From bb58f7f46c966747bdec7a7b581c2cec2cc5b7c7 Mon Sep 17 00:00:00 2001
From: Quinn Edenfield <william.edenfield@neuralink.com>
Date: Sat, 14 Jun 2025 21:02:55 -0700
Subject: [PATCH 01/60] maintainers: add quinneden

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c45018a4b839..ad3fe96e89af 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -20581,6 +20581,12 @@
     githubId = 39039420;
     name = "Quinn Dougherty";
   };
+  quinneden = {
+    email = "quinn@qeden.dev";
+    github = "quinneden";
+    githubId = 125415641;
+    name = "Quinn Edenfield";
+  };
   QuiNzX = {
     name = "QuiNz-";
     github = "QuiNzX";

From a8464be051fe50849eceb315ddb83794b957927b Mon Sep 17 00:00:00 2001
From: Quinn Edenfield <william.edenfield@neuralink.com>
Date: Mon, 1 Sep 2025 19:33:13 -0700
Subject: [PATCH 02/60] libkrun-efi: init at 1.15.1

---
 pkgs/by-name/li/libkrun-efi/package.nix | 117 ++++++++++++++++++++++++
 1 file changed, 117 insertions(+)
 create mode 100644 pkgs/by-name/li/libkrun-efi/package.nix

diff --git a/pkgs/by-name/li/libkrun-efi/package.nix b/pkgs/by-name/li/libkrun-efi/package.nix
new file mode 100644
index 000000000000..e140e811a2ee
--- /dev/null
+++ b/pkgs/by-name/li/libkrun-efi/package.nix
@@ -0,0 +1,117 @@
+{
+  cargo,
+  fetchFromGitHub,
+  fetchurl,
+  fixDarwinDylibNames,
+  lib,
+  libepoxy,
+  libkrun-efi,
+  moltenvk,
+  pkg-config,
+  rustc,
+  rustPlatform,
+  rutabaga_gfx,
+  nix-update-script,
+  stdenv,
+  buildPackages,
+  meson,
+  ninja,
+  vulkan-headers,
+  withGpu ? true,
+}:
+let
+  virglrenderer = stdenv.mkDerivation (finalAttrs: {
+    pname = "virglrenderer";
+    version = "0.10.4d-krunkit";
+
+    src = fetchurl {
+      url = "https://gitlab.freedesktop.org/slp/virglrenderer/-/archive/${finalAttrs.version}/virglrenderer-${finalAttrs.version}.tar.bz2";
+      hash = "sha256-M/buj97QUeY6CYeW0VICD5F6FBPi9ATPGHpNA48xL3o=";
+    };
+
+    separateDebugInfo = true;
+
+    buildInputs = [
+      libepoxy
+      moltenvk
+      vulkan-headers
+    ];
+
+    nativeBuildInputs = [
+      meson
+      ninja
+      pkg-config
+      (buildPackages.python3.withPackages (ps: [ ps.pyyaml ]))
+    ];
+
+    mesonFlags = [
+      (lib.mesonBool "render-server" false)
+      (lib.mesonBool "venus" true)
+      (lib.mesonEnable "drm" false)
+    ];
+
+    meta = {
+      description = "Virtual 3D GPU library that allows a qemu guest to use the host GPU for accelerated 3D rendering";
+      mainProgram = "virgl_test_server";
+      homepage = "https://gitlab.freedesktop.org/slp/virglrenderer";
+      license = lib.licenses.mit;
+      platforms = lib.platforms.unix;
+      maintainers = [ lib.maintainers.quinneden ];
+    };
+  });
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libkrun-efi";
+  version = "1.15.1";
+
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "libkrun";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VhlFyYJ/TH12I3dUq0JTus60rQEJq5H4Pm1puCnJV5A=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    hash = "sha256-dK3V7HCCvTqmQhB5Op2zmBPa9FO3h9gednU9tpQk+1U=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    fixDarwinDylibNames
+    pkg-config
+    rustc
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    libepoxy
+    rutabaga_gfx
+    virglrenderer
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "EFI=1"
+  ]
+  ++ lib.optional withGpu "GPU=1";
+
+  passthru = {
+    tests.withoutGpu = libkrun-efi.override { withGpu = false; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "EFI variant of Libkrun, a dynamic library providing Virtualization-based process isolation capabilities";
+    homepage = "https://github.com/containers/libkrun";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ quinneden ];
+    platforms = [ "aarch64-darwin" ];
+  };
+})

From 854b1ada11a6ce1b1a8e1ddbd73af3afc6bef288 Mon Sep 17 00:00:00 2001
From: Quinn Edenfield <william.edenfield@neuralink.com>
Date: Mon, 1 Sep 2025 19:33:13 -0700
Subject: [PATCH 03/60] krunkit: init at 1.0.0

---
 pkgs/by-name/kr/krunkit/package.nix | 58 +++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 pkgs/by-name/kr/krunkit/package.nix

diff --git a/pkgs/by-name/kr/krunkit/package.nix b/pkgs/by-name/kr/krunkit/package.nix
new file mode 100644
index 000000000000..230317284893
--- /dev/null
+++ b/pkgs/by-name/kr/krunkit/package.nix
@@ -0,0 +1,58 @@
+{
+  cargo,
+  darwin,
+  pkg-config,
+  rustc,
+  stdenv,
+  fetchFromGitHub,
+  libepoxy,
+  libkrun-efi,
+  rustPlatform,
+  lib,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "krunkit";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "krunkit";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dsEZZiLgHyd6xeXZCdDd4zsxzwQeIhAK+lewY2ZfvpY=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    hash = "sha256-i0cC3aOEqcvOcwTPbM6AazMzd8Q+QLwuhnvPGv3ntsc=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    darwin.sigtool
+    pkg-config
+    rustc
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    libepoxy
+    libkrun-efi
+  ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  # This is necessary in order for the binary to keep its entitlements
+  dontStrip = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Launch configurable virtual machines with libkrun";
+    homepage = "https://github.com/containers/krunkit";
+    license = lib.licenses.asl20;
+    platforms = [ "aarch64-darwin" ];
+    maintainers = with lib.maintainers; [ quinneden ];
+  };
+})

From 6923418913b7d3c9a5cfd81a251a1de27004de84 Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Mon, 6 Oct 2025 19:00:47 +0200
Subject: [PATCH 04/60] teleport: make teleport_18 default version

---
 pkgs/by-name/te/teleport/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/te/teleport/package.nix b/pkgs/by-name/te/teleport/package.nix
index 93697b54bc97..64af74563365 100644
--- a/pkgs/by-name/te/teleport/package.nix
+++ b/pkgs/by-name/te/teleport/package.nix
@@ -1,5 +1,5 @@
 {
-  teleport_17,
+  teleport_18,
 }:
 
-teleport_17
+teleport_18

From 3de456148f75c5910c66659d04e35e055ba9482b Mon Sep 17 00:00:00 2001
From: JuliusFreudenberger <julius+git@jfreudenberger.de>
Date: Mon, 6 Oct 2025 19:02:50 +0200
Subject: [PATCH 05/60] nixos/rl-2511: update of teleport default version

---
 nixos/doc/manual/release-notes/rl-2511.section.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index adc084518d04..c517936bd1ec 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -188,6 +188,10 @@
 
 - `services.gateone` has been removed as the package was removed such that it does not work.
 
