From e21e664067a86ac8c874d697f0b41950552b70b5 Mon Sep 17 00:00:00 2001
From: Antonis Kotronakis <mail@akotro.dev>
Date: Sun, 17 May 2026 17:35:19 +0100
Subject: [PATCH 01/83] nixos/tuwunel: added environmentFile option

---
 nixos/modules/services/matrix/tuwunel.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/nixos/modules/services/matrix/tuwunel.nix b/nixos/modules/services/matrix/tuwunel.nix
index 6296fd6cb6cf..6a17ac5f726d 100644
--- a/nixos/modules/services/matrix/tuwunel.nix
+++ b/nixos/modules/services/matrix/tuwunel.nix
@@ -62,6 +62,19 @@ in
       };
     };
 
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/secrets/matrix-tuwunel.env";
+      description = ''
+        Path to a file containing sensitive environment variables as described in {manpage}`systemd.exec(5).
+
+        Refer to
+        <https://matrix-construct.github.io/tuwunel/configuration.html#environment-variables>
+        for specifying options as environment variables.
+      '';
+    };
+
     settings = lib.mkOption {
       type = lib.types.submodule {
         freeformType = format.type;
@@ -255,6 +268,7 @@ in
         ExecStart = lib.getExe cfg.package;
         Restart = "on-failure";
         RestartSec = 10;
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
       };
     };
   };

From 35fd55e84d639f66082f3bc894385f5386f66246 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 7 Jun 2026 01:36:23 +0000
Subject: [PATCH 02/83] kde-rounded-corners: 0.8.7 -> 0.9.0

---
 pkgs/by-name/kd/kde-rounded-corners/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/kd/kde-rounded-corners/package.nix b/pkgs/by-name/kd/kde-rounded-corners/package.nix
index adde7bfc8e3b..a569c0ca6d9b 100644
--- a/pkgs/by-name/kd/kde-rounded-corners/package.nix
+++ b/pkgs/by-name/kd/kde-rounded-corners/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kde-rounded-corners";
-  version = "0.8.7";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "matinlotfali";
     repo = "KDE-Rounded-Corners";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ivWOMl0cveJHC6eX/QYteVi2GaRJ/2j02YlDj/Uvs1s=";
+    hash = "sha256-JZlrjVjA2OGZhWpkSYvwYpPx4tmqlMvi4cP4zM4hxFc=";
   };
 
   nativeBuildInputs = [

From ba82d660dcc1e453b6f51c8cdea5b91486dc2792 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Jun 2026 06:28:38 +0000
Subject: [PATCH 03/83] badger: 4.9.1 -> 4.9.2

---
 pkgs/by-name/ba/badger/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ba/badger/package.nix b/pkgs/by-name/ba/badger/package.nix
index 90643e18ae4d..51f878f4f1b1 100644
--- a/pkgs/by-name/ba/badger/package.nix
+++ b/pkgs/by-name/ba/badger/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "badger";
-  version = "4.9.1";
+  version = "4.9.2";
 
   src = fetchFromGitHub {
     owner = "dgraph-io";
     repo = "badger";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BsKFi4oMNJE09PBjFmqNhbMcQcHk5uR5QssbwN2ZNCk=";
+    hash = "sha256-L6qGeOZlIl6I87t9Ohk57bA+WXT7NwMOJkiA3WaMFhM=";
   };
 
-  vendorHash = "sha256-+rXXCVH2xuULPzdM0KVPwYht+tu0qyxPjLLaBMWVIuI=";
+  vendorHash = "sha256-KDIwEH83nPMJPJGTN3UgO00pjYwR17XqGdPXioP1YcY=";
 
   subPackages = [ "badger" ];
 

From 140489168ec6a6eaa6e2f10f4e061b3cff20bed1 Mon Sep 17 00:00:00 2001
From: Josh Hoffer <jhoffer@sansorgan.es>
Date: Wed, 10 Jun 2026 15:40:57 -0700
Subject: [PATCH 04/83] nixos/uki: use config systemd package

Use the config's systemd package. This makes patching systemd-stub
easier. All other ukify settings are set from config so this is
more consistent.
---
 nixos/modules/system/boot/uki.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/system/boot/uki.nix b/nixos/modules/system/boot/uki.nix
index fa12c63b751a..a33822a9ba37 100644
--- a/nixos/modules/system/boot/uki.nix
+++ b/nixos/modules/system/boot/uki.nix
@@ -81,7 +81,7 @@ in
         Linux = lib.mkOptionDefault "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}";
         Initrd = lib.mkOptionDefault "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
         Cmdline = lib.mkOptionDefault "init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}";
-        Stub = lib.mkOptionDefault "${pkgs.systemd}/lib/systemd/boot/efi/linux${efiArch}.efi.stub";
+        Stub = lib.mkOptionDefault "${config.systemd.package}/lib/systemd/boot/efi/linux${efiArch}.efi.stub";
         Uname = lib.mkOptionDefault "${config.boot.kernelPackages.kernel.modDirVersion}";
         OSRelease = lib.mkOptionDefault "@${config.system.build.etc}/etc/os-release";
         # This is needed for cross compiling.

From ad97c22f57c97a9e86f9ce608e0dac25e0ed7dc2 Mon Sep 17 00:00:00 2001
From: Thomas Butter <tbutter@gmail.com>
Date: Wed, 17 Jun 2026 05:49:01 +0000
Subject: [PATCH 05/83] pgrok: 1.5.0 -> 1.7.0

---
 pkgs/by-name/pg/pgrok/package.nix | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/pg/pgrok/package.nix b/pkgs/by-name/pg/pgrok/package.nix
index 231fbb265f68..7a8bef55ef44 100644
--- a/pkgs/by-name/pg/pgrok/package.nix
+++ b/pkgs/by-name/pg/pgrok/package.nix
@@ -11,12 +11,12 @@
 
 let
   pname = "pgrok";
-  version = "1.5.0";
+  version = "1.7.0";
   src = fetchFromGitHub {
     owner = "pgrok";
     repo = "pgrok";
     tag = "v${version}";
-    hash = "sha256-arPFccclBie3XOBt0q6UC96fPaPc7NmgQDMsd2H2bhI=";
+    hash = "sha256-uMHeVxAGmAEIOfCK9SEFsL7GZZIUNMYdoV8XeHjXmWc=";
   };
 in
 
@@ -34,6 +34,18 @@ buildGoModule {
     pnpm_9
   ];
 
+  postPatch = ''
+    # Rename directories to avoid binary naming conflicts (both would be named "cli")
+    mv pgrok/cli pgrok/pgrok
+    mv pgrokd/cli pgrokd/pgrokd
+
+    # Update references in Go code and web app package.json to match renamed directory
+    substituteInPlace pgrokd/pgrokd/main.go \
+      --replace-fail "github.com/pgrok/pgrok/pgrokd/cli/internal/web" "github.com/pgrok/pgrok/pgrokd/pgrokd/internal/web"
+    substituteInPlace pgrokd/web/package.json \
+      --replace-fail "../cli/internal/web/dist" "../pgrokd/internal/web/dist"
+  '';
+
   env.pnpmDeps = fetchPnpmDeps {
     inherit
       pname
@@ -42,10 +54,10 @@ buildGoModule {
       ;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-D8UZoN0ZnjB8CXQiHmBZwBEt57XGb5SDLg61xxSqNus=";
+    hash = "sha256-O3bDxnxeRO20FsRNpgXfz4UweYJmeU6zgrrPJ05fgWo=";
   };
 
-  vendorHash = "sha256-ob8s1jYL2+JGaqjCsM10jgirPiEyTY4U3IVVlHVdoGQ=";
+  vendorHash = "sha256-fhyyyXHUJsIWiCZbqtLZZRuIG9hb0LAkSo7lKW0i8Sk";
 
   ldflags = [
     "-s"
@@ -66,10 +78,6 @@ buildGoModule {
     pnpm run build
 
     popd
-
-    # rename packages due to naming conflict
-    mv pgrok/cli/ pgrok/pgrok/
-    mv pgrokd/cli/ pgrokd/pgrokd/
   '';
 
   postInstall = ''

From f51d8dfb421858b1a689889c8d76c9596cc42130 Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Thu, 18 Jun 2026 09:59:26 +0200
Subject: [PATCH 06/83] pkgs/nixos-render-docs: introduce sidebar navigation

---
 doc/style.css                                 | 71 ++++++++++++++++++-
 .../src/nixos_render_docs/manual.py           |  8 ++-
 2 files changed, 73 insertions(+), 6 deletions(-)

diff --git a/doc/style.css b/doc/style.css
index 96b6979474db..c3c58e88637d 100644
--- a/doc/style.css
+++ b/doc/style.css
@@ -34,7 +34,7 @@ body {
   }
 }
 
-.book .list-of-examples {
+.list-of-examples {
   display: none;
 }
 
@@ -392,8 +392,7 @@ div.appendix .toc dt {
   margin-top: 0;
 }
 
-div.book .list-of-examples dt,
-div.appendix .list-of-examples dt {
+.list-of-examples dt {
   margin-top: 0;
 }
 
@@ -450,6 +449,7 @@ div.appendix .variablelist .term {
 }
 
 :root {
+  --sidebar-width: 20rem;
   --background: #fff;
   --main-text-color: #000;
   --link-color: #405d99;
@@ -496,3 +496,68 @@ div.appendix .variablelist .term {
 .chapter {
   content-visibility: auto;
 }
+
+.navheader {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  background-color: var(--background);
+}
+
+nav.toc-sidebar {
+  height: 100%;
+  overflow-y: none;
+  padding: 0 1rem 2rem;
+  border-bottom: 0.0625rem solid #d8d8d8;
+}
+
+nav.toc-sidebar .toc {
+  margin-bottom: 0;
+}
+
+nav.toc-sidebar .toc dl {
+  margin: 0;
+}
+
+nav.toc-sidebar .toc dd {
+  margin-left: 1em;
+}
+
+@media screen and (min-width: 768px) {
+  body {
+    height: 100vh;
+    min-height: 0;
+    display: grid;
+    grid-template-columns: minmax(0, 1fr);
+    grid-template-rows: auto minmax(0, 1fr);
+  }
+
+  body:has(> nav.toc-sidebar) {
+    grid-template-columns: var(--sidebar-width) minmax(0, 1fr);
+  }
+
+  .navheader {
+    grid-column: 1 / -1;
+    grid-row: 1;
+  }
+
+  nav.toc-sidebar {
+    grid-column: 1;
+    grid-row: 2;
+    max-height: none;
+    overflow-y: auto;
+    border-bottom: none;
+    border-right: 0.0625rem solid #d8d8d8;
+  }
+
+  main.content {
+    grid-column: 1 / -1;
+    grid-row: 2;
+    overflow-y: auto;
+    padding: 0 1rem;
+  }
+
+  body:has(> nav.toc-sidebar) main.content {
+    grid-column: 2;
+  }
+}
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
index 5b3c30ee1da4..9208148c594b 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
@@ -307,7 +307,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
 
         toc = TocEntry.of(tokens[0])
         return "\n".join([
-            self._file_header(toc),
+            self._file_header(toc, sidebar=self._build_toc(tokens, 0)),
             ' <div class="book">',
             '  <div class="titlepage">',
             '   <div>',
@@ -316,13 +316,12 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
             '   </div>',
             "   <hr />",
             '  </div>',
-            self._build_toc(tokens, 0),
             super(HTMLRenderer, self).render(tokens[6:]),
             ' </div>',
             self._file_footer(toc),
         ])
 
-    def _file_header(self, toc: TocEntry) -> str:
+    def _file_header(self, toc: TocEntry, sidebar: str = "") -> str:
         prev_link, up_link, next_link = "", "", ""
         prev_a, next_a, parent_title = "", "", "&nbsp;"
         nav_html = ""
@@ -384,6 +383,8 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
             ' </head>',
             ' <body>',
             nav_html,
+            f'  <nav class="toc-sidebar">{sidebar}</nav>' if sidebar else "",
+            '  <main class="content">',
         ])
 
     def _file_footer(self, toc: TocEntry) -> str:
@@ -424,6 +425,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
             ])
         return "\n".join([
             nav_html,
+            '  </main>',
             ' </body>',
             '</html>',
         ])

From ca5c018649d7ac20ed22c659c1672bafa33c7bc7 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Fri, 19 Jun 2026 10:36:43 +0800
Subject: [PATCH 07/83] firewalld-gui: fix firewall-{applet,config}

---
 pkgs/by-name/fi/firewalld/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 0d7e5ea21f23..b768985444eb 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -80,6 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
     docbook_xml_dtd_42
     docbook-xsl-nons
     glib
+    gobject-introspection
     intltool
     libxml2
     libxslt
@@ -94,7 +95,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     glib
-    gobject-introspection
     ipset
     iptables
     kmod

From 803113e064b4e3e60dfdb2fb501751ddcf048ad2 Mon Sep 17 00:00:00 2001
From: SamLukeYes <samlukeyes123@gmail.com>
Date: Sat, 1 Nov 2025 23:47:35 +0800
Subject: [PATCH 08/83] pacman: 7.0.0 -> 7.1.0

---
 pkgs/by-name/pa/pacman/dont-create-empty-dirs.patch | 13 +++++++++++--
 pkgs/by-name/pa/pacman/package.nix                  |  6 +-----
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/pa/pacman/dont-create-empty-dirs.patch b/pkgs/by-name/pa/pacman/dont-create-empty-dirs.patch
index 59deb947bb5d..7deaf0448ba1 100644
--- a/pkgs/by-name/pa/pacman/dont-create-empty-dirs.patch
+++ b/pkgs/by-name/pa/pacman/dont-create-empty-dirs.patch
@@ -1,8 +1,17 @@
 diff --git a/meson.build b/meson.build
-index c8ee42fd..610401ca 100644
+index 1e8bd8f8..86e68a75 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -414,15 +414,6 @@ install_data(
+@@ -433,8 +433,6 @@ configure_file(
+   configuration : substs,
+   install_dir : join_paths(SYSCONFDIR, 'makepkg.conf.d/'))
+ 
+-install_emptydir(join_paths(SYSCONFDIR, 'makepkg.d/'))
+-
+ configure_file(
+   input : 'etc/pacman.conf.in',
+   output : 'pacman.conf',
+@@ -448,15 +446,6 @@ install_data(
    'proto/proto.install',
    install_dir : join_paths(DATAROOTDIR, 'pacman'))
  
diff --git a/pkgs/by-name/pa/pacman/package.nix b/pkgs/by-name/pa/pacman/package.nix
index d4faa6298245..51c9c9056e3e 100644
--- a/pkgs/by-name/pa/pacman/package.nix
+++ b/pkgs/by-name/pa/pacman/package.nix
@@ -41,7 +41,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pacman";
-  version = "7.0.0";
+  version = "7.1.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.archlinux.org";
@@ -101,10 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
         --replace-fail "/bin/true" "${coreutils}/bin/true"
       substituteInPlace scripts/repo-add.sh.in \
         --replace-fail bsdtar "${libarchive}/bin/bsdtar"
-
-      # Fix https://gitlab.archlinux.org/pacman/pacman/-/issues/171
-      substituteInPlace scripts/libmakepkg/source/git.sh.in \
-        --replace-warn "---mirror" "--mirror"
     '';
 
   mesonFlags = [

From 95b6fb4b949ac77f60d1ef18637367db0cac669e Mon Sep 17 00:00:00 2001
From: SamLukeYes <samlukeyes123@gmail.com>
Date: Sun, 25 Jan 2026 13:40:23 +0800
Subject: [PATCH 09/83] paru: 2.1.0 -> 2.1.0-unstable-2026-01-09

---
 pkgs/by-name/pa/paru/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/pa/paru/package.nix b/pkgs/by-name/pa/paru/package.nix
index 4ab3a97d0925..a26dee18b3f5 100644
--- a/pkgs/by-name/pa/paru/package.nix
+++ b/pkgs/by-name/pa/paru/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "paru";
-  version = "2.1.0";
+  version = "2.1.0-unstable-2026-01-09";
 
   src = fetchFromGitHub {
     owner = "Morganamilo";
     repo = "paru";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-i99f2ngYhfVCKpImJ8L7u2T2FgOt7Chp8DHDbrNh1kw=";
+    rev = "9ac3578807a87858651e81a02586ceb947686e7c";
+    hash = "sha256-TJbhxVnP5UhlCmwxKjXq/XaqPGtzHoN5S+lizm3Bmvs=";
   };
 
-  cargoHash = "sha256-USIceRh24WGV0TIrpuyHs4thjaghpxqZmk2uVKBxlm4=";
+  cargoHash = "sha256-Shp/2jQtO3pulT2gmsAcsEVPpv76nbEiGol+kYD7kr8=";
 
   nativeBuildInputs = [
     gettext

From 1ec0b769c1eea3714dd1851ef359ab8734cc6c0e Mon Sep 17 00:00:00 2001
From: SamLukeYes <samlukeyes123@gmail.com>
Date: Sun, 25 Jan 2026 17:50:35 +0800
Subject: [PATCH 10/83] pacman: add bashInteractive dependency

---
 pkgs/by-name/pa/pacman/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/pa/pacman/package.nix b/pkgs/by-name/pa/pacman/package.nix
index 51c9c9056e3e..8347638e28f0 100644
--- a/pkgs/by-name/pa/pacman/package.nix
+++ b/pkgs/by-name/pa/pacman/package.nix
@@ -34,6 +34,9 @@
   gnugrep,
   gnupg,
 
+  # makepkg requires compgen to work
+  bashInteractive,
+
   # Tells pacman where to find ALPM hooks provided by packages.
   # This path is very likely to be used in an Arch-like root.
   sysHookDir ? "/usr/share/libalpm/hooks/",
@@ -55,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     asciidoc
+    bashInteractive
     gettext
     installShellFiles
     libarchive

From b40b7cf8ea8afc72fc343ae1206bb7fcd8a73cb9 Mon Sep 17 00:00:00 2001
From: SamLukeYes <samlukeyes123@gmail.com>
Date: Fri, 19 Jun 2026 14:17:23 +0800
Subject: [PATCH 11/83] pacman: use tag instead of rev

---
 pkgs/by-name/pa/pacman/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pa/pacman/package.nix b/pkgs/by-name/pa/pacman/package.nix
index 8347638e28f0..b761137cbf60 100644
--- a/pkgs/by-name/pa/pacman/package.nix
+++ b/pkgs/by-name/pa/pacman/package.nix
@@ -50,8 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
     domain = "gitlab.archlinux.org";
     owner = "pacman";
     repo = "pacman";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-ejOBxN2HjV4dZwFA7zvPz3JUJa0xiJ/jZ+evEQYG1Mc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bGg2ZrIsEYJYZCLsIh4FZROhpyLSBO0Lar1mSoz66wI=";
   };
 
   strictDeps = true;

From a99d35372029b8a2262a495b87736e245628752d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 20 Jun 2026 09:22:02 +0000
Subject: [PATCH 12/83] gogcli: 0.11.0 -> 0.29.0

---
 pkgs/by-name/go/gogcli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/gogcli/package.nix b/pkgs/by-name/go/gogcli/package.nix
index 5d7d9c06b5d6..950513c2261c 100644
--- a/pkgs/by-name/go/gogcli/package.nix
+++ b/pkgs/by-name/go/gogcli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gogcli";
-  version = "0.11.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "steipete";
     repo = "gogcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hJU40ysjRx4p9SWGmbhhpToYCpk3DcMAWCnKqxHRmh0=";
+    hash = "sha256-JunPpEzbNp00uEiJ7AzouXyzFwyNLehLU7mwL3eh4bM=";
   };
 
-  vendorHash = "sha256-WGRlv3UsK3SVBQySD7uZ8+FiRl03p0rzjBm9Se1iITs=";
+  vendorHash = "sha256-JrRIUYpw2lAD0ezi0HTZvS42OS7vP8DAHU3m0u3eCbM=";
 
   subPackages = [ "cmd/gog" ];
 

From fad6c551540c1d85f204504ed423936c3d1e9194 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 20 Jun 2026 12:02:50 +0000
Subject: [PATCH 13/83] ocamlPackages.ca-certs-nss: 3.121 -> 3.125

---
 pkgs/development/ocaml-modules/ca-certs-nss/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
index 061763973722..a3c1b8cb2395 100644
--- a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@@ -14,13 +14,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "ca-certs-nss";
-  version = "3.121";
+  version = "3.125";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs-nss/releases/download/v${finalAttrs.version}/ca-certs-nss-${finalAttrs.version}.tbz";
-    hash = "sha256-KLFr7n9DORIkRHXud/xe61DkxKAKPZ1TopGCeK5h45w=";
+    hash = "sha256-mF0XgW/8YiZjDSaAjloI6cIEGJbEuclYitZ6kAmyWWQ=";
   };
 
   propagatedBuildInputs = [

From ba61d33e7026371bdd0bacbfbd327f89aa637197 Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Fri, 19 Jun 2026 15:31:30 -0700
Subject: [PATCH 14/83] python3Packages.stanza: 1.12.2 -> 1.13.0

Changelog: https://github.com/stanfordnlp/stanza/releases/tag/v1.13.0

This release uses huggingface-hub to download models instead of
downloading them over HTTP with the requests library, hence the new
dependency (note: huggingface-hub is already a transitive dependency
of this package via peft).
---
 pkgs/development/python-modules/stanza/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/stanza/default.nix b/pkgs/development/python-modules/stanza/default.nix
index 8ba3b9f599c6..2c8cde03e1cf 100644
--- a/pkgs/development/python-modules/stanza/default.nix
+++ b/pkgs/development/python-modules/stanza/default.nix
@@ -6,6 +6,7 @@
   setuptools,
   # dependencies
   emoji,
+  huggingface-hub,
   networkx,
   numpy,
   peft,
@@ -20,20 +21,21 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "stanza";
-  version = "1.12.2";
+  version = "1.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stanfordnlp";
     repo = "stanza";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hUI8sZDwBK8ZRS9asyDiTqpoIGnGbHeH/Q9i/gasut0=";
+    hash = "sha256-+quLNaxaGCUpsg3PH11nEMeKjIoHsKaBqK4FdIHlaMM=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
     emoji
+    huggingface-hub
     networkx
     numpy
     peft

From e95fa37b159078640be8ec845b6302802b02c925 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 21 Jun 2026 04:27:40 +0000
Subject: [PATCH 15/83] newelle: 1.3.7 -> 1.4.5

---
 pkgs/by-name/ne/newelle/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ne/newelle/package.nix b/pkgs/by-name/ne/newelle/package.nix
index 027551626794..cb118e03f15f 100644
--- a/pkgs/by-name/ne/newelle/package.nix
+++ b/pkgs/by-name/ne/newelle/package.nix
@@ -20,7 +20,7 @@
 }:
 
 let
-  version = "1.3.7";
+  version = "1.4.5";
 in
 python3Packages.buildPythonApplication {
   pname = "newelle";
@@ -31,7 +31,7 @@ python3Packages.buildPythonApplication {
     owner = "qwersyk";
     repo = "Newelle";
     tag = version;
-    hash = "sha256-Qa1f6lNfKt1hh1gWJ45n9rwjO5lSO2d0tMII27glU/E=";
+    hash = "sha256-GcNAwrk5y6F0BgRy69nRePkX4WoYviWsB+8X/+N5QwE=";
   };
 
   postPatch = ''

From bbc252da8eb965e4b474c33863558f6831ab82b5 Mon Sep 17 00:00:00 2001
From: fliiiix <hi@l33t.name>
Date: Sun, 21 Jun 2026 20:51:22 +0200
Subject: [PATCH 16/83] polybar: Remove unused pcre

---
 pkgs/by-name/po/polybar/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/po/polybar/package.nix b/pkgs/by-name/po/polybar/package.nix
index 1890481c389c..50de2ab4b755 100644
--- a/pkgs/by-name/po/polybar/package.nix
+++ b/pkgs/by-name/po/polybar/package.nix
@@ -8,7 +8,6 @@
   libxdmcp,
   libpthread-stubs,
   libxcb,
-  pcre,
   pkg-config,
   python3,
   python3Packages, # sphinx-build
@@ -68,7 +67,6 @@ stdenv.mkDerivation (finalAttrs: {
     libxdmcp
     libpthread-stubs
     libxcb
-    pcre
     python3
     xcbproto
     libxcb-util

From 107d882dcef2681278518fa1fe566ae270b4dfb2 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 21 Jun 2026 19:08:40 -0300
Subject: [PATCH 17/83] convertx: 0.17.0 -> 0.18.0

---
 pkgs/by-name/co/convertx/package.nix | 9 +++++----
 pkgs/by-name/co/convertx/pin.json    | 8 ++++----
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/co/convertx/package.nix b/pkgs/by-name/co/convertx/package.nix
index 153ab012903a..49dd77cf384f 100644
--- a/pkgs/by-name/co/convertx/package.nix
+++ b/pkgs/by-name/co/convertx/package.nix
@@ -1,5 +1,5 @@
 {
-  stdenv,
+  stdenvNoCC,
   lib,
   fetchFromGitHub,
 
@@ -43,11 +43,12 @@ let
     hash = pin.srcHash;
   };
 
-  node_modules = stdenv.mkDerivation (finalAttrs: {
+  node_modules = stdenvNoCC.mkDerivation (finalAttrs: {
     pname = "${pname}-node_modules";
     inherit version src;
 
     dontConfigure = true;
+    dontFixup = true;
 
     nativeBuildInputs = [
       bun
@@ -70,11 +71,11 @@ let
       cp package.json $out/lib
     '';
 
-    outputHash = pin."${stdenv.system}";
+    outputHash = pin."${stdenvNoCC.system}";
     outputHashMode = "recursive";
   });
 in
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   inherit pname version src;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/convertx/pin.json b/pkgs/by-name/co/convertx/pin.json
index 1fc9e21d094a..928e63882b97 100644
--- a/pkgs/by-name/co/convertx/pin.json
+++ b/pkgs/by-name/co/convertx/pin.json
@@ -1,6 +1,6 @@
 {
-  "version": "0.17.0",
-  "srcHash": "sha256-1W7M9BfAh89ntmJW7tNwydwPCkVy5CoddWb2aPPUFds=",
-  "x86_64-linux": "sha256-7B4ZGGew6isFnz7EoaLyJgO6a66V9ZTKsKxXwVSsnfs=",
-  "aarch64-linux": "sha256-IoQP9UBd64qecOwmI8oQREgiYCL2pXGjfVx1Ylvd/WA="
+  "version": "0.18.0",
+  "srcHash": "sha256-S8oUU21VOy+4MiWvnEBOSUBuMysYq9H4tQIcEOvLjKw=",
+  "x86_64-linux": "sha256-rAZROhjbvGg/7aRPlh6yGmPDmbEsYjDHJEVaWXejxts=",
+  "aarch64-linux": "sha256-yJbwexqwe95XIZ51gbjwpg6cRm5ssJl1qrIS+Vrd+vo="
 }

From 21f49adcf1eb9cc5aedd2abb8bfdafbc7bd84bd5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 02:00:21 +0000
Subject: [PATCH 18/83] kubevirt: 1.8.2 -> 1.8.4

---
 pkgs/by-name/ku/kubevirt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ku/kubevirt/package.nix b/pkgs/by-name/ku/kubevirt/package.nix
index ef233f4fb9b5..660fd8893edf 100644
--- a/pkgs/by-name/ku/kubevirt/package.nix
+++ b/pkgs/by-name/ku/kubevirt/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubevirt";
-  version = "1.8.2";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "kubevirt";
     repo = "kubevirt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YSrMJz0L0Ybw5G6p42YAMMa1D1xc9G8sBLdxjxz3axg=";
+    hash = "sha256-4MQtONb8opLDBLtGr+5oDrOQkkK1q4RlMXDcqyilarM=";
   };
 
   vendorHash = null;

From 52a02f7d54db028bce866112cd19870349c38727 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 09:55:11 +0000
Subject: [PATCH 19/83] amp-cli: 0.0.1781370323-g977781 ->
 0.0.1782120930-g64087b

---
 pkgs/by-name/am/amp-cli/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/am/amp-cli/package.nix b/pkgs/by-name/am/amp-cli/package.nix
index 9d550582c9d3..d74fdc80035b 100644
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@@ -27,7 +27,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1781370323-g977781";
+  version = "0.0.1782120930-g64087b";
 
   src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};
 
@@ -78,10 +78,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
         hash =
           {
-            x86_64-linux = "sha256-taXa0AE0re6IoUxr/Sa7Os/pt/u0Zm+eCxRbRW019fA=";
-            aarch64-linux = "sha256-gFfgGlFB+HpV+KAitpOtXu2ij7hQYmxzm8gzy+l79us=";
-            x86_64-darwin = "sha256-1L+J9i/y5fg2rySOfAZySnBbqgmxpM7+7h9CoREI14s=";
-            aarch64-darwin = "sha256-1I7roExnTQFjByVDDr6ym3X+70Ba9IVE9vxBHVlJQIY=";
+            x86_64-linux = "sha256-Ye1ch/mmhFelSv77Yy+fbpiBUlXzInACp2Hux+CLQzk=";
+            aarch64-linux = "sha256-cGV6tqiaHDjSCjhlSgAf0wIcOXY0Y78G2IT0ZQ5uuNk=";
+            x86_64-darwin = "sha256-5UmALYPSfUceumD4puKbMY+VwUsmAojHuu3pNXxVOr4=";
+            aarch64-darwin = "sha256-zzpPWKfYHAEXLNvAucVOwm0HE8Ui3Ai31XMs+utlXF4=";
           }
           .${system'};
       }

From d4d028a336f6e7094a67ca72c24f65693efd9dd5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 22 Jun 2026 11:35:15 +0200
Subject: [PATCH 20/83] python314Packages.osc-lib: fix hash which was forgotten
 to be updated

---
 pkgs/development/python-modules/osc-lib/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/osc-lib/default.nix b/pkgs/development/python-modules/osc-lib/default.nix
index d36ea86e78f5..bc8801c50dbe 100644
--- a/pkgs/development/python-modules/osc-lib/default.nix
+++ b/pkgs/development/python-modules/osc-lib/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "openstack";
     repo = "osc-lib";
     tag = version;
-    hash = "sha256-HYRm3GdgGUZqi7sqe2wmni2t0t7Ox3qJAukGABKPoyY=";
+    hash = "sha256-XwOJSd3k/74FvSZGveSTjH+KGLlQ2jNbk8GrTzFhbL0=";
   };
 
   patches = [

From c456aeab232173fb04da342d54ce5e53cf804780 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 22 Jun 2026 11:35:33 +0200
Subject: [PATCH 21/83] python314Packages.python-openstackclient: remove no
 longer failing tests

---
 .../python-modules/python-openstackclient/default.nix        | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/development/python-modules/python-openstackclient/default.nix b/pkgs/development/python-modules/python-openstackclient/default.nix
index b22d3b4ed7df..5a008c978161 100644
--- a/pkgs/development/python-modules/python-openstackclient/default.nix
+++ b/pkgs/development/python-modules/python-openstackclient/default.nix
@@ -82,11 +82,6 @@ buildPythonPackage (finalAttrs: {
     stestrCheckHook
   ];
 
-  disabledTestsRegex = [
-    "openstackclient.tests.unit.common.test_module.TestModuleList*"
-    "openstackclient.tests.unit.common.test_clientmanager.TestClientManager*"
-  ];
-
   pythonImportsCheck = [
     "openstackclient"
     "openstackclient.api"

From 8d12e1709714b8464386feae1e5f581b52e0c4ba Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 10:59:59 +0000
Subject: [PATCH 22/83] fence: 0.1.60 -> 0.1.61

---
 pkgs/by-name/fe/fence/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fe/fence/package.nix b/pkgs/by-name/fe/fence/package.nix
index d71b14fe1a0f..fc4007422868 100644
--- a/pkgs/by-name/fe/fence/package.nix
+++ b/pkgs/by-name/fe/fence/package.nix
@@ -14,16 +14,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "fence";
-  version = "0.1.60";
+  version = "0.1.61";
 
   src = fetchFromGitHub {
     owner = "fencesandbox";
     repo = "fence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4yRfU6fCTGOcA9IeFs9Sk9n1PqXi7E++reVDPlCwS1k=";
+    hash = "sha256-/IVxTPgAzl+mX85M1IyD+21O8j/tIxt2a18TLtQz/zk=";
   };
 
-  vendorHash = "sha256-rZ+ArTdr5GbW+nRzglNgxzsXjuTlTA0uInNWXgAVurM=";
+  vendorHash = "sha256-aMxay3dow6mDKyv396R0j1GOKDmhkX4ebGmhca1B4WE=";
 
   __structuredAttrs = true;
 

From 905b7c6884680f85067f959da70e2a7eb349ef48 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Sun, 21 Jun 2026 18:04:35 -0500
Subject: [PATCH 23/83] wasmtime: add pinned 36.x variant

Expose wasmtime_36 for packages that need the 36.x C API while keeping the default wasmtime on the current major.
---
 pkgs/by-name/wa/wasmtime/package.nix    | 23 ++++++++++++++++++++---
 pkgs/by-name/wa/wasmtime_36/package.nix | 18 ++++++++++++++++++
 2 files changed, 38 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/by-name/wa/wasmtime_36/package.nix

diff --git a/pkgs/by-name/wa/wasmtime/package.nix b/pkgs/by-name/wa/wasmtime/package.nix
index a3cd6a1f0701..034984f5d6de 100644
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@@ -10,23 +10,40 @@
   nix-update-script,
   enableShared ? !stdenv.hostPlatform.isStatic,
   enableStatic ? stdenv.hostPlatform.isStatic,
+  majorVersion ? "45",
 }:
+let
+  sources = {
+    "36" = {
+      version = "36.0.11";
+      hash = "sha256-rrSI2dSOA8/1CL7JhW0eQ7LaeS5EqTVnyn2HTI+/x20=";
+      cargoHash = "sha256-S67/fv7179uDy4PpwycyXSWAknIC/7ZzvzWPOd6MD+8=";
+    };
+    "45" = {
+
+      version = "45.0.2";
+      hash = "sha256-LEQitwz+UDSX4mrjEecmoO/ZPgRnYTZ3DsD1pu8Jybs=";
+      cargoHash = "sha256-uTgEW2w0RSMetd2W1ucGiVMEEvz2A7CQ79SEsE8/+BM=";
+    };
+  };
+  source = sources.${majorVersion};
+in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasmtime";
-  version = "45.0.2";
+  version = source.version;
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasmtime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LEQitwz+UDSX4mrjEecmoO/ZPgRnYTZ3DsD1pu8Jybs=";
+    hash = source.hash;
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-uTgEW2w0RSMetd2W1ucGiVMEEvz2A7CQ79SEsE8/+BM=";
+  cargoHash = source.cargoHash;
   cargoBuildFlags = [
     "--package"
     "wasmtime-cli"
diff --git a/pkgs/by-name/wa/wasmtime_36/package.nix b/pkgs/by-name/wa/wasmtime_36/package.nix
new file mode 100644
index 000000000000..282b821a7642
--- /dev/null
+++ b/pkgs/by-name/wa/wasmtime_36/package.nix
@@ -0,0 +1,18 @@
+{
+  nix-update-script,
+  wasmtime,
+}:
+
+# NOTE: LTS Version EOL August 20 2027
+(wasmtime.override { majorVersion = "36"; }).overrideAttrs (old: {
+  __structuredAttrs = true;
+
+  passthru = old.passthru // {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "^v(36\\.\\d+\\.\\d+)$"
+      ];
+    };
+  };
+})

From a4ad2cc8d6fe84fb9c89bb0dfc3bf89ea037ed3a Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Sun, 21 Jun 2026 18:04:47 -0500
Subject: [PATCH 24/83] tree-sitter: add optional wasm support

Add a wasmSupport override that builds libtree-sitter against wasmtime_36 while leaving the default derivation unchanged.
---
 pkgs/by-name/tr/tree-sitter/package.nix | 35 +++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index 1ae410255fc0..a456828b16b2 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -18,8 +18,11 @@
   substitute,
   installShellFiles,
   buildPackages,
+  cmake,
+  wasmtime_36,
   enableShared ? !stdenv.hostPlatform.isStatic,
   enableStatic ? stdenv.hostPlatform.isStatic,
+  wasmSupport ? false,
   webUISupport ? false,
 }:
 
@@ -124,9 +127,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-9FeWnWWPUWmMF15Psmul8GxGv2JceHWc2WZPmOr81gw=";
 
+  cargoBuildFeatures = lib.optionals wasmSupport [ "wasm" ];
+
   buildInputs = [
     installShellFiles
   ]
+  ++ lib.optionals wasmSupport [
+    wasmtime_36
+  ]
   ++ lib.optionals webUISupport [
     openssl
   ];
@@ -134,6 +142,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rustPlatform.bindgenHook
     which
   ]
+  ++ lib.optionals wasmSupport [
+    cmake
+  ]
   ++ lib.optionals webUISupport [
     emscripten
     pkg-config
@@ -164,6 +175,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
       sed -i '/^install:/,/^[^[:space:]]/ { /$(SOEXT/d; }' ./Makefile
     '';
 
+  # The Makefile install can't enable the wasm feature.
+  cmakeFlags = lib.optionals wasmSupport [
+    (lib.cmakeBool "TREE_SITTER_FEATURE_WASM" true)
+    (lib.cmakeFeature "WASMTIME_INCLUDE_DIR" "${lib.getDev wasmtime_36}/include")
+    (lib.cmakeFeature "WASMTIME_LIBRARY" "${lib.getLib wasmtime_36}/lib/libwasmtime${stdenv.hostPlatform.extensions.sharedLibrary}")
+    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
+  ];
+
   # Compile web assembly with emscripten. The --debug flag prevents us from
   # minifying the JavaScript; passing it allows us to side-step more Node
   # JS dependencies for installation.
@@ -175,6 +195,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   postInstall = ''
     PREFIX=$out make install
+  ''
+  + lib.optionalString wasmSupport ''
+    cmake --install $cmakeBuildDir
+  ''
+  + ''
     ${lib.optionalString (!enableShared) "rm -f $out/lib/*.so{,.*}"}
     ${lib.optionalString (!enableStatic) "rm -f $out/lib/*.a"}
 
@@ -196,6 +221,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # test result: FAILED. 120 passed; 13 failed; 0 ignored; 0 measured; 0 filtered out
   doCheck = false;
 
+  # CMake builds libtree-sitter with wasm support; cargo still builds the CLI.
+  ${if wasmSupport then "configurePhase" else null} = ''
+    cmakeConfigurePhase
+    cd ..
+  '';
+
+  ${if wasmSupport then "postBuild" else null} = ''
+    cmake --build $cmakeBuildDir
+  '';
+
   passthru = {
     inherit
       grammars

From aade615d924603d9ef8079e2cdd6deeb3d149ecb Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Sun, 21 Jun 2026 18:04:57 -0500
Subject: [PATCH 25/83] neovim-unwrapped: add optional wasmtime support

