From 739c336e8d16c52b239c82c1ae3a63724d497e95 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 10 Feb 2026 15:52:45 +0000
Subject: [PATCH 01/33] multipath-tools: 0.14.1 -> 0.14.3

---
 pkgs/by-name/mu/multipath-tools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mu/multipath-tools/package.nix b/pkgs/by-name/mu/multipath-tools/package.nix
index 8f5aca898c61..c3c3852ee715 100644
--- a/pkgs/by-name/mu/multipath-tools/package.nix
+++ b/pkgs/by-name/mu/multipath-tools/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "multipath-tools";
-  version = "0.14.1";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "opensvc";
     repo = "multipath-tools";
     tag = finalAttrs.version;
-    hash = "sha256-fkpBvadQAR+oiFeyar7flwL8N69RoWhwOaiYSwYCbXs=";
+    hash = "sha256-uppx79+ZWazGM/QQ+8jeTogqXyHosiFfcnH2npiz7W0=";
   };
 
   nativeBuildInputs = [

From 018b4de7f3dcc8f7c3200cb31c3356de3b860e9e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Feb 2026 00:50:18 +0000
Subject: [PATCH 02/33] libcpr: 1.14.1 -> 1.14.2

---
 pkgs/by-name/li/libcpr/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libcpr/package.nix b/pkgs/by-name/li/libcpr/package.nix
index e55950be8b7b..82a38e7be001 100644
--- a/pkgs/by-name/li/libcpr/package.nix
+++ b/pkgs/by-name/li/libcpr/package.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "1.14.1";
+  version = "1.14.2";
 in
 stdenv.mkDerivation {
   pname = "libcpr";
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     owner = "libcpr";
     repo = "cpr";
     rev = version;
-    hash = "sha256-kwbkdAeTpkEJbzvqpUQx007ZIBtwqOPG8n41TvFxeiM=";
+    hash = "sha256-fglJNQzf+5c5nJysxqTxE4EWSQO0GVauLV8yLypQMPs=";
   };
 
   nativeBuildInputs = [

From d0264c3475fc202f291a28b1969e67eef0fa5088 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 16 Jun 2026 12:08:25 +0200
Subject: [PATCH 03/33] formatjson5: apply no rewrite if unchanged patch

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/by-name/fo/formatjson5/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/fo/formatjson5/package.nix b/pkgs/by-name/fo/formatjson5/package.nix
index 505c3f073f8a..55cc640cf25d 100644
--- a/pkgs/by-name/fo/formatjson5/package.nix
+++ b/pkgs/by-name/fo/formatjson5/package.nix
@@ -20,9 +20,20 @@ rustPlatform.buildRustPackage {
 
   patches = [
     (fetchpatch {
+      # bugfix: fix missing_docs error
+      # Needed to build with Rust 1.83+.
+      name = "0001-bugfix-fix-missing-docs-error";
       url = "https://github.com/google/json5format/commit/32914546e7088b3d9173ae9a2f307effa87917bf.patch";
       hash = "sha256-kAbRUL/FuhnxkC9Xo4J2bXt9nkMOLeJvgMmOoKnSxKc=";
     })
+    (fetchpatch {
+      # Skip rewriting unchanged files with --replace
+      # Unmerged upstream patch, ensures json5format is compatible with treefmt(-nix),
+      # which is quite popular in the Nix ecosystem.
+      name = "0002-skip-rewriting-unchanged-files";
+      url = "https://github.com/google/json5format/commit/7bb67ff03529f6f0350d72b7a36839f20fe9d190.patch";
+      hash = "sha256-ZY7Ck51/vHcRDQ5GEwOuMIF+QiYNGay3wbIvesmEl9k=";
+    })
   ];
 
   cargoHash = "sha256-1CSt9dPVHdOqfQXio7/eXiDLWt+iOe6Qj+VtWblwSDE=";

From 87805ea105b62f4914bc42d8c43fba3b60030726 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Wed, 17 Jun 2026 18:00:00 +0200
Subject: [PATCH 04/33] redisinsight: 3.4.2 -> 3.6.0

changelog: https://github.com/redis/RedisInsight/releases/tag/3.6.0

diff: https://github.com/redis/RedisInsight/compare/3.4.2...3.6.0
---
 pkgs/by-name/re/redisinsight/package.nix | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/re/redisinsight/package.nix b/pkgs/by-name/re/redisinsight/package.nix
index 68167e401eb8..f35b44b5661a 100644
--- a/pkgs/by-name/re/redisinsight/package.nix
+++ b/pkgs/by-name/re/redisinsight/package.nix
@@ -9,27 +9,28 @@
   copyDesktopItems,
   dart-sass,
   makeWrapper,
-  nodejs-slim_20,
+  nodejs-slim_24,
   pkg-config,
   yarnConfigHook,
 
-  electron,
+  electron_41,
   libsecret,
   sqlite,
 }:
 
 let
-  nodejs = nodejs-slim_20;
+  electron = electron_41;
+  nodejs = nodejs-slim_24;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "redisinsight";
-  version = "3.4.2";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "RedisInsight";
     rev = finalAttrs.version;
-    hash = "sha256-QV1xxpr8aMgkxWitJPVjXB/G2UaAYrV2wMM1FbltZpE=";
+    hash = "sha256-YnBy++KshDVNw3p1gf7gHydQyyh03fkSULhnZsqZMxs=";
   };
 
   patches = [
@@ -42,21 +43,21 @@ stdenv.mkDerivation (finalAttrs: {
   baseOfflineCache = fetchYarnDeps {
     name = "redisinsight-${finalAttrs.version}-base-offline-cache";
     inherit (finalAttrs) src patches;
-    hash = "sha256-hU8/ycljmRxqQEx0neezQmJPaianJhL0IyVOJEfLy5o=";
+    hash = "sha256-lfCasq3C0jD4wNpguxSOxwrR0Sx3ZfwK95Ib31TShSQ=";
   };
 
   innerOfflineCache = fetchYarnDeps {
     name = "redisinsight-${finalAttrs.version}-inner-offline-cache";
     inherit (finalAttrs) src patches;
     postPatch = "cd redisinsight";
-    hash = "sha256-s4JTgqXT+5P/C5e3/c30/VZHt8MRct3KViZOD1Fekqc=";
+    hash = "sha256-vdBSquVsIeMh5eZMRxYdVz3iuhM27RgEtI6FZqjCP74=";
   };
 
   apiOfflineCache = fetchYarnDeps {
     name = "redisinsight-${finalAttrs.version}-api-offline-cache";
     inherit (finalAttrs) src patches;
     postPatch = "cd redisinsight/api";
-    hash = "sha256-GsdKJjQltpHKDZmGRF60M1TLTbnwyHt9e5ayrXgbFOU=";
+    hash = "sha256-8u4igcegknwydNsVLcPv6E5/uwQJpwNWhIpCujfoXqk=";
   };
 
   nativeBuildInputs = [
@@ -101,6 +102,7 @@ stdenv.mkDerivation (finalAttrs: {
     npm rebuild --verbose --no-progress
     cd redisinsight
     npm rebuild --verbose --no-progress
+    export npm_config_nodedir=${nodejs}
     cd api
     npm rebuild --verbose --no-progress
     cd ../..
@@ -115,6 +117,7 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace node_modules/sass/dist/lib/src/compiler-path.js \
       --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["${lib.getExe dart-sass}"];'
 
+    yarn --cwd redisinsight/api generate:api-client
     yarn --offline build:prod
 
     # TODO: Generate defaults. Currently broken because it requires network access.

From cc19bd18527f8674944435e6c54277b74c9c1742 Mon Sep 17 00:00:00 2001
From: fliiiix <hi@l33t.name>
Date: Thu, 25 Jun 2026 21:04:27 +0200
Subject: [PATCH 05/33] libvlcpp: 0.1.0-unstable-2024-02-04 ->
 0.1.0-unstable-2026-04-16

