From 3fdc01e32a470d5e752e71b3af795e725b52ff3e Mon Sep 17 00:00:00 2001
From: jf-uu <181011550+jf-uu@users.noreply.github.com>
Date: Wed, 16 Apr 2025 18:36:19 +0100
Subject: [PATCH 01/54] maintainers: add jf-uu

---
 maintainers/maintainer-list.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 005baf03646b..749447a8b429 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11777,6 +11777,11 @@
     name = "Jez Cope";
     keys = [ { fingerprint = "D9DA 3E47 E8BD 377D A317  B3D0 9E42 CE07 1C45 59D1"; } ];
   };
+  jf-uu = {
+    github = "jf-uu";
+    githubId = 181011550;
+    name = "jf-uu";
+  };
   jfchevrette = {
     email = "jfchevrette@gmail.com";
     github = "jfchevrette";

From 6ff8139859648a7e585b5b36d092f2c5470149ad Mon Sep 17 00:00:00 2001
From: Jared Baur <jaredbaur@fastmail.com>
Date: Sat, 18 Jan 2025 13:44:04 -0800
Subject: [PATCH 02/54] 3cpio: init at 0.8.0

---
 pkgs/by-name/_3/_3cpio/package.nix | 36 ++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 pkgs/by-name/_3/_3cpio/package.nix

diff --git a/pkgs/by-name/_3/_3cpio/package.nix b/pkgs/by-name/_3/_3cpio/package.nix
new file mode 100644
index 000000000000..cd9020c80f60
--- /dev/null
+++ b/pkgs/by-name/_3/_3cpio/package.nix
@@ -0,0 +1,36 @@
+{
+  fetchFromGitHub,
+  lib,
+  lz4,
+  lzop,
+  nix-update-script,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "3cpio";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "bdrung";
+    repo = "3cpio";
+    tag = version;
+    hash = "sha256-1kdJSwe9v7ojdukj04/G/RDeEk0NVCXmiNoVaelqt4Y=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-axPghG1T5NZYzGRZBwtdBJ5tQh+h8/vep/EmL5ADCjE=";
+
+  # Tests attempt to access arbitrary filepaths
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Manage initrd cpio archives";
+    homepage = "https://github.com/bdrung/3cpio";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.jmbaur ];
+    mainProgram = "3cpio";
+  };
+}

From 4604f8e1159f941dd5b0fd3f23a7d2f9f3d5f780 Mon Sep 17 00:00:00 2001
From: Jared Baur <jaredbaur@fastmail.com>
Date: Mon, 25 Sep 2023 21:41:28 -0700
Subject: [PATCH 03/54] ubootBananaPim2Zero: init at 2023.07.02

Adds the upstream uboot (w/SPL) for the bananapi m2 zero board.
---
 pkgs/misc/uboot/default.nix     | 6 ++++++
 pkgs/top-level/all-packages.nix | 1 +
 2 files changed, 7 insertions(+)

diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 8142ede3407d..eb76c47ec192 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -236,6 +236,12 @@ in
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
+  ubootBananaPim2Zero = buildUBoot {
+    defconfig = "bananapi_m2_zero_defconfig";
+    filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
+    extraMeta.platforms = [ "armv7l-linux" ];
+  };
+
   ubootBananaPim3 = buildUBoot {
     defconfig = "Sinovoip_BPI_M3_defconfig";
     extraMeta.platforms = [ "armv7l-linux" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a523101ce1ec..f36a777ee9fb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11305,6 +11305,7 @@ with pkgs;
     ubootA20OlinuxinoLime
     ubootA20OlinuxinoLime2EMMC
     ubootBananaPi
+    ubootBananaPim2Zero
     ubootBananaPim3
     ubootBananaPim64
     ubootAmx335xEVM

From d8c6eaa95b775101ac7a7060137aae356008f910 Mon Sep 17 00:00:00 2001
From: Jared Baur <jaredbaur@fastmail.com>
Date: Thu, 9 Nov 2023 14:40:43 -0800
Subject: [PATCH 04/54] ubootTools: add `mkeficapsule` to installed tools

This tool is useful for generating UEFI capsule files that can be
consumed by u-boot for firmware updates.
---
 pkgs/misc/uboot/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 8142ede3407d..051bfd3500d6 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -199,6 +199,7 @@ in
       "tools/mkenvimage"
       "tools/mkimage"
       "tools/env/fw_printenv"
+      "tools/mkeficapsule"
     ];
 
     pythonScriptsToInstall = {

From 4b81ba62e708592cfa7b9e017f2fe28ff498c27e Mon Sep 17 00:00:00 2001
From: jf-uu <181011550+jf-uu@users.noreply.github.com>
Date: Wed, 16 Apr 2025 18:52:20 +0100
Subject: [PATCH 05/54] overseerr: init at 1.34.0

---
 pkgs/by-name/ov/overseerr/package.nix | 73 +++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 pkgs/by-name/ov/overseerr/package.nix

diff --git a/pkgs/by-name/ov/overseerr/package.nix b/pkgs/by-name/ov/overseerr/package.nix
new file mode 100644
index 000000000000..b3933754c950
--- /dev/null
+++ b/pkgs/by-name/ov/overseerr/package.nix
@@ -0,0 +1,73 @@
+{
+  fetchFromGitHub,
+  fetchYarnDeps,
+  lib,
+  makeWrapper,
+  node-gyp,
+  node-pre-gyp,
+  nodejs,
+  python3,
+  stdenv,
+  yarnBuildHook,
+  yarnConfigHook,
+  yarnInstallHook,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "overseerr";
+  version = "1.34.0";
+
+  src = fetchFromGitHub {
+    owner = "sct";
+    repo = "overseerr";
+    tag = "v${version}";
+    hash = "sha256-4332XsupUGjkFo0+4wn2fUyK5/y6EQoPaAuayBH/myk=";
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${src}/yarn.lock";
+    hash = "sha256-f30P+/DxDz9uBmdgvaYK4YOAUmVce8MUnNHBXr8/yKc=";
+  };
+
+  env.CYPRESS_INSTALL_BINARY = 0;
+
+  nativeBuildInputs = [
+    makeWrapper
+    node-gyp
+    node-pre-gyp
+    nodejs
+    python3
+    yarnBuildHook
+    yarnConfigHook
+    yarnInstallHook
+  ];
+
+  postInstall = ''
+    # Fixes "Error: Cannot find module" (bcrypt) and "SQLite package has not been found installed".
+    pushd $out/lib/node_modules/overseerr/node_modules
+    for module in bcrypt sqlite3; do
+      pushd $module
+      node-pre-gyp rebuild --build-from-source --nodedir=${nodejs} --prefer-offline
+      popd
+    done
+
+    makeWrapper "${lib.getExe nodejs}" "$out/bin/overseerr" \
+      --set NODE_ENV production \
+      --chdir "$out/lib/node_modules/overseerr" \
+      --add-flags "dist/index.js" \
+      --add-flags "--"
+  '';
+
+  meta = {
+    badPlatforms = [
+      # FileNotFoundError: [Errno 2] No such file or directory: 'xcodebuild'
+      lib.systems.inspect.patterns.isDarwin
+    ];
+    changelog = "https://github.com/sct/overseerr/releases/tag/v${version}";
+    description = "Request management and media discovery tool for the Plex ecosystem";
+    homepage = "https://github.com/sct/overseerr";
+    license = lib.licenses.mit;
+    mainProgram = "overseerr";
+    maintainers = with lib.maintainers; [ jf-uu ];
+  };
+}

From 50b7400d9343a1bd52e3f8b3f63318441111c403 Mon Sep 17 00:00:00 2001
From: jf-uu <181011550+jf-uu@users.noreply.github.com>
Date: Wed, 16 Jul 2025 14:09:05 +0100
Subject: [PATCH 06/54] nixos/overseerr: init

Co-authored-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
---
 .../manual/release-notes/rl-2511.section.md   |  2 +
 nixos/modules/module-list.nix                 |  1 +
 nixos/modules/services/misc/overseerr.nix     | 89 +++++++++++++++++++
 nixos/tests/all-tests.nix                     |  1 +
 nixos/tests/overseerr.nix                     | 20 +++++
 5 files changed, 113 insertions(+)
 create mode 100644 nixos/modules/services/misc/overseerr.nix
 create mode 100644 nixos/tests/overseerr.nix

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index ea72486c0273..c4c4735227a4 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -16,6 +16,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as [services.overseerr](#opt-services.overseerr.enable).
+
 - [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).
 - [Chrysalis](https://github.com/keyboardio/Chrysalis), a graphical configurator for Kaleidoscope-powered keyboards. Available as [programs.chrysalis](#opt-programs.chrysalis.enable).
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0ec81e5bcb7b..d37d7d5f4380 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -878,6 +878,7 @@
   ./services/misc/open-webui.nix
   ./services/misc/orthanc.nix
   ./services/misc/osrm.nix
+  ./services/misc/overseerr.nix
   ./services/misc/owncast.nix
   ./services/misc/packagekit.nix
   ./services/misc/paperless.nix
diff --git a/nixos/modules/services/misc/overseerr.nix b/nixos/modules/services/misc/overseerr.nix
new file mode 100644
index 000000000000..3ea8cc26eb28
--- /dev/null
+++ b/nixos/modules/services/misc/overseerr.nix
@@ -0,0 +1,89 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.overseerr;
+in
+{
+  meta.maintainers = [ lib.maintainers.jf-uu ];
+
+  options.services.overseerr = {
+    enable = lib.mkEnableOption "Overseerr, a request management and media discovery tool for the Plex ecosystem";
+
+    package = lib.mkPackageOption pkgs "overseerr" { };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Open a port in the firewall for the Overseerr web interface.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 5055;
+      description = "The port which the Overseerr web UI should listen on.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.overseerr = {
+      description = "Request management and media discovery tool for the Plex ecosystem";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        CONFIG_DIRECTORY = "/var/lib/overseerr";
+        PORT = toString cfg.port;
+      };
+      serviceConfig = {
+        CapabilityBoundingSet = "";
+        DynamicUser = true;
+        ExecStart = lib.getExe cfg.package;
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateIPC = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        Restart = "on-failure";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        StateDirectory = "overseerr";
+        StateDirectoryMode = "0700";
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        Type = "exec";
+      };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 7aa2dbdbdaf5..102f92b3642a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -688,6 +688,7 @@ in
     _module.args.package = pkgs.odoo16;
   };
   oncall = runTest ./web-apps/oncall.nix;
+  overseerr = runTest ./overseerr.nix;
   # 9pnet_virtio used to mount /nix partition doesn't support
   # hibernation. This test happens to work on x86_64-linux but
   # not on other platforms.
diff --git a/nixos/tests/overseerr.nix b/nixos/tests/overseerr.nix
new file mode 100644
index 000000000000..f6e38b5d746c
--- /dev/null
+++ b/nixos/tests/overseerr.nix
@@ -0,0 +1,20 @@
+{ lib, pkgs, ... }:
+{
+  name = "overseerr";
+  meta.maintainers = with lib.maintainers; [ jf-uu ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.jq ];
+      services.overseerr.enable = true;
+    };
+
+  testScript = ''
+    machine.wait_for_unit("overseerr.service")
+    machine.wait_for_open_port(5055)
+
+    version = machine.succeed("curl --fail http://localhost:5055/api/v1/status | jq --raw-output .version").rstrip("\n")
+    assert version == "${pkgs.overseerr.version}", f"expected version to be ${pkgs.overseerr.version}, got {version}"
+  '';
+}

From 6d8da589c38611c8a1d9e73f007c499bd2d5f7ef Mon Sep 17 00:00:00 2001
From: qubitnano <146656568+qubitnano@users.noreply.github.com>
Date: Wed, 23 Jul 2025 21:16:54 -0400
Subject: [PATCH 07/54] mongodb-6_0: drop

https://www.mongodb.com/legal/support-policy/lifecycles

mongodb-6_0 is end of life on 2025-07-31
---
 doc/release-notes/rl-2511.section.md          |  2 +
 pkgs/servers/nosql/mongodb/6.0.nix            | 39 -------------------
 .../nosql/mongodb/fix-gcc-13-ctype-6_0.patch  | 12 ------
 pkgs/top-level/aliases.nix                    |  1 +
 pkgs/top-level/all-packages.nix               |  5 ---
 5 files changed, 3 insertions(+), 56 deletions(-)
 delete mode 100644 pkgs/servers/nosql/mongodb/6.0.nix
 delete mode 100644 pkgs/servers/nosql/mongodb/fix-gcc-13-ctype-6_0.patch

diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 123b11f4717b..a57f0ed106a1 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -37,6 +37,8 @@
 
 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.
 
