From df6c982022cee640fa12bc4f8f0368890283dd73 Mon Sep 17 00:00:00 2001
From: Guy Chronister <guychronister@outlook.com>
Date: Wed, 3 Jun 2026 11:42:03 -0500
Subject: [PATCH 01/57] acl2.libipasir: switch to finalAttrs pattern, switch to
 SRI hash

Assisted-by: Cursor Composer 2.5
---
 pkgs/by-name/ac/acl2/libipasirglucose4/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/ac/acl2/libipasirglucose4/default.nix b/pkgs/by-name/ac/acl2/libipasirglucose4/default.nix
index e52e45ee1a03..1028453b0ab0 100644
--- a/pkgs/by-name/ac/acl2/libipasirglucose4/default.nix
+++ b/pkgs/by-name/ac/acl2/libipasirglucose4/default.nix
@@ -6,18 +6,18 @@
   unzip,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libipasirglucose4";
   # This library has no version number AFAICT (beyond generally being based on
   # Glucose 4.x), but it was submitted to the 2017 SAT competition so let's use
   # that as the version number, I guess.
   version = "2017";
 
-  libname = pname + stdenv.hostPlatform.extensions.sharedLibrary;
+  libname = finalAttrs.pname + stdenv.hostPlatform.extensions.sharedLibrary;
 
   src = fetchurl {
     url = "https://baldur.iti.kit.edu/sat-competition-2017/solvers/incremental/glucose-ipasir.zip";
-    sha256 = "0xchgady9vwdh8frmc8swz6va53igp2wj1y9sshd0g7549n87wdj";
+    hash = "sha256-svGDbCLlPNCg1skHycV9cRS1zecasZodgo3v5Jt6kHU=";
   };
   nativeBuildInputs = [ unzip ];
 
@@ -29,13 +29,13 @@ stdenv.mkDerivation rec {
   makeFlags = [ "CXX=${stdenv.cc.targetPrefix}c++" ];
 
   postBuild = ''
-    $CXX -shared -o ${libname} \
-        ${lib.optionalString (!stdenv.cc.isClang) "-Wl,-soname,${libname}"} \
+    $CXX -shared -o ${finalAttrs.libname} \
+        ${lib.optionalString (!stdenv.cc.isClang) "-Wl,-soname,${finalAttrs.libname}"} \
         ipasirglucoseglue.o libipasirglucose4.a
   '';
 
   installPhase = ''
-    install -D ${libname} $out/lib/${libname}
+    install -D ${finalAttrs.libname} $out/lib/${finalAttrs.libname}
   '';
 
   meta = {
@@ -44,4 +44,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ kini ];
   };
-}
+})

From f91de7a4130981b097550dc31bbdd9e2885b0e39 Mon Sep 17 00:00:00 2001
From: Guy Chronister <guychronister@outlook.com>
Date: Wed, 3 Jun 2026 12:10:39 -0500
Subject: [PATCH 02/57] acl2: switch to finalAttrs pattern, switch to hash

Assisted-by: Cursor Composer 2.5
---
 pkgs/by-name/ac/acl2/package.nix | 38 ++++++++++++++++----------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/pkgs/by-name/ac/acl2/package.nix b/pkgs/by-name/ac/acl2/package.nix
index df06ba483a57..f5d78743636e 100644
--- a/pkgs/by-name/ac/acl2/package.nix
+++ b/pkgs/by-name/ac/acl2/package.nix
@@ -32,15 +32,15 @@ let
   '';
 
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "acl2";
   version = "8.6";
 
   src = fetchFromGitHub {
     owner = "acl2-devel";
     repo = "acl2-devel";
-    rev = version;
-    sha256 = "sha256-fF9bbEacwCHP1m/eVgFrTD4Ne7L2mzq0K9vJ1tiy9go=";
+    tag = finalAttrs.version;
+    hash = "sha256-fF9bbEacwCHP1m/eVgFrTD4Ne7L2mzq0K9vJ1tiy9go=";
   };
 
   # You can swap this out with any other IPASIR implementation at
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     })
 
     (replaceVars ./0001-path-changes-for-nix.patch {
-      libipasir = "${libipasir}/lib/${libipasir.libname}";
+      libipasir = "${finalAttrs.libipasir}/lib/${finalAttrs.libipasir.libname}";
       libssl = "${lib.getLib openssl}/lib/libssl${stdenv.hostPlatform.extensions.sharedLibrary}";
       libcrypto = "${lib.getLib openssl}/lib/libcrypto${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
     glucose
     minisat
     abc-verifier
-    libipasir
+    finalAttrs.libipasir
     z3
     (python3.withPackages (ps: [ ps.z3-solver ]))
   ];
@@ -115,10 +115,10 @@ stdenv.mkDerivation rec {
     # ACL2 and its books need to be built in place in the out directory because
     # the proof artifacts are not relocatable. Since ACL2 mostly expects
     # everything to exist in the original source tree layout, we put it in
-    # $out/share/${pname} and create symlinks in $out/bin as necessary.
-    mkdir -p $out/share/${pname}
-    cp -pR . $out/share/${pname}
-    cd $out/share/${pname}
+    # $out/share/acl2 and create symlinks in $out/bin as necessary.
+    mkdir -p $out/share/acl2
+    cp -pR . $out/share/acl2
+    cd $out/share/acl2
   '';
 
   preBuild = "mkdir -p $HOME";
@@ -132,19 +132,19 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p $out/bin
-    ln -s $out/share/${pname}/saved_acl2           $out/bin/${pname}
+    ln -s $out/share/acl2/saved_acl2           $out/bin/acl2
   ''
   + lib.optionalString certifyBooks ''
-    ln -s $out/share/${pname}/books/build/cert.pl  $out/bin/${pname}-cert
-    ln -s $out/share/${pname}/books/build/clean.pl $out/bin/${pname}-clean
+    ln -s $out/share/acl2/books/build/cert.pl  $out/bin/acl2-cert
+    ln -s $out/share/acl2/books/build/clean.pl $out/bin/acl2-clean
   '';
 
   preDistPhases = [ (if certifyBooks then "certifyBooksPhase" else "removeBooksPhase") ];
 
   certifyBooksPhase = ''
     # Certify the community books
-    pushd $out/share/${pname}/books
-    makeFlags="ACL2=$out/share/${pname}/saved_acl2"
+    pushd $out/share/acl2/books
+    makeFlags="ACL2=$out/share/acl2/saved_acl2"
     buildFlags="all"
     buildPhase
 
@@ -157,7 +157,7 @@ stdenv.mkDerivation rec {
 
   removeBooksPhase = ''
     # Delete the community books
-    rm -rf $out/share/${pname}/books
+    rm -rf $out/share/acl2/books
   '';
 
   meta = {
@@ -172,9 +172,9 @@ stdenv.mkDerivation rec {
       ACL2 is part of the Boyer-Moore family of provers, for which its authors
       have received the 2005 ACM Software System Award.
 
-      This package installs the main ACL2 executable ${pname}, as well as the
-      build tools cert.pl and clean.pl, renamed to ${pname}-cert and
-      ${pname}-clean.
+      This package installs the main ACL2 executable acl2, as well as the
+      build tools cert.pl and clean.pl, renamed to acl2-cert and
+      acl2-clean.
 
     ''
     + (
@@ -212,4 +212,4 @@ stdenv.mkDerivation rec {
     ];
     platforms = lib.platforms.all;
   };
-}
+})

From 181953216adabac8be7282d68770a2e5a8498fb8 Mon Sep 17 00:00:00 2001
From: Guy Chronister <guychronister@outlook.com>
Date: Wed, 3 Jun 2026 15:52:53 -0500
Subject: [PATCH 03/57] altermime: switch to finalAttrs and SRI hash format

Assisted-by: Cursor Composer 2.5
---
 pkgs/by-name/al/altermime/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/al/altermime/package.nix b/pkgs/by-name/al/altermime/package.nix
index 02bf3fd7c373..7464067c9f17 100644
--- a/pkgs/by-name/al/altermime/package.nix
+++ b/pkgs/by-name/al/altermime/package.nix
@@ -4,13 +4,13 @@
   fetchurl,
 }:
 
-gccStdenv.mkDerivation rec {
+gccStdenv.mkDerivation (finalAttrs: {
   pname = "altermime";
   version = "0.3.11";
 
   src = fetchurl {
-    url = "https://pldaniels.com/altermime/altermime-${version}.tar.gz";
-    sha256 = "15zxg6spcmd35r6xbidq2fgcg2nzyv1sbbqds08lzll70mqx4pj7";
+    url = "https://pldaniels.com/altermime/altermime-${finalAttrs.version}.tar.gz";
+    hash = "sha256-R17ScQWH0k8R0A2vpcP234rHnhO4xdVNLqNVdrV5/Zc=";
   };
 
   env.NIX_CFLAGS_COMPILE = toString [
@@ -36,4 +36,4 @@ gccStdenv.mkDerivation rec {
     downloadPage = "https://pldaniels.com/altermime/";
     mainProgram = "altermime";
   };
-}
+})

From f9f9e010cd3a5a64f22f1c74dada2b78b65c6aa2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 4 Jun 2026 00:36:31 +0000
Subject: [PATCH 04/57] libtoxcore: 0.2.22 -> 0.2.23

---
 pkgs/by-name/li/libtoxcore/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libtoxcore/package.nix b/pkgs/by-name/li/libtoxcore/package.nix
index e6a2cddd354b..ddd7252c0dae 100644
--- a/pkgs/by-name/li/libtoxcore/package.nix
+++ b/pkgs/by-name/li/libtoxcore/package.nix
@@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtoxcore";
-  version = "0.2.22";
+  version = "0.2.23";
 
   src = fetchFromGitHub {
     owner = "TokTok";
     repo = "c-toxcore";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Oi0AYV252KPF6omiErCXZvQlxkWvubk0eiegc5OMQHM=";
+    hash = "sha256-yII4U+PCkQax7d2ZgTClK+mMypZhVPjEcKDdxHcBf6Y=";
     fetchSubmodules = true;
   };
 

From b0d72a85e98ecf114192e21125be4a301d4e1ea2 Mon Sep 17 00:00:00 2001
From: kaynetik <aleksandar@nesovic.dev>
Date: Sun, 31 May 2026 07:14:01 +0200
Subject: [PATCH 05/57] podman-desktop: switch pnpm pin back to `pnpm_10`

The hard pin to pnpm_10_29_2 worked around a lockfile regression in pnpm
10.29.3+ that broke electron-builder. electron-builder fixed it in
26.8.2,
which podman-desktop has shipped since 1.26.0, so pnpm_10 builds cleanly
on the current 1.27.2 tree.
Switch the pin back to pnpm_10 and re-enable the pnpm bump in the update
script.

Signed-off-by: kaynetik <aleksandar@nesovic.dev>
---
 pkgs/by-name/po/podman-desktop/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index 788abd836c83..1e930b4c8e1a 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -6,7 +6,7 @@
   copyDesktopItems,
   electron_41,
   nodejs-slim_24,
-  pnpm_10_29_2,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   makeDesktopItem,
@@ -22,7 +22,7 @@
 
 let
   nodejs-slim = nodejs-slim_24;
-  pnpm = pnpm_10_29_2.override { inherit nodejs-slim; };
+  pnpm = pnpm_10.override { inherit nodejs-slim; };
   electron = electron_41;
   appName = "Podman Desktop";
 in

From 7a77089c8fc2908a856d64727017f1b74cab8126 Mon Sep 17 00:00:00 2001
From: kaynetik <aleksandar@nesovic.dev>
Date: Sun, 31 May 2026 07:24:41 +0200
Subject: [PATCH 06/57] podman-desktop: derive .desktop entry from upstream
 .flatpak.desktop

Install the upstream .flatpak.desktop directly instead of hand-maintaining
a makeDesktopItem, rewriting only the launcher command and icon name and
dropping the X-Flatpak key. This keeps Categories and Keywords aligned with
upstream and prevents them from regressing. The --replace-fail patterns
fail the build if upstream renames those lines.

Signed-off-by: kaynetik <aleksandar@nesovic.dev>
---
 pkgs/by-name/po/podman-desktop/package.nix | 26 ++++++----------------
 1 file changed, 7 insertions(+), 19 deletions(-)

diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index 1e930b4c8e1a..40d117964a87 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -3,13 +3,11 @@
   stdenv,
   fetchFromGitHub,
   makeBinaryWrapper,
-  copyDesktopItems,
   electron_41,
   nodejs-slim_24,
   pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
-  makeDesktopItem,
   darwin,
   nix-update-script,
   _experimental-update-script-combinators,
@@ -96,9 +94,6 @@ stdenv.mkDerivation (finalAttrs: {
     pnpm
     pnpmConfigHook
   ]
-  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
-    copyDesktopItems
-  ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.autoSignDarwinBinariesHook
   ];
@@ -147,6 +142,13 @@ stdenv.mkDerivation (finalAttrs: {
 
         install -Dm644 buildResources/icon.svg "$out/share/icons/hicolor/scalable/apps/podman-desktop.svg"
 
+        # Derive the .desktop entry from upstream to keep it aligned and avoid regressions.
+        install -Dm644 .flatpak.desktop "$out/share/applications/podman-desktop.desktop"
+        substituteInPlace "$out/share/applications/podman-desktop.desktop" \
+          --replace-fail 'Exec=run.sh %U' 'Exec=podman-desktop %U' \
+          --replace-fail 'Icon=io.podman_desktop.PodmanDesktop' 'Icon=podman-desktop'
+        sed -i '/^X-Flatpak=/d' "$out/share/applications/podman-desktop.desktop"
+
         makeWrapper '${electron}/bin/electron' "$out/bin/podman-desktop" \
           --add-flags "$out/share/lib/podman-desktop/resources/app.asar" \
           --set XDG_SESSION_TYPE 'x11' \
@@ -159,20 +161,6 @@ stdenv.mkDerivation (finalAttrs: {
       ''
     );
 
-  # see: https://github.com/podman-desktop/podman-desktop/blob/main/.flatpak.desktop
-  desktopItems = [
-    (makeDesktopItem {
-      name = "podman-desktop";
-      exec = "podman-desktop %U";
-      icon = "podman-desktop";
-      desktopName = appName;
-      genericName = "Desktop client for podman";
-      comment = finalAttrs.meta.description;
-      categories = [ "Utility" ];
-      startupWMClass = appName;
-    })
-  ];
-
   meta = {
     description = "Graphical tool for developing on containers and Kubernetes";
     homepage = "https://podman-desktop.io";

From eaad2d4d3c0835d8e2838455bcf51645bbfabb11 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 7 Jun 2026 16:13:19 +0200
Subject: [PATCH 07/57] srcOnly: disable `outputChecks`

---
 pkgs/build-support/src-only/default.nix | 59 ++++++++++++++-----------
 1 file changed, 33 insertions(+), 26 deletions(-)

diff --git a/pkgs/build-support/src-only/default.nix b/pkgs/build-support/src-only/default.nix
index f44e41a62eef..bb91c6b4bba9 100644
--- a/pkgs/build-support/src-only/default.nix
+++ b/pkgs/build-support/src-only/default.nix
@@ -37,37 +37,44 @@
 
 attrs:
 let
-  argsToOverride = args: {
-    name = "${args.name or "${args.pname}-${args.version}"}-source";
+  argsToOverride =
+    args:
+    {
+      name = "${args.name or "${args.pname}-${args.version}"}-source";
 
-    outputs = [ "out" ];
+      outputs = [ "out" ];
 
-    phases = [
-      "unpackPhase"
-      "patchPhase"
-      "installPhase"
-    ];
-    separateDebugInfo = false;
+      phases = [
+        "unpackPhase"
+        "patchPhase"
+        "installPhase"
+      ];
+      separateDebugInfo = false;
 
-    dontUnpack = lib.warnIf (args.dontUnpack or false
-    ) "srcOnly: derivation has dontUnpack set, overriding" false;
+      dontUnpack = lib.warnIf (args.dontUnpack or false
+      ) "srcOnly: derivation has dontUnpack set, overriding" false;
 
-    dontInstall = false;
-    installPhase = "cp -pr --reflink=auto -- . $out";
+      dontInstall = false;
+      installPhase = "cp -pr --reflink=auto -- . $out";
 
-    # the original derivation might've set something like outputDev = "lib", but "lib" isn't an output anymore
-    # some things get confused and error if one of these is set to an output that doesn't exist
-    # ex: pkgs/build-support/setup-hooks/multiple-outputs.sh
-    outputDev = "out";
-    outputBin = "out";
-    outputInclude = "out";
-    outputLib = "out";
-    outputDoc = "out";
-    outputDevdoc = "out";
-    outputMan = "out";
-    outputDevman = "out";
-    outputInfo = "out";
-  };
+      # the original derivation might've set something like outputDev = "lib", but "lib" isn't an output anymore
+      # some things get confused and error if one of these is set to an output that doesn't exist
+      # ex: pkgs/build-support/setup-hooks/multiple-outputs.sh
+      outputDev = "out";
+      outputBin = "out";
+      outputInclude = "out";
+      outputLib = "out";
+      outputDoc = "out";
+      outputDevdoc = "out";
+      outputMan = "out";
+      outputDevman = "out";
+      outputInfo = "out";
+
+    }
+    // lib.optionalAttrs (lib.isAttrs args.outputChecks or null) {
+      # If the original derivation includes outputChecks for output we are removing, we need to reset it to an empty check.
+      outputChecks = { };
+    };
 in
 
 # If we are passed a derivation (based on stdenv*), we can use overrideAttrs to

From 3c9cf6210c625513e2b0f45cfe2e1b8bfd3bf1f2 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 7 Jun 2026 16:24:28 +0200
Subject: [PATCH 08/57] nodejs: remove `npm` and `corepack` passthru

The passthru has been added to give a migration path, but those outputs
were not present on the 25.11's `nodejs` derivation. Removing those
is helpful to use them to discriminate between the slim and non-slim
variants for derivations that accept one or the other.
---
 pkgs/development/web/nodejs/symlink.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/web/nodejs/symlink.nix b/pkgs/development/web/nodejs/symlink.nix
index 538ac2311946..defbb3f088e8 100644
--- a/pkgs/development/web/nodejs/symlink.nix
+++ b/pkgs/development/web/nodejs/symlink.nix
@@ -44,6 +44,10 @@
                 "man"
                 "out"
                 "static"
+
+                # Filter out outputs that didn't exist on 25.11
+                "npm"
+                "corepack"
               ])
               && !(builtins.hasAttr name nodejs)
             ) (builtins.attrNames nodejs-slim)

