/Adda0/jjui.yazi";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ adda ];
+  };
+}

From e59816457b5f014e000f26dcc3f93d73d3752056 Mon Sep 17 00:00:00 2001
From: Nick Blumenauer <nicknb@posteo.com>
Date: Sat, 17 Jan 2026 15:54:34 +0100
Subject: [PATCH 63/74] forgejo-cli: update repo url

The repo has been moved from https://codeberg.org/Cyborus/forgejo-cli to
https://codeberg.org/forgejo-contrib/forgejo-cli
---
 pkgs/by-name/fo/forgejo-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo-cli/package.nix b/pkgs/by-name/fo/forgejo-cli/package.nix
index 6ee01cf036c0..610bc5764db6 100644
--- a/pkgs/by-name/fo/forgejo-cli/package.nix
+++ b/pkgs/by-name/fo/forgejo-cli/package.nix
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   src = fetchFromGitea {
     domain = "codeberg.org";
-    owner = "Cyborus";
+    owner = "forgejo-contrib";
     repo = "forgejo-cli";
     tag = "v${finalAttrs.version}";
     hash = "sha256-8KPR7Fx26hj5glKDjczCLP6GgQBUsA5TpjhO5UZOpik=";
@@ -52,8 +52,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "CLI application for interacting with Forgejo";
-    homepage = "https://codeberg.org/Cyborus/forgejo-cli";
-    changelog = "https://codeberg.org/Cyborus/forgejo-cli/releases/tag/v${finalAttrs.version}";
+    homepage = "https://codeberg.org/forgejo-contrib/forgejo-cli";
+    changelog = "https://codeberg.org/forgejo-contrib/forgejo-cli/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       asl20
       mit

From cd2625f9f2f915a664a1fc37d7e7c6024a5aa727 Mon Sep 17 00:00:00 2001
From: Nick Blumenauer <nicknb@posteo.com>
Date: Sat, 17 Jan 2026 16:05:21 +0100
Subject: [PATCH 64/74] forgejo-cli: 0.3.0 -> 0.4.0

---
 pkgs/by-name/fo/forgejo-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo-cli/package.nix b/pkgs/by-name/fo/forgejo-cli/package.nix
index 610bc5764db6..0cba165ee615 100644
--- a/pkgs/by-name/fo/forgejo-cli/package.nix
+++ b/pkgs/by-name/fo/forgejo-cli/package.nix
@@ -13,17 +13,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "forgejo-cli";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo-contrib";
     repo = "forgejo-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8KPR7Fx26hj5glKDjczCLP6GgQBUsA5TpjhO5UZOpik=";
+    hash = "sha256-EJr/7me2wiOBSFw0VFSxyqnQKy3kpOMGJmxD7wxmWPc=";
   };
 
-  cargoHash = "sha256-kW7Pexydkosaufk1e8P5FaY+dgkeeTG5qgJxestWkVs=";
+  cargoHash = "sha256-DpQt76o3ZnIJwHR1DQ/mn9f8XiWHKVB4h3NNbvCIMZ8=";
 
   nativeBuildInputs = [
     pkg-config

From 74863d82649a30d716d571d37b428c795474285a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 17 Jan 2026 15:14:32 +0000
Subject: [PATCH 65/74] vacuum-go: 0.23.2 -> 0.23.3

---
 pkgs/by-name/va/vacuum-go/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index 8c34af0f8057..6f2415df4026 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,14 +7,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.23.2";
+  version = "0.23.3";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zQ9NzNPWJC431AF1wlrRAZRhUTMdKJO6qWa4x9jpFoE=";
+    hash = "sha256-Z++nFH1UquT+4CvW5bohQCXQGW7P0tFXFcfTvQWjMgg=";
   };
 
   vendorHash = "sha256-kpW1i6LJUFMJArSHYMI4taTfAcfDH+E39GOBOKZFu+c=";

From fbd3e087eeab8ae93c1dcad6a7492f52bd98543e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 17 Jan 2026 16:17:30 +0100
Subject: [PATCH 66/74] evcc: 0.300.3 -> 0.300.4

https://github.com/evcc-io/evcc/releases/tag/0.300.4
---
 pkgs/by-name/ev/evcc/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index 24d85db6de45..4284db117572 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,16 +17,16 @@
 }:
 
 let
-  version = "0.300.3";
+  version = "0.300.4";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-SGTsM4zZAuh/OGpMXvphHdlcCl1hOOYTn0R1k0/2qQo=";
+    hash = "sha256-f2whzEq0LOyvNVLjSNvA19azbtJnOMJqu5EJQXnzZyg=";
   };
 
-  vendorHash = "sha256-S23rTyg+QClky0vWfRl5nnd+2cYnHMGXmxZwLoTxUu0=";
+  vendorHash = "sha256-IB3DqaUbdrqnYQpyHtnvY37xjbRvTvNOV39b8wciuTA=";
 
   commonMeta = {
     license = lib.licenses.mit;