+- `mongodb-6_0` was removed as it is end of life as of 2025-07-31.
+
 - `vmware-horizon-client` was renamed to `omnissa-horizon-client`, following [VMware's sale of their end-user business to Omnissa](https://www.omnissa.com/insights/introducing-omnissa-the-former-vmware-end-user-computing-business/). The binary has been renamed from `vmware-view` to `horizon-client`.
 
 - `neovimUtils.makeNeovimConfig` now uses `customLuaRC` parameter instead of accepting `luaRcContent`. The old usage is deprecated but still works with a warning.
diff --git a/pkgs/servers/nosql/mongodb/6.0.nix b/pkgs/servers/nosql/mongodb/6.0.nix
deleted file mode 100644
index 5bd6cf943af8..000000000000
--- a/pkgs/servers/nosql/mongodb/6.0.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  stdenv,
-  callPackage,
-  fetchpatch,
-  sasl,
-  boost,
-  cctools,
-  avxSupport ? stdenv.hostPlatform.avxSupport,
-}:
-
-let
-  buildMongoDB = callPackage ./mongodb.nix {
-    inherit
-      sasl
-      boost
-      cctools
-      stdenv
-      ;
-  };
-in
-buildMongoDB {
-  inherit avxSupport;
-  version = "6.0.24";
-  sha256 = "sha256-5Ip7uulbdb1rTzDWkPQjra035hA01bltPfvqnTm3tDw=";
-  patches = [
-    # Patches a bug that it couldn't build MongoDB 6.0 on gcc 13 because a include in ctype.h was missing
-    ./fix-gcc-13-ctype-6_0.patch
-
-    (fetchpatch {
-      name = "mongodb-6.1.0-rc-more-specific-cache-alignment-types.patch";
-      url = "https://github.com/mongodb/mongo/commit/5435f9585f857f6145beaf6d31daf336453ba86f.patch";
-      sha256 = "sha256-gWlE2b/NyGe2243iNCXzjcERIY8/4ZWI4Gjh5SF0tYA=";
-    })
-
-    # Fix building with python 3.12 since the imp module was removed
-    ./mongodb-python312.patch
-  ];
-  # passthru.tests = { inherit (nixosTests) mongodb; }; # currently tests mongodb-7_0
-}
diff --git a/pkgs/servers/nosql/mongodb/fix-gcc-13-ctype-6_0.patch b/pkgs/servers/nosql/mongodb/fix-gcc-13-ctype-6_0.patch
deleted file mode 100644
index 5473997e56c9..000000000000
--- a/pkgs/servers/nosql/mongodb/fix-gcc-13-ctype-6_0.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/src/mongo/util/ctype.h b/src/mongo/util/ctype.h
-index a3880e2..78ee57e 100644
---- a/src/mongo/util/ctype.h
-+++ b/src/mongo/util/ctype.h
-@@ -67,6 +67,7 @@
- #pragma once
-
- #include <array>
-+#include <cstdint>
-
- namespace mongo::ctype {
- namespace detail {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c95c989ffdae..2e920a582482 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1319,6 +1319,7 @@ mapAliases {
   monero = throw "'monero' has been renamed to/replaced by 'monero-cli'"; # Converted to throw 2024-10-17
   mongodb-4_4 = throw "mongodb-4_4 has been removed, it's end of life since April 2024"; # Added 2024-04-11
   mongodb-5_0 = throw "mongodb-5_0 has been removed, it's end of life since October 2024"; # Added 2024-10-01
+  mongodb-6_0 = throw "mongodb-6_0 has been removed, it's end of life since July 2025"; # Added 2025-07-23
   moz-phab = mozphab; # Added 2022-08-09
   mp3info = throw "'mp3info' has been removed due to lack of maintenance upstream. Consider using 'eartag' or 'tagger' instead"; # Added 2024-09-14
   mp3splt = throw "'mp3splt' has been removed due to lack of maintenance upstream."; # Added 2025-05-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 57dc2156916a..905955c83c55 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10512,11 +10512,6 @@ with pkgs;
 
   mongodb = hiPrio mongodb-7_0;
 
-  mongodb-6_0 = callPackage ../servers/nosql/mongodb/6.0.nix {
-    sasl = cyrus_sasl;
-    boost = boost178.override { enableShared = false; };
-  };
-
   mongodb-7_0 = callPackage ../servers/nosql/mongodb/7.0.nix {
     sasl = cyrus_sasl;
     boost = boost179.override { enableShared = false; };

From 7b787be4ec86ec6e0a75e0f10ec19e218bf5d8e4 Mon Sep 17 00:00:00 2001
From: Davis Schirmer <git@djds.dev>
Date: Sat, 26 Jul 2025 15:11:13 -0400
Subject: [PATCH 08/54] traefik: 3.4.4 -> 3.5.0

https://github.com/traefik/traefik/releases/tag/v3.5.0
---
 pkgs/by-name/tr/traefik/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index ab792f8f5b3e..4cd7576c6730 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -8,16 +8,16 @@
 
 buildGo124Module (finalAttrs: {
   pname = "traefik";
-  version = "3.4.4";
+  version = "3.5.0";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${finalAttrs.version}/traefik-v${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-v9czTMaNcl4Aov6w4+CAM6YQoyIEy90eBfwrnmQVmgQ=";
+    hash = "sha256-xsTf6DASRUlV1dJooZQjIBmdtdeLYZwVTvznZ7LxoZ4=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-y0RibDQF+iG3HCX2FkEqxxn8bsC7zc4rQyRyq8oRgQM=";
+  vendorHash = "sha256-rs68UCXzi4JfZqdJpr4kPqmpfZU4CIC8AK2YCXy0i14=";
 
   subPackages = [ "cmd/traefik" ];
 

From 1d57cdc601753915c8468fc8e41dc1f105c79ec6 Mon Sep 17 00:00:00 2001
From: Dominique Martinet <asmadeus@codewreck.org>
Date: Tue, 29 Jul 2025 18:57:05 +0900
Subject: [PATCH 09/54] rmfakecloud: 0.0.24 -> 0.0.25

fix compat with rm 3.20

See https://github.com/ddvk/rmfakecloud/pull/364

(note it also apparently requires adding eu.tectonic.remarkable.com to the
dozen of other redirected domains in /etc/hosts...
not sure that's worth writing in release notes?)
---
 pkgs/by-name/rm/rmfakecloud/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/rm/rmfakecloud/package.nix b/pkgs/by-name/rm/rmfakecloud/package.nix
index 44a994a66945..b825c908aff0 100644
--- a/pkgs/by-name/rm/rmfakecloud/package.nix
+++ b/pkgs/by-name/rm/rmfakecloud/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "rmfakecloud";
-  version = "0.0.24";
+  version = "0.0.25";
 
   src = fetchFromGitHub {
     owner = "ddvk";
     repo = "rmfakecloud";
     rev = "v${version}";
-    hash = "sha256-ZsYq1+Bb6SyMGdbiy5UzanDiUiFOt4uhttiPKC0ESis=";
+    hash = "sha256-dembIFEoKQEZabsl7oK8rzvV2G7nhmebfw0AGUBanYs=";
   };
 
-  vendorHash = "sha256-S2P80uhX86IVUVEoR4tZ7e6qMe7CK+6bmmjBgjXGZmo=";
+  vendorHash = "sha256-ColOCdKa/sKoLnF/3idBIEyFB2JWYM+1y5TdC/LZT4A=";
 
   # if using webUI build it
   # use env because of https://github.com/NixOS/nixpkgs/issues/358844
@@ -29,7 +29,7 @@ buildGoModule rec {
     sourceRoot = "${src.name}/ui";
     pnpmLock = "${src}/ui/pnpm-lock.yaml";
     fetcherVersion = 1;
-    hash = "sha256-VNmCT4um2W2ii8jAm+KjQSjixYEKoZkw7CeRwErff/o=";
+    hash = "sha256-uywmHN9HWKi0CaqTg9uEio2XCu6ap9v2xtbodW/6b4Q=";
   };
   preBuild = lib.optionals enableWebui ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart

From 6f79a7af3a5dad337aad4313664730ad5c60c66d Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Sat, 2 Aug 2025 14:10:58 +0200
Subject: [PATCH 10/54] Doc/nixosOptionsDoc: fix baseModules cannot be empty

---
 nixos/lib/make-options-doc/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index f49745cf59d4..67c0fb130db1 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -59,9 +59,6 @@
   let
     # Evaluate a NixOS configuration
     eval = import (pkgs.path + "/nixos/lib/eval-config.nix") {
-      # Overridden explicitly here, this would include all modules from NixOS otherwise.
-      # See: docs of eval-config.nix for more details
-      baseModules = [];
       modules = [
         ./module.nix
       ];

From ad91f2783d3f911a3c971569bd24102ad2f86ca6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 3 Aug 2025 09:53:43 +0000
Subject: [PATCH 11/54] python3Packages.textual-autocomplete: 4.0.4 -> 4.0.5

---
 .../python-modules/textual-autocomplete/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/textual-autocomplete/default.nix b/pkgs/development/python-modules/textual-autocomplete/default.nix
index 22ef79217757..5b2768f33090 100644
--- a/pkgs/development/python-modules/textual-autocomplete/default.nix
+++ b/pkgs/development/python-modules/textual-autocomplete/default.nix
@@ -9,13 +9,13 @@
 }:
 buildPythonPackage rec {
   pname = "textual-autocomplete";
-  version = "4.0.4";
+  version = "4.0.5";
   pyproject = true;
 
   src = fetchPypi {
     pname = "textual_autocomplete";
     inherit version;
-    hash = "sha256-CWmYe5ClPB91dT3+OtLH6g2XS1g53CoAotMywAAFeHE=";
+    hash = "sha256-24Bm/H2Hx0r9CDZ/j8IUS87F3b3qY6Y3JJdU6dH9h1U=";
   };
 
   build-system = [

From f26cc7265c80fd6b8035731fd2da6b801914588e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 3 Aug 2025 20:20:35 +0000
Subject: [PATCH 12/54] high-tide: 0.1.7 -> 0.1.8