From 3f318e99f1b9f86173692ec18a24e13bdbab85df Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 7 Jun 2026 16:24:50 +0200
Subject: [PATCH 09/57] pnpm-fixup-state-db: make it depend on `nodejs-slim`

---
 .../build-support/node/fetch-pnpm-deps/default.nix | 14 +-------------
 pkgs/by-name/pn/pnpm-fixup-state-db/package.nix    |  7 ++++---
 2 files changed, 5 insertions(+), 16 deletions(-)

diff --git a/pkgs/build-support/node/fetch-pnpm-deps/default.nix b/pkgs/build-support/node/fetch-pnpm-deps/default.nix
index 68b8836887c6..4669d4909b7f 100644
--- a/pkgs/build-support/node/fetch-pnpm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-pnpm-deps/default.nix
@@ -52,19 +52,7 @@ in
       pnpm-fixup-state-db' =
         if pnpm.nodejs-slim or null != null then
           pnpm-fixup-state-db.override {
-            # FIXME: make npm-config-hook accept nodejs-slim
-            nodejs =
-              let
-                inherit (pnpm) nodejs-slim;
-              in
-              if nodejs-slim ? paths && builtins.isList nodejs-slim.paths then
-                # If nodejs-slim has a list `paths` attribute, it's likely a simlinkJoin
-                nodejs-slim
-              else
-                # Otherwise we need to recreate one by overriding the default one
-                pnpm-fixup-state-db.nodejs.override {
-                  inherit nodejs-slim;
-                };
+            inherit (pnpm) nodejs-slim;
           }
         else
           pnpm-fixup-state-db;
diff --git a/pkgs/by-name/pn/pnpm-fixup-state-db/package.nix b/pkgs/by-name/pn/pnpm-fixup-state-db/package.nix
index 66c5da928e16..2bfc32c31d73 100644
--- a/pkgs/by-name/pn/pnpm-fixup-state-db/package.nix
+++ b/pkgs/by-name/pn/pnpm-fixup-state-db/package.nix
@@ -1,7 +1,7 @@
 {
   buildNpmPackage,
   lib,
-  nodejs,
+  nodejs-slim,
   pnpm,
   tests,
 }:
@@ -11,12 +11,13 @@ buildNpmPackage {
 
   src = ./src;
 
-  inherit nodejs;
+  nodejs = nodejs-slim;
+  nativeBuildInputs = lib.optional (builtins.hasAttr "npm" nodejs-slim) nodejs-slim.npm;
 
   npmDepsHash = "sha256-um6a4pEtPtdxHBRq9g5ZW20wIQAMjWJ3qF96XuxJg8o=";
 
   postInstall = ''
-    makeWrapper ${lib.getExe nodejs} $out/bin/pnpm-fixup-state-db \
+    makeWrapper ${lib.getExe nodejs-slim} $out/bin/pnpm-fixup-state-db \
       --add-flags "$out/lib/node_modules/pnpm-fixup-state-db"
   '';
 

From 411c555a352e20e111cb5a2b4d277ac527339dd6 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Mon, 8 Jun 2026 02:19:41 -0400
Subject: [PATCH 10/57] rasm: modernize

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/ra/rasm/package.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ra/rasm/package.nix b/pkgs/by-name/ra/rasm/package.nix
index d4916b436fdc..dbbd77ca3183 100644
--- a/pkgs/by-name/ra/rasm/package.nix
+++ b/pkgs/by-name/ra/rasm/package.nix
@@ -2,12 +2,16 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  installShellFiles,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rasm";
   version = "3.2.4bis";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "EdouardBERGE";
     repo = "rasm";
@@ -15,11 +19,17 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-D9V9CqCCy0EYRIX0nr+kwxPH7W2KIIq67jabP7ZzETE=";
   };
 
+  nativeBuildInputs = [ installShellFiles ];
+
   # by default the EXEC variable contains `rasm.exe`
   makeFlags = [ "EXEC=rasm" ];
 
   installPhase = ''
-    install -Dt $out/bin rasm
+    runHook preInstall
+
+    installBin rasm
+
+    runHook postInstall
   '';
 
   meta = {

From c1aabb026d7e1dc6bd4209ab26fa2193a47a7057 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Mon, 8 Jun 2026 17:08:30 -0700
Subject: [PATCH 11/57] devin-cli: cleanup derivation

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/de/devin-cli/package.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/de/devin-cli/package.nix b/pkgs/by-name/de/devin-cli/package.nix
index d5e6f1a1381d..22151ed7036b 100644
--- a/pkgs/by-name/de/devin-cli/package.nix
+++ b/pkgs/by-name/de/devin-cli/package.nix
@@ -32,8 +32,6 @@ let
       hash = "sha256-HtB5iCT3d3AprPM+1uNkPkX0v4wSerTJlEu5F4P6pp0=";
     };
   };
-
-  src = srcs.${stdenvNoCC.hostPlatform.system} or throwSystem;
 in
 
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -49,18 +47,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   strictDeps = true;
   __structuredAttrs = true;
 
-  inherit src;
+  src = srcs.${stdenvNoCC.hostPlatform.system} or throwSystem;
 
   sourceRoot = ".";
 
   nativeBuildInputs = [ installShellFiles ];
 
   dontConfigure = true;
-  dontStrip = true;
   dontBuild = true;
 
-  doCheck = true;
-
   installPhase = ''
     runHook preInstall
 
@@ -83,7 +78,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Cognition's Devin Agent CLI";
     homepage = "https://devin.ai/";
     license = lib.licenses.unfree;
-    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
     maintainers = with lib.maintainers; [
       ethancedwards8
       nhshah15

From c96aaca10c261a9476fc89bcfbd131401880f116 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Jun 2026 01:05:44 +0000
Subject: [PATCH 12/57] betula: 1.7.0 -> 1.8.0

---
 pkgs/by-name/be/betula/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/be/betula/package.nix b/pkgs/by-name/be/betula/package.nix
index 0e1e681cee8a..7005ec33ce0c 100644
--- a/pkgs/by-name/be/betula/package.nix
+++ b/pkgs/by-name/be/betula/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "betula";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromSourcehut {
     owner = "~bouncepaw";
     repo = "betula";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8iDWWAL8JDZyKl3o0IJsWml410jh3cTPC2AoonvqiTI=";
+    hash = "sha256-cZ7xMtJ6I1lvWllwdNSFzeUsvGXWJnUtUR4iPn3oosc=";
   };
   vendorHash = "sha256-HGjaS2Sqsjk/pilt8wtx5Ect8Y8S5638PWEpXCqeZ6w=";
 

From bc9cc199e43200282c4cecdfa70df146a4a48652 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 14 Apr 2026 11:58:10 +0800
Subject: [PATCH 13/57] firewalld: 2.4.0 -> 2.4.2

---
 pkgs/by-name/fi/firewalld/package.nix | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index e2f637639772..853ea60a0220 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   autoconf,
   automake,
   docbook_xml_dtd_42,
@@ -46,13 +45,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "firewalld";
-  version = "2.4.0";
+  version = "2.4.2";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "firewalld";
     repo = "firewalld";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-P48qdgvcF3BQZ5h+HaylHb70ECa2bmEvYiAi9CeH0qs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RUDDUvpGfWEKI+VtC4SBMLKsAHkStV1qAYpHLQbN5HM=";
   };
 
   patches = [
@@ -61,20 +63,13 @@ stdenv.mkDerivation (finalAttrs: {
     ./specify-localedir.patch
 
     ./gettext-0.25.patch
-
-    # CVE-2026-4948: https://github.com/NixOS/nixpkgs/issues/505280
-    (fetchpatch2 {
-      url = "https://github.com/Prince213/firewalld/commit/e621b4b54be7cd8d77ce549ec17c6f814f9bd337.patch?full_index=1";
-      hash = "sha256-8auXNPVYnNk1UI0jM82IEQrMBhG189/I+DbaXt0VEhc=";
-    })
   ];
 
   postPatch = ''
     substituteInPlace config/xmlschema/check.sh \
       --replace-fail /usr/bin/ ""
 
-    for file in src/{firewall-offline-cmd.in,firewall/config/__init__.py.in} \
-      config/firewall-{applet,config}.desktop.in; do
+    for file in src/{firewall-offline-cmd.in,firewall/config/__init__.py.in}; do
         substituteInPlace $file \
           --replace-fail /usr "$out"
     done
@@ -162,8 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru.tests = {
-    firewalld = nixosTests.firewalld;
-    firewall-firewalld = nixosTests.firewall-firewalld;
+    inherit (nixosTests) firewalld firewall-firewalld;
   };
 
   meta = {

From 737356d7d9fe7b046a61189358ee41a936b35aae Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 14 Apr 2026 11:58:10 +0800
Subject: [PATCH 14/57] firewalld: don't depend on nm-connection-editor

---
 .../fi/firewalld/nm-connection-editor.patch   | 19 +++++++++++++++++++
 pkgs/by-name/fi/firewalld/package.nix         | 10 ++--------
 2 files changed, 21 insertions(+), 8 deletions(-)
 create mode 100644 pkgs/by-name/fi/firewalld/nm-connection-editor.patch

diff --git a/pkgs/by-name/fi/firewalld/nm-connection-editor.patch b/pkgs/by-name/fi/firewalld/nm-connection-editor.patch
new file mode 100644
index 000000000000..b12ef91354f7
--- /dev/null
+++ b/pkgs/by-name/fi/firewalld/nm-connection-editor.patch
@@ -0,0 +1,19 @@
+--- a/src/firewall-applet.in
++++ b/src/firewall-applet.in
+@@ -59,14 +59,8 @@
+ 
+ NM_CONNECTION_EDITOR = ""
+ for binary in [
+-    "/usr/bin/systemsettings",
+-    "/bin/systemsettings",
+-    "/usr/bin/nm-connection-editor",
+-    "/bin/nm-connection-editor",
+-    "/usr/bin/kde5-nm-connection-editor",
+-    "/bin/kde5-nm-connection-editor",
+-    "/usr/bin/kde-nm-connection-editor",
+-    "/bin/kde-nm-connection-editor",
++    "/run/current-system/sw/bin/systemsettings",
++    "/run/current-system/sw/bin/nm-connection-editor",
+ ]:
+     if os.path.exists(binary):
+         NM_CONNECTION_EDITOR = binary
diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 853ea60a0220..0d7e5ea21f23 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -12,14 +12,12 @@
   intltool,
   ipset,
   iptables,
-  kdePackages,
   kmod,
   libnotify,
   librsvg,
   libxml2,
   libxslt,
   networkmanager,
-  networkmanagerapplet,
   pkg-config,
   python3,
   qt6,
@@ -63,7 +61,8 @@ stdenv.mkDerivation (finalAttrs: {
     ./specify-localedir.patch
 
     ./gettext-0.25.patch
-  ];
+  ]
+  ++ lib.optional withGui ./nm-connection-editor.patch;
 
   postPatch = ''
     substituteInPlace config/xmlschema/check.sh \
@@ -73,11 +72,6 @@ stdenv.mkDerivation (finalAttrs: {
         substituteInPlace $file \
           --replace-fail /usr "$out"
     done
-  ''
-  + lib.optionalString withGui ''
-    substituteInPlace src/firewall-applet.in \
-      --replace-fail "/usr/bin/systemsettings" "${kdePackages.systemsettings}/bin/systemsettings" \
-      --replace-fail "/usr/bin/nm-connection-editor" "${networkmanagerapplet}/bin/nm-connection-editor"
   '';
 
   nativeBuildInputs = [

From 9d4f8a67eaedaa62aac62359cf5c51eabf008296 Mon Sep 17 00:00:00 2001
From: Chahatpreet Singh <c@chahat.dev>
Date: Sun, 7 Jun 2026 20:34:27 +0000
Subject: [PATCH 15/57] asymptote: 3.11 -> 3.12

* Added `vulkan-headers` and `glfw` to `buildInputs` to support
  the new Vulkan renderer introduced in this release.
---
 pkgs/by-name/as/asymptote/package.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/as/asymptote/package.nix b/pkgs/by-name/as/asymptote/package.nix
index 9ad6f838736d..ea0e5738863d 100644
--- a/pkgs/by-name/as/asymptote/package.nix
+++ b/pkgs/by-name/as/asymptote/package.nix
@@ -30,10 +30,12 @@
   curl,
   texinfo,
   texliveSmall,
+  vulkan-headers,
+  glfw,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "3.11";
+  version = "3.12";
   pname = "asymptote";
 
   outputs = [
@@ -46,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://sourceforge/asymptote/${finalAttrs.version}/asymptote-${finalAttrs.version}.src.tgz";
-    hash = "sha256-U36fImIb+E8J7g1E3EVcTqkboZODDx12JKB9RxDX59E=";
+    hash = "sha256-6uwel0Y+8hOjk8OI1GanNHiwgY+UA8liuRJAZZybjxs=";
   };
 
   # override with TeX Live containers to avoid building sty, docs from source
@@ -111,6 +113,8 @@ stdenv.mkDerivation (finalAttrs: {
         pyqt5
       ]
     ))
+    vulkan-headers
+    glfw
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ libtirpc ];
 

From babc435df7dc5f6f4004860d7cf87953be99b814 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Jun 2026 16:27:21 +0000
Subject: [PATCH 16/57] reaper: 7.73 -> 7.74

---
 pkgs/by-name/re/reaper/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/re/reaper/package.nix b/pkgs/by-name/re/reaper/package.nix
index 8a2fa53312c4..0bd430aeca77 100644
--- a/pkgs/by-name/re/reaper/package.nix
+++ b/pkgs/by-name/re/reaper/package.nix
@@ -40,17 +40,17 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "reaper";
-  version = "7.73";
+  version = "7.74";
 
   src = fetchurl {
     url = url_for_platform finalAttrs.version stdenv.hostPlatform.qemuArch;
     hash =
       if stdenv.hostPlatform.isDarwin then
-        "sha256-iEslm5gmkkCwCfwilgXgRrwpj6D6lNypDZnNIv1ZPKw="
+        "sha256-QxmAag1tPB3bjz68lFsxSlMim06IfjWUTa++rE4fudE="
       else
         {
-          x86_64-linux = "sha256-tXyflaxx00SCqjo7xZFOigMwAc0i/i3Jakwr6BuasbQ=";
-          aarch64-linux = "sha256-+fbpuu0iAqEnchKwkct/FmooE0cpBUkSUyI3HCT+Nwg=";
+          x86_64-linux = "sha256-4Mf2q/eJz8djJv5JlrGGAWjivjEriRrkbrfKXd/iS6w=";
+          aarch64-linux = "sha256-zQ4XmFrACfUD04UWs0fYWW+m4L4B1xxe4Rg18xCUemc=";
         }
         .${stdenv.hostPlatform.system};
   };

From 2a1a3ccc39075099513693912bacbdf3920ea0f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20M=C3=BChlbacher?= <tmuehlbacher@posteo.net>
Date: Thu, 11 Jun 2026 01:39:30 +0200
Subject: [PATCH 17/57] fwupd: move patch descriptions

---
 .../fw/fwupd/0001-Install-fwupdplugin-to-out.patch  |  2 ++
 .../fwupd/0002-Add-output-for-installed-tests.patch |  2 ++
 ...003-Add-option-for-installation-sysconfdir.patch |  4 ++++
 .../fwupd/0004-Get-the-efi-app-from-fwupd-efi.patch |  1 +
 pkgs/by-name/fw/fwupd/package.nix                   | 13 -------------
 5 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/fw/fwupd/0001-Install-fwupdplugin-to-out.patch b/pkgs/by-name/fw/fwupd/0001-Install-fwupdplugin-to-out.patch
index f68d082afd54..184a6f9a825a 100644
--- a/pkgs/by-name/fw/fwupd/0001-Install-fwupdplugin-to-out.patch
+++ b/pkgs/by-name/fw/fwupd/0001-Install-fwupdplugin-to-out.patch
@@ -3,6 +3,8 @@ From: r-vdp <ramses@well-founded.dev>
 Date: Mon, 28 Oct 2024 12:07:51 +0100
 Subject: [PATCH] Install fwupdplugin to out
 
+Install plug-ins and libfwupdplugin to $out output, they are not really
+part of the library.
 ---
  meson.build | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pkgs/by-name/fw/fwupd/0002-Add-output-for-installed-tests.patch b/pkgs/by-name/fw/fwupd/0002-Add-output-for-installed-tests.patch
index 1c1ce14a4b9b..c56be1a1d28e 100644
--- a/pkgs/by-name/fw/fwupd/0002-Add-output-for-installed-tests.patch
+++ b/pkgs/by-name/fw/fwupd/0002-Add-output-for-installed-tests.patch
@@ -3,6 +3,8 @@ From: r-vdp <ramses@well-founded.dev>
 Date: Tue, 15 Oct 2024 14:49:53 +0200
 Subject: [PATCH] Add output for installed tests
 
+Installed tests are installed to different output we also cannot have
+fwupd-tests.conf in $out/etc since it would form a cycle.
 ---
  data/tests/meson.build             | 2 +-
  meson.build                        | 5 +++--
diff --git a/pkgs/by-name/fw/fwupd/0003-Add-option-for-installation-sysconfdir.patch b/pkgs/by-name/fw/fwupd/0003-Add-option-for-installation-sysconfdir.patch
index 999acdd4e874..e0f0a52f61fa 100644
--- a/pkgs/by-name/fw/fwupd/0003-Add-option-for-installation-sysconfdir.patch
+++ b/pkgs/by-name/fw/fwupd/0003-Add-option-for-installation-sysconfdir.patch
@@ -3,6 +3,10 @@ From: r-vdp <ramses@well-founded.dev>
 Date: Tue, 15 Oct 2024 11:46:38 +0200
 Subject: [PATCH] Add option for installation sysconfdir
 