---
 pkgs/by-name/li/libvlcpp/package.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/libvlcpp/package.nix b/pkgs/by-name/li/libvlcpp/package.nix
index 5aae8b619233..450acf0c48fd 100644
--- a/pkgs/by-name/li/libvlcpp/package.nix
+++ b/pkgs/by-name/li/libvlcpp/package.nix
@@ -2,26 +2,28 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  autoreconfHook,
   pkg-config,
   libvlc,
+  meson,
+  ninja,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libvlcpp";
-  version = "0.1.0-unstable-2024-02-04";
+  version = "0.1.0-unstable-2026-04-16";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = "libvlcpp";
-    rev = "44c1f48e56a66c3f418175af1e1ef3fd1ab1b118";
-    hash = "sha256-nnS4DMz/2VciCrhOBGRb1+kDbxj+ZOnEtQmzs/TJ870=";
+    rev = "33214afee13df36dc46309ef5416d681b56db5b9";
+    hash = "sha256-PjJzFrvkmrTsBjzmEG6hNU8VzDlofQrdfTGFhxkVPWU=";
   };
 
   nativeBuildInputs = [
+    meson
+    ninja
     pkg-config
-    autoreconfHook
   ];
 
   propagatedBuildInputs = [

From 83599f2574ac4bc347ae170f76b94249bfed978e Mon Sep 17 00:00:00 2001
From: Mukul Agarwal <vcs@agarmu.com>
Date: Thu, 2 Jul 2026 01:19:57 -0400
Subject: [PATCH 06/33] thorium-reader: 3.3.0 -> 3.4.0

---
 pkgs/by-name/th/thorium-reader/package.nix    | 23 ++++++++++++++++---
 .../remove-dist-npm-install.patch             | 13 +++++++++++
 2 files changed, 33 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/by-name/th/thorium-reader/remove-dist-npm-install.patch

diff --git a/pkgs/by-name/th/thorium-reader/package.nix b/pkgs/by-name/th/thorium-reader/package.nix
index e345900043fa..b98d7cd74d79 100644
--- a/pkgs/by-name/th/thorium-reader/package.nix
+++ b/pkgs/by-name/th/thorium-reader/package.nix
@@ -14,18 +14,35 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "thorium-reader";
-  version = "3.3.0";
+  version = "3.4.0";
   nodejs = nodejs_24;
-  npmDepsHash = "sha256-UR2MSqmdJ79Fz7qjQRkCAwx2jdMn8KLWPzNSnnsb5Ak=";
+  npmDepsHash = "sha256-IwdU77fRJJ7Ch5rWop3lFpf14XHklFDa8w6YJCFtJRU=";
   makeCacheWritable = true;
 
   src = fetchFromGitHub {
     owner = "edrlab";
     repo = "thorium-reader";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2d5M9C/cLK2A8O3Ls0xEkT6H8tucVR7eivPi+82V7Zg=";
+    hash = "sha256-h285GM7DKKD34Wjw6E+zSSIGkUH/UOesLrYD2EdQ7+U=";
   };
 
+  # The upstream `build` script re-runs `npm i` inside `dist/` to populate
+  # `dist/node_modules` with the runtime subset declared in `src/package.json`.
+  # This is bad (not reproducible), so we strip that segment from the `build`
+  # script. This ends up not being an issue, since our build/install process
+  # copies relevant dependencies anyways.
+  patches = [ ./remove-dist-npm-install.patch ];
+
+  postBuild = ''
+    # copy node modules manually
+    cp -r node_modules dist/node_modules
+
+    # remove unnecessary npm deps
+    pushd dist
+    npm prune --production --ignore-scripts --offline --no-audit --no-fund
+    popd
+  '';
+
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
   # makeBinaryWrapper is required on Darwin since MacOS is confuses itself
   # into thinking it needs Rosetta 2 if it encounters a non-MachO executable
diff --git a/pkgs/by-name/th/thorium-reader/remove-dist-npm-install.patch b/pkgs/by-name/th/thorium-reader/remove-dist-npm-install.patch
new file mode 100644
index 000000000000..4b5146605262
--- /dev/null
+++ b/pkgs/by-name/th/thorium-reader/remove-dist-npm-install.patch
@@ -0,0 +1,13 @@
+diff --git a/package.json b/package.json
+index d838331..073dfff 100644
+--- a/package.json
++++ b/package.json
+@@ -25,7 +25,7 @@
+     "_NOT_NEEDED_electron-build_": "npm rebuild --runtime=electron --target=41.1.1 --disturl=https://electronjs.org/headers --build-from-source",
+     "_NOT_NEEDED_electron-build": "electron-rebuild --version=41.1.1 --disturl=https://electronjs.org/headers",
+     "_NOT_NEEDED_rmDupeReactReduxTypes": "rimraf \"./node_modules/@types/react-redux/node_modules/@types/react\"",
+-    "build": "cross-env NODE_ENV=production webpack --config webpack.config.js && ncp src/package.json dist/package.json && cd dist && rimraf node_modules && npm i --ignore-scripts --foreground-scripts && rimraf package-lock.json && cd ..",
++    "build": "cross-env NODE_ENV=production webpack --config webpack.config.js && ncp src/package.json dist/package.json",
+     "build:prod": "npm run lint && npm run build",
+     "build:dev:main": "webpack --config webpack.config.main.js",
+     "_NOT_NEEDED_build:dev:renderer:library": "webpack --config webpack.config.renderer-library.js",

From 5e5e22b4e8d188fc0932f6529f8bdef75bdb63ef Mon Sep 17 00:00:00 2001
From: Arnout Engelen <arnout@bzzt.net>
Date: Mon, 6 Jul 2026 20:48:12 +0200
Subject: [PATCH 07/33] python3Packages.bytecode: 0.17.0 -> 0.18.1

Also switch to the git repo also referenced in
https://pypi.org/project/bytecode/
---
 pkgs/development/python-modules/bytecode/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/bytecode/default.nix b/pkgs/development/python-modules/bytecode/default.nix
index 7911b9156a40..5f803209905e 100644
--- a/pkgs/development/python-modules/bytecode/default.nix
+++ b/pkgs/development/python-modules/bytecode/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "bytecode";
-  version = "0.17.0";
+  version = "0.18.1";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "vstinner";
+    owner = "MatthieuDartiailh";
     repo = "bytecode";
     tag = version;
-    hash = "sha256-AocS5Z4WkHTR+nO5/4B7oV/fb/ASG0aGrG/722Ioup0=";
+    hash = "sha256-hjPjF7xC7v2dZ6espAcru2sb7/6AEb3D1MYO0ekzJds=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];

From b36e8003133bb91e99b41193f9d5594d0dfb33e2 Mon Sep 17 00:00:00 2001
From: Philip White <philip@0xfff.me>
Date: Tue, 7 Jul 2026 21:04:05 -0700
Subject: [PATCH 08/33] bisq1: 1.10.2 -> 1.10.3 (and add update script)

nixpkgs-update is not able to update this package as-is, because it
has multiple fetch targets. So I add a custom updater.
---
 pkgs/by-name/bi/bisq1/package.nix | 17 ++++---
 pkgs/by-name/bi/bisq1/sources.nix |  9 ++++
 pkgs/by-name/bi/bisq1/update.sh   | 79 +++++++++++++++++++++++++++++++
 3 files changed, 99 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/by-name/bi/bisq1/sources.nix
 create mode 100755 pkgs/by-name/bi/bisq1/update.sh

diff --git a/pkgs/by-name/bi/bisq1/package.nix b/pkgs/by-name/bi/bisq1/package.nix
index 8895ec305994..e5ca6ad35ec8 100644
--- a/pkgs/by-name/bi/bisq1/package.nix
+++ b/pkgs/by-name/bi/bisq1/package.nix
@@ -36,7 +36,10 @@
 }:
 
 let
-  version = "1.10.2";
+  # This is separated into its own file so it's easier for `update.sh`.
+  sources = import ./sources.nix;
+
+  version = sources.version;
 
   # JDK 21 is the toolchain required by docs/build.md. enableJavaFX is not
   # strictly required (Bisq bundles its own JavaFX jars), but mirrors the
@@ -86,17 +89,17 @@ let
   publicKey = {
     "E222AA02" = fetchurl {
       url = "https://github.com/bisq-network/bisq/releases/download/v${version}/E222AA02.asc";
-      hash = "sha256-Ue/UmS6F440/ybEEIAR+pdPEIksAt6QSMN6G5TZVWzc=";
+      hash = sources."key-E222AA02-hash";
     };
 
     "4A133008" = fetchurl {
       url = "https://github.com/bisq-network/bisq/releases/download/v${version}/4A133008.asc";
-      hash = "sha256-UijG3DkJNNTakVJd2wl30mDepa27n6R/Xxfl4sjt0sk=";
+      hash = sources."key-4A133008-hash";
     };
 
     "387C8307" = fetchurl {
       url = "https://github.com/bisq-network/bisq/releases/download/v${version}/387C8307.asc";
-      hash = "sha256-PrRYZLT0xv82dUscOBgQGKNf6zwzWUDhriAffZbNpmI=";
+      hash = sources."key-387C8307-hash";
     };
   };
 
@@ -133,7 +136,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
-    hash = "sha256-e7rPUhA6KF3Tz3zlYqEfM9G0owe9hAUFDifKseRvb6A=";
+    hash = sources."deb-hash";
 