From 88038cef09ef1602f00850e1f33b7a1effc5c4c1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 17 Jan 2026 16:40:20 +0100
Subject: [PATCH 67/74] esphome: 2025.12.6 -> 2025.12.7

https://github.com/esphome/esphome/releases/tag/2025.12.7
---
 pkgs/by-name/es/esphome/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index f7fc47df76d7..9e1dc9cd80b7 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.12.6";
+  version = "2025.12.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = version;
-    hash = "sha256-7TpHpivBNA5DW/ThCUqhEn9y0L62lMhRAP9tH1800Zk=";
+    hash = "sha256-KC3LbY5mU4xig3kftIuemSz/RAnJ7wZ8eSccr9BKz9Q=";
   };
 
   patches = [

From 65298275faefe6e3ccf5a05d73a6c872cefbbc80 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 17 Jan 2026 17:08:15 +0100
Subject: [PATCH 68/74] lasuite-docs: 4.2.0 -> 4.4.0

https://github.com/suitenumerique/docs/blob/v4.4.0/CHANGELOG.md
---
 pkgs/by-name/la/lasuite-docs/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-docs/package.nix b/pkgs/by-name/la/lasuite-docs/package.nix
index adb7060169d8..3be6d11eec1d 100644
--- a/pkgs/by-name/la/lasuite-docs/package.nix
+++ b/pkgs/by-name/la/lasuite-docs/package.nix
@@ -17,12 +17,12 @@ let
     };
   };
 
-  version = "4.2.0";
+  version = "4.4.0";
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-BQ2vJIEXS51dBkqdmKUuLB6hM8QRJW0zVDayYt8Pe+w=";
+    hash = "sha256-Cm/Ch7dBKInQYPFGfSlSMLgj8uQR6E3S+6gCFUyvFSU=";
   };
 
   mail-templates = stdenv.mkDerivation {
@@ -35,7 +35,7 @@ let
 
     offlineCache = fetchYarnDeps {
       yarnLock = "${src}/src/mail/yarn.lock";
-      hash = "sha256-kwt4vSIiC8NNaKmygl2moV8ft02eB4ylPND4oe9tBUA=";
+      hash = "sha256-g71OGg0PAo60h0bC+oOyvLvPOCg0pYXuYD8vsR5X9/k=";
     };
 
     nativeBuildInputs = [
@@ -91,6 +91,7 @@ python.pkgs.buildPythonApplication rec {
       factory-boy
       gunicorn
       jsonschema
+      langfuse
       lxml
       markdown
       mozilla-django-oidc

From 194a70d8f64602401a9e4882d005c702a2889c27 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 17 Jan 2026 17:13:27 +0100
Subject: [PATCH 69/74] lasuite-docs-frontend: 4.2.0 -> 4.4.0

https://github.com/suitenumerique/docs/blob/v4.4.0/CHANGELOG.md
https://github.com/suitenumerique/docs/security/advisories/GHSA-4rwv-ghwh-9rv6

Fixes: CVE-2026-22867
---
 pkgs/by-name/la/lasuite-docs-frontend/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-docs-frontend/package.nix b/pkgs/by-name/la/lasuite-docs-frontend/package.nix
index d250ae13ed21..64dbe9867d8a 100644
--- a/pkgs/by-name/la/lasuite-docs-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-docs-frontend/package.nix
@@ -12,20 +12,20 @@
 
 stdenv.mkDerivation rec {
   pname = "lasuite-docs-frontend";
-  version = "4.2.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-BQ2vJIEXS51dBkqdmKUuLB6hM8QRJW0zVDayYt8Pe+w=";
+    hash = "sha256-Cm/Ch7dBKInQYPFGfSlSMLgj8uQR6E3S+6gCFUyvFSU=";
   };
 
   sourceRoot = "source/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-tttq1Tp6BZ30cJJgRBoHaBJesmqhkFNuk9tftitGNVw=";
+    hash = "sha256-JacPecJvdyATea8o1jQOxY9Gzx4kH+HLqE0eq03dzjg=";
   };
 
   nativeBuildInputs = [

From c93ffd252d0ccddd90396229ced13ad044c0ac02 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 17 Jan 2026 17:17:45 +0100
Subject: [PATCH 70/74] lasuite-docs-collaboration-server: 4.2.0 -> 4.4.0

https://github.com/suitenumerique/docs/blob/v4.4.0/CHANGELOG.md
---
 .../la/lasuite-docs-collaboration-server/package.nix        | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix b/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
index cfa99a3af912..a415e4174df0 100644
--- a/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
+++ b/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
@@ -13,20 +13,20 @@
 