---
 pkgs/by-name/hi/high-tide/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hi/high-tide/package.nix b/pkgs/by-name/hi/high-tide/package.nix
index f2c5f581a67a..7aabc641e89c 100644
--- a/pkgs/by-name/hi/high-tide/package.nix
+++ b/pkgs/by-name/hi/high-tide/package.nix
@@ -18,14 +18,14 @@
 
 python313Packages.buildPythonApplication rec {
   pname = "high-tide";
-  version = "0.1.7";
+  version = "0.1.8";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "Nokse22";
     repo = "high-tide";
     tag = "v${version}";
-    hash = "sha256-QFa9K/iSPe3cIx90PzPCkJszrygON9ijukv4px3Rob8=";
+    hash = "sha256-QcTK5E8rz/JcC40CCCK8G7PUZ6UAg53UPmxyLBXNHxY=";
   };
 
   nativeBuildInputs = [

From 7d2a2e33dbfb0f250efc3e01911674a2f8bd9f77 Mon Sep 17 00:00:00 2001
From: Jared Baur <jaredbaur@fastmail.com>
Date: Thu, 7 Aug 2025 16:38:00 -0700
Subject: [PATCH 13/54] dropbear: disable wtmp when using musl

WTMP is not available when using musl libc, so disable it in dropbear
builds.
---
 pkgs/by-name/dr/dropbear/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/dr/dropbear/package.nix b/pkgs/by-name/dr/dropbear/package.nix
index 19fdfbb43c88..aa787b877641 100644
--- a/pkgs/by-name/dr/dropbear/package.nix
+++ b/pkgs/by-name/dr/dropbear/package.nix
@@ -32,6 +32,11 @@ stdenv.mkDerivation rec {
     (lib.concatStringsSep " ")
   ];
 
+  configureFlags = lib.optionals stdenv.hostPlatform.isMusl [
+    "--enable-wtmp=no"
+    "--enable-wtmpx=no"
+  ];
+
   # https://www.gnu.org/software/make/manual/html_node/Libraries_002fSearch.html
   preConfigure = ''
     makeFlagsArray=(

From 7ad0253959994872c1fdbfa7f551c5ca55326a48 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 31 Jul 2025 12:59:28 +0200
Subject: [PATCH 14/54] python3Packages.triton-bin: 3.3.1 -> 3.4.0

Diff: https://github.com/triton-lang/triton/compare/v3.3.1...v3.4.0

Changelog: https://github.com/triton-lang/triton/releases/tag/v3.4.0
---
 .../development/python-modules/triton/bin.nix |  4 +-
 .../python-modules/triton/binary-hashes.nix   | 50 +++++++++----------
 2 files changed, 26 insertions(+), 28 deletions(-)

diff --git a/pkgs/development/python-modules/triton/bin.nix b/pkgs/development/python-modules/triton/bin.nix
index 0a8897acb311..7edc81d576a6 100644
--- a/pkgs/development/python-modules/triton/bin.nix
+++ b/pkgs/development/python-modules/triton/bin.nix
@@ -1,12 +1,10 @@
 {
   lib,
   stdenv,
-  addDriverRunpath,
   cudaPackages,
   buildPythonPackage,
   fetchurl,
   python,
-  pythonOlder,
   autoPatchelfHook,
   filelock,
   lit,
@@ -15,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "triton";
-  version = "3.3.1";
+  version = "3.4.0";
   format = "wheel";
 
   src =
diff --git a/pkgs/development/python-modules/triton/binary-hashes.nix b/pkgs/development/python-modules/triton/binary-hashes.nix
index 0d67dc25d465..54eda3494663 100644
--- a/pkgs/development/python-modules/triton/binary-hashes.nix
+++ b/pkgs/development/python-modules/triton/binary-hashes.nix
@@ -7,46 +7,46 @@
 
 version:
 builtins.getAttr version {
-  "3.3.1" = {
+  "3.4.0" = {
     aarch64-linux-310 = {
-      name = "triton-3.3.1-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-nuTCrhQM7ftvnmnlRFf6KIqrbxOP0axLcdqSzfpmCQE=";
+      name = "triton-3.4.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-husMt2NDKM1Xf6UbWTOPGvQZnPmrYjhaxCqCeD2RFqQ=";
     };
     x86_64-linux-310 = {
-      name = "triton-3.3.1-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-t020RbHFYoRNPPrW6Weccuk/37GpCiQFKwO7XEnRJC4=";
+      name = "triton-3.4.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-axdYjFnL4dmHEz6nzRzC5SKeBUSgapkIv69oxh9WSVo=";
     };
     aarch64-linux-311 = {
-      name = "triton-3.3.1-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-1OMWwp3LUQPc/N+Y3o+huRwL+yYhisV37MwwWFrftg0=";
+      name = "triton-3.4.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-3Y0y0zf1gST+JUBD0oKkvBM8Ksp5ibxjWLLFRtISFRM=";
     };
     x86_64-linux-311 = {
-      name = "triton-3.3.1-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-sx46om+Ms8xb9OGHv3N8us8XMR4REreB1KBZNT39cxs=";
+      name = "triton-3.4.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-4rCv5CDSAtlvULhH10Skh7eAVnl1RV5W9ksGEVLulVQ=";
     };
     aarch64-linux-312 = {
-      name = "triton-3.3.1-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-mxmTw7pHARfc8oiP8RbYKAntek080FB0/ED/ORkLLOg=";
+      name = "triton-3.4.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-AOpKHBXwebv0n/AsMSIQ/bj/BbFQPqMIEmEOKjsXHzs=";
     };
     x86_64-linux-312 = {
-      name = "triton-3.3.1-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-mZnoOroh4aeMHzbyG85iG3e8qlMCd6UEhKfLSoIvbkM=";
+      name = "triton-3.4.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-hVBnKxGE8FGH9BQNsy4z5htZIEb9Ph65B+O321Mht1A=";
     };
     aarch64-linux-313 = {
-      name = "triton-3.3.1-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-S3nkmxWuMd0JWQkPN6Ni64HHfFZDug7FblKZA7BtKM8=";
+      name = "triton-3.4.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-WstSjwHcFDYsSoj6Tc+iJ9Ey9uYfJypodOhNZIUDfKQ=";
     };
     x86_64-linux-313 = {
-      name = "triton-3.3.1-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-uJ2Ea1pBmDF/7Cel06YJ6pa21Vf/RLVsIxdlRgI8QkA=";
+      name = "triton-3.4.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-Dlgr/YFHr9Dhf0ELOe4WHfkzoqyp9lPhF42q6Y+H9gE=";
     };
   };
 }

From 01f6508918a7af7583e4da274dc429b5ea831665 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Sat, 9 Aug 2025 10:02:04 +0200
Subject: [PATCH 15/54] freetube: 0.23.5 -> 0.23.6

Changelog:
https://github.com/FreeTubeApp/FreeTube/releases/tag/v0.23.6-beta
Diff:
https://github.com/FreeTubeApp/FreeTube/compare/v0.23.5-beta...v0.23.6-beta
---
 pkgs/by-name/fr/freetube/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fr/freetube/package.nix b/pkgs/by-name/fr/freetube/package.nix
index 3daf94c56da4..839113087450 100644
--- a/pkgs/by-name/fr/freetube/package.nix
+++ b/pkgs/by-name/fr/freetube/package.nix
@@ -20,13 +20,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "freetube";
-  version = "0.23.5";
+  version = "0.23.6";
 
   src = fetchFromGitHub {
     owner = "FreeTubeApp";
     repo = "FreeTube";
     tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-tVe//h20cTVgpHeo3IlfGfuAH+dM6H5MEfGny5Uhrjk=";
+    hash = "sha256-Z1L45RHlmylfqKBY37PC5TQ3ubOgH0AHFGM7VkmtkZ0=";
   };
 
   # Darwin requires writable Electron dist
@@ -49,7 +49,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-F1YcdshWGRCO7kHsCK0Ejs0aMR7BFXd5M9ITdRVcpbk=";
+    hash = "sha256-ia5wLRt3Hmo4/dsB1/rhGWGJ7LMnVR9ju9lSlQZDTTg=";
   };
 
   nativeBuildInputs = [

From 4ba01f711e87f34de5c694f26df29c0f95a5901e Mon Sep 17 00:00:00 2001
From: Astra Tsai <astra@ucsc.edu>
Date: Sat, 9 Aug 2025 13:27:46 -0700
Subject: [PATCH 16/54] vista-fonts: Remove the embedded bitmaps from Calibri
 and Cambria because they have very low resolutions

---
 pkgs/by-name/vi/vista-fonts/package.nix | 31 +++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/vi/vista-fonts/package.nix b/pkgs/by-name/vi/vista-fonts/package.nix
index 44d2551ce72b..0c6ad96ea908 100644
--- a/pkgs/by-name/vi/vista-fonts/package.nix
+++ b/pkgs/by-name/vi/vista-fonts/package.nix
@@ -3,6 +3,7 @@
   stdenvNoCC,
   fetchurl,
   cabextract,
+  fontforge,
 }:
 
 stdenvNoCC.mkDerivation {
@@ -14,7 +15,10 @@ stdenvNoCC.mkDerivation {
     hash = "sha256-xOdTVI0wkv/X3ThJEF4KJtm1oa/kbm5mf+fGiHiTcB8=";
   };
 
-  nativeBuildInputs = [ cabextract ];
+  nativeBuildInputs = [
+    cabextract
+    fontforge
+  ];
 
   unpackPhase = ''
     runHook preUnpack
@@ -30,10 +34,29 @@ stdenvNoCC.mkDerivation {
     runHook preInstall
 
     mkdir -p $out/share/fonts/truetype
-    cp *.ttf *.ttc $out/share/fonts/truetype
 
-    # Set up no-op font configs to override any aliases set up by
-    # other packages.
+    # Remove the embedded bitmaps from Calibri and Cambria because they have very low resolutions.
+    fontforge -c "
+    import fontforge
+    import sys
+
+    def removeBitmaps(font):
+      for table in ('EBDT', 'EBLC', 'EBSC'):
+        font.setTableData(table, None)
+
+    for path in sys.argv[1:]:
+      fonts = [fontforge.open(f'{path}({font})') for font in fontforge.fontsInFile(path)]
+      for font in fonts:
+        removeBitmaps(font)
+      if len(fonts) > 1:
+        fonts[0].generateTtc(f'$out/share/fonts/truetype/{path}', fonts[1:], layer=fonts[0].activeLayer)
+      else:
+        fonts[0].generate(f'$out/share/fonts/truetype/{path}')
+    " calibri* cambria*
+
+    cp -n *.ttf *.ttc $out/share/fonts/truetype
+
+    # Set up no-op font configs to override any aliases set up by other packages.
     mkdir -p $out/etc/fonts/conf.d
     for name in Calibri Cambria Candara Consolas Constantia Corbel ; do
       substitute ${./no-op.conf} $out/etc/fonts/conf.d/30-''${name,,}.conf \

From c4407ede1c1c41038b9f3d20f51271bc262dbae7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 10 Aug 2025 04:55:20 +0000
Subject: [PATCH 17/54] colima: 0.8.1 -> 0.8.4

---
 pkgs/by-name/co/colima/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/colima/package.nix b/pkgs/by-name/co/colima/package.nix
index 99d3c6f06972..e28197b411f0 100644
--- a/pkgs/by-name/co/colima/package.nix
+++ b/pkgs/by-name/co/colima/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.8.1";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = "colima";
     tag = "v${version}";
-    hash = "sha256-RQnHqEabxyoAKr8BfmVhk8z+l5oy8pa5JPTWk/0FV5g=";
+    hash = "sha256-TNq0lHNF6jwUqamJXYTxuF0Q9mfVwi8BaesQv87eRiE=";
     # We need the git revision
     leaveDotGit = true;
     postFetch = ''
@@ -35,7 +35,7 @@ buildGoModule rec {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.DarwinTools ];
 