     # Verify the upstream Debian package's detached PGP signature prior to use.
     # This ensures that a successful build of this Nix package requires the
@@ -158,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   signature = fetchurl {
     url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb.asc";
-    hash = "sha256-kBRaOXuP22DvXMkJ1XQatwvTmu/Ds8FvmUgYnRT7Vg0=";
+    hash = sources."sig-hash";
   };
 
   nativeBuildInputs = [
@@ -241,6 +244,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "Decentralized bitcoin exchange network (Bisq 1)";
     homepage = "https://bisq.network";
diff --git a/pkgs/by-name/bi/bisq1/sources.nix b/pkgs/by-name/bi/bisq1/sources.nix
new file mode 100644
index 000000000000..8b9f276e8cf1
--- /dev/null
+++ b/pkgs/by-name/bi/bisq1/sources.nix
@@ -0,0 +1,9 @@
+# Generated by ./update.sh - do not update manually!
+{
+  version = "1.10.3";
+  deb-hash = "sha256-kzLtadq8gfX6j9XU3PD5kNV43wLDoICPlXdJqULkAWE=";
+  sig-hash = "sha256-+51j+SBp7buukop1T4Gz0YDUga6540BVxDRoU2YE3pY=";
+  key-E222AA02-hash = "sha256-Ue/UmS6F440/ybEEIAR+pdPEIksAt6QSMN6G5TZVWzc=";
+  key-4A133008-hash = "sha256-UijG3DkJNNTakVJd2wl30mDepa27n6R/Xxfl4sjt0sk=";
+  key-387C8307-hash = "sha256-PrRYZLT0xv82dUscOBgQGKNf6zwzWUDhriAffZbNpmI=";
+}
diff --git a/pkgs/by-name/bi/bisq1/update.sh b/pkgs/by-name/bi/bisq1/update.sh
new file mode 100755
index 000000000000..c162a4e6190b
--- /dev/null
+++ b/pkgs/by-name/bi/bisq1/update.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash --pure --keep GITHUB_TOKEN -p nix git curl cacert jq
+
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+# Fetch the latest release version from GitHub
+payload=$(curl -sL https://api.github.com/repos/bisq-network/bisq/releases/latest)
+version=$(jq -r .tag_name <<< "$payload" | sed 's/^v//')
+
+echo "Updating bisq1 to version $version"
+
+# URLs for the new version
+deb_url="https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb"
+sig_url="https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb.asc"
+
+# Fetch and compute hashes using nix-prefetch-url and convert to SRI format
+echo "Prefetching .deb package..."
+deb_hash_raw=$(nix-prefetch-url "$deb_url" 2>/dev/null)
+deb_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$deb_hash_raw")
+echo "  deb hash: $deb_hash"
+
+echo "Prefetching signature..."
+sig_hash_raw=$(nix-prefetch-url "$sig_url" 2>/dev/null)
+sig_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$sig_hash_raw")
+echo "  signature hash: $sig_hash"
+
+# Fetch and compute hashes for public keys (these may not exist in all releases)
+get_key_hash() {
+  local key_name=$1
+  local url="https://github.com/bisq-network/bisq/releases/download/v${version}/${key_name}.asc"
+  local hash_raw
+  if hash_raw=$(nix-prefetch-url "$url" 2>/dev/null); then
+    nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$hash_raw"
+  else
+    echo ""  # Return empty if key doesn't exist
+  fi
+}
+
+echo "Prefetching public keys..."
+key_E222AA02_hash=$(get_key_hash "E222AA02")
+if [ -n "$key_E222AA02_hash" ]; then
+  echo "  E222AA02 hash: $key_E222AA02_hash"
+else
+  echo "  E222AA02: not found in this release, keeping old hash"
+  key_E222AA02_hash=$(grep 'key-E222AA02-hash' sources.nix | sed 's/.*= "\(.*\)".*/\1/')
+fi
+
+key_4A133008_hash=$(get_key_hash "4A133008")
+if [ -n "$key_4A133008_hash" ]; then
+  echo "  4A133008 hash: $key_4A133008_hash"
+else
+  echo "  4A133008: not found in this release, keeping old hash"
+  key_4A133008_hash=$(grep 'key-4A133008-hash' sources.nix | sed 's/.*= "\(.*\)".*/\1/')
+fi
+
+key_387C8307_hash=$(get_key_hash "387C8307")
+if [ -n "$key_387C8307_hash" ]; then
+  echo "  387C8307 hash: $key_387C8307_hash"
+else
+  echo "  387C8307: not found in this release, keeping old hash"
+  key_387C8307_hash=$(grep 'key-387C8307-hash' sources.nix | sed 's/.*= "\(.*\)".*/\1/')
+fi
+
+# Write sources.nix (only include keys that exist)
+cat >sources.nix <<EOF
+# Generated by ./update.sh
+{
+  version = "$version";
+  deb-hash = "$deb_hash";
+  sig-hash = "$sig_hash";
+  key-E222AA02-hash = "$key_E222AA02_hash";
+  key-4A133008-hash = "$key_4A133008_hash";
+  key-387C8307-hash = "$key_387C8307_hash";
+}
+EOF
+
+echo "Updated sources.nix with version $version"

From eb461e4e2cff6f95ae79f13155d6966005d528ca Mon Sep 17 00:00:00 2001
From: Evan Richter <evanjrichter@gmail.com>
Date: Wed, 8 Jul 2026 13:55:10 -0600
Subject: [PATCH 09/33] maskromtool: 2024-08-18 -> 2026-07-04

---
 pkgs/by-name/ma/maskromtool/package.nix | 27 +++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/maskromtool/package.nix b/pkgs/by-name/ma/maskromtool/package.nix
index d3af7bd976d1..66b3e917a201 100644
--- a/pkgs/by-name/ma/maskromtool/package.nix
+++ b/pkgs/by-name/ma/maskromtool/package.nix
@@ -4,37 +4,60 @@
   fetchFromGitHub,
   cmake,
   qt6,
+  yara-x,
+  replxx,
+  readline,
+  pkg-config,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "maskromtool";
-  version = "2024-08-18";
+  version = "2026-07-04";
 
   src = fetchFromGitHub {
     owner = "travisgoodspeed";
     repo = "maskromtool";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-iuCjAAVEKVwJuAgKITwkXGhKau2DVWhFQLPjp28tjIo=";
+    hash = "sha256-QO2s+nGmf0XTq+PRcIqjEeuc6djzQv8TcJjlYYs/X5c=";
+    fetchSubmodules = true;
   };
 
+  postPatch = ''
+    # remove hardcoded PKG_CONFIG_PATH
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        'set(ENV{PKG_CONFIG_PATH} "c:/lib/pkgconfig;/usr/local/lib64")' \
+        ""
+  '';
+
+  cmakeFlags = [
+    (lib.cmakeFeature "FETCHCONTENT_TRY_FIND_PACKAGE_MODE" "ALWAYS")
+  ];
+
   buildInputs = [
     qt6.qtbase
     qt6.qtcharts
     qt6.qttools
+    yara-x
+    replxx
+    readline
   ];
 
   nativeBuildInputs = [
     cmake
+    pkg-config
     qt6.wrapQtAppsHook
   ];
 
   meta = {
     description = "CAD tool for extracting bits from Mask ROM photographs";
     homepage = "https://github.com/travisgoodspeed/maskromtool";
+    changelog = "https://github.com/travisgoodspeed/maskromtool/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       beerware
       gpl1Plus
     ];
     maintainers = with lib.maintainers; [ evanrichter ];
+    mainProgram = "maskromtool";
   };
 })

From ee7c57add66af8f1da27c49763a4aab0bfc2d537 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Thu, 9 Jul 2026 01:30:17 +0200
Subject: [PATCH 10/33] {lomiri,lomiri-qt6}.lomiri-thumbnailer: 3.1.2 -> 3.1.3