Add a wasmSupport override that enables Neovim's wasmtime integration and uses wasm-enabled tree-sitter while keeping defaults aligned with upstream.
---
 pkgs/by-name/ne/neovim-unwrapped/package.nix | 37 +++++++++++++++-----
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index bcc15e19bcc7..aeb2807ce0f7 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -11,6 +11,7 @@
   unibilium,
   utf8proc,
   tree-sitter,
+  wasmtime_36,
   fetchurl,
   buildPackages,
   treesitter-parsers ? import ./treesitter-parsers.nix { inherit fetchurl; },
@@ -20,6 +21,7 @@
   versionCheckHook,
   nix-update-script,
   writableTmpDirAsHomeHook,
+  wasmSupport ? false,
 
   # now defaults to false because some tests can be flaky (clipboard etc), see
   # also: https://github.com/neovim/neovim/issues/16233
@@ -30,6 +32,9 @@
 
 let
   lua = if lib.meta.availableOn stdenv.hostPlatform luajit then luajit else lua5_1;
+  treeSitterForNeovim = tree-sitter.override {
+    inherit wasmSupport;
+  };
 in
 
 stdenv.mkDerivation (
@@ -161,10 +166,13 @@ stdenv.mkDerivation (
       # and it's definition at: pkgs/development/lua-modules/overrides.nix
       lua.pkgs.libluv
       neovimLuaEnv
-      tree-sitter
+      treeSitterForNeovim
       unibilium
       utf8proc
     ]
+    ++ lib.optionals wasmSupport [
+      wasmtime_36
+    ]
     ++ lib.optionals (stdenv.hostPlatform.libc != "glibc") [
       # Provide libintl for non-glibc platforms
       gettext
@@ -202,13 +210,20 @@ stdenv.mkDerivation (
         pyEnv # for src/clint.py
       ];
 
-    # nvim --version output retains compilation flags and references to build tools
-    postPatch = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-      sed -i runtime/CMakeLists.txt \
-        -e "s|\".*/bin/nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
-      sed -i src/nvim/po/CMakeLists.txt \
-        -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
-    '';
+    postPatch =
+      lib.optionalString wasmSupport ''
+        substituteInPlace src/nvim/CMakeLists.txt \
+          --replace-fail \
+            'find_package(Wasmtime 36.0.6 EXACT REQUIRED)' \
+            'find_package(Wasmtime REQUIRED)'
+      ''
+      # nvim --version output retains compilation flags and references to build tools
+      + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        sed -i runtime/CMakeLists.txt \
+          -e "s|\".*/bin/nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
+        sed -i src/nvim/po/CMakeLists.txt \
+          -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
+      '';
     # check that the above patching actually works
     disallowedRequisites = [
       stdenv.cc
@@ -229,6 +244,12 @@ stdenv.mkDerivation (
       (lib.cmakeBool "ENABLE_TRANSLATIONS" true)
       (lib.cmakeBool "USE_BUNDLED_BUSTED" false)
     ]
+    ++ lib.optionals wasmSupport [
+      # FindWasmtime has no pkg-config fallback.
+      (lib.cmakeBool "ENABLE_WASMTIME" true)
+      (lib.cmakeFeature "WASMTIME_INCLUDE_DIR" "${lib.getDev wasmtime_36}/include")
+      (lib.cmakeFeature "WASMTIME_LIBRARY" "${lib.getLib wasmtime_36}/lib/libwasmtime${stdenv.hostPlatform.extensions.sharedLibrary}")
+    ]
     ++ (
       if lua.pkgs.isLuaJIT then
         [

From ca36aaa927ae31835ec76f242d4c85fecaff7eb0 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 10 Jun 2026 11:43:20 +0000
Subject: [PATCH 26/83] toml-f: cleanup

---
 pkgs/by-name/to/toml-f/package.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/to/toml-f/package.nix b/pkgs/by-name/to/toml-f/package.nix
index 96dc25e7d4c2..436c9b5fda1c 100644
--- a/pkgs/by-name/to/toml-f/package.nix
+++ b/pkgs/by-name/to/toml-f/package.nix
@@ -21,11 +21,13 @@ assert (
 stdenv.mkDerivation (finalAttrs: {
   pname = "toml-f";
   version = "0.5.1";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "toml-f";
     repo = "toml-f";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-lReez2rSAJVnLFngjUYgGkm+HUDH8VsCC2m9zYOOr4A=";
   };
 
@@ -42,7 +44,9 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
   ]
-  ++ lib.optional (buildType == "cmake") cmake;
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];
 
   buildInputs = [ test-drive ];
 
@@ -65,6 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
       mit
     ];
     homepage = "https://github.com/toml-f/toml-f";
+    changelog = "https://github.com/toml-f/toml-f/releases/tag/${finalAttrs.src.tag}";
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.sheepforce ];
   };

From f1e4d1e986d18425bd3129ffbfa6d2c8cdc8a5ca Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 10 Jun 2026 11:44:15 +0000
Subject: [PATCH 27/83] multicharge: cleanup

---
 pkgs/by-name/mu/multicharge/package.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mu/multicharge/package.nix b/pkgs/by-name/mu/multicharge/package.nix
index 4cf03bdfee7d..677b9ec7f29e 100644
--- a/pkgs/by-name/mu/multicharge/package.nix
+++ b/pkgs/by-name/mu/multicharge/package.nix
@@ -26,11 +26,13 @@ assert (
 stdenv.mkDerivation (finalAttrs: {
   pname = "multicharge";
   version = "0.5.0";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "grimme-lab";
     repo = "multicharge";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-hswqC+fvC6tuxDpuUgowyqm72ubVikzpR4EzXtTM5cs=";
   };
 
@@ -48,7 +50,9 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
   ]
-  ++ lib.optional (buildType == "cmake") cmake;
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];
 
   buildInputs = [
     blas
@@ -85,6 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "multicharge";
     license = lib.licenses.asl20;
     homepage = "https://github.com/grimme-lab/multicharge";
+    changelog = "https://github.com/grimme-lab/multicharge/releases/tag/${finalAttrs.src.tag}";
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.sheepforce ];
   };

From 984462d5f1fe91fc35c8248aca655deff82afd2d Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 10 Jun 2026 11:56:43 +0000
Subject: [PATCH 28/83] tblite: cleanup

---
 .../libraries/science/chemistry/tblite/default.nix  | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/science/chemistry/tblite/default.nix b/pkgs/development/libraries/science/chemistry/tblite/default.nix
index 20a89a3647de..1c21aa56c2ec 100644
--- a/pkgs/development/libraries/science/chemistry/tblite/default.nix
+++ b/pkgs/development/libraries/science/chemistry/tblite/default.nix
@@ -27,14 +27,16 @@ assert (
   ]
 );
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tblite";
   version = "0.6.0";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "tblite";
     repo = "tblite";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-z0g+bf6APqNLB9mDE49FelitQ9ptZXdFQuYeXIT0NIw=";
   };
 
@@ -86,7 +88,9 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
+    # Runs python test drivers (test/*/tester.py) during checkPhase, so it must be available on the
+    # build host (strictDeps)
     python3
   ];
 
@@ -108,7 +112,8 @@ stdenv.mkDerivation rec {
       lgpl3Plus
     ];
     homepage = "https://github.com/tblite/tblite";
+    changelog = "https://github.com/tblite/tblite/releases/tag/${finalAttrs.src.tag}";
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.sheepforce ];
   };
-}
+})

From 3a0f47ee5352e457cd69039bc15cfa27cc82e5fc Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 10 Jun 2026 11:58:45 +0000
Subject: [PATCH 29/83] dftd4: cleanup

---
 pkgs/by-name/df/dftd4/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/df/dftd4/package.nix b/pkgs/by-name/df/dftd4/package.nix
index 0b2c5944035c..c58a7400c404 100644
--- a/pkgs/by-name/df/dftd4/package.nix
+++ b/pkgs/by-name/df/dftd4/package.nix
@@ -27,11 +27,13 @@ assert (
 stdenv.mkDerivation (finalAttrs: {
   pname = "dftd4";
   version = "4.2.0";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "dftd4";
     repo = "dftd4";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-uKjNOIza3/I0oREp88oFESoNqEdumo1AztIjcrVb1O8=";
   };
 
@@ -85,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Generally Applicable Atomic-Charge Dependent London Dispersion Correction";
+    changelog = "https://github.com/dftd4/dftd4/releases/tag/${finalAttrs.src.tag}";
     mainProgram = "dftd4";
     license = with lib.licenses; [
       lgpl3Plus

From 0856fdbe3135e280c2b70ca20fbbd9eda94a2159 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 10 Jun 2026 07:36:54 +0000
Subject: [PATCH 30/83] numsa: init at 0.2.0

---
 pkgs/by-name/nu/numsa/package.nix             | 107 ++++++++++++++++++
 .../nu/numsa/use-external-mstore.patch        |  30 +++++
 2 files changed, 137 insertions(+)
 create mode 100644 pkgs/by-name/nu/numsa/package.nix
 create mode 100644 pkgs/by-name/nu/numsa/use-external-mstore.patch

diff --git a/pkgs/by-name/nu/numsa/package.nix b/pkgs/by-name/nu/numsa/package.nix
new file mode 100644
index 000000000000..c823b92a5036
--- /dev/null
+++ b/pkgs/by-name/nu/numsa/package.nix
@@ -0,0 +1,107 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  buildType ? "meson",
+
+  # nativeBuildInputs
+  asciidoctor,
+  gfortran,
+  pkg-config,
+  python3,
+  # meson:
+  meson,
+  ninja,
+  # cmake:
+  cmake,
+
+  # buildInputs
+  mstore,
+  test-drive,
+  blas,
+  lapack,
+
+  # propagatedBuildInputs
+  mctc-lib,
+
+  # passthru
+  nix-update-script,
+}:
+
+assert (
+  builtins.elem buildType [
+    "meson"
+    "cmake"
+  ]
+);
+stdenv.mkDerivation (finalAttrs: {
+  pname = "numsa";
+  version = "0.2.0";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "grimme-lab";
+    repo = "numsa";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PAzxeYyg/9P/3YFxKzM4ZFm2xT0AGap6q8/ei8jD/3M=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  patches = [
+    # Use nixpkgs' mstore instead of building it from source
+    ./use-external-mstore.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace config/install-mod.py \
+      --replace-fail "/usr/bin/env python" "${lib.getExe python3}"
+  '';
+
+  nativeBuildInputs = [
+    asciidoctor
+    gfortran
+    pkg-config
+    python3
+  ]
+  ++ lib.optionals (buildType == "meson") [
+    meson
+    ninja
+  ]
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];
+
+  buildInputs = [
+    blas
+    lapack
+    mstore # only needed to build the bundled test suite
+    test-drive
+  ];
+
+  propagatedBuildInputs = [
+    mctc-lib
+  ];
+
+  doCheck = true;
+
+  preCheck = ''
+    export OMP_NUM_THREADS=2
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Solvent accessible surface area calculation";
+    homepage = "https://github.com/grimme-lab/numsa";
+    changelog = "https://github.com/grimme-lab/numsa/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/nu/numsa/use-external-mstore.patch b/pkgs/by-name/nu/numsa/use-external-mstore.patch
new file mode 100644
index 000000000000..f490884198e1
--- /dev/null
+++ b/pkgs/by-name/nu/numsa/use-external-mstore.patch
@@ -0,0 +1,30 @@
+diff --git a/test/meson.build b/test/meson.build
+index c60e4a4..7da0216 100644
+--- a/test/meson.build
++++ b/test/meson.build
+@@ -14,20 +14,21 @@
+ # You should have received a copy of the GNU Lesser General Public License
+ # along with numsa.  If not, see <https://www.gnu.org/licenses/>.
+ 
+-# Create mstore as subproject for testing
+-mstore_prj = subproject(
++# Find the molecular structure store, preferring an external installation
++# (e.g. via pkg-config) and falling back to building it as a subproject
++mstore_dep = dependency(
+   'mstore',
+   version: '>=0.1',
++  fallback: ['mstore', 'mstore_dep'],
+   required: not meson.is_subproject(),
+   default_options: [
+     'default_library=static',
+   ],
+ )
+ # If we do not find mstore and are a subproject, we just skip testing
+-if not mstore_prj.found()
++if not mstore_dep.found()
+    subdir_done()
+ endif
+-mstore_dep = mstore_prj.get_variable('mstore_dep')
+ 
+ tests = [
+   'surface',

From 76aa5f0129364e5c85ed5c8cdab6b870cedd2966 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 10 Jun 2026 07:37:00 +0000
Subject: [PATCH 31/83] cpcm-x: init at 1.1.0

---
 .../cp/cpcm-x/cmake-config-find-numsa.patch   |  15 +++
 pkgs/by-name/cp/cpcm-x/package.nix            | 107 ++++++++++++++++++
 2 files changed, 122 insertions(+)
 create mode 100644 pkgs/by-name/cp/cpcm-x/cmake-config-find-numsa.patch
 create mode 100644 pkgs/by-name/cp/cpcm-x/package.nix

diff --git a/pkgs/by-name/cp/cpcm-x/cmake-config-find-numsa.patch b/pkgs/by-name/cp/cpcm-x/cmake-config-find-numsa.patch
new file mode 100644
index 000000000000..3e54583533ff
--- /dev/null
+++ b/pkgs/by-name/cp/cpcm-x/cmake-config-find-numsa.patch
@@ -0,0 +1,15 @@
+diff --git a/config/config.cmake.in b/config/config.cmake.in
+index e5e4f6b..d41c070 100644
+--- a/config/config.cmake.in
++++ b/config/config.cmake.in
+@@ -23,6 +23,10 @@ if(NOT TARGET "@PROJECT_NAME@::@PROJECT_NAME@")
+ 
+   include(CMakeFindDependencyMacro)
+ 
++  if(NOT TARGET "numsa::numsa")
++    find_dependency("numsa" REQUIRED)
++  endif()
++
+   if(NOT TARGET "mctc-lib::mctc-lib")
+     find_dependency("mctc-lib" REQUIRED)
+   endif()
diff --git a/pkgs/by-name/cp/cpcm-x/package.nix b/pkgs/by-name/cp/cpcm-x/package.nix
new file mode 100644
index 000000000000..99484edfc1d2
--- /dev/null
+++ b/pkgs/by-name/cp/cpcm-x/package.nix
@@ -0,0 +1,107 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  buildType ? "meson",
+
+  gfortran,
+  pkg-config,
+  python3,
+  meson,
+  ninja,
+  cmake,
+
+  # buildInputs
+  blas,
+  lapack,
+  test-drive,
+
+  # propagatedBuildInputs
+  mctc-lib,
+  numsa,
+  toml-f,
+
+  nix-update-script,
+}:
+
+assert (
+  builtins.elem buildType [
+    "meson"
+    "cmake"
+  ]
+);
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cpcm-x";
+  version = "1.1.0";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "grimme-lab";
+    repo = "CPCM-X";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-FyPUECbcqUHoGq1LASvPF4qSUKQ5N/y1itq8e2wGliE=";
+  };
+
+  patches = [
+    # The installed CMake package config links numsa::numsa transitively but
+    # never re-discovers it, so consumers fail with "target numsa::numsa not
+    # found". Add the missing find_dependency call.
+    ./cmake-config-find-numsa.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace config/install-mod.py \
+      --replace-fail "/usr/bin/env python" "${lib.getExe python3}"
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [
+    gfortran
+    pkg-config
+    python3
+  ]
+  ++ lib.optionals (buildType == "meson") [
+    meson
+    ninja
+  ]
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];
+
+  buildInputs = [
+    blas
+    lapack
+    # only needed to build the bundled test suite
+    test-drive
+  ];
+
+  propagatedBuildInputs = [
+    mctc-lib
+    numsa
+    toml-f
+  ];
+
+  doCheck = true;
+
+  preCheck = ''
+    export OMP_NUM_THREADS=2
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Extended conductor-like polarizable continuum solvation model";
+    homepage = "https://github.com/grimme-lab/CPCM-X";
+    changelog = "https://github.com/grimme-lab/CPCM-X/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.lgpl3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    mainProgram = "cpx";
+    platforms = lib.platforms.linux;
+  };
+})

From fdbf749ab66e125cda4e0572881f3211374b0c8c Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 10 Jun 2026 07:22:55 +0000
Subject: [PATCH 32/83] xtb: init at 6.7.1

---
 pkgs/by-name/xt/xtb/package.nix | 112 ++++++++++++++++++++++++++++++++
 1 file changed, 112 insertions(+)
 create mode 100644 pkgs/by-name/xt/xtb/package.nix

diff --git a/pkgs/by-name/xt/xtb/package.nix b/pkgs/by-name/xt/xtb/package.nix
new file mode 100644
index 000000000000..47f1010308fb
--- /dev/null
+++ b/pkgs/by-name/xt/xtb/package.nix
@@ -0,0 +1,112 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  # nativeBuildInputs
+  gfortran,
+  meson,
+  ninja,
+  pkg-config,
+
+  # buildInputs
+  blas,
+  lapack,
+  cpcm-x,
+  dftd4,
+  mctc-lib,
+  multicharge,
+  numsa,
+  simple-dftd3,
+  tblite,
+  test-drive,
+  toml-f,
+
+  # passthru
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xtb";
+  # No tagged release supports the tblite 0.6 / dftd4 4.2 API; the latest tag (6.7.1) targets
+  # tblite 0.3. Track master, which builds against the current grimme-lab stack packaged in nixpkgs
+  version = "6.7.1-unstable-2026-05-16";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "grimme-lab";
+    repo = "xtb";
+    rev = "2b5cd4829290775e575807daee21560f851ff7e1";
+    hash = "sha256-dnpmbjLG6xKSLXEUdwndsA0ADTEyaTY9fJiOSXI7jD4=";
+  };
+
+  # The `solve`/`solve4` eigensolvers size the DSYGVD workspace from a `LWORK = -1` query.
+  # OpenBLAS leaves `aux(1)` as a denormal/garbage value on that query, so `int(aux(1))` falls
+  # below DSYGVD's documented minimum and the real call aborts with `DSYGVD parameter number 11 had
+  # an illegal value` (it works against reference LAPACK, which fills the query correctly).
+  # This surfaces as failures in the `gfn0` and `peeq` unit tests. Clamp the workspace sizes to the
+  # LAPACK minima so the query result can only ever grow them.
+  postPatch = ''
+    substituteInPlace src/scc_core.f90 \
+      --replace-fail "lwork=int(aux(1))"  "lwork=max(int(aux(1)),1+6*ndim+2*ndim**2)" \
+      --replace-fail "lwork=int(aux4(1))" "lwork=max(int(aux4(1)),1+6*ndim+2*ndim**2)" \
+      --replace-fail "liwork=iwork(1)"    "liwork=max(iwork(1),3+5*ndim)"
+  '';
+
+  nativeBuildInputs = [
+    gfortran
+    meson
+    ninja
+    pkg-config
+  ];
+
+  mesonFlags = [
+    # Require the optional backends rather than letting the `auto` features
+    # silently disable themselves if a dependency is not found.
+    (lib.mesonEnable "tblite" true)
+    (lib.mesonEnable "cpcmx" true)
+  ];
+
+  # Serialize the build: ninja otherwise compiles xtb's program/library objects before the
+  # library's Fortran modules are generated.
+  # `enableParallel` only controls the explicit -j flag and ninja parallelizes regardless, so the
+  # race has to be killed with an explicit -j1.
+  ninjaFlags = [ "-j1" ];
+
+  buildInputs = [
+    blas
+    cpcm-x
+    dftd4
+    lapack
+    mctc-lib
+    multicharge
+    numsa
+    simple-dftd3
+    tblite
+    test-drive
+    toml-f
+  ];
+
+  doCheck = true;
+  preCheck = ''
+    export OMP_NUM_THREADS=2
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Semiempirical Extended Tight-Binding Program Package";
+    homepage = "https://github.com/grimme-lab/xtb";
+    # changelog = "https://github.com/grimme-lab/xtb/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+      sheepforce
+    ];
+    mainProgram = "xtb";
+    platforms = lib.platforms.linux;
+  };
+})

From 5e784f7d4b55c7abf1131e3a1badc728148556c2 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 22 Jun 2026 13:24:23 +0000
Subject: [PATCH 33/83] rerun: 0.33.0 -> 0.33.1

Diff: https://github.com/rerun-io/rerun/compare/0.33.0...0.33.1

Changelog: https://github.com/rerun-io/rerun/blob/0.33.1/CHANGELOG.md
---
 pkgs/by-name/re/rerun/package.nix                          | 6 +++---
 pkgs/development/python-modules/rerun-notebook/default.nix | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/re/rerun/package.nix b/pkgs/by-name/re/rerun/package.nix
index 888e2a3cc9db..b3694808af56 100644
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -35,7 +35,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rerun";
-  version = "0.33.0";
+  version = "0.33.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "rerun-io";
     repo = "rerun";
     tag = finalAttrs.version;
-    hash = "sha256-1jlZ+8jx1dNsWWrkQSyFAIK/VQNSotcyTknz0WhIaIc=";
+    hash = "sha256-GCIrvNNktW9h2/s90tTxFOmiIRAbWQWOS3Ti03EZ/GM=";
   };
 
   # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@@ -58,7 +58,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '"rerun_sdk/rerun_cli/rerun"' '"rerun_sdk/rerun"'
   '';
 
-  cargoHash = "sha256-3erI/kWTJ5Exl9QpGidsIizi0UWbudzMSzoscoSTmP8=";
+  cargoHash = "sha256-wCJKerOgOUWNn3wBeHEKn92qzGdICX6P52B2FT5wcZE=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/development/python-modules/rerun-notebook/default.nix b/pkgs/development/python-modules/rerun-notebook/default.nix
index dbaa086c8bd1..11b947a01b8a 100644
--- a/pkgs/development/python-modules/rerun-notebook/default.nix
+++ b/pkgs/development/python-modules/rerun-notebook/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     inherit (finalAttrs) version;
     format = "wheel";
     python = "py2.py3";
-    hash = "sha256-GDgqFShq40hcptQPie9pwyZFed/9kBmvke5/OwfHl6M=";
+    hash = "sha256-PiZOxfVyqTwK0oSQ57TLpDIzuZUSecSEDmJtfdqqCGo=";
   };
 
   pythonRelaxDeps = [

From e09bc37026c5821740bb61365d52c9d8aaa085cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stefan=20N=C3=BCrnberger?=
 <stefan.nuernberger@cyberus-technology.de>
Date: Tue, 16 Jun 2026 11:08:58 +0200
Subject: [PATCH 34/83] openjdk11{, -headless}: fix UB in markOop

OpenJDK 11 misuses the low bits in pointers that have an assumed
alignment. This is undefined behavior and compiler optimizations break
the code at runtime, causing SIGSEGV in the garbage collector.

This was originally noticed for clang13, but GCC15 seems to
do similar optimizations now. The UB was removed in JDK14.

See https://bugs.openjdk.org/browse/JDK-8229258

This is a smaller version of the unsuccessful backport PR proposed upstream:
https://github.com/openjdk/jdk11u-dev/pull/1284

Removed the .github/workflows changes and everything from the markOop to
markWord rename and file move from the patch. I found a way to avoid most
of the `markOopDesc`->`markOop` renames with a typedef, and dropped the
changes to all architectures besides x86 and aarch64.

Fixes: https://github.com/nixos/nixpkgs/issues/526834
---
 .../fix-oopdesc-ptr-alignment-ub.patch        | 2622 +++++++++++++++++
 .../development/compilers/openjdk/generic.nix |    3 +
 2 files changed, 2625 insertions(+)
 create mode 100644 pkgs/development/compilers/openjdk/11/patches/fix-oopdesc-ptr-alignment-ub.patch