+Since /etc is the domain of NixOS, not Nix, we cannot install files
+there. Let's install the files to $prefix/etc while still reading them
+from /etc. NixOS module for fwupd will take care of copying the files
+appropriately.
 ---
  data/bios-settings.d/meson.build |  2 +-
  data/meson.build                 |  2 +-
diff --git a/pkgs/by-name/fw/fwupd/0004-Get-the-efi-app-from-fwupd-efi.patch b/pkgs/by-name/fw/fwupd/0004-Get-the-efi-app-from-fwupd-efi.patch
index 8f044f425216..b2876ca37a6d 100644
--- a/pkgs/by-name/fw/fwupd/0004-Get-the-efi-app-from-fwupd-efi.patch
+++ b/pkgs/by-name/fw/fwupd/0004-Get-the-efi-app-from-fwupd-efi.patch
@@ -3,6 +3,7 @@ From: r-vdp <ramses@well-founded.dev>
 Date: Mon, 28 Oct 2024 12:08:49 +0100
 Subject: [PATCH] Get the efi app from fwupd-efi
 
+EFI capsule is located in fwupd-efi now.
 ---
  meson.build | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index 8e9d9f3f1ae2..d8af64f12d32 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -144,22 +144,9 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
-    # Install plug-ins and libfwupdplugin to $out output,
-    # they are not really part of the library.
     ./0001-Install-fwupdplugin-to-out.patch
-
-    # Installed tests are installed to different output
-    # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
     ./0002-Add-output-for-installed-tests.patch
-
-    # Since /etc is the domain of NixOS, not Nix,
-    # we cannot install files there.
-    # Let’s install the files to $prefix/etc
-    # while still reading them from /etc.
-    # NixOS module for fwupd will take take care of copying the files appropriately.
     ./0003-Add-option-for-installation-sysconfdir.patch
-
-    # EFI capsule is located in fwupd-efi now.
     ./0004-Get-the-efi-app-from-fwupd-efi.patch
   ];
 

From 7bce8db1d7502e36019dd28b71a2dc9554dcef81 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20M=C3=BChlbacher?= <tmuehlbacher@posteo.net>
Date: Thu, 11 Jun 2026 01:40:57 +0200
Subject: [PATCH 18/57] fwupd: 2.1.4 -> 2.1.5

Diff: https://github.com/fwupd/fwupd/compare/2.1.4...2.1.5

Changelog: https://github.com/fwupd/fwupd/releases/tag/2.1.5
---
 pkgs/by-name/fw/fwupd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index d8af64f12d32..0025fb8d550a 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -122,7 +122,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "2.1.4";
+  version = "2.1.5";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -140,7 +140,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     tag = finalAttrs.version;
-    hash = "sha256-bKBEZR7Wzi9nZYH+KAzh1q+sh2t2Gl3puQmeogNdIsE=";
+    hash = "sha256-DzQ+N99ZmFRqZc2rN6PSqmoIMXUyrE8Kkn+KnT/AWPc=";
   };
 
   patches = [

From e643d1953a0dacd031a458d7c14ef6a82f832bcc Mon Sep 17 00:00:00 2001
From: Santhosh Raju <santhosh.raju@gmail.com>
Date: Thu, 11 Jun 2026 20:18:13 +0200
Subject: [PATCH 19/57] ssh-to-age: 1.2.0 -> 1.3.0

---
 pkgs/by-name/ss/ssh-to-age/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ss/ssh-to-age/package.nix b/pkgs/by-name/ss/ssh-to-age/package.nix
index 7e153ea05c6e..a863f128010d 100644
--- a/pkgs/by-name/ss/ssh-to-age/package.nix
+++ b/pkgs/by-name/ss/ssh-to-age/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ssh-to-age";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "ssh-to-age";
-    rev = finalAttrs.version;
-    sha256 = "sha256-0i3h46lVyCbA4zJdjHM9GyRxZR6IsavpdDG3pdFEGjk=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-j+X+kZCOmMdNw8LBDoixl8ToRmDjbmRVe7+IGS/2sMg=";
   };
 
-  vendorHash = "sha256-4R+44AM0zS6WyKWfg0TH5OxmrC1c4xN0MSBgaZrWPX4=";
+  vendorHash = "sha256-FveYuYa6C3R50+jdAlU1jorRw/mg482eZ4ZJ8Pu+R0s=";
 
   checkPhase = ''
     runHook preCheck

From 8e4ed01ccd88afdfd10be6b73513b64328dfc7e7 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 11 Jun 2026 19:25:42 +0000
Subject: [PATCH 20/57] python3Packages.flash-attn-4: 4.0.0.beta15 ->
 4.0.0.beta17

Changelog: https://github.com/Dao-AILab/flash-attention/releases/tag/fa4-v4.0.0.beta17
---
 .../python-modules/flash-attn-4/default.nix        | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/flash-attn-4/default.nix b/pkgs/development/python-modules/flash-attn-4/default.nix
index 072f4a43ad16..dfd641995fd2 100644
--- a/pkgs/development/python-modules/flash-attn-4/default.nix
+++ b/pkgs/development/python-modules/flash-attn-4/default.nix
@@ -15,10 +15,13 @@
   quack-kernels,
   torch,
   torch-c-dlpack-ext,
+
+  # passthru
+  nix-update-script,
 }:
 buildPythonPackage (finalAttrs: {
   pname = "flash-attn-4";
-  version = "4.0.0.beta15";
+  version = "4.0.0.beta17";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -26,7 +29,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Dao-AILab";
     repo = "flash-attention";
     tag = "fa4-v${finalAttrs.version}";
-    hash = "sha256-k6158mEJocKIRS4MQIM+Ih4VMHnXCKJGcykZFi91J2w=";
+    hash = "sha256-DL3qe3sPU/GY/iyPibVXli/lw4U/Ul04XIv0NEQk9ns=";
   };
 
   # FA4 is a separate distribution shipped under flash_attn/cute/ with its own pyproject.toml.
@@ -55,6 +58,13 @@ buildPythonPackage (finalAttrs: {
   # No tests
   doCheck = false;
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex=fa4-v(.*)"
+      "--version=unstable"
+    ];
+  };
+
   meta = {
     description = "CuTeDSL-based implementation of FlashAttention for Hopper and Blackwell GPUs";
     homepage = "https://github.com/Dao-AILab/flash-attention/tree/main/flash_attn/cute";

From 60b78a40dc9b5a22b46acd4777a66c2b30ee3b77 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Jun 2026 19:39:45 +0000
Subject: [PATCH 21/57] python3Packages.hydra-core: 1.3.2 -> 1.3.3

---
 pkgs/development/python-modules/hydra-core/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hydra-core/default.nix b/pkgs/development/python-modules/hydra-core/default.nix
index cc4808cdb629..6f48efcff234 100644
--- a/pkgs/development/python-modules/hydra-core/default.nix
+++ b/pkgs/development/python-modules/hydra-core/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hydra-core";
-  version = "1.3.2";
+  version = "1.3.3";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
     owner = "facebookresearch";
     repo = "hydra";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kD4BStnstr5hwyAOxdpPzLAJ9MZqU/CPiHkaD2HnUPI=";
+    hash = "sha256-5+uD3AzkV9MVRUWhYoIPo7D0GozQasEjeCNl8tBAB8c=";
   };
 
   patches = [

From 800cff079a82aca47bf39a99a6a194c8f36fa4e2 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Thu, 11 Jun 2026 14:09:46 -0700
Subject: [PATCH 22/57] arpa2cm: 1.0.4 -> 1.0.7, modernize, add ngi team

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/ar/arpa2cm/package.nix | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ar/arpa2cm/package.nix b/pkgs/by-name/ar/arpa2cm/package.nix
index 84eb1eeff552..2e4dff0bcb96 100644
--- a/pkgs/by-name/ar/arpa2cm/package.nix
+++ b/pkgs/by-name/ar/arpa2cm/package.nix
@@ -3,21 +3,27 @@
   stdenv,
   fetchFromGitLab,
   cmake,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "arpa2cm";
-  version = "1.0.4";
+  version = "1.0.7";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitLab {
     owner = "arpa2";
     repo = "arpa2cm";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-2vb/7UL+uWGrQNh8yOZ3gih5G1/eOp064hF78SDsPGk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JkMZUXqmrVzURVi8BJRsHprD4Jz6l83qhPxnOfq4KE4=";
   };
 
   nativeBuildInputs = [ cmake ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "CMake Module library for the ARPA2 project";
     longDescription = ''
@@ -33,8 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://gitlab.com/arpa2/arpa2cm";
     license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [
-      fufexan
-    ];
+    maintainers = with lib.maintainers; [ fufexan ];
+    teams = [ lib.teams.ngi ];
   };
 })

From 58accf20d685ee5db5a8a39d148ced7c9700603e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Jun 2026 21:11:27 +0000
Subject: [PATCH 23/57] evtx: 0.11.2 -> 0.12.1

---
 pkgs/by-name/ev/evtx/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ev/evtx/package.nix b/pkgs/by-name/ev/evtx/package.nix
index d5c40c00a27e..1e72731fa69c 100644
--- a/pkgs/by-name/ev/evtx/package.nix
+++ b/pkgs/by-name/ev/evtx/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "evtx";
-  version = "0.11.2";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "omerbenamram";
     repo = "evtx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LVGw/u5xq+m96zSMPbQDpMnfMHq7FyQnzkmGMUMVgwM=";
+    hash = "sha256-zmXRUA2+x697AptONn5VUVySp4zz+VHwt8dqd6pJBGI=";
   };
 
-  cargoHash = "sha256-RnuWlfmzOZzOMfeKo8tv9I4elLQgpn9IbVa0EpYGnI0=";
+  cargoHash = "sha256-5Jw+zem0XLLvn3tELXk8vTnH2zvUr82qFx9QUYUwXyY=";
 
   postPatch = ''
     # CLI tests will fail in the sandbox

From 22182e936fb585febe84817bfb1736a3aac3376d Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 28 May 2026 07:31:13 +0000
Subject: [PATCH 24/57] python3Packages.pytorch-lightning: 2.6.4 -> 2.6.5

Diff: https://github.com/Lightning-AI/pytorch-lightning/compare/2.6.4...2.6.5

Changelog: https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.5
---
 pkgs/development/python-modules/pytorch-lightning/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytorch-lightning/default.nix b/pkgs/development/python-modules/pytorch-lightning/default.nix
index 25f044198c16..e372204602d3 100644
--- a/pkgs/development/python-modules/pytorch-lightning/default.nix
+++ b/pkgs/development/python-modules/pytorch-lightning/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pytorch-lightning";
-  version = "2.6.4";
+  version = "2.6.5";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Lightning-AI";
     repo = "pytorch-lightning";
     tag = finalAttrs.version;
-    hash = "sha256-Qysnr76OCO9eZzhQW5EoGT2hUAYGw/qY+j6dF8XCXC4=";
+    hash = "sha256-j29UvQbm+R/uDqwj3kZrXw5YSbUPlJWZUT8RUPc4QyY=";
   };
 
   env.PACKAGE_NAME = "pytorch";

From f58d4f99805bf20a4352b3769cf0c37f265b71fc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Jun 2026 21:26:31 +0000
Subject: [PATCH 25/57] cargo-rdme: 1.5.0 -> 1.5.1

---
 pkgs/by-name/ca/cargo-rdme/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-rdme/package.nix b/pkgs/by-name/ca/cargo-rdme/package.nix
index 2931e682c3cc..6faadf48ad67 100644
--- a/pkgs/by-name/ca/cargo-rdme/package.nix
+++ b/pkgs/by-name/ca/cargo-rdme/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-rdme";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-TmV6Fc5vlc4fm9w4+iuxmnonwsEbqoJ3jvpIyQOuxjg=";
+    hash = "sha256-d3WughXxh9cBzy33s3iB75paldZFokGGI1L9yTLGYoc=";
   };
 
-  cargoHash = "sha256-EjIvKf1XgHubvyWPOAjysNH4nD0xqOWYg1FeiPSYh4c=";
+  cargoHash = "sha256-26Poh5lUCYi+a+/E7pOYwilKX+eqRmbRNYRFdVfRSCw=";
 
   meta = {
     description = "Cargo command to create the README.md from your crate's documentation";

From 2ca035d5d3c5317aa7b2ebf0164797585f3c4815 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Jun 2026 23:04:11 +0000
Subject: [PATCH 26/57] dotenvx: 1.71.0 -> 1.71.2

---
 pkgs/by-name/do/dotenvx/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/do/dotenvx/package.nix b/pkgs/by-name/do/dotenvx/package.nix
index 78729f99a991..2ca9efcf88e7 100644
--- a/pkgs/by-name/do/dotenvx/package.nix
+++ b/pkgs/by-name/do/dotenvx/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "dotenvx";
-  version = "1.71.0";
+  version = "1.71.2";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nnzjPyxqAu7r4rKkTEaQsHdORnVo6dqwG38ALjjmZMs=";
+    hash = "sha256-51mmOF03j+JpyE4fyoqmZdgHtAOPhdEQiUTTATPFujM=";
   };
 
-  npmDepsHash = "sha256-XMNpCgFVphdfdAWjclqjpGyhggbNm6A/RdIAy/Ga9po=";
+  npmDepsHash = "sha256-3+Dn4XE5BH3QfeHVILLP/3ZESmhbYuzfT6IAIOLCJkQ=";
 
   dontNpmBuild = true;
 

From bda71c4b7130dee4b3b6e1bf2f99b80099762113 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Jun 2026 03:53:51 +0000
Subject: [PATCH 27/57] glitchtip: 6.1.6 -> 6.1.8

---
 pkgs/by-name/gl/glitchtip/frontend.nix | 6 +++---
 pkgs/by-name/gl/glitchtip/package.nix  | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/gl/glitchtip/frontend.nix b/pkgs/by-name/gl/glitchtip/frontend.nix
index 6e87db12f35d..e57cd1aef060 100644
--- a/pkgs/by-name/gl/glitchtip/frontend.nix
+++ b/pkgs/by-name/gl/glitchtip/frontend.nix
@@ -10,13 +10,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "glitchtip-frontend";
-  version = "6.1.6";
+  version = "6.1.8";
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-frontend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CDszzMDvjC8GOg/Nuh1G2Vwq75tOrwBithYOTNubQhM=";
+    hash = "sha256-y8NPj1xjGnGS9yBFaRjFRxLdTGrAq08T9N7cZN5IeSc=";
   };
 
   nodejs = nodejs_22;
@@ -25,7 +25,7 @@ buildNpmPackage (finalAttrs: {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src;
     npmDepsFetcherVersion = 3;
-    hash = "sha256-pakglYUPHTB872cVG1IZ3WyYXR5+fFYQr5zvTh2IrMo=";
+    hash = "sha256-AIzPJpNvGV/U71UFAUwOqx8kb31s7LXhMha4bXV+oCU=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/gl/glitchtip/package.nix b/pkgs/by-name/gl/glitchtip/package.nix
index 9b3c6949bbb7..194c96134d45 100644
--- a/pkgs/by-name/gl/glitchtip/package.nix
+++ b/pkgs/by-name/gl/glitchtip/package.nix
@@ -76,14 +76,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glitchtip";
-  version = "6.1.6";
+  version = "6.1.8";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-backend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BUWLN3+ob934MgIoDLirY0O8fn6G3zmGA5wuVGPPp7w=";
+    hash = "sha256-4RAZYGoS1tUbcPVv8L0sFWqFfBX05yXKZHFZDbEn0C0=";
   };
 
   postPatch = ''

From 1974d203a127e9107fe3b5cd4de898d7c4899fb4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Jun 2026 06:17:00 +0000
Subject: [PATCH 28/57] errbot: 6.2.0 -> 6.2.1

---
 pkgs/by-name/er/errbot/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/er/errbot/package.nix b/pkgs/by-name/er/errbot/package.nix
index c759d1bab7cf..04ccfaa29ae7 100644
--- a/pkgs/by-name/er/errbot/package.nix
+++ b/pkgs/by-name/er/errbot/package.nix
@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "errbot";
-  version = "6.2.0";
+  version = "6.2.1";
 
   pyproject = true;
 
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     owner = "errbotio";
     repo = "errbot";
     rev = finalAttrs.version;
-    hash = "sha256-UdqzBrlcb9NkuVo8ChADJmaKevadoGLyZUrckStb5ko=";
+    hash = "sha256-ufJUcQUn+BbfnYRXqLlThis70sY5VLdsZlag6390wqs=";
   };
 
   build-system = with python3.pkgs; [

From cf707d8167f537b335c0a49088313af98bfe88bb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Jun 2026 07:03:53 +0000
Subject: [PATCH 29/57] bombsquad: 1.7.62 -> 1.7.63

---
 pkgs/by-name/bo/bombsquad/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bo/bombsquad/package.nix b/pkgs/by-name/bo/bombsquad/package.nix
index 6ac0065809ab..0de333726602 100644
--- a/pkgs/by-name/bo/bombsquad/package.nix
+++ b/pkgs/by-name/bo/bombsquad/package.nix
@@ -25,7 +25,7 @@ let
     {
       x86_64-linux = {
         name = "BombSquad_Linux_x86_64";
-        hash = "sha256-Su7xEVzgFBl+Q2iFWdIRbyO8lRs8Xd4KabFhycZUVjs=";
+        hash = "sha256-zKZpRsyBCTYDJbTwjaP/HFXfYvD9zBhetUGzriB9754=";
       };
       aarch64-linux = {
         name = "BombSquad_Linux_Arm64";
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Note: This version trails behind the latest version by one since the latest
   # version sometimes gets replaced for minor updates. The builds in /old/ are
   # stable.
-  version = "1.7.62";
+  version = "1.7.63";
 
   src = fetchurl {
     url = "https://files.ballistica.net/bombsquad/builds/old/${archive.name}_${finalAttrs.version}.tar.gz";

From 0ebe398b2f290475bc061c5d021677b6d36c7fe0 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 12 Jun 2026 09:10:08 +0200
Subject: [PATCH 30/57] python3Packages.iamdata: 0.1.202606111 -> 0.1.202606121

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202606111...v0.1.202606121

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202606121
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 8dc1dbf6e973..4b49c19db0cc 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606111";
+  version = "0.1.202606121";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1TQlMrNuBiUHB4APdFq2cQE/MAxaZ+P6VF+/q8pzeXQ=";
+    hash = "sha256-d7joiPl5EQaGH0co6SC1ifnjRV7FowFswGFF6mSmIcM=";
   };
 
   __darwinAllowLocalNetworking = true;

From 15f6d788f2e4fcc8829e95265fc32c749edd9b9a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 12 Jun 2026 09:11:47 +0200
Subject: [PATCH 31/57] python3Packages.tencentcloud-sdk-python: 3.1.112 ->
 3.1.114

Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/3.1.112...3.1.114

Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.1.114/CHANGELOG.md
---
 .../python-modules/tencentcloud-sdk-python/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index bae34c8e39c1..ad0745100d55 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.112";
+  version = "3.1.114";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-uB9WcR2XT9BsCB8D7IWCBcTf4Re6dGGxtuiSJ1Wik/k=";
+    hash = "sha256-j9VOVuCa8XLJ3Ali1fWV7K47fm1xbnTSwtXDHYqevUA=";
   };
 
   build-system = [ setuptools ];

From dd7737fc0d9c3bba046ff90a2f34e53ad9b9eba8 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 12 Jun 2026 09:12:15 +0200
Subject: [PATCH 32/57] python3Packages.publicsuffixlist: 1.0.2.20260529 ->
 1.0.2.20260611

Changelog: https://github.com/ko-zu/psl/blob/v1.0.2.20260611-gha/CHANGES.md
---
 pkgs/development/python-modules/publicsuffixlist/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index cb13dfbca985..be54c6dde815 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "publicsuffixlist";
-  version = "1.0.2.20260529";
+  version = "1.0.2.20260611";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-q50y20Gy9GaW2bTZ5ArPK8Kpl/m2NG3CkO6Xxlxc3+o=";
+    hash = "sha256-zwFR1F4yqo0O7rLHbhQcaPlxVnttEaylk/duiX7SxcY=";
   };
 
   postPatch = ''

From ad32be182197a73a60291cf71754bf0308fcf713 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 12 Jun 2026 09:13:02 +0200
Subject: [PATCH 33/57] python3Packages.mypy-boto3-eks: 1.43.1 -> 1.43.28

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 450edd331669..a2a5ea72b839 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -467,8 +467,8 @@ in
       "sha256-11KpPRxGId76g/I4jXwMQ55kwGEQVsasgvMUXsiLbM4=";
 
   mypy-boto3-eks =
-    buildMypyBoto3Package "eks" "1.43.1"
-      "sha256-ZC5DCPPLUWIEV9mVAtG/DBhrdIawwrtMBCY/DGB6MvM=";
+    buildMypyBoto3Package "eks" "1.43.28"
+      "sha256-+mB3Dz5wx0uP8LPGZdJOGkjebCAYNPfEHhHybT1Pk98=";
 
   mypy-boto3-elastic-inference =
     buildMypyBoto3Package "elastic-inference" "1.36.0"

From b811440566e23f0b5ad1f9f901e8fdf641eadc48 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 12 Jun 2026 09:13:12 +0200
Subject: [PATCH 34/57] python3Packages.mypy-boto3-healthlake: 1.43.0 ->
 1.43.28

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index a2a5ea72b839..028248e38239 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -598,8 +598,8 @@ in
       "sha256-UHDodWN6MLV54LA31Pc7vlMr7a0tVrmCfVjXl96cjsE=";
 
   mypy-boto3-healthlake =
-    buildMypyBoto3Package "healthlake" "1.43.0"
-      "sha256-YeeEfYiM8ZJxcmxk6an+uCan9sMzYN4SWiApLaGCyzo=";
+    buildMypyBoto3Package "healthlake" "1.43.28"
+      "sha256-qRmvgKIela1k38muCLMKrGbFWiOjapQPS0oXQ2mPU+s=";
 
   mypy-boto3-iam =
     buildMypyBoto3Package "iam" "1.43.2"

From 62b4321614a5c2161babfe22c5b9055027e9c4ad Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 12 Jun 2026 09:13:36 +0200
Subject: [PATCH 35/57] python3Packages.mypy-boto3-neptune: 1.43.0 -> 1.43.28

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 028248e38239..f5ef93151ae6 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -938,8 +938,8 @@ in
       "sha256-K6PcvRVHUGRXbsro9CbPJ9GQQ8mrjsrgU6nr/MXV4vg=";
 
   mypy-boto3-neptune =
-    buildMypyBoto3Package "neptune" "1.43.0"
-      "sha256-++taPLvX9mWzlCBHtr3pLVPWUT/WcFdtCD73pxoDqjY=";
+    buildMypyBoto3Package "neptune" "1.43.28"
+      "sha256-igWmbkUqAiS+kCoH5DV72SaVD1eaX+70V1HcYnTGXfw=";
 
   mypy-boto3-neptunedata =
     buildMypyBoto3Package "neptunedata" "1.43.0"

From 8002d9b323315088dd6e22e8f475f6aeeff82cce Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 12 Jun 2026 09:13:38 +0200
Subject: [PATCH 36/57] python3Packages.mypy-boto3-omics: 1.43.25 -> 1.43.28

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index f5ef93151ae6..f19659197c9e 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -962,8 +962,8 @@ in
       "sha256-BUl/wnJKR3TB1YsTCLrJdEoH9Lz8DZ6H94STOOX8gkQ=";
 
   mypy-boto3-omics =
-    buildMypyBoto3Package "omics" "1.43.25"
-      "sha256-EcyGzTAvrwhS25jx7LrKCa4cKgcO+FvlS41Va0YhOIY=";
+    buildMypyBoto3Package "omics" "1.43.28"
+      "sha256-dlZYG0M6H1b3SyocmFc+HQYn9MX1fryNJo6cIu6paBA=";
 
   mypy-boto3-opensearch =
     buildMypyBoto3Package "opensearch" "1.43.16"

From 6f32cfdb575ab32c236ddb0daec653fe4167ebb7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 12 Jun 2026 09:14:04 +0200
Subject: [PATCH 37/57] python3Packages.mypy-boto3-support: 1.43.0 -> 1.43.28

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index f19659197c9e..d36521ec9555 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -1330,8 +1330,8 @@ in
       "sha256-fDjP/Q8H/yJtC4AWYQv1+hm9b6KnWgTP3uy6LKvqikw=";
 
   mypy-boto3-support =
-    buildMypyBoto3Package "support" "1.43.0"
-      "sha256-e6w7bGtbIWb/Jj2RSfEWup+zLjONPbYMUpWL0oEHgwo=";
+    buildMypyBoto3Package "support" "1.43.28"
+      "sha256-2smd+BvF4sNeJg7dd/eVzEqL6IXSp/iYyECcqVcMpFs=";
 
   mypy-boto3-support-app =
     buildMypyBoto3Package "support-app" "1.43.0"

From 1b9aa403020cc5a52203f830c7fc8f42689f6f16 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 12 Jun 2026 09:14:16 +0200
Subject: [PATCH 38/57] python3Packages.boto3-stubs: 1.43.27 -> 1.43.28

---
 pkgs/development/python-modules/boto3-stubs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index dc514d747c18..87ef490bfd9e 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.27";
+  version = "1.43.28";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-p1ZVLxdk29KeJVq1xFwpEkbEE/u+kEe04IXvDxAQaI0=";
+    hash = "sha256-G4JqUi5Hf70SFprLaFH3mamHmGNEHKhfbBFmvNRx5Fs=";
   };
 
   build-system = [ setuptools ];

From 26562a0d177cf9d335dedb34e1869181354f8535 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Jun 2026 07:14:36 +0000
Subject: [PATCH 39/57] amnezia-vpn: 4.8.15.4 -> 4.8.18.0

---
 pkgs/by-name/am/amnezia-vpn/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix
index 831f1ec9b45a..6cad55ecd001 100644
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -81,7 +81,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "4.8.15.4";
+  version = "4.8.18.0";
 
   __structuredAttrs = true;
 
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-ZUWesEpXb+L7NzL/jkWpS3b4DGq4733T5zc+VXSw9Ic=";
+    hash = "sha256-/A1juZzNWjdShdg41M1nfO3pMukMFzyBjQaZvZjYaJs=";
     fetchSubmodules = true;
   };
 

From 95db3d0bb732013f681192547fbeb51d811561ee Mon Sep 17 00:00:00 2001
From: networkException <git@nwex.de>
Date: Fri, 12 Jun 2026 09:30:20 +0200
Subject: [PATCH 40/57] ungoogled-chromium: 149.0.7827.53-1 -> 149.0.7827.102-1

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html

This update includes 74 security fixes. Google is aware that an exploit
for CVE-2026-11645 exists in the wild.

CVEs:
CVE-2026-11628 CVE-2026-11629 CVE-2026-11630 CVE-2026-11631
CVE-2026-11632 CVE-2026-11633 CVE-2026-11634 CVE-2026-11635
CVE-2026-11636 CVE-2026-11637 CVE-2026-11638 CVE-2026-11639
CVE-2026-11640 CVE-2026-11641 CVE-2026-11642 CVE-2026-11643
CVE-2026-11644 CVE-2026-11645 CVE-2026-11646 CVE-2026-11647
CVE-2026-11648 CVE-2026-11649 CVE-2026-11650 CVE-2026-11651
CVE-2026-11652 CVE-2026-11653 CVE-2026-11654 CVE-2026-11655
CVE-2026-11656 CVE-2026-11657 CVE-2026-11658 CVE-2026-11659
CVE-2026-11660 CVE-2026-11661 CVE-2026-11662 CVE-2026-11663
CVE-2026-11664 CVE-2026-11665 CVE-2026-11666 CVE-2026-11667
CVE-2026-11668 CVE-2026-11669 CVE-2026-11670 CVE-2026-11671
CVE-2026-11672 CVE-2026-11673 CVE-2026-11674 CVE-2026-11675
CVE-2026-11676 CVE-2026-11677 CVE-2026-11678 CVE-2026-11679
CVE-2026-11680 CVE-2026-11681 CVE-2026-11682 CVE-2026-11683
CVE-2026-11684 CVE-2026-11685 CVE-2026-11686 CVE-2026-11687
CVE-2026-11688 CVE-2026-11689 CVE-2026-11690 CVE-2026-11691
CVE-2026-11692 CVE-2026-11693 CVE-2026-11694 CVE-2026-11695
CVE-2026-11696 CVE-2026-11697 CVE-2026-11698 CVE-2026-11699
CVE-2026-11700 CVE-2026-11701
---
 .../networking/browsers/chromium/info.json    | 38 +++++++++----------
 .../browsers/chromium/ungoogled-flags.toml    |  1 -
 2 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 4d6e2a837b42..686a3f7aa05e 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -823,7 +823,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "149.0.7827.53",
+    "version": "149.0.7827.102",
     "deps": {
       "depot_tools": {
         "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
@@ -835,16 +835,16 @@
         "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
       },
       "ungoogled-patches": {
-        "rev": "149.0.7827.53-1",
-        "hash": "sha256-j4maEZiU38tqs57cTmg8OhIAAQcT+liWU0fDA7GMZHM="
+        "rev": "149.0.7827.102-1",
+        "hash": "sha256-I2yrFav9r+vfkKfCpa71F8amzApGViVT8Enlmukwe7s="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "9d2c8156a72129edca4785abb98866fad60ea338",
-        "hash": "sha256-RPFeHTWAeJUzbWU7QyRPmT3sqf3bAEuJ7/IJ3TP40pA=",
+        "rev": "112f665d98a2fe84b156c74fbea2aed742f16c15",
+        "hash": "sha256-75PYsss5Qob493WCc28XHncjFIlvUr2HQx79w5UmK/k=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -914,8 +914,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "ded782bca9d5f165d1c4a70124cdc5384043a8b3",
-        "hash": "sha256-7+Hhx/V554hO3zzGuIZswkaRVDElz7ost7vbnf2wyZc="
+        "rev": "4b8c7f0f321952bba4f81056b4aa57d0d6428642",
+        "hash": "sha256-ADG0WfkeFRq4NF0m+s3a/N5+u3q4ApExuWUnV3m5uAI="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -954,8 +954,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "1815a06195d9c74ac737a96f87c05111926e04f8",
-        "hash": "sha256-71KbW0w60VB67+HM48WpOo18hrVId4/4QBDl+xl5pgo="
+        "rev": "c1179de12ec3ed8feb91e922f12a90ae33f4a8cf",
+        "hash": "sha256-VFEBqbSsn/3jqRGJgTM/r5DEtfhvTOIfS9fGIKzYo9I="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1374,8 +1374,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "a7849e8a5e9c996bef2332efae897e7301055a20",
-        "hash": "sha256-ftOTwWULKNplqjQQ9oM9t+PU3S6/ySDOBoE5E/HWuHg="
+        "rev": "644251f252a84bf8ce91ff0aca86a9b16b069ab8",
+        "hash": "sha256-DsoOY8bg0sPOF8tF67Gk7fRqdQzG1hc9fVMlZVjKWU4="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -1429,8 +1429,8 @@
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "846203c4b3b25f834a0bebc101fa8e1b8f9d0ca9",
-        "hash": "sha256-YOgOau9vNrOOqyUf6WylI/oQ2drCxoW7jnrHt7fAfQM="
+        "rev": "97c58a94bb6495c4e202467fb1c55eaa22b5670f",
+        "hash": "sha256-qtClkWAluLDRZn7yrHLU7qp9szP+/WsiG5JZZzRKd38="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -1474,8 +1474,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "53348aa333da02b77c4b5797e2de722f5abde7d0",
-        "hash": "sha256-Qh0ytA45zP67VQE417iUtjPcJmJmDzcu4BAatyh6p0w="
+        "rev": "92a56ebeef43061f4878aa869aa1f2160265c24c",
+        "hash": "sha256-QEY9Wy2guRuS4CXeXHUhUNigCJWWndnNCbWQmaSYJ/A="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1609,8 +1609,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "5a7e0ff57a52e12f834d64c57d040d1105ea17f2",
-        "hash": "sha256-V1accCSU6LV5Ixhd+HBOvqZ7GxT57ALsvaF8ABLIXxM="
+        "rev": "e8b4d4c5952a8fb7b35c2a6cba4e8c3de2ea2e1e",
+        "hash": "sha256-94U9URlFGLYe94KCFU0giY9bBbrHNDCBr9GEwbRbOK4="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1639,8 +1639,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "5a39b146dd810a52812202fae891281d5dc4db7d",
-        "hash": "sha256-UbX88nE4VyWUm4PvFTOy3mC04MzSdgC006ZpQrEY8cQ="
+        "rev": "16ef80c1f5d3cfade812bd1743952a4cfd480a31",
+        "hash": "sha256-GI0NWA0XYGocxZp3+lPen6BkwaG7X3EDaEWM9rejgkI="
       }
     }
   }
diff --git a/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml b/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml
index 7aca3d6cd078..8394b02408c3 100644
--- a/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml
+++ b/pkgs/applications/networking/browsers/chromium/ungoogled-flags.toml
@@ -16,4 +16,3 @@ treat_warnings_as_errors=false
 use_official_google_api_keys=false
 use_unofficial_version_number=false
 v8_drumbrake_bounds_checks=true
-v8_enable_drumbrake=true

From ca0296ce668d7e97316c87e90031dbcb3cf8b0b3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Jun 2026 07:53:22 +0000
Subject: [PATCH 41/57] postgresqlPackages.pg_squeeze: 1.9.1 -> 1.9.2

---
 pkgs/servers/sql/postgresql/ext/pg_squeeze.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/pg_squeeze.nix b/pkgs/servers/sql/postgresql/ext/pg_squeeze.nix
index 7f7d55fc5bc5..5a7f652f2eb0 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_squeeze.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_squeeze.nix
@@ -9,13 +9,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_squeeze";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "cybertec-postgresql";
     repo = "pg_squeeze";
     tag = "REL${lib.replaceString "." "_" finalAttrs.version}";
-    hash = "sha256-KbCS3kg2MoxKHl+35UOFCSF4kPPsIMeO7AfwfHZYZVg=";
+    hash = "sha256-gzep34mxV9D9xk/J7JfSTWg8EaM/BJezpM3tt/tlxmM=";
   };
 
   passthru.updateScript = nix-update-script {

From df041989dcefc12a8a60ba50df25548623a589e8 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Fri, 12 Jun 2026 15:23:42 +0800
Subject: [PATCH 42/57] nixosTests.firewalld: wait until state is running

---
 nixos/tests/firewalld.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/tests/firewalld.nix b/nixos/tests/firewalld.nix
index a191fe806354..5c1c34e35ece 100644
--- a/nixos/tests/firewalld.nix
+++ b/nixos/tests/firewalld.nix
@@ -29,6 +29,8 @@
 
     walled.wait_for_unit("firewalld")
     walled.wait_for_unit("httpd")
+    # https://github.com/firewalld/firewalld/issues/1571
+    walled.wait_until_succeeds("firewall-cmd --state")
 
     open.wait_for_unit("network.target")
 

From 04b8fdb00ae629dd25e7326bf6095f7915f8a3a1 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Fri, 12 Jun 2026 15:23:42 +0800
Subject: [PATCH 43/57] nixosTests.firewall-firewalld: wait until state is
 running

---
 nixos/tests/firewall.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/tests/firewall.nix b/nixos/tests/firewall.nix
index 31db36ef8dc1..5c2e94fccac4 100644
--- a/nixos/tests/firewall.nix
+++ b/nixos/tests/firewall.nix
@@ -89,12 +89,17 @@
         else
           "nixos-firewall-tool open tcp 80";
       reset = if backend == "firewalld" then "firewall-cmd --reload" else "nixos-firewall-tool reset";
+      # https://github.com/firewalld/firewalld/issues/1571
+      waitForFirewalld = lib.optionalString (backend == "firewalld") ''
+        walled.wait_until_succeeds("firewall-cmd --state")
+      '';
     in
     ''
       start_all()
 
       walled.wait_for_unit("${unit}")
       walled.wait_for_unit("httpd")
+      ${waitForFirewalld}
       attacker.wait_for_unit("network.target")
 