---
 .../services/lomiri-thumbnailer/default.nix    | 18 ++----------------
 1 file changed, 2 insertions(+), 16 deletions(-)

diff --git a/pkgs/desktops/lomiri/services/lomiri-thumbnailer/default.nix b/pkgs/desktops/lomiri/services/lomiri-thumbnailer/default.nix
index 0e6cab178aac..730c2d6b3a77 100644
--- a/pkgs/desktops/lomiri/services/lomiri-thumbnailer/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-thumbnailer/default.nix
@@ -2,14 +2,12 @@
   stdenv,
   lib,
   fetchFromGitLab,
-  fetchpatch,
   gitUpdater,
   nixosTests,
   testers,
   boost,
   cmake,
   cmake-extras,
-  ctestCheckHook,
   doxygen,
   gst_all_1,
   gdk-pixbuf,
@@ -37,13 +35,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-thumbnailer";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-thumbnailer";
     tag = finalAttrs.version;
-    hash = "sha256-6fQonYnOjxzHcM51VgCeL5OfsmThq9tNpGnMvNWrDXI=";
+    hash = "sha256-bDSqLxYQYCnN5SngoZmYwJTL6qoWpZ9HVUQMiAVQxlE=";
   };
 
   outputs = [
@@ -125,7 +123,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]);
 
   nativeCheckInputs = [
-    ctestCheckHook
     shared-mime-info
     xvfb-run
   ];
@@ -147,17 +144,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
-  disabledTests = [
-    # QSignalSpy tests in QML suite always fail, pass when running interactively
-    "qml"
-  ]
-  ++ lib.optionals withQt6 [
-    # https://gitlab.com/ubports/development/core/lomiri-thumbnailer/-/work_items/13
-    "dbus"
-    "lomiri-thumbnailer-qt6"
-    "thumbnailer-admin"
-  ];
-
   enableParallelChecking = false;
 
   preCheck = ''

From 9f3e49bffaaf88895680fa4cacede553017ec60c Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Thu, 9 Jul 2026 02:02:55 +0200
Subject: [PATCH 11/33] {lomiri,lomiri-qt6}.lomiri-url-dispatcher: 0.1.4 ->
 0.1.5

---
 .../lomiri/services/lomiri-url-dispatcher/default.nix    | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/desktops/lomiri/services/lomiri-url-dispatcher/default.nix b/pkgs/desktops/lomiri/services/lomiri-url-dispatcher/default.nix
index d9a7435ec4ee..786dbeac64fb 100644
--- a/pkgs/desktops/lomiri/services/lomiri-url-dispatcher/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-url-dispatcher/default.nix
@@ -29,17 +29,17 @@
 }:
 
 let
-  withQt6 = lib.strings.versionAtLeast qtbase.version "6";
+  withQt6 = lib.versions.major qtbase.version == "6";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-url-dispatcher";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-url-dispatcher";
     tag = finalAttrs.version;
-    hash = "sha256-+3/C6z8wyiNSpt/eyMl+j/TGJW0gZ5T3Vd1NmghK67k=";
+    hash = "sha256-Qg3nYg8SThm6lYp/TB81XW4yEM5NhzK3wPU8bB/g/ks=";
   };
 
   outputs = [
@@ -81,7 +81,9 @@ stdenv.mkDerivation (finalAttrs: {
         setuptools
       ]
       ++ lib.optionals finalAttrs.finalPackage.doCheck [
+        fixtures
         python-dbusmock
+        testtools
       ]
     ))
     wrapQtAppsHook
@@ -103,6 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeCheckInputs = [
     dbus
+    dbus-test-runner
     sqlite
   ];
 

From e0abffecc00c745cabdb5ea20f693d874881aa94 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Thu, 9 Jul 2026 02:31:17 +0200
Subject: [PATCH 12/33] miracle-wm: 0.9.1 -> 0.10.1

---
 pkgs/by-name/mi/miracle-wm/package.nix | 34 ++++++++++++++------------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/mi/miracle-wm/package.nix b/pkgs/by-name/mi/miracle-wm/package.nix
index 56c617c0768e..489f32863563 100644
--- a/pkgs/by-name/mi/miracle-wm/package.nix
+++ b/pkgs/by-name/mi/miracle-wm/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   gitUpdater,
   nixosTests,
   boost,
@@ -12,6 +11,8 @@
   glib,
   glm,
   gtest,
+  gtk4,
+  gtk4-layer-shell,
   json_c,
   libevdev,
   libglvnd,
@@ -29,31 +30,21 @@
   wasmedge,
   wayland,
   wayland-scanner,
+  wrapGAppsHook4,
   yaml-cpp,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "miracle-wm";
-  version = "0.9.1";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "miracle-wm-org";
     repo = "miracle-wm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7JtdSopKBHfFK0KsV0+9OxrOx3vrSydmZSmAiBvKQiI=";
+    hash = "sha256-htFgvXYgxQXV2U3F+tXEoaTb0udc2H1aHsIg5E8nRL8=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "0001-miracle-wm-mir2.28.patch";
-      url = "https://github.com/miracle-wm-org/miracle-wm/commit/0fcfb54c59327d0776f6e8074e885080731a95c4.patch";
-      excludes = [
-        ".github/workflows/test-deb-install.yml"
-      ];
-      hash = "sha256-HuXwPkM0whLFIy8HM6n9bG9I/DZOuzAajmDpJMZt9BQ=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace-fail 'DESTINATION lib' 'DESTINATION ''${CMAKE_INSTALL_LIBDIR}' \
@@ -67,12 +58,15 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
     pkg-config
     wayland-scanner
+    wrapGAppsHook4
   ];
 
   buildInputs = [
     boost
     glib
     glm
+    gtk4
+    gtk4-layer-shell
     json_c
     libevdev
     libglvnd
@@ -96,11 +90,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   checkInputs = [ gtest ];
 
+  # Manually wrapping the few binaries that needs it
+  dontWrapGApps = true;
+
   cmakeFlags = [
+    (lib.cmakeBool "BUILD_DEBUG_OVERLAY" true)
+    (lib.cmakeBool "BUILD_ERROR_REPORTER" true)
     (lib.cmakeBool "ENABLE_LTO" true)
     (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
-    # https://github.com/miracle-wm-org/miracle-wm/issues/865
-    (lib.cmakeBool "FEATURE_PLUGIN_SYSTEM" false)
+    (lib.cmakeBool "FEATURE_PLUGIN_SYSTEM" true)
     (lib.cmakeBool "SYSTEMD_INTEGRATION" true)
     (lib.cmakeBool "END_TO_END_TESTS" finalAttrs.finalPackage.doCheck)
   ];
@@ -119,6 +117,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postFixup = ''
     patchShebangs $out/libexec/miracle-wm-session-setup
+
     wrapProgram $out/libexec/miracle-wm-session-setup \
       --prefix PATH : "$out/bin:${
         lib.makeBinPath [
@@ -127,6 +126,9 @@ stdenv.mkDerivation (finalAttrs: {
           systemd # systemctl
         ]
       }"
+
+    wrapGApp $out/bin/miracle-wm-basic-error-reporter
+    wrapGApp $out/bin/miracle-wm-debug-overlay
   '';
 
   passthru = {

From 3a79a9ded25c8165d93178944d79307bc7b21191 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Thu, 9 Jul 2026 03:03:09 +0200
Subject: [PATCH 13/33] dosbox-x: 2026.06.02 -> 2026.07.02

---
 pkgs/by-name/do/dosbox-x/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/do/dosbox-x/package.nix b/pkgs/by-name/do/dosbox-x/package.nix
index c09e3235c70f..b7007d6b9197 100644
--- a/pkgs/by-name/do/dosbox-x/package.nix
+++ b/pkgs/by-name/do/dosbox-x/package.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dosbox-x";
-  version = "2026.06.02";
+  version = "2026.07.02";
 
   src = fetchFromGitHub {
     owner = "joncampbell123";
     repo = "dosbox-x";
     rev = "dosbox-x-v${finalAttrs.version}";
-    hash = "sha256-60ZMaevTqYjHq6WrhKVQ8T8kfrQV7Auy59y3JFMHi5w=";
+    hash = "sha256-HO5JJQHeEJYXU7TtNCXZALgqkNbIMGI+TjDwbvs5L8w=";
   };
 
   # sips is unavailable in sandbox, replacing with imagemagick breaks build due to wrong Foundation propagation(?) so don't generate resolution variants

From 2c327785b3f186e8b1455e115a3c22a44c71e6f0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 9 Jul 2026 06:55:06 +0000
Subject: [PATCH 14/33] davmail: 6.8.0 -> 6.8.1

---
 pkgs/by-name/da/davmail/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/da/davmail/package.nix b/pkgs/by-name/da/davmail/package.nix
index 60c07cfa4630..026e4cde54ee 100644
--- a/pkgs/by-name/da/davmail/package.nix
+++ b/pkgs/by-name/da/davmail/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "davmail";
-  version = "6.8.0";
+  version = "6.8.1";
 
   src = fetchFromGitHub {
     owner = "mguessan";
     repo = "davmail";
     tag = finalAttrs.version;
-    hash = "sha256-I5MQTxCU3SCIAj6Y6idJ9KbBRhvSbzZhZ9nY82BXM7k=";
+    hash = "sha256-kIDAMVenUzc7tIC49yzc1MzqNa9B7nNlX1bzwpG8Vp0=";
   };
 
   buildPhase = ''