diff --git a/pkgs/development/compilers/openjdk/11/patches/fix-oopdesc-ptr-alignment-ub.patch b/pkgs/development/compilers/openjdk/11/patches/fix-oopdesc-ptr-alignment-ub.patch
new file mode 100644
index 000000000000..9fc32990d1ae
--- /dev/null
+++ b/pkgs/development/compilers/openjdk/11/patches/fix-oopdesc-ptr-alignment-ub.patch
@@ -0,0 +1,2622 @@
+From 55ce9f824ab06507e7253e7de6e57c7baac5ae45 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stefan=20N=C3=BCrnberger?=
+ <stefan.nuernberger@cyberus-technology.de>
+Date: Thu, 18 Jun 2026 20:21:59 +0200
+Subject: [PATCH] fix undefined behavior in markOop
+
+A smaller version of https://github.com/openjdk/jdk11u-dev/pull/1284
+to fix https://bugs.openjdk.java.net/browse/JDK-8229258
+
+Only fixes x86 and aarch64. Other architectures will not build.
+
+Co-authored-by: Campbell Jones <git@serebit.com>
+Co-authored-by: Reilly Brogan <reilly@reillybrogan.com>
+
+---
+ src/hotspot/cpu/aarch64/aarch64.ad            |   2 +-
+ .../cpu/aarch64/c1_MacroAssembler_aarch64.cpp |   2 +-
+ .../cpu/aarch64/templateTable_aarch64.cpp     |   2 +-
+ src/hotspot/cpu/x86/c1_MacroAssembler_x86.cpp |   2 +-
+ src/hotspot/cpu/x86/macroAssembler_x86.cpp    |   8 +-
+ src/hotspot/cpu/x86/templateTable_x86.cpp     |   2 +-
+ src/hotspot/cpu/zero/cppInterpreter_zero.cpp  |   2 +-
+ src/hotspot/share/classfile/altHashing.cpp    |   2 +-
+ .../gc/cms/concurrentMarkSweepGeneration.cpp  |  32 +--
+ src/hotspot/share/gc/cms/freeChunk.hpp        |   8 +-
+ .../share/gc/cms/parOopClosures.inline.hpp    |   4 +-
+ src/hotspot/share/gc/cms/promotionInfo.cpp    |   2 +-
+ .../share/gc/g1/g1FullGCCompactionPoint.cpp   |   4 +-
+ .../share/gc/g1/g1FullGCMarker.inline.hpp     |   2 +-
+ .../gc/g1/g1FullGCOopClosures.inline.hpp      |   4 +-
+ .../share/gc/g1/g1OopClosures.inline.hpp      |   4 +-
+ .../share/gc/g1/g1ParScanThreadState.cpp      |  12 +-
+ .../gc/g1/g1ParScanThreadState.inline.hpp     |   4 +-
+ .../gc/parallel/psMarkSweepDecorator.cpp      |  10 +-
+ .../gc/parallel/psPromotionManager.inline.hpp |   6 +-
+ src/hotspot/share/gc/serial/markSweep.cpp     |   2 +-
+ .../share/gc/serial/markSweep.inline.hpp      |  10 +-
+ .../share/gc/shared/preservedMarks.inline.hpp |   2 +-
+ src/hotspot/share/gc/shared/space.inline.hpp  |   6 +-
+ .../share/gc/shenandoah/shenandoahAsserts.cpp |   2 +-
+ .../shenandoahForwarding.inline.hpp           |  16 +-
+ .../gc/shenandoah/shenandoahStringDedup.cpp   |   6 +-
+ .../share/interpreter/bytecodeInterpreter.cpp |  18 +-
+ .../jfr/leakprofiler/chains/bfsClosure.cpp    |   4 +-
+ .../jfr/leakprofiler/chains/dfsClosure.cpp    |   2 +-
+ .../jfr/leakprofiler/chains/edgeStore.cpp     |   4 +-
+ .../jfr/leakprofiler/chains/edgeUtils.cpp     |   2 +-
+ .../chains/objectSampleMarker.hpp             |   6 +-
+ .../leakprofiler/checkpoint/eventEmitter.cpp  |   2 +-
+ .../leakprofiler/utilities/saveRestore.cpp    |   8 +-
+ src/hotspot/share/memory/metaspaceShared.cpp  |   2 +-
+ src/hotspot/share/memory/universe.cpp         |   2 +-
+ src/hotspot/share/memory/virtualspace.cpp     |   4 +-
+ src/hotspot/share/oops/klass.cpp              |   2 +-
+ src/hotspot/share/oops/klass.hpp              |   1 +
+ src/hotspot/share/oops/klass.inline.hpp       |   2 +-
+ src/hotspot/share/oops/markOop.hpp            |  62 ++++--
+ src/hotspot/share/oops/markOop.inline.hpp     |   8 +-
+ src/hotspot/share/oops/oop.cpp                |   4 +-
+ src/hotspot/share/oops/oop.hpp                |   1 +
+ src/hotspot/share/oops/oop.inline.hpp         |  65 +++---
+ src/hotspot/share/oops/oopsHierarchy.hpp      |   2 -
+ src/hotspot/share/opto/macro.cpp              |   2 +-
+ src/hotspot/share/prims/jvmtiEnvBase.cpp      |   8 +-
+ src/hotspot/share/prims/jvmtiTagMap.cpp       |  10 +-
+ src/hotspot/share/prims/whitebox.cpp          |   2 +-
+ src/hotspot/share/runtime/basicLock.cpp       |   8 +-
+ src/hotspot/share/runtime/basicLock.hpp       |  10 +-
+ src/hotspot/share/runtime/biasedLocking.cpp   |  84 ++++----
+ src/hotspot/share/runtime/deoptimization.cpp  |   8 +-
+ src/hotspot/share/runtime/objectMonitor.hpp   |   1 +
+ .../share/runtime/objectMonitor.inline.hpp    |  10 +-
+ src/hotspot/share/runtime/sharedRuntime.cpp   |   4 +-
+ src/hotspot/share/runtime/synchronizer.cpp    | 191 +++++++++---------
+ src/hotspot/share/runtime/vframe.cpp          |  22 +-
+ src/hotspot/share/runtime/vmStructs.cpp       |   4 +-
+ 69 files changed, 394 insertions(+), 345 deletions(-)
+
+diff --git a/src/hotspot/cpu/aarch64/aarch64.ad b/src/hotspot/cpu/aarch64/aarch64.ad
+index 27ba4e10d..0e7f17588 100644
+--- a/src/hotspot/cpu/aarch64/aarch64.ad
++++ b/src/hotspot/cpu/aarch64/aarch64.ad
+@@ -3565,7 +3565,7 @@ encode %{
+       // lock. The fast-path monitor unlock code checks for
+       // markOopDesc::monitor_value so use markOopDesc::unused_mark which has the
+       // relevant bit set, and also matches ObjectSynchronizer::slow_enter.
+-      __ mov(tmp, (address)markOopDesc::unused_mark());
++      __ mov(tmp, (address)markOopDesc::unused_mark().value());
+       __ str(tmp, Address(box, BasicLock::displaced_header_offset_in_bytes()));
+     }
+ 
+diff --git a/src/hotspot/cpu/aarch64/c1_MacroAssembler_aarch64.cpp b/src/hotspot/cpu/aarch64/c1_MacroAssembler_aarch64.cpp
+index 218113b78..97791fb63 100644
+--- a/src/hotspot/cpu/aarch64/c1_MacroAssembler_aarch64.cpp
++++ b/src/hotspot/cpu/aarch64/c1_MacroAssembler_aarch64.cpp
+@@ -176,7 +176,7 @@ void C1_MacroAssembler::initialize_header(Register obj, Register klass, Register
+     ldr(t1, Address(klass, Klass::prototype_header_offset()));
+   } else {
+     // This assumes that all prototype bits fit in an int32_t
+-    mov(t1, (int32_t)(intptr_t)markOopDesc::prototype());
++    mov(t1, (int32_t)(intptr_t)markOopDesc::prototype().value());
+   }
+   str(t1, Address(obj, oopDesc::mark_offset_in_bytes()));
+ 
+diff --git a/src/hotspot/cpu/aarch64/templateTable_aarch64.cpp b/src/hotspot/cpu/aarch64/templateTable_aarch64.cpp
+index 6fd216b95..a3c082f49 100644
+--- a/src/hotspot/cpu/aarch64/templateTable_aarch64.cpp
++++ b/src/hotspot/cpu/aarch64/templateTable_aarch64.cpp
+@@ -3611,7 +3611,7 @@ void TemplateTable::_new() {
+     if (UseBiasedLocking) {
+       __ ldr(rscratch1, Address(r4, Klass::prototype_header_offset()));
+     } else {
+-      __ mov(rscratch1, (intptr_t)markOopDesc::prototype());
++      __ mov(rscratch1, (intptr_t)markOopDesc::prototype().value());
+     }
+     __ str(rscratch1, Address(r0, oopDesc::mark_offset_in_bytes()));
+     __ store_klass_gap(r0, zr);  // zero klass gap for compressed oops
+diff --git a/src/hotspot/cpu/x86/c1_MacroAssembler_x86.cpp b/src/hotspot/cpu/x86/c1_MacroAssembler_x86.cpp
+index 25353446f..0e611a18a 100644
+--- a/src/hotspot/cpu/x86/c1_MacroAssembler_x86.cpp
++++ b/src/hotspot/cpu/x86/c1_MacroAssembler_x86.cpp
+@@ -154,7 +154,7 @@ void C1_MacroAssembler::initialize_header(Register obj, Register klass, Register
+     movptr(Address(obj, oopDesc::mark_offset_in_bytes()), t1);
+   } else {
+     // This assumes that all prototype bits fit in an int32_t
+-    movptr(Address(obj, oopDesc::mark_offset_in_bytes ()), (int32_t)(intptr_t)markOopDesc::prototype());
++    movptr(Address(obj, oopDesc::mark_offset_in_bytes ()), (int32_t)(intptr_t)markOopDesc::prototype().value());
+   }
+ #ifdef _LP64
+   if (UseCompressedClassPointers) { // Take care not to kill klass
+diff --git a/src/hotspot/cpu/x86/macroAssembler_x86.cpp b/src/hotspot/cpu/x86/macroAssembler_x86.cpp
+index ccde5ec7f..3e8098320 100644
+--- a/src/hotspot/cpu/x86/macroAssembler_x86.cpp
++++ b/src/hotspot/cpu/x86/macroAssembler_x86.cpp
+@@ -1556,7 +1556,7 @@ void MacroAssembler::rtm_inflated_locking(Register objReg, Register boxReg, Regi
+   int owner_offset = OM_OFFSET_NO_MONITOR_VALUE_TAG(owner);
+ 
+   // Without cast to int32_t a movptr will destroy r10 which is typically obj
+-  movptr(Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark()));
++  movptr(Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark().value()));
+   movptr(boxReg, tmpReg); // Save ObjectMonitor address
+ 
+   if (RTMRetryCount > 0) {
+@@ -1727,7 +1727,7 @@ void MacroAssembler::fast_lock(Register objReg, Register boxReg, Register tmpReg
+   if (EmitSync & 1) {
+       // set box->dhw = markOopDesc::unused_mark()
+       // Force all sync thru slow-path: slow_enter() and slow_exit()
+-      movptr (Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark()));
++      movptr (Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark().value()));
+       cmpptr (rsp, (int32_t)NULL_WORD);
+   } else {
+     // Possible cases that we'll encounter in fast_lock
+@@ -1879,7 +1879,7 @@ void MacroAssembler::fast_lock(Register objReg, Register boxReg, Register tmpReg
+        //   Invariant: m->_recursions should already be 0, so we don't need to explicitly set it.
+        // Intentional fall-through into DONE_LABEL ...
+     } else {
+-       movptr(Address(boxReg, 0), intptr_t(markOopDesc::unused_mark()));  // results in ST-before-CAS penalty
++       movptr(Address(boxReg, 0), intptr_t(markOopDesc::unused_mark().value()));  // results in ST-before-CAS penalty
+        movptr(boxReg, tmpReg);
+ 
+        // Using a prefetchw helps avoid later RTS->RTO upgrades and cache probes
+@@ -1926,7 +1926,7 @@ void MacroAssembler::fast_lock(Register objReg, Register boxReg, Register tmpReg
+     cmpxchgptr(r15_thread, Address(scrReg, OM_OFFSET_NO_MONITOR_VALUE_TAG(owner)));
+     // Unconditionally set box->_displaced_header = markOopDesc::unused_mark().
+     // Without cast to int32_t movptr will destroy r10 which is typically obj.
+-    movptr(Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark()));
++    movptr(Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark().value()));
+     // Intentional fall-through into DONE_LABEL ...
+     // Propagate ICC.ZF from CAS above into DONE_LABEL.
+ #endif // _LP64
+diff --git a/src/hotspot/cpu/x86/templateTable_x86.cpp b/src/hotspot/cpu/x86/templateTable_x86.cpp
+index 311a54f1b..785b675cb 100644
+--- a/src/hotspot/cpu/x86/templateTable_x86.cpp
++++ b/src/hotspot/cpu/x86/templateTable_x86.cpp
+@@ -4103,7 +4103,7 @@ void TemplateTable::_new() {
+       __ movptr(Address(rax, oopDesc::mark_offset_in_bytes ()), rbx);
+     } else {
+       __ movptr(Address(rax, oopDesc::mark_offset_in_bytes ()),
+-                (intptr_t)markOopDesc::prototype()); // header
++                (intptr_t)markOopDesc::prototype().value()); // header
+       __ pop(rcx);   // get saved klass back in the register.
+     }
+ #ifdef _LP64
+diff --git a/src/hotspot/cpu/zero/cppInterpreter_zero.cpp b/src/hotspot/cpu/zero/cppInterpreter_zero.cpp
+index 9331d02ce..04c59d9b6 100644
+--- a/src/hotspot/cpu/zero/cppInterpreter_zero.cpp
++++ b/src/hotspot/cpu/zero/cppInterpreter_zero.cpp
+@@ -274,7 +274,7 @@ int CppInterpreter::native_entry(Method* method, intptr_t UNUSED, TRAPS) {
+   if (method->is_synchronized()) {
+     monitor = (BasicObjectLock*) istate->stack_base();
+     oop lockee = monitor->obj();
+-    markOop disp = lockee->mark()->set_unlocked();
++    markOop disp = lockee->mark().set_unlocked();
+ 
+     monitor->lock()->set_displaced_header(disp);
+     if (lockee->cas_set_mark((markOop)monitor, disp) != disp) {
+diff --git a/src/hotspot/share/classfile/altHashing.cpp b/src/hotspot/share/classfile/altHashing.cpp
+index 253266c16..d7f3e7090 100644
+--- a/src/hotspot/share/classfile/altHashing.cpp
++++ b/src/hotspot/share/classfile/altHashing.cpp
+@@ -55,7 +55,7 @@
+ // objects.  We don't want to call the synchronizer hash code to install
+ // this value because it may safepoint.
+ static intptr_t object_hash(Klass* k) {
+-  intptr_t hc = k->java_mirror()->mark()->hash();
++  intptr_t hc = k->java_mirror()->mark().hash();
+   return hc != markOopDesc::no_hash ? hc : os::random();
+ }
+ 
+diff --git a/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp b/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp
+index d4e9253ab..a3d91a6aa 100644
+--- a/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp
++++ b/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp
+@@ -7773,7 +7773,7 @@ bool CMSCollector::take_from_overflow_list(size_t num, CMSMarkStack* stack) {
+   const markOop proto = markOopDesc::prototype();
+   NOT_PRODUCT(ssize_t n = 0;)
+   for (oop next; i > 0 && cur != NULL; cur = next, i--) {
+-    next = oop(cur->mark_raw());
++    next = oop(cur->mark_raw().to_pointer());
+     cur->set_mark_raw(proto);   // until proven otherwise
+     assert(oopDesc::is_oop(cur), "Should be an oop");
+     bool res = stack->push(cur);
+@@ -7857,8 +7857,8 @@ bool CMSCollector::par_take_from_overflow_list(size_t num,
+   size_t i = num;
+   oop cur = prefix;
+   // Walk down the first "num" objects, unless we reach the end.
+-  for (; i > 1 && cur->mark_raw() != NULL; cur = oop(cur->mark_raw()), i--);
+-  if (cur->mark_raw() == NULL) {
++  for (; i > 1 && cur->mark_raw().to_pointer() != NULL; cur = oop(cur->mark_raw().to_pointer()), i--);
++  if (cur->mark_raw().to_pointer() == NULL) {
+     // We have "num" or fewer elements in the list, so there
+     // is nothing to return to the global list.
+     // Write back the NULL in lieu of the BUSY we wrote
+@@ -7868,9 +7868,9 @@ bool CMSCollector::par_take_from_overflow_list(size_t num,
+     }
+   } else {
+     // Chop off the suffix and return it to the global list.
+-    assert(cur->mark_raw() != BUSY, "Error");
+-    oop suffix_head = cur->mark_raw(); // suffix will be put back on global list
+-    cur->set_mark_raw(NULL);           // break off suffix
++    assert(cur->mark_raw().to_pointer() != (void*)BUSY, "Error");
++    oop suffix_head = oop(cur->mark_raw().to_pointer()); // suffix will be put back on global list
++    cur->set_mark_raw(markOop::from_pointer(NULL));           // break off suffix
+     // It's possible that the list is still in the empty(busy) state
+     // we left it in a short while ago; in that case we may be
+     // able to place back the suffix without incurring the cost
+@@ -7890,18 +7890,18 @@ bool CMSCollector::par_take_from_overflow_list(size_t num,
+       // Too bad, someone else sneaked in (at least) an element; we'll need
+       // to do a splice. Find tail of suffix so we can prepend suffix to global
+       // list.
+-      for (cur = suffix_head; cur->mark_raw() != NULL; cur = (oop)(cur->mark_raw()));
++      for (cur = suffix_head; cur->mark_raw().to_pointer() != NULL; cur = (oop)(cur->mark_raw().to_pointer()));
+       oop suffix_tail = cur;
+-      assert(suffix_tail != NULL && suffix_tail->mark_raw() == NULL,
++      assert(suffix_tail != NULL && suffix_tail->mark_raw().to_pointer() == NULL,
+              "Tautology");
+       observed_overflow_list = _overflow_list;
+       do {
+         cur_overflow_list = observed_overflow_list;
+         if (cur_overflow_list != BUSY) {
+           // Do the splice ...
+-          suffix_tail->set_mark_raw(markOop(cur_overflow_list));
++          suffix_tail->set_mark_raw(markOop::from_pointer((void*)cur_overflow_list));
+         } else { // cur_overflow_list == BUSY
+-          suffix_tail->set_mark_raw(NULL);
++          suffix_tail->set_mark_raw(markOop::from_pointer(NULL));
+         }
+         // ... and try to place spliced list back on overflow_list ...
+         observed_overflow_list =
+@@ -7917,7 +7917,7 @@ bool CMSCollector::par_take_from_overflow_list(size_t num,
+   oop next;
+   NOT_PRODUCT(ssize_t n = 0;)
+   for (cur = prefix; cur != NULL; cur = next) {
+-    next = oop(cur->mark_raw());
++    next = oop(cur->mark_raw().to_pointer());
+     cur->set_mark_raw(proto);   // until proven otherwise
+     assert(oopDesc::is_oop(cur), "Should be an oop");
+     bool res = work_q->push(cur);
+@@ -7936,7 +7936,7 @@ void CMSCollector::push_on_overflow_list(oop p) {
+   NOT_PRODUCT(_num_par_pushes++;)
+   assert(oopDesc::is_oop(p), "Not an oop");
+   preserve_mark_if_necessary(p);
+-  p->set_mark_raw((markOop)_overflow_list);
++  p->set_mark_raw(markOop::from_pointer(_overflow_list));
+   _overflow_list = p;
+ }
+ 
+@@ -7950,9 +7950,9 @@ void CMSCollector::par_push_on_overflow_list(oop p) {
+   do {
+     cur_overflow_list = observed_overflow_list;
+     if (cur_overflow_list != BUSY) {
+-      p->set_mark_raw(markOop(cur_overflow_list));
++      p->set_mark_raw(markOop::from_pointer((void*)cur_overflow_list));
+     } else {
+-      p->set_mark_raw(NULL);
++      p->set_mark_raw(markOop::from_pointer(NULL));
+     }
+     observed_overflow_list =
+       Atomic::cmpxchg((oopDesc*)p, &_overflow_list, (oopDesc*)cur_overflow_list);
+@@ -7985,14 +7985,14 @@ void CMSCollector::preserve_mark_work(oop p, markOop m) {
+ // Single threaded
+ void CMSCollector::preserve_mark_if_necessary(oop p) {
+   markOop m = p->mark_raw();
+-  if (m->must_be_preserved(p)) {
++  if (m.must_be_preserved(p)) {
+     preserve_mark_work(p, m);
+   }
+ }
+ 
+ void CMSCollector::par_preserve_mark_if_necessary(oop p) {
+   markOop m = p->mark_raw();
+-  if (m->must_be_preserved(p)) {
++  if (m.must_be_preserved(p)) {
+     MutexLockerEx x(ParGCRareEvent_lock, Mutex::_no_safepoint_check_flag);
+     // Even though we read the mark word without holding
+     // the lock, we are assured that it will not change
+diff --git a/src/hotspot/share/gc/cms/freeChunk.hpp b/src/hotspot/share/gc/cms/freeChunk.hpp
+index a48a6dd1f..02bce8602 100644
+--- a/src/hotspot/share/gc/cms/freeChunk.hpp
++++ b/src/hotspot/share/gc/cms/freeChunk.hpp
+@@ -62,8 +62,8 @@ class FreeChunk {
+   FreeChunk* _prev;
+   FreeChunk* _next;
+ 
+-  markOop mark()     const volatile { return (markOop)_size; }
+-  void set_mark(markOop m)          { _size = (size_t)m; }
++  markOop mark()     const volatile { return markOop((uintptr_t)_size); }
++  void set_mark(markOop m)          { _size = (size_t)m.value(); }
+ 
+  public:
+   NOT_PRODUCT(static const size_t header_size();)
+@@ -79,7 +79,7 @@ class FreeChunk {
+   }
+ 
+   bool is_free() const volatile {
+-    LP64_ONLY(if (UseCompressedOops) return mark()->is_cms_free_chunk(); else)
++    LP64_ONLY(if (UseCompressedOops) return mark().is_cms_free_chunk(); else)
+     return (((intptr_t)_prev) & 0x1) == 0x1;
+   }
+   bool cantCoalesce() const {
+@@ -100,7 +100,7 @@ class FreeChunk {
+   debug_only(void* size_addr() const { return (void*)&_size; })
+ 
+   size_t size() const volatile {
+-    LP64_ONLY(if (UseCompressedOops) return mark()->get_size(); else )
++    LP64_ONLY(if (UseCompressedOops) return mark().get_size(); else )
+     return _size;
+   }
+   void set_size(size_t sz) {
+diff --git a/src/hotspot/share/gc/cms/parOopClosures.inline.hpp b/src/hotspot/share/gc/cms/parOopClosures.inline.hpp
+index 609a14868..e73659121 100644
+--- a/src/hotspot/share/gc/cms/parOopClosures.inline.hpp
++++ b/src/hotspot/share/gc/cms/parOopClosures.inline.hpp
+@@ -47,7 +47,7 @@ template <class T> inline void ParScanWeakRefClosure::do_oop_work(T* p) {
+     OrderAccess::loadload();
+     markOop m = obj->mark_raw();
+     oop new_obj;
+-    if (m->is_marked()) { // Contains forwarding pointer.
++    if (m.is_marked()) { // Contains forwarding pointer.
+       new_obj = ParNewGeneration::real_forwardee(obj);
+     } else {
+       size_t obj_sz = obj->size_given_klass(objK);
+@@ -112,7 +112,7 @@ inline void ParScanClosure::do_oop_work(T* p,
+       OrderAccess::loadload();
+       markOop m = obj->mark_raw();
+       oop new_obj;
+-      if (m->is_marked()) { // Contains forwarding pointer.
++      if (m.is_marked()) { // Contains forwarding pointer.
+         new_obj = ParNewGeneration::real_forwardee(obj);
+         RawAccess<IS_NOT_NULL>::oop_store(p, new_obj);
+         log_develop_trace(gc, scavenge)("{%s %s ( " PTR_FORMAT " ) " PTR_FORMAT " -> " PTR_FORMAT " (%d)}",
+diff --git a/src/hotspot/share/gc/cms/promotionInfo.cpp b/src/hotspot/share/gc/cms/promotionInfo.cpp
+index 971368c12..50bb470d5 100644
+--- a/src/hotspot/share/gc/cms/promotionInfo.cpp
++++ b/src/hotspot/share/gc/cms/promotionInfo.cpp
+@@ -95,7 +95,7 @@ void PromotionInfo::track(PromotedObject* trackOop, Klass* klassOfOop) {
+   // make a copy of header as it may need to be spooled
+   markOop mark = oop(trackOop)->mark_raw();
+   trackOop->clear_next();
+-  if (mark->must_be_preserved_for_cms_scavenge(klassOfOop)) {
++  if (mark.must_be_preserved_for_cms_scavenge(klassOfOop)) {
+     // save non-prototypical header, and mark oop
+     saveDisplacedHeader(mark);
+     trackOop->setDisplacedMark();
+diff --git a/src/hotspot/share/gc/g1/g1FullGCCompactionPoint.cpp b/src/hotspot/share/gc/g1/g1FullGCCompactionPoint.cpp
+index 76e9e77d7..8dbf7e8cb 100644
+--- a/src/hotspot/share/gc/g1/g1FullGCCompactionPoint.cpp
++++ b/src/hotspot/share/gc/g1/g1FullGCCompactionPoint.cpp
+@@ -117,10 +117,10 @@ void G1FullGCCompactionPoint::forward(oop object, size_t size) {
+       // Make sure object has the correct mark-word set or that it will be
+       // fixed when restoring the preserved marks.
+       assert(object->mark_raw() == markOopDesc::prototype_for_object(object) || // Correct mark
+-             object->mark_raw()->must_be_preserved(object) || // Will be restored by PreservedMarksSet
++             object->mark_raw().must_be_preserved(object) || // Will be restored by PreservedMarksSet
+              (UseBiasedLocking && object->has_bias_pattern_raw()), // Will be restored by BiasedLocking
+              "should have correct prototype obj: " PTR_FORMAT " mark: " PTR_FORMAT " prototype: " PTR_FORMAT,
+-             p2i(object), p2i(object->mark_raw()), p2i(markOopDesc::prototype_for_object(object)));
++             p2i(object), object->mark_raw().value(), markOopDesc::prototype_for_object(object).value());
+     }
+     assert(object->forwardee() == NULL, "should be forwarded to NULL");
+   }
+diff --git a/src/hotspot/share/gc/g1/g1FullGCMarker.inline.hpp b/src/hotspot/share/gc/g1/g1FullGCMarker.inline.hpp
+index 98a2fe7f1..e0976fd5c 100644
+--- a/src/hotspot/share/gc/g1/g1FullGCMarker.inline.hpp
++++ b/src/hotspot/share/gc/g1/g1FullGCMarker.inline.hpp
+@@ -51,7 +51,7 @@ inline bool G1FullGCMarker::mark_object(oop obj) {
+ 
+   // Marked by us, preserve if needed.
+   markOop mark = obj->mark_raw();
+-  if (mark->must_be_preserved(obj) &&
++  if (mark.must_be_preserved(obj) &&
+       !G1ArchiveAllocator::is_open_archive_object(obj)) {
+     preserved_stack()->push(obj, mark);
+   }
+diff --git a/src/hotspot/share/gc/g1/g1FullGCOopClosures.inline.hpp b/src/hotspot/share/gc/g1/g1FullGCOopClosures.inline.hpp
+index f19a57846..7e0feaf83 100644
+--- a/src/hotspot/share/gc/g1/g1FullGCOopClosures.inline.hpp
++++ b/src/hotspot/share/gc/g1/g1FullGCOopClosures.inline.hpp
+@@ -77,10 +77,10 @@ template <class T> inline void G1AdjustClosure::adjust_pointer(T* p) {
+   if (forwardee == NULL) {
+     // Not forwarded, return current reference.
+     assert(obj->mark_raw() == markOopDesc::prototype_for_object(obj) || // Correct mark
+-           obj->mark_raw()->must_be_preserved(obj) || // Will be restored by PreservedMarksSet
++           obj->mark_raw().must_be_preserved(obj) || // Will be restored by PreservedMarksSet
+            (UseBiasedLocking && obj->has_bias_pattern_raw()), // Will be restored by BiasedLocking
+            "Must have correct prototype or be preserved, obj: " PTR_FORMAT ", mark: " PTR_FORMAT ", prototype: " PTR_FORMAT,
+-           p2i(obj), p2i(obj->mark_raw()), p2i(markOopDesc::prototype_for_object(obj)));
++           p2i(obj), obj->mark_raw().value(), markOopDesc::prototype_for_object(obj).value());
+     return;
+   }
+ 
+diff --git a/src/hotspot/share/gc/g1/g1OopClosures.inline.hpp b/src/hotspot/share/gc/g1/g1OopClosures.inline.hpp
+index c25491323..81f9e1d0e 100644
+--- a/src/hotspot/share/gc/g1/g1OopClosures.inline.hpp
++++ b/src/hotspot/share/gc/g1/g1OopClosures.inline.hpp
+@@ -250,8 +250,8 @@ void G1ParCopyClosure<barrier, do_mark_object>::do_oop_work(T* p) {
+   if (state.is_in_cset()) {
+     oop forwardee;
+     markOop m = obj->mark_raw();
+-    if (m->is_marked()) {
+-      forwardee = (oop) m->decode_pointer();
++    if (m.is_marked()) {
++      forwardee = (oop) m.decode_pointer();
+     } else {
+       forwardee = _par_scan_state->copy_to_survivor_space(state, obj, m);
+     }
+diff --git a/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp b/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp
+index 72a607168..fde1efffc 100644
+--- a/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp
++++ b/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp
+@@ -188,8 +188,8 @@ HeapWord* G1ParScanThreadState::allocate_in_next_plab(InCSetState const state,
+ 
+ InCSetState G1ParScanThreadState::next_state(InCSetState const state, markOop const m, uint& age) {
+   if (state.is_young()) {
+-    age = !m->has_displaced_mark_helper() ? m->age()
+-                                          : m->displaced_mark_helper()->age();
++    age = !m.has_displaced_mark_helper() ? m.age()
++                                          : m.displaced_mark_helper().age();
+     if (age < _tenuring_threshold) {
+       return state;
+     }
+@@ -274,15 +274,15 @@ oop G1ParScanThreadState::copy_to_survivor_space(InCSetState const state,
+       if (age < markOopDesc::max_age) {
+         age++;
+       }
+-      if (old_mark->has_displaced_mark_helper()) {
++      if (old_mark.has_displaced_mark_helper()) {
+         // In this case, we have to install the mark word first,
+         // otherwise obj looks to be forwarded (the old mark word,
+         // which contains the forward pointer, was copied)
+         obj->set_mark_raw(old_mark);
+-        markOop new_mark = old_mark->displaced_mark_helper()->set_age(age);
+-        old_mark->set_displaced_mark_helper(new_mark);
++        markOop new_mark = old_mark.displaced_mark_helper().set_age(age);
++        old_mark.set_displaced_mark_helper(new_mark);
+       } else {
+-        obj->set_mark_raw(old_mark->set_age(age));
++        obj->set_mark_raw(old_mark.set_age(age));
+       }
+       _age_table.add(age, word_sz);
+     } else {
+diff --git a/src/hotspot/share/gc/g1/g1ParScanThreadState.inline.hpp b/src/hotspot/share/gc/g1/g1ParScanThreadState.inline.hpp
+index 10754bafa..78cabd806 100644
+--- a/src/hotspot/share/gc/g1/g1ParScanThreadState.inline.hpp
++++ b/src/hotspot/share/gc/g1/g1ParScanThreadState.inline.hpp
+@@ -42,8 +42,8 @@ template <class T> void G1ParScanThreadState::do_oop_evac(T* p) {
+   const InCSetState in_cset_state = _g1h->in_cset_state(obj);
+   if (in_cset_state.is_in_cset()) {
+     markOop m = obj->mark_raw();
+-    if (m->is_marked()) {
+-      obj = (oop) m->decode_pointer();
++    if (m.is_marked()) {
++      obj = (oop) m.decode_pointer();
+     } else {
+       obj = copy_to_survivor_space(in_cset_state, obj, m);
+     }
+diff --git a/src/hotspot/share/gc/parallel/psMarkSweepDecorator.cpp b/src/hotspot/share/gc/parallel/psMarkSweepDecorator.cpp
+index eed0fa51b..43c336892 100644
+--- a/src/hotspot/share/gc/parallel/psMarkSweepDecorator.cpp
++++ b/src/hotspot/share/gc/parallel/psMarkSweepDecorator.cpp
+@@ -113,8 +113,8 @@ void PSMarkSweepDecorator::precompact() {
+   const intx interval = PrefetchScanIntervalInBytes;
+ 
+   while (q < t) {
+-    assert(oop(q)->mark_raw()->is_marked() || oop(q)->mark_raw()->is_unlocked() ||
+-           oop(q)->mark_raw()->has_bias_pattern(),
++    assert(oop(q)->mark_raw().is_marked() || oop(q)->mark_raw().is_unlocked() ||
++           oop(q)->mark_raw().has_bias_pattern(),
+            "these are the only valid states during a mark sweep");
+     if (oop(q)->is_gc_marked()) {
+       /* prefetch beyond q */
+@@ -259,7 +259,7 @@ bool PSMarkSweepDecorator::insert_deadspace(size_t& allowed_deadspace_words,
+   if (allowed_deadspace_words >= deadlength) {
+     allowed_deadspace_words -= deadlength;
+     CollectedHeap::fill_with_object(q, deadlength);
+-    oop(q)->set_mark_raw(oop(q)->mark_raw()->set_marked());
++    oop(q)->set_mark_raw(oop(q)->mark_raw().set_marked());
+     assert((int) deadlength == oop(q)->size(), "bad filler object size");
+     // Recall that we required "q == compaction_top".
+     return true;
+@@ -350,7 +350,7 @@ void PSMarkSweepDecorator::compact(bool mangle_free_space ) {
+       q = t;
+     } else {
+       // $$$ Funky
+-      q = (HeapWord*) oop(_first_dead)->mark_raw()->decode_pointer();
++      q = (HeapWord*) oop(_first_dead)->mark_raw().decode_pointer();
+     }
+   }
+ 
+@@ -361,7 +361,7 @@ void PSMarkSweepDecorator::compact(bool mangle_free_space ) {
+     if (!oop(q)->is_gc_marked()) {
+       // mark is pointer to next marked oop
+       debug_only(prev_q = q);
+-      q = (HeapWord*) oop(q)->mark_raw()->decode_pointer();
++      q = (HeapWord*) oop(q)->mark_raw().decode_pointer();
+       assert(q > prev_q, "we should be moving forward through memory");
+     } else {
+       // prefetch beyond q
+diff --git a/src/hotspot/share/gc/parallel/psPromotionManager.inline.hpp b/src/hotspot/share/gc/parallel/psPromotionManager.inline.hpp
+index 1ef900783..15c95e3ea 100644
+--- a/src/hotspot/share/gc/parallel/psPromotionManager.inline.hpp
++++ b/src/hotspot/share/gc/parallel/psPromotionManager.inline.hpp
+@@ -119,13 +119,13 @@ inline oop PSPromotionManager::copy_to_survivor_space(oop o) {
+   markOop test_mark = o->mark_raw();
+ 
+   // The same test as "o->is_forwarded()"
+-  if (!test_mark->is_marked()) {
++  if (!test_mark.is_marked()) {
+     bool new_obj_is_tenured = false;
+     size_t new_obj_size = o->size();
+ 
+     // Find the objects age, MT safe.
+-    uint age = (test_mark->has_displaced_mark_helper() /* o->has_displaced_mark() */) ?
+-      test_mark->displaced_mark_helper()->age() : test_mark->age();
++    uint age = (test_mark.has_displaced_mark_helper() /* o->has_displaced_mark() */) ?
++      test_mark.displaced_mark_helper().age() : test_mark.age();
+ 
+     if (!promote_immediately) {
+       // Try allocating obj in to-space (unless too old)
+diff --git a/src/hotspot/share/gc/serial/markSweep.cpp b/src/hotspot/share/gc/serial/markSweep.cpp
+index fcc4f40ec..c799afbe5 100644
+--- a/src/hotspot/share/gc/serial/markSweep.cpp
++++ b/src/hotspot/share/gc/serial/markSweep.cpp
+@@ -131,7 +131,7 @@ template <class T> inline void MarkSweep::follow_root(T* p) {
+   T heap_oop = RawAccess<>::oop_load(p);
+   if (!CompressedOops::is_null(heap_oop)) {
+     oop obj = CompressedOops::decode_not_null(heap_oop);
+-    if (!obj->mark_raw()->is_marked()) {
++    if (!obj->mark_raw().is_marked()) {
+       mark_object(obj);
+       follow_object(obj);
+     }
+diff --git a/src/hotspot/share/gc/serial/markSweep.inline.hpp b/src/hotspot/share/gc/serial/markSweep.inline.hpp
+index 25a5a315f..e021d8b17 100644
+--- a/src/hotspot/share/gc/serial/markSweep.inline.hpp
++++ b/src/hotspot/share/gc/serial/markSweep.inline.hpp
+@@ -39,9 +39,9 @@ inline void MarkSweep::mark_object(oop obj) {
+   // some marks may contain information we need to preserve so we store them away
+   // and overwrite the mark.  We'll restore it at the end of markSweep.
+   markOop mark = obj->mark_raw();
+-  obj->set_mark_raw(markOopDesc::prototype()->set_marked());
++  obj->set_mark_raw(markOopDesc::prototype().set_marked());
+ 
+-  if (mark->must_be_preserved(obj)) {
++  if (mark.must_be_preserved(obj)) {
+     preserve_mark(obj, mark);
+   }
+ }
+@@ -50,7 +50,7 @@ template <class T> inline void MarkSweep::mark_and_push(T* p) {
+   T heap_oop = RawAccess<>::oop_load(p);
+   if (!CompressedOops::is_null(heap_oop)) {
+     oop obj = CompressedOops::decode_not_null(heap_oop);
+-    if (!obj->mark_raw()->is_marked()) {
++    if (!obj->mark_raw().is_marked()) {
+       mark_object(obj);
+       _marking_stack.push(obj);
+     }
+@@ -79,11 +79,11 @@ template <class T> inline void MarkSweep::adjust_pointer(T* p) {
+     oop obj = CompressedOops::decode_not_null(heap_oop);
+     assert(Universe::heap()->is_in(obj), "should be in heap");
+ 
+-    oop new_obj = oop(obj->mark_raw()->decode_pointer());
++    oop new_obj = oop(obj->mark_raw().decode_pointer());
+ 
+     assert(new_obj != NULL ||                         // is forwarding ptr?
+            obj->mark_raw() == markOopDesc::prototype() || // not gc marked?
+-           (UseBiasedLocking && obj->mark_raw()->has_bias_pattern()),
++           (UseBiasedLocking && obj->mark_raw().has_bias_pattern()),
+            // not gc marked?
+            "should be forwarded");
+ 
+diff --git a/src/hotspot/share/gc/shared/preservedMarks.inline.hpp b/src/hotspot/share/gc/shared/preservedMarks.inline.hpp
+index e246a8a5b..42691d63b 100644
+--- a/src/hotspot/share/gc/shared/preservedMarks.inline.hpp
++++ b/src/hotspot/share/gc/shared/preservedMarks.inline.hpp
+@@ -31,7 +31,7 @@
+ #include "utilities/stack.inline.hpp"
+ 
+ inline bool PreservedMarks::should_preserve_mark(oop obj, markOop m) const {
+-  return m->must_be_preserved_for_promotion_failure(obj);
++  return m.must_be_preserved_for_promotion_failure(obj);
+ }
+ 
+ inline void PreservedMarks::push(oop obj, markOop m) {
+diff --git a/src/hotspot/share/gc/shared/space.inline.hpp b/src/hotspot/share/gc/shared/space.inline.hpp
+index ad22b6c42..3732606bc 100644
+--- a/src/hotspot/share/gc/shared/space.inline.hpp
++++ b/src/hotspot/share/gc/shared/space.inline.hpp
+@@ -118,7 +118,7 @@ public:
+       _allowed_deadspace_words -= dead_length;
+       CollectedHeap::fill_with_object(dead_start, dead_length);
+       oop obj = oop(dead_start);
+-      obj->set_mark_raw(obj->mark_raw()->set_marked());
++      obj->set_mark_raw(obj->mark_raw().set_marked());
+ 
+       assert(dead_length == (size_t)obj->size(), "bad filler object size");
+       log_develop_trace(gc, compaction)("Inserting object to dead space: " PTR_FORMAT ", " PTR_FORMAT ", " SIZE_FORMAT "b",
+@@ -165,8 +165,8 @@ inline void CompactibleSpace::scan_and_forward(SpaceType* space, CompactPoint* c
+ 
+   while (cur_obj < scan_limit) {
+     assert(!space->scanned_block_is_obj(cur_obj) ||
+-           oop(cur_obj)->mark_raw()->is_marked() || oop(cur_obj)->mark_raw()->is_unlocked() ||
+-           oop(cur_obj)->mark_raw()->has_bias_pattern(),
++           oop(cur_obj)->mark_raw().is_marked() || oop(cur_obj)->mark_raw().is_unlocked() ||
++           oop(cur_obj)->mark_raw().has_bias_pattern(),
+            "these are the only valid states during a mark sweep");
+     if (space->scanned_block_is_obj(cur_obj) && oop(cur_obj)->is_gc_marked()) {
+       // prefetch beyond cur_obj
+diff --git a/src/hotspot/share/gc/shenandoah/shenandoahAsserts.cpp b/src/hotspot/share/gc/shenandoah/shenandoahAsserts.cpp
+index 1f8b79d5e..d9ecdc8f7 100644
+--- a/src/hotspot/share/gc/shenandoah/shenandoahAsserts.cpp
++++ b/src/hotspot/share/gc/shenandoah/shenandoahAsserts.cpp
+@@ -60,7 +60,7 @@ void ShenandoahAsserts::print_obj(ShenandoahMessageBuffer& msg, oop obj) {
+   r->print_on(&ss);
+ 
+   stringStream mw_ss;
+-  obj->mark()->print_on(&mw_ss);
++  obj->mark().print_on(&mw_ss);
+ 
+   ShenandoahMarkingContext* const ctx = heap->marking_context();
+ 
+diff --git a/src/hotspot/share/gc/shenandoah/shenandoahForwarding.inline.hpp b/src/hotspot/share/gc/shenandoah/shenandoahForwarding.inline.hpp
+index 50d9c5015..4db606bfc 100644
+--- a/src/hotspot/share/gc/shenandoah/shenandoahForwarding.inline.hpp
++++ b/src/hotspot/share/gc/shenandoah/shenandoahForwarding.inline.hpp
+@@ -40,8 +40,8 @@ inline HeapWord* ShenandoahForwarding::get_forwardee_raw_unchecked(oop obj) {
+   // fwdptr. That object is still not forwarded, and we need to return
+   // the object itself.
+   markOop mark = obj->mark_raw();
+-  if (mark->is_marked()) {
+-    HeapWord* fwdptr = (HeapWord*) mark->clear_lock_bits();
++  if (mark.is_marked()) {
++    HeapWord* fwdptr = (HeapWord*) mark.clear_lock_bits().to_pointer();
+     if (fwdptr != NULL) {
+       return fwdptr;
+     }
+@@ -55,8 +55,8 @@ inline oop ShenandoahForwarding::get_forwardee_mutator(oop obj) {
+   assert(Thread::current()->is_Java_thread(), "Must be a mutator thread");
+ 
+   markOop mark = obj->mark_raw();
+-  if (mark->is_marked()) {
+-    HeapWord* fwdptr = (HeapWord*)mark->clear_lock_bits();
++  if (mark.is_marked()) {
++    HeapWord* fwdptr = (HeapWord*)mark.clear_lock_bits().to_pointer();
+     assert(fwdptr != NULL, "Forwarding pointer is never null here");
+     return oop(fwdptr);
+   } else {
+@@ -70,13 +70,13 @@ inline oop ShenandoahForwarding::get_forwardee(oop obj) {
+ }
+ 
+ inline bool ShenandoahForwarding::is_forwarded(oop obj) {
+-  return obj->mark_raw()->is_marked();
++  return obj->mark_raw().is_marked();
+ }
+ 
+ inline oop ShenandoahForwarding::try_update_forwardee(oop obj, oop update) {
+   markOop old_mark = obj->mark_raw();
+-  if (old_mark->is_marked()) {
+-    return (oop) old_mark->clear_lock_bits();
++  if (old_mark.is_marked()) {
++    return (oop) old_mark.clear_lock_bits().to_pointer();
+   }
+ 
+   markOop new_mark = markOopDesc::encode_pointer_as_mark(update);
+@@ -84,7 +84,7 @@ inline oop ShenandoahForwarding::try_update_forwardee(oop obj, oop update) {
+   if (prev_mark == old_mark) {
+     return update;
+   } else {
+-    return (oop) prev_mark->clear_lock_bits();
++    return (oop) prev_mark.clear_lock_bits().to_pointer();
+   }
+ }
+ 
+diff --git a/src/hotspot/share/gc/shenandoah/shenandoahStringDedup.cpp b/src/hotspot/share/gc/shenandoah/shenandoahStringDedup.cpp
+index edcb7724f..b7c4665b9 100644
+--- a/src/hotspot/share/gc/shenandoah/shenandoahStringDedup.cpp
++++ b/src/hotspot/share/gc/shenandoah/shenandoahStringDedup.cpp
+@@ -50,14 +50,14 @@ void ShenandoahStringDedup::enqueue_candidate(oop java_string) {
+     const markOop mark = java_string->mark();
+ 
+     // Having/had displaced header, too risk to deal with them, skip
+-    if (mark == markOopDesc::INFLATING() || mark->has_displaced_mark_helper()) {
++    if (mark == markOopDesc::INFLATING() || mark.has_displaced_mark_helper()) {
+       return;
+     }
+ 
+     // Increase string age and enqueue it when it rearches age threshold
+-    markOop new_mark = mark->incr_age();
++    markOop new_mark = mark.incr_age();
+     if (mark == java_string->cas_set_mark(new_mark, mark)) {
+-      if (mark->age() == StringDeduplicationAgeThreshold) {
++      if (mark.age() == StringDeduplicationAgeThreshold) {
+         StringDedupQueue::push(ShenandoahWorkerSession::worker_id(), java_string);
+       }
+     }
+diff --git a/src/hotspot/share/interpreter/bytecodeInterpreter.cpp b/src/hotspot/share/interpreter/bytecodeInterpreter.cpp
+index cea137469..3ebdc7714 100644
+--- a/src/hotspot/share/interpreter/bytecodeInterpreter.cpp
++++ b/src/hotspot/share/interpreter/bytecodeInterpreter.cpp
+@@ -668,7 +668,7 @@ BytecodeInterpreter::run(interpreterState istate) {
+         markOop mark = rcvr->mark();
+         intptr_t hash = (intptr_t) markOopDesc::no_hash;
+         // Implies UseBiasedLocking.
+-        if (mark->has_bias_pattern()) {
++        if (mark.has_bias_pattern()) {
+           uintptr_t thread_ident;
+           uintptr_t anticipated_bias_locking_value;
+           thread_ident = (uintptr_t)istate->thread();
+@@ -730,7 +730,7 @@ BytecodeInterpreter::run(interpreterState istate) {
+ 
+         // Traditional lightweight locking.
+         if (!success) {
+-          markOop displaced = rcvr->mark()->set_unlocked();
++          markOop displaced = rcvr->mark().set_unlocked();
+           mon->lock()->set_displaced_header(displaced);
+           bool call_vm = UseHeavyMonitors;
+           if (call_vm || rcvr->cas_set_mark((markOop)mon, displaced) != displaced) {
+@@ -854,7 +854,7 @@ BytecodeInterpreter::run(interpreterState istate) {
+       markOop mark = lockee->mark();
+       intptr_t hash = (intptr_t) markOopDesc::no_hash;
+       // implies UseBiasedLocking
+-      if (mark->has_bias_pattern()) {
++      if (mark.has_bias_pattern()) {
+         uintptr_t thread_ident;
+         uintptr_t anticipated_bias_locking_value;
+         thread_ident = (uintptr_t)istate->thread();
+@@ -916,7 +916,7 @@ BytecodeInterpreter::run(interpreterState istate) {
+ 
+       // traditional lightweight locking
+       if (!success) {
+-        markOop displaced = lockee->mark()->set_unlocked();
++        markOop displaced = lockee->mark().set_unlocked();
+         entry->lock()->set_displaced_header(displaced);
+         bool call_vm = UseHeavyMonitors;
+         if (call_vm || lockee->cas_set_mark((markOop)entry, displaced) != displaced) {
+@@ -1794,7 +1794,7 @@ run:
+           markOop mark = lockee->mark();
+           intptr_t hash = (intptr_t) markOopDesc::no_hash;
+           // implies UseBiasedLocking
+-          if (mark->has_bias_pattern()) {
++          if (mark.has_bias_pattern()) {
+             uintptr_t thread_ident;
+             uintptr_t anticipated_bias_locking_value;
+             thread_ident = (uintptr_t)istate->thread();
+@@ -1859,7 +1859,7 @@ run:
+ 
+           // traditional lightweight locking
+           if (!success) {
+-            markOop displaced = lockee->mark()->set_unlocked();
++            markOop displaced = lockee->mark().set_unlocked();
+             entry->lock()->set_displaced_header(displaced);
+             bool call_vm = UseHeavyMonitors;
+             if (call_vm || lockee->cas_set_mark((markOop)entry, displaced) != displaced) {
+@@ -1890,7 +1890,7 @@ run:
+             BasicLock* lock = most_recent->lock();
+             markOop header = lock->displaced_header();
+             most_recent->set_obj(NULL);
+-            if (!lockee->mark()->has_bias_pattern()) {
++            if (!lockee->mark().has_bias_pattern()) {
+               bool call_vm = UseHeavyMonitors;
+               // If it isn't recursive we either must swap old header or call the runtime
+               if (header != NULL || call_vm) {
+@@ -3030,7 +3030,7 @@ run:
+           markOop header = lock->displaced_header();