 stdenv.mkDerivation rec {
   pname = "lasuite-docs-collaboration-server";
-  version = "4.2.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-BQ2vJIEXS51dBkqdmKUuLB6hM8QRJW0zVDayYt8Pe+w=";
+    hash = "sha256-Cm/Ch7dBKInQYPFGfSlSMLgj8uQR6E3S+6gCFUyvFSU=";
   };
 
   sourceRoot = "source/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-tttq1Tp6BZ30cJJgRBoHaBJesmqhkFNuk9tftitGNVw=";
+    hash = "sha256-JacPecJvdyATea8o1jQOxY9Gzx4kH+HLqE0eq03dzjg=";
   };
 
   nativeBuildInputs = [

From a77dfa46cb3e62ac79ea596e801f4bf07b14ae5b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 17 Jan 2026 16:57:52 +0000
Subject: [PATCH 71/74] home-assistant-custom-components.alarmo: 1.10.13 ->
 1.10.15

---
 .../home-assistant/custom-components/alarmo/package.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/alarmo/package.nix b/pkgs/servers/home-assistant/custom-components/alarmo/package.nix
index 077d5e904bc4..38ea0e2d3797 100644
--- a/pkgs/servers/home-assistant/custom-components/alarmo/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/alarmo/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "nielsfaber";
   domain = "alarmo";
-  version = "1.10.13";
+  version = "1.10.15";
 
   src = fetchFromGitHub {
     owner = "nielsfaber";
     repo = "alarmo";
     tag = "v${version}";
-    hash = "sha256-TIdgJBC2oGnxfdUHCaIlq6GYUiqLzc9F0ZF4RUILkog=";
+    hash = "sha256-yXrzlaO6N6uknmIPNh9gc10Fs9xJSOXoeFEj4oBbNas=";
   };
 
   postPatch = ''

From 81b3aafc5526173b6eb56159ee80a89a4a490902 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 17 Jan 2026 17:21:33 +0000
Subject: [PATCH 72/74] models-dev: 0-unstable-2026-01-14 ->
 0-unstable-2026-01-17

---
 pkgs/by-name/mo/models-dev/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 1be5aeaa95d2..c65edb9aa8c0 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -9,12 +9,12 @@
 }:
 let
   pname = "models-dev";
-  version = "0-unstable-2026-01-14";
+  version = "0-unstable-2026-01-17";
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "models.dev";
-    rev = "db79e08e389c7d10994b5d5b99165c3e124da958";
-    hash = "sha256-Z1EcHBDZSz6xUN4S9TSzRTbRLXoRQPuWx+a6myxxDMA=";
+    rev = "971e8734ae3ae7220afc4cfc8320c717107bc9ba";
+    hash = "sha256-kAbJKCRxcgORYa6+GTYPw1461+Bb8dYguexgokw4d1U=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {

From 74d3202fca5d3790ccc5cd133bcfc54641067336 Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Sat, 17 Jan 2026 19:41:30 +0200
Subject: [PATCH 73/74] python3Packages.formatron: fix usage with newest
 version of pydantic

---
 pkgs/development/python-modules/formatron/default.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/python-modules/formatron/default.nix b/pkgs/development/python-modules/formatron/default.nix
index 0353fc4d7b8b..185ab306b71d 100644
--- a/pkgs/development/python-modules/formatron/default.nix
+++ b/pkgs/development/python-modules/formatron/default.nix
@@ -24,6 +24,17 @@ buildPythonPackage rec {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    # Fix pydantic compatibility
+    # https://github.com/Dan-wanna-M/formatron/issues/35
+    substituteInPlace src/formatron/schemas/dict_inference.py \
+      --replace-fail 'typing.Type' 'Type' \
+      --replace-fail 'typing.Any' 'Any'
+
+    substituteInPlace src/formatron/schemas/json_schema.py \
+      --replace-fail 'from pydantic import typing' 'import typing'
+  '';
+
   build-system = [
     setuptools
   ];

From e402bfe2c09b55d5571c8c1b0d67f84d6c1ffd68 Mon Sep 17 00:00:00 2001
From: sanana <umutinanerdogan@pm.me>
Date: Thu, 10 Jul 2025 00:16:47 +0300
Subject: [PATCH 74/74] OVMF: disable hardening option "relro" on aarch64

This option doesn't work with aarch64-elf toolchain for some reason. All
other *-elf toolchains are just fine.
---
 pkgs/applications/virtualization/OVMF/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix
index 369e08c71efa..9030799195bb 100644
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -136,7 +136,8 @@ edk2.mkDerivation projectDscPath (finalAttrs: {
     "stackprotector"
     "pic"
     "fortify"
-  ];
+  ]
+  ++ lib.optional stdenv.hostPlatform.isAarch64 "relro";
 
   buildFlags =
     # IPv6 has no reason to be disabled.