From b20b6d4a1ea871c3f98057cdd9c7c6a1ada759c9 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Fri, 10 Jul 2026 13:01:11 -0300
Subject: [PATCH 15/33] python3Packages.pandas-stubs: 2.3.3.260113 ->
 3.0.3.260530

---
 .../python-modules/pandas-stubs/default.nix           | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pandas-stubs/default.nix b/pkgs/development/python-modules/pandas-stubs/default.nix
index c4003e943cac..e77851a61808 100644
--- a/pkgs/development/python-modules/pandas-stubs/default.nix
+++ b/pkgs/development/python-modules/pandas-stubs/default.nix
@@ -35,14 +35,14 @@
 
 buildPythonPackage rec {
   pname = "pandas-stubs";
-  version = "2.3.3.260113";
+  version = "3.0.3.260530";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pandas-dev";
     repo = "pandas-stubs";
     tag = "v${version}";
-    hash = "sha256-DJS3aG79IZowiTqHeOEgDdlH9Z1SXrbZ7yplCrFTtzw=";
+    hash = "sha256-vPXz4ibNbFE2B14pkGPN5EDAwhA92VgFXzMLR9da6WQ=";
   };
 
   build-system = [ poetry-core ];
@@ -78,12 +78,19 @@ buildPythonPackage rec {
     # Missing dependencies, error and warning checks
     "test_all_read_without_lxml_dtype_backend" # pyarrow.orc
     "test_orc" # pyarrow.orc
+    "test_iceberg" # pyiceberg
     "test_plotting" # UserWarning: No artists with labels found to put in legend.
     "test_spss" # FutureWarning: ChainedAssignmentError: behaviour will change in pandas 3.0!
     "test_show_version"
     # FutureWarning: In the future `np.bool` will be defined as the corresponding...
     "test_timedelta_cmp"
     "test_timestamp_cmp"
+    # DeprecationWarning: The 'generic' unit for NumPy timedelta is deprecated
+    "test_timedelta_properties_methods"
+    "test_sparse_dtype"
+    "test_sparse_dtype_fill_value_subtype_compatibility"
+    "test_isna"
+    "test_timedelta_range"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "test_clipboard" # FileNotFoundError: [Errno 2] No such file or directory: 'pbcopy'

From a41aa77372cb691d0d665769681181276e6f43e4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 10 Jul 2026 21:39:37 +0200
Subject: [PATCH 16/33] python3Packages.genai-prices: 0.0.69 -> 0.0.71

https://github.com/pydantic/genai-prices/compare/v0.0.69...v0.0.71
---
 pkgs/development/python-modules/genai-prices/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/genai-prices/default.nix b/pkgs/development/python-modules/genai-prices/default.nix
index 105f09245c32..2c87e8d7887f 100644
--- a/pkgs/development/python-modules/genai-prices/default.nix
+++ b/pkgs/development/python-modules/genai-prices/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "genai-prices";
-  version = "0.0.69";
+  version = "0.0.71";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "genai-prices";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kXS8+GcrcDPGxfIej18wSn/DdBzgf3mjFo/1QIOGwVM=";
+    hash = "sha256-IFBdpXJ0AE3UNNqUlOrYMIgRGeB87BYbNqb4GvtJkl0=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/python";

From 8e4d714c703f53f2d002d62765fb404a15956dec Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 10 Jul 2026 21:42:21 +0200
Subject: [PATCH 17/33] python3Packages.pydantic-graph: 2.5.0 -> 2.8.0

https://github.com/pydantic/pydantic-ai/releases/tag/v2.8.0
---
 pkgs/development/python-modules/pydantic-graph/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pydantic-graph/default.nix b/pkgs/development/python-modules/pydantic-graph/default.nix
index 6b13b57c8483..5faee498d04f 100644
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-graph";
-  version = "2.5.0";
+  version = "2.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SpWiFEN9wwBtKSRDKZ8buPvBiRU3cqjwTCLFkGKpeOs=";
+    hash = "sha256-KwuhRZWGOofglR5SVsUOijtgYnhVV3Fc9DLtUwL+KSU=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_graph";

From e6bdae73bbea858cfafc4b3022d44a30cccef5e9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 10 Jul 2026 21:42:45 +0200
Subject: [PATCH 18/33] python3Packages.pydantic-ai-slim: 2.5.0 -> 2.8.0

https://github.com/pydantic/pydantic-ai/releases/tag/v2.8.0
---
 pkgs/development/python-modules/pydantic-ai-slim/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pydantic-ai-slim/default.nix b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
index 5be96456c138..f07cfb90e3d2 100644
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-ai-slim";
-  version = "2.5.0";
+  version = "2.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SpWiFEN9wwBtKSRDKZ8buPvBiRU3cqjwTCLFkGKpeOs=";
+    hash = "sha256-KwuhRZWGOofglR5SVsUOijtgYnhVV3Fc9DLtUwL+KSU=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";

From dac2015dabc17c5dc76a60498ed98e47d4dbde60 Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Fri, 10 Jul 2026 18:55:10 +0100
Subject: [PATCH 19/33] prometheus: Fix update script to handle ordering
 between pnpm and Go deps

---
 pkgs/by-name/pr/prometheus/update.sh | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pr/prometheus/update.sh b/pkgs/by-name/pr/prometheus/update.sh
index 2f3b54b8aed4..489a092aac61 100755
--- a/pkgs/by-name/pr/prometheus/update.sh
+++ b/pkgs/by-name/pr/prometheus/update.sh
@@ -49,9 +49,22 @@ cat > "$SOURCE_NIX" <<-EOF
 }
 EOF
 
-VENDOR_HASH=$(extractHash prometheus.goModules)
+# Resolve pnpm hash first: the Go integration pulls in the assets, so a fake
+# pnpmDepsHash makes that stage fail.
 PNPM_DEPS_HASH=$(extractHash prometheus.assets.pnpmDeps)
 
+cat > "$SOURCE_NIX" <<-EOF
+{
+  version = "$TARGET_VERSION";
+  hash = "$PREFETCH_HASH";
+  pnpmDepsHash = "$PNPM_DEPS_HASH";
+  vendorHash = "$FAKE_HASH";
+}
+EOF
+
+# Now do the Go module fetch.
+VENDOR_HASH=$(extractHash prometheus.goModules)
+
 cat > "$SOURCE_NIX" <<-EOF
 {
   version = "$TARGET_VERSION";

From 5fd332a07aa63f5ea19ebbe8fa6c84004cbf835b Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Fri, 10 Jul 2026 19:02:25 +0100
Subject: [PATCH 20/33] =?UTF-8?q?prometheus:=203.13.0=20=E2=86=92=203.13.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/pr/prometheus/source.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pr/prometheus/source.nix b/pkgs/by-name/pr/prometheus/source.nix
index 8bc7d9282302..e4d65170f55b 100644
--- a/pkgs/by-name/pr/prometheus/source.nix
+++ b/pkgs/by-name/pr/prometheus/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "3.13.0";
-  hash = "sha256-v6jk4MqoxcfK+yj+T31Ovqj1tyh3mc4aEr8BD0vjBOc=";
+  version = "3.13.1";
+  hash = "sha256-DtUdZp/o/tzLjiOZJ3duGqaLoNvkzulbL+wyLnY0dwA=";
   pnpmDepsHash = "sha256-Z1TYYZhELi+rIiuleN8xR/WiMn9TF4KotFMTOsR2e6Y=";
   vendorHash = "sha256-yvzQHfe7yd6Sjh1Vd2VxTp3jK8OWoKTmJ2uMyXX3+xs=";
 }

From ad63215eab08ede37cb9bc3d628b28054c086a64 Mon Sep 17 00:00:00 2001
From: Fernando Rodrigues <alpha@sigmasquadron.net>
Date: Sun, 12 Jul 2026 07:30:05 +1000
Subject: [PATCH 21/33] libvmi: drop fuse dependency

libvmi has an optional feature that depends on FUSE 2. We can just disable it here, given that FUSE 2 is now deprecated.