+           end->set_obj(NULL);
+ 
+-          if (!lockee->mark()->has_bias_pattern()) {
++          if (!lockee->mark().has_bias_pattern()) {
+             // If it isn't recursive we either must swap old header or call the runtime
+             if (header != NULL) {
+               markOop old_header = markOopDesc::encode(lock);
+@@ -3105,7 +3105,7 @@ run:
+             markOop header = lock->displaced_header();
+             base->set_obj(NULL);
+ 
+-            if (!rcvr->mark()->has_bias_pattern()) {
++            if (!rcvr->mark().has_bias_pattern()) {
+               base->set_obj(NULL);
+               // If it isn't recursive we either must swap old header or call the runtime
+               if (header != NULL) {
+diff --git a/src/hotspot/share/jfr/leakprofiler/chains/bfsClosure.cpp b/src/hotspot/share/jfr/leakprofiler/chains/bfsClosure.cpp
+index e436746e8..d14d67962 100644
+--- a/src/hotspot/share/jfr/leakprofiler/chains/bfsClosure.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/chains/bfsClosure.cpp
+@@ -131,7 +131,7 @@ void BFSClosure::closure_impl(const oop* reference, const oop pointee) {
+   if (!_mark_bits->is_marked(pointee)) {
+     _mark_bits->mark_obj(pointee);
+     // is the pointee a sample object?
+-    if (NULL == pointee->mark()) {
++    if (NULL == pointee->mark().to_pointer()) {
+       add_chain(reference, pointee);
+     }
+ 
+@@ -148,7 +148,7 @@ void BFSClosure::closure_impl(const oop* reference, const oop pointee) {
+ 
+ void BFSClosure::add_chain(const oop* reference, const oop pointee) {
+   assert(pointee != NULL, "invariant");
+-  assert(NULL == pointee->mark(), "invariant");
++  assert(NULL == pointee->mark().to_pointer(), "invariant");
+   Edge leak_edge(_current_parent, reference);
+   _edge_store->put_chain(&leak_edge, _current_parent == NULL ? 1 : _current_frontier_level + 2);
+ }
+diff --git a/src/hotspot/share/jfr/leakprofiler/chains/dfsClosure.cpp b/src/hotspot/share/jfr/leakprofiler/chains/dfsClosure.cpp
+index c347901bf..b1a1fca20 100644
+--- a/src/hotspot/share/jfr/leakprofiler/chains/dfsClosure.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/chains/dfsClosure.cpp
+@@ -121,7 +121,7 @@ void DFSClosure::closure_impl(const oop* reference, const oop pointee) {
+   assert(_mark_bits->is_marked(pointee), "invariant");
+ 
+   // is the pointee a sample object?
+-  if (NULL == pointee->mark()) {
++  if (NULL == pointee->mark().to_pointer()) {
+     add_chain();
+   }
+ 
+diff --git a/src/hotspot/share/jfr/leakprofiler/chains/edgeStore.cpp b/src/hotspot/share/jfr/leakprofiler/chains/edgeStore.cpp
+index ad549f486..b9f09fa9a 100644
+--- a/src/hotspot/share/jfr/leakprofiler/chains/edgeStore.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/chains/edgeStore.cpp
+@@ -237,8 +237,8 @@ StoredEdge* EdgeStore::associate_leak_context_with_candidate(const Edge* edge) {
+   StoredEdge* const leak_context_edge = put(edge->reference());
+   oop sample_object = edge->pointee();
+   assert(sample_object != NULL, "invariant");
+-  assert(NULL == sample_object->mark(), "invariant");
+-  sample_object->set_mark(markOop(leak_context_edge));
++  assert(NULL == sample_object->mark().to_pointer(), "invariant");
++  sample_object->set_mark(markOop::from_pointer(leak_context_edge));
+   return leak_context_edge;
+ }
+ 
+diff --git a/src/hotspot/share/jfr/leakprofiler/chains/edgeUtils.cpp b/src/hotspot/share/jfr/leakprofiler/chains/edgeUtils.cpp
+index 699fd4ac4..f4c925004 100644
+--- a/src/hotspot/share/jfr/leakprofiler/chains/edgeUtils.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/chains/edgeUtils.cpp
+@@ -36,7 +36,7 @@
+ #include "runtime/handles.inline.hpp"
+ 
+ bool EdgeUtils::is_leak_edge(const Edge& edge) {
+-  return (const Edge*)edge.pointee()->mark() == &edge;
++  return (const Edge*)edge.pointee()->mark().to_pointer() == &edge;
+ }
+ 
+ static bool is_static_field(const oop ref_owner, const InstanceKlass* ik, int offset) {
+diff --git a/src/hotspot/share/jfr/leakprofiler/chains/objectSampleMarker.hpp b/src/hotspot/share/jfr/leakprofiler/chains/objectSampleMarker.hpp
+index 9a97a373f..2c2616feb 100644
+--- a/src/hotspot/share/jfr/leakprofiler/chains/objectSampleMarker.hpp
++++ b/src/hotspot/share/jfr/leakprofiler/chains/objectSampleMarker.hpp
+@@ -45,7 +45,7 @@ class ObjectSampleMarker : public StackObj {
+                         const markOop mark_oop) : _obj(obj),
+                                                   _mark_oop(mark_oop) {}
+    public:
+-    ObjectSampleMarkOop() : _obj(NULL), _mark_oop(NULL) {}
++    ObjectSampleMarkOop() : _obj(NULL), _mark_oop(markOop::zero()) {}
+   };
+ 
+   GrowableArray<ObjectSampleMarkOop>* _store;
+@@ -72,9 +72,9 @@ class ObjectSampleMarker : public StackObj {
+     // This is an "impossible" state during a safepoint,
+     // hence we will use it to quickly identify sample objects
+     // during the reachability search from gc roots.
+-    assert(NULL == markOopDesc::INFLATING(), "invariant");
++    assert(NULL == markOopDesc::INFLATING().to_pointer(), "invariant");
+     obj->set_mark(markOopDesc::INFLATING());
+-    assert(NULL == obj->mark(), "invariant");
++    assert(NULL == obj->mark().to_pointer(), "invariant");
+   }
+ };
+ 
+diff --git a/src/hotspot/share/jfr/leakprofiler/checkpoint/eventEmitter.cpp b/src/hotspot/share/jfr/leakprofiler/checkpoint/eventEmitter.cpp
+index 02d9c2d9c..438f91763 100644
+--- a/src/hotspot/share/jfr/leakprofiler/checkpoint/eventEmitter.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/checkpoint/eventEmitter.cpp
+@@ -111,7 +111,7 @@ void EventEmitter::write_event(const ObjectSample* sample, EdgeStore* edge_store
+   traceid gc_root_id = 0;
+   const Edge* edge = NULL;
+   if (SafepointSynchronize::is_at_safepoint()) {
+-    edge = (const Edge*)(*object_addr)->mark();
++    edge = (const Edge*)(*object_addr)->mark().to_pointer();
+   }
+   if (edge == NULL) {
+     // In order to dump out a representation of the event
+diff --git a/src/hotspot/share/jfr/leakprofiler/utilities/saveRestore.cpp b/src/hotspot/share/jfr/leakprofiler/utilities/saveRestore.cpp
+index 3cfff5a70..14055853e 100644
+--- a/src/hotspot/share/jfr/leakprofiler/utilities/saveRestore.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/utilities/saveRestore.cpp
+@@ -27,7 +27,7 @@
+ #include "jfr/leakprofiler/utilities/saveRestore.hpp"
+ #include "oops/oop.inline.hpp"
+ 
+-MarkOopContext::MarkOopContext() : _obj(NULL), _mark_oop(NULL) {}
++MarkOopContext::MarkOopContext() : _obj(NULL), _mark_oop(markOop::zero()) {}
+ 
+ MarkOopContext::MarkOopContext(const oop obj) : _obj(obj), _mark_oop(obj->mark()) {
+   assert(_obj->mark() == _mark_oop, "invariant");
+@@ -36,9 +36,9 @@ MarkOopContext::MarkOopContext(const oop obj) : _obj(obj), _mark_oop(obj->mark()
+   // This is an "impossible" state during a safepoint,
+   // hence we will use it to quickly identify objects
+   // during the reachability search from gc roots.
+-  assert(NULL == markOopDesc::INFLATING(), "invariant");
++  assert(markOop::zero() == markOopDesc::INFLATING(), "invariant");
+   _obj->set_mark(markOopDesc::INFLATING());
+-  assert(NULL == obj->mark(), "invariant");
++  assert(markOop::zero() == obj->mark(), "invariant");
+ }
+ 
+ MarkOopContext::~MarkOopContext() {
+@@ -48,7 +48,7 @@ MarkOopContext::~MarkOopContext() {
+   }
+ }
+ 
+-MarkOopContext::MarkOopContext(const MarkOopContext& rhs) : _obj(NULL), _mark_oop(NULL) {
++MarkOopContext::MarkOopContext(const MarkOopContext& rhs) : _obj(NULL), _mark_oop(markOop::zero()) {
+   swap(const_cast<MarkOopContext&>(rhs));
+ }
+ 
+diff --git a/src/hotspot/share/memory/metaspaceShared.cpp b/src/hotspot/share/memory/metaspaceShared.cpp
+index c636ddbe9..b9aa49171 100644
+--- a/src/hotspot/share/memory/metaspaceShared.cpp
++++ b/src/hotspot/share/memory/metaspaceShared.cpp
+@@ -1865,7 +1865,7 @@ void MetaspaceShared::dump_open_archive_heap_objects(
+ }
+ 
+ unsigned MetaspaceShared::obj_hash(oop const& p) {
+-  assert(!p->mark()->has_bias_pattern(),
++  assert(!p->mark().has_bias_pattern(),
+          "this object should never have been locked");  // so identity_hash won't safepoin
+   unsigned hash = (unsigned)p->identity_hash();
+   return hash;
+diff --git a/src/hotspot/share/memory/universe.cpp b/src/hotspot/share/memory/universe.cpp
+index eab9576bc..933b17676 100644
+--- a/src/hotspot/share/memory/universe.cpp
++++ b/src/hotspot/share/memory/universe.cpp
+@@ -1315,7 +1315,7 @@ uintptr_t Universe::verify_mark_mask() {
+ 
+ uintptr_t Universe::verify_mark_bits() {
+   intptr_t mask = verify_mark_mask();
+-  intptr_t bits = (intptr_t)markOopDesc::prototype();
++  intptr_t bits = (intptr_t)markOopDesc::prototype().value();
+   assert((bits & ~mask) == 0, "no stray header bits");
+   return bits;
+ }
+diff --git a/src/hotspot/share/memory/virtualspace.cpp b/src/hotspot/share/memory/virtualspace.cpp
+index d67f624ca..691838c70 100644
+--- a/src/hotspot/share/memory/virtualspace.cpp
++++ b/src/hotspot/share/memory/virtualspace.cpp
+@@ -628,9 +628,9 @@ ReservedHeapSpace::ReservedHeapSpace(size_t size, size_t alignment, bool large,
+     initialize(size, alignment, large, NULL, false);
+   }
+ 
+-  assert(markOopDesc::encode_pointer_as_mark(_base)->decode_pointer() == _base,
++  assert(markOopDesc::encode_pointer_as_mark(_base).decode_pointer() == _base,
+          "area must be distinguishable from marks for mark-sweep");
+-  assert(markOopDesc::encode_pointer_as_mark(&_base[size])->decode_pointer() == &_base[size],
++  assert(markOopDesc::encode_pointer_as_mark(&_base[size]).decode_pointer() == &_base[size],
+          "area must be distinguishable from marks for mark-sweep");
+ 
+   if (base() != NULL) {
+diff --git a/src/hotspot/share/oops/klass.cpp b/src/hotspot/share/oops/klass.cpp
+index 4b97cf7eb..cacfaf82f 100644
+--- a/src/hotspot/share/oops/klass.cpp
++++ b/src/hotspot/share/oops/klass.cpp
+@@ -682,7 +682,7 @@ void Klass::oop_print_on(oop obj, outputStream* st) {
+ 
+   if (WizardMode) {
+      // print header
+-     obj->mark()->print_on(st);
++     obj->mark().print_on(st);
+   }
+ 
+   // print class
+diff --git a/src/hotspot/share/oops/klass.hpp b/src/hotspot/share/oops/klass.hpp
+index 3ade5867a..9094ff0a9 100644
+--- a/src/hotspot/share/oops/klass.hpp
++++ b/src/hotspot/share/oops/klass.hpp
+@@ -28,6 +28,7 @@
+ #include "classfile/classLoaderData.hpp"
+ #include "memory/iterator.hpp"
+ #include "memory/memRegion.hpp"
++#include "oops/markOop.hpp"
+ #include "oops/metadata.hpp"
+ #include "oops/oop.hpp"
+ #include "oops/oopHandle.hpp"
+diff --git a/src/hotspot/share/oops/klass.inline.hpp b/src/hotspot/share/oops/klass.inline.hpp
+index 560998057..89917e4f6 100644
+--- a/src/hotspot/share/oops/klass.inline.hpp
++++ b/src/hotspot/share/oops/klass.inline.hpp
+@@ -30,7 +30,7 @@
+ #include "oops/markOop.hpp"
+ 
+ inline void Klass::set_prototype_header(markOop header) {
+-  assert(!header->has_bias_pattern() || is_instance_klass(), "biased locking currently only supported for Java instances");
++  assert(!header.has_bias_pattern() || is_instance_klass(), "biased locking currently only supported for Java instances");
+   _prototype_header = header;
+ }
+ 
+diff --git a/src/hotspot/share/oops/markOop.hpp b/src/hotspot/share/oops/markOop.hpp
+index 649217c88..036b42372 100644
+--- a/src/hotspot/share/oops/markOop.hpp
++++ b/src/hotspot/share/oops/markOop.hpp
+@@ -101,10 +101,9 @@ class BasicLock;
+ class ObjectMonitor;
+ class JavaThread;
+ 
+-class markOopDesc: public oopDesc {
++class markOop {
+  private:
+-  // Conversion
+-  uintptr_t value() const { return (uintptr_t) this; }
++  uintptr_t _value;
+ 
+  public:
+   // Constants
+@@ -117,6 +116,29 @@ class markOopDesc: public oopDesc {
+          epoch_bits               = 2
+   };
+ 
++  explicit markOop(uintptr_t value) : _value(value) {}
++
++  markOop() { /* uninitialized */}
++
++  // It is critical for performance that this class be trivially
++  // destructable, copyable, and assignable.
++
++  static markOop from_pointer(void* ptr) {
++    return markOop((uintptr_t)ptr);
++  }
++  void* to_pointer() const {
++    return (void*)_value;
++  }
++
++  bool operator==(const markOop& other) const {
++    return _value == other._value;
++  }
++  bool operator!=(const markOop& other) const {
++    return !operator==(other);
++  }
++  // Conversion
++  uintptr_t value() const { return _value; }
++
+   // The biased locking code currently requires that the age bits be
+   // contiguous to the lock bits.
+   enum { lock_shift               = 0,
+@@ -164,6 +186,9 @@ class markOopDesc: public oopDesc {
+ 
+   enum { max_bias_epoch           = epoch_mask };
+ 
++  // Creates a markOop with all bits set to zero.
++  static markOop zero() { return markOop(uintptr_t(0)); }
++
+   // Biased Locking accessors.
+   // These must be checked by all code which calls into the
+   // ObjectSynchronizer and other code. The biasing is not understood
+@@ -224,7 +249,7 @@ class markOopDesc: public oopDesc {
+   // check for and avoid overwriting a 0 value installed by some
+   // other thread.  (They should spin or block instead.  The 0 value
+   // is transient and *should* be short-lived).
+-  static markOop INFLATING() { return (markOop) 0; }    // inflate-in-progress
++  static markOop INFLATING() { return zero(); }    // inflate-in-progress
+ 
+   // Should this header be preserved during GC?
+   inline bool must_be_preserved(oop obj_containing_mark) const;
+@@ -294,17 +319,17 @@ class markOopDesc: public oopDesc {
+   markOop copy_set_hash(intptr_t hash) const {
+     intptr_t tmp = value() & (~hash_mask_in_place);
+     tmp |= ((hash & hash_mask) << hash_shift);
+-    return (markOop)tmp;
++    return markOop(tmp);
+   }
+   // it is only used to be stored into BasicLock as the
+   // indicator that the lock is using heavyweight monitor
+   static markOop unused_mark() {
+-    return (markOop) marked_value;
++    return markOop(marked_value);
+   }
+   // the following two functions create the markOop to be
+   // stored into object header, it encodes monitor info
+   static markOop encode(BasicLock* lock) {
+-    return (markOop) lock;
++    return from_pointer(lock);
+   }
+   static markOop encode(ObjectMonitor* monitor) {
+     intptr_t tmp = (intptr_t) monitor;
+@@ -330,7 +355,7 @@ class markOopDesc: public oopDesc {
+     assert((v & ~age_mask) == 0, "shouldn't overflow age field");
+     return markOop((value() & ~age_mask_in_place) | (((uintptr_t)v & age_mask) << age_shift));
+   }
+-  markOop incr_age()          const { return age() == max_age ? markOop(this) : set_age(age() + 1); }
++  markOop incr_age()          const { return age() == max_age ? markOop(_value) : set_age(age() + 1); }
+ 
+   // hash operations
+   intptr_t hash() const {
+@@ -353,10 +378,10 @@ class markOopDesc: public oopDesc {
+   void print_on(outputStream* st) const;
+ 
+   // Prepare address of oop for placement into mark
+-  inline static markOop encode_pointer_as_mark(void* p) { return markOop(p)->set_marked(); }
++  inline static markOop encode_pointer_as_mark(void* p) { return from_pointer(p).set_marked(); }
+ 
+   // Recover address of oop from encoded form used in mark
+-  inline void* decode_pointer() { if (UseBiasedLocking && has_bias_pattern()) return NULL; return clear_lock_bits(); }
++  inline void* decode_pointer() { if (UseBiasedLocking && has_bias_pattern()) return NULL; return (void*)clear_lock_bits().value(); }
+ 
+   // These markOops indicate cms free chunk blocks and not objects.
+   // In 64 bit, the markOop is set to distinguish them from oops.
+@@ -375,7 +400,7 @@ class markOopDesc: public oopDesc {
+ 
+ #ifdef _LP64
+   static markOop cms_free_prototype() {
+-    return markOop(((intptr_t)prototype() & ~cms_mask_in_place) |
++    return markOop(((intptr_t)prototype().value() & ~cms_mask_in_place) |
+                    ((cms_free_chunk_pattern & cms_mask) << cms_shift));
+   }
+   uintptr_t cms_encoding() const {
+@@ -389,10 +414,23 @@ class markOopDesc: public oopDesc {
+   size_t get_size() const       { return (size_t)(value() >> size_shift); }
+   static markOop set_size_and_free(size_t size) {
+     assert((size & ~size_mask) == 0, "shouldn't overflow size field");
+-    return markOop(((intptr_t)cms_free_prototype() & ~size_mask_in_place) |
++    return markOop(((intptr_t)cms_free_prototype().value() & ~size_mask_in_place) |
+                    (((intptr_t)size & size_mask) << size_shift));
+   }
+ #endif // _LP64
+ };
+ 
++// Add an alias for the Desc type to minimize code churn.
++typedef class markOop markOopDesc;
++
++// Support atomic operations.
++template<>
++struct PrimitiveConversions::Translate<markOop> : public TrueType {
++  typedef markOop Value;
++  typedef uintptr_t Decayed;
++
++  static Decayed decay(const Value& x) { return x.value(); }
++  static Value recover(Decayed x) { return Value(x); }
++};
++
+ #endif // SHARE_VM_OOPS_MARKOOP_HPP
+diff --git a/src/hotspot/share/oops/markOop.inline.hpp b/src/hotspot/share/oops/markOop.inline.hpp
+index 77d2fee0e..f0e042070 100644
+--- a/src/hotspot/share/oops/markOop.inline.hpp
++++ b/src/hotspot/share/oops/markOop.inline.hpp
+@@ -39,7 +39,7 @@ inline bool markOopDesc::must_be_preserved_with_bias(oop obj_containing_mark) co
+     return false;
+   }
+   markOop prototype_header = prototype_for_object(obj_containing_mark);
+-  if (prototype_header->has_bias_pattern()) {
++  if (prototype_header.has_bias_pattern()) {
+     // Individual instance which has its bias revoked; must return
+     // true for correctness
+     return true;
+@@ -68,7 +68,7 @@ inline bool markOopDesc::must_be_preserved_with_bias_for_promotion_failure(oop o
+   // BiasedLocking::preserve_marks() / restore_marks() in the middle
+   // of a scavenge when a promotion failure has first been detected.
+   if (has_bias_pattern() ||
+-      prototype_for_object(obj_containing_mark)->has_bias_pattern()) {
++      prototype_for_object(obj_containing_mark).has_bias_pattern()) {
+     return true;
+   }
+   return (!is_unlocked() || !has_no_hash());
+@@ -89,7 +89,7 @@ inline bool markOopDesc::must_be_preserved_with_bias_for_cms_scavenge(Klass* kla
+   assert(UseBiasedLocking, "unexpected");
+   // CMS scavenges preserve mark words in similar fashion to promotion failures; see above
+   if (has_bias_pattern() ||
+-      klass_of_obj_containing_mark->prototype_header()->has_bias_pattern()) {
++      klass_of_obj_containing_mark->prototype_header().has_bias_pattern()) {
+     return true;
+   }
+   return (!is_unlocked() || !has_no_hash());
+@@ -106,7 +106,7 @@ inline bool markOopDesc::must_be_preserved_for_cms_scavenge(Klass* klass_of_obj_
+ inline markOop markOopDesc::prototype_for_object(oop obj) {
+ #ifdef ASSERT
+   markOop prototype_header = obj->klass()->prototype_header();
+-  assert(prototype_header == prototype() || prototype_header->has_bias_pattern(), "corrupt prototype header");
++  assert(prototype_header == prototype() || prototype_header.has_bias_pattern(), "corrupt prototype header");
+ #endif
+   return obj->klass()->prototype_header();
+ }
+diff --git a/src/hotspot/share/oops/oop.cpp b/src/hotspot/share/oops/oop.cpp
+index 0470cbbde..ab598d767 100644
+--- a/src/hotspot/share/oops/oop.cpp
++++ b/src/hotspot/share/oops/oop.cpp
+@@ -130,7 +130,7 @@ bool oopDesc::is_oop(oop obj, bool ignore_mark_word) {
+   if (ignore_mark_word) {
+     return true;
+   }
+-  if (obj->mark_raw() != NULL) {
++  if (obj->mark_raw().value() != 0) {
+     return true;
+   }
+   return !SafepointSynchronize::is_at_safepoint();
+@@ -145,7 +145,7 @@ bool oopDesc::is_oop_or_null(oop obj, bool ignore_mark_word) {
+ // used only for asserts
+ bool oopDesc::is_unlocked_oop() const {
+   if (!Universe::heap()->is_in_reserved(this)) return false;
+-  return mark()->is_unlocked();
++  return mark().is_unlocked();
+ }
+ #endif // PRODUCT
+ 
+diff --git a/src/hotspot/share/oops/oop.hpp b/src/hotspot/share/oops/oop.hpp
+index 4430530e5..6311ee908 100644
+--- a/src/hotspot/share/oops/oop.hpp
++++ b/src/hotspot/share/oops/oop.hpp
+@@ -28,6 +28,7 @@
+ #include "memory/iterator.hpp"
+ #include "memory/memRegion.hpp"
+ #include "oops/access.hpp"
++#include "oops/markOop.hpp"
+ #include "oops/metadata.hpp"
+ #include "runtime/atomic.hpp"
+ #include "utilities/macros.hpp"
+diff --git a/src/hotspot/share/oops/oop.inline.hpp b/src/hotspot/share/oops/oop.inline.hpp
+index 6c631f545..dfeecb9c5 100644
+--- a/src/hotspot/share/oops/oop.inline.hpp
++++ b/src/hotspot/share/oops/oop.inline.hpp
+@@ -44,23 +44,24 @@
+ // We need a separate file to avoid circular references
+ 
+ markOop  oopDesc::mark()      const {
+-  return HeapAccess<MO_VOLATILE>::load_at(as_oop(), mark_offset_in_bytes());
++  uintptr_t v = HeapAccess<MO_VOLATILE>::load_at(as_oop(), mark_offset_in_bytes());
++  return markOop(v);
+ }
+ 
+ markOop  oopDesc::mark_raw()  const {
+-  return _mark;
++  return Atomic::load(&_mark);;
+ }
+ 
+ markOop* oopDesc::mark_addr_raw() const {
+   return (markOop*) &_mark;
+ }
+ 
+-void oopDesc::set_mark(volatile markOop m) {
+-  HeapAccess<MO_VOLATILE>::store_at(as_oop(), mark_offset_in_bytes(), m);
++void oopDesc::set_mark(markOop m) {
++  HeapAccess<MO_VOLATILE>::store_at(as_oop(), mark_offset_in_bytes(), m.value());
+ }
+ 
+-void oopDesc::set_mark_raw(volatile markOop m) {
+-  _mark = m;
++void oopDesc::set_mark_raw(markOop m) {
++  Atomic::store(m, &_mark);
+ }
+ 
+ void oopDesc::set_mark_raw(HeapWord* mem, markOop m) {
+@@ -68,11 +69,12 @@ void oopDesc::set_mark_raw(HeapWord* mem, markOop m) {
+ }
+ 
+ void oopDesc::release_set_mark(markOop m) {
+-  HeapAccess<MO_RELEASE>::store_at(as_oop(), mark_offset_in_bytes(), m);
++  HeapAccess<MO_RELEASE>::store_at(as_oop(), mark_offset_in_bytes(), m.value());
+ }
+ 
+ markOop oopDesc::cas_set_mark(markOop new_mark, markOop old_mark) {
+-  return HeapAccess<>::atomic_cmpxchg_at(new_mark, as_oop(), mark_offset_in_bytes(), old_mark);
++  uintptr_t v = HeapAccess<>::atomic_cmpxchg_at(new_mark.value(), as_oop(), mark_offset_in_bytes(), old_mark.value());
++  return markOop(v);
+ }
+ 
+ markOop oopDesc::cas_set_mark_raw(markOop new_mark, markOop old_mark, atomic_memory_order order) {
+@@ -318,31 +320,31 @@ inline jdouble oopDesc::double_field(int offset) const              { return Hea
+ inline void    oopDesc::double_field_put(int offset, jdouble value) { HeapAccess<>::store_at(as_oop(), offset, value); }
+ 
+ bool oopDesc::is_locked() const {
+-  return mark()->is_locked();
++  return mark().is_locked();
+ }
+ 
+ bool oopDesc::is_unlocked() const {
+-  return mark()->is_unlocked();
++  return mark().is_unlocked();
+ }
+ 
+ bool oopDesc::has_bias_pattern() const {
+-  return mark()->has_bias_pattern();
++  return mark().has_bias_pattern();
+ }
+ 
+ bool oopDesc::has_bias_pattern_raw() const {
+-  return mark_raw()->has_bias_pattern();
++  return mark_raw().has_bias_pattern();
+ }
+ 
+ // Used only for markSweep, scavenging
+ bool oopDesc::is_gc_marked() const {
+-  return mark_raw()->is_marked();
++  return mark_raw().is_marked();
+ }
+ 
+ // Used by scavengers
+ bool oopDesc::is_forwarded() const {
+   // The extra heap check is needed since the obj might be locked, in which case the
+   // mark would point to a stack location and have the sentinel bit cleared
+-  return mark_raw()->is_marked();
++  return mark_raw().is_marked();
+ }
+ 
+ // Used by scavengers
+@@ -355,7 +357,7 @@ void oopDesc::forward_to(oop p) {
+          !MetaspaceShared::is_archive_object(p),
+          "forwarding archive object");
+   markOop m = markOopDesc::encode_pointer_as_mark(p);
+-  assert(m->decode_pointer() == p, "encoding must be reversable");
++  assert(m.decode_pointer() == p, "encoding must be reversable");
+   set_mark_raw(m);
+ }
+ 
+@@ -366,7 +368,7 @@ bool oopDesc::cas_forward_to(oop p, markOop compare, atomic_memory_order order)
+   assert(Universe::heap()->is_in_reserved(p),
+          "forwarding to something not in heap");
+   markOop m = markOopDesc::encode_pointer_as_mark(p);
+-  assert(m->decode_pointer() == p, "encoding must be reversable");
++  assert(m.decode_pointer() == p, "encoding must be reversable");
+   return cas_set_mark_raw(m, compare, order) == compare;
+ }
+ 
+@@ -375,10 +377,10 @@ oop oopDesc::forward_to_atomic(oop p, atomic_memory_order order) {
+   markOop forwardPtrMark = markOopDesc::encode_pointer_as_mark(p);
+   markOop curMark;
+ 
+-  assert(forwardPtrMark->decode_pointer() == p, "encoding must be reversable");
++  assert(forwardPtrMark.decode_pointer() == p, "encoding must be reversable");
+   assert(sizeof(markOop) == sizeof(intptr_t), "CAS below requires this.");
+ 
+-  while (!oldMark->is_marked()) {
++  while (!oldMark.is_marked()) {
+     curMark = cas_set_mark_raw(forwardPtrMark, oldMark, order);
+     assert(is_forwarded(), "object should have been forwarded");
+     if (curMark == oldMark) {
+@@ -396,33 +398,32 @@ oop oopDesc::forward_to_atomic(oop p, atomic_memory_order order) {
+ // The forwardee is used when copying during scavenge and mark-sweep.
+ // It does need to clear the low two locking- and GC-related bits.
+ oop oopDesc::forwardee() const {
+-  return (oop) mark_raw()->decode_pointer();
++  return (oop) mark_raw().decode_pointer();
+ }
+ 
+ // Note that the forwardee is not the same thing as the displaced_mark.
+ // The forwardee is used when copying during scavenge and mark-sweep.
+ // It does need to clear the low two locking- and GC-related bits.
+ oop oopDesc::forwardee_acquire() const {
+-  markOop m = OrderAccess::load_acquire(&_mark);
+-  return (oop) m->decode_pointer();
++  return (oop) OrderAccess::load_acquire(&_mark).decode_pointer();
+ }
+ 
+ // The following method needs to be MT safe.
+ uint oopDesc::age() const {
+   assert(!is_forwarded(), "Attempt to read age from forwarded mark");
+   if (has_displaced_mark_raw()) {
+-    return displaced_mark_raw()->age();
++    return displaced_mark_raw().age();
+   } else {
+-    return mark_raw()->age();
++    return mark_raw().age();
+   }
+ }
+ 
+ void oopDesc::incr_age() {
+   assert(!is_forwarded(), "Attempt to increment age of forwarded mark");
+   if (has_displaced_mark_raw()) {
+-    set_displaced_mark_raw(displaced_mark_raw()->incr_age());
++    set_displaced_mark_raw(displaced_mark_raw().incr_age());
+   } else {
+-    set_mark_raw(mark_raw()->incr_age());
++    set_mark_raw(mark_raw().incr_age());
+   }
+ }
+ 
+@@ -489,25 +490,25 @@ intptr_t oopDesc::identity_hash() {
+   // Fast case; if the object is unlocked and the hash value is set, no locking is needed
+   // Note: The mark must be read into local variable to avoid concurrent updates.
+   markOop mrk = mark();
+-  if (mrk->is_unlocked() && !mrk->has_no_hash()) {
+-    return mrk->hash();
+-  } else if (mrk->is_marked()) {
+-    return mrk->hash();
++  if (mrk.is_unlocked() && !mrk.has_no_hash()) {
++    return mrk.hash();
++  } else if (mrk.is_marked()) {
++    return mrk.hash();
+   } else {
+     return slow_identity_hash();
+   }
+ }
+ 
+ bool oopDesc::has_displaced_mark_raw() const {
+-  return mark_raw()->has_displaced_mark_helper();
++  return mark_raw().has_displaced_mark_helper();
+ }
+ 
+ markOop oopDesc::displaced_mark_raw() const {
+-  return mark_raw()->displaced_mark_helper();
++  return mark_raw().displaced_mark_helper();
+ }
+ 
+ void oopDesc::set_displaced_mark_raw(markOop m) {
+-  mark_raw()->set_displaced_mark_helper(m);
++  mark_raw().set_displaced_mark_helper(m);
+ }
+ 
+ #endif // SHARE_VM_OOPS_OOP_INLINE_HPP
+diff --git a/src/hotspot/share/oops/oopsHierarchy.hpp b/src/hotspot/share/oops/oopsHierarchy.hpp
+index d419aa156..f5ae4084b 100644
+--- a/src/hotspot/share/oops/oopsHierarchy.hpp
++++ b/src/hotspot/share/oops/oopsHierarchy.hpp
+@@ -40,7 +40,6 @@ typedef juint narrowOop; // Offset instead of address for an oop within a java o
+ typedef juint  narrowKlass;
+ 
+ typedef void* OopOrNarrowOopStar;
+-typedef class   markOopDesc*                markOop;
+ 
+ #ifndef CHECK_UNHANDLED_OOPS
+ 
+@@ -120,7 +119,6 @@ public:
+   operator oopDesc* () const volatile { return obj(); }
+   operator intptr_t* () const         { return (intptr_t*)obj(); }
+   operator PromotedObject* () const   { return (PromotedObject*)obj(); }
+-  operator markOop () const volatile  { return markOop(obj()); }
+   operator address   () const         { return (address)obj(); }
+ 
+   // from javaCalls.cpp
+diff --git a/src/hotspot/share/opto/macro.cpp b/src/hotspot/share/opto/macro.cpp
+index 155c6893e..933adcb3e 100644
+--- a/src/hotspot/share/opto/macro.cpp
++++ b/src/hotspot/share/opto/macro.cpp
+@@ -1773,7 +1773,7 @@ PhaseMacroExpand::initialize_object(AllocateNode* alloc,
+   if (UseBiasedLocking && (length == NULL)) {
+     mark_node = make_load(control, rawmem, klass_node, in_bytes(Klass::prototype_header_offset()), TypeRawPtr::BOTTOM, T_ADDRESS);
+   } else {
+-    mark_node = makecon(TypeRawPtr::make((address)markOopDesc::prototype()));
++    mark_node = makecon(TypeRawPtr::make((address)markOopDesc::prototype().value()));
+   }
+   rawmem = make_store(control, rawmem, object, oopDesc::mark_offset_in_bytes(), mark_node, T_ADDRESS);
+ 
+diff --git a/src/hotspot/share/prims/jvmtiEnvBase.cpp b/src/hotspot/share/prims/jvmtiEnvBase.cpp
+index 093c79042..28ef47815 100644
+--- a/src/hotspot/share/prims/jvmtiEnvBase.cpp
++++ b/src/hotspot/share/prims/jvmtiEnvBase.cpp
+@@ -965,16 +965,16 @@ JvmtiEnvBase::get_object_monitor_usage(JavaThread* calling_thread, jobject objec
+     {
+       markOop mark = hobj()->mark();
+ 
+-      if (!mark->has_monitor()) {
++      if (!mark.has_monitor()) {
+         // this object has a lightweight monitor
+ 
+-        if (mark->has_locker()) {
+-          owner = (address)mark->locker(); // save the address of the Lock word
++        if (mark.has_locker()) {
++          owner = (address)mark.locker(); // save the address of the Lock word
+         }
+         // implied else: no owner
+       } else {
+         // this object has a heavyweight monitor
+-        mon = mark->monitor();
++        mon = mark.monitor();
+ 
+         // The owner field of a heavyweight monitor may be NULL for no
+         // owner, a JavaThread * or it may still be the address of the
+diff --git a/src/hotspot/share/prims/jvmtiTagMap.cpp b/src/hotspot/share/prims/jvmtiTagMap.cpp
+index 1baa32c33..aa8f5230e 100644
+--- a/src/hotspot/share/prims/jvmtiTagMap.cpp
++++ b/src/hotspot/share/prims/jvmtiTagMap.cpp
+@@ -1645,7 +1645,7 @@ class RestoreMarksClosure : public ObjectClosure {
+   void do_object(oop o) {
+     if (o != NULL) {
+       markOop mark = o->mark();
+-      if (mark->is_marked()) {
++      if (mark.is_marked()) {
+         o->init_mark();
+       }
+     }
+@@ -1723,23 +1723,23 @@ void ObjectMarker::done() {
+ // mark an object
+ inline void ObjectMarker::mark(oop o) {
+   assert(Universe::heap()->is_in(o), "sanity check");
+-  assert(!o->mark()->is_marked(), "should only mark an object once");
++  assert(!o->mark().is_marked(), "should only mark an object once");
+ 
+   // object's mark word
+   markOop mark = o->mark();
+ 
+-  if (mark->must_be_preserved(o)) {
++  if (mark.must_be_preserved(o)) {
+     _saved_mark_stack->push(mark);
+     _saved_oop_stack->push(o);
+   }
+ 
+   // mark the object
+-  o->set_mark(markOopDesc::prototype()->set_marked());
++  o->set_mark(markOopDesc::prototype().set_marked());
+ }
+ 
+ // return true if object is marked
+ inline bool ObjectMarker::visited(oop o) {
+-  return o->mark()->is_marked();
++  return o->mark().is_marked();
+ }
+ 
+ // Stack allocated class to help ensure that ObjectMarker is used
+diff --git a/src/hotspot/share/prims/whitebox.cpp b/src/hotspot/share/prims/whitebox.cpp
+index 82a811062..29f67a28e 100644
+--- a/src/hotspot/share/prims/whitebox.cpp
++++ b/src/hotspot/share/prims/whitebox.cpp
+@@ -1689,7 +1689,7 @@ WB_END
+ 
+ WB_ENTRY(jboolean, WB_IsMonitorInflated(JNIEnv* env, jobject wb, jobject obj))
+   oop obj_oop = JNIHandles::resolve(obj);
+-  return (jboolean) obj_oop->mark()->has_monitor();
++  return (jboolean) obj_oop->mark().has_monitor();
+ WB_END
+ 
+ WB_ENTRY(void, WB_ForceSafepoint(JNIEnv* env, jobject wb))
+diff --git a/src/hotspot/share/runtime/basicLock.cpp b/src/hotspot/share/runtime/basicLock.cpp
+index 5d69b30ae..2090e4906 100644
+--- a/src/hotspot/share/runtime/basicLock.cpp
++++ b/src/hotspot/share/runtime/basicLock.cpp
+@@ -29,8 +29,8 @@
+ void BasicLock::print_on(outputStream* st) const {
+   st->print("monitor");
+   markOop moop = displaced_header();
+-  if (moop != NULL)
+-    moop->print_on(st);
++  if (moop.value() != 0)
++    moop.print_on(st);
+ }
+ 
+ void BasicLock::move_to(oop obj, BasicLock* dest) {
+@@ -62,7 +62,7 @@ void BasicLock::move_to(oop obj, BasicLock* dest) {
+   // is small (given the support for inflated fast-path locking in the fast_lock, etc)
+   // we'll leave that optimization for another time.
+ 
+-  if (displaced_header()->is_neutral()) {
++  if (displaced_header().is_neutral()) {
+     ObjectSynchronizer::inflate_helper(obj);
+     // WARNING: We can not put check here, because the inflation
+     // will not update the displaced header. Once BasicLock is inflated,
+@@ -75,6 +75,6 @@ void BasicLock::move_to(oop obj, BasicLock* dest) {
+     // we can find any flavor mark in the displaced mark.
+   }
+ // [RGV] The next line appears to do nothing!
+-  intptr_t dh = (intptr_t) displaced_header();
++  intptr_t dh = (intptr_t) displaced_header().value();
+   dest->set_displaced_header(displaced_header());
+ }
+diff --git a/src/hotspot/share/runtime/basicLock.hpp b/src/hotspot/share/runtime/basicLock.hpp
+index 68fd6c332..388741734 100644
+--- a/src/hotspot/share/runtime/basicLock.hpp
++++ b/src/hotspot/share/runtime/basicLock.hpp
+@@ -26,6 +26,7 @@
+ #define SHARE_VM_RUNTIME_BASICLOCK_HPP
+ 
+ #include "oops/markOop.hpp"
++#include "runtime/atomic.hpp"
+ #include "runtime/handles.hpp"
+ 
+ class BasicLock {
+@@ -34,8 +35,13 @@ class BasicLock {
+  private:
+   volatile markOop _displaced_header;
+  public:
+-  markOop      displaced_header() const               { return _displaced_header; }
+-  void         set_displaced_header(markOop header)   { _displaced_header = header; }
++  markOop displaced_header() const {
++    return Atomic::load(&_displaced_header);
++  }
++
++  void set_displaced_header(markOop header) {
++    Atomic::store(header, &_displaced_header);
++  }
+ 
+   void print_on(outputStream* st) const;
+ 
+diff --git a/src/hotspot/share/runtime/biasedLocking.cpp b/src/hotspot/share/runtime/biasedLocking.cpp
+index a324120d8..2c23a4288 100644
+--- a/src/hotspot/share/runtime/biasedLocking.cpp
++++ b/src/hotspot/share/runtime/biasedLocking.cpp
+@@ -150,27 +150,27 @@ static GrowableArray<MonitorInfo*>* get_or_compute_monitor_info(JavaThread* thre
+   return info;
+ }
+ 
+-// After the call, *biased_locker will be set to obj->mark()->biased_locker() if biased_locker != NULL,
++// After the call, *biased_locker will be set to obj->mark().biased_locker() if biased_locker != NULL,
+ // AND it is a living thread. Otherwise it will not be updated, (i.e. the caller is responsible for initialization).
+ static BiasedLocking::Condition revoke_bias(oop obj, bool allow_rebias, bool is_bulk, JavaThread* requesting_thread, JavaThread** biased_locker) {
+   markOop mark = obj->mark();
+-  if (!mark->has_bias_pattern()) {
++  if (!mark.has_bias_pattern()) {
+     if (log_is_enabled(Info, biasedlocking)) {
+       ResourceMark rm;
+       log_info(biasedlocking)("  (Skipping revocation of object " INTPTR_FORMAT
+                               ", mark " INTPTR_FORMAT ", type %s"
+                               ", requesting thread " INTPTR_FORMAT
+                               " because it's no longer biased)",
+-                              p2i((void *)obj), (intptr_t) mark,
++                              p2i((void *)obj), (intptr_t) mark.value(),
+                               obj->klass()->external_name(),
+                               (intptr_t) requesting_thread);
+     }
+     return BiasedLocking::NOT_BIASED;
+   }
+ 
+-  uint age = mark->age();
+-  markOop   biased_prototype = markOopDesc::biased_locking_prototype()->set_age(age);
+-  markOop unbiased_prototype = markOopDesc::prototype()->set_age(age);
++  uint age = mark.age();
++  markOop   biased_prototype = markOopDesc::biased_locking_prototype().set_age(age);
++  markOop unbiased_prototype = markOopDesc::prototype().set_age(age);
+ 
+   // Log at "info" level if not bulk, else "trace" level
+   if (!is_bulk) {
+@@ -179,9 +179,9 @@ static BiasedLocking::Condition revoke_bias(oop obj, bool allow_rebias, bool is_
+                             INTPTR_FORMAT ", type %s, prototype header " INTPTR_FORMAT
+                             ", allow rebias %d, requesting thread " INTPTR_FORMAT,
+                             p2i((void *)obj),
+-                            (intptr_t) mark,
++                            (intptr_t) mark.value(),
+                             obj->klass()->external_name(),
+-                            (intptr_t) obj->klass()->prototype_header(),
++                            (intptr_t) obj->klass()->prototype_header().value(),
+                             (allow_rebias ? 1 : 0),
+                             (intptr_t) requesting_thread);
+   } else {
+@@ -190,14 +190,14 @@ static BiasedLocking::Condition revoke_bias(oop obj, bool allow_rebias, bool is_
+                              INTPTR_FORMAT " , type %s , prototype header " INTPTR_FORMAT
+                              " , allow rebias %d , requesting thread " INTPTR_FORMAT,
+                              p2i((void *)obj),
+-                             (intptr_t) mark,
++                             (intptr_t) mark.value(),
+                              obj->klass()->external_name(),
+-                             (intptr_t) obj->klass()->prototype_header(),
++                             (intptr_t) obj->klass()->prototype_header().value(),
+                              (allow_rebias ? 1 : 0),
+                              (intptr_t) requesting_thread);
+   }
+ 
+-  JavaThread* biased_thread = mark->biased_locker();
++  JavaThread* biased_thread = mark.biased_locker();
+   if (biased_thread == NULL) {
+     // Object is anonymously biased. We can get here if, for
+     // example, we revoke the bias due to an identity hash code
+@@ -279,7 +279,7 @@ static BiasedLocking::Condition revoke_bias(oop obj, bool allow_rebias, bool is_
+     // Must release storing the lock address for platforms without TSO
+     // ordering (e.g. ppc).
+     obj->release_set_mark(markOopDesc::encode(highest_lock));
+-    assert(!obj->mark()->has_bias_pattern(), "illegal mark state: stack lock used bias bit");
++    assert(!obj->mark().has_bias_pattern(), "illegal mark state: stack lock used bias bit");
+     // Log at "info" level if not bulk, else "trace" level
+     if (!is_bulk) {
+       log_info(biasedlocking)("  Revoked bias of currently-locked object");
+@@ -320,7 +320,7 @@ enum HeuristicsResult {
+ 
+ static HeuristicsResult update_heuristics(oop o, bool allow_rebias) {
+   markOop mark = o->mark();
+-  if (!mark->has_bias_pattern()) {
++  if (!mark.has_bias_pattern()) {
+     return HR_NOT_BIASED;
+   }
+ 
+@@ -381,7 +381,7 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+                           INTPTR_FORMAT " , mark " INTPTR_FORMAT " , type %s",
+                           (bulk_rebias ? "rebias" : "revoke"),
+                           p2i((void *) o),
+-                          (intptr_t) o->mark(),
++                          (intptr_t) o->mark().value(),
+                           o->klass()->external_name());
+ 
+   jlong cur_time = os::javaTimeMillis();
+@@ -405,10 +405,10 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+       // try to update the epoch -- assume another VM operation came in
+       // and reset the header to the unbiased state, which will
+       // implicitly cause all existing biases to be revoked
+-      if (klass->prototype_header()->has_bias_pattern()) {
+-        int prev_epoch = klass->prototype_header()->bias_epoch();
+-        klass->set_prototype_header(klass->prototype_header()->incr_bias_epoch());
+-        int cur_epoch = klass->prototype_header()->bias_epoch();
++      if (klass->prototype_header().has_bias_pattern()) {
++        int prev_epoch = klass->prototype_header().bias_epoch();
++        klass->set_prototype_header(klass->prototype_header().incr_bias_epoch());
++        int cur_epoch = klass->prototype_header().bias_epoch();
+ 
+         // Now walk all threads' stacks and adjust epochs of any biased
+         // and locked objects of this data type we encounter
+@@ -418,10 +418,10 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+             MonitorInfo* mon_info = cached_monitor_info->at(i);
+             oop owner = mon_info->owner();
+             markOop mark = owner->mark();
+-            if ((owner->klass() == k_o) && mark->has_bias_pattern()) {
++            if ((owner->klass() == k_o) && mark.has_bias_pattern()) {
+               // We might have encountered this object already in the case of recursive locking
+-              assert(mark->bias_epoch() == prev_epoch || mark->bias_epoch() == cur_epoch, "error in bias epoch adjustment");
+-              owner->set_mark(mark->set_bias_epoch(cur_epoch));
++              assert(mark.bias_epoch() == prev_epoch || mark.bias_epoch() == cur_epoch, "error in bias epoch adjustment");
++              owner->set_mark(mark.set_bias_epoch(cur_epoch));
+             }
+           }
+         }
+@@ -429,7 +429,7 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+ 
+       // At this point we're done. All we have to do is potentially
+       // adjust the header of the given object to revoke its bias.
+-      revoke_bias(o, attempt_rebias_of_object && klass->prototype_header()->has_bias_pattern(), true, requesting_thread, NULL);