+- `teleport` has been upgraded from major version 17 to major version 18.
+Refer to [upstream upgrade instructions](https://goteleport.com/docs/upgrading/overview/)
+and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
+
 - `services.dwm-status.extraConfig` was replaced by [RFC0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant [](#opt-services.dwm-status.settings), which is used to generate the config file. `services.dwm-status.order` is now moved to [](#opt-services.dwm-status.settings.order), as it's a part of the config file.
 
 - `gitversion` was updated to 6.3.0, which includes a number of breaking changes, old configurations may need updating or they will cause the tool to fail to run.

From f13458f7b8e1393fa73aacaf9153850b8b95bc3b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 16 Oct 2025 14:39:08 +0000
Subject: [PATCH 06/60] sing-box: 1.12.9 -> 1.12.10

---
 pkgs/by-name/si/sing-box/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/si/sing-box/package.nix b/pkgs/by-name/si/sing-box/package.nix
index 285cadf26edb..b7db2b8d0f35 100644
--- a/pkgs/by-name/si/sing-box/package.nix
+++ b/pkgs/by-name/si/sing-box/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sing-box";
-  version = "1.12.9";
+  version = "1.12.10";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = "sing-box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1sN1VE+3CMI/rDiADpPJFv9NsxOvulLjGTE38CQOJzo=";
+    hash = "sha256-ZnpvE/x2+kKlKYuez1VaVx7qkybYhRTqfg7yorZpxfc=";
   };
 
-  vendorHash = "sha256-Cx9SD5FTiyISRpWxlUsxeGP1M39YJQrWpRPaK1o6H08=";
+  vendorHash = "sha256-D4nfi5PzcL9CcgLvm09DmF2Ws1o4wIH0zjgv1qDP7Nw=";
 
   tags = [
     "with_quic"

From f4bb20607f302e804bf0d51c43055342107a2470 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 18 Oct 2025 00:39:47 +0000
Subject: [PATCH 07/60] python3Packages.copier: 9.10.2 -> 9.10.3

---
 pkgs/development/python-modules/copier/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/copier/default.nix b/pkgs/development/python-modules/copier/default.nix
index af924d10e4ca..ccfd20310fb3 100644
--- a/pkgs/development/python-modules/copier/default.nix
+++ b/pkgs/development/python-modules/copier/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage rec {
   pname = "copier";
-  version = "9.10.2";
+  version = "9.10.3";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm $out/tests/demo/doc/ma*ana.txt
     '';
-    hash = "sha256-vO807Jzl04DkiHPBhu3cGK0bhn2Cd2dT1nKznQKP/p0=";
+    hash = "sha256-ZBRJ4FrdhtKr273D2amwA3dJhISZAORqFqoh//963Fg=";
   };
 
   POETRY_DYNAMIC_VERSIONING_BYPASS = version;

From 5c5c689522aebc5f922c01db3a2839abffbb377c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 18 Oct 2025 14:59:03 +0000
Subject: [PATCH 08/60] peergos: 1.12.0 -> 1.13.0

---
 pkgs/by-name/pe/peergos/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pe/peergos/package.nix b/pkgs/by-name/pe/peergos/package.nix
index c0ac21fe07ac..49bbfd223761 100644
--- a/pkgs/by-name/pe/peergos/package.nix
+++ b/pkgs/by-name/pe/peergos/package.nix
@@ -41,12 +41,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "peergos";
-  version = "1.12.0";
+  version = "1.13.0";
   src = fetchFromGitHub {
     owner = "Peergos";
     repo = "web-ui";
     rev = "v${version}";
-    hash = "sha256-PwjSMW5d/M/IShclyFqAZJ75+dq0xSCnZmYsdKN5/O0=";
+    hash = "sha256-gyhNb68W3UF9t0AvQULQp3aEIjRUzss9XgQbHrrrsk8=";
     fetchSubmodules = true;
   };
 

From b8af8f2e3d726fb4e942fe459c922ec71338b8d1 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 20 Oct 2025 02:25:10 +0800
Subject: [PATCH 09/60] limine: convert boolean values

---
 .../boot/loader/limine/limine-install.py      | 21 +++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/system/boot/loader/limine/limine-install.py b/nixos/modules/system/boot/loader/limine/limine-install.py
index f4a4245f141c..a64f34eaefc3 100644
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -51,6 +51,11 @@ def config(*path: str) -> Optional[Any]:
         result = result[component]
     return result
 
+
+def bool_to_yes_no(value: bool) -> str:
+    return 'yes' if value else 'no'
+
+
 def get_system_path(profile: str = 'system', gen: Optional[str] = None, spec: Optional[str] = None) -> str:
     basename = f'{profile}-{gen}-link' if gen is not None else profile
     profiles_dir = '/nix/var/nix/profiles'
@@ -377,10 +382,14 @@ def copy_file(from_path: str, to_path: str):
 
     paths[to_path] = True
 
-def option_from_config(name: str, config_path: List[str], conversion: Callable[[str], str] | None = None) -> str:
-    if config(*config_path):
-        return f'{name}: {conversion(config(*config_path)) if conversion else config(*config_path)}\n'
-    return ''
+
+def option_from_config(name: str, config_path: List[str]) -> str:
+    value = config(*config_path)
+    if value is None:
+        return ""
+    if isinstance(value, bool):
+        value = bool_to_yes_no(value)
+    return f"{name}: {config(*config_path)}\n"
 
 
 def install_bootloader() -> None:
@@ -439,8 +448,8 @@ def install_bootloader() -> None:
         profiles += [(profile, get_gens(profile))]
 
     timeout = config('timeout')
-    editor_enabled = 'yes' if config('enableEditor') else 'no'
-    hash_mismatch_panic = 'yes' if config('panicOnChecksumMismatch') else 'no'
+    editor_enabled = bool_to_yes_no(config('enableEditor'))
+    hash_mismatch_panic = bool_to_yes_no(config('panicOnChecksumMismatch'))
 
     last_gen = get_gens()[-1]
     last_gen_json = json.load(open(os.path.join(get_system_path('system', last_gen), 'boot.json'), 'r'))

From 2a834de6bed7aa92bc06443beed6b2bdd39a7aee Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Wed, 1 Oct 2025 19:36:52 +0200
Subject: [PATCH 10/60] harper: 0.65.0 -> 0.66.0

Changelog: https://github.com/Automattic/harper/releases/tag/v0.66.0
Diff: https://github.com/Automattic/harper/compare/v0.65.0...v0.66.0
---
 pkgs/by-name/ha/harper/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index fea0e094595c..16a0272d38bb 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.65.0";
+  version = "0.66.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-y2oYEJTZWZ7Rc7ZLjYUh3Cy9dtznGLhIXzJ6D0JUIGw=";
+    hash = "sha256-b4KGpW+Axtd0JMxdGuW7UK8GD2WxiDQpjQo1qnzMI0Q=";
   };
 
   buildAndTestSubdir = "harper-ls";
 