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
---
 pkgs/by-name/li/libvmi/package.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/li/libvmi/package.nix b/pkgs/by-name/li/libvmi/package.nix
index 53680ff18971..1619409ed4d4 100644
--- a/pkgs/by-name/li/libvmi/package.nix
+++ b/pkgs/by-name/li/libvmi/package.nix
@@ -13,9 +13,6 @@
   json_c,
   libvirt,
 
-  withVMIFS ? true,
-  fuse,
-
   legacyKVM ? false,
   libkvmi,
 
@@ -67,13 +64,11 @@ stdenv.mkDerivation {
     libvirt
   ]
   ++ lib.optionals xenSupport [ xen ]
-  ++ lib.optionals (!legacyKVM) [ libkvmi ]
-  ++ lib.optionals withVMIFS [ fuse ];
+  ++ lib.optionals (!legacyKVM) [ libkvmi ];
 
   configureFlags =
     lib.optionals (!xenSupport) [ "--disable-xen" ]
-    ++ lib.optionals legacyKVM [ "--enable-kvm-legacy" ]
-    ++ lib.optionals withVMIFS [ "--enable-vmifs" ];
+    ++ lib.optionals legacyKVM [ "--enable-kvm-legacy" ];
 
   # libvmi uses dlopen() for the xen libraries, however autoPatchelfHook doesn't work here
   postFixup = lib.optionalString xenSupport ''

From 626e303ddc7b8b307234be8b5a60ba795ae2bff3 Mon Sep 17 00:00:00 2001
From: Vladyslav Pekker <agilesteel@gmail.com>
Date: Sun, 12 Jul 2026 14:26:50 -0300
Subject: [PATCH 22/33] bloop: 2.1.0 -> 2.1.1

---
 pkgs/by-name/bl/bloop/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/bl/bloop/package.nix b/pkgs/by-name/bl/bloop/package.nix
index d5421084db2e..65dbf840fb6e 100644
--- a/pkgs/by-name/bl/bloop/package.nix
+++ b/pkgs/by-name/bl/bloop/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "bloop";
-  version = "2.1.0";
+  version = "2.1.1";
 
   platform =
     if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 then
@@ -42,11 +42,11 @@ stdenv.mkDerivation rec {
     url = "https://github.com/scalacenter/bloop/releases/download/v${version}/bloop-${platform}";
     sha256 =
       if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 then
-        "sha256-yZEN3w2pvCmDRcvwE3KjUaJOVbUSDvVthMmlRSY2cSY="
+        "sha256-F5wRihAwf/TNBSYortTCoK9qKqTI+1N5InJ+rqLFp8A="
       else if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64 then
-        "sha256-U1rPA1h0xVjAsuDFfaFvy7n6L+yRNKgqS9OQYvZH8MM="
+        "sha256-wQXAldzU6Typ6pZB8k3dfX7g+aaVF7jXvd0pnuk5gZU="
       else if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 then
-        "sha256-1MO14ChMnn/cDSEl1qiwDhzgX3pQjsSN8ksp4WkPDMk="
+        "sha256-OrONKbC2l0jjfmguDmoiyEaJWdTrKBiP0ZEa5rhizDM="
       else
         throw "unsupported platform";
   };

From 69640f6d1f788e631b7457681ec278010dfd9a74 Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Sun, 12 Jul 2026 20:58:08 +0200
Subject: [PATCH 23/33] doc/style.css: clamp content max-width

---
 doc/style.css | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/style.css b/doc/style.css
index 8b426e72de24..8f891a2f44b0 100644
--- a/doc/style.css
+++ b/doc/style.css
@@ -23,14 +23,14 @@ body {
 @media screen and (min-width: 992px) {
   .book,
   .appendix {
-    max-width: 60rem;
+    max-width: 55rem;
   }
 }
 
 @media screen and (min-width: 1200px) {
   .book,
   .appendix {
-    max-width: 73rem;
+    max-width: 55rem;
   }
 }
 

From 9af645506c710799906e7a45bdcaa00fc9552b93 Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Sun, 12 Jul 2026 23:41:21 +0200
Subject: [PATCH 24/33] matrix-continuwuity: 26.6.1 -> 26.6.2

Release notes: https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.2
Changelog: https://forgejo.ellis.link/continuwuation/continuwuity/src/commit/v26.6.2/CHANGELOG.md
Diff: https://forgejo.ellis.link/continuwuation/continuwuity/compare/v26.6.1...v26.6.2
---
 pkgs/by-name/ma/matrix-continuwuity/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/matrix-continuwuity/package.nix b/pkgs/by-name/ma/matrix-continuwuity/package.nix
index 6e7e99fcc997..9caad3ba2e9d 100644
--- a/pkgs/by-name/ma/matrix-continuwuity/package.nix
+++ b/pkgs/by-name/ma/matrix-continuwuity/package.nix
@@ -38,17 +38,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-continuwuity";
-  version = "26.6.1";
+  version = "26.6.2";
 
   src = fetchFromGitea {
     domain = "forgejo.ellis.link";
     owner = "continuwuation";
     repo = "continuwuity";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sfUxhBPf0P46Xf0lcZFDj23cuZ9apJDyTQPa97jlcSY=";
+    hash = "sha256-GcCjJiUOGX+vF7R4IRgNQs8KpfVj+MXwnhofwSm6gpA=";
   };
 
-  cargoHash = "sha256-Qmw9Xum+Osu/4kbVqJP79gbtimpV2P7SkCMuQWyBYxg=";
+  cargoHash = "sha256-p1Bz7op/qPogBn8bj9pQ7KjRhH2kZao8o0LPqWH2ZYo=";
 
   nativeBuildInputs = [
     pkg-config

From 0d2c276e3eb1e91ea8501d249f506f0de7e0be9e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 02:04:34 +0000
Subject: [PATCH 25/33] python3Packages.sabctools: 9.5.0 -> 9.6.1

---
 pkgs/development/python-modules/sabctools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sabctools/default.nix b/pkgs/development/python-modules/sabctools/default.nix
index dc69a97325d2..63c70514debd 100644
--- a/pkgs/development/python-modules/sabctools/default.nix
+++ b/pkgs/development/python-modules/sabctools/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "sabctools";
-  version = "9.5.0";
+  version = "9.6.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-x0+9GT/xs+EdX63qglTeuYE/z8cp/kOZmk6zd8MlAgQ=";
+    hash = "sha256-7hiLzmhaB5btSw5OVWcGpWAvsnKKamybRvwDQMrdigM=";
   };
 
   build-system = [ setuptools ];

From e718bf5f8cc938cda66b12130ffb5eb32975b43b Mon Sep 17 00:00:00 2001
From: David Wronek <david.wronek@mainlining.org>
Date: Mon, 13 Jul 2026 07:24:27 +0200
Subject: [PATCH 26/33] git-repo: 2.59 -> 2.65

Following changes have been done:
* Update to v2.65
* Use upstream git repository (Previous GitHub mirror has been archived)
* Add custom update script
* Add myself as maintainer

Signed-off-by: David Wronek <david.wronek@mainlining.org>
---
 pkgs/by-name/gi/git-repo/package.nix | 19 ++++++++++---------
 pkgs/by-name/gi/git-repo/update.sh   |  7 +++++++
 2 files changed, 17 insertions(+), 9 deletions(-)
 create mode 100755 pkgs/by-name/gi/git-repo/update.sh

diff --git a/pkgs/by-name/gi/git-repo/package.nix b/pkgs/by-name/gi/git-repo/package.nix
index 1229c78825b1..d28573c0448c 100644
--- a/pkgs/by-name/gi/git-repo/package.nix
+++ b/pkgs/by-name/gi/git-repo/package.nix
@@ -1,9 +1,8 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
+  fetchFromGitiles,
   makeWrapper,
-  nix-update-script,
   python3,
   git,
   gnupg,
@@ -13,13 +12,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "git-repo";
-  version = "2.59";
+  version = "2.65";
 
-  src = fetchFromGitHub {
-    owner = "aosp-mirror";
-    repo = "tools_repo";
+  src = fetchFromGitiles {
+    url = "https://android.googlesource.com/tools/repo";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5ffk5B4ZA/Wy2bQNahFaXPFRSZdKz5t6TaGbN00mfxo=";
+    hash = "sha256-ToJj5WS74vwCAX53UB5zgy1K54y1gNK+1d4qQLmp1L8=";
   };
 
   # Fix 'NameError: name 'ssl' is not defined'
@@ -57,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = nix-update-script { };
+    updateScript = ./update.sh;
   };
 
   meta = {
@@ -70,7 +68,10 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://android.googlesource.com/tools/repo";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ otavio ];
+    maintainers = with lib.maintainers; [
+      otavio
+      ungeskriptet
+    ];
     platforms = lib.platforms.unix;
     mainProgram = "repo";
   };
diff --git a/pkgs/by-name/gi/git-repo/update.sh b/pkgs/by-name/gi/git-repo/update.sh
new file mode 100755
index 000000000000..3b1531b75b87
--- /dev/null
+++ b/pkgs/by-name/gi/git-repo/update.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts git
+set -euo pipefail
+latest_tag=$(list-git-tags --url="https://android.googlesource.com/tools/repo" | sort -V | tail -n1)
+latest_tag=${latest_tag##v}
+cd "$(git rev-parse --show-toplevel)"
+update-source-version git-repo "$latest_tag"