-  vendorHash = "sha256-rqCPpO/Va31U++sfELcN1X6oDtDiCXoGj0RHKZUM6rY=";
+  vendorHash = "sha256-ZwgzKCOEhgKK2LNRLjnWP6qHI4f6OGORvt3CREJf55I=";
 
   # disable flaky Test_extractZones
   # https://hydra.nixos.org/build/212378003/log

From a665b0aca2b51e394448ad79e8f3791b0f84ca49 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sun, 1 Jun 2025 22:59:25 +0200
Subject: [PATCH 18/54] modsecurity_standalone: 2.9.8 -> 2.9.12

Fixes CVE-2025-47947, CVE 2025-48866, CVE-2025-52891 and CVE 2025-54571.

https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.9
https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.10
https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.11
https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.12
---
 .../mo/modsecurity_standalone/package.nix     | 28 ++-----------------
 1 file changed, 2 insertions(+), 26 deletions(-)

diff --git a/pkgs/by-name/mo/modsecurity_standalone/package.nix b/pkgs/by-name/mo/modsecurity_standalone/package.nix
index 064e589f0887..58f6d6bbe899 100644
--- a/pkgs/by-name/mo/modsecurity_standalone/package.nix
+++ b/pkgs/by-name/mo/modsecurity_standalone/package.nix
@@ -13,7 +13,6 @@
   luaSupport ? false,
   lua5,
   perl,
-  fetchpatch,
   versionCheckHook,
 }:
 
@@ -24,13 +23,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "modsecurity";
-  version = "2.9.8";
+  version = "2.9.12";
 
   src = fetchFromGitHub {
     owner = "owasp-modsecurity";
     repo = "modsecurity";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fJ5XeO5m5LlImAuzIvXVVWkc9awbaRI3NWWOOwGrshI=";
+    hash = "sha256-scMOiu8oI3+VcXe05gLNQ8ILmnP4iwls8ZZ9r+3ei5Y=";
   };
 
   nativeBuildInputs = [
@@ -61,11 +60,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    # msc_test.c:86:5: error: initialization of 'int' from 'void *' makes integer from pointer without a cast []
-    "-Wno-error=int-conversion"
-  ];
-
   outputs = [
     "out"
     "nginx"
@@ -74,24 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
     # by default modsecurity's install script copies compiled output to httpd's modules folder
     # this patch removes those lines
     ./Makefile.am.patch
-    # remove when 2.9.9 is released
-    (fetchpatch {
-      name = "move-id_log";
-      url = "https://github.com/owasp-modsecurity/ModSecurity/commit/149376377ecef9ecc36ee81d5b666fc0ac7e249b.patch";
-      hash = "sha256-KjQGqSBt/u9zPZY1aSIupnYHleJbsOAOk3Y2bNOyRxk=";
-    })
-    # remove when 2.9.9 is released
-    (fetchpatch {
-      name = "gcc-format-security";
-      url = "https://github.com/owasp-modsecurity/ModSecurity/commit/cddd9a7eb5585a9b3be1f9bdcadcace8f60f5808.patch";
-      hash = "sha256-H1wkZQ5bTQIRhlEvvvj7YCBi9qndRgHgKTnE9Cusq3I=";
-    })
-    # remove when 2.9.9 is released
-    (fetchpatch {
-      name = "gcc-incompatible-pointer-type";
-      url = "https://github.com/owasp-modsecurity/ModSecurity/commit/4919814a5cf0e7911f71856ed872b0e73b659a0a.patch";
-      hash = "sha256-9JzCtiLf43xw6i4NqQpok37es+kuWXZWKdJum28Hx4M=";
-    })
   ];
 
   doCheck = true;

From b7f8d7b262ce2a20c6ca03a76b39d07d9929b34c Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Tue, 5 Aug 2025 08:53:17 -0500
Subject: [PATCH 19/54] teams-for-linux: 2.1.0 -> 2.1.4

Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
---
 pkgs/by-name/te/teams-for-linux/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index bc259cf2a778..fc82e595df82 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -16,16 +16,16 @@
 
 buildNpmPackage rec {
   pname = "teams-for-linux";
-  version = "2.1.0";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     tag = "v${version}";
-    hash = "sha256-lISDy721e3bfWMl56DlIxVKN2bW8Yonc5XSVL072OQk=";
+    hash = "sha256-wzw7GXKehQCYX2RDH5G/SqhBSziVPnXiaPiLrhC2Dfc=";
   };
 
-  npmDepsHash = "sha256-QcjXJcEIi/sUJLUF+wMqhXyLYPgjZKK6n4ngyvrH9NA=";
+  npmDepsHash = "sha256-PWWEFbenAXuYKwFN+C+pQumrYJqgtfAt9EzEiaMddhQ=";
 
   nativeBuildInputs = [
     makeWrapper

From a41793d96cad47fe80e670b564a120cc965cb1cc Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Sun, 10 Aug 2025 16:11:04 -0500
Subject: [PATCH 20/54] teams-for-linux: fix aarch64-darwin

Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
---
 pkgs/by-name/te/teams-for-linux/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index fc82e595df82..a6a35e113194 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -61,7 +61,8 @@ buildNpmPackage rec {
         -c.npmRebuild=true \
         -c.asarUnpack="**/*.node" \
         -c.electronDist=electron-dist \
-        -c.electronVersion=${electron_37.version}
+        -c.electronVersion=${electron_37.version} \
+        -c.mac.identity=null
 
     runHook postBuild
   '';

From 69df914cf951a6679d6be332a995508d3a9d9ae8 Mon Sep 17 00:00:00 2001
From: Jamie Magee <jamie.magee@gmail.com>
Date: Sun, 10 Aug 2025 20:55:55 -0700
Subject: [PATCH 21/54] python3Packages.baidu-aip: init at 4.16.1

---
 .../python-modules/baidu-aip/default.nix      | 39 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 41 insertions(+)
 create mode 100644 pkgs/development/python-modules/baidu-aip/default.nix

diff --git a/pkgs/development/python-modules/baidu-aip/default.nix b/pkgs/development/python-modules/baidu-aip/default.nix
new file mode 100644
index 000000000000..c8fc92da521d
--- /dev/null
+++ b/pkgs/development/python-modules/baidu-aip/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  chardet,
+  requests,
+}:
+
+buildPythonPackage rec {
+  pname = "baidu-aip";
+  version = "4.16.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-zNYjEVVwhqFAR7w7CR3rWYefUZcM+sPZ87KYfDDLxN0=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    chardet
+    requests
+  ];
+
+  # Package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "aip" ];
+
+  meta = {
+    description = "Baidu AI Platform SDK for Python";
+    homepage = "https://github.com/Baidu-AIP/python-sdk";
+    changelog = "https://github.com/Baidu-AIP/python-sdk/releases";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 39a62538ad78..8f925b087aaf 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1655,6 +1655,8 @@ self: super: with self; {
 
   bagit = callPackage ../development/python-modules/bagit { };
 
+  baidu-aip = callPackage ../development/python-modules/baidu-aip { };
+
   baize = callPackage ../development/python-modules/baize { };
 
   bambi = callPackage ../development/python-modules/bambi { };

From ce7737373b887661a0243837c9a5bfbb09ac404d Mon Sep 17 00:00:00 2001
From: Jamie Magee <jamie.magee@gmail.com>
Date: Sun, 10 Aug 2025 20:56:02 -0700
Subject: [PATCH 22/54] home-assistant: update component packages

---
 pkgs/servers/home-assistant/component-packages.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index d3dab1154da8..4491f53f63a7 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -537,7 +537,8 @@
       ];
     "baidu" =
       ps: with ps; [
-      ]; # missing inputs: baidu-aip
+        baidu-aip
+      ];
     "balay" =
       ps: with ps; [
       ];

From c7ec5706d61dc3626233d6e0357d376ff63d0eb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janne=20He=C3=9F?= <janne@hess.ooo>
Date: Mon, 11 Aug 2025 14:40:32 +0200
Subject: [PATCH 23/54] flexoptix-app: 5.21.2-latest -> 5.48.0-latest

---
 .../allow-no-secret-manager.patch             |  9 ++++++
 .../fl/flexoptix-app/disable-autoupdate.patch | 28 ++++++++-----------
 pkgs/by-name/fl/flexoptix-app/package.nix     | 26 +++++++++++++----
 3 files changed, 42 insertions(+), 21 deletions(-)
 create mode 100644 pkgs/by-name/fl/flexoptix-app/allow-no-secret-manager.patch

diff --git a/pkgs/by-name/fl/flexoptix-app/allow-no-secret-manager.patch b/pkgs/by-name/fl/flexoptix-app/allow-no-secret-manager.patch
new file mode 100644
index 000000000000..30b676d8f403
--- /dev/null
+++ b/pkgs/by-name/fl/flexoptix-app/allow-no-secret-manager.patch
@@ -0,0 +1,9 @@
+--- app/node_modules/rme-electron/main/fo-storage/models/fo-storage-file.js
++++ app/node_modules/rme-electron/main/fo-storage/models/fo-storage-file.js
+@@ -25,6 +25,7 @@
+		if (!this.#isPlainObject(initialContent)) {
+			throw new Error("Content must be a plain object");
+		}
++		safeStorage.setUsePlainTextEncryption(true);
+		this.#content = initialContent;
+	}
diff --git a/pkgs/by-name/fl/flexoptix-app/disable-autoupdate.patch b/pkgs/by-name/fl/flexoptix-app/disable-autoupdate.patch
index d71133951e72..c3b2bdec8185 100644
--- a/pkgs/by-name/fl/flexoptix-app/disable-autoupdate.patch
+++ b/pkgs/by-name/fl/flexoptix-app/disable-autoupdate.patch
@@ -1,16 +1,12 @@
---- app/electron/jsComponents/mainWindowEvents.js	2024-02-18 12:53:41.115773007 -0500
-+++ app/electron/jsComponents/mainWindowEvents.js2	2024-02-18 23:22:20.003280203 -0500
-@@ -128,7 +128,12 @@
- 
- 	if (app.isPackaged) {
- 		global.mainWindow.webContents.once("did-finish-load", function () {
--			autoUpdater.checkForUpdates();
-+			global.mainWindow.loadURL(
-+				url.format({
-+					...global.APPLICATION_URL_OBJECT,
-+					slashes: true,
-+				}),
-+			);
- 		});
- 	} else {
- 		global.mainWindow.webContents.openDevTools();
+--- app/node_modules/electron-updater/out/AppUpdater.js
++++ app/node_modules/electron-updater/out/AppUpdater.js
+@@ -211,6 +211,9 @@
+      * Asks the server whether there is an update.
+      */
+     checkForUpdates() {
++        this.emit("update-not-available", null);
++        return true;
++
+         if (!this.isUpdaterActive()) {
+             return Promise.resolve(null);
+         }
diff --git a/pkgs/by-name/fl/flexoptix-app/package.nix b/pkgs/by-name/fl/flexoptix-app/package.nix
index 402f7cc52d0c..d37ec9824bff 100644
--- a/pkgs/by-name/fl/flexoptix-app/package.nix
+++ b/pkgs/by-name/fl/flexoptix-app/package.nix
@@ -3,29 +3,42 @@
   appimageTools,
   fetchurl,
   asar,
+  python3,
 }:
 let
   pname = "flexoptix-app";
-  version = "5.21.2-latest";
+  version = "5.48.0-latest";
 
   src = fetchurl {
     name = "${pname}-${version}.AppImage";
     url = "https://flexbox.reconfigure.me/download/electron/linux/x64/FLEXOPTIX%20App.${version}.AppImage";
-    hash = "sha256-BnNRwD09CE1EZDg3Hn3khN4FZ8Hj5LLAunk+NKU5BJo=";
+    hash = "sha256-VSGfExus+4dDef6V1ZEATMBVCIb0JS459+yolx5sg3c=";
   };
 
   udevRules = fetchurl {
     url = "https://www.flexoptix.net/static/frontend/Flexoptix/default/en_US/files/99-tprogrammer.rules";
-    hash = "sha256-faowRYdrk88WUpOpaEfedzybBgxVRZhvAaYP9HAuzAE=";
+    hash = "sha256-/1ZtJT+1IMyYqw3N0bVJ/T3vbmex169lzx+SlY5WsnA=";
   };
 
   appimageContents = (appimageTools.extract { inherit pname version src; }).overrideAttrs (oA: {
     buildCommand = ''
       ${oA.buildCommand}
 