++      revoke_bias(o, attempt_rebias_of_object && klass->prototype_header().has_bias_pattern(), true, requesting_thread, NULL);
+     } else {
+       if (log_is_enabled(Info, biasedlocking)) {
+         ResourceMark rm;
+@@ -450,7 +450,7 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+           MonitorInfo* mon_info = cached_monitor_info->at(i);
+           oop owner = mon_info->owner();
+           markOop mark = owner->mark();
+-          if ((owner->klass() == k_o) && mark->has_bias_pattern()) {
++          if ((owner->klass() == k_o) && mark.has_bias_pattern()) {
+             revoke_bias(owner, false, true, requesting_thread, NULL);
+           }
+         }
+@@ -467,17 +467,17 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+   BiasedLocking::Condition status_code = BiasedLocking::BIAS_REVOKED;
+ 
+   if (attempt_rebias_of_object &&
+-      o->mark()->has_bias_pattern() &&
+-      klass->prototype_header()->has_bias_pattern()) {
+-    markOop new_mark = markOopDesc::encode(requesting_thread, o->mark()->age(),
+-                                           klass->prototype_header()->bias_epoch());
++      o->mark().has_bias_pattern() &&
++      klass->prototype_header().has_bias_pattern()) {
++    markOop new_mark = markOopDesc::encode(requesting_thread, o->mark().age(),
++                                           klass->prototype_header().bias_epoch());
+     o->set_mark(new_mark);
+     status_code = BiasedLocking::BIAS_REVOKED_AND_REBIASED;
+     log_info(biasedlocking)("  Rebiased object toward thread " INTPTR_FORMAT, (intptr_t) requesting_thread);
+   }
+ 
+-  assert(!o->mark()->has_bias_pattern() ||
+-         (attempt_rebias_of_object && (o->mark()->biased_locker() == requesting_thread)),
++  assert(!o->mark().has_bias_pattern() ||
++         (attempt_rebias_of_object && (o->mark().biased_locker() == requesting_thread)),
+          "bug in bulk bias revocation");
+ 
+   return status_code;
+@@ -523,13 +523,13 @@ public:
+     // there is nothing to do and we avoid a safepoint.
+     if (_obj != NULL) {
+       markOop mark = (*_obj)()->mark();
+-      if (mark->has_bias_pattern()) {
++      if (mark.has_bias_pattern()) {
+         return true;
+       }
+     } else {
+       for ( int i = 0 ; i < _objs->length(); i++ ) {
+         markOop mark = (_objs->at(i))()->mark();
+-        if (mark->has_bias_pattern()) {
++        if (mark.has_bias_pattern()) {
+           return true;
+         }
+       }
+@@ -629,7 +629,7 @@ BiasedLocking::Condition BiasedLocking::revoke_and_rebias(Handle obj, bool attem
+   // update the heuristics because doing so may cause unwanted bulk
+   // revocations (which are expensive) to occur.
+   markOop mark = obj->mark();
+-  if (mark->is_biased_anonymously() && !attempt_rebias) {
++  if (mark.is_biased_anonymously() && !attempt_rebias) {
+     // We are probably trying to revoke the bias of this object due to
+     // an identity hash code computation. Try to revoke the bias
+     // without a safepoint. This is possible if we can successfully
+@@ -637,15 +637,15 @@ BiasedLocking::Condition BiasedLocking::revoke_and_rebias(Handle obj, bool attem
+     // the object, meaning that no other thread has raced to acquire
+     // the bias of the object.
+     markOop biased_value       = mark;
+-    markOop unbiased_prototype = markOopDesc::prototype()->set_age(mark->age());
++    markOop unbiased_prototype = markOopDesc::prototype().set_age(mark.age());
+     markOop res_mark = obj->cas_set_mark(unbiased_prototype, mark);
+     if (res_mark == biased_value) {
+       return BIAS_REVOKED;
+     }
+-  } else if (mark->has_bias_pattern()) {
++  } else if (mark.has_bias_pattern()) {
+     Klass* k = obj->klass();
+     markOop prototype_header = k->prototype_header();
+-    if (!prototype_header->has_bias_pattern()) {
++    if (!prototype_header.has_bias_pattern()) {
+       // This object has a stale bias from before the bulk revocation
+       // for this data type occurred. It's pointless to update the
+       // heuristics at this point so simply update the header with a
+@@ -654,9 +654,9 @@ BiasedLocking::Condition BiasedLocking::revoke_and_rebias(Handle obj, bool attem
+       // with it.
+       markOop biased_value       = mark;
+       markOop res_mark = obj->cas_set_mark(prototype_header, mark);
+-      assert(!obj->mark()->has_bias_pattern(), "even if we raced, should still be revoked");
++      assert(!obj->mark().has_bias_pattern(), "even if we raced, should still be revoked");
+       return BIAS_REVOKED;
+-    } else if (prototype_header->bias_epoch() != mark->bias_epoch()) {
++    } else if (prototype_header.bias_epoch() != mark.bias_epoch()) {
+       // The epoch of this biasing has expired indicating that the
+       // object is effectively unbiased. Depending on whether we need
+       // to rebias or revoke the bias of this object we can do it
+@@ -667,14 +667,14 @@ BiasedLocking::Condition BiasedLocking::revoke_and_rebias(Handle obj, bool attem
+       if (attempt_rebias) {
+         assert(THREAD->is_Java_thread(), "");
+         markOop biased_value       = mark;
+-        markOop rebiased_prototype = markOopDesc::encode((JavaThread*) THREAD, mark->age(), prototype_header->bias_epoch());
++        markOop rebiased_prototype = markOopDesc::encode((JavaThread*) THREAD, mark.age(), prototype_header.bias_epoch());
+         markOop res_mark = obj->cas_set_mark(rebiased_prototype, mark);
+         if (res_mark == biased_value) {
+           return BIAS_REVOKED_AND_REBIASED;
+         }
+       } else {
+         markOop biased_value       = mark;
+-        markOop unbiased_prototype = markOopDesc::prototype()->set_age(mark->age());
++        markOop unbiased_prototype = markOopDesc::prototype().set_age(mark.age());
+         markOop res_mark = obj->cas_set_mark(unbiased_prototype, mark);
+         if (res_mark == biased_value) {
+           return BIAS_REVOKED;
+@@ -689,8 +689,8 @@ BiasedLocking::Condition BiasedLocking::revoke_and_rebias(Handle obj, bool attem
+   } else if (heuristics == HR_SINGLE_REVOKE) {
+     Klass *k = obj->klass();
+     markOop prototype_header = k->prototype_header();
+-    if (mark->biased_locker() == THREAD &&
+-        prototype_header->bias_epoch() == mark->bias_epoch()) {
++    if (mark.biased_locker() == THREAD &&
++        prototype_header.bias_epoch() == mark.bias_epoch()) {
+       // A thread is trying to revoke the bias of an object biased
+       // toward it, again likely due to an identity hash code
+       // computation. We can again avoid a safepoint in this case
+@@ -814,7 +814,7 @@ void BiasedLocking::preserve_marks() {
+             oop owner = mon_info->owner();
+             if (owner != NULL) {
+               markOop mark = owner->mark();
+-              if (mark->has_bias_pattern()) {
++              if (mark.has_bias_pattern()) {
+                 _preserved_oop_stack->push(Handle(cur, owner));
+                 _preserved_mark_stack->push(mark);
+               }
+diff --git a/src/hotspot/share/runtime/deoptimization.cpp b/src/hotspot/share/runtime/deoptimization.cpp
+index 7ca0d9154..5f1d44355 100644
+--- a/src/hotspot/share/runtime/deoptimization.cpp
++++ b/src/hotspot/share/runtime/deoptimization.cpp
+@@ -1121,14 +1121,14 @@ void Deoptimization::relock_objects(GrowableArray<MonitorInfo*>* monitors, JavaT
+       if (!mon_info->owner_is_scalar_replaced()) {
+         Handle obj(thread, mon_info->owner());
+         markOop mark = obj->mark();
+-        if (UseBiasedLocking && mark->has_bias_pattern()) {
++        if (UseBiasedLocking && mark.has_bias_pattern()) {
+           // New allocated objects may have the mark set to anonymously biased.
+           // Also the deoptimized method may called methods with synchronization
+           // where the thread-local object is bias locked to the current thread.
+-          assert(mark->is_biased_anonymously() ||
+-                 mark->biased_locker() == thread, "should be locked to current thread");
++          assert(mark.is_biased_anonymously() ||
++                 mark.biased_locker() == thread, "should be locked to current thread");
+           // Reset mark word to unbiased prototype.
+-          markOop unbiased_prototype = markOopDesc::prototype()->set_age(mark->age());
++          markOop unbiased_prototype = markOopDesc::prototype().set_age(mark.age());
+           obj->set_mark(unbiased_prototype);
+         }
+         BasicLock* lock = mon_info->lock();
+diff --git a/src/hotspot/share/runtime/objectMonitor.hpp b/src/hotspot/share/runtime/objectMonitor.hpp
+index d73c8a947..eba6075a2 100644
+--- a/src/hotspot/share/runtime/objectMonitor.hpp
++++ b/src/hotspot/share/runtime/objectMonitor.hpp
+@@ -27,6 +27,7 @@
+ 
+ #include "memory/allocation.hpp"
+ #include "memory/padded.hpp"
++#include "oops/markOop.hpp"
+ #include "runtime/os.hpp"
+ #include "runtime/park.hpp"
+ #include "runtime/perfData.hpp"
+diff --git a/src/hotspot/share/runtime/objectMonitor.inline.hpp b/src/hotspot/share/runtime/objectMonitor.inline.hpp
+index 951d6472e..abb8cc554 100644
+--- a/src/hotspot/share/runtime/objectMonitor.inline.hpp
++++ b/src/hotspot/share/runtime/objectMonitor.inline.hpp
+@@ -25,6 +25,8 @@
+ #ifndef SHARE_VM_RUNTIME_OBJECTMONITOR_INLINE_HPP
+ #define SHARE_VM_RUNTIME_OBJECTMONITOR_INLINE_HPP
+ 
++#include "runtime/atomic.hpp"
++
+ inline intptr_t ObjectMonitor::is_entered(TRAPS) const {
+   if (THREAD == _owner || THREAD->is_lock_owned((address) _owner)) {
+     return 1;
+@@ -33,7 +35,7 @@ inline intptr_t ObjectMonitor::is_entered(TRAPS) const {
+ }
+ 
+ inline markOop ObjectMonitor::header() const {
+-  return _header;
++  return Atomic::load(&_header);
+ }
+ 
+ inline volatile markOop* ObjectMonitor::header_addr() {
+@@ -42,7 +44,7 @@ inline volatile markOop* ObjectMonitor::header_addr() {
+ }
+ 
+ inline void ObjectMonitor::set_header(markOop hdr) {
+-  _header = hdr;
++  Atomic::store(hdr, &_header);
+ }
+ 
+ inline jint ObjectMonitor::count() const {
+@@ -58,14 +60,14 @@ inline void* ObjectMonitor::owner() const {
+ }
+ 
+ inline void ObjectMonitor::clear() {
+-  assert(_header, "Fatal logic error in ObjectMonitor header!");
++  assert(Atomic::load(&_header).value() != 0, "Fatal logic error in ObjectMonitor header!");
+   assert(_count == 0, "Fatal logic error in ObjectMonitor count!");
+   assert(_waiters == 0, "Fatal logic error in ObjectMonitor waiters!");
+   assert(_recursions == 0, "Fatal logic error in ObjectMonitor recursions!");
+   assert(_object != NULL, "Fatal logic error in ObjectMonitor object!");
+   assert(_owner == 0, "Fatal logic error in ObjectMonitor owner!");
+ 
+-  _header = NULL;
++  Atomic::store(markOop::zero(), &_header);
+   _object = NULL;
+ }
+ 
+diff --git a/src/hotspot/share/runtime/sharedRuntime.cpp b/src/hotspot/share/runtime/sharedRuntime.cpp
+index 595ff7495..cee41fcd7 100644
+--- a/src/hotspot/share/runtime/sharedRuntime.cpp
++++ b/src/hotspot/share/runtime/sharedRuntime.cpp
+@@ -3080,10 +3080,10 @@ JRT_LEAF(intptr_t*, SharedRuntime::OSR_migration_begin( JavaThread *thread) )
+     if (kptr2->obj() != NULL) {         // Avoid 'holes' in the monitor array
+       BasicLock *lock = kptr2->lock();
+       // Inflate so the displaced header becomes position-independent
+-      if (lock->displaced_header()->is_unlocked())
++      if (lock->displaced_header().is_unlocked())
+         ObjectSynchronizer::inflate_helper(kptr2->obj());
+       // Now the displaced header is free to move
+-      buf[i++] = (intptr_t)lock->displaced_header();
++      buf[i++] = (intptr_t)lock->displaced_header().value();
+       buf[i++] = cast_from_oop<intptr_t>(kptr2->obj());
+     }
+   }
+diff --git a/src/hotspot/share/runtime/synchronizer.cpp b/src/hotspot/share/runtime/synchronizer.cpp
+index e7b32723e..2da0b02e9 100644
+--- a/src/hotspot/share/runtime/synchronizer.cpp
++++ b/src/hotspot/share/runtime/synchronizer.cpp
+@@ -160,14 +160,14 @@ bool ObjectSynchronizer::quick_notify(oopDesc * obj, Thread * self, bool all) {
+   if (obj == NULL) return false;  // slow-path for invalid obj
+   const markOop mark = obj->mark();
+ 
+-  if (mark->has_locker() && self->is_lock_owned((address)mark->locker())) {
++  if (mark.has_locker() && self->is_lock_owned((address)mark.locker())) {
+     // Degenerate notify
+     // stack-locked by caller so by definition the implied waitset is empty.
+     return true;
+   }
+ 
+-  if (mark->has_monitor()) {
+-    ObjectMonitor * const mon = mark->monitor();
++  if (mark.has_monitor()) {
++    ObjectMonitor * const mon = mark.monitor();
+     assert(mon->object() == obj, "invariant");
+     if (mon->owner() != self) return false;  // slow-path for IMS exception
+ 
+@@ -210,8 +210,8 @@ bool ObjectSynchronizer::quick_enter(oop obj, Thread * Self,
+   if (obj == NULL) return false;       // Need to throw NPE
+   const markOop mark = obj->mark();
+ 
+-  if (mark->has_monitor()) {
+-    ObjectMonitor * const m = mark->monitor();
++  if (mark.has_monitor()) {
++    ObjectMonitor * const m = mark.monitor();
+     assert(m->object() == obj, "invariant");
+     Thread * const owner = (Thread *) m->_owner;
+ 
+@@ -273,7 +273,7 @@ void ObjectSynchronizer::fast_enter(Handle obj, BasicLock* lock,
+       assert(!attempt_rebias, "can not rebias toward VM thread");
+       BiasedLocking::revoke_at_safepoint(obj);
+     }
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   slow_enter(obj, lock, THREAD);
+@@ -283,10 +283,10 @@ void ObjectSynchronizer::fast_exit(oop object, BasicLock* lock, TRAPS) {
+   markOop mark = object->mark();
+   // We cannot check for Biased Locking if we are racing an inflation.
+   assert(mark == markOopDesc::INFLATING() ||
+-         !mark->has_bias_pattern(), "should not see bias pattern here");
++         !mark.has_bias_pattern(), "should not see bias pattern here");
+ 
+   markOop dhw = lock->displaced_header();
+-  if (dhw == NULL) {
++  if (dhw.value() == 0) {
+     // If the displaced header is NULL, then this exit matches up with
+     // a recursive enter. No real work to do here except for diagnostics.
+ #ifndef PRODUCT
+@@ -294,10 +294,10 @@ void ObjectSynchronizer::fast_exit(oop object, BasicLock* lock, TRAPS) {
+       // Only do diagnostics if we are not racing an inflation. Simply
+       // exiting a recursive enter of a Java Monitor that is being
+       // inflated is safe; see the has_monitor() comment below.
+-      assert(!mark->is_neutral(), "invariant");
+-      assert(!mark->has_locker() ||
+-             THREAD->is_lock_owned((address)mark->locker()), "invariant");
+-      if (mark->has_monitor()) {
++      assert(!mark.is_neutral(), "invariant");
++      assert(!mark.has_locker() ||
++             THREAD->is_lock_owned((address)mark.locker()), "invariant");
++      if (mark.has_monitor()) {
+         // The BasicLock's displaced_header is marked as a recursive
+         // enter and we have an inflated Java Monitor (ObjectMonitor).
+         // This is a special case where the Java Monitor was inflated
+@@ -306,7 +306,7 @@ void ObjectSynchronizer::fast_exit(oop object, BasicLock* lock, TRAPS) {
+         // Monitor owner's stack and update the BasicLocks because a
+         // Java Monitor can be asynchronously inflated by a thread that
+         // does not own the Java Monitor.
+-        ObjectMonitor * m = mark->monitor();
++        ObjectMonitor * m = mark.monitor();
+         assert(((oop)(m->object()))->mark() == mark, "invariant");
+         assert(m->is_entered(THREAD), "invariant");
+       }
+@@ -315,10 +315,10 @@ void ObjectSynchronizer::fast_exit(oop object, BasicLock* lock, TRAPS) {
+     return;
+   }
+ 
+-  if (mark == (markOop) lock) {
++  if (mark == markOop::from_pointer(lock)) {
+     // If the object is stack-locked by the current thread, try to
+     // swing the displaced header from the BasicLock back to the mark.
+-    assert(dhw->is_neutral(), "invariant");
++    assert(dhw.is_neutral(), "invariant");
+     if (object->cas_set_mark(dhw, mark) == mark) {
+       TEVENT(fast_exit: release stack-lock);
+       return;
+@@ -338,22 +338,22 @@ void ObjectSynchronizer::fast_exit(oop object, BasicLock* lock, TRAPS) {
+ // failed in the interpreter/compiler code.
+ void ObjectSynchronizer::slow_enter(Handle obj, BasicLock* lock, TRAPS) {
+   markOop mark = obj->mark();
+-  assert(!mark->has_bias_pattern(), "should not see bias pattern here");
++  assert(!mark.has_bias_pattern(), "should not see bias pattern here");
+ 
+-  if (mark->is_neutral()) {
++  if (mark.is_neutral()) {
+     // Anticipate successful CAS -- the ST of the displaced mark must
+     // be visible <= the ST performed by the CAS.
+     lock->set_displaced_header(mark);
+-    if (mark == obj()->cas_set_mark((markOop) lock, mark)) {
++    if (mark == obj()->cas_set_mark(markOop::from_pointer(lock), mark)) {
+       TEVENT(slow_enter: release stacklock);
+       return;
+     }
+     // Fall through to inflate() ...
+-  } else if (mark->has_locker() &&
+-             THREAD->is_lock_owned((address)mark->locker())) {
+-    assert(lock != mark->locker(), "must not re-lock the same lock");
+-    assert(lock != (BasicLock*)obj->mark(), "don't relock with same BasicLock");
+-    lock->set_displaced_header(NULL);
++  } else if (mark.has_locker() &&
++             THREAD->is_lock_owned((address)mark.locker())) {
++    assert(lock != mark.locker(), "must not re-lock the same lock");
++    assert(lock != (BasicLock*)obj->mark().value(), "don't relock with same BasicLock");
++    lock->set_displaced_header(markOop::from_pointer(NULL));
+     return;
+   }
+ 
+@@ -391,7 +391,7 @@ intptr_t ObjectSynchronizer::complete_exit(Handle obj, TRAPS) {
+   TEVENT(complete_exit);
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   ObjectMonitor* monitor = ObjectSynchronizer::inflate(THREAD,
+@@ -406,7 +406,7 @@ void ObjectSynchronizer::reenter(Handle obj, intptr_t recursion, TRAPS) {
+   TEVENT(reenter);
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   ObjectMonitor* monitor = ObjectSynchronizer::inflate(THREAD,
+@@ -423,7 +423,7 @@ void ObjectSynchronizer::jni_enter(Handle obj, TRAPS) {
+   TEVENT(jni_enter);
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+   THREAD->set_current_pending_monitor_is_from_java(false);
+   ObjectSynchronizer::inflate(THREAD, obj(), inflate_cause_jni_enter)->enter(THREAD);
+@@ -438,7 +438,7 @@ void ObjectSynchronizer::jni_exit(oop obj, Thread* THREAD) {
+     BiasedLocking::revoke_and_rebias(h_obj, false, THREAD);
+     obj = h_obj();
+   }
+-  assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++  assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+ 
+   ObjectMonitor* monitor = ObjectSynchronizer::inflate(THREAD,
+                                                        obj,
+@@ -479,7 +479,7 @@ ObjectLocker::~ObjectLocker() {
+ int ObjectSynchronizer::wait(Handle obj, jlong millis, TRAPS) {
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+   if (millis < 0) {
+     TEVENT(wait - throw IAX);
+@@ -502,7 +502,7 @@ int ObjectSynchronizer::wait(Handle obj, jlong millis, TRAPS) {
+ void ObjectSynchronizer::waitUninterruptibly(Handle obj, jlong millis, TRAPS) {
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+   if (millis < 0) {
+     TEVENT(wait - throw IAX);
+@@ -516,11 +516,11 @@ void ObjectSynchronizer::waitUninterruptibly(Handle obj, jlong millis, TRAPS) {
+ void ObjectSynchronizer::notify(Handle obj, TRAPS) {
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   markOop mark = obj->mark();
+-  if (mark->has_locker() && THREAD->is_lock_owned((address)mark->locker())) {
++  if (mark.has_locker() && THREAD->is_lock_owned((address)mark.locker())) {
+     return;
+   }
+   ObjectSynchronizer::inflate(THREAD,
+@@ -532,11 +532,11 @@ void ObjectSynchronizer::notify(Handle obj, TRAPS) {
+ void ObjectSynchronizer::notifyall(Handle obj, TRAPS) {
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   markOop mark = obj->mark();
+-  if (mark->has_locker() && THREAD->is_lock_owned((address)mark->locker())) {
++  if (mark.has_locker() && THREAD->is_lock_owned((address)mark.locker())) {
+     return;
+   }
+   ObjectSynchronizer::inflate(THREAD,
+@@ -583,14 +583,14 @@ static volatile int ForceMonitorScavenge = 0; // Scavenge required and pending
+ 
+ static markOop ReadStableMark(oop obj) {
+   markOop mark = obj->mark();
+-  if (!mark->is_being_inflated()) {
++  if (!mark.is_being_inflated()) {
+     return mark;       // normal fast-path return
+   }
+ 
+   int its = 0;
+   for (;;) {
+     markOop mark = obj->mark();
+-    if (!mark->is_being_inflated()) {
++    if (!mark.is_being_inflated()) {
+       return mark;    // normal fast-path return
+     }
+ 
+@@ -716,7 +716,7 @@ intptr_t ObjectSynchronizer::FastHashCode(Thread * Self, oop obj) {
+     // been checked to make sure they can handle a safepoint. The
+     // added check of the bias pattern is to avoid useless calls to
+     // thread-local storage.
+-    if (obj->mark()->has_bias_pattern()) {
++    if (obj->mark().has_bias_pattern()) {
+       // Handle for oop obj in case of STW safepoint
+       Handle hobj(Self, obj);
+       // Relaxing assertion for bug 6320749.
+@@ -725,7 +725,7 @@ intptr_t ObjectSynchronizer::FastHashCode(Thread * Self, oop obj) {
+              "biases should not be seen by VM thread here");
+       BiasedLocking::revoke_and_rebias(hobj, false, JavaThread::current());
+       obj = hobj();
+-      assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++      assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+     }
+   }
+ 
+@@ -744,15 +744,15 @@ intptr_t ObjectSynchronizer::FastHashCode(Thread * Self, oop obj) {
+   markOop mark = ReadStableMark(obj);
+ 
+   // object should remain ineligible for biased locking
+-  assert(!mark->has_bias_pattern(), "invariant");
++  assert(!mark.has_bias_pattern(), "invariant");
+ 
+-  if (mark->is_neutral()) {
+-    hash = mark->hash();              // this is a normal header
++  if (mark.is_neutral()) {
++    hash = mark.hash();              // this is a normal header
+     if (hash) {                       // if it has hash, just return it
+       return hash;
+     }
+     hash = get_next_hash(Self, obj);  // allocate a new hash code
+-    temp = mark->copy_set_hash(hash); // merge the hash code into header
++    temp = mark.copy_set_hash(hash); // merge the hash code into header
+     // use (machine word version) atomic operation to install the hash
+     test = obj->cas_set_mark(temp, mark);
+     if (test == mark) {
+@@ -761,19 +761,19 @@ intptr_t ObjectSynchronizer::FastHashCode(Thread * Self, oop obj) {
+     // If atomic operation failed, we must inflate the header
+     // into heavy weight monitor. We could add more code here
+     // for fast path, but it does not worth the complexity.
+-  } else if (mark->has_monitor()) {
+-    monitor = mark->monitor();
++  } else if (mark.has_monitor()) {
++    monitor = mark.monitor();
+     temp = monitor->header();
+-    assert(temp->is_neutral(), "invariant");
+-    hash = temp->hash();
++    assert(temp.is_neutral(), "invariant");
++    hash = temp.hash();
+     if (hash) {
+       return hash;
+     }
+     // Skip to the following code to reduce code size
+-  } else if (Self->is_lock_owned((address)mark->locker())) {
+-    temp = mark->displaced_mark_helper(); // this is a lightweight monitor owned
+-    assert(temp->is_neutral(), "invariant");
+-    hash = temp->hash();              // by current thread, check if the displaced
++  } else if (Self->is_lock_owned((address)mark.locker())) {
++    temp = mark.displaced_mark_helper(); // this is a lightweight monitor owned
++    assert(temp.is_neutral(), "invariant");
++    hash = temp.hash();              // by current thread, check if the displaced
+     if (hash) {                       // header contains hash code
+       return hash;
+     }
+@@ -792,19 +792,20 @@ intptr_t ObjectSynchronizer::FastHashCode(Thread * Self, oop obj) {
+   monitor = ObjectSynchronizer::inflate(Self, obj, inflate_cause_hash_code);
+   // Load displaced header and check it has hash code
+   mark = monitor->header();
+-  assert(mark->is_neutral(), "invariant");
+-  hash = mark->hash();
++  assert(mark.is_neutral(), "invariant");
++  hash = mark.hash();
+   if (hash == 0) {
+     hash = get_next_hash(Self, obj);
+-    temp = mark->copy_set_hash(hash); // merge hash code into header
+-    assert(temp->is_neutral(), "invariant");
+-    test = Atomic::cmpxchg(temp, monitor->header_addr(), mark);
++    temp = mark.copy_set_hash(hash); // merge hash code into header
++    assert(temp.is_neutral(), "invariant");
++    uintptr_t t = Atomic::cmpxchg(temp.value(), (volatile uintptr_t*)monitor->header_addr(), mark.value());
++    test = markOop(t);
+     if (test != mark) {
+       // The only update to the header in the monitor (outside GC)
+       // is install the hash code. If someone add new usage of
+       // displaced header, please update this code
+-      hash = test->hash();
+-      assert(test->is_neutral(), "invariant");
++      hash = test.hash();
++      assert(test.is_neutral(), "invariant");
+       assert(hash != 0, "Trivial unexpected object/monitor header usage.");
+     }
+   }
+@@ -823,7 +824,7 @@ bool ObjectSynchronizer::current_thread_holds_lock(JavaThread* thread,
+                                                    Handle h_obj) {
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(h_obj, false, thread);
+-    assert(!h_obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!h_obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   assert(thread == JavaThread::current(), "Can only be called on current thread");
+@@ -832,16 +833,16 @@ bool ObjectSynchronizer::current_thread_holds_lock(JavaThread* thread,
+   markOop mark = ReadStableMark(obj);
+ 
+   // Uncontended case, header points to stack
+-  if (mark->has_locker()) {
+-    return thread->is_lock_owned((address)mark->locker());
++  if (mark.has_locker()) {
++    return thread->is_lock_owned((address)mark.locker());
+   }
+   // Contended case, header points to ObjectMonitor (tagged pointer)
+-  if (mark->has_monitor()) {
+-    ObjectMonitor* monitor = mark->monitor();
++  if (mark.has_monitor()) {
++    ObjectMonitor* monitor = mark.monitor();
+     return monitor->is_entered(thread) != 0;
+   }
+   // Unlocked case, header in place
+-  assert(mark->is_neutral(), "sanity check");
++  assert(mark.is_neutral(), "sanity check");
+   return false;
+ }
+ 
+@@ -859,10 +860,10 @@ ObjectSynchronizer::LockOwnership ObjectSynchronizer::query_lock_ownership
+ 
+   // Possible mark states: neutral, biased, stack-locked, inflated
+ 
+-  if (UseBiasedLocking && h_obj()->mark()->has_bias_pattern()) {
++  if (UseBiasedLocking && h_obj()->mark().has_bias_pattern()) {
+     // CASE: biased
+     BiasedLocking::revoke_and_rebias(h_obj, false, self);
+-    assert(!h_obj->mark()->has_bias_pattern(),
++    assert(!h_obj->mark().has_bias_pattern(),
+            "biases should be revoked by now");
+   }
+ 
+@@ -871,23 +872,23 @@ ObjectSynchronizer::LockOwnership ObjectSynchronizer::query_lock_ownership
+   markOop mark = ReadStableMark(obj);
+ 
+   // CASE: stack-locked.  Mark points to a BasicLock on the owner's stack.
+-  if (mark->has_locker()) {
+-    return self->is_lock_owned((address)mark->locker()) ?
++  if (mark.has_locker()) {
++    return self->is_lock_owned((address)mark.locker()) ?
+       owner_self : owner_other;
+   }
+ 
+   // CASE: inflated. Mark (tagged pointer) points to an objectMonitor.
+   // The Object:ObjectMonitor relationship is stable as long as we're
+   // not at a safepoint.
+-  if (mark->has_monitor()) {
+-    void * owner = mark->monitor()->_owner;
++  if (mark.has_monitor()) {
++    void * owner = mark.monitor()->_owner;
+     if (owner == NULL) return owner_none;
+     return (owner == self ||
+             self->is_lock_owned((address)owner)) ? owner_self : owner_other;
+   }
+ 
+   // CASE: neutral
+-  assert(mark->is_neutral(), "sanity check");
++  assert(mark.is_neutral(), "sanity check");
+   return owner_none;           // it's unlocked
+ }
+ 
+@@ -899,7 +900,7 @@ JavaThread* ObjectSynchronizer::get_lock_owner(ThreadsList * t_list, Handle h_ob
+     } else {
+       BiasedLocking::revoke_and_rebias(h_obj, false, JavaThread::current());
+     }
+-    assert(!h_obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!h_obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   oop obj = h_obj();
+@@ -908,13 +909,13 @@ JavaThread* ObjectSynchronizer::get_lock_owner(ThreadsList * t_list, Handle h_ob
+   markOop mark = ReadStableMark(obj);
+ 
+   // Uncontended case, header points to stack
+-  if (mark->has_locker()) {
+-    owner = (address) mark->locker();
++  if (mark.has_locker()) {
++    owner = (address) mark.locker();
+   }
+ 
+   // Contended case, header points to ObjectMonitor (tagged pointer)
+-  if (mark->has_monitor()) {
+-    ObjectMonitor* monitor = mark->monitor();
++  if (mark.has_monitor()) {
++    ObjectMonitor* monitor = mark.monitor();
+     assert(monitor != NULL, "monitor should be non-null");
+     owner = (address) monitor->owner();
+   }
+@@ -927,7 +928,7 @@ JavaThread* ObjectSynchronizer::get_lock_owner(ThreadsList * t_list, Handle h_ob
+   // Unlocked case, header in place
+   // Cannot have assertion since this object may have been
+   // locked by another thread when reaching here.
+-  // assert(mark->is_neutral(), "sanity check");
++  // assert(mark.is_neutral(), "sanity check");
+ 
+   return NULL;
+ }
+@@ -1374,10 +1375,10 @@ static void post_monitor_inflate_event(EventJavaMonitorInflate* event,
+ // Fast path code shared by multiple functions
+ ObjectMonitor* ObjectSynchronizer::inflate_helper(oop obj) {
+   markOop mark = obj->mark();
+-  if (mark->has_monitor()) {
+-    assert(ObjectSynchronizer::verify_objmon_isinpool(mark->monitor()), "monitor is invalid");
+-    assert(mark->monitor()->header()->is_neutral(), "monitor must record a good object header");
+-    return mark->monitor();
++  if (mark.has_monitor()) {
++    assert(ObjectSynchronizer::verify_objmon_isinpool(mark.monitor()), "monitor is invalid");
++    assert(mark.monitor()->header().is_neutral(), "monitor must record a good object header");
++    return mark.monitor();
+   }
+   return ObjectSynchronizer::inflate(Thread::current(),
+                                      obj,
+@@ -1397,7 +1398,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+ 
+   for (;;) {
+     const markOop mark = object->mark();
+-    assert(!mark->has_bias_pattern(), "invariant");
++    assert(!mark.has_bias_pattern(), "invariant");
+ 
+     // The mark can be in one of the following states:
+     // *  Inflated     - just return
+@@ -1407,9 +1408,9 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+     // *  BIASED       - Illegal.  We should never see this
+ 
+     // CASE: inflated
+-    if (mark->has_monitor()) {
+-      ObjectMonitor * inf = mark->monitor();
+-      assert(inf->header()->is_neutral(), "invariant");
++    if (mark.has_monitor()) {
++      ObjectMonitor * inf = mark.monitor();
++      assert(inf->header().is_neutral(), "invariant");
+       assert(inf->object() == object, "invariant");
+       assert(ObjectSynchronizer::verify_objmon_isinpool(inf), "monitor is invalid");
+       return inf;
+@@ -1446,7 +1447,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+     // before or after the CAS(INFLATING) operation.
+     // See the comments in omAlloc().
+ 
+-    if (mark->has_locker()) {
++    if (mark.has_locker()) {
+       ObjectMonitor * m = omAlloc(Self);
+       // Optimistically prepare the objectmonitor - anticipate successful CAS
+       // We do this before the CAS in order to minimize the length of time
+@@ -1484,7 +1485,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+       // drop the lock (restoring the header from the basiclock to the object)
+       // while inflation is in-progress.  This protocol avoids races that might
+       // would otherwise permit hashCode values to change or "flicker" for an object.
+-      // Critically, while object->mark is 0 mark->displaced_mark_helper() is stable.
++      // Critically, while object->mark is 0 mark.displaced_mark_helper() is stable.
+       // 0 serves as a "BUSY" inflate-in-progress indicator.
+ 
+ 
+@@ -1492,18 +1493,18 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+       // The owner can't die or unwind past the lock while our INFLATING
+       // object is in the mark.  Furthermore the owner can't complete
+       // an unlock on the object, either.
+-      markOop dmw = mark->displaced_mark_helper();
+-      assert(dmw->is_neutral(), "invariant");
++      markOop dmw = mark.displaced_mark_helper();
++      assert(dmw.is_neutral(), "invariant");
+ 
+       // Setup monitor fields to proper values -- prepare the monitor
+       m->set_header(dmw);
+ 
+-      // Optimization: if the mark->locker stack address is associated
++      // Optimization: if the mark.locker stack address is associated
+       // with this thread we could simply set m->_owner = Self.
+       // Note that a thread can inflate an object
+       // that it has stack-locked -- as might happen in wait() -- directly
+       // with CAS.  That is, we can avoid the xchg-NULL .... ST idiom.
+-      m->set_owner(mark->locker());
++      m->set_owner(mark.locker());
+       m->set_object(object);
+       // TODO-FIXME: assert BasicLock->dhw != 0.
+ 
+@@ -1520,7 +1521,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+         if (object->is_instance()) {
+           ResourceMark rm;
+           log_debug(monitorinflation)("Inflating object " INTPTR_FORMAT " , mark " INTPTR_FORMAT " , type %s",
+-                                      p2i(object), p2i(object->mark()),
++                                      p2i(object), object->mark().value(),
+                                       object->klass()->external_name());
+         }
+       }
+@@ -1540,7 +1541,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+     // An inflateTry() method that we could call from fast_enter() and slow_enter()
+     // would be useful.
+ 
+-    assert(mark->is_neutral(), "invariant");
++    assert(mark.is_neutral(), "invariant");
+     ObjectMonitor * m = omAlloc(Self);
+     // prepare m for installation - set monitor to initial state
+     m->Recycle();
+@@ -1571,7 +1572,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+       if (object->is_instance()) {
+         ResourceMark rm;
+         log_debug(monitorinflation)("Inflating object " INTPTR_FORMAT " , mark " INTPTR_FORMAT " , type %s",
+-                                    p2i(object), p2i(object->mark()),
++                                    p2i(object), object->mark().value(),
+                                     object->klass()->external_name());
+       }
+     }
+@@ -1623,8 +1624,8 @@ bool ObjectSynchronizer::deflate_monitor(ObjectMonitor* mid, oop obj,
+   bool deflated;
+   // Normal case ... The monitor is associated with obj.
+   guarantee(obj->mark() == markOopDesc::encode(mid), "invariant");
+-  guarantee(mid == obj->mark()->monitor(), "invariant");
+-  guarantee(mid->header()->is_neutral(), "invariant");
++  guarantee(mid == obj->mark().monitor(), "invariant");
++  guarantee(mid->header().is_neutral(), "invariant");
+ 
+   if (mid->is_busy()) {
+     if (ClearResponsibleAtSTW) mid->_Responsible = NULL;
+@@ -1639,7 +1640,7 @@ bool ObjectSynchronizer::deflate_monitor(ObjectMonitor* mid, oop obj,
+         ResourceMark rm;
+         log_debug(monitorinflation)("Deflating object " INTPTR_FORMAT " , "
+                                     "mark " INTPTR_FORMAT " , type %s",
+-                                    p2i(obj), p2i(obj->mark()),
++                                    p2i(obj), obj->mark().value(),
+                                     obj->klass()->external_name());
+       }
+     }
+diff --git a/src/hotspot/share/runtime/vframe.cpp b/src/hotspot/share/runtime/vframe.cpp
+index cca364217..7dfb2e4a2 100644
+--- a/src/hotspot/share/runtime/vframe.cpp
++++ b/src/hotspot/share/runtime/vframe.cpp
+@@ -222,7 +222,7 @@ void javaVFrame::print_lock_info_on(outputStream* st, int frame_count) {
+       if (monitor->owner() != NULL) {
+         // the monitor is associated with an object, i.e., it is locked
+ 
+-        markOop mark = NULL;
++        markOop mark = markOop::zero();
+         const char *lock_state = "locked"; // assume we have the monitor locked
+         if (!found_first_monitor && frame_count == 0) {
+           // If this is the first frame and we haven't found an owned
+@@ -231,17 +231,17 @@ void javaVFrame::print_lock_info_on(outputStream* st, int frame_count) {
+           // an inflated monitor that is first on the monitor list in
+           // the first frame can block us on a monitor enter.
+           mark = monitor->owner()->mark();
+-          if (mark->has_monitor() &&
++          if (mark.has_monitor() &&
+               ( // we have marked ourself as pending on this monitor
+-                mark->monitor() == thread()->current_pending_monitor() ||
++                mark.monitor() == thread()->current_pending_monitor() ||
+                 // we are not the owner of this monitor
+-                !mark->monitor()->is_entered(thread())
++                !mark.monitor()->is_entered(thread())
+               )) {
+             lock_state = "waiting to lock";
+           } else {
+             // We own the monitor which is not as interesting so
+             // disable the extra printing below.
+-            mark = NULL;
++            mark = markOop::zero();
+           }
+         } else if (frame_count != 0) {
+           // This is not the first frame so we either own this monitor
+@@ -250,23 +250,23 @@ void javaVFrame::print_lock_info_on(outputStream* st, int frame_count) {
+           // numbered frame on the stack, we have to check all the
+           // monitors on the list for this frame.
+           mark = monitor->owner()->mark();
+-          if (mark->has_monitor() &&
++          if (mark.has_monitor() &&
+               ( // we have marked ourself as pending on this monitor
+-                mark->monitor() == thread()->current_pending_monitor() ||
++                mark.monitor() == thread()->current_pending_monitor() ||
+                 // we are not the owner of this monitor
+-                !mark->monitor()->is_entered(thread())
++                !mark.monitor()->is_entered(thread())
+               )) {
+             lock_state = "waiting to re-lock in wait()";
+           } else {
+             // We own the monitor which is not as interesting so
+             // disable the extra printing below.
+-            mark = NULL;
++            mark = markOop::zero();
+           }
+         }
+         print_locked_object_class_name(st, Handle(THREAD, monitor->owner()), lock_state);
+-        if (ObjectMonitor::Knob_Verbose && mark != NULL) {
++        if (ObjectMonitor::Knob_Verbose && mark.to_pointer() != NULL) {
+           st->print("\t- lockbits=");
+-          mark->print_on(st);
++          mark.print_on(st);
+           st->cr();
+         }
+ 
+diff --git a/src/hotspot/share/runtime/vmStructs.cpp b/src/hotspot/share/runtime/vmStructs.cpp
+index adce6da6a..b161a6ec1 100644
+--- a/src/hotspot/share/runtime/vmStructs.cpp
++++ b/src/hotspot/share/runtime/vmStructs.cpp
+@@ -1285,7 +1285,6 @@ typedef PaddedEnd<ObjectMonitor>              PaddedObjectMonitor;
+     declare_type(arrayOopDesc, oopDesc)                                   \
+       declare_type(objArrayOopDesc, arrayOopDesc)                         \
+     declare_type(instanceOopDesc, oopDesc)                                \
+-    declare_type(markOopDesc, oopDesc)                                    \
+                                                                           \
+   /**************************************************/                    \
+   /* MetadataOopDesc hierarchy (NOTE: some missing) */                    \
+@@ -1325,7 +1324,6 @@ typedef PaddedEnd<ObjectMonitor>              PaddedObjectMonitor;
+   /* Oops */                                                              \
+   /********/                                                              \
+                                                                           \
+-  declare_oop_type(markOop)                                               \
+   declare_oop_type(objArrayOop)                                           \
+   declare_oop_type(oop)                                                   \
+   declare_oop_type(narrowOop)                                             \
+@@ -1983,6 +1981,8 @@ typedef PaddedEnd<ObjectMonitor>              PaddedObjectMonitor;
+             declare_type(BitMapView, BitMap)                              \
+                                                                           \
+    declare_integer_type(AccessFlags)  /* FIXME: wrong type (not integer) */\
++   declare_integer_type(markOop)                                          \
++   declare_type(markOopDesc, markOop)                                    \
+   declare_toplevel_type(address)      /* FIXME: should this be an integer type? */\
+    declare_integer_type(BasicType)   /* FIXME: wrong type (not integer) */\
+   JVMTI_ONLY(declare_toplevel_type(BreakpointInfo))                       \
+-- 
+2.54.0
+
diff --git a/pkgs/development/compilers/openjdk/generic.nix b/pkgs/development/compilers/openjdk/generic.nix
index 65bed061789e..7d123cb1fdf9 100644
--- a/pkgs/development/compilers/openjdk/generic.nix
+++ b/pkgs/development/compilers/openjdk/generic.nix
@@ -234,6 +234,9 @@ stdenv.mkDerivation (finalAttrs: {
       else
         ./8/patches/swing-use-gtk-jdk8.patch
     )
+  ]
+  ++ lib.optionals (featureVersion == "11") [
+    ./11/patches/fix-oopdesc-ptr-alignment-ub.patch
   ];
 