       # Local connections should still work.

From 0065862031447aa1761da21f4fb859654826bf23 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 12 Jun 2026 11:10:34 +0300
Subject: [PATCH 44/57] kdePackages: Frameworks 6.26 -> 6.27

oxygen-icons and kmime absorbed into Frameworks,
however the Gear version of kmime is still going to win
until the next Gear update drops it, as the Frameworks
version is API incompatible with current stable Gear.
---
 pkgs/kde/default.nix                         |   1 -
 pkgs/kde/frameworks/default.nix              |   2 +
 pkgs/kde/frameworks/kmime/default.nix        |   9 +
 pkgs/kde/frameworks/oxygen-icons/default.nix |   6 +
 pkgs/kde/generated/licenses.json             |  18 +-
 pkgs/kde/generated/sources/frameworks.json   | 442 ++++++++++---------
 pkgs/kde/misc/oxygen-icons/default.nix       |  18 -
 7 files changed, 259 insertions(+), 237 deletions(-)
 create mode 100644 pkgs/kde/frameworks/kmime/default.nix
 create mode 100644 pkgs/kde/frameworks/oxygen-icons/default.nix
 delete mode 100644 pkgs/kde/misc/oxygen-icons/default.nix

diff --git a/pkgs/kde/default.nix b/pkgs/kde/default.nix
index 5ee3785b7eb5..70b140ecf133 100644
--- a/pkgs/kde/default.nix
+++ b/pkgs/kde/default.nix
@@ -81,7 +81,6 @@ let
         kup = self.callPackage ./misc/kup { };
         marknote = self.callPackage ./misc/marknote { };
         mpvqt = self.callPackage ./misc/mpvqt { };
-        oxygen-icons = self.callPackage ./misc/oxygen-icons { };
         phonon = self.callPackage ./misc/phonon { };
         phonon-vlc = self.callPackage ./misc/phonon-vlc { };
         plasma-pass = self.callPackage ./misc/plasma-pass { };
diff --git a/pkgs/kde/frameworks/default.nix b/pkgs/kde/frameworks/default.nix
index 148c6a3d9895..4a4e542c94d6 100644
--- a/pkgs/kde/frameworks/default.nix
+++ b/pkgs/kde/frameworks/default.nix
@@ -40,6 +40,7 @@
   kitemmodels = callPackage ./kitemmodels { };
   kitemviews = callPackage ./kitemviews { };
   kjobwidgets = callPackage ./kjobwidgets { };
+  kmime = callPackage ./kmime { };
   knewstuff = callPackage ./knewstuff { };
   knotifications = callPackage ./knotifications { };
   knotifyconfig = callPackage ./knotifyconfig { };
@@ -64,6 +65,7 @@
   kxmlgui = callPackage ./kxmlgui { };
   modemmanager-qt = callPackage ./modemmanager-qt { };
   networkmanager-qt = callPackage ./networkmanager-qt { };
+  oxygen-icons = callPackage ./oxygen-icons { };
   prison = callPackage ./prison { };
   purpose = callPackage ./purpose { };
   qqc2-desktop-style = callPackage ./qqc2-desktop-style { };
diff --git a/pkgs/kde/frameworks/kmime/default.nix b/pkgs/kde/frameworks/kmime/default.nix
new file mode 100644
index 000000000000..678bc5940736
--- /dev/null
+++ b/pkgs/kde/frameworks/kmime/default.nix
@@ -0,0 +1,9 @@
+{
+  mkKdeDerivation,
+  qttools,
+}:
+mkKdeDerivation {
+  pname = "kmime";
+
+  extraNativeBuildInputs = [ qttools ];
+}
diff --git a/pkgs/kde/frameworks/oxygen-icons/default.nix b/pkgs/kde/frameworks/oxygen-icons/default.nix
new file mode 100644
index 000000000000..374365715a16
--- /dev/null
+++ b/pkgs/kde/frameworks/oxygen-icons/default.nix
@@ -0,0 +1,6 @@
+{ mkKdeDerivation }:
+mkKdeDerivation {
+  pname = "oxygen-icons";
+
+  dontStrip = true;
+}
diff --git a/pkgs/kde/generated/licenses.json b/pkgs/kde/generated/licenses.json
index 12e03ba44697..c0fe90c9efe5 100644
--- a/pkgs/kde/generated/licenses.json
+++ b/pkgs/kde/generated/licenses.json
@@ -735,10 +735,15 @@
     "MIT"
   ],
   "kcalendarcore": [
+    "BSD-2-Clause",
     "BSD-3-Clause",
     "CC0-1.0",
     "LGPL-2.0-or-later",
-    "LGPL-3.0-or-later"
+    "LGPL-2.1-only",
+    "LGPL-3.0-only",
+    "LGPL-3.0-or-later",
+    "LicenseRef-KDE-Accepted-LGPL",
+    "MIT"
   ],
   "kcalutils": [
     "BSD-3-Clause",
@@ -843,6 +848,7 @@
     "Qt-LGPL-exception-1.1"
   ],
   "kcrash": [
+    "BSD-2-Clause",
     "CC0-1.0",
     "LGPL-2.0-or-later"
   ],
@@ -1246,7 +1252,8 @@
     "LGPL-2.0-or-later",
     "LGPL-2.1-only",
     "LGPL-3.0-only",
-    "LicenseRef-KDE-Accepted-LGPL"
+    "LicenseRef-KDE-Accepted-LGPL",
+    "MIT"
   ],
   "ki18n": [
     "BSD-3-Clause",
@@ -1461,6 +1468,7 @@
     "BSD-3-Clause",
     "CC0-1.0",
     "LGPL-2.1-or-later",
+    "LGPL-3.0-or-later",
     "MIT"
   ],
   "kjumpingcube": [
@@ -2587,6 +2595,10 @@
     "LicenseRef-KDE-Accepted-LGPL",
     "MIT"
   ],
+  "oxygen-icons": [
+    "CC0-1.0",
+    "LGPL-3.0-or-later"
+  ],
   "oxygen-sounds": [
     "BSD-2-Clause",
     "CC-BY-3.0",
@@ -2982,6 +2994,7 @@
     "MIT"
   ],
   "purpose": [
+    "BSD-2-Clause",
     "CC0-1.0",
     "GPL-2.0-or-later",
     "LGPL-2.0-or-later",
@@ -3135,6 +3148,7 @@
     "BSD-3-Clause",
     "CC0-1.0",
     "GPL-2.0-only",
+    "GPL-3.0-or-later",
     "LGPL-2.0-or-later",
     "LGPL-2.1-or-later",
     "MIT"
diff --git a/pkgs/kde/generated/sources/frameworks.json b/pkgs/kde/generated/sources/frameworks.json
index 32cfa04a2737..5c2bef41b16c 100644
--- a/pkgs/kde/generated/sources/frameworks.json
+++ b/pkgs/kde/generated/sources/frameworks.json
@@ -1,362 +1,372 @@
 {
   "attica": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/attica-6.26.0.tar.xz",
-    "hash": "sha256-6y09LYsSwqtNGSxK5vB7AYikCqACswVttjabR7L535Y="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/attica-6.27.0.tar.xz",
+    "hash": "sha256-jz09YeyKdFbbinXKqAGi5fXgRnKL0kCgA+cbiBMJOuQ="
   },
   "baloo": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/baloo-6.26.0.tar.xz",
-    "hash": "sha256-cC9bhoqu9IFTxsOCgRGzszVAMHlJGo83BD69icaZWzA="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/baloo-6.27.0.tar.xz",
+    "hash": "sha256-ayJhGL3ijoEhf4zWEp9uJMXUIr16Mi/mguWSsCi3Lbc="
   },
   "bluez-qt": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/bluez-qt-6.26.0.tar.xz",
-    "hash": "sha256-6+swHq627GcpsnlpVWg5FlulguviQrQs3nHI+qgNY98="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/bluez-qt-6.27.0.tar.xz",
+    "hash": "sha256-PiLB9x89k/VywqESbtwqoWFR+LrRD58d235B3Tcq7nA="
   },
   "breeze-icons": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/breeze-icons-6.26.0.tar.xz",
-    "hash": "sha256-ThI/rFEd+rK3xQWFeEmlzs+sLOYZTjIwxRzuwxZ2sG4="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/breeze-icons-6.27.0.tar.xz",
+    "hash": "sha256-vIwjN4AoN/8YCSaajkxDEbk+fpDHirT+KobPUwD/1BQ="
   },
   "extra-cmake-modules": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/extra-cmake-modules-6.26.0.tar.xz",
-    "hash": "sha256-9OENnUWq+1Jz6ZYZYED05CDwvEBxwggoKq6U2a2OF0M="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/extra-cmake-modules-6.27.0.tar.xz",
+    "hash": "sha256-87WvV4AXpqDxJ/scMWCdsuTwFumbkA1aEfb/tsVQBqM="
   },
   "frameworkintegration": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/frameworkintegration-6.26.0.tar.xz",
-    "hash": "sha256-hOu605tVnicbzsSBfrqRJJA8pmCtT1w/c/IaX0oyBi0="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/frameworkintegration-6.27.0.tar.xz",
+    "hash": "sha256-Ve7+jrxnoEDmTHVIInbCmmnQxYd7ezZ09MekAjjG1Ew="
   },
   "kapidox": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kapidox-6.26.0.tar.xz",
-    "hash": "sha256-be8hYA76d3rt2OrJdmTg49VfstwImFWebHu6/ah+Fu8="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kapidox-6.27.0.tar.xz",
+    "hash": "sha256-qC+dLkofqnH2MwksKalZ4t7hoXLNJUZc9KBMU4igUCI="
   },
   "karchive": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/karchive-6.26.0.tar.xz",
-    "hash": "sha256-p/320LjbiNYKpSvMh9jgDZU5GhrTmksqjp8wJ7j/QDU="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/karchive-6.27.0.tar.xz",
+    "hash": "sha256-Q07feN+PTJ8lAA0QetFSDXrBTbWAogIEe/Gcv3c3ZSI="
   },
   "kauth": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kauth-6.26.0.tar.xz",
-    "hash": "sha256-5rZWIRTCy3HbbKSP3w6+0t9w4WTEgpWzVDOoCwM4WEc="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kauth-6.27.0.tar.xz",
+    "hash": "sha256-dBk0dl8MnxxTVZggP7rT8blyMcxoOiGKfzn6uUjBPqs="
   },
   "kbookmarks": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kbookmarks-6.26.0.tar.xz",
-    "hash": "sha256-guh5QoGHBobann57XdwIOfULFdkZNXSQ1Qj6zLJjUDA="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kbookmarks-6.27.0.tar.xz",
+    "hash": "sha256-daQ3de8DywxXfHDZYFIDeJs8dbeG76F6LowobQxV+5M="
   },
   "kcalendarcore": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kcalendarcore-6.26.0.tar.xz",
-    "hash": "sha256-OGvg7uOS2EMra3+v096tld0fx0+BeQkoxYD4HmIioXw="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kcalendarcore-6.27.0.tar.xz",
+    "hash": "sha256-QiiGlyLFu1Mlt8WxBVXmt0e94ONsvUNRnYaB/js4MXM="
   },
   "kcmutils": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kcmutils-6.26.0.tar.xz",
-    "hash": "sha256-bQgQZJtxUoEkzfnb3rizxsbTHXhzJco+SiDFNuy98tk="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kcmutils-6.27.0.tar.xz",
+    "hash": "sha256-vrClCiIjD92UFkpdblPqf0y8l7hsurP/KlkuqGY++kE="
   },
   "kcodecs": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kcodecs-6.26.0.tar.xz",
-    "hash": "sha256-7h/jvYvNk6hNRBhqX8UDlba/Q90r+JcjOKeq1yqgvLQ="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kcodecs-6.27.0.tar.xz",
+    "hash": "sha256-d/UfdYbotFdTTZXdJBKA6LdHWRXGVuZh3Dex6KdzxZU="
   },
   "kcolorscheme": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kcolorscheme-6.26.0.tar.xz",
-    "hash": "sha256-dBSaA3m9i/ZZDTwff4xQNmXg862vwq29RPxrt2TJafE="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kcolorscheme-6.27.0.tar.xz",
+    "hash": "sha256-V04SNQ6hrfJIxSY88Y0UVHbTaGZKMCUU0QZaolY+Hv0="
   },
   "kcompletion": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kcompletion-6.26.0.tar.xz",
-    "hash": "sha256-lfceuAfk3kDs3+cjTJw9hEQjFxrFJYiuzKZC942QTkg="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kcompletion-6.27.0.tar.xz",
+    "hash": "sha256-AGhk3LpdX8h7TKXcwSOVOGV6XQUgV7rl07w+ceq6BVE="
   },
   "kconfig": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kconfig-6.26.0.tar.xz",
-    "hash": "sha256-i7WqkY2OYOwUCjPbPDKUFNIxncl6FkSzaNpVdhJckrU="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kconfig-6.27.0.tar.xz",
+    "hash": "sha256-4ZcouA5swBdQL8tQ/m1+m1upcnhxrDpOmBGHXgHLX+k="
   },
   "kconfigwidgets": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kconfigwidgets-6.26.0.tar.xz",
-    "hash": "sha256-O6vO8irqKT+tDbZfzb9260rJB3vHWO6NrsEICQJC6jw="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kconfigwidgets-6.27.0.tar.xz",
+    "hash": "sha256-QE7QYG37E8xEw23q9fiA7ux1AYroeBJdq/g/Mu/rCn8="
   },
   "kcontacts": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kcontacts-6.26.0.tar.xz",
-    "hash": "sha256-3OmvNAUPzwnItOzm31oKvtuvAv6FA5/DccXhHpFEPPA="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kcontacts-6.27.0.tar.xz",
+    "hash": "sha256-3Y1t0EWw/XHHzj/Bi7Fbd+yDFuV/TYPdrmfzpit5bvs="
   },
   "kcoreaddons": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kcoreaddons-6.26.0.tar.xz",
-    "hash": "sha256-kv2/q2jlLZ6s9EqZLwHLNk1jlcJEQeL9R91IojsygfY="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kcoreaddons-6.27.0.tar.xz",
+    "hash": "sha256-rQ0BR5aNq9zwEUJc93ZOcaDQz9ww6eNLVh6lupp2gAE="
   },
   "kcrash": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kcrash-6.26.0.tar.xz",
-    "hash": "sha256-0F2Thjp0XODUq4zP9oSoSoE+5MvMaMnHpRdRB7EH6TE="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kcrash-6.27.0.tar.xz",
+    "hash": "sha256-+OEIOGPawsBwaLEGFMp9S1LGkg3wIohUz8N+DWV42QI="
   },
   "kdav": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kdav-6.26.0.tar.xz",
-    "hash": "sha256-dTWyuabrNeW1Od54Dy0rhGaOuX7sO3ps8U2R++a+3+w="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kdav-6.27.0.tar.xz",
+    "hash": "sha256-4K9BkJYNZfXIR18BIT6k5ooHdj/+qmdm3kt/UFKeBJg="
   },
   "kdbusaddons": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kdbusaddons-6.26.0.tar.xz",
-    "hash": "sha256-iUuy4DLG9tm0pYuLJGeGkqn05w6VP/TavaLtTptUMeI="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kdbusaddons-6.27.0.tar.xz",
+    "hash": "sha256-nqN5Ky8cQ9VVFDcmCAP91nbJA+J2j0qsQYYFTlsi1Mo="
   },
   "kdeclarative": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kdeclarative-6.26.0.tar.xz",
-    "hash": "sha256-mkZOVg5DbNOmJspqq4lPQUxiEtLei5xajtozviE+ANg="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kdeclarative-6.27.0.tar.xz",
+    "hash": "sha256-sU6BFDrtJe5iQT+cKzdCxVj1tqHabFuSypqVu2NB6WQ="
   },
   "kded": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kded-6.26.0.tar.xz",
-    "hash": "sha256-QmXRFiy9f+vxbRA78b2fq4WPo/VPUnl+0JOENr7jR68="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kded-6.27.0.tar.xz",
+    "hash": "sha256-TyQGeRWwWh0MyH4sN/N+sOjEQej8zfBson7nuSMFgkM="
   },
   "kdesu": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kdesu-6.26.0.tar.xz",
-    "hash": "sha256-N98zoSNoULa+vXc6Guq1bKWX40dDKSTKWFU2kzfUviQ="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kdesu-6.27.0.tar.xz",
+    "hash": "sha256-qKDFEDy0PcYpUqq3a7flduhkPbsxZy4qwpiCeatXFwA="
   },
   "kdnssd": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kdnssd-6.26.0.tar.xz",
-    "hash": "sha256-hDna7ZxLlCp0OT2vI8jZf9qr2BuT3DR/kbu0Wiv4Ukg="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kdnssd-6.27.0.tar.xz",
+    "hash": "sha256-pgdGrKHObP0vvSAUS8SGnSsA0EtZeu2rPdN6NF+wO7Q="
   },
   "kdoctools": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kdoctools-6.26.0.tar.xz",
-    "hash": "sha256-P76l3iFQdhMAB/PBjha4cHdP+k/IXdrOIBrAINAkX7Y="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kdoctools-6.27.0.tar.xz",
+    "hash": "sha256-aQJu+GB8tiV+TR8ORuRREw73umeZSoPk+abEbu/Vo/M="
   },
   "kfilemetadata": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kfilemetadata-6.26.0.tar.xz",
-    "hash": "sha256-91lCuaPRvgsJEM1Qoiw8Qy7e3cUGhYyNVRHd9UmAUfI="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kfilemetadata-6.27.0.tar.xz",
+    "hash": "sha256-J/aFWCWTlK2E01eqMWghZy7mZIH6hR3fKmEJ9mimxqM="
   },
   "kglobalaccel": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kglobalaccel-6.26.0.tar.xz",
-    "hash": "sha256-PxnSLRQ1d+XdzIgxcP4ZpW+PZXZuQcT5wBHE373hemE="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kglobalaccel-6.27.0.tar.xz",
+    "hash": "sha256-57oWAaFZ6nn0JKTVNkdBU5P5Db7aHjIW0CPutUIIN9M="
   },
   "kguiaddons": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kguiaddons-6.26.0.tar.xz",
-    "hash": "sha256-g3U0L4UhBPNv1ypocOuXlRg69FFlks1vpzRF6muBMXI="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kguiaddons-6.27.0.tar.xz",
+    "hash": "sha256-KbBDSAxF0+UcV8rHT9g1icx3KckHplhbcogMvwf+r4I="
   },
   "kholidays": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kholidays-6.26.0.tar.xz",
-    "hash": "sha256-/E9Gy1u45HZvVQ/hqLQBcx15f89q+ny1NnkEjCFaYL4="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kholidays-6.27.0.tar.xz",
+    "hash": "sha256-hM4qzVVlqVENdJReojEfjAmcsDE5MlXRyNOZZl1XuRQ="
   },
   "ki18n": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/ki18n-6.26.0.tar.xz",
-    "hash": "sha256-SEqtSGv6/vbIbY1bJlKSWOZ8dMliUMGsIS3fVoRIx8A="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/ki18n-6.27.0.tar.xz",
+    "hash": "sha256-zYEq6VsOlbQORqULneptGI7sABvpax4aXZYnMOX5vFg="
   },
   "kiconthemes": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kiconthemes-6.26.0.tar.xz",
-    "hash": "sha256-7WwMC/7VF91bZGLZschOvnvJnHp1IUkhtZePCG34ZT0="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kiconthemes-6.27.0.tar.xz",
+    "hash": "sha256-b+hvDA/0EET0TR83+a4AG40sGlqLwGxBxD7VdBOK9b4="
   },
   "kidletime": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kidletime-6.26.0.tar.xz",
-    "hash": "sha256-8O/WfuDlteuSAOkk6UeMHssXm0o44M8SWzd+f6Nz7wc="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kidletime-6.27.0.tar.xz",
+    "hash": "sha256-LLAZbuO7G2C+m60UtNBN+vU7PQAXzUWQgwNccVkQVRs="
   },
   "kimageformats": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kimageformats-6.26.0.tar.xz",
-    "hash": "sha256-wZJVLuGDH9XgmvTjYzuyRybftAMRcMQoUCRoO+2vmXI="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kimageformats-6.27.0.tar.xz",
+    "hash": "sha256-ap9Ak2upRieQY8va6kc7nrc1tTBHsBJMiKyn2xfMq6w="
   },
   "kio": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kio-6.26.0.tar.xz",
-    "hash": "sha256-Vn9k25dmmGtVNdiEpdswIDaFwz5n9WiSvO/zDhvVzIo="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kio-6.27.0.tar.xz",
+    "hash": "sha256-/CAbAsJ3o1zoFBSx3n5vhR5GsLXUO+t4STakptxhZ9A="
   },
   "kirigami": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kirigami-6.26.0.tar.xz",
-    "hash": "sha256-smh4WycRmKzsf+S2F36v3uiQ4YAkXHFokW2jzP8UJf8="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kirigami-6.27.0.tar.xz",
+    "hash": "sha256-19qnTp/oG2dOVObpef64XT0vQha/bZwCv6osAh/hrC0="
   },
   "kitemmodels": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kitemmodels-6.26.0.tar.xz",
-    "hash": "sha256-qZYgEGL/fSH525ct68LZYVdi3bD9naBppCt/17uh5h0="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kitemmodels-6.27.0.tar.xz",
+    "hash": "sha256-9a7HGYsWFWJhbBOe0DflYueuaCK4OfZ8jC4vl2ePxY4="
   },
   "kitemviews": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kitemviews-6.26.0.tar.xz",
-    "hash": "sha256-52zJ11YdCq4isHp3VS+83fYcgGa6xc+smVisBlthfnQ="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kitemviews-6.27.0.tar.xz",
+    "hash": "sha256-eihvFHFEcUqp6PVn3VoGOKj7gd+Xo0oBEvcltyqjaXk="
   },
   "kjobwidgets": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kjobwidgets-6.26.0.tar.xz",
-    "hash": "sha256-gFe3vRMswrRprEBvlboivDz8JAwQMUhfGfoHKrlC9x4="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kjobwidgets-6.27.0.tar.xz",
+    "hash": "sha256-MUnNB9giBMa/qNhsWQvwySkF4bWwdce1Q1QJFqYdegM="
+  },
+  "kmime": {
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kmime-6.27.0.tar.xz",
+    "hash": "sha256-sMgft+ABrEwFvWyLG7Qar3ZfeeTT6NFxCEWKiQ1xLHY="
   },
   "knewstuff": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/knewstuff-6.26.0.tar.xz",
-    "hash": "sha256-lO85B3ulOnL05VW2+UonYsunlzBhnLgKMcVDVkLr4ao="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/knewstuff-6.27.0.tar.xz",
+    "hash": "sha256-jBnfe6WUDDb/FQUXA6zToWxmS0pXCBe2dw+vx6tZ1t4="
   },
   "knotifications": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/knotifications-6.26.0.tar.xz",
-    "hash": "sha256-IDOnmIVqnSd25uTO9vPrO8JLk4wNALBrL25xvkThRGo="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/knotifications-6.27.0.tar.xz",
+    "hash": "sha256-7rBn+rAB3SRzWtVujsSAj8p25ezfADz2FCRsmr4cPhk="
   },
   "knotifyconfig": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/knotifyconfig-6.26.0.tar.xz",
-    "hash": "sha256-Bi4i9IodpIXULvVrN9sfxQL1+TBYcUg2J9IY81dWCig="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/knotifyconfig-6.27.0.tar.xz",
+    "hash": "sha256-gYYTFtYV5+X/BxQ8HVjZtSytxeAqs4yPJnfAH3HlHyY="
   },
   "kpackage": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kpackage-6.26.0.tar.xz",
-    "hash": "sha256-MTzaSjNezbZ7uOL8wVvetZcNsX1VlygsplW/l6mKurU="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kpackage-6.27.0.tar.xz",
+    "hash": "sha256-X6Swf3KcP/a382LTGDdIEPpVsTqSLSskBGLrjvwQReg="
   },
   "kparts": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kparts-6.26.0.tar.xz",
-    "hash": "sha256-BJws8Ei0y7/+C+qTV72atTuL5nK6UJsrsFj3ZNIbP1s="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kparts-6.27.0.tar.xz",
+    "hash": "sha256-DCzjnxEOEv8IgsclvudFW5CFSJwS0x60sxZLFQ+43iQ="
   },
   "kpeople": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kpeople-6.26.0.tar.xz",
-    "hash": "sha256-vRCSzZkA0O47PQjQlx5mmoLRoRyb7G4jItcTtZGRuHM="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kpeople-6.27.0.tar.xz",
+    "hash": "sha256-WGQHMQNw+af+iHc8kOg+Invsf19vhg32VA1p20JVgdY="
   },
   "kplotting": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kplotting-6.26.0.tar.xz",
-    "hash": "sha256-uxIPRG5r/DdhKeA2Y+SzuecUaryUjMxo2hkYeED58YE="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kplotting-6.27.0.tar.xz",
+    "hash": "sha256-svjX5yAYfqgVllPLPIyvDQP7Xz1+zvGyuArAsqd7Q2c="
   },
   "kpty": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kpty-6.26.0.tar.xz",
-    "hash": "sha256-dhPCbPqnRlov4ooidizrOCZkFOf0qUoSfAncBihiVVM="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kpty-6.27.0.tar.xz",
+    "hash": "sha256-rQa/2o3wGbsrM1Z8499Tm8wQfg3+AEKB5f+a5GF8bsw="
   },
   "kquickcharts": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kquickcharts-6.26.0.tar.xz",
-    "hash": "sha256-rj4HhKKi0Tlst1HMYfQ6Vn4GbWQ0lxJGsaGDZUgaG1I="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kquickcharts-6.27.0.tar.xz",
+    "hash": "sha256-0qUzu/PX8lfpMGAJvDK96kE0bL2OgtBsGIh51fBGA4A="
   },
   "krunner": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/krunner-6.26.0.tar.xz",
-    "hash": "sha256-NRnH/hcL4TWaTDjdUmneZMAgjM/rlQZhAC3fpOkvK/A="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/krunner-6.27.0.tar.xz",
+    "hash": "sha256-RtBjIbvMrbjz+7lI/6rF7/GNrZVS/eZ3dh3d25RwIC8="
   },
   "kservice": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kservice-6.26.0.tar.xz",
-    "hash": "sha256-+FKFJMyvtqSVli3TJgxEI3eSAWnxxETxFlfqQlWKU7Y="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kservice-6.27.0.tar.xz",
+    "hash": "sha256-NzbG1s04nvyJrby2T+e6Jf/J1i646vY5P0K7hfZVqMc="
   },
   "kstatusnotifieritem": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kstatusnotifieritem-6.26.0.tar.xz",
-    "hash": "sha256-iYkUyUgg+ZiJ2HnzPKu7X757n04kpqHZqbRDlIm8MmY="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kstatusnotifieritem-6.27.0.tar.xz",
+    "hash": "sha256-ou7CqYHtnabP/JVcwhpQ3Lx3FBy7hA2RX5LRiXRC0jk="
   },
   "ksvg": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/ksvg-6.26.0.tar.xz",
-    "hash": "sha256-86dBLiJ9E7HK/skcG1jdP4aYCr78CLJTW0a+82K0wH4="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/ksvg-6.27.0.tar.xz",
+    "hash": "sha256-aNQ/AUY5rmCXASzdZ72779VCWxfSMi2U9VvisThhPgo="
   },
   "ktexteditor": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/ktexteditor-6.26.0.tar.xz",
-    "hash": "sha256-7HvAlPk9UUtfZ1rpXCdN0krMR3adlxYG2HCMyI+BE0E="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/ktexteditor-6.27.0.tar.xz",
+    "hash": "sha256-K3N6YXN+c2UM0LQNniRqGC3MzGyK6BIc/LlBVDPuQa4="
   },
   "ktexttemplate": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/ktexttemplate-6.26.0.tar.xz",
-    "hash": "sha256-i4RkPDLK9YgS/sWpEKH7mIZbx/ked4r4YPqYt50P8Dg="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/ktexttemplate-6.27.0.tar.xz",
+    "hash": "sha256-GKkrgCscMTD/Igh/ngSIB73znEFHg16aqhvhhAi5Nhs="
   },
   "ktextwidgets": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/ktextwidgets-6.26.0.tar.xz",
-    "hash": "sha256-ZRH5kJ+Q+slR4oc6RN1FG4rHHTgIWmLGWm+1Ao5i2E0="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/ktextwidgets-6.27.0.tar.xz",
+    "hash": "sha256-A8NdiJlVnvwXtPdOhu79g1ja/XqpMRyJucCfezVwB1Y="
   },
   "kunitconversion": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kunitconversion-6.26.0.tar.xz",
-    "hash": "sha256-lEBEUwEe7Dc/hY70pYCR0k+627kPlru/RwwJhkbZZ14="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kunitconversion-6.27.0.tar.xz",
+    "hash": "sha256-QE4GQRTJXsoO91m5bKTgul+bi8VjE4V0NYJwlj8/VVQ="
   },
   "kuserfeedback": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kuserfeedback-6.26.0.tar.xz",
-    "hash": "sha256-bMGNymWiSvKsJiy5yHYZkXAcgIGnEzSHtOyTYAPz+GQ="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kuserfeedback-6.27.0.tar.xz",
+    "hash": "sha256-WtAiiqSHL2I4uTgn6Z0mOuvMfgv8Tyi6PPOcD9Kt16k="
   },
   "kwallet": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kwallet-6.26.0.tar.xz",
-    "hash": "sha256-IyH4WR8fIl09clP66e5h0HidsjGz7q5qX4oUwBNTE4k="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kwallet-6.27.0.tar.xz",
+    "hash": "sha256-2qA6zEDuyHO7RQ/YEWrnx4i4anzuvJ+lVbShZv7reYM="
   },
   "kwidgetsaddons": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kwidgetsaddons-6.26.0.tar.xz",
-    "hash": "sha256-ZQRIguMLMF/p+yAzGjVM2BHKnYC1x/n6ciY58zNP5jA="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kwidgetsaddons-6.27.0.tar.xz",
+    "hash": "sha256-TLqGmZMxlgs/3ayO0CzMsx/ElAZCI2AhcTX2vz+8qNk="
   },
   "kwindowsystem": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kwindowsystem-6.26.0.tar.xz",
-    "hash": "sha256-X3lit8mG53xdJfpPfQnNiRRLh4Hlfrw3/UXq7BlhuwI="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kwindowsystem-6.27.0.tar.xz",
+    "hash": "sha256-QB5XAKs2UwpgVBBGQmi/cmyJjaQsb3178FqdsAzP4XI="
   },
   "kxmlgui": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/kxmlgui-6.26.0.tar.xz",
-    "hash": "sha256-Q4OFXOpaf5omnHLdoVSQuNcMHSPReVCWOTczL8XWt6A="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/kxmlgui-6.27.0.tar.xz",
+    "hash": "sha256-NtXJz4qFGmPBBk1qmYfpYcCGDr0Tls2pkRnlcIR99yE="
   },
   "modemmanager-qt": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/modemmanager-qt-6.26.0.tar.xz",
-    "hash": "sha256-vvRWrApZg7zBShWAyw0yoAEkHzgNkBy1A2E4VTgK86U="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/modemmanager-qt-6.27.0.tar.xz",
+    "hash": "sha256-qJOhad1AxDDFHTkyaxrwqrKp1sIK3DTyuOYzLBUvYjQ="
   },
   "networkmanager-qt": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/networkmanager-qt-6.26.0.tar.xz",
-    "hash": "sha256-pc/tBq9hVhYff+5W7+FSGm6eJhGTJwafF5mYb5C0MuU="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/networkmanager-qt-6.27.0.tar.xz",
+    "hash": "sha256-qBk4lbQg1Xb6wig4i6j9GyTW8inEO3lj4u1YHvgsrZo="
+  },
+  "oxygen-icons": {
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/oxygen-icons-6.27.0.tar.xz",
+    "hash": "sha256-82oIhOa55VRyHA+MvUDCDtT/Ght9fik8Z9PRHQtyz5o="
   },
   "prison": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/prison-6.26.0.tar.xz",
-    "hash": "sha256-BBTdwxC8pe7Pwab51EY7im2BiU20EorEO0+MHhS3O1s="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/prison-6.27.0.tar.xz",
+    "hash": "sha256-dgkD6a5AH4vNue/JrWVImCZC50EaIjyM60HlSRprETU="
   },
   "purpose": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/purpose-6.26.0.tar.xz",
-    "hash": "sha256-zHt1mdGsfOftBzUaNddC+sG35VSyCKexyS6FmztK3TA="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/purpose-6.27.0.tar.xz",
+    "hash": "sha256-xONI+lrJkKd7OSYQXGK8Ty3dr411VMQ+5PGN49FqNpk="
   },
   "qqc2-desktop-style": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/qqc2-desktop-style-6.26.0.tar.xz",
-    "hash": "sha256-GAX6MTVf+GwCFY/SuNOW/YiDXQHbl9hwAxTEjuM2CYY="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/qqc2-desktop-style-6.27.0.tar.xz",
+    "hash": "sha256-bABfBsX4xKw0kjir8UmZu5FyFaj3uMUTZOL90S6eY1U="
   },
   "solid": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/solid-6.26.0.tar.xz",
-    "hash": "sha256-hc+rmweH9ZR4ZhFAmXxIX62rYs7FNf/O8pU9MS9zbEo="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/solid-6.27.0.tar.xz",
+    "hash": "sha256-cKnuabQ1fr+DzIeqYdtv3/jJalniT5Vy5RcW8dPFef4="
   },
   "sonnet": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/sonnet-6.26.0.tar.xz",
-    "hash": "sha256-OsThZcCzx57aQWt1S7g3KS81QYihIg8gZfV/aGSJryU="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/sonnet-6.27.0.tar.xz",
+    "hash": "sha256-+Ny7pY00ed+kkiFGJw9uy3zg2YfYLtxZsMfCf/ll9lo="
   },
   "syndication": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/syndication-6.26.0.tar.xz",
-    "hash": "sha256-YTC4vJdssHjto0uDPs1VihVrTmvEy1XlesNiyymYukc="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/syndication-6.27.0.tar.xz",
+    "hash": "sha256-4oA266m/lPYkZur/ZvSTBf/53VdqMX3yR01r/lv7x1k="
   },
   "syntax-highlighting": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/syntax-highlighting-6.26.0.tar.xz",
-    "hash": "sha256-pOhtFnzV88QxhYQRlFH4kVUcJM1KD/H375XiR2o5xaw="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/syntax-highlighting-6.27.0.tar.xz",
+    "hash": "sha256-y/8AG58A0DL+slQxPs/umm4KCzxajIKn4IBsXxkVpUU="
   },
   "threadweaver": {
-    "version": "6.26.0",
-    "url": "mirror://kde/stable/frameworks/6.26/threadweaver-6.26.0.tar.xz",
-    "hash": "sha256-rTLa6vrGIHdZCIXzq8S8rBq7xvrrNMILMvYEBkj33hs="
+    "version": "6.27.0",
+    "url": "mirror://kde/stable/frameworks/6.27/threadweaver-6.27.0.tar.xz",
+    "hash": "sha256-a+idQ7TXz9TOUZ7SS4vPhADJO8/G9C2ZMc0PhSJpvcs="
   }
 }
\ No newline at end of file
diff --git a/pkgs/kde/misc/oxygen-icons/default.nix b/pkgs/kde/misc/oxygen-icons/default.nix
deleted file mode 100644
index dcf24a74ef20..000000000000
--- a/pkgs/kde/misc/oxygen-icons/default.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  lib,
-  mkKdeDerivation,
-  fetchurl,
-}:
-mkKdeDerivation rec {
-  pname = "oxygen-icons";
-  version = "6.2.0";
-
-  src = fetchurl {
-    url = "mirror://kde/stable/oxygen-icons/oxygen-icons-${version}.tar.xz";
-    hash = "sha256-Yf0u9W56+7urA0BSAXJkrQDQdMe+BvCFXUyAWly6z90=";
-  };
-
-  dontStrip = true;
-
-  meta.license = [ lib.licenses.lgpl3Plus ];
-}