-  cargoHash = "sha256-o6RFBCvPn3AH3mMI3guHziqOcYN99o8yk5b6VXWoepI=";
+  cargoHash = "sha256-5zs4jh7o0ROl82eIOyscmaQv42kKJSVO0LD/VkmzQw4=";
 
   passthru.updateScript = nix-update-script { };
 

From 15686a5fadc9ca1171380c54936988c797107d84 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Tue, 7 Oct 2025 09:04:20 +0200
Subject: [PATCH 11/60] harper: 0.66.0 -> 0.67.0

Changelog: https://github.com/Automattic/harper/releases/tag/v0.67.0
Diff: https://github.com/Automattic/harper/compare/v0.66.0...v0.67.0
---
 pkgs/by-name/ha/harper/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index 16a0272d38bb..8a7195ae1107 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.66.0";
+  version = "0.67.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-b4KGpW+Axtd0JMxdGuW7UK8GD2WxiDQpjQo1qnzMI0Q=";
+    hash = "sha256-PqMThAZyImufW6i+OBzUPGIGyKwX9F6dNCoVPsjFom0=";
   };
 
   buildAndTestSubdir = "harper-ls";
 
-  cargoHash = "sha256-5zs4jh7o0ROl82eIOyscmaQv42kKJSVO0LD/VkmzQw4=";
+  cargoHash = "sha256-0ksfMkDUIwSSKaNQZAb+tZYes2YoAih6niBJ4mm0icE=";
 
   passthru.updateScript = nix-update-script { };
 

From 3671f9ddb7a87951b9d61a679d1b971ef0488494 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Thu, 16 Oct 2025 09:57:35 +0200
Subject: [PATCH 12/60] harper: 0.67.0 -> 0.68.0

Changelog: https://github.com/Automattic/harper/releases/tag/v0.68.0
Diff: https://github.com/Automattic/harper/compare/v0.67.0...v0.68.0
---
 .../vscode/extensions/elijah-potter.harper/default.nix      | 2 +-
 pkgs/by-name/ha/harper/package.nix                          | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix b/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
index 93e87a47131c..b080f2fa1ad2 100644
--- a/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
@@ -13,7 +13,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "harper";
     publisher = "elijah-potter";
     version = harper.version;
-    hash = "sha256-m9PN1BZf6rLrNnX8meX2TjGx8zGLl0GgnHEgQirh9Oc=";
+    hash = "sha256-kWO3Gd2g5IsMCg+rvlQ3LpU/g5hUrpCsg3+vmOO0mnA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index 8a7195ae1107..4fd9bff2db9a 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.67.0";
+  version = "0.68.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-PqMThAZyImufW6i+OBzUPGIGyKwX9F6dNCoVPsjFom0=";
+    hash = "sha256-NYbTz/+APVGU8P0edXz84YBbBWBc8k7rhDXpRxH7Pjc=";
   };
 
   buildAndTestSubdir = "harper-ls";
 
-  cargoHash = "sha256-0ksfMkDUIwSSKaNQZAb+tZYes2YoAih6niBJ4mm0icE=";
+  cargoHash = "sha256-3Vk8nQPUxD1D6AG6PjJwju5xolvfVucfYL9i6l9atOk=";
 
   passthru.updateScript = nix-update-script { };
 

From 7e74f12c36b134d955305b472b38739b0c807780 Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Mon, 20 Oct 2025 17:05:01 +0000
Subject: [PATCH 13/60] linux_xanmod: 6.12.53 -> 6.12.54

- Changelog: https://dl.xanmod.org/changelog/6.12/ChangeLog-6.12.54-xanmod1.gz
- Diff: https://gitlab.com/xanmod/linux/-/compare/6.12.53-xanmod1..6.12.54-xanmod1?from_project_id=51590166
---
 pkgs/os-specific/linux/kernel/xanmod-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 80beae4c400d..61683ba1860c 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,8 +15,8 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.12.53";
-      hash = "sha256-BhaWUdfCgIvD0LA69I1NVIW0rv6JWQs+7HNLxOkrmGc=";
+      version = "6.12.54";
+      hash = "sha256-8ZeVHP8voR4GJfBB1iM8ZDx4QgCd83tJ7IkpJNW63ME=";
       isLTS = true;
     };
     # ./update-xanmod.sh main

From 22c0bb9dddce6d4d61ccf04f3c15340f686deadf Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Mon, 20 Oct 2025 17:08:04 +0000
Subject: [PATCH 14/60] linux_xanmod_latest: 6.17.3 -> 6.17.4

- Changelog: https://dl.xanmod.org/changelog/6.17/ChangeLog-6.17.4-xanmod1.gz
- Diff: https://gitlab.com/xanmod/linux/-/compare/6.17.3-xanmod1..6.17.4-xanmod1?from_project_id=51590166
---
 pkgs/os-specific/linux/kernel/xanmod-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 61683ba1860c..edc5aa9fc5f2 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -21,8 +21,8 @@ let
     };
     # ./update-xanmod.sh main
     main = {
-      version = "6.17.3";
-      hash = "sha256-VL1SCMB89P0UcCbtPdkjxcCZqQZpnSTlzzf9e8uzkyA=";
+      version = "6.17.4";
+      hash = "sha256-UHfZwK0qIVhiKw8OpE8i+V2BRav6Fsju8E5rO5WRwVA=";
     };
   };
 

From eced5cf47d1f438e433290cec692ce16a1e32fee Mon Sep 17 00:00:00 2001
From: Yiyu Zhou <yiyuzhou19@gmail.com>
Date: Mon, 20 Oct 2025 11:34:07 -0700
Subject: [PATCH 15/60] woodpecker: remove deprecated subcommands of nix hash

---
 .../tools/continuous-integration/woodpecker/update.sh           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/continuous-integration/woodpecker/update.sh b/pkgs/development/tools/continuous-integration/woodpecker/update.sh
index 98c2888c27de..10b16d9f5062 100755
--- a/pkgs/development/tools/continuous-integration/woodpecker/update.sh
+++ b/pkgs/development/tools/continuous-integration/woodpecker/update.sh
@@ -28,5 +28,5 @@ sed -i -E -e "s#version = \".*\"#version = \"$version\"#" common.nix
 
 # Woodpecker repository
 src_hash=$(nix-prefetch-url --type sha256 --unpack "https://github.com/woodpecker-ci/woodpecker/releases/download/v$version/woodpecker-src.tar.gz")
-src_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$src_hash")
+src_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$src_hash")
 sed -i -E -e "s#srcHash = \".*\"#srcHash = \"$src_hash\"#" common.nix

From 6e8317c620e07acfe9342393874c057df1ffebb4 Mon Sep 17 00:00:00 2001
From: Yiyu Zhou <yiyuzhou19@gmail.com>
Date: Mon, 20 Oct 2025 11:42:17 -0700
Subject: [PATCH 16/60] woodpecker: cleanup

---
 .../tools/continuous-integration/woodpecker/common.nix   | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/tools/continuous-integration/woodpecker/common.nix b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
index ee8f8106657a..aaae68d75956 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/common.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@@ -2,8 +2,7 @@
 let
   version = "3.11.0";
   srcHash = "sha256-mLyEHNMePVZI6MOSyeD9NMp9QXRXQ7h3LFSxHxpf878=";
-  # The tarball contains vendored dependencies
-  vendorHash = null;
+  vendorHash = null; # The tarball contains vendored dependencies
 in
 {
   inherit version vendorHash;
@@ -38,11 +37,11 @@ in
     "-X go.woodpecker-ci.org/woodpecker/v3/version.Version=${version}"
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://woodpecker-ci.org/";
     changelog = "https://github.com/woodpecker-ci/woodpecker/blob/v${version}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       ambroisie
       marcusramberg
       techknowlogick