From 222f2a064d6c4a26b6bcc5e0303374e1e00dc15a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 06:33:36 +0000
Subject: [PATCH 27/33] gelly: 1.9.0 -> 1.9.2

---
 pkgs/by-name/ge/gelly/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ge/gelly/package.nix b/pkgs/by-name/ge/gelly/package.nix
index 75488e5e7912..367d8e288f00 100644
--- a/pkgs/by-name/ge/gelly/package.nix
+++ b/pkgs/by-name/ge/gelly/package.nix
@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gelly";
-  version = "1.9.0";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "Fingel";
     repo = "gelly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DIE+IjFpDG9kCEwN3XLlxYLWduGZ7G8LXjVDnl6pp1w=";
+    hash = "sha256-WcnPNsFvQ/CqvAYxWeoAWZiJ62bOgLe8fGNeyh2B+8s=";
   };
 
-  cargoHash = "sha256-iOJMUyjqYBl5muWZCnKRRgpAf5lTPgANjohTHa1cfGY=";
+  cargoHash = "sha256-0ZKW2xxjTn84mWBrK6zhw/uiOnd5sD+URu2O0a1TZW8=";
 
   nativeBuildInputs = [
     pkg-config

From b5e311369cc4f25121b95128262aa900c4d26154 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 11:17:48 +0000
Subject: [PATCH 28/33] duplicati: 2.3.0.3 -> 2.3.0.4

---
 pkgs/by-name/du/duplicati/package.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/du/duplicati/package.nix b/pkgs/by-name/du/duplicati/package.nix
index b56dc86e3d52..04a6d33e7e31 100644
--- a/pkgs/by-name/du/duplicati/package.nix
+++ b/pkgs/by-name/du/duplicati/package.nix
@@ -14,9 +14,9 @@
 
 let
   # for update.sh easy to handle
-  ngclientVersion = "0.0.225";
-  ngclientRev = "b740ef00435af2066936f90d4cf284b5662c4bf9";
-  ngclientHash = "sha256-X8ZhCmwfroIZWj3DjFq/InN+2zCOtHjEE1TyCXHNaIw=";
+  ngclientVersion = "0.0.226";
+  ngclientRev = "2cc3e2e088ddb4691bb389b0afa89287d399340e";
+  ngclientHash = "sha256-uMWOunSaV9HNhgH65P2boangZFe/9NCRb5BBqXv9TI0=";
 
   # from Duplicati/Server/webroot/ngclient/package.json
   ngclient = buildNpmPackage {
@@ -30,7 +30,7 @@ let
       hash = ngclientHash;
     };
 
-    npmDepsHash = "sha256-DhP1gY965xNOj98s95LqSTCaqJt4YdFfbZ4bGp3o4cA=";
+    npmDepsHash = "sha256-89l/1v8dncwImDgiQic2VN65K/dxIkEPCrsHCty2VV0=";
 
     nativeBuildInputs = [ bun ];
 
@@ -58,15 +58,15 @@ let
 in
 buildDotnetModule rec {
   pname = "duplicati";
-  version = "2.3.0.3";
+  version = "2.3.0.4";
   channel = "stable";
-  buildDate = "2026-06-10";
+  buildDate = "2026-07-09";
 
   src = fetchFromGitHub {
     owner = "duplicati";
     repo = "duplicati";
     tag = "v${version}_${channel}_${buildDate}";
-    hash = "sha256-vRD3pehsGznGesynrftns6F5md9Ej509A99Ug0IOPGk=";
+    hash = "sha256-pVfcD7bIlZ/ZsMNwjPcg+DY6YFNm191ngEm5SrDukSw=";
     stripRoot = true;
   };
 

From c31d88156e9bd3f480dc94b9882750ef7d769d7a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 12:28:10 +0000
Subject: [PATCH 29/33] context7-mcp: 3.2.2 -> 3.2.3

---
 pkgs/by-name/co/context7-mcp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/context7-mcp/package.nix b/pkgs/by-name/co/context7-mcp/package.nix
index bc565e2e546b..2869d2bac74c 100644
--- a/pkgs/by-name/co/context7-mcp/package.nix
+++ b/pkgs/by-name/co/context7-mcp/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "context7-mcp";
-  version = "3.2.2";
+  version = "3.2.3";
 
   src = fetchFromGitHub {
     owner = "upstash";
     repo = "context7";
     tag = "${tag-prefix}@${finalAttrs.version}";
-    hash = "sha256-v3zKMnZsc0gWVAdgZwFTskWcFVlOU6sG2i+qDwjx+dw=";
+    hash = "sha256-yyz4UraRm1JR/C7J2ib0nBU6zsNpKCWIWduTu7OlebM=";
   };
 
   nativeBuildInputs = [

From 9dfe7560d5e6ae6a7aaaa9a991f71f048608626b Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Fri, 26 Jun 2026 15:11:05 +0200
Subject: [PATCH 30/33] pkgs/nixos-render-docs: add --header, and
 --no-navheader

--header is a file pointing to an html fragment, when given injected as first child into <body>
--no-navheader turns of nrd's own header if desired for a more clean look, in case the header states duplicate information
---
 .../src/nixos_render_docs/manual.py           | 15 ++++++++--
 .../src/tests/test_html_header.py             | 30 +++++++++++++++++++
 2 files changed, 43 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/by-name/ni/nixos-render-docs/src/tests/test_html_header.py

diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
index a0b9beabc617..9177b0ad5202 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
@@ -265,6 +265,8 @@ class HTMLParameters(NamedTuple):
     sidebar_depth: int
     media_dir: Path
     sidebar_open: frozenset[str] = frozenset()
+    header: Path | None = None
+    no_navheader: bool = False
 
 class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
     _base_path: Path
@@ -344,7 +346,8 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
         if toc.next:
             next_link = f'<link rel="next" href="{toc.next.target.href()}" title="{toc.next.target.title}" />'
             next_a = f'<a accesskey="n" href="{toc.next.target.href()}">Next</a>'
-        if toc.prev or toc.parent or toc.next:
+        # nav_header is not disabled
+        if not self._html_params.no_navheader and (toc.prev or toc.parent or toc.next):
             nav_html = "\n".join([
                 '  <div class="navheader">',
                 '   <table width="100%" summary="Navigation header">',
@@ -381,6 +384,10 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
                 });
             });
         """
+        header_content = ""
+        if self._html_params.header:
+            with open(self._html_params.header) as header_file:
+                header_content = header_file.read()
 
         return "\n".join([
             '<?xml version="1.0" encoding="utf-8" standalone="no"?>',
@@ -406,6 +413,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
             ('  <button type="button" class="toc-toggle" popovertarget="manual-toc"'
              ' popovertargetaction="toggle" aria-label="Toggle table of contents">'
              '☰</button>') if sidebar else "",
+            header_content,
             nav_html,
             f'  <nav id="manual-toc" class="toc-sidebar" popover="auto">{sidebar}</nav>' if sidebar else "",
             '  <main class="content">',
@@ -757,6 +765,9 @@ def _build_cli_html(p: argparse.ArgumentParser) -> None:
     p.add_argument('--chunk-toc-depth', nargs='?', action=_DeprecatedDepthFlag, default=None)
     p.add_argument('--section-toc-depth', nargs='?', action=_DeprecatedDepthFlag, default=None)
     # Positional
+    p.add_argument('--no-navheader', default=False, action='store_true')
+    p.add_argument('--header', type=Path,
+                   help='Inject any html fragment into the <body> as first child')
     p.add_argument('infile', type=Path)
     p.add_argument('outfile', type=Path)
 
@@ -774,7 +785,7 @@ def _run_cli_html(args: argparse.Namespace) -> None:
         md = HTMLConverter(
             args.revision,
             HTMLParameters(args.generator, args.stylesheet, args.script,
-                           args.sidebar_depth, args.media_dir, sidebar_open),
+                           args.sidebar_depth, args.media_dir, sidebar_open, args.header, args.no_navheader),
             json.load(manpage_urls), redirects)
         md.convert(args.infile, args.outfile)
 