From fdc4f67163061de1795d877a870ae98508b23227 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 12 Jun 2026 08:01:00 +0000
Subject: [PATCH 45/57] mistral-vibe: 2.13.0 -> 2.14.1

Diff: https://github.com/mistralai/mistral-vibe/compare/v2.13.0...v2.14.1

Changelog: https://github.com/mistralai/mistral-vibe/blob/v2.14.1/CHANGELOG.md
---
 pkgs/by-name/mi/mistral-vibe/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/mistral-vibe/package.nix b/pkgs/by-name/mi/mistral-vibe/package.nix
index 04442dfcfe9c..721ad86d4060 100644
--- a/pkgs/by-name/mi/mistral-vibe/package.nix
+++ b/pkgs/by-name/mi/mistral-vibe/package.nix
@@ -28,7 +28,7 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mistral-vibe";
-  version = "2.13.0";
+  version = "2.14.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -36,7 +36,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "mistralai";
     repo = "mistral-vibe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N4VkqsqcjJfRJwShs5JGyoeGXgc8Ioa0M3UZbO68z0A=";
+    hash = "sha256-Mkz4COMQDQvMZ5rKOYLsIUWFcZfI/dUqpf8z/23YDrY=";
   };
 
   build-system = with python3Packages; [
@@ -70,6 +70,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       httpcore
       httpx
       httpx-sse
+      humanize
       idna
       importlib-metadata
       jaraco-classes