-      # Get rid of the autoupdater
+      # Remove left-over node-gyp executable symlinks
+      # https://github.com/nodejs/node-gyp/issues/2713
+      find $out/ -type l -name python3 -exec ln -sf ${python3.interpreter} {} \;
+
+      # Extract app to make it patchable
       ${asar}/bin/asar extract $out/resources/app.asar app
+
+      # Fix app crash when none of these secret managers is available: https://www.electronjs.org/docs/latest/api/safe-storage#safestoragegetselectedstoragebackend-linux
+      patch -p0 < ${./allow-no-secret-manager.patch}
+      # Get rid of the autoupdater
       patch -p0 < ${./disable-autoupdate.patch}
+
+      # Makes debugging easier: cp -r app $out/_app
+
+      # Repackage
       ${asar}/bin/asar pack app $out/resources/app.asar
     '';
   });
@@ -42,7 +55,10 @@ appimageTools.wrapAppImage {
     install -Dm444 ${appimageContents}/flexoptix-app.desktop -t $out/share/applications
     install -Dm444 ${appimageContents}/flexoptix-app.png -t $out/share/pixmaps
     substituteInPlace $out/share/applications/flexoptix-app.desktop \
-      --replace 'Exec=AppRun' "Exec=$out/bin/${pname} --"
+      --replace-fail 'Exec=AppRun' "Exec=$out/bin/${pname} --"
+
+    # For debugging
+    [[ -e ${appimageContents}/_app ]] && ln -s ${appimageContents}/_app $out
 
     # Add udev rules
     mkdir -p $out/lib/udev/rules.d

From a53e6fe748a79fe6c4943ab253d286a090c64c58 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 12 Aug 2025 05:49:17 +0000
Subject: [PATCH 24/54] angular-language-server: 20.1.1 -> 20.2.1

---
 pkgs/by-name/an/angular-language-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/an/angular-language-server/package.nix b/pkgs/by-name/an/angular-language-server/package.nix
index 84efaadafb86..617cb98c56b4 100644
--- a/pkgs/by-name/an/angular-language-server/package.nix
+++ b/pkgs/by-name/an/angular-language-server/package.nix
@@ -16,11 +16,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "angular-language-server";
-  version = "20.1.1";
+  version = "20.2.1";
   src = fetchurl {
     name = "angular-language-server-${finalAttrs.version}.zip";
     url = "https://github.com/angular/vscode-ng-language-service/releases/download/v${finalAttrs.version}/ng-template.vsix";
-    hash = "sha256-fcJXyuGow39uep6Giexft+3a/nnoJSsKdwjtAQKTMj0=";
+    hash = "sha256-oemc2lJDPsWWG+tcJAk8u5lSGUpIoI6K/fE/TZC5bWw=";
   };
 
   nativeBuildInputs = [

From 87c92bce52e81fb353f034013e53fed5adf8c6bb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 12 Aug 2025 13:36:44 +0000
Subject: [PATCH 25/54] opensnitch: 1.7.1 -> 1.7.2

---
 pkgs/by-name/op/opensnitch/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opensnitch/package.nix b/pkgs/by-name/op/opensnitch/package.nix
index d670db042cae..dc99acef4777 100644
--- a/pkgs/by-name/op/opensnitch/package.nix
+++ b/pkgs/by-name/op/opensnitch/package.nix
@@ -34,13 +34,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "opensnitch";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "evilsocket";
     repo = "opensnitch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j73wbHm8hrfm+8YVwonzU+ddzwSk9+ecucsQ0Es715k=";
+    hash = "sha256-XAR7yZjAzbMxIVGSV82agpAGwlejkILGgDI6iRicZuQ=";
   };
 
   postPatch = ''
@@ -63,7 +63,7 @@ buildGoModule (finalAttrs: {
     protoc-gen-go-grpc'
   ];
 
-  vendorHash = "sha256-IByoQuJsGORmePlv1HzvF8RSu2XhP5Sry1j3NoY2WP8=";
+  vendorHash = "sha256-6/N/E+uk6RVmSLy6fSWjHj+J5mPFXtHZwWThhFJnfYY=";
 
   preBuild = ''
     make -C ../proto ../daemon/ui/protocol/ui.pb.go

From e21c8614de95dbfbd79643175f30b6ea095a8e82 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 12 Aug 2025 14:17:39 +0000
Subject: [PATCH 26/54] harbor-cli: 0.0.8 -> 0.0.9

---
 pkgs/by-name/ha/harbor-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ha/harbor-cli/package.nix b/pkgs/by-name/ha/harbor-cli/package.nix
index f9ae66872e49..0c0829f6f5b5 100644
--- a/pkgs/by-name/ha/harbor-cli/package.nix
+++ b/pkgs/by-name/ha/harbor-cli/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "harbor-cli";
-  version = "0.0.8";
+  version = "0.0.9";
 
   src = fetchFromGitHub {
     owner = "goharbor";
     repo = "harbor-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7Fi4FeWsLwTtNZhD8TfSBTMr/LKzUm6UO4aWC0eJFtQ=";
+    hash = "sha256-3LgFhSG/k4cnpxiYaXTPr52n1cntIG2qfLkYaOyaqGw=";
   };
 
-  vendorHash = "sha256-gkPMyDX5CO7j6JX3AUNw9o/HApRwLHAd8mD25rq96Lk=";
+  vendorHash = "sha256-QnKSzWa/XTrA83d/DXcS5PE59CL4wD2sISNDV5pBIfM=";
 
   excludedPackages = [
     "dagger"

From 5dcc292fd8ca3da9cbae28f35415e37ca353bbde Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 12 Aug 2025 15:19:02 +0000
Subject: [PATCH 27/54] lint-staged: 16.1.3 -> 16.1.5

---
 pkgs/by-name/li/lint-staged/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/lint-staged/package.nix b/pkgs/by-name/li/lint-staged/package.nix
index ab97d87014d8..42882508d8b7 100644
--- a/pkgs/by-name/li/lint-staged/package.nix
+++ b/pkgs/by-name/li/lint-staged/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "16.1.3";
+  version = "16.1.5";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-Aviq2FJBA2R2w8WkvafD7uwM6RxBNCbiawqrvy/VyEw=";
+    hash = "sha256-XXNBKxlHfyQXHyaWFrgFmEHmcxhodco1p44i9SjXgo4=";
   };
 
-  npmDepsHash = "sha256-l/t/TS7Yj2ti35mL0Ol3mug0I87Xtcx+RCv8Z6hK7AY=";
+  npmDepsHash = "sha256-edBeGkkkcHR4FC+zF3W+NbguEGfU2qCJ1hYwdTMTLA0=";
 
   dontNpmBuild = true;
 

From 1f1a0cd7494f9a8b5b477a635859466926e818cc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 12 Aug 2025 19:24:45 +0000
Subject: [PATCH 28/54] pixi: 0.49.0 -> 0.51.0

---
 pkgs/by-name/pi/pixi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pi/pixi/package.nix b/pkgs/by-name/pi/pixi/package.nix
index be325175197a..aa43a843407f 100644
--- a/pkgs/by-name/pi/pixi/package.nix
+++ b/pkgs/by-name/pi/pixi/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pixi";
-  version = "0.49.0";
+  version = "0.51.0";
 
   src = fetchFromGitHub {
     owner = "prefix-dev";
     repo = "pixi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BLzE2mhSCrVPhiECrEcOMB0+DC6KjTFBmuJmtpJ20bA=";
+    hash = "sha256-DuYfDy87HoJc+LL/vL91Omx6Spy7wO4HKI3Uary2DGs=";
   };
 
-  cargoHash = "sha256-bzOfIXT9QQE0CzVjOCMv7l9/MKNqazO7yxVmFOPKeEg=";
+  cargoHash = "sha256-pqhoEWWEjgMDz9G4Bhom0cdP1R3fWydAI9Z3aX4sQD4=";
 
   nativeBuildInputs = [
     pkg-config

From dd85d60fc9d66cfa92cff9b86d7f86ee806be5a6 Mon Sep 17 00:00:00 2001
From: Diego <diego@strebel.com>
Date: Tue, 29 Jul 2025 11:28:05 +0200
Subject: [PATCH 29/54] mprime: 30.8b15 -> 30.19b21

---
 pkgs/by-name/mp/mprime/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/mp/mprime/package.nix b/pkgs/by-name/mp/mprime/package.nix
index 8cdf5f1b1479..bc4e505d54f6 100644
--- a/pkgs/by-name/mp/mprime/package.nix
+++ b/pkgs/by-name/mp/mprime/package.nix
@@ -31,13 +31,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "mprime";
-  version = "30.8b15";
-
+  version = "30.19b21";
   src = fetchurl {
-    url = "https://www.mersenne.org/ftp_root/gimps/p95v${
+    url = "https://download.mersenne.ca/gimps/v30/30.19/p95v${
       lib.replaceStrings [ "." ] [ "" ] version
     }.source.zip";
-    hash = "sha256-CNYorZStHV0aESGX9LfLZ4oD5PFR2UOFLN1MiLaKw58=";
+    hash = "sha256-vchDpUem+R3GcASj77zZmFivfbB17Nd7cYiyPlrCzio=";
   };
 
   postPatch = ''
@@ -88,6 +87,7 @@ stdenv.mkDerivation rec {
       "x86_64-linux"
       "x86_64-darwin"
     ];
+    maintainers = with maintainers; [ dstremur ];
     mainProgram = "mprime";
   };
 }

From 79eea558a46d8adeff65ed7a1ba3cf6d6cbb2384 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 12 Aug 2025 23:03:49 +0200
Subject: [PATCH 30/54] dolibarr: 21.0.2 -> 22.0.0

Diff: https://github.com/Dolibarr/dolibarr/compare/21.0.2...22.0.0

Changelog: https://github.com/Dolibarr/dolibarr/releases/tag/22.0.0
---
 pkgs/by-name/do/dolibarr/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/do/dolibarr/package.nix b/pkgs/by-name/do/dolibarr/package.nix
index 5ba589efeb2c..72eb3a240183 100644
--- a/pkgs/by-name/do/dolibarr/package.nix
+++ b/pkgs/by-name/do/dolibarr/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dolibarr";
-  version = "21.0.2";
+  version = "22.0.0";
 
   src = fetchFromGitHub {
     owner = "Dolibarr";
     repo = "dolibarr";
     tag = finalAttrs.version;
-    hash = "sha256-H1p20dDe7YDFFk0hwyNvJ7LG9/3FF7JPo322Cgb0gYo=";
+    hash = "sha256-NEE/ZKfkJLW360ioffzBOPJIkxrV0a2F4CFEPZPbivA=";
   };
 
   dontBuild = true;

From 034e28eb3104d78751a23035fdcf78c6424cf847 Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Wed, 13 Aug 2025 01:06:18 +0200
Subject: [PATCH 31/54] chromium,chromedriver: 139.0.7258.66 -> 139.0.7258.127

https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html

This update includes 6 security fixes.