From eeedb0d9d6b9c2a949ced07aea9843ccb31e7647 Mon Sep 17 00:00:00 2001
From: 0x4A6F <0x4A6F@users.noreply.github.com>
Date: Mon, 20 Oct 2025 17:58:01 +0200
Subject: [PATCH 17/60] containerlabs: 0.70.2 -> 0.71.0

Release: https://github.com/srl-labs/containerlab/releases/tag/v0.71.0
Changes: https://github.com/srl-labs/containerlab/compare/v0.70.2...v0.71.0

- adopt package
---
 pkgs/by-name/co/containerlab/package.nix | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/co/containerlab/package.nix b/pkgs/by-name/co/containerlab/package.nix
index f0f2b220ecab..29a2eadcdbc0 100644
--- a/pkgs/by-name/co/containerlab/package.nix
+++ b/pkgs/by-name/co/containerlab/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "containerlab";
-  version = "0.70.2";
+  version = "0.71.0";
 
   src = fetchFromGitHub {
     owner = "srl-labs";
     repo = "containerlab";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QBv0SZ7XxVc0yWbOxPKdfzk9AKYlMJyeZwpAx1jbamk=";
+    hash = "sha256-wfkkRQ0F8G57pEuyLP1qjoZGkDNW/Ix4Nh3ZKoWK+w8=";
   };
 
-  vendorHash = "sha256-XttJ/GXhNKVHLR33A/o3N3OYHsyKWHBhD5QOz0AlfFk=";
+  vendorHash = "sha256-s5WBCYOdNooygEL0AbhIqZLeWd4gnpAvWjJu38QTKYU=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -37,9 +37,10 @@ buildGoModule (finalAttrs: {
     export USER="runner"
   '';
 
-  # TestVerifyLinks wants to use docker.sock which is not available in the Nix build env
-  # KernelModulesLoaded wants to use /proc/modules which is not available in Nix build env
   checkFlags = [
+    # Not available in sandbox:
+    # - docker.sock needed for TestVerifyLinks
+    # - /proc/modules needed for KernelModulesLoaded
     "-skip=^TestVerifyLinks$|^TestIsKernelModuleLoaded$"
   ];
 
@@ -60,7 +61,7 @@ buildGoModule (finalAttrs: {
     changelog = "https://github.com/srl-labs/containerlab/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ _0x4A6F ];
     mainProgram = "containerlab";
   };
 })

From 3379edc0b0e819751e666ed085f4fc1c1fe6a131 Mon Sep 17 00:00:00 2001
From: 0x4A6F <0x4A6F@users.noreply.github.com>
Date: Tue, 21 Oct 2025 08:11:52 +0200
Subject: [PATCH 18/60] rotonda: 0.4.2 -> 0.5.0

Release: https://github.com/NLnetLabs/rotonda/releases/tag/v0.5.0
Changes: https://github.com/NLnetLabs/rotonda/compare/v0.4.2...v0.5.0
---
 pkgs/by-name/ro/rotonda/package.nix | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/ro/rotonda/package.nix b/pkgs/by-name/ro/rotonda/package.nix
index 6d18cef194b9..12f5ee3ba95e 100644
--- a/pkgs/by-name/ro/rotonda/package.nix
+++ b/pkgs/by-name/ro/rotonda/package.nix
@@ -10,18 +10,23 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rotonda";
-  version = "0.4.2";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "rotonda";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B2sdQr9PctWZBpDuatJkUApW5T98BQa4HiqL8+HHevY=";
+    hash = "sha256-7SVhxUpQq1CCDYNc0xza/2ixjKF8kHBSobt4S+azLQU=";
   };
 
-  cargoHash = "sha256-XbBlA7QYUtD4uBz4t5ZR70o9bMgVLeSzq6Lexe0jzME=";
+  cargoHash = "sha256-4wldyvg0VOFTlM0FN/BSsyDNp5HbRumw4Lv4VEJlPfI=";
 
-  checkFlags =
+  checkFlags = [
+    # Broken in sandbox:
+    "--skip=http_api_responses_multiple_gets"
+    "--skip=representation::genoutput_json"
+  ]
+  ++
     lib.optionals
       (stdenv.hostPlatform.system == "aarch64-darwin" || stdenv.hostPlatform.system == "x86_64-darwin")
       [
@@ -36,10 +41,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru = {
     updateScript = nix-update-script { };
     tests.version = testers.testVersion {
-      package = rotonda;
-      command = "rotonda --version";
-      # tag/release with this version string, please revert to `inherit (finalAttrs) version;` on next release
-      version = "0.4.3-dev";
+      package = finalAttrs.finalPackage;
     };
   };
 

From 9b5f114a4a214960ce68a8d962624ff5bb701aa4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 21 Oct 2025 15:10:58 +0000
Subject: [PATCH 19/60] plakar: 1.0.4 -> 1.0.5

---
 pkgs/by-name/pl/plakar/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pl/plakar/package.nix b/pkgs/by-name/pl/plakar/package.nix
index 336064592473..dab7c6e06394 100644
--- a/pkgs/by-name/pl/plakar/package.nix
+++ b/pkgs/by-name/pl/plakar/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "plakar";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchFromGitHub {
     owner = "PlakarKorp";
     repo = "plakar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gClQiXZEPui7g3Ps6yhB2tN36PnkqADo9iD4Gm6DpD4=";
+    hash = "sha256-cuPz0xg/cGKczHLpFqSBfFD7KlygCX6fnfrigv0K2Zs=";
   };
 
-  vendorHash = "sha256-JVk8wiuuicwWgEbqIjp7ryC4k3uc4DiXnJ5FxYbXV5M=";
+  vendorHash = "sha256-ySzDtj8EdGcWl6H1q44+QR5ebSC76leVygl+c8fa7sk=";
 
   buildInputs = [
     fuse

From 385547cc9afffacf196fb14fba9a82c9a240cada Mon Sep 17 00:00:00 2001
From: Andrew Zah <zah@andrewzah.com>
Date: Tue, 21 Oct 2025 15:32:19 +0900
Subject: [PATCH 20/60] anki,anki-bin,anki-utils,anki-sync-server,ankiAddons:
 mv to pkgs/by-name