From bc1fa5c8638c255cb783d1f0e915c5e3b1859e69 Mon Sep 17 00:00:00 2001
From: Taimoor Zaeem <taimoorzaeem@gmail.com>
Date: Fri, 12 Jun 2026 13:02:31 +0500
Subject: [PATCH 46/57] postgrest: 14.12 -> 14.13

Release notes:
https://github.com/PostgREST/postgrest/releases/tag/v14.13
---
 pkgs/development/haskell-modules/configuration-common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 460cdc6dad5e..a00cc0cdb399 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -2530,12 +2530,12 @@ with haskellLib;
         doJailbreak
         # 2022-12-02: Hackage release lags behind actual releases: https://github.com/PostgREST/postgrest/issues/2275
         (overrideSrc rec {
-          version = "14.12";
+          version = "14.13";
           src = pkgs.fetchFromGitHub {
             owner = "PostgREST";
             repo = "postgrest";
             rev = "v${version}";
-            hash = "sha256-9Y14sDjHf51qv78DGIrcoU1S/nSHOhc6lGM9wRlegMs=";
+            hash = "sha256-F34fAoNBcww9n6MsxYTjuBorOMcFzmo8nEj8rRomcrs=";
           };
         })
       ];

From ae0f00e844e4a57156e8814c0347ea2d61e9b2db Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 12 Jun 2026 11:25:18 +0300
Subject: [PATCH 47/57] kdePackages: fix sources order

Gear needs to go later, so gear/kmime wins over frameworks/kmime
---
 pkgs/kde/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/kde/default.nix b/pkgs/kde/default.nix
index 70b140ecf133..58cdeab2dfc8 100644
--- a/pkgs/kde/default.nix
+++ b/pkgs/kde/default.nix
@@ -20,8 +20,8 @@ let
       plasma = import ./plasma { inherit (self) callPackage; };
 
       sets = [
-        "gear"
         "frameworks"
+        "gear"
         "plasma"
       ];
 

From facc06d2dfd2a0fdbbe0aadf6b7adaf991d9c881 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Jun 2026 08:47:53 +0000
Subject: [PATCH 48/57] daktari: 0.0.328 -> 0.0.334

---
 pkgs/by-name/da/daktari/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/da/daktari/package.nix b/pkgs/by-name/da/daktari/package.nix
index aadaa467d2e7..cf10fb7c079b 100644
--- a/pkgs/by-name/da/daktari/package.nix
+++ b/pkgs/by-name/da/daktari/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "daktari";
-  version = "0.0.328";
+  version = "0.0.334";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "genio-learn";
     repo = "daktari";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WTxZTfW4KVACxR3wS9+nDV/pYlCrCu8TBQRVulxqiRo=";
+    hash = "sha256-UmfR64zG7UHTCp1rh0LWoWNqPTaBqrT/eShggrmW2Yg=";
   };
 
   patches = [ ./optional-pyclip.patch ];

From 3ceb28928eee8fe90ab739d697820ffa93910095 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Jun 2026 08:48:59 +0000
Subject: [PATCH 49/57] melos: 7.8.1 -> 7.8.2

---
 pkgs/by-name/me/melos/package.nix       |  4 ++--
 pkgs/by-name/me/melos/pubspec.lock.json | 22 ++++++++++++++++------
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/me/melos/package.nix b/pkgs/by-name/me/melos/package.nix
index 1bf026e12c1b..fffcfb13ef57 100644
--- a/pkgs/by-name/me/melos/package.nix
+++ b/pkgs/by-name/me/melos/package.nix
@@ -5,12 +5,12 @@
 }:
 buildDartApplication (finalAttrs: {
   pname = "melos";
-  version = "7.8.1";
+  version = "7.8.2";
   src = fetchFromGitHub {
     owner = "invertase";
     repo = "melos";
     tag = "melos-v${finalAttrs.version}";
-    hash = "sha256-ApD4F0JljoRKNnRVXZq4c2VFr8ewN1Bf0iKyeC/RF0Q=";
+    hash = "sha256-5HLd0NUaRd0zl8WtTOGX4nHXwzCOOvCQcUW8GmmBqEw=";
   };
 
   patches = [
diff --git a/pkgs/by-name/me/melos/pubspec.lock.json b/pkgs/by-name/me/melos/pubspec.lock.json
index 849179d32320..15f4ee2a3413 100644
--- a/pkgs/by-name/me/melos/pubspec.lock.json
+++ b/pkgs/by-name/me/melos/pubspec.lock.json
@@ -4,21 +4,21 @@
       "dependency": "transitive",
       "description": {
         "name": "_fe_analyzer_shared",
-        "sha256": "563c6992eaeda8625f45b87f6a6a0c547df16565d1c93d8271c7c11057710ca7",
+        "sha256": "1b0e6a07425a3e460666e88bf1c949ccc7bb0116ad562ce94a1eca60fe820725",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "101.0.0"
+      "version": "103.0.0"
     },
     "analyzer": {
       "dependency": "transitive",
       "description": {
         "name": "analyzer",
-        "sha256": "aa6a9365901532864cae51208f2a6bb18dd01972ebead19c431efc848f60080b",
+        "sha256": "61c04d0c1bfed555c681ea079519933f071a5a026578ff73c4ff0df2d3462e5e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "13.1.0"
+      "version": "13.3.0"
     },
     "ansi_styles": {
       "dependency": "transitive",
@@ -134,11 +134,11 @@
       "dependency": "transitive",
       "description": {
         "name": "cli_util",
-        "sha256": "ff6785f7e9e3c38ac98b2fb035701789de90154024a75b6cb926445e83197d1c",
+        "sha256": "5909d2c6b66817222779e1eedc19e0e28b76d1df7bd9856a4792ccb9881df358",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.4.2"
+      "version": "0.5.1"
     },
     "code_builder": {
       "dependency": "transitive",
@@ -200,6 +200,16 @@
       "source": "hosted",
       "version": "3.1.9"
     },
+    "ffi": {
+      "dependency": "transitive",
+      "description": {
+        "name": "ffi",
+        "sha256": "6d7fd89431262d8f3125e81b50d3847a091d846eafcd4fdb88dd06f36d705a45",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.0"
+    },
     "file": {
       "dependency": "transitive",
       "description": {

From 16ce3054f17c35bba0d5780f198f91ee8893ee42 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Jun 2026 08:56:28 +0000
Subject: [PATCH 50/57] stress-ng: 0.21.02 -> 0.21.03

---
 pkgs/by-name/st/stress-ng/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/st/stress-ng/package.nix b/pkgs/by-name/st/stress-ng/package.nix
index c69d507e76c7..32d8ec13be7a 100644
--- a/pkgs/by-name/st/stress-ng/package.nix
+++ b/pkgs/by-name/st/stress-ng/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "stress-ng";
-  version = "0.21.02";
+  version = "0.21.03";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = "stress-ng";
     tag = "V${finalAttrs.version}";
-    hash = "sha256-kRyQCuDarSUkJRqYEj3JAii4JeFlruZe+b5Hz81VVdU=";
+    hash = "sha256-gk66OY9QLDRKf4qQuPnRP0jPz+nArLbTKW5sKKiw5gY=";
   };
 
   postPatch = ''

From baf8c995700c5140135b3e7da60d7b03d98b7fe9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Jun 2026 09:12:46 +0000
Subject: [PATCH 51/57] libretro.mame2003: 0-unstable-2026-05-22 ->
 0-unstable-2026-06-05

---
 pkgs/applications/emulators/libretro/cores/mame2003.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/mame2003.nix b/pkgs/applications/emulators/libretro/cores/mame2003.nix
index 27de92ea2e6e..b9b93ff31f69 100644
--- a/pkgs/applications/emulators/libretro/cores/mame2003.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2003.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003";
-  version = "0-unstable-2026-05-22";
+  version = "0-unstable-2026-06-05";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-libretro";
-    rev = "099c2ef21c67c463a97b9ab19403e58b31c69740";
-    hash = "sha256-D3/d/TzTjK0t4bh6Il9CMfHTHdYgMsQNE52PxjrXeyE=";
+    rev = "299789ce642b34c2679cfd89d7ecf06b09851bc1";
+    hash = "sha256-FX+onEaaQUdcjAvgsrdW0m408oCSXJEJHQncrN2Uk/Y=";
   };
 
   # Fix build with GCC 14

From 34e9e9e4067ef616555ad6247eb3539fa168bc3b Mon Sep 17 00:00:00 2001
From: Seudonym <wk170179@gmail.com>
Date: Thu, 11 Jun 2026 16:41:29 +0530
Subject: [PATCH 52/57] nixos/syncthing: fix defaults config

---
 nixos/modules/services/networking/syncthing.nix | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index dc338f783858..6925950a048f 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -301,7 +301,7 @@ let
     +
       /*
         Now we update the other settings defined in cleanedConfig which are not
-        "folders", "devices", or "guiPasswordFile".
+        "folders", "devices", "guiPasswordFile", or "defaults".
       */
       (lib.pipe cleanedConfig [
         builtins.attrNames
@@ -309,6 +309,7 @@ let
           "folders"
           "devices"
           "guiPasswordFile"
+          "defaults"
         ])
         (map (subOption: ''
           curl -X PUT -d ${
@@ -317,6 +318,19 @@ let
         ''))
         (lib.concatStringsSep "\n")
       ])
+    +
+      # Handle the "defaults" option separately, as it has multiple sub-endpoints.
+      (lib.optionalString (cleanedConfig ? defaults) (
+        lib.pipe cleanedConfig.defaults [
+          builtins.attrNames
+          (map (subOption: ''
+            curl -X PUT -d ${
+              lib.escapeShellArg (builtins.toJSON cleanedConfig.defaults.${subOption})
+            } ${curlAddressArgs "/rest/config/defaults/${subOption}"}
+          ''))
+          (lib.concatStringsSep "\n")
+        ]
+      ))
     +
       # Now we hash the contents of guiPasswordFile and use the result to update the gui password
       (lib.optionalString (cfg.guiPasswordFile != null) ''

From 511068bba9b41efecf67fa3557119e99ebf0bb1e Mon Sep 17 00:00:00 2001
From: Seudonym <wk170179@gmail.com>
Date: Thu, 11 Jun 2026 16:42:15 +0530
Subject: [PATCH 53/57] nixos/tests/syncthing: add defaults test

---
 nixos/tests/all-tests.nix          |  1 +
 nixos/tests/syncthing/defaults.nix | 42 ++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)
 create mode 100644 nixos/tests/syncthing/defaults.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5b17b838e343..96b117c3f9e5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1585,6 +1585,7 @@ in
   sx = runTest ./sx.nix;
   sympa = runTest ./sympa.nix;
   syncthing = runTest ./syncthing/main.nix;
+  syncthing-defaults = runTest ./syncthing/defaults.nix;
   syncthing-folders = runTest ./syncthing/folders.nix;
   syncthing-guiPassword = runTest ./syncthing/guiPassword.nix;
   syncthing-guiPasswordFile = runTest ./syncthing/guiPasswordFile.nix;
diff --git a/nixos/tests/syncthing/defaults.nix b/nixos/tests/syncthing/defaults.nix
new file mode 100644
index 000000000000..cd90d40770e5
--- /dev/null
+++ b/nixos/tests/syncthing/defaults.nix
@@ -0,0 +1,42 @@
+{ lib, pkgs, ... }:
+let
+  expectedPath = "/tmp/syncthing-default";
+in
+{
+  name = "syncthing-defaults";
+  meta.maintainers = with pkgs.lib.maintainers; [ seudonym ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.libxml2
+        pkgs.curl
+      ];
+      services.syncthing = {
+        enable = true;
+        settings.defaults.folder.path = expectedPath;
+      };
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("syncthing.service")
+    machine.wait_for_unit("syncthing-init.service")
+
+    # Get the API key by parsing the config.xml
+    api_key = machine.succeed(
+        "xmllint --xpath 'string(configuration/gui/apikey)' /var/lib/syncthing/.config/syncthing/config.xml"
+    ).strip()
+
+    # Query the defaults/folder endpoint via Syncthing's REST API
+    config = json.loads(machine.succeed(
+        f"curl -Ssf -H 'X-API-Key: {api_key}' http://127.0.0.1:8384/rest/config/defaults/folder"
+    ))
+
+    actual_path = config.get('path')
+    assert actual_path == "${expectedPath}", f"Default folder path is '{actual_path}', but expected '${expectedPath}'"
+    machine.log(f"Success: Default folder path is correctly set to '{actual_path}'")
+  '';
+}

From f7d047601bfdffd1317d61f75a282dd01fc1878f Mon Sep 17 00:00:00 2001
From: Seudonym <wk170179@gmail.com>
Date: Thu, 11 Jun 2026 19:07:23 +0530
Subject: [PATCH 54/57] nixos/syncthing: use PATCH for config updates

---
 .../manual/release-notes/rl-2611.section.md   |  2 ++
 .../modules/services/networking/syncthing.nix | 19 +++++++++++++------
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 3697b3bb2e3e..64e2c427da94 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -34,6 +34,8 @@
 
 - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.
 
+- The `services.syncthing` module now updates the Syncthing REST API using partial updates (`PATCH`) instead of full replacements (`PUT`) for general settings. Updating these settings was broken and prone to errors after updates, see [#428808](https://github.com/NixOS/nixpkgs/issues/428808) and [#528889](https://github.com/NixOS/nixpkgs/issues/528889). As a result, settings modified manually through the Syncthing Web UI that are not explicitly defined in your Nix configuration will now persist across rebuilds.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 6925950a048f..17594e8db9f9 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -312,7 +312,7 @@ let
           "defaults"
         ])
         (map (subOption: ''
-          curl -X PUT -d ${
+          curl -X PATCH -d ${
             lib.escapeShellArg (builtins.toJSON cleanedConfig.${subOption})
           } ${curlAddressArgs "/rest/config/${subOption}"}
         ''))
@@ -323,11 +323,18 @@ let
       (lib.optionalString (cleanedConfig ? defaults) (
         lib.pipe cleanedConfig.defaults [
           builtins.attrNames
-          (map (subOption: ''
-            curl -X PUT -d ${
-              lib.escapeShellArg (builtins.toJSON cleanedConfig.defaults.${subOption})
-            } ${curlAddressArgs "/rest/config/defaults/${subOption}"}
-          ''))
+          (map (
+            subOption:
+            let
+              # /rest/config/defaults/ignores only supports PUT
+              method = if subOption == "ignores" then "PUT" else "PATCH";
+            in
+            ''
+              curl -X ${method} -d ${
+                lib.escapeShellArg (builtins.toJSON cleanedConfig.defaults.${subOption})
+              } ${curlAddressArgs "/rest/config/defaults/${subOption}"}
+            ''
+          ))
           (lib.concatStringsSep "\n")
         ]
       ))

From 893048f24cba47d8f833a2bf6ba537b8bd351f1c Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 12 Jun 2026 14:46:28 +0300
Subject: [PATCH 55/57] nixos/syncthing: remove `with lib;`

---
 .../modules/services/networking/syncthing.nix | 246 +++++++++---------
 1 file changed, 123 insertions(+), 123 deletions(-)

diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 17594e8db9f9..69d119d88a1d 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -6,15 +6,13 @@
   ...
 }:
 
-with lib;
-
 let
   cfg = config.services.syncthing;
   opt = options.services.syncthing;
   defaultUser = "syncthing";
   defaultGroup = defaultUser;
   settingsFormat = pkgs.formats.json { };
-  cleanedConfig = converge (filterAttrsRecursive (_: v: v != null && v != { })) cfg.settings;
+  cleanedConfig = lib.converge (lib.filterAttrsRecursive (_: v: v != null && v != { })) cfg.settings;
 
   isUnixGui = lib.strings.hasPrefix "unix://" cfg.guiAddress;
 
@@ -35,7 +33,7 @@ let
     else
       "${cfg.guiAddress}${path}";
 
-  devices = mapAttrsToList (
+  devices = lib.mapAttrsToList (
     _: device:
     device
     // {
@@ -45,11 +43,11 @@ let
 
   anyAutoAccept = builtins.any (dev: dev.autoAcceptFolders) devices;
 
-  folders = mapAttrsToList (
+  folders = lib.mapAttrsToList (
     _: folder:
     folder
     //
-      throwIf (folder ? rescanInterval || folder ? watch || folder ? watchDelay)
+      lib.throwIf (folder ? rescanInterval || folder ? watch || folder ? watchDelay)
         ''
           The options services.syncthing.settings.folders.<name>.{rescanInterval,watch,watchDelay}
           were removed. Please use, respectively, {rescanIntervalS,fsWatcherEnabled,fsWatcherDelayS} instead.
@@ -69,7 +67,7 @@ let
                 throw "Invalid type for devices in folder '${folderName}'; expected list or attrset."
             ) folderDevices;
         }
-  ) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);
+  ) (lib.filterAttrs (_: folder: folder.enable) cfg.settings.folders);
 
   jq = "${pkgs.jq}/bin/jq";
   grep = lib.getExe pkgs.gnugrep;
@@ -179,7 +177,7 @@ let
         [
           # Now for each of these attributes, write the curl commands that are
           # identical to both folders and devices.
-          (mapAttrs (
+          (lib.mapAttrs (
             conf_type: s:
             # We iterate the `conf` list now, and run a curl -X POST command for each, that
             # should update that device/folder only.
@@ -358,10 +356,10 @@ in
   options = {
     services.syncthing = {
 
-      enable = mkEnableOption "Syncthing, a self-hosted open-source alternative to Dropbox and Bittorrent Sync";
+      enable = lib.mkEnableOption "Syncthing, a self-hosted open-source alternative to Dropbox and Bittorrent Sync";
 
-      cert = mkOption {
-        type = types.nullOr types.str;
+      cert = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Path to the `cert.pem` file, which will be copied into Syncthing's
@@ -369,8 +367,8 @@ in
         '';
       };
 
-      key = mkOption {
-        type = types.nullOr types.str;
+      key = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Path to the `key.pem` file, which will be copied into Syncthing's
@@ -378,16 +376,16 @@ in
         '';
       };
 