CVEs:
CVE-2025-8879 CVE-2025-8880 CVE-2025-8901 CVE-2025-8881 CVE-2025-8882
---
 .../networking/browsers/chromium/info.json    | 28 +++++++++----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index eb1b32f6892f..ce000998626a 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "139.0.7258.66",
+    "version": "139.0.7258.127",
     "chromedriver": {
-      "version": "139.0.7258.67",
-      "hash_darwin": "sha256-kWrlkFZ1X0n7h5GtnfZnKbT1zylVuaSCDMJA549LoEY=",
-      "hash_darwin_aarch64": "sha256-HWgR2CWj5/N2zPIIHXBnA1DoYe0+KAmScopNfMcYlzc="
+      "version": "139.0.7258.128",
+      "hash_darwin": "sha256-QHYwd9B47p3/Y3z/TYaUpNbCBenUrI7yXVsMUwtnifg=",
+      "hash_darwin_aarch64": "sha256-rwMRpEW+sQ6u/Y0rJWGw7UICfjZO8WQddOfzpqwcsnY="
     },
     "deps": {
       "depot_tools": {
@@ -20,8 +20,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "a62d329947691f76c376a873eae39f56381103c8",
-        "hash": "sha256-RWqOw0Kogz2GwbICet7NdcGnZMrkkE4bu70jU+tbYFQ=",
+        "rev": "5dc2cf9cf870d324cd9fba708f26d2572cc6d4d8",
+        "hash": "sha256-YcOVErOKKruc3kPuXhmeibo3KL+Rrny1FEwF769+aEU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -96,8 +96,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "0145c376fadde16390298681252785f98ae90185",
-        "hash": "sha256-8ztvupTvp5v8lTq3eo/viR9X85qm+bw8299jxr6XslE="
+        "rev": "5f3636345f1d8afd495e2fcc474fd81e91c4866b",
+        "hash": "sha256-fx+QD0T85Js9jPQx2aghJU8UOL6WbR0bOkGY2i87A3w="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -401,8 +401,8 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "0ddc6630b3723b14b164752d46c27752f078ddd3",
-        "hash": "sha256-cs1+5vBEFPqzi1vbxiSgujrLIoaXZROZaRJq2gRdUrE="
+        "rev": "90c632fc6c01cd8637186c783ca8012bab3c3260",
+        "hash": "sha256-e+rUkNOakv6WQrgx1ozoJTynk/GZy1zdsnYX4oz+6ks="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -631,8 +631,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "cbc694239b06ecf694676aba22d5263dbc23ee5e",
-        "hash": "sha256-5vIwNP9RbtUVtgKKDiZd6NVkR2Ed3DUqZWESTUM+fIs="
+        "rev": "2d6f1aa4be9c33b013c322b2bc9cd99a682243b6",
+        "hash": "sha256-VysJkpCRRYNdCStnXvo6wyMCv1gLHecMwefKiwypARc="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -796,8 +796,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "b07b4e9376489c7f7c0ff2af5eceb4261b3bb784",
-        "hash": "sha256-MnrieVgkvlkWKZ0O790gDSCrgF9c+XEk/XLHQDzMqVY="
+        "rev": "505ec917b67c535519bebec58c62a34f145dd49f",
+        "hash": "sha256-fsf8j2Spe++vSnuO8763eWWmMhYqcyybpILb7OkkXq4="
       }
     }
   },

From eae238e32a7f2e508367158697fc47e06885156c Mon Sep 17 00:00:00 2001
From: Alvaro Aleman <alvaroaleman@users.noreply.github.com>
Date: Tue, 12 Aug 2025 19:52:39 -0400
Subject: [PATCH 32/54] go_1_25: 1.25rc3 -> 1.25.0

---
 pkgs/development/compilers/go/1.25.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index 5ca1b35dcebf..9d7bab15e3ef 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -28,11 +28,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25rc3";
+  version = "1.25.0";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-Rw4LjnCmjyhV59AJ8TXsgLPRgIXSxOU323Xmrkliv3Q=";
+    hash = "sha256-S9AekSlyB7+kUOpA1NWpOxtTGl5DhHOyoG4Y4HciciU=";
   };
 
   strictDeps = true;

From 382415cc14eabfbbba3e2937a7775b9167fa74fd Mon Sep 17 00:00:00 2001
From: botnk <github-botnk@korz.dev>
Date: Wed, 13 Aug 2025 01:48:27 +0000
Subject: [PATCH 33/54] zed-editor: 0.198.5 -> 0.198.6

Changelog: https://github.com/zed-industries/zed/releases/tag/v0.198.6
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index c0e220cb0099..cffcf0a0dac3 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.198.5";
+  version = "0.198.6";
 
   outputs = [
     "out"
@@ -112,7 +112,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jDwHw5kbm0qfV2WJ5tbFl9z/1S1ICp8bCZbhUD5o0VI=";
+    hash = "sha256-XsfY6K8qsL2mi0+Z3tJp6LVDm7D+X3dPnaqgeT1iIHs=";
   };
 
   patches = [
@@ -138,7 +138,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
         --replace-fail "inner.redirect(policy)" "inner.redirect_policy(policy)"
     '';
 
-  cargoHash = "sha256-MHwMsMdv7TjnWi2Kmr7vA+TUK+VyHMm4faYOssJ5Z1o=";
+  cargoHash = "sha256-XIED6sQ7a5z2p1CZQ4A9TSTTNI5qpp9WSzVmiYdYG2o=";
 
   nativeBuildInputs = [
     cmake

From a7c966447a5b095721f6a3e507d568c9a6b16a5f Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Wed, 13 Aug 2025 11:40:12 +0800
Subject: [PATCH 34/54] notation: unpin go1.23

---
 pkgs/top-level/all-packages.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9d659083ebca..6ad786718afd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3803,10 +3803,6 @@ with pkgs;
 
   nifskope = libsForQt5.callPackage ../tools/graphics/nifskope { };
 
-  notation = callPackage ../by-name/no/notation/package.nix {
-    buildGoModule = buildGo123Module;
-  };
-
   nsjail = callPackage ../tools/security/nsjail {
     protobuf = protobuf_21;
   };

From 0bc5ed4c00dec18dfdf3a1db929447d80ac01c3b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Aug 2025 03:55:49 +0000
Subject: [PATCH 35/54] codebook: 0.3.6 -> 0.3.8

---
 pkgs/by-name/co/codebook/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/codebook/package.nix b/pkgs/by-name/co/codebook/package.nix
index a53919b6ce0b..51716fcb11a1 100644
--- a/pkgs/by-name/co/codebook/package.nix
+++ b/pkgs/by-name/co/codebook/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codebook";
-  version = "0.3.6";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "blopker";
     repo = "codebook";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zSxMvWRpH1AtvHo/odQZftxgAMdOd8p2ZiMUcsOWhes=";
+    hash = "sha256-1ZjR3nUWpeglTTTtXdvbmMGK7SW517cQIu6IQ63a8Wc=";
   };
 
   buildAndTestSubdir = "crates/codebook-lsp";
-  cargoHash = "sha256-FS8ZEjFFoNCJGkfL8C5hBgwj9o9XT239/9Qh/Xea2wk=";
+  cargoHash = "sha256-fwI+k9m5ptGb1KQ+mxsAmwlPhQwWSo5HGM0XeWlFHTI=";
 
   # Integration tests require internet access for dictionaries
   doCheck = false;

From a45a08588020bd887e5dbf569e594cdffc50359f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Aug 2025 04:39:01 +0000
Subject: [PATCH 36/54] python3Packages.types-awscrt: 0.27.5 -> 0.27.6

---
 pkgs/development/python-modules/types-awscrt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/types-awscrt/default.nix b/pkgs/development/python-modules/types-awscrt/default.nix
index d15ba2d262ea..d26d86687dc0 100644
--- a/pkgs/development/python-modules/types-awscrt/default.nix
+++ b/pkgs/development/python-modules/types-awscrt/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "types-awscrt";
-  version = "0.27.5";
+  version = "0.27.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "types_awscrt";
     inherit version;
-    hash = "sha256-ju/lDRcJUgZjt302Q6dyw1rOPYrPyylvhXYnYiyEy0w=";
+    hash = "sha256-nT8YZak7iywy8TdRSsiMsEi1vEOHOZRboZ2XJpiZW/s=";
   };
 
   build-system = [ setuptools ];

From 633ac63074354629c8c012c86085a25cb483bfa2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Aug 2025 06:35:54 +0000
Subject: [PATCH 37/54] cinny: 4.8.1 -> 4.9.0

---
 pkgs/by-name/ci/cinny-unwrapped/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ci/cinny-unwrapped/package.nix b/pkgs/by-name/ci/cinny-unwrapped/package.nix
index 2fd7b23861af..99b9a061cd15 100644
--- a/pkgs/by-name/ci/cinny-unwrapped/package.nix
+++ b/pkgs/by-name/ci/cinny-unwrapped/package.nix
@@ -13,16 +13,16 @@
 
 buildNpmPackage rec {
   pname = "cinny-unwrapped";
-  version = "4.8.1";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny";
     tag = "v${version}";
-    hash = "sha256-1F49KHAfCtvcqMeRYI8r6Ke7oz+EQqOfkgdgn5E1DU4=";
+    hash = "sha256-tvBaONJwfkCK77aHmWJ/UAAZHq2WIc7geNT2tEFKuZ0=";
   };
 
-  npmDepsHash = "sha256-Tx+08NrbFolI7agC6AtNvkOgCJWJa4fsY0CFC02h4r0=";
+  npmDepsHash = "sha256-9faffTlXEI1lMrVrkSyso/tfjs/4W+TVzmiv+bZAv18=";
 
   nativeBuildInputs = [
     python3

From a0c4961ada3b63b4060a9013ed1c85d1a9d458fc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Aug 2025 06:36:01 +0000
Subject: [PATCH 38/54] cinny-unwrapped: 4.8.1 -> 4.9.0

---
 pkgs/by-name/ci/cinny-unwrapped/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ci/cinny-unwrapped/package.nix b/pkgs/by-name/ci/cinny-unwrapped/package.nix
index 2fd7b23861af..99b9a061cd15 100644
--- a/pkgs/by-name/ci/cinny-unwrapped/package.nix
+++ b/pkgs/by-name/ci/cinny-unwrapped/package.nix
@@ -13,16 +13,16 @@
 
 buildNpmPackage rec {
   pname = "cinny-unwrapped";
-  version = "4.8.1";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny";
     tag = "v${version}";
-    hash = "sha256-1F49KHAfCtvcqMeRYI8r6Ke7oz+EQqOfkgdgn5E1DU4=";
+    hash = "sha256-tvBaONJwfkCK77aHmWJ/UAAZHq2WIc7geNT2tEFKuZ0=";
   };
 