* mv `anki`, `anki-bin`, `anki-sync-server` into pkgs/by-name
  * `ankiAddons` and `anki-utils` are under `anki`
---
 .../anki/bin.nix => by-name/an/anki-bin/package.nix}     | 0
 .../an/anki-sync-server/package.nix}                     | 0
 .../an}/anki/addons/adjust-sound-volume/default.nix      | 0
 .../an}/anki/addons/anki-connect/default.nix             | 0
 .../addons/anki-quizlet-importer-extended/default.nix    | 0
 pkgs/{games => by-name/an}/anki/addons/anki-utils.nix    | 0
 pkgs/{games => by-name/an}/anki/addons/default.nix       | 0
 .../an}/anki/addons/local-audio-yomichan/default.nix     | 0
 .../an}/anki/addons/passfail2/default.nix                | 0
 .../an}/anki/addons/puppy-reinforcement/default.nix      | 0
 .../an}/anki/addons/recolor/default.nix                  | 0
 ...0001-Apply-vite-style-to-anki-review-heatmap.js.patch | 0
 .../an}/anki/addons/review-heatmap/default.nix           | 0
 .../an}/anki/addons/reviewer-refocus-card/default.nix    | 0
 .../an}/anki/addons/yomichan-forvo-server/default.nix    | 0
 pkgs/{games => by-name/an}/anki/missing-hashes.json      | 0
 .../anki/default.nix => by-name/an/anki/package.nix}     | 4 ++--
 .../an}/anki/patches/allow-setting-addons-folder.patch   | 0
 .../an}/anki/patches/disable-auto-update.patch           | 0
 .../anki/patches/remove-the-gl-library-workaround.patch  | 0
 .../an}/anki/patches/skip-formatting-python-code.patch   | 0
 pkgs/{games => by-name/an}/anki/update.sh                | 0
 pkgs/{games => by-name/an}/anki/uv-deps.json             | 0
 pkgs/{games => by-name/an}/anki/with-addons.nix          | 0
 pkgs/top-level/all-packages.nix                          | 9 ++-------
 25 files changed, 4 insertions(+), 9 deletions(-)
 rename pkgs/{games/anki/bin.nix => by-name/an/anki-bin/package.nix} (100%)
 rename pkgs/{games/anki/sync-server.nix => by-name/an/anki-sync-server/package.nix} (100%)
 rename pkgs/{games => by-name/an}/anki/addons/adjust-sound-volume/default.nix (100%)
 rename pkgs/{games => by-name/an}/anki/addons/anki-connect/default.nix (100%)
 rename pkgs/{games => by-name/an}/anki/addons/anki-quizlet-importer-extended/default.nix (100%)
 rename pkgs/{games => by-name/an}/anki/addons/anki-utils.nix (100%)
 rename pkgs/{games => by-name/an}/anki/addons/default.nix (100%)
 rename pkgs/{games => by-name/an}/anki/addons/local-audio-yomichan/default.nix (100%)
 rename pkgs/{games => by-name/an}/anki/addons/passfail2/default.nix (100%)
 rename pkgs/{games => by-name/an}/anki/addons/puppy-reinforcement/default.nix (100%)
 rename pkgs/{games => by-name/an}/anki/addons/recolor/default.nix (100%)
 rename pkgs/{games => by-name/an}/anki/addons/review-heatmap/0001-Apply-vite-style-to-anki-review-heatmap.js.patch (100%)
 rename pkgs/{games => by-name/an}/anki/addons/review-heatmap/default.nix (100%)
 rename pkgs/{games => by-name/an}/anki/addons/reviewer-refocus-card/default.nix (100%)
 rename pkgs/{games => by-name/an}/anki/addons/yomichan-forvo-server/default.nix (100%)
 rename pkgs/{games => by-name/an}/anki/missing-hashes.json (100%)
 rename pkgs/{games/anki/default.nix => by-name/an/anki/package.nix} (99%)
 rename pkgs/{games => by-name/an}/anki/patches/allow-setting-addons-folder.patch (100%)
 rename pkgs/{games => by-name/an}/anki/patches/disable-auto-update.patch (100%)
 rename pkgs/{games => by-name/an}/anki/patches/remove-the-gl-library-workaround.patch (100%)
 rename pkgs/{games => by-name/an}/anki/patches/skip-formatting-python-code.patch (100%)
 rename pkgs/{games => by-name/an}/anki/update.sh (100%)
 rename pkgs/{games => by-name/an}/anki/uv-deps.json (100%)
 rename pkgs/{games => by-name/an}/anki/with-addons.nix (100%)