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/tests/test_html_header.py b/pkgs/by-name/ni/nixos-render-docs/src/tests/test_html_header.py
new file mode 100644
index 000000000000..7111959bea55
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-render-docs/src/tests/test_html_header.py
@@ -0,0 +1,30 @@
+from pathlib import Path
+
+import pytest
+from nixos_render_docs.manual import HTMLConverter, HTMLParameters
+
+SAMPLE_BOOK = "# Title {#book-title}\n## Subtitle\n"
+
+def render(tmp_path: Path, header: Path | None) -> str:
+    infile = tmp_path / "index.md"
+    infile.write_text(SAMPLE_BOOK)
+    outfile = tmp_path / "index.html"
+    params = HTMLParameters("", [], [], 2, sidebar_open = [], media_dir=tmp_path, header = header)
+    HTMLConverter("1.0.0", params, {}).convert(infile, outfile)
+    return outfile.read_text()
+
+
+def test_html_header_injected_at_start_of_body(tmp_path: Path) -> None:
+    fragment = '<header class="corp-nav">corporate navigation</header>'
+    header = tmp_path / "header.html"
+    header.write_text(fragment)
+
+    out = render(tmp_path, header)
+    assert fragment in out
+    # verify markers appear in this order
+    assert out.index(" <body>") < out.index(fragment) < out.index('<main class="content">')
+
+
+def test_html_header_absent_when_not_given(tmp_path: Path) -> None:
+    out = render(tmp_path, None)
+    assert "corp-nav" not in out

From 4388cd791a882669b46fda4333b4fd0eb9f7ab9d Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Fri, 26 Jun 2026 15:12:42 +0200
Subject: [PATCH 31/33] doc/doc-support: inject custom header via
 nixos-render-docs --header

---
 doc/doc-support/header.html |  7 ++++
 doc/doc-support/package.nix |  2 +
 doc/style.css               | 79 +++++++++++++++++++++++++++++++++++--
 3 files changed, 84 insertions(+), 4 deletions(-)
 create mode 100644 doc/doc-support/header.html

diff --git a/doc/doc-support/header.html b/doc/doc-support/header.html
new file mode 100644
index 000000000000..1e1d504aa4a3
--- /dev/null
+++ b/doc/doc-support/header.html
@@ -0,0 +1,7 @@
+<div class="manual-header">
+    <nav class="manual-header--tabs">
+        <a class="manual-header--tab manual-header--tab-active" href="#">Nixpkgs</a>
+        <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">NixOS</a>
+    </nav>
+    <span class="manual-header--title">Nixpkgs Reference Manual</span>
+</div>
diff --git a/doc/doc-support/package.nix b/doc/doc-support/package.nix
index f2c37df39132..728bbe334501 100644
--- a/doc/doc-support/package.nix
+++ b/doc/doc-support/package.nix
@@ -119,6 +119,8 @@ stdenvNoCC.mkDerivation (
         --script ./anchor-use.js \
         --sidebar-depth 3 \
         --nav ./nav.json \
+        --header ${./header.html}\
+        --no-navheader \
         manual.md \
         out/index.html
 
diff --git a/doc/style.css b/doc/style.css
index 8b426e72de24..ba0327093d75 100644
--- a/doc/style.css
+++ b/doc/style.css
@@ -398,6 +398,7 @@ div.appendix .variablelist .term {
 
 :root {
   --sidebar-width: 20rem;
+  --header-height: 3rem;
   --background: #fff;
   --main-text-color: #000;
   --link-color: #405d99;
@@ -528,7 +529,7 @@ nav.toc-sidebar summary {
     min-height: 0;
     display: grid;
     grid-template-columns: minmax(0, 1fr);
-    grid-template-rows: auto minmax(0, 1fr);
+    grid-template-rows: var(--header-height) auto minmax(0, 1fr);
   }
 
   body:has(> nav.toc-sidebar) {
@@ -537,7 +538,7 @@ nav.toc-sidebar summary {
 
   .navheader {
     grid-column: 1 / -1;
-    grid-row: 1;
+    grid-row: 2;
   }
 
   nav.toc-sidebar {
@@ -548,7 +549,7 @@ nav.toc-sidebar summary {
     /*  */
     margin: 0;
     grid-column: 1;
-    grid-row: 2;
+    grid-row: 3;
     max-height: none;
     overflow-y: auto;
     border: none;
@@ -562,7 +563,7 @@ nav.toc-sidebar summary {
 
   main.content {
     grid-column: 1 / -1;
-    grid-row: 2;
+    grid-row: 3;
     overflow-y: auto;
     padding: 0 1rem;
   }
@@ -571,3 +572,73 @@ nav.toc-sidebar summary {
     grid-column: 2;
   }
 }
+
+.manual-header {
+  background-color: var(--background);
+  border-bottom: 0.0625rem solid #d8d8d8;
+  display: flex;
+  flex-direction: column;
+}
+
+.manual-header--title {
+  order: -1;
+  padding: 0.5rem 1rem 0;
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--small-heading-color);
+  text-align: center;
+}
+
+.manual-header--tabs {
+  display: flex;
+  align-items: stretch;
+  justify-content: space-around;
+  margin: 0;
+  padding: 0;
+}
+
+.manual-header--tab {
+  display: flex;
+  align-items: center;
+  padding: 0 1rem;
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--main-text-color);
+  text-decoration: none;
+  border-bottom: 0.1875rem solid transparent;
+  border-top: 0.1875rem solid transparent;
+  transition: border-bottom-color 0.15s ease;
+}
+
+.manual-header--tab:hover {
+  border-bottom-color: var(--heading-color);
+  color: var(--main-text-color);
+}
+
+.manual-header--tab-active {
+  border-bottom-color: var(--heading-color);
+  color: var(--heading-color);
+  font-weight: 700;
+}
+
+@media screen and (min-width: 768px) {
+  .manual-header {
+    height: var(--header-height);
+    flex-direction: row;
+    align-items: stretch;
+    grid-column: 1 / -1;
+    grid-row: 1;
+  }
+
+  .manual-header--title {
+    order: 0;
+    margin-left: auto;
+    padding: 0 1rem;
+    align-self: center;
+  }
+
+  .manual-header--tabs {
+    justify-content: flex-start;
+    padding: 0 1rem;
+  }
+}

From f26adbb436a470975638bc2fd7f2386bba52bed9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 12:54:35 +0000
Subject: [PATCH 32/33] libretro.play: 0-unstable-2026-06-22 ->
 0-unstable-2026-07-11

---
 pkgs/applications/emulators/libretro/cores/play.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/play.nix b/pkgs/applications/emulators/libretro/cores/play.nix
index f777c18941ff..26b3d48ea660 100644
--- a/pkgs/applications/emulators/libretro/cores/play.nix
+++ b/pkgs/applications/emulators/libretro/cores/play.nix
@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2026-06-22";
+  version = "0-unstable-2026-07-11";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "1e4f393f3c52581cdec7867ddadc47f6b4d20cec";
-    hash = "sha256-a02AsJg7mm/fUBN/5IC2Q6NexLYsBYp74bfqfJosaxc=";
+    rev = "50aedca2639521bc498ace0b2be1ea012801a86a";
+    hash = "sha256-ywqwy8HwxigRG/2GfvfpewNjTIeunXH9NtyAH5iUfa8=";
     fetchSubmodules = true;
   };
 

From 7c1a8c45bfdc733fce69f18f5970c84c7cf85528 Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Fri, 26 Jun 2026 15:15:04 +0200
Subject: [PATCH 33/33] nixos/doc: inject custom header via nixos-render-docs
 --header

---
 doc/doc-support/header.html  | 2 +-
 nixos/doc/manual/default.nix | 2 ++
 nixos/doc/manual/header.html | 7 +++++++
 3 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 nixos/doc/manual/header.html

diff --git a/doc/doc-support/header.html b/doc/doc-support/header.html
index 1e1d504aa4a3..1c42f4adcf11 100644
--- a/doc/doc-support/header.html
+++ b/doc/doc-support/header.html
@@ -3,5 +3,5 @@
         <a class="manual-header--tab manual-header--tab-active" href="#">Nixpkgs</a>
         <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">NixOS</a>
     </nav>
-    <span class="manual-header--title">Nixpkgs Reference Manual</span>
+    <span class="manual-header--title">Nixpkgs Manual</span>
 </div>
diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index cf5c28358097..78f44ad9ad74 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -202,6 +202,8 @@ rec {
           --script ./anchor.min.js \
           --script ./anchor-use.js \
           --sidebar-depth 2 \
+          --header ${./header.html}\
+          --no-navheader \
           ./manual.md \
           $dst/${common.indexPath}
 
diff --git a/nixos/doc/manual/header.html b/nixos/doc/manual/header.html
new file mode 100644
index 000000000000..acc029f5c3e4
--- /dev/null
+++ b/nixos/doc/manual/header.html
@@ -0,0 +1,7 @@
+<div class="manual-header">
+    <nav class="manual-header--tabs">
+        <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">Nixpkgs</a>
+        <a class="manual-header--tab manual-header--tab-active" href="#">NixOS</a>
+    </nav>
+    <span class="manual-header--title">Nixos Manual</span>
+</div>