   strictDeps = true;

From a9202f95da1269a79f7466687881c3f2d76de2f8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 22 Jun 2026 23:05:13 +0200
Subject: [PATCH 35/83] nixos/test/php: migrate to nspawn, modernize

They boot up quicker now, which is why the curl needs a retry mechanism.

Also uses proper unittest asserts, which provide good feedback on error.
---
 nixos/tests/php/fpm-modular.nix | 8 ++++----
 nixos/tests/php/fpm.nix         | 8 ++++----
 nixos/tests/php/httpd.nix       | 8 ++++----
 nixos/tests/php/pcre.nix        | 9 +++++----
 4 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/nixos/tests/php/fpm-modular.nix b/nixos/tests/php/fpm-modular.nix
index 360e664963cf..443594673e13 100644
--- a/nixos/tests/php/fpm-modular.nix
+++ b/nixos/tests/php/fpm-modular.nix
@@ -7,7 +7,7 @@
     aanderse
   ];
 
-  nodes.machine =
+  containers.machine =
     { config, pkgs, ... }:
     {
       environment.systemPackages = [ php ];
@@ -56,14 +56,14 @@
       };
     };
   testScript =
-    { ... }:
+    # python
     ''
       machine.wait_for_unit("nginx.service")
       machine.wait_for_unit("php-fpm.service")
 
       # Check so we get an evaluated PHP back
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/")
-      assert "PHP Version ${php.version}" in response, "PHP version not detected"
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
+      t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")
 
       # Check so we have database and some other extensions loaded
       for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite", "apcu"]:
diff --git a/nixos/tests/php/fpm.nix b/nixos/tests/php/fpm.nix
index 21336ade042b..cb128df26ebe 100644
--- a/nixos/tests/php/fpm.nix
+++ b/nixos/tests/php/fpm.nix
@@ -3,7 +3,7 @@
   name = "php-${php.version}-fpm-nginx-test";
   meta.maintainers = lib.teams.php.members;
 
-  nodes.machine =
+  containers.machine =
     { config, pkgs, ... }:
     {
       environment.systemPackages = [ php ];
@@ -47,14 +47,14 @@
       };
     };
   testScript =
-    { ... }:
+    # python
     ''
       machine.wait_for_unit("nginx.service")
       machine.wait_for_unit("phpfpm-foobar.service")
 
       # Check so we get an evaluated PHP back
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/")
-      assert "PHP Version ${php.version}" in response, "PHP version not detected"
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
+      t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")
 
       # Check so we have database and some other extensions loaded
       for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite", "apcu"]:
diff --git a/nixos/tests/php/httpd.nix b/nixos/tests/php/httpd.nix
index 9ee157a01096..36381c15509f 100644
--- a/nixos/tests/php/httpd.nix
+++ b/nixos/tests/php/httpd.nix
@@ -7,7 +7,7 @@
   name = "php-${php.version}-httpd-test";
   meta.maintainers = lib.teams.php.members;
 
-  nodes.machine =
+  containers.machine =
     {
       config,
       pkgs,
@@ -32,13 +32,13 @@
       };
     };
   testScript =
-    { ... }:
+    # python
     ''
       machine.wait_for_unit("httpd.service")
 
       # Check so we get an evaluated PHP back
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/")
-      assert "PHP Version ${php.version}" in response, "PHP version not detected"
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
+      t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")
 
       # Check so we have database and some other extensions loaded
       for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite"]:
diff --git a/nixos/tests/php/pcre.nix b/nixos/tests/php/pcre.nix
index e95ce76c7d7e..fb4c59e310da 100644
--- a/nixos/tests/php/pcre.nix
+++ b/nixos/tests/php/pcre.nix
@@ -11,7 +11,7 @@ in
   name = "php-${php.version}-httpd-pcre-jit-test";
   meta.maintainers = lib.teams.php.members;
 
-  nodes.machine =
+  containers.machine =
     { pkgs, ... }:
     {
       time.timeZone = "UTC";
@@ -50,12 +50,13 @@ in
         pcntl_wait($pid);
       '';
     in
+    # python
     ''
       machine.wait_for_unit("httpd.service")
       # Ensure php evaluation by matching on the var_dump syntax
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/index.php")
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/index.php")
       expected = 'string(${toString (builtins.stringLength testString)}) "${testString}"'
-      assert expected in response, "Does not appear to be able to use subgroups."
-      machine.succeed("${php}/bin/php -f ${pcreJitSeallocForkIssue}")
+      t.assertIn(expected, response, "Does not appear to be able to use subgroups.")
+      machine.succeed("${lib.getExe php} -f ${pcreJitSeallocForkIssue}")
     '';
 }

From bd036deae89eac166f6ba3372c57a349e90b27e1 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 22 Jun 2026 21:34:44 +0000
Subject: [PATCH 36/83] python3Packages.devito: 4.8.21 -> 4.8.22

Diff: https://github.com/devitocodes/devito/compare/v4.8.21...v4.8.22

Changelog: https://github.com/devitocodes/devito/releases/tag/v4.8.22
---
 pkgs/development/python-modules/devito/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/devito/default.nix b/pkgs/development/python-modules/devito/default.nix
index 06894f3f1dd5..5c22a8db1300 100644
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@@ -32,14 +32,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "devito";
-  version = "4.8.21";
+  version = "4.8.22";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "devitocodes";
     repo = "devito";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nD1bUFv24lnonajUG6m5yhGUAC0pVtSKTX69JwSt69E=";
+    hash = "sha256-7bHMMZKm+n+wSVGUSSoYQjXklxzdTeyCkjMuK0Z8qTI=";
   };
 
   patches = [

From 775bdd0467f3de2fb5017830d00fa1f573b2ecda Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 27 May 2026 17:15:33 +0000
Subject: [PATCH 37/83] mujoco: 3.8.1 -> 3.10.0

Diff: https://github.com/google-deepmind/mujoco/compare/3.8.1...3.10.0

Changelog: https://mujoco.readthedocs.io/en/3.10.0/changelog.html
---
 .../mujoco-system-deps-dont-fetch.patch       |  9 +++++
 pkgs/by-name/mu/mujoco/package.nix            | 34 +++++++++++++------
 .../python-modules/mujoco/default.nix         |  3 +-
 3 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch b/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
index 010c78da81c5..b6d360c0949f 100644
--- a/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
+++ b/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
@@ -84,6 +84,15 @@ index d2404bc1..5c7ddaf6 100644
    TARGETS
    ccd
    EXCLUDE_FROM_ALL
+@@ -256,8 +256,6 @@ set(BUILD_TESTS OFF)
+ set(BUILD_TESTS OFF)
+ fetchpackage(
+   PACKAGE_NAME  miniz
+-  GIT_REPO      https://github.com/richgel999/miniz.git
+-  GIT_TAG       ${MUJOCO_DEP_VERSION_miniz}
+   TARGETS       miniz
+ )
+ if(_BUILD_TESTS_WAS_DEFINED)
 @@ -261,10 +241,6 @@ if(MUJOCO_BUILD_TESTS OR MUJOCO_BUILD_STUDIO OR MUJOCO_USE_FILAMENT)
      absl
      LIBRARY_NAME
diff --git a/pkgs/by-name/mu/mujoco/package.nix b/pkgs/by-name/mu/mujoco/package.nix
index 6b2f93e71eae..b437d8e69259 100644
--- a/pkgs/by-name/mu/mujoco/package.nix
+++ b/pkgs/by-name/mu/mujoco/package.nix
@@ -20,14 +20,14 @@ let
     abseil-cpp = fetchFromGitHub {
       owner = "abseil";
       repo = "abseil-cpp";
-      rev = "255c84dadd029fd8ad25c5efb5933e47beaa00c7";
-      hash = "sha256-TJT2Kzc64zI42FAbbGWP3Sshh1dU/D/AtEpgZrrhebg=";
+      rev = "5650e9cf76d3be4318d5fa3af38ee483ddfd5e4a";
+      hash = "sha256-O9ClnGm4WSTX3g1Q2VYTMhUtGG52XBwxzgHtWW9WSG0=";
     };
     benchmark = fetchFromGitHub {
       owner = "google";
       repo = "benchmark";
-      rev = "5c55f5d4f45a1b09c5d98aa63a671993ebd42c69";
-      hash = "sha256-CChXn58cqam3d6Q61ZJMr5NFq1Ezc5uywA7FSPhk4GI=";
+      rev = "834a61fc65e8b7885fcf177f1230ae4b897118fa";
+      hash = "sha256-V5pVCG5QdFlgBIVKMv4jyTTB22BWfTHD3HolVPDFpgQ=";
     };
     ccd = fetchFromGitHub {
       owner = "danfis";
@@ -38,8 +38,8 @@ let
     eigen3 = fetchFromGitLab {
       owner = "libeigen";
       repo = "eigen";
-      rev = "75bcd155c40cb48e647c87c3f29052360255bc9e";
-      hash = "sha256-ZBm3ac6Kt7gOqNip6PeNNMiOF0fwG+7PJYA47KT0ogI=";
+      rev = "ea13a98decd497a8c5588fb5de71b57bcf10d864";
+      hash = "sha256-v9bNWc9yfK3vG8hYhQ7vkc7DHaoPF6RAKfX9kC0Gw8c=";
     };
     googletest = fetchFromGitHub {
       owner = "google";
@@ -53,11 +53,17 @@ let
       rev = "17d08dd26cac4d63f43af217ebd70318bfb8189c";
       hash = "sha256-vnw52G0lY68471dzH7NXc++bTbLRsITSxGYXOTicA5w=";
     };
+    miniz = fetchFromGitHub {
+      owner = "richgel999";
+      repo = "miniz";
+      rev = "d10b03cc73475af673df40f06e5cefd1d5f940d9";
+      hash = "sha256-hRB/0TVVQjr4VwjozfRnYKUJfeqO+1PNfdvP/rrOCR4=";
+    };
     qhull = fetchFromGitHub {
       owner = "qhull";
       repo = "qhull";
-      rev = "62ccc56af071eaa478bef6ed41fd7a55d3bb2d80";
-      hash = "sha256-kIxHtE0L/axV9WKnQzyFN0mxoIFAI33Z+MP0P/MtQPw=";
+      rev = "d1c2fc0caa5f644f3a0f220290d4a868c68ed4f6";
+      hash = "sha256-enwzl4td3lgYwQ4PXfcONKQrxChnJcvf8ehnJ6vf0yg=";
     };
     tinyobjloader = fetchFromGitHub {
       owner = "tinyobjloader";
@@ -82,7 +88,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mujoco";
-  version = "3.8.1";
+  version = "3.10.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -93,7 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "google-deepmind";
     repo = "mujoco";
     tag = finalAttrs.version;
-    hash = "sha256-eoZblIIH+tUNKPdVERGh1dE0KoWwMpP0LA6FgcJCiNU=";
+    hash = "sha256-wNsTTq5z+wKE0rSw2cyY1tJxP5i7LGu05DR7KfZEBtE=";
   };
 
   patches = [
@@ -128,9 +134,14 @@ stdenv.mkDerivation (finalAttrs: {
   # Move things into place so that cmake doesn't try downloading dependencies.
   preConfigure = ''
     mkdir -p build/_deps
-    ln -s ${pin.abseil-cpp} build/_deps/abseil-cpp-src
     ln -s ${pin.benchmark} build/_deps/benchmark-src
   ''
+  # mujoco applies a patch on top of abseil-cpp's sources
+  # https://github.com/google-deepmind/mujoco/blob/3.10.0/cmake/MujocoDependencies.cmake#L299-L300
+  + ''
+    cp -r ${pin.abseil-cpp} build/_deps/abseil-cpp-src
+    chmod -R +w build/_deps/abseil-cpp-src
+  ''
   # cccd is patched by mujoco's cmake and thus needs to be writable
   # https://github.com/google-deepmind/mujoco/blob/3.4.0/cmake/MujocoDependencies.cmake#L232-L235
   + ''
@@ -141,6 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${pin.eigen3} build/_deps/eigen3-src
     ln -s ${pin.googletest} build/_deps/googletest-src
     ln -s ${pin.lodepng} build/_deps/lodepng-src
+    ln -s ${pin.miniz} build/_deps/miniz-src
   ''
   # qhull is patched by mujoco's cmake and thus needs to be writable
   # https://github.com/google-deepmind/mujoco/blob/3.4.0/cmake/MujocoDependencies.cmake#L132-L135
diff --git a/pkgs/development/python-modules/mujoco/default.nix b/pkgs/development/python-modules/mujoco/default.nix
index bd51f0d85688..5215b66c0e62 100644
--- a/pkgs/development/python-modules/mujoco/default.nix
+++ b/pkgs/development/python-modules/mujoco/default.nix
@@ -31,6 +31,7 @@ buildPythonPackage (finalAttrs: {
   inherit (mujoco) version;
 
   pyproject = true;
+  __structuredAttrs = true;
 
   # We do not fetch from the repository because the PyPi tarball is
   # impurely build via
@@ -38,7 +39,7 @@ buildPythonPackage (finalAttrs: {
   # in the project's CI.
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-AZoLNAaJK8mEVOr1XL0n+F0Wd1iteF93xgimHzo0rRc=";
+    hash = "sha256-yejV2H2CIE7VvMyH2EPApT51qvOB3ik47EbQTxrG4k4=";
   };
 
   nativeBuildInputs = [ cmake ];

From b5ab03f4c5ac260aab5c9a13c9faae4479cfdb8d Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 22 Jun 2026 21:32:24 +0000
Subject: [PATCH 38/83] python3Packages.dm-control: 1.0.41 -> 1.0.43

Diff: https://github.com/google-deepmind/dm_control/compare/1.0.41...1.0.43

Changelog: https://github.com/google-deepmind/dm_control/releases/tag/1.0.43
---
 pkgs/development/python-modules/dm-control/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dm-control/default.nix b/pkgs/development/python-modules/dm-control/default.nix
index 44b9ab7d99ba..04f99e7767d1 100644
--- a/pkgs/development/python-modules/dm-control/default.nix
+++ b/pkgs/development/python-modules/dm-control/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "dm-control";
-  version = "1.0.41";
+  version = "1.0.43";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -37,7 +37,7 @@ buildPythonPackage (finalAttrs: {
     owner = "google-deepmind";
     repo = "dm_control";
     tag = finalAttrs.version;
-    hash = "sha256-AxyxI9sRF822oNLk/zVUnGVRGSQ3BHCBQJ9HtD8aL/M=";
+    hash = "sha256-6c67sOcKsygtjdn3NOjfK0K3IsZIOZHDMXr5qMp+W5A=";
   };
 
   build-system = [

From a1fac10c75130834155ecb96d89900391504e2bb Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 22 Jun 2026 22:26:49 +0000
Subject: [PATCH 39/83] python3Packages.brax: fix mujoco incompatibility

---
 .../python-modules/brax/default.nix           | 22 +++++++++++++------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/brax/default.nix b/pkgs/development/python-modules/brax/default.nix
index 849d44c7fab2..dbde33329245 100644
--- a/pkgs/development/python-modules/brax/default.nix
+++ b/pkgs/development/python-modules/brax/default.nix
@@ -54,13 +54,21 @@ buildPythonPackage (finalAttrs: {
     ./dont-use-device_put_replicated-compat.patch
   ];
 
-  # TypeError: clip() got an unexpected keyword argument 'a_min'
-  postPatch = ''
-    substituteInPlace brax/fluid.py \
-      --replace-fail \
-        "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), a_min=1e-12)" \
-        "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), min=1e-12)"
-  '';
+  postPatch =
+    # TypeError: clip() got an unexpected keyword argument 'a_min'
+    ''
+      substituteInPlace brax/fluid.py \
+        --replace-fail \
+          "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), a_min=1e-12)" \
+          "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), min=1e-12)"
+    ''
+    # mujoco >= 3.10 changed mj_fullM's signature from (m, dst, qM) to (m, d, dst).
+    + ''
+      substituteInPlace brax/generalized/mass_test.py \
+        --replace-fail \
+          "mujoco.mj_fullM(model, mj_mass_mx, mj_next.qM)" \
+          "mujoco.mj_fullM(model, mj_next, mj_mass_mx)"
+    '';
 
   build-system = [
     hatchling

From 292217fd5e5aaae65b053e6b1dc5f3a128700aed Mon Sep 17 00:00:00 2001
From: proitheus <me@mail.proitheus.top>
Date: Tue, 23 Jun 2026 07:14:14 +0800
Subject: [PATCH 40/83] maintainers: add proitheus

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ae44182003b8..26d7e7fa77b5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22355,6 +22355,12 @@
     githubId = 406946;
     name = "Valentin Lorentz";
   };
+  proitheus = {
+    email = "me@mail.proitheus.top";
+    github = "proitheus";
+    githubId = 50539150;
+    name = "proitheus";
+  };
   projectinitiative = {
     name = "ProjectInitiative";
     github = "ProjectInitiative";

From acdcb6883d69b612b7eac58a8b19c93f49602ab4 Mon Sep 17 00:00:00 2001
From: proitheus <me@mail.proitheus.top>
Date: Tue, 23 Jun 2026 07:18:19 +0800
Subject: [PATCH 41/83] breaktimer: init at 2.1.0

Cross-platform Electron desktop app for managing periodic breaks.
Runs as a system tray application with notifications and fullscreen
break overlays. Homepage:
https://github.com/tom-james-watson/breaktimer-app

Assisted-by: opencode (z-ai GLM-5.2)
---
 .../br/breaktimer/disable-auto-update.patch   |  89 +++++++++++
 pkgs/by-name/br/breaktimer/package.nix        | 140 ++++++++++++++++++
 2 files changed, 229 insertions(+)
 create mode 100644 pkgs/by-name/br/breaktimer/disable-auto-update.patch
 create mode 100644 pkgs/by-name/br/breaktimer/package.nix

diff --git a/pkgs/by-name/br/breaktimer/disable-auto-update.patch b/pkgs/by-name/br/breaktimer/disable-auto-update.patch
new file mode 100644
index 000000000000..2af3ab9a14e3
--- /dev/null
+++ b/pkgs/by-name/br/breaktimer/disable-auto-update.patch
@@ -0,0 +1,89 @@
+diff --git a/app/main/index.ts b/app/main/index.ts
+index 96921cb..f6ce034 100644
+--- a/app/main/index.ts
++++ b/app/main/index.ts
+@@ -1,11 +1,9 @@
+-import { app, shell } from "electron";
++import { app } from "electron";
+ import electronDebug from "electron-debug";
+ import log from "electron-log";
+-import { autoUpdater } from "electron-updater";
+ import { setAutoLauch } from "./lib/auto-launch";
+ import { initBreaks } from "./lib/breaks";
+ import "./lib/ipc";
+-import { showNotification } from "./lib/notifications";
+ import { getAppInitialized } from "./lib/store";
+ import { initTray } from "./lib/tray";
+ import { createSettingsWindow, createSoundsWindow } from "./lib/windows";
+@@ -29,62 +27,6 @@ if (!gotTheLock) {
+   app.exit();
+ }
+ 
+-function getDownloadUrl(): string {
+-  switch (process.platform) {
+-    case "win32":
+-      return "https://github.com/tom-james-watson/breaktimer-app/releases/latest/download/BreakTimer.exe";
+-    case "linux":
+-      return "https://github.com/tom-james-watson/breaktimer-app/releases/latest";
+-    default:
+-      throw new Error("Download URL should not be called for macOS");
+-  }
+-}
+-
+-function shouldAutoInstall(): boolean {
+-  const isMac = process.platform === "darwin";
+-  const isLinux = process.platform === "linux";
+-
+-  return isMac || isLinux;
+-}
+-
+-function checkForUpdates(): void {
+-  log.info("Checking for updates...");
+-  autoUpdater.logger = log;
+-
+-  autoUpdater.on("error", (error) => {
+-    log.error(`Auto updater error: ${error}`);
+-  });
+-
+-  if (shouldAutoInstall()) {
+-    autoUpdater.checkForUpdatesAndNotify().catch((error) => {
+-      log.error(`Unable to run auto updater: ${error}`);
+-    });
+-  } else {
+-    autoUpdater.autoDownload = false;
+-
+-    autoUpdater.on("update-available", (info) => {
+-      log.info("Update available:", info);
+-
+-      const downloadUrl = getDownloadUrl();
+-
+-      showNotification(
+-        "Update Available",
+-        "A new version of BreakTimer is available. Click to download.",
+-        () => {
+-          shell.openExternal(downloadUrl).catch((error) => {
+-            log.error(`Failed to open download URL: ${error}`);
+-          });
+-        },
+-        false,
+-      );
+-    });
+-
+-    autoUpdater.checkForUpdates().catch((error) => {
+-      log.error(`Unable to check for updates: ${error}`);
+-    });
+-  }
+-}
+-
+ if (process.env.NODE_ENV === "production") {
+   const sourceMapSupport = require("source-map-support");
+   sourceMapSupport.install();
+@@ -146,8 +88,4 @@ app.on("ready", async () => {
+   initBreaks();
+   initTray();
+   createSoundsWindow();
+-
+-  if (process.env.NODE_ENV !== "development") {
+-    checkForUpdates();
+-  }
+ });
diff --git a/pkgs/by-name/br/breaktimer/package.nix b/pkgs/by-name/br/breaktimer/package.nix
new file mode 100644
index 000000000000..9fd129c237fc
--- /dev/null
+++ b/pkgs/by-name/br/breaktimer/package.nix
@@ -0,0 +1,140 @@
+{
+  lib,
+  stdenv,
+  buildNpmPackage,
+  copyDesktopItems,
+  electron_40,
+  fetchFromGitHub,
+  jq,
+  makeDesktopItem,
+  makeWrapper,
+  nix-update-script,
+  nodejs_24,
+}:
+
+let
+  electron = electron_40;
+  nodejs = nodejs_24;
+  description = "Cross-platform desktop app for managing periodic breaks";
+in
+buildNpmPackage rec {
+  pname = "breaktimer";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "tom-james-watson";
+    repo = "breaktimer-app";
+    tag = "v${version}";
+    hash = "sha256-STDb6+brlVk/ZPUbw3cQOpe2r03WlFKEBgVLqJrsrHI=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  # electron-updater's auto-install path tries to download a new release
+  # from GitHub and overwrite the nix-store binary, which is read-only.
+  # Updates come via nix instead.
+  patches = [ ./disable-auto-update.patch ];
+
+  # The package ships a lockfile (package-lock.json) but the default
+  # `npm run build` is run via `concurrently`; we drive the build manually.
+  dontNpmBuild = true;
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  npmDepsHash = "sha256-UL8e0UKZKhHHC+JvRpmcdBvFHlCdn3YknceVJ+knMgg=";
+
+  nativeBuildInputs = [
+    jq
+    nodejs
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  preBuild = ''
+    if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '\^[0-9]+' | sed -e 's/\^//') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
+      echo 'ERROR: electron version mismatch'
+      exit 1
+    fi
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    npm run build
+
+    # electron-builder needs to mutate the copied Electron.app, which is
+    # read-only in the nix store. Copy it to a writable location first.
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    # Produce an unpacked Electron app without code-signing / notarisation.
+    npm exec electron-builder -- \
+      --dir \
+      --c.electronDist=electron-dist \
+      --c.electronVersion=${electron.version} \
+      --c.mac.identity=null \
+      --c.mac.notarize=false
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    unpacked="release/linux-${lib.optionalString stdenv.hostPlatform.isAarch64 "arm64-"}unpacked"
+
+    mkdir -p "$out/share/lib/breaktimer"
+    cp -r "$unpacked"/{locales,resources{,.pak}} "$out/share/lib/breaktimer"
+
+    makeWrapper '${lib.getExe electron}' "$out/bin/breaktimer" \
+      --add-flags "$out/share/lib/breaktimer/resources/app.asar" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=UseOzonePlatform,WaylandWindowDecorations,WebRTCPipeWireCapturer}}" \
+      --set-default ELECTRON_IS_DEV 0 \
+      --inherit-argv0
+
+    install -Dm644 resources/icon.png \
+      "$out/share/icons/hicolor/512x512/apps/breaktimer.png"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p "$out/Applications"
+    cp -R release/mac-*/BreakTimer.app "$out/Applications/"
+
+    mkdir -p "$out/bin"
+    makeWrapper \
+      "$out/Applications/BreakTimer.app/Contents/MacOS/BreakTimer" \
+      "$out/bin/breaktimer" \
+      --set-default ELECTRON_IS_DEV 0
+  ''
+  + ''
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "breaktimer";
+      exec = "breaktimer";
+      icon = "breaktimer";
+      comment = description;
+      desktopName = "BreakTimer";
+      genericName = "Break Reminder";
+      categories = [
+        "Utility"
+        "Office"
+      ];
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    inherit description;
+    homepage = "https://github.com/tom-james-watson/breaktimer-app";
+    changelog = "https://github.com/tom-james-watson/breaktimer-app/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ proitheus ];
+    mainProgram = "breaktimer";
+    platforms = electron.meta.platforms;
+  };
+}

From 5095f4fb193f28fa3134167afd4da300a8cbae19 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 23:49:52 +0000
Subject: [PATCH 42/83] vscode-extensions.kilocode.kilo-code: 7.2.20 -> 7.3.53

---
 .../vscode/extensions/kilocode.kilo-code/default.nix   | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix b/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
index 31fc7cf075b7..e8d4b1b9ce98 100644
--- a/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
@@ -12,26 +12,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-YeF6LyQzVAXgZ5Iqr6YvNcACfiUukUsq7cybeCQdSYc=";
+          hash = "sha256-uPmJyEq7X6uJzE1M5Xywax1mrnTcg6jOb9MlpKZ0WRk=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-SjirNvI83eh3Gt5rGsaiLT6TJMH6LRQAasOFNy9OMCY=";
+          hash = "sha256-oEVt3VbRUPD4tfQs0EU7RX6671fCJiMi38wF+76RzZI=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-FjE3xTp5Mj1584bepVc4nZr3rxCR3CV+jplmA45VF44=";
+          hash = "sha256-b46f0f99rjBivewC9jUbAFiKK+DS1XKv+AynUlKHliw=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-SAf3+0QSFUDq09AZQnw78ps55RM/RwoAeQuVly7vn10=";
+          hash = "sha256-yBJjt53eOazV9FB8qimerwXTX4vCIPC+lyXtau/3FyI=";
         };
       };
     in
     {
       publisher = "kilocode";
       name = "Kilo-Code";
-      version = "7.2.20";
+      version = "7.3.53";
     }
     // sources.${stdenv.hostPlatform.system}
       or (throw "Unsupported system ${stdenv.hostPlatform.system}");

From 35c4430927a37a44556e36866b238d55649c9f7e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 23 Jun 2026 02:00:18 +0200
Subject: [PATCH 43/83] python3Packages.blasthttp: init at 0.9.0

Offensive-first HTTP library

https://pypi.org/project/blasthttp
---
 .../python-modules/blasthttp/default.nix      | 67 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 69 insertions(+)
 create mode 100644 pkgs/development/python-modules/blasthttp/default.nix

diff --git a/pkgs/development/python-modules/blasthttp/default.nix b/pkgs/development/python-modules/blasthttp/default.nix
new file mode 100644
index 000000000000..7a889f486a9d
--- /dev/null
+++ b/pkgs/development/python-modules/blasthttp/default.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  buildPythonPackage,
+  cargo,
+  fetchPypi,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  pytest-asyncio,
+  pytestCheckHook,
+  rustc,
+  rustPlatform,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "blasthttp";
+  version = "0.9.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-JuoGy+QdBsVPMtD0T4Y/NSoeJcO7dwg3HmpqHxTxCIc=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-1+OFAD9n8JntZSV+PZbYLPRM/XDlFwgrEMFGv/LzTN8=";
+  };
+
+  postPatch = ''
+    # The bundled .cargo/config.toml sets OPENSSL_DIR to a relative path
+    rm .cargo/config.toml
+  '';
+
+  env = {
+    OPENSSL_NO_VENDOR = "1";
+  };
+
+  build-system = [
+    cargo
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  buildInputs = [ openssl ];
+
+  nativeCheckInputs = [
+    openssl
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "blasthttp" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Offensive-first HTTP library";
+    homepage = "https://pypi.org/project/blasthttp";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index cb255c8fb62c..694e915654c7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2142,6 +2142,8 @@ self: super: with self; {
 
   blake3 = callPackage ../development/python-modules/blake3 { };
 
+  blasthttp = callPackage ../development/python-modules/blasthttp { };
+
   ble-serial = callPackage ../development/python-modules/ble-serial { };
 
   bleach = callPackage ../development/python-modules/bleach { };

From 58d3a3af3a3d920cc99ff5269d299012ab124181 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 23 Jun 2026 02:07:52 +0200
Subject: [PATCH 44/83] python3Packages.badsecrets: 0.13.47 -> 1.2.0

Changelog: https://github.com/blacklanternsecurity/badsecrets/releases/tag/1.2.0
---
 .../python-modules/badsecrets/default.nix     | 25 +++++++++----------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/badsecrets/default.nix b/pkgs/development/python-modules/badsecrets/default.nix
index d2eed4774527..734a80b35e4d 100644
--- a/pkgs/development/python-modules/badsecrets/default.nix
+++ b/pkgs/development/python-modules/badsecrets/default.nix
@@ -1,49 +1,48 @@
 {
   lib,
+  blasthttp,
   buildPythonPackage,
   colorama,
   django,
   fetchFromGitHub,
   flask-unsign,
-  poetry-core,
-  poetry-dynamic-versioning,
+  hatchling,
   pycryptodome,
   pyjwt,
   requests,
-  viewstate,
+  yara-python,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "badsecrets";
-  version = "0.13.47";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "blacklanternsecurity";
     repo = "badsecrets";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-Yvd9AGbVDOfXep8y+XzwYP2EpTvy+rwyz5hRIe7v4oc=";
+    tag = finalAttrs.version;
+    hash = "sha256-fhRQvVb+JUP1DyTMAV7leIAKD/L4kRhGFYtD78cYABI=";
   };
 
   pythonRelaxDeps = [
     "django"
-    "viewstate"
+    "pyjwt"
   ];
 