diff --git a/pkgs/games/anki/bin.nix b/pkgs/by-name/an/anki-bin/package.nix
similarity index 100%
rename from pkgs/games/anki/bin.nix
rename to pkgs/by-name/an/anki-bin/package.nix
diff --git a/pkgs/games/anki/sync-server.nix b/pkgs/by-name/an/anki-sync-server/package.nix
similarity index 100%
rename from pkgs/games/anki/sync-server.nix
rename to pkgs/by-name/an/anki-sync-server/package.nix
diff --git a/pkgs/games/anki/addons/adjust-sound-volume/default.nix b/pkgs/by-name/an/anki/addons/adjust-sound-volume/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/adjust-sound-volume/default.nix
rename to pkgs/by-name/an/anki/addons/adjust-sound-volume/default.nix
diff --git a/pkgs/games/anki/addons/anki-connect/default.nix b/pkgs/by-name/an/anki/addons/anki-connect/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/anki-connect/default.nix
rename to pkgs/by-name/an/anki/addons/anki-connect/default.nix
diff --git a/pkgs/games/anki/addons/anki-quizlet-importer-extended/default.nix b/pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/anki-quizlet-importer-extended/default.nix
rename to pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix
diff --git a/pkgs/games/anki/addons/anki-utils.nix b/pkgs/by-name/an/anki/addons/anki-utils.nix
similarity index 100%
rename from pkgs/games/anki/addons/anki-utils.nix
rename to pkgs/by-name/an/anki/addons/anki-utils.nix
diff --git a/pkgs/games/anki/addons/default.nix b/pkgs/by-name/an/anki/addons/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/default.nix
rename to pkgs/by-name/an/anki/addons/default.nix
diff --git a/pkgs/games/anki/addons/local-audio-yomichan/default.nix b/pkgs/by-name/an/anki/addons/local-audio-yomichan/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/local-audio-yomichan/default.nix
rename to pkgs/by-name/an/anki/addons/local-audio-yomichan/default.nix
diff --git a/pkgs/games/anki/addons/passfail2/default.nix b/pkgs/by-name/an/anki/addons/passfail2/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/passfail2/default.nix
rename to pkgs/by-name/an/anki/addons/passfail2/default.nix
diff --git a/pkgs/games/anki/addons/puppy-reinforcement/default.nix b/pkgs/by-name/an/anki/addons/puppy-reinforcement/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/puppy-reinforcement/default.nix
rename to pkgs/by-name/an/anki/addons/puppy-reinforcement/default.nix
diff --git a/pkgs/games/anki/addons/recolor/default.nix b/pkgs/by-name/an/anki/addons/recolor/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/recolor/default.nix
rename to pkgs/by-name/an/anki/addons/recolor/default.nix
diff --git a/pkgs/games/anki/addons/review-heatmap/0001-Apply-vite-style-to-anki-review-heatmap.js.patch b/pkgs/by-name/an/anki/addons/review-heatmap/0001-Apply-vite-style-to-anki-review-heatmap.js.patch
similarity index 100%
rename from pkgs/games/anki/addons/review-heatmap/0001-Apply-vite-style-to-anki-review-heatmap.js.patch
rename to pkgs/by-name/an/anki/addons/review-heatmap/0001-Apply-vite-style-to-anki-review-heatmap.js.patch
diff --git a/pkgs/games/anki/addons/review-heatmap/default.nix b/pkgs/by-name/an/anki/addons/review-heatmap/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/review-heatmap/default.nix
rename to pkgs/by-name/an/anki/addons/review-heatmap/default.nix
diff --git a/pkgs/games/anki/addons/reviewer-refocus-card/default.nix b/pkgs/by-name/an/anki/addons/reviewer-refocus-card/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/reviewer-refocus-card/default.nix
rename to pkgs/by-name/an/anki/addons/reviewer-refocus-card/default.nix
diff --git a/pkgs/games/anki/addons/yomichan-forvo-server/default.nix b/pkgs/by-name/an/anki/addons/yomichan-forvo-server/default.nix
similarity index 100%
rename from pkgs/games/anki/addons/yomichan-forvo-server/default.nix
rename to pkgs/by-name/an/anki/addons/yomichan-forvo-server/default.nix
diff --git a/pkgs/games/anki/missing-hashes.json b/pkgs/by-name/an/anki/missing-hashes.json
similarity index 100%
rename from pkgs/games/anki/missing-hashes.json
rename to pkgs/by-name/an/anki/missing-hashes.json
diff --git a/pkgs/games/anki/default.nix b/pkgs/by-name/an/anki/package.nix
similarity index 99%
rename from pkgs/games/anki/default.nix
rename to pkgs/by-name/an/anki/package.nix
index 57d68b125fbc..ec4f2405a974 100644
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/by-name/an/anki/package.nix
@@ -14,7 +14,7 @@
   nixosTests,
   nodejs,
   jq,
-  protobuf,
+  protobuf_31,
   python3,
   python3Packages,
   qt6,
@@ -176,7 +176,7 @@ python3Packages.buildPythonApplication rec {
     # https://github.com/ankitects/anki/blob/24.11/docs/linux.md#packaging-considerations
     OFFLINE_BUILD = "1";
     NODE_BINARY = lib.getExe nodejs;
-    PROTOC_BINARY = lib.getExe protobuf;
+    PROTOC_BINARY = lib.getExe protobuf_31;
     PYTHON_BINARY = lib.getExe python3;
     UV_BINARY = lib.getExe uv;
     UV_NO_MANAGED_PYTHON = "1";
diff --git a/pkgs/games/anki/patches/allow-setting-addons-folder.patch b/pkgs/by-name/an/anki/patches/allow-setting-addons-folder.patch
similarity index 100%
rename from pkgs/games/anki/patches/allow-setting-addons-folder.patch
rename to pkgs/by-name/an/anki/patches/allow-setting-addons-folder.patch
diff --git a/pkgs/games/anki/patches/disable-auto-update.patch b/pkgs/by-name/an/anki/patches/disable-auto-update.patch
similarity index 100%
rename from pkgs/games/anki/patches/disable-auto-update.patch
rename to pkgs/by-name/an/anki/patches/disable-auto-update.patch
diff --git a/pkgs/games/anki/patches/remove-the-gl-library-workaround.patch b/pkgs/by-name/an/anki/patches/remove-the-gl-library-workaround.patch
similarity index 100%
rename from pkgs/games/anki/patches/remove-the-gl-library-workaround.patch
rename to pkgs/by-name/an/anki/patches/remove-the-gl-library-workaround.patch
diff --git a/pkgs/games/anki/patches/skip-formatting-python-code.patch b/pkgs/by-name/an/anki/patches/skip-formatting-python-code.patch
similarity index 100%
rename from pkgs/games/anki/patches/skip-formatting-python-code.patch
rename to pkgs/by-name/an/anki/patches/skip-formatting-python-code.patch
diff --git a/pkgs/games/anki/update.sh b/pkgs/by-name/an/anki/update.sh
similarity index 100%
rename from pkgs/games/anki/update.sh
rename to pkgs/by-name/an/anki/update.sh
diff --git a/pkgs/games/anki/uv-deps.json b/pkgs/by-name/an/anki/uv-deps.json
similarity index 100%
rename from pkgs/games/anki/uv-deps.json
rename to pkgs/by-name/an/anki/uv-deps.json
diff --git a/pkgs/games/anki/with-addons.nix b/pkgs/by-name/an/anki/with-addons.nix
similarity index 100%
rename from pkgs/games/anki/with-addons.nix
rename to pkgs/by-name/an/anki/with-addons.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c967d8f89074..c62100ef4843 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13196,13 +13196,8 @@ with pkgs;
 
   qgo = libsForQt5.callPackage ../games/qgo { };
 
-  anki = callPackage ../games/anki {
-    protobuf = protobuf_31;
-  };
-  anki-utils = callPackage ../games/anki/addons/anki-utils.nix { };
-  ankiAddons = recurseIntoAttrs (callPackage ../games/anki/addons { });
-  anki-bin = callPackage ../games/anki/bin.nix { };
-  anki-sync-server = callPackage ../games/anki/sync-server.nix { };
+  anki-utils = callPackage ../by-name/an/anki/addons/anki-utils.nix { };
+  ankiAddons = recurseIntoAttrs (callPackage ../by-name/an/anki/addons { });
 
   art = callPackage ../by-name/ar/art/package.nix {
     fftw = fftwSinglePrec;

From d0055576c6258ad5506dcc3087071fd4317f5b53 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 21 Oct 2025 19:00:19 +0200
Subject: [PATCH 21/60] python313Packages.cyclopts: 3.24.0 -> 4.0.0

Changelog: https://github.com/BrianPugh/cyclopts/releases/tag/v4.0.0
---
 .../python-modules/cyclopts/default.nix       | 25 ++++++++++---------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/cyclopts/default.nix b/pkgs/development/python-modules/cyclopts/default.nix
index f01ac6e888cc..d2b79bff7003 100644
--- a/pkgs/development/python-modules/cyclopts/default.nix
+++ b/pkgs/development/python-modules/cyclopts/default.nix
@@ -4,12 +4,11 @@
   buildPythonPackage,
   docstring-parser,
   fetchFromGitHub,
-  poetry-core,
-  poetry-dynamic-versioning,
+  hatchling,
+  hatch-vcs,
   pydantic,
   pytest-mock,
   pytestCheckHook,
-  pythonOlder,
   pyyaml,
   rich-rst,
   rich,
@@ -18,21 +17,19 @@
 
 buildPythonPackage rec {
   pname = "cyclopts";
-  version = "3.24.0";
+  version = "4.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.12";
-
   src = fetchFromGitHub {
     owner = "BrianPugh";
     repo = "cyclopts";
     tag = "v${version}";
-    hash = "sha256-gJflZBH3xCGKffKGt7y1xGXQR8C1wK19LnbunZ0kbAc=";
+    hash = "sha256-efc3P5xOy6YTWoCNOjatjELOEUh6Obfkf8U94GO4+40=";
   };
 
   build-system = [
-    poetry-core
-    poetry-dynamic-versioning
+    hatchling
+    hatch-vcs
   ];
 
   dependencies = [
@@ -51,15 +48,19 @@ buildPythonPackage rec {
     pydantic
     pytest-mock
     pytestCheckHook
-    pyyaml
   ]
   ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   pythonImportsCheck = [ "cyclopts" ];
 