-  npmDepsHash = "sha256-Tx+08NrbFolI7agC6AtNvkOgCJWJa4fsY0CFC02h4r0=";
+  npmDepsHash = "sha256-9faffTlXEI1lMrVrkSyso/tfjs/4W+TVzmiv+bZAv18=";
 
   nativeBuildInputs = [
     python3

From 0518453b11939c27d9b9ab8f5035b9a7187c3b25 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Wed, 13 Aug 2025 09:13:29 +0200
Subject: [PATCH 39/54] go_latest: 1.24 -> 1.25

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/top-level/all-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9d659083ebca..8d223d0bf240 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9647,8 +9647,8 @@ with pkgs;
   go = go_1_24;
   buildGoModule = buildGo124Module;
 
-  go_latest = go_1_24;
-  buildGoLatestModule = buildGo124Module;
+  go_latest = go_1_25;
+  buildGoLatestModule = buildGo125Module;
 
   go_1_23 = callPackage ../development/compilers/go/1.23.nix { };
   buildGo123Module = callPackage ../build-support/go/module.nix {

From 6e14ef3d438d27418574b235b017aec76203c865 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Wed, 13 Aug 2025 14:55:23 +0800
Subject: [PATCH 40/54] nixosTests.mitmproxy: test mitmproxy2swagger

---
 nixos/tests/mitmproxy.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/nixos/tests/mitmproxy.nix b/nixos/tests/mitmproxy.nix
index aa71d64cea18..fe571bc430d0 100644
--- a/nixos/tests/mitmproxy.nix
+++ b/nixos/tests/mitmproxy.nix
@@ -71,6 +71,7 @@ in
         [
           counter
           pkgs.mitmproxy
+          pkgs.mitmproxy2swagger
         ];
     };
 
@@ -130,5 +131,17 @@ in
       machine.succeed("mitmdump -C /root/replay")
 
       t.assertEqual("2", curl("http://localhost:8000/counter"))
+
+      # create a OpenAPI 3.0 spec from captured flow
+      # https://github.com/alufers/mitmproxy2swagger
+
+      # create a initial spec
+      machine.succeed("mitmproxy2swagger -i /root/replay -f flow -o /root/spec -p http://localhost:8000")
+      # don't ignore any endpoint
+      machine.succeed("sed -i -e 's/- ignore:/- /' /root/spec")
+      # generate the actual spec
+      machine.succeed("mitmproxy2swagger -i /root/replay -f flow -o /root/spec -p http://localhost:8000")
+      # check for endpoint /counter
+      machine.succeed("grep '/counter:' /root/spec")
     '';
 }

From b068f626fd19a854b604238ec0e206084d9fdd57 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 Aug 2025 10:39:32 +0300
Subject: [PATCH 41/54] opencloud: 3.2.1 -> 3.3.0

Diff: https://github.com/opencloud-eu/opencloud/compare/v3.2.1...v3.3.0

Changelog: https://github.com/opencloud-eu/opencloud/blob/v3.3.0/CHANGELOG.md
---
 pkgs/by-name/op/opencloud/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index f51419e98d3c..304418c1890f 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -28,13 +28,13 @@ let
 in
 buildGoModule rec {
   pname = "opencloud";
-  version = "3.2.1";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
     tag = "v${version}";
-    hash = "sha256-8bVBkLzqQpSnNqCZzNxqglyd14FtaJvbrwCQDbwrn2Q=";
+    hash = "sha256-ekOqKJxXTEClHfVZ5VDzKgEG3imK7ec/bnpqduL4LOQ=";
   };
 
   postPatch = ''

From 278964ba8ee0ced3db1dfa57057707fc7ae7b870 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 Aug 2025 10:43:05 +0300
Subject: [PATCH 42/54] opencloud.web: 3.2.0 -> 3.3.0

Diff: https://github.com/opencloud-eu/web/compare/v3.2.0...v3.3.0

Changelog: https://github.com/opencloud-eu/web/blob/v3.3.0/CHANGELOG.md
---
 pkgs/by-name/op/opencloud/web.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
index 0f9f1b53cabf..ab788789ac6a 100644
--- a/pkgs/by-name/op/opencloud/web.nix
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -9,19 +9,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-web";
-  version = "3.2.0";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-11vHPrmtyqRIvR/619z2YvF3VAW5EfrAhwnGTVexEZA=";
+    hash = "sha256-QBIAy3S8pss6NhN7V+AovWMoYZmu0cHbi6E7lUugYzU=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-PAoDkeiZIzf4P21oct0pNwMHT6jMLtS44if6maxN9c0=";
+    hash = "sha256-KYSjgDrl/IC+xi/GN+DqB0H6q0HWT7sjzGk/YvfTmHA=";
   };
 
   nativeBuildInputs = [

From 0bb250aead50f202d22f6ef69ab884da206fd641 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Aug 2025 09:00:49 +0000
Subject: [PATCH 43/54] manifold: 3.2.0 -> 3.2.1

---
 pkgs/by-name/ma/manifold/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/manifold/package.nix b/pkgs/by-name/ma/manifold/package.nix
index 179a5f685e48..50c41e0bbdf9 100644
--- a/pkgs/by-name/ma/manifold/package.nix
+++ b/pkgs/by-name/ma/manifold/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "manifold";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "elalish";
     repo = "manifold";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tcEjgOU90tYnlZDedHJvnqWFDDtXGx64G80wnWz4lBI=";
+    hash = "sha256-d/e4SKwfKqvLZgQu/Gfwsym9/XqEqQr7fWNSyLtCxzs=";
   };
 
   nativeBuildInputs = [ cmake ];

From 1ba471ace042cff4acdf0ccec9590dcbd1dc68db Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Aug 2025 09:02:03 +0000
Subject: [PATCH 44/54] kanboard: 1.2.46 -> 1.2.47

---
 pkgs/by-name/ka/kanboard/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ka/kanboard/package.nix b/pkgs/by-name/ka/kanboard/package.nix
index 2fa45a167ce0..5eb89e73d5fc 100644
--- a/pkgs/by-name/ka/kanboard/package.nix
+++ b/pkgs/by-name/ka/kanboard/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kanboard";
-  version = "1.2.46";
+  version = "1.2.47";
 
   src = fetchFromGitHub {
     owner = "kanboard";
     repo = "kanboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IYnlBNa4f+ZpOttQHlIZi8wsZYJuB/kWWLwhQK8vdQY=";
+    hash = "sha256-LedK1Ct4xz88r4gvN2jxOE/7Yg6rnrnjCHdhmn3tun4=";
   };
 
   dontBuild = true;

From b9e3822cf143cc4a34af3d7d4b2f102027695dfe Mon Sep 17 00:00:00 2001
From: unixpariah <100892812+unixpariah@users.noreply.github.com>
Date: Tue, 12 Aug 2025 21:51:51 +0200
Subject: [PATCH 45/54] sccache: add distributed features (dist-client,
 dist-server)

---
 pkgs/by-name/sc/sccache/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/sc/sccache/package.nix b/pkgs/by-name/sc/sccache/package.nix
index a84126411ace..5bec7dd7043b 100644
--- a/pkgs/by-name/sc/sccache/package.nix
+++ b/pkgs/by-name/sc/sccache/package.nix
@@ -4,6 +4,7 @@
   rustPlatform,
   pkg-config,
   openssl,
+  distributed ? false,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -19,6 +20,11 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-1kfKBN4uRbU5LjbC0cLgMqoGnOSEAdC0S7EzXlfaDPo=";
 
+  buildFeatures = lib.optionals distributed [
+    "dist-client"
+    "dist-server"
+  ];
+
   nativeBuildInputs = [
     pkg-config
   ];

From 22b7bcb53726456d13f92c42f8343cc902467d61 Mon Sep 17 00:00:00 2001
From: unixpariah <100892812+unixpariah@users.noreply.github.com>
Date: Tue, 12 Aug 2025 21:54:30 +0200
Subject: [PATCH 46/54] sccache: use `finalAttrs` pattern instead of `rec`

---
 pkgs/by-name/sc/sccache/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/sc/sccache/package.nix b/pkgs/by-name/sc/sccache/package.nix
index 5bec7dd7043b..59ee81490845 100644
--- a/pkgs/by-name/sc/sccache/package.nix
+++ b/pkgs/by-name/sc/sccache/package.nix
@@ -7,14 +7,14 @@
   distributed ? false,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   version = "0.10.0";
   pname = "sccache";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "sccache";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-VEDMeRFQKNPS3V6/DhMWxHR7YWsCzAXTzp0lO+COl08=";
   };
 
@@ -40,11 +40,11 @@ rustPlatform.buildRustPackage rec {
     description = "Ccache with Cloud Storage";
     mainProgram = "sccache";
     homepage = "https://github.com/mozilla/sccache";
-    changelog = "https://github.com/mozilla/sccache/releases/tag/v${version}";
+    changelog = "https://github.com/mozilla/sccache/releases/tag/v${finalAttrs.version}";
     maintainers = with lib.maintainers; [
       doronbehar
       figsoda
     ];
     license = lib.licenses.asl20;
   };
-}
+})

From 92375e4bc96f330075ff5d201fb2f5d70ab57434 Mon Sep 17 00:00:00 2001
From: Volker Diels-Grabsch <v@njh.eu>
Date: Wed, 30 Jul 2025 10:54:34 +0200
Subject: [PATCH 47/54] ocamlPackages.colombe: init at 0.12.0

---
 .../ocaml-modules/colombe/default.nix         | 41 +++++++++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  2 +
 2 files changed, 43 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/colombe/default.nix

diff --git a/pkgs/development/ocaml-modules/colombe/default.nix b/pkgs/development/ocaml-modules/colombe/default.nix
new file mode 100644
index 000000000000..d0ed2b870e54
--- /dev/null
+++ b/pkgs/development/ocaml-modules/colombe/default.nix
@@ -0,0 +1,41 @@
+{
+  alcotest,
+  angstrom,
+  buildDunePackage,
+  crowbar,
+  emile,
+  fetchurl,
+  fmt,
+  ipaddr,
+  lib,
+}:
+
+let
+  pname = "colombe";
+  version = "0.12.0";
+in
+buildDunePackage {
+  inherit pname version;
+  minimalOCamlVersion = "4.03";
+  src = fetchurl {
+    url = "https://github.com/mirage/colombe/releases/download/v${version}/colombe-${version}.tbz";
+    hash = "sha256-9g9l0wTzlXtESNeoBxhjMxlX0bRFY19T2+PN1lZ7ojE=";
+  };
+  propagatedBuildInputs = [
+    angstrom
+    emile
+    fmt
+    ipaddr
+  ];
+  doCheck = true;
+  checkInputs = [
+    alcotest
+    crowbar
+  ];
+  meta = {
+    description = "SMTP protocol according to RFC5321 without extensions";
+    homepage = "https://github.com/mirage/colombe";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vog ];
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index e7b4290548a8..293b6d6a16dc 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -262,6 +262,8 @@ let
 
         coin = callPackage ../development/ocaml-modules/coin { };
 
+        colombe = callPackage ../development/ocaml-modules/colombe { };
+
         color = callPackage ../development/ocaml-modules/color { };
 
         colors = callPackage ../development/ocaml-modules/colors { };

From 8c5b5260ecc17fdfd2c41e816b46ff43af91bf61 Mon Sep 17 00:00:00 2001
From: Volker Diels-Grabsch <v@njh.eu>
Date: Wed, 30 Jul 2025 10:55:23 +0200
Subject: [PATCH 48/54] ocamlPackages.sendmail: init at 0.12.0