-      guiPasswordFile = mkOption {
-        type = types.nullOr types.str;
+      guiPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Path to file containing the plaintext password for Syncthing's GUI.
         '';
       };
 
-      overrideDevices = mkOption {
-        type = types.bool;
+      overrideDevices = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to delete the devices which are not configured via the
@@ -397,10 +395,10 @@ in
         '';
       };
 
-      overrideFolders = mkOption {
-        type = types.bool;
+      overrideFolders = lib.mkOption {
+        type = lib.types.bool;
         default = !anyAutoAccept;
-        defaultText = literalMD ''
+        defaultText = lib.literalMD ''
           `true` unless any device has the
           [autoAcceptFolders](#opt-services.syncthing.settings.devices._name_.autoAcceptFolders)
           option set to `true`.
@@ -413,47 +411,47 @@ in
         '';
       };
 
-      settings = mkOption {
-        type = types.submodule {
+      settings = lib.mkOption {
+        type = lib.types.submodule {
           freeformType = settingsFormat.type;
           options = {
             # global options
-            options = mkOption {
+            options = lib.mkOption {
               default = { };
               description = ''
                 The options element contains all other global configuration options
               '';
-              type = types.submodule (
-                { name, ... }:
+              type = lib.types.submodule (
+                { ... }:
                 {
                   freeformType = settingsFormat.type;
                   options = {
-                    localAnnounceEnabled = mkOption {
-                      type = types.nullOr types.bool;
+                    localAnnounceEnabled = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                       default = null;
                       description = ''
                         Whether to send announcements to the local LAN, also use such announcements to find other devices.
                       '';
                     };
 
-                    localAnnouncePort = mkOption {
-                      type = types.nullOr types.port;
+                    localAnnouncePort = lib.mkOption {
+                      type = lib.types.nullOr lib.types.port;
                       default = null;
                       description = ''
                         The port on which to listen and send IPv4 broadcast announcements to.
                       '';
                     };
 
-                    relaysEnabled = mkOption {
-                      type = types.nullOr types.bool;
+                    relaysEnabled = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                       default = null;
                       description = ''
                         When true, relays will be connected to and potentially used for device to device connections.
                       '';
                     };
 
-                    urAccepted = mkOption {
-                      type = types.nullOr types.int;
+                    urAccepted = lib.mkOption {
+                      type = lib.types.nullOr lib.types.int;
                       default = null;
                       description = ''
                         Whether the user has accepted to submit anonymous usage data.
@@ -462,16 +460,16 @@ in
                       '';
                     };
 
-                    limitBandwidthInLan = mkOption {
-                      type = types.nullOr types.bool;
+                    limitBandwidthInLan = lib.mkOption {
+                      type = lib.types.nullOr lib.types.bool;
                       default = null;
                       description = ''
                         Whether to apply bandwidth limits to devices in the same broadcast domain as the local device.
                       '';
                     };
 
-                    maxFolderConcurrency = mkOption {
-                      type = types.nullOr types.int;
+                    maxFolderConcurrency = lib.mkOption {
+                      type = lib.types.nullOr lib.types.int;
                       default = null;
                       description = ''
                         This option controls how many folders may concurrently be in I/O-intensive operations such as syncing or scanning.
@@ -484,7 +482,7 @@ in
             };
 
             # device settings
-            devices = mkOption {
+            devices = lib.mkOption {
               default = { };
               description = ''
                 Peers/devices which Syncthing should communicate with.
@@ -499,30 +497,30 @@ in
                   addresses = [ "tcp://192.168.0.10:51820" ];
                 };
               };
-              type = types.attrsOf (
-                types.submodule (
+              type = lib.types.attrsOf (
+                lib.types.submodule (
                   { name, ... }:
                   {
                     freeformType = settingsFormat.type;
                     options = {
 
-                      name = mkOption {
-                        type = types.str;
+                      name = lib.mkOption {
+                        type = lib.types.str;
                         default = name;
                         description = ''
                           The name of the device.
                         '';
                       };
 
-                      id = mkOption {
-                        type = types.str;
+                      id = lib.mkOption {
+                        type = lib.types.str;
                         description = ''
                           The device ID. See <https://docs.syncthing.net/dev/device-ids.html>.
                         '';
                       };
 
-                      autoAcceptFolders = mkOption {
-                        type = types.bool;
+                      autoAcceptFolders = lib.mkOption {
+                        type = lib.types.bool;
                         default = false;
                         description = ''
                           Automatically create or share folders that this device advertises at the default path.
@@ -537,7 +535,7 @@ in
             };
 
             # folder settings
-            folders = mkOption {
+            folders = lib.mkOption {
               default = { };
               description = ''
                 Folders which should be shared by Syncthing.
@@ -546,7 +544,7 @@ in
                 will be reverted on restart if [overrideFolders](#opt-services.syncthing.overrideFolders)
                 is enabled.
               '';
-              example = literalExpression ''
+              example = lib.literalExpression ''
                 {
                   "/home/user/sync" = {
                     id = "syncme";
@@ -554,15 +552,15 @@ in
                   };
                 }
               '';
-              type = types.attrsOf (
-                types.submodule (
+              type = lib.types.attrsOf (
+                lib.types.submodule (
                   { name, ... }:
                   {
                     freeformType = settingsFormat.type;
                     options = {
 
-                      enable = mkOption {
-                        type = types.bool;
+                      enable = lib.mkOption {
+                        type = lib.types.bool;
                         default = true;
                         description = ''
                           Whether to share this folder.
@@ -571,12 +569,12 @@ in
                         '';
                       };
 
-                      path = mkOption {
+                      path = lib.mkOption {
                         # TODO for release 23.05: allow relative paths again and set
                         # working directory to cfg.dataDir
-                        type = types.str // {
-                          check = x: types.str.check x && (substring 0 1 x == "/" || substring 0 2 x == "~/");
-                          description = types.str.description + " starting with / or ~/";
+                        type = lib.types.str // {
+                          check = x: lib.types.str.check x && (lib.substring 0 1 x == "/" || lib.substring 0 2 x == "~/");
+                          description = lib.types.str.description + " starting with / or ~/";
                         };
                         default = name;
                         description = ''
@@ -587,24 +585,24 @@ in
                         '';
                       };
 
-                      id = mkOption {
-                        type = types.str;
+                      id = lib.mkOption {
+                        type = lib.types.str;
                         default = name;
                         description = ''
                           The ID of the folder. Must be the same on all devices.
                         '';
                       };
 
-                      label = mkOption {
-                        type = types.str;
+                      label = lib.mkOption {
+                        type = lib.types.str;
                         default = name;
                         description = ''
                           The label of the folder.
                         '';
                       };
 
-                      type = mkOption {
-                        type = types.enum [
+                      type = lib.mkOption {
+                        type = lib.types.enum [
                           "sendreceive"
                           "sendonly"
                           "receiveonly"
@@ -617,17 +615,17 @@ in
                         '';
                       };
 
-                      devices = mkOption {
-                        type = types.listOf (
-                          types.oneOf [
-                            types.str
-                            (types.submodule (
+                      devices = lib.mkOption {
+                        type = lib.types.listOf (
+                          lib.types.oneOf [
+                            lib.types.str
+                            (lib.types.submodule (
                               { ... }:
                               {
                                 freeformType = settingsFormat.type;
                                 options = {
-                                  name = mkOption {
-                                    type = types.str;
+                                  name = lib.mkOption {
+                                    type = lib.types.str;
                                     default = null;
                                     description = ''
                                       The name of a device defined in the
@@ -635,8 +633,8 @@ in
                                       option.
                                     '';
                                   };
-                                  encryptionPasswordFile = mkOption {
-                                    type = types.nullOr types.externalPath;
+                                  encryptionPasswordFile = lib.mkOption {
+                                    type = lib.types.nullOr lib.types.externalPath;
                                     default = null;
                                     description = ''
                                       Path to encryption password. If set, the file will be read during
@@ -658,14 +656,14 @@ in
                         '';
                       };
 
-                      versioning = mkOption {
+                      versioning = lib.mkOption {
                         default = null;
                         description = ''
                           How to keep changed/deleted files with Syncthing.
                           There are 4 different types of versioning with different parameters.
                           See <https://docs.syncthing.net/users/versioning.html>.
                         '';
-                        example = literalExpression ''
+                        example = lib.literalExpression ''
                           [
                             {
                               versioning = {
@@ -701,13 +699,12 @@ in
                             }
                           ]
                         '';
-                        type =
-                          with types;
-                          nullOr (submodule {
+                        type = lib.types.nullOr (
+                          lib.types.submodule {
                             freeformType = settingsFormat.type;
                             options = {
-                              type = mkOption {
-                                type = enum [
+                              type = lib.mkOption {
+                                type = lib.types.enum [
                                   "external"
                                   "simple"
                                   "staggered"
@@ -719,11 +716,12 @@ in
                                 '';
                               };
                             };
-                          });
+                          }
+                        );
                       };
 
-                      copyOwnershipFromParent = mkOption {
-                        type = types.bool;
+                      copyOwnershipFromParent = lib.mkOption {
+                        type = lib.types.bool;
                         default = false;
                         description = ''
                           On Unix systems, tries to copy file/folder ownership from the parent directory (the directory it’s located in).
@@ -731,8 +729,8 @@ in
                         '';
                       };
 
-                      ignorePatterns = mkOption {
-                        type = types.nullOr (types.listOf types.str);
+                      ignorePatterns = lib.mkOption {
+                        type = lib.types.nullOr (lib.types.listOf lib.types.str);
                         default = null;
                         description = ''
                           Syncthing can be configured to ignore certain files in a folder using ignore patterns.
@@ -792,8 +790,8 @@ in
         };
       };
 
-      guiAddress = mkOption {
-        type = types.str;
+      guiAddress = lib.mkOption {
+        type = lib.types.str;
         default = "127.0.0.1:8384";
         apply = x: if lib.strings.hasPrefix "/" x then "unix://${x}" else x;
         description = ''
@@ -801,16 +799,16 @@ in
         '';
       };
 
-      systemService = mkOption {
-        type = types.bool;
+      systemService = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Whether to auto-launch Syncthing as a system service.
         '';
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = defaultUser;
         example = "yourUser";
         description = ''
@@ -820,8 +818,8 @@ in
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = defaultGroup;
         example = "yourGroup";
         description = ''
@@ -830,8 +828,8 @@ in
         '';
       };
 
-      all_proxy = mkOption {
-        type = with types; nullOr str;
+      all_proxy = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "socks5://address.com:1234";
         description = ''
@@ -842,8 +840,8 @@ in
         '';
       };
 
-      dataDir = mkOption {
-        type = types.path;
+      dataDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/syncthing";
         example = "/home/yourUser";
         description = ''
@@ -853,15 +851,15 @@ in
 
       configDir =
         let
-          cond = versionAtLeast config.system.stateVersion "19.03";
+          cond = lib.versionAtLeast config.system.stateVersion "19.03";
         in
-        mkOption {
-          type = types.path;
+        lib.mkOption {
+          type = lib.types.path;
           description = ''
             The path where the settings and keys will exist.
           '';
-          default = cfg.dataDir + optionalString cond "/.config/syncthing";
-          defaultText = literalMD ''
+          default = cfg.dataDir + lib.optionalString cond "/.config/syncthing";
+          defaultText = lib.literalMD ''
             * if `stateVersion >= 19.03`:
 
                   config.${opt.dataDir} + "/.config/syncthing"
@@ -871,17 +869,17 @@ in
           '';
         };
 
-      databaseDir = mkOption {
-        type = types.path;
+      databaseDir = lib.mkOption {
+        type = lib.types.path;
         description = ''
           The directory containing the database and logs.
         '';
         default = cfg.configDir;
-        defaultText = literalExpression "config.${opt.configDir}";
+        defaultText = lib.literalExpression "config.${opt.configDir}";
       };
 
-      extraFlags = mkOption {
-        type = types.listOf types.str;
+      extraFlags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "--reset-deltas" ];
         description = ''
@@ -889,8 +887,8 @@ in
         '';
       };
 
-      openDefaultPorts = mkOption {
-        type = types.bool;
+      openDefaultPorts = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         example = true;
         description = ''
@@ -904,35 +902,37 @@ in
         '';
       };
 
-      package = mkPackageOption pkgs "syncthing" { };
+      package = lib.mkPackageOption pkgs "syncthing" { };
     };
   };
 
   imports = [
-    (mkRemovedOptionModule [ "services" "syncthing" "useInotify" ] ''
+    (lib.mkRemovedOptionModule [ "services" "syncthing" "useInotify" ] ''
       This option was removed because Syncthing now has the inotify functionality included under the name "fswatcher".
       It can be enabled on a per-folder basis through the web interface.
     '')
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "extraOptions" ]
       [ "services" "syncthing" "settings" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "folders" ]
       [ "services" "syncthing" "settings" "folders" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "devices" ]
       [ "services" "syncthing" "settings" "devices" ]
     )
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "syncthing" "options" ]
       [ "services" "syncthing" "settings" "options" ]
     )
   ]
   ++
     map
-      (o: mkRenamedOptionModule [ "services" "syncthing" "declarative" o ] [ "services" "syncthing" o ])
+      (
+        o: lib.mkRenamedOptionModule [ "services" "syncthing" "declarative" o ] [ "services" "syncthing" o ]
+      )
       [
         "cert"
         "key"
@@ -945,7 +945,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = !(cfg.overrideFolders && anyAutoAccept);
@@ -962,7 +962,7 @@ in
       }
     ];
 
-    networking.firewall = mkIf cfg.openDefaultPorts {
+    networking.firewall = lib.mkIf cfg.openDefaultPorts {
       allowedTCPPorts = [ 22000 ];
       allowedUDPPorts = [
         21027
@@ -973,7 +973,7 @@ in
     environment.systemPackages = [ cfg.package ];
     systemd.packages = [ cfg.package ];
 
-    users.users = mkIf (cfg.systemService && cfg.user == defaultUser) {
+    users.users = lib.mkIf (cfg.systemService && cfg.user == defaultUser) {
       ${defaultUser} = {
         group = cfg.group;
         home = cfg.dataDir;
@@ -983,14 +983,14 @@ in
       };
     };
 
-    users.groups = mkIf (cfg.systemService && cfg.group == defaultGroup) {
+    users.groups = lib.mkIf (cfg.systemService && cfg.group == defaultGroup) {
       ${defaultGroup}.gid = config.ids.gids.syncthing;
     };
 
     systemd.services = {
       # upstream reference:
       # https://github.com/syncthing/syncthing/blob/main/etc/linux-systemd/system/syncthing%40.service
-      syncthing = mkIf cfg.systemService {
+      syncthing = lib.mkIf cfg.systemService {
         description = "Syncthing service";
         after = [ "network.target" ];
         environment = {
@@ -1007,13 +1007,13 @@ in
           User = cfg.user;
           Group = cfg.group;
           ExecStartPre =
-            mkIf (cfg.cert != null || cfg.key != null)
+            lib.mkIf (cfg.cert != null || cfg.key != null)
               "+${pkgs.writers.writeBash "syncthing-copy-keys" ''
                 install -dm700 -o ${cfg.user} -g ${cfg.group} ${cfg.configDir}
-                ${optionalString (cfg.cert != null) ''
+                ${lib.optionalString (cfg.cert != null) ''
                   install -Dm644 -o ${cfg.user} -g ${cfg.group} ${toString cfg.cert} ${cfg.configDir}/cert.pem
                 ''}
-                ${optionalString (cfg.key != null) ''
+                ${lib.optionalString (cfg.key != null) ''
                   install -Dm600 -o ${cfg.user} -g ${cfg.group} ${toString cfg.key} ${cfg.configDir}/key.pem
                 ''}
               ''}";
@@ -1055,7 +1055,7 @@ in
           ];
         };
       };
-      syncthing-init = mkIf (cleanedConfig != { }) {
+      syncthing-init = lib.mkIf (cleanedConfig != { }) {
         description = "Syncthing configuration updater";
         requisite = [ "syncthing.service" ];
         after = [ "syncthing.service" ];

From 95e51031b49ab828a3238cf70b051ae80ec93da4 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 12 Jun 2026 14:49:16 +0300
Subject: [PATCH 56/57] nixos/syncthing: remove old, not evaluating well
 deprecation message

The `folderType` variable wasn't evaluating even if the message would
have been thrown.
---
 .../modules/services/networking/syncthing.nix | 29 +++----------------
 1 file changed, 4 insertions(+), 25 deletions(-)

diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 69d119d88a1d..3ee231fcbc3b 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -43,31 +43,10 @@ let
 
   anyAutoAccept = builtins.any (dev: dev.autoAcceptFolders) devices;
 
-  folders = lib.mapAttrsToList (
-    _: folder:
-    folder
-    //
-      lib.throwIf (folder ? rescanInterval || folder ? watch || folder ? watchDelay)
-        ''
-          The options services.syncthing.settings.folders.<name>.{rescanInterval,watch,watchDelay}
-          were removed. Please use, respectively, {rescanIntervalS,fsWatcherEnabled,fsWatcherDelayS} instead.
-        ''
-        {
-          devices =
-            let
-              folderDevices = folder.devices;
-            in
-            map (
-              device:
-              if builtins.isString device then
-                { deviceId = cfg.settings.devices.${device}.id; }
-              else if builtins.isAttrs device then
-                { deviceId = cfg.settings.devices.${device.name}.id; } // device
-              else
-                throw "Invalid type for devices in folder '${folderName}'; expected list or attrset."
-            ) folderDevices;
-        }
-  ) (lib.filterAttrs (_: folder: folder.enable) cfg.settings.folders);
+  folders = lib.pipe cfg.settings.folders [
+    (lib.filterAttrs (_: folder: folder.enable))
+    builtins.attrValues
+  ];
 
   jq = "${pkgs.jq}/bin/jq";
   grep = lib.getExe pkgs.gnugrep;

From c13c604a7a04e9c41524b6330d14a05c266a5197 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 12 Jun 2026 14:49:55 +0300
Subject: [PATCH 57/57] nixos/syncthing: add maintainers

---
 nixos/modules/services/networking/syncthing.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 3ee231fcbc3b..b96718675e15 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -1050,4 +1050,9 @@ in
       };
     };
   };
+
+  meta.maintainers = with lib.maintainers; [
+    doronbehar
+    seudonym
+  ];
 }