   disabledTests = [
-    # Assertion error
-    "test_pydantic_error_msg"
+    # Test requires bash
+    "test_positional_not_treated_as_command"
+  ];
+
+  disabledTestPaths = [
+    # Tests requires sphinx
+    "tests/test_sphinx_ext.py"
   ];
 
   meta = with lib; {

From 13b4ef935774807551d5c8fe546f77f5b8386d0d Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 21 Oct 2025 20:33:41 +0200
Subject: [PATCH 22/60] =?UTF-8?q?ocamlPackages.graphql=5Fppx:=201.2.2=20?=
 =?UTF-8?q?=E2=86=92=201.2.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../ocaml-modules/graphql_ppx/default.nix        | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/ocaml-modules/graphql_ppx/default.nix b/pkgs/development/ocaml-modules/graphql_ppx/default.nix
index 08ae3343d062..5623248589fa 100644
--- a/pkgs/development/ocaml-modules/graphql_ppx/default.nix
+++ b/pkgs/development/ocaml-modules/graphql_ppx/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  ocaml,
   buildDunePackage,
   fetchFromGitHub,
   alcotest,
@@ -9,19 +10,15 @@
   yojson,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "graphql_ppx";
-  version = "1.2.2";
-
-  duneVersion = "3";
-
-  minimalOCamlVersion = "4.08";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "reasonml-community";
     repo = "graphql-ppx";
-    rev = "v${version}";
-    sha256 = "sha256-+WJhA2ixZHiSZBoX14dnQKk7JfVAIME4JooNSnhRp44=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-u49JHC8K5iMCOQRPYaMl00npJsIE6ePaeJ2jP/vnuvw=";
   };
 
   nativeBuildInputs = [ reason ];
@@ -42,6 +39,7 @@ buildDunePackage rec {
   doCheck = true;
 
   meta = {
+    broken = lib.versionAtLeast ocaml.version "5.4";
     homepage = "https://github.com/reasonml-community/graphql_ppx";
     description = "GraphQL PPX rewriter for Bucklescript/ReasonML";
     license = lib.licenses.mit;
@@ -50,4 +48,4 @@ buildDunePackage rec {
       jtcoolen
     ];
   };
-}
+})

From 73e8a483e6baf2ff666d393b8396a02490ee6de6 Mon Sep 17 00:00:00 2001
From: Lukas Wurzinger <lukas@wrz.one>
Date: Tue, 21 Oct 2025 15:02:15 +0200
Subject: [PATCH 23/60] lib/cli: add toCommandLine

---
 doc/release-notes/rl-2511.section.md |   2 +
 lib/cli.nix                          | 191 ++++++++++++++++++++++++++-
 lib/tests/misc.nix                   |  80 +++++++++++
 3 files changed, 270 insertions(+), 3 deletions(-)

diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 81389bf97a8b..df2eb32e9ef1 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -360,3 +360,5 @@
   See the neovim help page [`:help startup`](https://neovim.io/doc/user/starting.html#startup) for more information, as well as [the nixpkgs neovim wrapper documentation](#neovim-custom-configuration).
 
 - `cloudflare-ddns`: Added package cloudflare-ddns.
+
+- `lib.cli.toCommandLine`, `lib.cli.toCommandLineShell`, `lib.cli.toCommandLineGNU` and `lib.cli.toCommandLineShellGNU` have been added to address multiple issues in `lib.cli.toGNUCommandLine` and `lib.cli.toGNUCommandLineShell`.
diff --git a/lib/cli.nix b/lib/cli.nix
index 590ba691d386..487f7f44e969 100644
--- a/lib/cli.nix
+++ b/lib/cli.nix
@@ -1,6 +1,6 @@
 { lib }:
 
-rec {
+{
   /**
     Automatically convert an attribute set to command-line options.
 
@@ -20,6 +20,7 @@ rec {
     : The attributes to transform into arguments.
 
     # Examples
+
     :::{.example}
     ## `lib.cli.toGNUCommandLineShell` usage example
 
@@ -38,7 +39,8 @@ rec {
 
     :::
   */
-  toGNUCommandLineShell = options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
+  toGNUCommandLineShell =
+    options: attrs: lib.escapeShellArgs (lib.cli.toGNUCommandLine options attrs);
 
   /**
     Automatically convert an attribute set to a list of command-line options.
@@ -55,7 +57,7 @@ rec {
 
     : The attributes to transform into arguments.
 
-    # Options
+    ## Options
 
     `mkOptionName`
 
@@ -85,6 +87,7 @@ rec {
     This is useful if the command requires equals, for example, `-c=5`.
 