-  build-system = [
-    poetry-core
-    poetry-dynamic-versioning
-  ];
+  build-system = [ hatchling ];
 
   dependencies = [
+    blasthttp
     colorama
     django
     flask-unsign
     pycryptodome
     pyjwt
     requests
-    viewstate
-  ];
+    yara-python
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   pythonImportsCheck = [ "badsecrets" ];
 

From 109b9cc0e1221ee9a39c67915a9f653f4f15d873 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 23 Jun 2026 02:11:10 +0200
Subject: [PATCH 45/83] python3Packages.tencentcloud-sdk-python: 3.1.119 ->
 3.1.120

Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/3.1.119...3.1.120

Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.1.120/CHANGELOG.md
---
 .../python-modules/tencentcloud-sdk-python/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 0ffadb14a6ea..21a2f7aa0da9 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.119";
+  version = "3.1.120";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-6uPKhXonPxWIwyXYlURSukwDg0WJnUkA4wCcNxWimlY=";
+    hash = "sha256-VJnFj/NeGKT223boJWMZZC/LxHdu+pqNexd+ezuq/js=";
   };
 
   build-system = [ setuptools ];

From 6282be339a6271c03b2971c96440e725b1ebbbf7 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Mon, 22 Jun 2026 19:02:00 +0200
Subject: [PATCH 46/83] tinymist: 0.15.0 -> 0.15.2

Changelog:
https://github.com/Myriad-Dreamin/tinymist/releases/tag/v0.15.2
Diff:
https://github.com/Myriad-Dreamin/tinymist/compare/v0.15.0...v0.15.2
---
 .../vscode/extensions/myriad-dreamin.tinymist/default.nix   | 2 +-
 pkgs/by-name/ti/tinymist/package.nix                        | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
index b03efaaac854..d1c2cd86f006 100644
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "tinymist";
     publisher = "myriad-dreamin";
     inherit (tinymist) version;
-    hash = "sha256-7kpW5EYOFsnib5i5xVcywgM82I0Ey/2mjC/LAjFy8qM=";
+    hash = "sha256-FLWUeRPoqzHjwBrf0OOejaAVY+KBOpNBb9OJMdfLr04=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index a1aebd60033a..220c0096b9f3 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.15.0";
+  version = "0.15.2";
 
   __structuredAttrs = true;
 
@@ -23,10 +23,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SfkyyszTmleWHa19jMgHjiOUvBOniVybDr9GBmtMVDw=";
+    hash = "sha256-wNSMjfU3upsqKQQUYx76iFGC+5ghcErlxy65ZJ/LvHk=";
   };
 
-  cargoHash = "sha256-ztJb2Br0Ph2qSeo9MGm9OdU66YPkep+9lBCrL2TimB4=";
+  cargoHash = "sha256-NEvINvHMD9tVG9kyj84AC8DEAbR0ndjkCHpwR4OD6YA=";
 
   nativeBuildInputs = [
     installShellFiles

From 8942ebde8b8157dcb75314302e51d8309359aea1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 01:18:58 +0000
Subject: [PATCH 47/83] wastebin: 3.6.2 -> 3.7.0

---
 pkgs/by-name/wa/wastebin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/wa/wastebin/package.nix b/pkgs/by-name/wa/wastebin/package.nix
index 845026e7fd40..f4b5d79b2eaf 100644
--- a/pkgs/by-name/wa/wastebin/package.nix
+++ b/pkgs/by-name/wa/wastebin/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wastebin";
-  version = "3.6.2";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "matze";
     repo = "wastebin";
     rev = finalAttrs.version;
-    hash = "sha256-pORShre3lLgI8UE9iZ7gicQbGbZM06IgYnKLLwOYm/s=";
+    hash = "sha256-uWr2xJjWcm0WmOB6eD2pdzUch7HSk9KdHV31FoYHr0E=";
   };
 
-  cargoHash = "sha256-fpEG0J+l/kRq5s6G0rzDsshbKM44fZfVeURFPhFeV7s=";
+  cargoHash = "sha256-m5cO3J4LryO+pS991DkS+4J6dw8ltP9sJR88FVGdsdw=";
 
   nativeBuildInputs = [
     pkg-config

From 096deb4bbf543ca0cb78e81cd8948b74060a0576 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 02:37:52 +0000
Subject: [PATCH 48/83] prl-tools: 26.3.3-57507 -> 26.4.0-57513

---
 pkgs/by-name/pr/prl-tools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pr/prl-tools/package.nix b/pkgs/by-name/pr/prl-tools/package.nix
index 57a2f14dd0e0..ef3fb2075385 100644
--- a/pkgs/by-name/pr/prl-tools/package.nix
+++ b/pkgs/by-name/pr/prl-tools/package.nix
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "26.3.3-57507";
+  version = "26.4.0-57513";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-QXrzdQ6eY3ikgwMD11/zEkYau/X0mmm2uk6O92r8w1o=";
+    hash = "sha256-Qkul+hZh0J7g8+D+T7RLmfrtK2i90+wlsrfm5tNaYug=";
   };
 
   hardeningDisable = [

From d48de758e85782f41f72c5b5a58e49b3be3a443d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 02:57:18 +0000
Subject: [PATCH 49/83] runme: 3.16.11 -> 3.16.15

---
 pkgs/by-name/ru/runme/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/runme/package.nix b/pkgs/by-name/ru/runme/package.nix
index 8c2d06b7a4c1..75c900b5b249 100644
--- a/pkgs/by-name/ru/runme/package.nix
+++ b/pkgs/by-name/ru/runme/package.nix
@@ -13,16 +13,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "runme";
-  version = "3.16.11";
+  version = "3.16.15";
 
   src = fetchFromGitHub {
     owner = "runmedev";
     repo = "runme";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-c01mVr8JW+qghj7q5W3B1NsuH9hQUEq3hVHLT+9VM20=";
+    hash = "sha256-mU8U/aak0FrQEFanVksM/32bsGx5damuf6BxshTk/M0=";
   };
 
-  vendorHash = "sha256-7F33MmGWIY1z2aw2mJ83XhcOrhT+olGwNmvdgGdxyME=";
+  vendorHash = "sha256-q+NVyzTCKgyOW94O/YWbmgvgUVh9xlnBOMLWCp/0jrM=";
 
   nativeBuildInputs = [
     installShellFiles

From 155e12eb6ec7a40d6b039c81a084d34cfe11e758 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 03:13:23 +0000
Subject: [PATCH 50/83] python3Packages.xknx: 3.15.0 -> 3.16.0

---
 pkgs/development/python-modules/xknx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/xknx/default.nix b/pkgs/development/python-modules/xknx/default.nix
index 8d829187a5c8..40e75ee02244 100644
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "xknx";
-  version = "3.15.0";
+  version = "3.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "XKNX";
     repo = "xknx";
     tag = finalAttrs.version;
-    hash = "sha256-EA6F4Wkji495uVfFyN1M+jZsXFkKbfK7POie3qbuqBY=";
+    hash = "sha256-884iWQynTRBauJR10CzgkveoD9//Dq+mpvywtSnmT+c=";
   };
 
   build-system = [ setuptools ];

From c2b7b3eab6ed3832310f14aac66ebe7f93826660 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 03:33:54 +0000
Subject: [PATCH 51/83] multica-cli: 0.3.21 -> 0.3.27

---
 pkgs/by-name/mu/multica-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mu/multica-cli/package.nix b/pkgs/by-name/mu/multica-cli/package.nix
index 0c5dc989be80..59e6c8e5f6a0 100644
--- a/pkgs/by-name/mu/multica-cli/package.nix
+++ b/pkgs/by-name/mu/multica-cli/package.nix
@@ -9,13 +9,13 @@ buildGoModule rec {
   __structuredAttrs = true;
 
   pname = "multica-cli";
-  version = "0.3.21";
+  version = "0.3.27";
 
   src = fetchFromGitHub {
     owner = "multica-ai";
     repo = "multica";
     rev = "v${version}";
-    hash = "sha256-qsQ2ycr+MU1A+U8LIbxnfaYtSHoMnLNO3P9ACJ6ThD4=";
+    hash = "sha256-zHjyITvFG7dTk8mFQ62f8JY9wLbKeOvlo0pjF6hQxcI=";
   };
 
   sourceRoot = "${src.name}/server";

From 0196202d52cd611e7057c624333e6782264f29f3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 03:49:42 +0000
Subject: [PATCH 52/83] jj-vine: 0.5.0 -> 0.5.3

---
 pkgs/by-name/jj/jj-vine/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/jj/jj-vine/package.nix b/pkgs/by-name/jj/jj-vine/package.nix
index 6287241df882..17ef577e9285 100644
--- a/pkgs/by-name/jj/jj-vine/package.nix
+++ b/pkgs/by-name/jj/jj-vine/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jj-vine";
-  version = "0.5.0";
+  version = "0.5.3";
 
   src = fetchFromCodeberg {
     owner = "abrenneke";
     repo = "jj-vine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uvnSv+4ijVdBoHrOklDRY+JDLsVOTRu+laOcFMjkYaA=";
+    hash = "sha256-dUamfoMtdDNz9xmXeg1O1j5UHW6uF/1WznHSsG+eVjs=";
   };
 
-  cargoHash = "sha256-TsyFWcvr8ksiC1vStWs+mH88lw1/JGRg8IQ7XFnZ5qg=";
+  cargoHash = "sha256-nuj0cugeK5oc+sZmm1f5dvGEjML0qkle5uO66e54VIY=";
 
   nativeCheckInputs = [
     jujutsu

From d2cb5a2a684a4b68c56ab6a3a2a01da5c1f27c51 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 03:50:50 +0000
Subject: [PATCH 53/83] osmium: 0.0.29-alpha -> 0.0.30-alpha

---
 pkgs/by-name/os/osmium/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/os/osmium/package.nix b/pkgs/by-name/os/osmium/package.nix
index 97114e38aee1..bbd5040f3061 100644
--- a/pkgs/by-name/os/osmium/package.nix
+++ b/pkgs/by-name/os/osmium/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation rec {
   pname = "osmium";
-  version = "0.0.29-alpha";
+  version = "0.0.30-alpha";
 
   src = fetchurl {
     url = "https://updater.osmium.chat/Osmium-${version}-x64.tar.gz";
-    hash = "sha256-UbYnT/9bkMCii4rkAlkUBQcHc6DyAkOa8rQl+9e3NZU=";
+    hash = "sha256-NF7RF8odDQfh4zhk5B4md4OqDgh538exFNsRZzSJwBM=";
   };
 
   nativeBuildInputs = [

From 16f25fd071b872b38cad281fd3aeb4ea8456b982 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 04:02:55 +0000
Subject: [PATCH 54/83] python3Packages.typst: 0.14.9 -> 0.15.0

---
 pkgs/development/python-modules/typst/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/typst/default.nix b/pkgs/development/python-modules/typst/default.nix
index 598de8ecac99..47a48e690ed5 100644
--- a/pkgs/development/python-modules/typst/default.nix
+++ b/pkgs/development/python-modules/typst/default.nix
@@ -12,19 +12,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "typst";
-  version = "0.14.9";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = "typst-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BiheOVvXPoLGtOzObZte38RkMVkUMOsFURn5DU1cw+o=";
+    hash = "sha256-9wHUikOf/WULPaGkCOXa0aXcSme+xbweC6IDwaJnwRk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-PM0WntALVI/ks7N/Uk5tjcb0XBr2PSUY+O1nalFg2JQ=";
+    hash = "sha256-TyLKnJUVbodCHQXhpjIr1numNDmeUkvpsKH1o5tWFCM=";
   };
 
   build-system = [

From 693ff56b4b167284f2f29f64bc6c4cd4aa6a445a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 04:19:59 +0000
Subject: [PATCH 55/83] python3Packages.opower: 0.18.5 -> 0.18.6

---
 pkgs/development/python-modules/opower/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index 75c632dd0fae..98d9084c692d 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "opower";
-  version = "0.18.5";
+  version = "0.18.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tronikos";
     repo = "opower";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s6nacD6k9OgByt2ZdBrZsHtAhdUto7gngqqQWI3henY=";
+    hash = "sha256-lOmd/eyU0XDPbAjW2ur9lSlq5ECv80/1FZXjLaZ92e4=";
   };
 
   build-system = [ setuptools ];

From 6998697633bff5b4f42d85971a897376d0e8354a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 04:50:11 +0000
Subject: [PATCH 56/83] ocamlPackages.charon: 2026.06.14 -> 2026.06.22

---
 pkgs/development/ocaml-modules/charon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/charon/default.nix b/pkgs/development/ocaml-modules/charon/default.nix
index a560a938ddaa..93d58a2079d7 100644
--- a/pkgs/development/ocaml-modules/charon/default.nix
+++ b/pkgs/development/ocaml-modules/charon/default.nix
@@ -16,14 +16,14 @@
 
 buildDunePackage (finalAttrs: {
   pname = "charon";
-  version = "2026.06.14";
+  version = "2026.06.22";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "AeneasVerif";
     repo = "charon";
     tag = "nightly-${finalAttrs.version}";
-    hash = "sha256-EZ1Ueco4vK4mUKyOGXXHgToNLMp+1W7095HyU+1zQ2Q=";
+    hash = "sha256-Wz2iVkHZLHwgIycHTNCmST5gizupU3xGTo0scfdq8T0=";
   };
 
   propagatedBuildInputs = [

From 5841cb32b5a4acf92f4f1fef563c8917b503f9cd Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Tue, 23 Jun 2026 04:55:47 +0000
Subject: [PATCH 57/83] blocky: 0.31.0 -> 0.32.1

---
 pkgs/by-name/bl/blocky/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bl/blocky/package.nix b/pkgs/by-name/bl/blocky/package.nix
index 0c5d680dc1ea..e468ac4bd49b 100644
--- a/pkgs/by-name/bl/blocky/package.nix
+++ b/pkgs/by-name/bl/blocky/package.nix
@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "blocky";
-  version = "0.31.0";
+  version = "0.32.1";
 
   src = fetchFromGitHub {
     owner = "0xERR0R";
     repo = "blocky";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qFGJaShWplvZo/uKRjizWWeb/OzLJCoL9YTRsKWTriY=";
+    hash = "sha256-/gkEP7UylJQ079W1n7QaAF8EngWTSF8YbzPN3L+Ru5U=";
   };
 
   # needs network connection and fails at
   # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
   doCheck = false;
 
-  vendorHash = "sha256-EsGaY3U6bHjQTj+rLRtjiQJoNP5WnP7/gZ2NrRX53b0=";
+  vendorHash = "sha256-atsq9nSfuchtyeX9P7dV3wmEj8k9G9aZQSZxieX7mx0";
 
   ldflags = [
     "-s"

From 309f240874f3c4094ecf5067d98b303bf7c156b9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 05:07:10 +0000
Subject: [PATCH 58/83] kopia-ui: 0.23.0 -> 0.23.1

---
 pkgs/by-name/ko/kopia-ui/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ko/kopia-ui/package.nix b/pkgs/by-name/ko/kopia-ui/package.nix
index 68f8fe86a3dc..e32b5af7e61b 100644
--- a/pkgs/by-name/ko/kopia-ui/package.nix
+++ b/pkgs/by-name/ko/kopia-ui/package.nix
@@ -10,12 +10,12 @@
   kopia,
 }:
 let
-  version = "0.23.0";
+  version = "0.23.1";
   src = fetchFromGitHub {
     owner = "kopia";
     repo = "kopia";
     tag = "v${version}";
-    hash = "sha256-9xvgm+A8h2pAX3oHtiFSa2xNab5BDkEBEtXQZz3Fd5A=";
+    hash = "sha256-yjeLV7N/U88oVdP4iJYgSM/QJLAMREaB/2jBcbTDWkA=";
   };
 in
 buildNpmPackage {
@@ -24,7 +24,7 @@ buildNpmPackage {
 
   sourceRoot = "${src.name}/app";
 
-  npmDepsHash = "sha256-Ctp41vNZPVbycwIzWiTh+1ej3NpCf1WJCqnJsyoyxlc=";
+  npmDepsHash = "sha256-yj5+qiLfy6CjAOXIzT9OMu860Pefwn+HuJNoBAizb/0=";
   makeCacheWritable = true;
 
   nativeBuildInputs = [

From cb46fe38c070959f86af31e9e1bca595c0309774 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 05:39:28 +0000
Subject: [PATCH 59/83] vault-bin: 2.0.0 -> 2.0.3

---
 pkgs/by-name/va/vault-bin/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/va/vault-bin/package.nix b/pkgs/by-name/va/vault-bin/package.nix
index 5896eaedce6e..5401509c09f7 100644
--- a/pkgs/by-name/va/vault-bin/package.nix
+++ b/pkgs/by-name/va/vault-bin/package.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "2.0.0";
+  version = "2.0.3";
 
   src =
     let
@@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-Zp/rbxNa9gDFHclb0Mb2jYfav6jVGfSYvpybEFOaQ+U=";
-        aarch64-linux = "sha256-qenfLCdDrIsJZMzv2CO3VDcI9TwzRfh/KbFvojFwGhQ=";
-        i686-linux = "sha256-hGqJUlK92XO3APCUeJTiLnVHNh6r1MfskEbtYMjDg7I=";
-        x86_64-darwin = "sha256-WJFs/8Lq2VBVMF2wls5EHFfe4ClLJOoxO91+5oGl6Ko=";
-        aarch64-darwin = "sha256-3wfrn05JeYho9+F6lmgT8cZdlogV+7IhJ/kwj09OeOA=";
+        x86_64-linux = "sha256-THVYezhV7TmChy8IKsE8Agx6ks4wFctuk+GevXhwRv8=";
+        aarch64-linux = "sha256-Wmlpw9gzbdCvgCwf3Nh9JPjjmDKS2P0TNYaRvKqO4fg=";
+        i686-linux = "sha256-Fdxq1r1G17kiCl7b9OBrWwkyo+VoKOvrUPf0p4wZlcs=";
+        x86_64-darwin = "sha256-tyQzmycXo4kSvo1X4afFU2aWuXyvyvw0mb81eiH3WjE=";
+        aarch64-darwin = "sha256-+zor3j+7saG6AnuIlkJSAsCkMHYuhm0Abmt6TTu8bZI=";
       };
     in
     fetchzip {

From f4ffe2972b795eb12d0f357fcb87d4adc5183a9e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 05:41:55 +0000
Subject: [PATCH 60/83] terraform-providers.venafi_venafi: 0.23.2 -> 0.24.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 017ea2623f71..cb4cf5708501 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1436,13 +1436,13 @@
     "vendorHash": "sha256-lWBMihP6oX7qPpTuPQQwQS3IDwdyb/rEYqtBsTozb7Q="
   },
   "venafi_venafi": {
-    "hash": "sha256-WOCZRVAYVR9uzsyyAvCQvYReaas6YmZsbRgxxxhDF/k=",
+    "hash": "sha256-oEyrnKMe+cMLSajI2wxkjXfHySM198NviiSqX0hGduk=",
     "homepage": "https://registry.terraform.io/providers/Venafi/venafi",
     "owner": "Venafi",
     "repo": "terraform-provider-venafi",
-    "rev": "v0.23.2",
+    "rev": "v0.24.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rqDzBez3HvhG+xvEyQ6foq/m0sFyyqrioquY9mcuWOU="
+    "vendorHash": "sha256-UnC3dob6idNgitHo4uGs1BPb3T7UQTR8wAJ2faYVvhE="
   },
   "vinyldns_vinyldns": {
     "hash": "sha256-/M+HFMDeKpIzzdn04TkMxriVeE6vvORRiqonxF38B9Q=",

From 130d8403d71b9c636e6c0148cf54a3edefe31256 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 05:54:04 +0000
Subject: [PATCH 61/83] globalping-cli: 1.5.1 -> 1.5.2

---
 pkgs/by-name/gl/globalping-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gl/globalping-cli/package.nix b/pkgs/by-name/gl/globalping-cli/package.nix
index 2fc6d470840f..a4224f4e4a3c 100644
--- a/pkgs/by-name/gl/globalping-cli/package.nix
+++ b/pkgs/by-name/gl/globalping-cli/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "globalping-cli";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "jsdelivr";
     repo = "globalping-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-muWhiKqPdNVhy7c7MSRHACGzOn5pIVRdqSdfdCJw2CA=";
+    hash = "sha256-MaqBaR177gcgoqEpsER1+8oYZmiGeySfL/O9r6CxqCY=";
   };
 
-  vendorHash = "sha256-dJAuN5srL5EvMaRg8rHaTsurjYrdH45p965DeubpB0E=";
+  vendorHash = "sha256-7fhcQptMyq8IuRaqx3Znc9QFLaV0t6HpM4eCtdimupA=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 49f3485031b59493be2daa492ec30725a7575fa2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 06:22:46 +0000
Subject: [PATCH 62/83] just: 1.53.0 -> 1.54.0

---
 pkgs/by-name/ju/just/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ju/just/package.nix b/pkgs/by-name/ju/just/package.nix
index acab33ada1e8..de3091c0dbd5 100644
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@@ -17,7 +17,7 @@
   withDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
 }:
 let
-  version = "1.53.0";
+  version = "1.54.0";
 in
 rustPlatform.buildRustPackage {
   inherit version;
@@ -36,10 +36,10 @@ rustPlatform.buildRustPackage {
     owner = "casey";
     repo = "just";
     tag = version;
-    hash = "sha256-+/G5fIPBl9NoDL0i9y67tjccte75yMT84pqsCWropws=";
+    hash = "sha256-sWEelwKEuxJUTh2Ejwr7e29j5EFVCSiQJoLCEH60PxI=";
   };
 
-  cargoHash = "sha256-Rwv10c487qOf6nH/Nj8rcfMLHRm8RaA5OYOh5p27rtM=";
+  cargoHash = "sha256-+eUi0g+ObJhlXhRLmWfRmTlnoxHHVdzTtXdX8LNloIc=";
 
   nativeBuildInputs =
     lib.optionals (installShellCompletions || installManPages) [ installShellFiles ]

From cabdd5ebcaa2ac097c9d9be59582449d3bb93436 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 06:37:32 +0000
Subject: [PATCH 63/83] xh: 0.25.3 -> 0.26.1

---
 pkgs/by-name/xh/xh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/xh/xh/package.nix b/pkgs/by-name/xh/xh/package.nix
index 3609712c8298..755452446727 100644
--- a/pkgs/by-name/xh/xh/package.nix
+++ b/pkgs/by-name/xh/xh/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xh";
-  version = "0.25.3";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     owner = "ducaale";
     repo = "xh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WRYClBIjw67lVrzvnIMqVHd6toi5yU7nClViqfXahKA=";
+    hash = "sha256-Y8T/r7DaKha0cjWewJPzq4jo6Lab18cDrAj8Ek1D5Bg=";
   };
 
-  cargoHash = "sha256-T2ZaijWXyH8ZJKFTTngGtQsdRWL9re4i3nKHp8srWSI=";
+  cargoHash = "sha256-JjXv4QMmOF0xsRloaKqbdJ8ztHtEg80QRJmnTW1/3Lc=";
 
   buildFeatures = lib.optional withNativeTls "native-tls";
 

From 498aab6ea8d5c7bca2a5420da5f70ebbafa9ee2c Mon Sep 17 00:00:00 2001
From: zimward <zimward@zimward.moe>
Date: Thu, 18 Jun 2026 14:24:32 +0200
Subject: [PATCH 64/83] nixos/run0: add options for persistent authentication

Co-authored-by: Grimmauld <soeren@benjos.de>
Assisted-by: languagetool 6.6
---
 .../manual/release-notes/rl-2611.section.md   |  2 ++
 nixos/modules/security/run0.nix               | 32 +++++++++++++++----
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 331b6a919479..c7a615694fe1 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -50,6 +50,8 @@
 
 - `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
 
+- `security.run0.persistentAuth` options have been added to support persistent Authentication of session. Timeout configurable via `security.polkit.settings.Polkitd.ExpirationSeconds`.
+
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
 
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
diff --git a/nixos/modules/security/run0.nix b/nixos/modules/security/run0.nix
index 295215aa5a0a..478fae3db67d 100644
--- a/nixos/modules/security/run0.nix
+++ b/nixos/modules/security/run0.nix
@@ -13,6 +13,7 @@ let
     mkOption
     mkPackageOption
     mkAliasOptionModule
+    optionalString
     ;
 
   cfg = config.security.run0;
@@ -21,6 +22,12 @@ in
   options.security.run0 = {
     enable = mkEnableOption "support for run0";
 
+    persistentAuth.enable = mkEnableOption ''
+      persistent authentication for sessions.
+      Timeout configurable via {option}`security.polkit.settings.Polkitd.ExpirationSeconds`
+    '';
+    persistentAuth.enableRemote = mkEnableOption "persistent authentication for remote sessions";
+
     wheelNeedsPassword = mkOption {
       type = lib.types.bool;
       default = true;
@@ -67,13 +74,24 @@ in
 
       security.polkit = {
         enable = true;
-        extraConfig = mkIf (!cfg.wheelNeedsPassword) ''
-          polkit.addRule(function(action, subject) {
-            if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
-              return polkit.Result.YES;
-            }
-          });
-        '';
+        extraConfig = lib.concatLines [
+          (optionalString (!cfg.wheelNeedsPassword) ''
+            polkit.addRule(function(action, subject) {
+              if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
+                return polkit.Result.YES;
+              }
+            });
+          '')
+          (optionalString cfg.persistentAuth.enable ''
+            polkit.addRule(function(action, subject) {
+              if (action.id == "org.freedesktop.systemd1.manage-units" && subject.active ${
+                optionalString (!cfg.persistentAuth.enableRemote) "&& subject.local"
+              }) {
+                return polkit.Result.AUTH_ADMIN_KEEP;
+              }
+            });
+          '')
+        ];
       };
 
       environment.systemPackages = lib.optional cfg.sudo-shim.enable cfg.sudo-shim.package;

From aee6a48479ec651de15562af3103152171bca682 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 07:07:36 +0000
Subject: [PATCH 65/83] terraform-providers.oracle_oci: 8.18.0 -> 8.19.0

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 017ea2623f71..66b781769263 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1058,11 +1058,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-SFs0BYaYgB4J/HbaYFx1Sh1raVWhRJdW/3KMWdyvX+I=",
+    "hash": "sha256-ByAuY0y7tpzeaHmf1VTpvVUzRFxhuS49g57XqJ4Mnuk=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.18.0",
+    "rev": "v8.19.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

From df36357946a0fbbc7480cfef12ecc08322aac7c6 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 23 Jun 2026 09:13:13 +0200
Subject: [PATCH 66/83] python3Packages.iamdata: 0.1.202606221 -> 0.1.202606231

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202606221...v0.1.202606231

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202606231
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index e1bb6d407022..4303c9ae55d5 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606221";
+  version = "0.1.202606231";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qJJGLgkqvDTqozTCb+1sTLcbWwsVh1JVyOEirNpBGlc=";
+    hash = "sha256-IQWbG1aPrQ8mgzCa8XFMiZDPeMStIy/L9WubtMKpCbI=";
   };
 
   __darwinAllowLocalNetworking = true;

From 3d4c5a022dc3e521ccdeb9f61794479c5e297d10 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 07:18:38 +0000
Subject: [PATCH 67/83] dalfox: 3.1.0 -> 3.1.1

---
 pkgs/by-name/da/dalfox/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/da/dalfox/package.nix b/pkgs/by-name/da/dalfox/package.nix
index a27763c913dc..d3d0492acfb9 100644
--- a/pkgs/by-name/da/dalfox/package.nix
+++ b/pkgs/by-name/da/dalfox/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dalfox";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = "dalfox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QV2+eKTMuvt//krGrPrjViIsLiog5i4bzhgq8lgHvR0=";
+    hash = "sha256-V+5/+UYj9Pd727olIOwXij/XUh2NMzGHQDuupTO9DMk=";
   };
 
   vendorHash = null;

From 455bc1e55daed2a9535c649f57d70836c0351754 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 07:38:03 +0000
Subject: [PATCH 68/83] emacsPackages.copilot: 0.5.0 -> 0.6.0

---
 .../emacs/elisp-packages/manual-packages/copilot/package.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
index 07bf31827567..555fba45c2d8 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
@@ -12,13 +12,13 @@
 }:
 melpaBuild (finalAttrs: {
   pname = "copilot";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "copilot-emacs";
     repo = "copilot.el";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-1uHPtz0F0pim7KlotB1+pmls1i7H3hRhZ0DX1h53cPc=";
+    sha256 = "sha256-l4TR3mk72j2VRN8s6DmlT+I5Ii2FgPEG62KKHql40L8=";
   };
 
   files = ''(:defaults "dist")'';

From a7466627e66d3afa5d488cade90860e619a790c2 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 23 Jun 2026 10:38:31 +0300
Subject: [PATCH 69/83] linux-firmware: 20260519 -> 20260622

Diff: https://gitlab.com/kernel-firmware/linux-firmware/-/compare/20260519...20260622
---
 pkgs/by-name/li/linux-firmware/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/linux-firmware/package.nix b/pkgs/by-name/li/linux-firmware/package.nix
index f26f8e593019..6019480aed92 100644
--- a/pkgs/by-name/li/linux-firmware/package.nix
+++ b/pkgs/by-name/li/linux-firmware/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "linux-firmware";
-  version = "20260519";
+  version = "20260622";
 
   src = fetchFromGitLab {
     owner = "kernel-firmware";
     repo = "linux-firmware";
     tag = version;
-    hash = "sha256-vyrnHNnyNko7m/fZ3fXgLvvasYyJ/pzs5be/Ele+6vY=";
+    hash = "sha256-nSoJhgI4hAxtNmnj5M6ticzuBSt9uNAYcmc1VR/yXxE=";
   };
 
   postUnpack = ''

From 5c4c814fd00d334ba0a878fdd989f9df19013796 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 23 Jun 2026 07:48:17 +0000
Subject: [PATCH 70/83] ocamlPackages.aeneas: 2026.06.14 -> 2026.06.22

---
 pkgs/development/ocaml-modules/aeneas/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/aeneas/default.nix b/pkgs/development/ocaml-modules/aeneas/default.nix
index 46a5e5827b44..82668012a2e4 100644
--- a/pkgs/development/ocaml-modules/aeneas/default.nix
+++ b/pkgs/development/ocaml-modules/aeneas/default.nix
@@ -8,6 +8,7 @@
   core_unix,
   domainslib,
   ocamlgraph,
+  ppx_deriving_yojson,
   progress,
   visitors,
 
@@ -16,7 +17,7 @@
 
 buildDunePackage (finalAttrs: {
   pname = "aeneas";
-  version = "2026.06.14";
+  version = "2026.06.22";
   __structuredAttrs = true;
 
   minimalOCamlVersion = "5.1";
@@ -25,7 +26,7 @@ buildDunePackage (finalAttrs: {
     owner = "AeneasVerif";
     repo = "aeneas";
     tag = "nightly-${finalAttrs.version}";
-    hash = "sha256-ef68sJtVdKlIr7IiZSehFlG87m1BjW5HSG8PYxbs3Lg=";
+    hash = "sha256-T/wiTajDKCG4lFcHtdQvO0AhEzX9F+vT6ij2VBBnvdU=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
@@ -35,6 +36,7 @@ buildDunePackage (finalAttrs: {
     core_unix
     domainslib
     ocamlgraph
+    ppx_deriving_yojson
     progress
     visitors
   ];

From ccf3ea96bf7668c908c6f476f6edf51a60b5a6cc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 08:52:00 +0000
Subject: [PATCH 71/83] zashboard: 3.9.0 -> 3.10.1

---
 pkgs/by-name/za/zashboard/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/za/zashboard/package.nix b/pkgs/by-name/za/zashboard/package.nix
index d9fb336a683b..138104b05ff4 100644
--- a/pkgs/by-name/za/zashboard/package.nix
+++ b/pkgs/by-name/za/zashboard/package.nix
@@ -12,13 +12,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "zashboard";
-  version = "3.9.0";
+  version = "3.10.1";
 
   src = fetchFromGitHub {
     owner = "Zephyruso";
     repo = "zashboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QUu1HNGjxcT/oNO6XEiUpQ6TfMwLv9MQIsAtff+hYsY=";
+    hash = "sha256-unk/QO2V5BzuY8TL8Z1K/EPPMB6JwW15OQICix8Mukk=";
   };
 
   npmDeps = null;
@@ -26,7 +26,7 @@ buildNpmPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-reYRJgLBxz+/J1wwPG4sO953R4xN0L6JInRJauseFc8=";
+    hash = "sha256-7bjsqBQssirsrIbegm5G/J/v3+yzfomq/gxCbxKEb6g=";
   };
 
   nativeBuildInputs = [ pnpm ];

From ee5aa77ddaebc8f67aca2f573f226b145470cbb5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 09:06:09 +0000
Subject: [PATCH 72/83] python3Packages.victron-mqtt: 2026.6.4 -> 2026.6.7

---
 pkgs/development/python-modules/victron-mqtt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/victron-mqtt/default.nix b/pkgs/development/python-modules/victron-mqtt/default.nix
index ae19b7e9db66..f2b9e81a9557 100644
--- a/pkgs/development/python-modules/victron-mqtt/default.nix
+++ b/pkgs/development/python-modules/victron-mqtt/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "victron-mqtt";
-  version = "2026.6.4";
+  version = "2026.6.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tomer-w";
     repo = "victron_mqtt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lKntAZF9SkSBnlLwcwMB9wZz9PviRbSbweTMzwwzExY=";
+    hash = "sha256-06+vn0HKvml3VRvPnQHz832OQnbvjd8tJEcnE6TIer8=";
   };
 
   build-system = [

From 04d37432219466ff7ca21bcd18df9632eaaee4df Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 09:24:24 +0000
Subject: [PATCH 73/83] kubectl-gadget: 0.52.0 -> 0.53.2

---
 pkgs/by-name/ku/kubectl-gadget/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ku/kubectl-gadget/package.nix b/pkgs/by-name/ku/kubectl-gadget/package.nix
index 20047fda5c07..7508162ad206 100644
--- a/pkgs/by-name/ku/kubectl-gadget/package.nix
+++ b/pkgs/by-name/ku/kubectl-gadget/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubectl-gadget";
-  version = "0.52.0";
+  version = "0.53.2";
 
   src = fetchFromGitHub {
     owner = "inspektor-gadget";
     repo = "inspektor-gadget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WcIPubDzj3LPf1KUWfmxdlBGnG2x68hax/ZQKwSNifc=";
+    hash = "sha256-Mfj2Slgeo5v5NNg3qj8v0eFg35jishtk5bEt+IxA1xc=";
   };
 
-  vendorHash = "sha256-aEzzXcsM3D+Sp6LBms5+RzWirdC5iFvN2IiwbOXCrEw=";
+  vendorHash = "sha256-u4kEi/H8vdIV6bS/R76H09m7dh1YR8pUD8ZOQ23VhHU=";
 
   env.CGO_ENABLED = 0;
 

From 822f8ee64711c6755b2081aceb29e27e95a65514 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 23 Jun 2026 09:39:24 +0000
Subject: [PATCH 74/83] nixpkgs-review: 3.8.0 -> 3.9.0

Diff: https://github.com/Mic92/nixpkgs-review/compare/3.8.0...3.9.0

Changelog: https://github.com/Mic92/nixpkgs-review/releases/tag/3.9.0
---
 pkgs/by-name/ni/nixpkgs-review/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixpkgs-review/package.nix b/pkgs/by-name/ni/nixpkgs-review/package.nix
index ff037e9b7549..37cbd707d2bc 100644
--- a/pkgs/by-name/ni/nixpkgs-review/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-review/package.nix
@@ -23,7 +23,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nixpkgs-review";
-  version = "3.8.0";
+  version = "3.9.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -32,7 +32,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "Mic92";
     repo = "nixpkgs-review";
     tag = finalAttrs.version;
-    hash = "sha256-Z8pOct9DtuRo4LERqhVpDxX9uoLNQGgqPFUh0Fn3MrI=";
+    hash = "sha256-u0DbEwe28csVWKbu8x9v9/Ah0ZUUgqXtZU2Rr5IJpWI=";
   };
 
   build-system = [

From 3a34d774c2c1d34ac593c7e1cd5b673403817f0c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 23 Jun 2026 13:03:10 +0300
Subject: [PATCH 75/83] kdePackages: Plasma 6.7.0 -> 6.7.1