---
 .../ocaml-modules/colombe/sendmail.nix        | 36 +++++++++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  2 ++
 2 files changed, 38 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/colombe/sendmail.nix

diff --git a/pkgs/development/ocaml-modules/colombe/sendmail.nix b/pkgs/development/ocaml-modules/colombe/sendmail.nix
new file mode 100644
index 000000000000..639102d95f96
--- /dev/null
+++ b/pkgs/development/ocaml-modules/colombe/sendmail.nix
@@ -0,0 +1,36 @@
+{
+  alcotest,
+  angstrom,
+  base64,
+  buildDunePackage,
+  colombe,
+  hxd,
+  ke,
+  lib,
+  logs,
+  mrmime,
+  rresult,
+  tls,
+}:
+
+buildDunePackage {
+  pname = "sendmail";
+  inherit (colombe) version src;
+  propagatedBuildInputs = [
+    base64
+    colombe
+    logs
+    rresult
+    hxd
+    ke
+    tls
+  ];
+  doCheck = true;
+  checkInputs = [
+    alcotest
+    mrmime
+  ];
+  meta = colombe.meta // {
+    description = "Library to be able to send an email";
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 293b6d6a16dc..5f7839023fe8 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1895,6 +1895,8 @@ let
 
         semver = callPackage ../development/ocaml-modules/semver { };
 
+        sendmail = callPackage ../development/ocaml-modules/colombe/sendmail.nix { };
+
         seq = callPackage ../development/ocaml-modules/seq { };
 
         seqes = callPackage ../development/ocaml-modules/seqes { };

From ad911115b254a2f6185c7e5ebd0469dfc4fb9841 Mon Sep 17 00:00:00 2001
From: Volker Diels-Grabsch <v@njh.eu>
Date: Wed, 30 Jul 2025 08:56:33 +0000
Subject: [PATCH 49/54] ocamlPackages.letters: init at 0.4.0

---
 .../ocaml-modules/letters/default.nix         | 58 +++++++++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  2 +
 2 files changed, 60 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/letters/default.nix

diff --git a/pkgs/development/ocaml-modules/letters/default.nix b/pkgs/development/ocaml-modules/letters/default.nix
new file mode 100644
index 000000000000..e3588c3a21d7
--- /dev/null
+++ b/pkgs/development/ocaml-modules/letters/default.nix
@@ -0,0 +1,58 @@
+{
+  alcotest-lwt,
+  buildDunePackage,
+  ca-certs,
+  colombe,
+  containers,
+  domain-name,
+  emile,
+  fetchFromGitHub,
+  fmt,
+  lib,
+  logs,
+  lwt,
+  mrmime,
+  ptime,
+  rresult,
+  sendmail,
+  tls-lwt,
+  x509,
+}:
+
+let
+  pname = "letters";
+  version = "0.4.0";
+in
+buildDunePackage {
+  inherit pname version;
+  src = fetchFromGitHub {
+    owner = "oxidizing";
+    repo = "letters";
+    tag = version;
+    hash = "sha256-75uLg+0AVDNdQ0M4w8H7MrTYwAKMhe8R5xC4vPNGkuQ=";
+  };
+  propagatedBuildInputs = [
+    ca-certs
+    colombe
+    containers
+    domain-name
+    emile
+    fmt
+    logs
+    lwt
+    mrmime
+    ptime
+    rresult
+    sendmail
+    tls-lwt
+    x509
+  ];
+  doCheck = true;
+  checkInputs = [ alcotest-lwt ];
+  meta = {
+    description = "OCaml library for creating and sending emails over SMTP using LWT";
+    homepage = "https://github.com/oxidizing/letters";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vog ];
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 5f7839023fe8..18bcbf85296a 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1044,6 +1044,8 @@ let
 
         letsencrypt-mirage = callPackage ../development/ocaml-modules/letsencrypt/mirage.nix { };
 
+        letters = callPackage ../development/ocaml-modules/letters { };
+
         libc = callPackage ../development/ocaml-modules/libc { };
 
         lilv = callPackage ../development/ocaml-modules/lilv {

From f8c9aa18ba409d9272d8003a1d91eeb09abca410 Mon Sep 17 00:00:00 2001
From: thattemperature <2719023332@qq.com>
Date: Tue, 12 Aug 2025 11:42:12 +0800
Subject: [PATCH 50/54] emacsPackages.eaf-browser: init at
 0-unstable-2025-06-14

---
 .../emacs/elisp-packages/manual-packages.nix  |  4 ++
 .../manual-packages/eaf-browser/default.nix   | 71 +++++++++++++++++++
 2 files changed, 75 insertions(+)
 create mode 100644 pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-browser/default.nix

diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
index 948a730d0c6f..79abf276094e 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
@@ -15,6 +15,10 @@ lib.packagesFromDirectoryRecursive {
     inherit (pkgs) codeium;
   };
 
+  eaf-browser = callPackage ./manual-packages/eaf-browser {
+    inherit (pkgs) aria2;
+  };
+
   elpaca = callPackage ./manual-packages/elpaca { inherit (pkgs) git; };
 
   emacs-application-framework = callPackage ./manual-packages/emacs-application-framework {
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-browser/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-browser/default.nix
new file mode 100644
index 000000000000..27cca359f5b8
--- /dev/null
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-browser/default.nix
@@ -0,0 +1,71 @@
+{
+  # Basic
+  lib,
+  melpaBuild,
+  fetchFromGitHub,
+  # Dependencies
+  aria2,
+  # Java Script dependency
+  nodejs,
+  fetchNpmDeps,
+  npmHooks,
+  # Updater
+  nix-update-script,
+}:
+
+melpaBuild (finalAttrs: {
+
+  pname = "eaf-browser";
+  version = "0-unstable-2025-06-14";
+
+  src = fetchFromGitHub {
+    owner = "emacs-eaf";
+    repo = "eaf-browser";
+    rev = "120967319132f361a2b27f89ee54d1984aa23eaf";
+    hash = "sha256-DsPrctB1bSGBPQLI2LsnSUtqnzWpZRrWrVZM8lS9fms=";
+  };
+
+  env.npmDeps = fetchNpmDeps {
+    name = "${finalAttrs.pname}-npm-deps";
+    inherit (finalAttrs) src;
+    hash = "sha256-UfQL7rN47nI1FyhgBlzH4QtyVCn0wGV3Rv5Y+aidRNE=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    npmHooks.npmConfigHook
+  ];
+
+  files = ''
+    ("*.el"
+     "*.py"
+     "easylist.txt"
+     "aria2-ng")
+  '';
+
+  postInstall = ''
+    LISPDIR=$out/share/emacs/site-lisp/elpa/${finalAttrs.ename}-${finalAttrs.melpaVersion}
+    cp -r node_modules $LISPDIR/
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+    eafPythonDeps =
+      ps: with ps; [
+        pysocks
+      ];
+    eafOtherDeps = [
+      aria2
+    ];
+  };
+
+  meta = {
+    description = "Modern browser in Emacs";
+    homepage = "https://github.com/emacs-eaf/eaf-browser";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      thattemperature
+    ];
+  };
+
+})

From 5f7fd2471c00a100d7a7d0a4cd63783906b905b6 Mon Sep 17 00:00:00 2001
From: Michael Rodler <m@mrodler.eu>
Date: Tue, 12 Aug 2025 20:33:16 +0200
Subject: [PATCH 51/54] python3Packages.python-doi: 0.1.1 -> 0.2

---
 pkgs/development/python-modules/python-doi/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/python-doi/default.nix b/pkgs/development/python-modules/python-doi/default.nix
index c624d1284532..37494e57e1e4 100644
--- a/pkgs/development/python-modules/python-doi/default.nix
+++ b/pkgs/development/python-modules/python-doi/default.nix
@@ -7,21 +7,21 @@
 
 buildPythonPackage rec {
   pname = "python-doi";
-  version = "0.1.1";
+  version = "0.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "papis";
     repo = "python-doi";
     rev = "v${version}";
-    sha256 = "1wa5inh2a0drjswrnhjv6m23mvbfdgqj2jb8fya7q0armzp7l6fr";
+    sha256 = "sha256-c5Wo/bJuHwAG7XOy4Re9joYw14jWZ6QaRB4Wsk8StL0=";
   };
 
   disabled = !isPy3k;
 
   meta = with lib; {
     description = "Python library to work with Document Object Identifiers (doi)";
-    homepage = "https://github.com/alejandrogallo/python-doi";
+    homepage = "https://github.com/papis/python-doi";
     maintainers = with maintainers; [ teto ];
   };
 }

From 1628f7f58f0bc839e06562ba83c04f996a0cfcc4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Aug 2025 10:42:56 +0000
Subject: [PATCH 52/54] uuu: 1.5.219 -> 1.5.222

---
 pkgs/by-name/uu/uuu/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/uu/uuu/package.nix b/pkgs/by-name/uu/uuu/package.nix
index 3aaddaa5e5b5..314c60697970 100644
--- a/pkgs/by-name/uu/uuu/package.nix
+++ b/pkgs/by-name/uu/uuu/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uuu";
-  version = "1.5.219";
+  version = "1.5.222";
 
   src = fetchFromGitHub {
     owner = "nxp-imx";
     repo = "mfgtools";
     rev = "uuu_${finalAttrs.version}";
-    hash = "sha256-hiRKW97PBU6bIXnS/D1oPaSLpY8Z/wm+m8Pp/4RCVQM=";
+    hash = "sha256-n5CgsArkj67vR6WaUaTUYno1pFffXRxjlC7kU8N/oEM=";
   };
 
   passthru.updateScript = nix-update-script {

From ea96ba8bf0e4e1db18f2518479ddbb7aa8832af5 Mon Sep 17 00:00:00 2001
From: Jared Baur <jaredbaur@fastmail.com>
Date: Wed, 13 Aug 2025 04:18:14 -0700
Subject: [PATCH 53/54] 3cpio: remove useFetchCargoVendor

---
 pkgs/by-name/_3/_3cpio/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/_3/_3cpio/package.nix b/pkgs/by-name/_3/_3cpio/package.nix
index cd9020c80f60..a708c12ff018 100644
--- a/pkgs/by-name/_3/_3cpio/package.nix
+++ b/pkgs/by-name/_3/_3cpio/package.nix
@@ -18,7 +18,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-1kdJSwe9v7ojdukj04/G/RDeEk0NVCXmiNoVaelqt4Y=";
   };
 
-  useFetchCargoVendor = true;
   cargoHash = "sha256-axPghG1T5NZYzGRZBwtdBJ5tQh+h8/vep/EmL5ADCjE=";
 
   # Tests attempt to access arbitrary filepaths

From 5ae00382193048acfd2ef314cfe185c7faf00c57 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 13 Aug 2025 11:33:08 +0000
Subject: [PATCH 54/54] bitrise: 2.32.1 -> 2.33.0

---
 pkgs/by-name/bi/bitrise/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bi/bitrise/package.nix b/pkgs/by-name/bi/bitrise/package.nix
index 5160e87fbb22..6f75e4e69fa1 100644
--- a/pkgs/by-name/bi/bitrise/package.nix
+++ b/pkgs/by-name/bi/bitrise/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "bitrise";
-  version = "2.32.1";
+  version = "2.33.0";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${version}";
-    hash = "sha256-IAuOqL5S9X003OtM9I0gtIIS+NI9snGcM55OPCtQWik=";
+    hash = "sha256-MpXJQHmpE9s3GYpqyrWCTBIzMCdb+nBAw+2DXmnK3Lw=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access