---
 pkgs/kde/generated/sources/plasma.json        | 450 +++++++++---------
 .../plasma-login-manager/kwin-path.patch      |   1 +
 2 files changed, 226 insertions(+), 225 deletions(-)

diff --git a/pkgs/kde/generated/sources/plasma.json b/pkgs/kde/generated/sources/plasma.json
index 5f74fe6626b9..ec36e1e0c869 100644
--- a/pkgs/kde/generated/sources/plasma.json
+++ b/pkgs/kde/generated/sources/plasma.json
@@ -1,377 +1,377 @@
 {
   "aurorae": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/aurorae-6.7.0.tar.xz",
-    "hash": "sha256-U4Ij6+dSEwXSmHPCePheeRDreBCjHSppaY7edqXA2jw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/aurorae-6.7.1.tar.xz",
+    "hash": "sha256-q++RuE02QRSkXyi8TLCHzPJCZQ53NzCB8qouJdAPEaQ="
   },
   "bluedevil": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/bluedevil-6.7.0.tar.xz",
-    "hash": "sha256-P9q0pyS6JGoQ8mNwdspTMniP/1w8YZPM806wMeiXPp0="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/bluedevil-6.7.1.tar.xz",
+    "hash": "sha256-HR6ao2cFBVtrHlMiO2B3dXy7okJeYmk8HjEtSU/4rPs="
   },
   "breeze": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-6.7.0.tar.xz",
-    "hash": "sha256-zzdbuqpF9bobPfA2vwxAt+39eJ6yb25G+d0dMldpy9U="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-6.7.1.tar.xz",
+    "hash": "sha256-BXoVTUYZ7/aI+OSJ+6EW43Q7dj0y3rERuwCCqRk8n5M="
   },
   "breeze-grub": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-grub-6.7.0.tar.xz",
-    "hash": "sha256-x+atJoKHKWS9cJucyrD8uTKKz1YpQHwji3XvfYA8+iE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-grub-6.7.1.tar.xz",
+    "hash": "sha256-WEFkMVfYE8JBztribmlVNktiTfWLcKNzeVQNqKOhvSk="
   },
   "breeze-gtk": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-gtk-6.7.0.tar.xz",
-    "hash": "sha256-KFmeF3tBZqezMvg0pyaWz4gs+fap7hknCKJ/R0wQJ8A="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-gtk-6.7.1.tar.xz",
+    "hash": "sha256-fMJ8F0QXyJvv5HFVI6vDrGqA0xj8Lw4YSULzShe+y24="
   },
   "breeze-plymouth": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-plymouth-6.7.0.tar.xz",
-    "hash": "sha256-2gNHVU33S38RsXA71s3eF2kXQuMqXMzfyTJaGzJhBqU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-plymouth-6.7.1.tar.xz",
+    "hash": "sha256-SBfQKH6/NW8DD9waChoGmrvfy99I1f5KES8wKRm2rcM="
   },
   "discover": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/discover-6.7.0.tar.xz",
-    "hash": "sha256-A9SisXVxdla/7pB/T7lBILhs3MhmPZTnkkrG8nelWyc="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/discover-6.7.1.tar.xz",
+    "hash": "sha256-JXpcSoOhlBYZeNQHzGbOFIG1hIsfp38fn7sn0hFrQfk="
   },
   "drkonqi": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/drkonqi-6.7.0.tar.xz",
-    "hash": "sha256-VeZibrxQCJmKInVcjNJx8jNYcqUM3fZfFY/dXNI319M="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/drkonqi-6.7.1.tar.xz",
+    "hash": "sha256-Ng8NlmwcUTxp7TCw3nFKovX6lTnPqf2J1VWTv4/kkVQ="
   },
   "flatpak-kcm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/flatpak-kcm-6.7.0.tar.xz",
-    "hash": "sha256-SmSQaW60yGQ4sE6X3BY75QsM17t+rPuyBGkglP9gt2s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/flatpak-kcm-6.7.1.tar.xz",
+    "hash": "sha256-AruzSZV2MuKyJHc5zSNG2/TQ/3hu2+Sk/tW3zlWLxhg="
   },
   "kactivitymanagerd": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kactivitymanagerd-6.7.0.tar.xz",
-    "hash": "sha256-7QZcLXbIXPjhDdcv+PiechNvxMhVYabJheuX3FGERqE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kactivitymanagerd-6.7.1.tar.xz",
+    "hash": "sha256-SAvTuiozFbQTCE3J9gxVJS8r+euinz3FebfhUOaAWws="
   },
   "kde-cli-tools": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kde-cli-tools-6.7.0.tar.xz",
-    "hash": "sha256-JyD/fvv5e+9GmwL1RInz2bKguYyHGu25Fazbr5nzGZg="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kde-cli-tools-6.7.1.tar.xz",
+    "hash": "sha256-KH5A1A9uVVs28MQ7ZnEceghmMCSoEGxLAuxM/215FBs="
   },
   "kde-gtk-config": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kde-gtk-config-6.7.0.tar.xz",
-    "hash": "sha256-2W5YIUxmMrSR0yyqSusVrihPg+inXTu5SFl49Cr0q9k="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kde-gtk-config-6.7.1.tar.xz",
+    "hash": "sha256-OLT5jVmIFpTFYmMJczULM853/aYsy85QZ8a7gPRjRtE="
   },
   "kdecoration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kdecoration-6.7.0.tar.xz",
-    "hash": "sha256-rP5WV9iJvw3VuLUBMrvpxi9ItQdPy6gmWhy4TWwie10="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kdecoration-6.7.1.tar.xz",
+    "hash": "sha256-Ol2PV7q0Uuq9Gq3EUIi5WmaalRYmx+YB9qDvNgMGhL8="
   },
   "kdeplasma-addons": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kdeplasma-addons-6.7.0.tar.xz",
-    "hash": "sha256-i4awt5sK8toJfYHc4JmRPUNXTgjEQop5JYcGkheLQpg="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kdeplasma-addons-6.7.1.tar.xz",
+    "hash": "sha256-nQ5x7xgIUGMIdRtfmydMlty9PTAsPCSVrW1R6zt+pP8="
   },
   "kgamma": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kgamma-6.7.0.tar.xz",
-    "hash": "sha256-6MM9ukfaPqD4kFPpQCmCqx+9tpwlm/CLEEegUEsH3ZI="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kgamma-6.7.1.tar.xz",
+    "hash": "sha256-3msXvkXDuvEUe0OXGNF+AQv3odG/cMUU3deDTOfI/tc="
   },
   "kglobalacceld": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kglobalacceld-6.7.0.tar.xz",
-    "hash": "sha256-/1423Ly4GC8baVBimTqeosxz0mdTay9ZJt4Dn6dzLGU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kglobalacceld-6.7.1.tar.xz",
+    "hash": "sha256-DycS/x9aTEQ+Lh33A/sHTi112lXx/gOaDuw4pYcI56c="
   },
   "kinfocenter": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kinfocenter-6.7.0.tar.xz",
-    "hash": "sha256-303tKcuH12W31fSxYcKaQlWGOES+5kJH5vDT8Miz5aM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kinfocenter-6.7.1.tar.xz",
+    "hash": "sha256-lXhBKL3ZZ5w5xmjiv3om1eB9ahP2osmjdhWJ+2x1LP0="
   },
   "kmenuedit": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kmenuedit-6.7.0.tar.xz",
-    "hash": "sha256-8n/tXImJrQCtxxS8fzd638qXQsTM06//lHjVAu6v/6s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kmenuedit-6.7.1.tar.xz",
+    "hash": "sha256-4nIVMiJyewt19Uq3y8vhFW1DRzwga1pz1n5a6jbfhEk="
   },
   "knighttime": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/knighttime-6.7.0.tar.xz",
-    "hash": "sha256-wvx1Kc7zs6gL5HFShtAn/IkI7w/oBArqEGgxpSZfwRM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/knighttime-6.7.1.tar.xz",
+    "hash": "sha256-1MYNnr6xO59NDMq/BUWkgtm4mTM6tKhst4sWWs9Z7UM="
   },
   "kpipewire": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kpipewire-6.7.0.tar.xz",
-    "hash": "sha256-2/g5t3nFCMICC9+dZCdiOHy6hQWSkd6rOOigwVIjuts="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kpipewire-6.7.1.tar.xz",
+    "hash": "sha256-j40qF3SPKWQl5sQGgjQKaV3/fNkz7ZdHTU6sK/6UJ8E="
   },
   "krdp": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/krdp-6.7.0.tar.xz",
-    "hash": "sha256-5lylbPL5ZplFENzOzVOJKSLiYa19upkR0vN0BgKTxts="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/krdp-6.7.1.tar.xz",
+    "hash": "sha256-bYe6Be/Sn4SnMKFcdIEJJTV+h12+31vL9pJqVFLrf3k="
   },
   "kscreen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kscreen-6.7.0.tar.xz",
-    "hash": "sha256-rVekMmpkl5poqlBopxUXAtmwLbByBnDkvj4XiQW+2lY="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kscreen-6.7.1.tar.xz",
+    "hash": "sha256-95xfFg04duXfLxfhBPOjf6Q6QLa5Z9o8687p4nKs9H8="
   },
   "kscreenlocker": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kscreenlocker-6.7.0.tar.xz",
-    "hash": "sha256-wxVLaKiF7VXUzVd/gT9VU+oLMdvdMbMrN0SQVVD+w9E="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kscreenlocker-6.7.1.tar.xz",
+    "hash": "sha256-m6zNFheLULYPmYuBKmHgdAV08T1Zlcohk5xeFgaOPJ4="
   },
   "ksshaskpass": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/ksshaskpass-6.7.0.tar.xz",
-    "hash": "sha256-TY7lYdv64xjil4QR2z1/3wkmY/XUXTafHjqSNNhyzuA="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/ksshaskpass-6.7.1.tar.xz",
+    "hash": "sha256-Y4FB/SY5UAW13R99BFS6n+p9JkupNDeYHzRVNVKi1Aw="
   },
   "ksystemstats": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/ksystemstats-6.7.0.tar.xz",
-    "hash": "sha256-IiTOQeQudYRaqIbhkueDPOY4uGqjHKDk48sx7zbkBms="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/ksystemstats-6.7.1.tar.xz",
+    "hash": "sha256-I7Fqk76ua+2xkl4MItBfKtX5/73ZfA+nUzX+K+Lrsx8="
   },
   "kwallet-pam": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwallet-pam-6.7.0.tar.xz",
-    "hash": "sha256-cdvV1qtSQ+eMUjzjgtU70Uw1cxrwlJf76Sm8pBtprtk="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwallet-pam-6.7.1.tar.xz",
+    "hash": "sha256-Lzce3Y5DR9W4rw4qaH9eNTd7/diWxwXJO4Ps4EOenEU="
   },
   "kwayland": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwayland-6.7.0.tar.xz",
-    "hash": "sha256-hiHRfpEAvmDqNAI1II0ET9ApMdvvdqMtmkd94xyOM/Q="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwayland-6.7.1.tar.xz",
+    "hash": "sha256-NPLbzil/W/zlv/ujyS8XTZp3SszSjSxnfnhscMnt5L8="
   },
   "kwayland-integration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwayland-integration-6.7.0.tar.xz",
-    "hash": "sha256-IRld2c69WlxzhmOybw4dFaspj1ncqvkkNethi540JcM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwayland-integration-6.7.1.tar.xz",
+    "hash": "sha256-Cc13B7KLXBnSB/3gdOmkwBLZROK66iPFmVqUAV6hwt4="
   },
   "kwin": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwin-6.7.0.tar.xz",
-    "hash": "sha256-0gt5gJSp9Y5X3lXso9WLHNy32yk564v3ORjE+rbZrsU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwin-6.7.1.tar.xz",
+    "hash": "sha256-NSv7NO+tFDUHGWDvTNOSsRChjhwWjR/cXM5rQzMdCHU="
   },
   "kwin-x11": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwin-x11-6.7.0.tar.xz",
-    "hash": "sha256-msC4W1kBbfuRWH+MGXD71cbyFdEsmkGazQv30PBJNgY="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwin-x11-6.7.1.tar.xz",
+    "hash": "sha256-C7QDHIcHM7oDrN6/uxmcqklF0ZFKFnAEXfqNO1O04F8="
   },
   "kwrited": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwrited-6.7.0.tar.xz",
-    "hash": "sha256-dUOaklYfbDMoBNHSfa4VvFdVuMmvKNp50WwDLVCQOxA="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwrited-6.7.1.tar.xz",
+    "hash": "sha256-QVjROFluLdUtr8h8370JcPUMmOQkB23XKaosbAkjYlE="
   },
   "layer-shell-qt": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/layer-shell-qt-6.7.0.tar.xz",
-    "hash": "sha256-5vSLbr4sPKqjwu9thHBVCQTQMK00lrwQpUCYddstqrA="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/layer-shell-qt-6.7.1.tar.xz",
+    "hash": "sha256-Ayo/VDPxkTKRpZXjPKCKCkx+IuLXzjf19ygkdpbGEYg="
   },
   "libkscreen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/libkscreen-6.7.0.tar.xz",
-    "hash": "sha256-bvulgFeiY12m8YVbprCOV+Y2yXZCG6Xj9fZn5qV7DOE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/libkscreen-6.7.1.tar.xz",
+    "hash": "sha256-xrE6dh5u6GXx0KtysSazL782D3ToAqFDFeWix+G35R4="
   },
   "libksysguard": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/libksysguard-6.7.0.tar.xz",
-    "hash": "sha256-40wBQ4OZ/CMJDN5NRyJbzY9giZ0TjsrpnMWZZZU2rOM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/libksysguard-6.7.1.tar.xz",
+    "hash": "sha256-P7orFd6RPrN2JMROw/O9iHNNCkIqvvb6goT2cmDnE/M="
   },
   "libplasma": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/libplasma-6.7.0.tar.xz",
-    "hash": "sha256-ioXkyessPAC1aDzOOqLJSdBrlWyIeJwbHBELarriAxI="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/libplasma-6.7.1.tar.xz",
+    "hash": "sha256-+sljROkeIvGsrCn5BQ+NzNSXplhzVzPP+Q5HnNob1bM="
   },
   "milou": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/milou-6.7.0.tar.xz",
-    "hash": "sha256-jJSkw875vGJbVByz1MLwqVv6E9MfPBgGM/fvnScB2x4="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/milou-6.7.1.tar.xz",
+    "hash": "sha256-fB+LXOhQ9ZkIAEIvUwEw3RT942QsfJFhAFFv1oNqzp8="
   },
   "ocean-sound-theme": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/ocean-sound-theme-6.7.0.tar.xz",
-    "hash": "sha256-ELK6ypKrcZirzCDVjdrTGRDIxr7uRxH8KkohUFRG8TU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/ocean-sound-theme-6.7.1.tar.xz",
+    "hash": "sha256-f/G3Nx/GPqqbmEdQlZGAMKlDiq5n0yxm7gy01yNy1iU="
   },
   "oxygen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/oxygen-6.7.0.tar.xz",
-    "hash": "sha256-ER+2K8PZ86lZ53/TX+VWLKNK14PLzcDBZFh/Vklc/ww="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/oxygen-6.7.1.tar.xz",
+    "hash": "sha256-Yh9N4kv4lh9NUaKhPgid5TqZtmL9LEGs1sWy8v7DHeg="
   },
   "oxygen-sounds": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/oxygen-sounds-6.7.0.tar.xz",
-    "hash": "sha256-YqPdeoilcNacNwpxomHI3QTZLa+QJQyiqdI8KeZ+HIo="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/oxygen-sounds-6.7.1.tar.xz",
+    "hash": "sha256-v/Fr9p+ddlcjfGfg7DLCEYjNyW8AQVfAx/PbuNOciJQ="
   },
   "plasma-activities": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-activities-6.7.0.tar.xz",
-    "hash": "sha256-OP+VeZagnBUjbpOwNboSNICliv90iUtht98QIOxEK1k="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-activities-6.7.1.tar.xz",
+    "hash": "sha256-2eOO+moKuLUMIIwIrKx7/iPJ6PfK/MGAoWRyStaBmAQ="
   },
   "plasma-activities-stats": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-activities-stats-6.7.0.tar.xz",
-    "hash": "sha256-K0qu2cRoW8LAVqDLqE1CfvLx63pPhB1Yd9A0e1sRzBM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-activities-stats-6.7.1.tar.xz",
+    "hash": "sha256-YvS4CWXw1hblC5XX7s/OSruStCYZD4znbZKblBBsOPU="
   },
   "plasma-bigscreen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-bigscreen-6.7.0.tar.xz",
-    "hash": "sha256-IS6811bk2oY4UsvKj9qPE+h/6IDSKSy9S+iPJs8k9IY="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-bigscreen-6.7.1.tar.xz",
+    "hash": "sha256-LaM+OvpKt+oZ24J/WTJUpSHf0XVohQmum39CIQQxMLE="
   },
   "plasma-browser-integration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-browser-integration-6.7.0.tar.xz",
-    "hash": "sha256-zVtIPuKJHea7Bi3q62r+DAop6VHgclEMASwVtJsblUs="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-browser-integration-6.7.1.tar.xz",
+    "hash": "sha256-5/m1qzdFlLFWNNvhKbpGdDG1M3tk7PL/21BPo80fjRM="
   },
   "plasma-desktop": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-desktop-6.7.0.tar.xz",
-    "hash": "sha256-Y1E7VPb2CzzX7DXKLwlivfJWaXKTiOhRWsHTuIme5H8="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-desktop-6.7.1.tar.xz",
+    "hash": "sha256-8EUNwmcG/C1xmrKOMQIUnPv2py6BzTEMk2uFwIq7by8="
   },
   "plasma-dialer": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-dialer-6.7.0.tar.xz",
-    "hash": "sha256-CKULmVTY8yxCgJknsUz7Kg/GaKc1XhdWGbsNL86izUc="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-dialer-6.7.1.tar.xz",
+    "hash": "sha256-1BpinydZ/NviXuLQ21rU1Y3xZXuA791aV8K5NnCq3yg="
   },
   "plasma-disks": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-disks-6.7.0.tar.xz",
-    "hash": "sha256-mYiOJyaPD1q9+9hd42KxjxymxnDps5LnbaMPUafVzc8="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-disks-6.7.1.tar.xz",
+    "hash": "sha256-gMxmv+uvhInLgA09FfDifwEQegzzbKFlkAxhwOv+470="
   },
   "plasma-firewall": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-firewall-6.7.0.tar.xz",
-    "hash": "sha256-eHwVBebooyw/hVu2X0YVY3fuItbcMhpyB5sWB68N8n0="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-firewall-6.7.1.tar.xz",
+    "hash": "sha256-tb2giZ3X4ygv6ibXH0gk5oFcoOHiHSAXlLfxMb9BcYE="
   },
   "plasma-integration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-integration-6.7.0.tar.xz",
-    "hash": "sha256-U3sFzUurGwcG+zH5gj+GZt9yleZH51YU8Ctr8UWO/x0="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-integration-6.7.1.tar.xz",
+    "hash": "sha256-GqsFgdC/2Taec/mWdIL0WTxZDPBYw0ofC8kREV0MWPw="
   },
   "plasma-keyboard": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-keyboard-6.7.0.tar.xz",
-    "hash": "sha256-gxGV8wjQgRuNeLTIRYFdyhZIuz/sg8nsY30b4ltTq3Q="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-keyboard-6.7.1.tar.xz",
+    "hash": "sha256-rPNqjTYVDGoOzuLusPcMTxImyuP+30fzjgbXZbY4gEc="
   },
   "plasma-login-manager": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-login-manager-6.7.0.tar.xz",
-    "hash": "sha256-A8WFlhQcwSYsKxxXSdm2TW5yJclyjUIcblr7ZJNWbuE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-login-manager-6.7.1.tar.xz",
+    "hash": "sha256-cZU/NZ8MIsI1HjliCFasSNse/e6bvExB0Wg9j8+EOdY="
   },
   "plasma-mobile": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-mobile-6.7.0.tar.xz",
-    "hash": "sha256-NCaqC2KblFsHbqzhMMSrvG//b2xd0cK/9/8Ney1HfkI="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-mobile-6.7.1.tar.xz",
+    "hash": "sha256-PineHwZCOzNky3VQ3jet92YhSX3xOmq6+JpmR8uPS/4="
   },
   "plasma-nano": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-nano-6.7.0.tar.xz",
-    "hash": "sha256-xOL0nSQVfO62vCWYHi1xYA3SEXJJ6CsMwE+klAEZMYE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-nano-6.7.1.tar.xz",
+    "hash": "sha256-C3cS0WA1Zci2/WKALspPB5GagqWzJ6vfTpk3vkpuzPQ="
   },
   "plasma-nm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-nm-6.7.0.tar.xz",
-    "hash": "sha256-spaAzBfEu+UuO5iNW+Q37EtSS1VPoYDq0TvIkQFEz5g="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-nm-6.7.1.tar.xz",
+    "hash": "sha256-xDSWduN13o2YM+/3GCthlwxJHZmLKbtiYupVykW0dNo="
   },
   "plasma-pa": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-pa-6.7.0.tar.xz",
-    "hash": "sha256-utzogREH7ldyBxYnWsX8EhFmibw0zkk8q+cijhtlj1E="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-pa-6.7.1.tar.xz",
+    "hash": "sha256-cOnkdSfzi5FZ+UHciJWoSYKLP24xPjOznhHbQyA/Fwk="
   },
   "plasma-sdk": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-sdk-6.7.0.tar.xz",
-    "hash": "sha256-1G1SKRVGImSuXUl7rBb3U7DQtrW1uZtG/fiCP0xWLtM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-sdk-6.7.1.tar.xz",
+    "hash": "sha256-RAoThwkoj+iTUCjsKLHebR3wjKCY+s17i4YpkCssZMU="
   },
   "plasma-setup": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-setup-6.7.0.tar.xz",
-    "hash": "sha256-3I+l3XRXBW3hwtAEPw83zTBhAg/s0hmMq/83i9XJVx4="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-setup-6.7.1.tar.xz",
+    "hash": "sha256-D520I44I2sk5ABkSQqcu5FVMsAfaDYs3axfwsOTyy6M="
   },
   "plasma-systemmonitor": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-systemmonitor-6.7.0.tar.xz",
-    "hash": "sha256-9lthyXWIbtxXSZVnAKWkxAWeeRXEl4aFeI/oGKFxS0I="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-systemmonitor-6.7.1.tar.xz",
+    "hash": "sha256-u4duK34ulFDkIHQ40lZCgtKFFNSLnh8WU0CZgh87cvs="
   },
   "plasma-thunderbolt": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-thunderbolt-6.7.0.tar.xz",
-    "hash": "sha256-Pepo91aAHJVHM2ykFVJnLDaTCRwpu/iWjuAf8pKHk6A="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-thunderbolt-6.7.1.tar.xz",
+    "hash": "sha256-Mra0QYXPAj/g909PXjNxGiJTZFftuNLXNcbE7AFP3OQ="
   },
   "plasma-vault": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-vault-6.7.0.tar.xz",
-    "hash": "sha256-i9cLPTeHidOWpm5pOoCd1rIe3EgWYnWTL399AgdPzhw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-vault-6.7.1.tar.xz",
+    "hash": "sha256-5RfE/MK+NzFtrVfHDBrooQ30Z4FHm1mLoes+I2Z/34I="
   },
   "plasma-welcome": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-welcome-6.7.0.tar.xz",
-    "hash": "sha256-SD8WkxtswsVmaPVCBBjnsvja1XarqgG8dVRsE2HyGQM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-welcome-6.7.1.tar.xz",
+    "hash": "sha256-/QOm4pkS55WQTJ/7ODX6iB9ZGTUZStcdJFAUMt6WurA="
   },
   "plasma-workspace": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-workspace-6.7.0.tar.xz",
-    "hash": "sha256-mn8qBOikS/JNpNKUu6JwmEoJDvF6CCzR6yXLgYJlHTw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-workspace-6.7.1.tar.xz",
+    "hash": "sha256-o/Jn78KTkmnCZSNEmteqzK4GsBryBzYklHzOxF17wjw="
   },
   "plasma-workspace-wallpapers": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-workspace-wallpapers-6.7.0.tar.xz",
-    "hash": "sha256-DpIiDArgt8QmROvtb+FZ+wCXqJLmQMsSQgR8kpkx6go="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-workspace-wallpapers-6.7.1.tar.xz",
+    "hash": "sha256-s8u3+qZqOE8TfDT5OE7vBRTzMlQhtEmxh7V7XgZdaZo="
   },
   "plasma5support": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma5support-6.7.0.tar.xz",
-    "hash": "sha256-5g4eR6Pe6TUYZH1mOTwh4kBvd3np6eQ4LXzqaM67+3s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma5support-6.7.1.tar.xz",
+    "hash": "sha256-BnC/QpkCc/vmBJ0Tbb1g/WU2UJ1SlVw4BImSRLgmOOM="
   },
   "plymouth-kcm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plymouth-kcm-6.7.0.tar.xz",
-    "hash": "sha256-KrVY7wsm/U4C+iZ4ZBL28be8UHZAe7nuR6fByffgJUc="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plymouth-kcm-6.7.1.tar.xz",
+    "hash": "sha256-JL/chn4wxcVMr2Rvrwj4Z48o+znyIZK0G5Mh947eK4Q="
   },
   "polkit-kde-agent-1": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/polkit-kde-agent-1-6.7.0.tar.xz",
-    "hash": "sha256-Dyf/KqNhBBhiDEKAS5w9wi9peeXAOCL5OXnUT77R2r8="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/polkit-kde-agent-1-6.7.1.tar.xz",
+    "hash": "sha256-GvLysrM+GDhOsSDHQi9tKP88eFWzOpiOF3fe5ILWeKc="
   },
   "powerdevil": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/powerdevil-6.7.0.tar.xz",
-    "hash": "sha256-djXv/9UD542SvMAwM9VoHlFXfskrxtpy8qsoKLsKNNs="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/powerdevil-6.7.1.tar.xz",
+    "hash": "sha256-+oJiQSf5Umf2lGdhClfDy6Vi+gZzBSsv9/nbfwU9nlo="
   },
   "print-manager": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/print-manager-6.7.0.tar.xz",
-    "hash": "sha256-v3tqkw7cG4Ped65YV0O9pOGjpYKt5tICovuiYWrcpbM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/print-manager-6.7.1.tar.xz",
+    "hash": "sha256-Y7vr7t7UX96tDDtw/IFm+zrSHderKpfNzTeo2qO0xCk="
   },
   "qqc2-breeze-style": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/qqc2-breeze-style-6.7.0.tar.xz",
-    "hash": "sha256-gfsPQ/4VwrzRxi50LKuoTWCk65OAwLzsRHtbdyjin7s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/qqc2-breeze-style-6.7.1.tar.xz",
+    "hash": "sha256-C9N/SlZblK7HwuZ3kjpwVRuVNXj1tQwUvW9Em3SawhI="
   },
   "sddm-kcm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/sddm-kcm-6.7.0.tar.xz",
-    "hash": "sha256-A7Heo6c4BIoGRjO57bgCcWAE9GMLP2p/Bo/QdNcZ700="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/sddm-kcm-6.7.1.tar.xz",
+    "hash": "sha256-vwpEdfaE59XMOQ4AX+PRvyXbwP+ko0gUtqnhdIWWxx4="
   },
   "spacebar": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/spacebar-6.7.0.tar.xz",
-    "hash": "sha256-XwtcSkDFHaPKxaXWg6uDq/2KNX5FkXYmjs7RWPAxSIU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/spacebar-6.7.1.tar.xz",
+    "hash": "sha256-A+UTHgSbS8PKMxTAQ38esjscDWZBHtjdNtM+Q+Dl3uo="
   },
   "spectacle": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/spectacle-6.7.0.tar.xz",
-    "hash": "sha256-Sw5J3iGyGP9fEwLQzebgZyC8RSQ5bIUA02zWRMnVDGQ="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/spectacle-6.7.1.tar.xz",
+    "hash": "sha256-gp9kCwn5VJkpqymaUOgt4QldcQ6bjGdFU1zmp56qJG0="
   },
   "systemsettings": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/systemsettings-6.7.0.tar.xz",
-    "hash": "sha256-WfJKRQRrZp0awW+A7ngyPrbxchMKusMcbWXPYfBfp58="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/systemsettings-6.7.1.tar.xz",
+    "hash": "sha256-6ZlBGNFnAL8jO6/Le4LxKfiI9BZJjajKowysjX7oG0I="
   },
   "union": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/union-6.7.0.tar.xz",
-    "hash": "sha256-0JJd9wpnQiRuadl3btE508UuPDzNtoaT66vKLE6M9Fk="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/union-6.7.1.tar.xz",
+    "hash": "sha256-sAJVMeS9e2qF3xSmebS4N8DhGzxZv0yNCqwxp9ipdTM="
   },
   "wacomtablet": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/wacomtablet-6.7.0.tar.xz",
-    "hash": "sha256-4lBGcIom7JKbkTYcPYZAgu3m/toDgrcSntOKl1SiwKw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/wacomtablet-6.7.1.tar.xz",
+    "hash": "sha256-Fy6qVwNjDX93fYNKBU8fBeMS8LJwNrcIwnT/f194D5A="
   },
   "xdg-desktop-portal-kde": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/xdg-desktop-portal-kde-6.7.0.tar.xz",
-    "hash": "sha256-9a/Ab5SLc7KgED2e5uV3RKmISj8uCBCAd3bsS/cQKto="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/xdg-desktop-portal-kde-6.7.1.tar.xz",
+    "hash": "sha256-C5BKsknt9HkaPfXICqQhVVE1eNqMoslQLfqp3sHoSos="
   }
 }
\ No newline at end of file
diff --git a/pkgs/kde/plasma/plasma-login-manager/kwin-path.patch b/pkgs/kde/plasma/plasma-login-manager/kwin-path.patch
index 360884d1e30b..6c214eac534f 100644
--- a/pkgs/kde/plasma/plasma-login-manager/kwin-path.patch
+++ b/pkgs/kde/plasma/plasma-login-manager/kwin-path.patch
@@ -4,6 +4,7 @@
  PartOf=graphical-session.target
  
  [Service]
+ Environment="KWIN_USE_OVERLAYS=0"
 -ExecStart=@CMAKE_INSTALL_FULL_BINDIR@/kwin_wayland --no-lockscreen --no-global-shortcuts --no-kactivities --inputmethod plasma-keyboard --locale1
 +ExecStart=@kwin_wayland@ --no-lockscreen --no-global-shortcuts --no-kactivities --inputmethod plasma-keyboard --locale1
  SuccessExitStatus=15

From 8f58add7b0ff92f582861c48819e31ca326fc6aa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 10:10:40 +0000
Subject: [PATCH 76/83] python3Packages.symbolic: 13.2.0 -> 13.3.1

---
 pkgs/development/python-modules/symbolic/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/symbolic/default.nix b/pkgs/development/python-modules/symbolic/default.nix
index bcc2b224335a..81b779197b5a 100644
--- a/pkgs/development/python-modules/symbolic/default.nix
+++ b/pkgs/development/python-modules/symbolic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "symbolic";
-  version = "13.2.0";
+  version = "13.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -23,12 +23,12 @@ buildPythonPackage (finalAttrs: {
     tag = finalAttrs.version;
     # the `py` directory is not included in the tarball, so we fetch the source via git instead
     forceFetchGit = true;
-    hash = "sha256-Nks8CClNENRFBbEGgFP3yhi5sWR/iiaLOdTayPD7M9k=";
+    hash = "sha256-w2suCkNxuHGLnf8+RsXwyZWYKGT/41rrckVUWQgT1bg=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-r+9mrGyr78UenC9BFpW1a+VjEAXgcamLOoI8V1N10Cg=";
+    hash = "sha256-6AnNOTdiUvJbmB4TJdEipKoTLXHlJb5WPX51GtJy+II=";
   };
 
   nativeBuildInputs = [

From 0efd6a129add664f999212866b9ff28490a77167 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 2 May 2026 23:07:09 +0000
Subject: [PATCH 77/83] python3Packages.funsor: 0.4.6 -> 0.4.7

Diff: https://github.com/pyro-ppl/funsor/compare/0.4.6...0.4.7

Changelog: https://github.com/pyro-ppl/funsor/releases/tag/0.4.7
---
 .../python-modules/funsor/default.nix         | 37 ++++---------------
 1 file changed, 8 insertions(+), 29 deletions(-)

diff --git a/pkgs/development/python-modules/funsor/default.nix b/pkgs/development/python-modules/funsor/default.nix
index 96c7dcd3a62e..04ece9b20542 100644
--- a/pkgs/development/python-modules/funsor/default.nix
+++ b/pkgs/development/python-modules/funsor/default.nix
@@ -14,7 +14,7 @@
   opt-einsum,
   typing-extensions,
 
-  # checks
+  # tests
   pyro-ppl,
   torch,
   pandas,
@@ -25,20 +25,19 @@
   requests,
   scipy,
   torchvision,
-
-  stdenv,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "funsor";
-  version = "0.4.6";
+  version = "0.4.7";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "pyro-ppl";
     repo = "funsor";
-    tag = version;
-    hash = "sha256-Prj1saT0yoPAP8rDE0ipBEpR3QMk4PS12VSJlxc22p8=";
+    tag = finalAttrs.version;
+    hash = "sha256-0STJv1OOliJaHdmYUXdnOnocH3hVXceH/Uw5nILvT+U=";
   };
 
   patches = [
@@ -49,13 +48,6 @@ buildPythonPackage rec {
     })
   ];
 
-  # TypeError: clip() got an unexpected keyword argument 'a_max'
-  postPatch = ''
-    substituteInPlace funsor/jax/ops.py \
-      --replace-fail "a_max=" "max=" \
-      --replace-fail "a_min=" "min="
-  '';
-
   build-system = [ setuptools ];
 
   dependencies = [
@@ -87,24 +79,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "funsor" ];
 
-  disabledTests = [
-    # `test_torch_save` got broken by the update of torch (2.3.1 -> 2.4.0):
-    # FutureWarning: You are using `torch.load` with `weights_only=False`...
-    # TODO: Try to re-enable this test at next release
-    "test_torch_save"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # Failures related to JIT
-    # RuntimeError: required keyword attribute 'Subgraph' has the wrong type
-    "test_local_param_ok"
-    "test_plate_ok"
-  ];
-
   meta = {
     description = "Functional tensors for probabilistic programming";
     homepage = "https://funsor.pyro.ai";
-    changelog = "https://github.com/pyro-ppl/funsor/releases/tag/${version}";
+    changelog = "https://github.com/pyro-ppl/funsor/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})

From 6400c97afd0e6613c4fb0fbddf548cdc60790ad5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 23 Jun 2026 09:42:28 +0200
Subject: [PATCH 78/83] python3Packages.blasthttp: add darwin support

---
 .../python-modules/blasthttp/default.nix            | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/python-modules/blasthttp/default.nix b/pkgs/development/python-modules/blasthttp/default.nix
index 7a889f486a9d..48c79b7adbba 100644
--- a/pkgs/development/python-modules/blasthttp/default.nix
+++ b/pkgs/development/python-modules/blasthttp/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   cargo,
   fetchPypi,
@@ -34,6 +35,8 @@ buildPythonPackage (finalAttrs: {
     rm .cargo/config.toml
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   env = {
     OPENSSL_NO_VENDOR = "1";
   };
@@ -56,6 +59,16 @@ buildPythonPackage (finalAttrs: {
 
   pythonImportsCheck = [ "blasthttp" ];
 
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    "tests/python/test_ssl_verify.py"
+    "tests/python/test_response_api.py"
+  ];
+
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    "test_redirect_onto_proxied_host_reevaluates_no_proxy"
+    "test_redirect_onto_no_proxy_host_reevaluates_to_direct"
+  ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {

From 84f8b1f1dada30d16d5353c8ee851a9ba41135d5 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 23 Jun 2026 13:12:10 +0200
Subject: [PATCH 79/83] nixos/networkd: this isn't experimental

I know a lot of places where this is used in production and this isn't
true anymore, especially since we're considering to drop scripted
networking.
---
 nixos/modules/tasks/network-interfaces.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 4887256b7be1..06b38deff6b6 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1693,8 +1693,7 @@ in
       type = types.bool;
       description = ''
         Whether we should use networkd as the network configuration backend or
-        the legacy script based system. Note that this option is experimental,
-        enable at your own risk.
+        the legacy script based system.
       '';
     };
 

From 981ff8ba3d22a64fe513a1bba5e683a89f782d51 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 11:12:28 +0000
Subject: [PATCH 80/83] ffmpeg-normalize: 1.37.8 -> 1.38.0

---
 pkgs/by-name/ff/ffmpeg-normalize/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ff/ffmpeg-normalize/package.nix b/pkgs/by-name/ff/ffmpeg-normalize/package.nix
index 0965b2e24413..c60497ee3e1a 100644
--- a/pkgs/by-name/ff/ffmpeg-normalize/package.nix
+++ b/pkgs/by-name/ff/ffmpeg-normalize/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ffmpeg-normalize";
-  version = "1.37.8";
+  version = "1.38.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "ffmpeg_normalize";
-    hash = "sha256-9pSVrYTTaxjGCty2pHPtaaSSwCkGDLoNK2wltTwOL3c=";
+    hash = "sha256-qn0E2AxadOvj80rAJ+i8vyGyid8/JD0wPSKMJbM8oX0=";
   };
 
   build-system = with python3Packages; [ uv-build ];

From 4ce9f78a6bd38e82598a4802bcdb0b8595ed3e84 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 11:16:50 +0000
Subject: [PATCH 81/83] python3Packages.pydocket: 0.21.1 -> 0.22.0

---
 pkgs/development/python-modules/pydocket/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pydocket/default.nix b/pkgs/development/python-modules/pydocket/default.nix
index c67c32a80dd4..d2ced9dba1a3 100644
--- a/pkgs/development/python-modules/pydocket/default.nix
+++ b/pkgs/development/python-modules/pydocket/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydocket";
-  version = "0.21.1";
+  version = "0.22.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
     owner = "chrisguidry";
     repo = "docket";
     tag = finalAttrs.version;
-    hash = "sha256-2YBX/PaR0ebQBkx/Z72TSxlTzY8MWBJu+0mEanLfvnU=";
+    hash = "sha256-WbOXUB6nYeD248K3pE5s1NIf+73dZcuqchQ/Nfw9AbA=";
   };
 
   build-system = [

From 9bdae476ae0c7650c3cd27fe1638ad737b659a1c Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Tue, 23 Jun 2026 13:17:30 +0200
Subject: [PATCH 82/83] nixos/tests/systemd-boot: fix update test for systemd
 261

This test breaks with systemd 261 because the parsing of PEs has been changed.
This fixes it by using a version that is closer to actual systemd
versions but still always older than any reasonable actual version of
systemd.
---
 nixos/tests/systemd-boot.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index c2d9131f1974..e001f11ce3a3 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -460,6 +460,9 @@ in
       nodes.machine = common;
 
       testScript =
+        let
+          oldVersion = "222";
+        in
         # python
         ''
           machine.succeed("mount -o remount,rw /boot")
@@ -469,13 +472,13 @@ in
               machine.succeed(
                 """
                 find /boot -iname '*boot*.efi' -print0 | \
-                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot 000.0-1-notnixos ####/' '{}'
+                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot ${oldVersion} ####/' '{}'
                 """
               )
               return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")
 
           output = switch()
-          assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
+          assert "updating systemd-boot from ${oldVersion} to " in output, "Couldn't find systemd-boot update message"
           assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
           assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
 
@@ -486,7 +489,7 @@ in
                   "mv /boot/EFI/BOOT/bootx64.efi.new /boot/EFI/BOOT/bootx64.efi",
               )
               output = switch()
-              assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
+              assert "updating systemd-boot from ${oldVersion} to " in output, "Couldn't find systemd-boot update message"
               assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
               assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
         '';

From 750c39e15073101fdef465eaa762e7ce441f9809 Mon Sep 17 00:00:00 2001
From: Jo-Blade <bladeur13@free.fr>
Date: Fri, 19 Jun 2026 17:12:10 +0200
Subject: [PATCH 83/83] ocamlPackages.windtrap: init at 0.1.0

---
 .../ocaml-modules/windtrap/default.nix        | 31 +++++++++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  2 ++
 2 files changed, 33 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/windtrap/default.nix

diff --git a/pkgs/development/ocaml-modules/windtrap/default.nix b/pkgs/development/ocaml-modules/windtrap/default.nix
new file mode 100644
index 000000000000..f5e1f82e123c
--- /dev/null
+++ b/pkgs/development/ocaml-modules/windtrap/default.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  fetchurl,
+  buildDunePackage,
+}:
+
+buildDunePackage {
+  pname = "windtrap";
+  version = "0.1.0";
+  minimalOCamlVersion = "5.0";
+
+  src = fetchurl {
+    url = "https://github.com/invariant-hq/windtrap/releases/download/0.1.0/windtrap-0.1.0.tbz";
+    hash = "sha256-IkGylLJO1dVuqLg00pbm+rxdvdkkqJ9RwUsA2mbFCiU=";
+  };
+
+  doCheck = true;
+
+  # this force to skip "collapse_home" tests, because $HOME != getpwuid in the
+  # sandbox
+  preCheck = ''
+    unset HOME
+  '';
+
+  meta = {
+    description = "Unit tests, property-based tests, snapshot tests, and expect tests in a single package with one API.";
+    homepage = "https://ocaml.org/p/windtrap";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.joblade ];
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 8913bb36c421..c2157ed3316c 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2261,6 +2261,8 @@ let
 
         webmachine = callPackage ../development/ocaml-modules/webmachine { };
 
+        windtrap = callPackage ../development/ocaml-modules/windtrap { };
+
         wtf8 = callPackage ../development/ocaml-modules/wtf8 { };
 
         ### X ###