     # Examples
+
     :::{.example}
     ## `lib.cli.toGNUCommandLine` usage example
 
@@ -145,4 +148,186 @@ rec {
 
     in
     builtins.concatLists (lib.mapAttrsToList render options);
+
+  /**
+    Converts the given attributes into a single shell-escaped command-line string.
+    Similar to `toCommandLineGNU`, but returns a single escaped string instead of an array of arguments.
+    For further reference see: [`lib.cli.toCommandLineGNU`](#function-library-lib.cli.toCommandLineGNU)
+  */
+  toCommandLineShellGNU =
+    options: attrs: lib.escapeShellArgs (lib.cli.toCommandLineGNU options attrs);
+
+  /**
+    Converts an attribute set into a list of GNU-style command line options.
+
+    `toCommandLineGNU` returns a list of string arguments.
+
+    # Inputs
+
+    `options`
+
+    : Options, see below.
+
+    `attrs`
+
+    : The attributes to transform into arguments.
+
+    ## Options
+
+    `isLong`
+
+    : A function that determines whether an option is long or short.
+
+    `explicitBool`
+
+    : Whether or not boolean option arguments should be formatted explicitly.
+
+    `formatArg`
+
+    : A function that turns the option argument into a string.
+
+    # Examples
+
+    :::{.example}
+    ## `lib.cli.toCommandLineGNU` usage example
+
+    ```nix
+    lib.cli.toCommandLineGNU {} {
+      v = true;
+      verbose = [true true false null];
+      i = ".bak";
+      testsuite = ["unit" "integration"];
+      e = ["s/a/b/" "s/b/c/"];
+      n = false;
+      data = builtins.toJSON {id = 0;};
+    }
+    => [
+      "--data={\"id\":0}"
+      "-es/a/b/"
+      "-es/b/c/"
+      "-i.bak"
+      "--testsuite=unit"
+      "--testsuite=integration"
+      "-v"
+      "--verbose"
+      "--verbose"
+    ]
+    ```
+
+    :::
+  */
+  toCommandLineGNU =
+    {
+      isLong ? optionName: builtins.stringLength optionName > 1,
+      explicitBool ? false,
+      formatArg ? lib.generators.mkValueStringDefault { },
+    }:
+    let
+      optionFormat = optionName: {
+        option = if isLong optionName then "--${optionName}" else "-${optionName}";
+        sep = if isLong optionName then "=" else "";
+        inherit explicitBool formatArg;
+      };
+    in
+    lib.cli.toCommandLine optionFormat;
+
+  /**
+    Converts the given attributes into a single shell-escaped command-line string.
+    Similar to `toCommandLine`, but returns a single escaped string instead of an array of arguments.
+    For further reference see: [`lib.cli.toCommandLine`](#function-library-lib.cli.toCommandLine)
+  */
+  toCommandLineShell =
+    optionFormat: attrs: lib.escapeShellArgs (lib.cli.toCommandLine optionFormat attrs);
+
+  /**
+    Converts an attribute set into a list of command line options.
+
+    `toCommandLine` returns a list of string arguments.
+
+    # Inputs
+
+    `optionFormat`
+
+    : The option format that describes how options and their arguments should be formatted.
+
+    `attrs`
+
+    : The attributes to transform into arguments.
+
+    # Examples
+    :::{.example}
+    ## `lib.cli.toCommandLine` usage example
+
+    ```nix
+    let
+      optionFormat = optionName: {
+        option = "-${optionName}";
+        sep = "=";
+        explicitBool = true;
+      };
+    in lib.cli.toCommandLine optionFormat {
+      v = true;
+      verbose = [true true false null];
+      i = ".bak";
+      testsuite = ["unit" "integration"];
+      e = ["s/a/b/" "s/b/c/"];
+      n = false;
+      data = builtins.toJSON {id = 0;};
+    }
+    => [
+      "-data={\"id\":0}"
+      "-e=s/a/b/"
+      "-e=s/b/c/"
+      "-i=.bak"
+      "-n=false"
+      "-testsuite=unit"
+      "-testsuite=integration"
+      "-v=true"
+      "-verbose=true"
+      "-verbose=true"
+      "-verbose=false"
+    ]
+    ```
+
+    :::
+  */
+  toCommandLine =
+    optionFormat: attrs:
+    let
+      handlePair =
+        k: v:
+        if k == "" then
+          lib.throw "lib.cli.toCommandLine only accepts non-empty option names."
+        else if builtins.isList v then
+          builtins.concatMap (handleOption k) v
+        else
+          handleOption k v;
+
+      handleOption = k: renderOption (optionFormat k) k;
+
+      renderOption =
+        {
+          option,
+          sep,
+          explicitBool,
+          formatArg ? lib.generators.mkValueStringDefault { },
+        }:
+        k: v:
+        if v == null || (!explicitBool && v == false) then
+          [ ]
+        else if !explicitBool && v == true then
+          [ option ]
+        else
+          let
+            arg = formatArg v;
+          in
+          if sep != null then
+            [ "${option}${sep}${arg}" ]
+          else
+            [
+              option
+              arg
+            ];
+    in
+    builtins.concatLists (lib.mapAttrsToList handlePair attrs);
 }
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 59fbb1ccd63b..d12c27c34bbc 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -3106,6 +3106,86 @@ runTests {
     expected = "-X PUT --data '{\"id\":0}' --retry 3 --url https://example.com/foo --url https://example.com/bar --verbose";
   };
 
+  testToCommandLine = {
+    expr =
+      let
+        optionFormat = optionName: {
+          option = "-${optionName}";
+          sep = "=";
+          explicitBool = true;
+        };
+      in
+      cli.toCommandLine optionFormat {
+        v = true;
+        verbose = [
+          true
+          true
+          false
+          null
+        ];
+        i = ".bak";
+        testsuite = [
+          "unit"
+          "integration"
+        ];
+        e = [
+          "s/a/b/"
+          "s/b/c/"
+        ];
+        n = false;
+        data = builtins.toJSON { id = 0; };
+      };
+
+    expected = [
+      "-data={\"id\":0}"
+      "-e=s/a/b/"
+      "-e=s/b/c/"
+      "-i=.bak"
+      "-n=false"
+      "-testsuite=unit"
+      "-testsuite=integration"
+      "-v=true"
+      "-verbose=true"
+      "-verbose=true"
+      "-verbose=false"
+    ];
+  };
+
+  testToCommandLineGNU = {
+    expr = cli.toCommandLineGNU { } {
+      v = true;
+      verbose = [
+        true
+        true
+        false
+        null
+      ];
+      i = ".bak";
+      testsuite = [
+        "unit"
+        "integration"
+      ];
+      e = [
+        "s/a/b/"
+        "s/b/c/"
+      ];
+      n = false;
+      data = builtins.toJSON { id = 0; };
+    };
+
+    expected = [
+      "--data={\"id\":0}"
+      "-es/a/b/"
+      "-es/b/c/"
+      "-i.bak"
+      "--testsuite=unit"
+      "--testsuite=integration"
+      "-v"
+      "--verbose"
+      "--verbose"
+    ];
+  };
+
   testSanitizeDerivationNameLeadingDots = testSanitizeDerivationName {
     name = "..foo";
     expected = "foo";

From 1f4c50ab8116b151fb9a007b2dbf46decd7a1483 Mon Sep 17 00:00:00 2001
From: Lukas Wurzinger <lukas@wrz.one>
Date: Tue, 21 Oct 2025 15:02:59 +0200
Subject: [PATCH 24/60] lib/cli: deprecate toGNUCommandLine

---
 doc/release-notes/rl-2511.section.md          |  2 +
 lib/cli.nix                                   | 66 ++++++++++---------
 nixos/modules/hardware/printers.nix           |  2 +-
 .../services/finance/libeufin/common.nix      |  6 +-
 nixos/modules/services/hardware/undervolt.nix |  2 +-
 .../services/home-automation/ebusd.nix        |  2 +-
 nixos/modules/services/mail/mailpit.nix       |  2 +-
 nixos/modules/services/misc/paperless.nix     |  2 +-
 .../services/networking/gns3-server.nix       |  2 +-
 .../services/networking/hylafax/systemd.nix   | 12 ++--
 nixos/modules/services/networking/newt.nix    |  2 +-
 .../modules/services/networking/syncthing.nix |  2 +-
 .../modules/services/networking/wstunnel.nix  |  2 +-
 nixos/modules/services/security/tsidp.nix     |  2 +-
 nixos/modules/services/system/earlyoom.nix    |  2 +-
 nixos/modules/services/system/self-deploy.nix |  2 +-
 .../services/web-apps/c2fmzq-server.nix       |  6 +-
 .../services/web-apps/libretranslate.nix      |  2 +-
 nixos/modules/services/web-apps/zitadel.nix   |  2 +-
 .../modules/services/web-servers/fcgiwrap.nix |  2 +-
 .../system/boot/systemd/journald-gateway.nix  |  2 +-
 .../system/boot/systemd/journald-remote.nix   |  2 +-
 nixos/modules/virtualisation/containerd.nix   |  2 +-
 .../virtualisation/virtualbox-image.nix       |  4 +-
 pkgs/build-support/writers/scripts.nix        |  8 ++-
 pkgs/by-name/an/antora/test/default.nix       |  2 +-
 pkgs/by-name/li/lightway/package.nix          |  2 +-
 .../dhall/build-dhall-package.nix             |  2 +-
 28 files changed, 81 insertions(+), 65 deletions(-)

diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index df2eb32e9ef1..6793072fcf79 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -353,6 +353,8 @@
   - `number`
   - `numbers.*`
 
+- `lib.cli.toGNUCommandLine` and `lib.cli.toGNUCommandLineShell` have been deprecated in favor of `lib.cli.toCommandLine`, `lib.cli.toCommandLineShell`, `lib.cli.toCommandLineGNU` and `lib.cli.toCommandLineShellGNU`.
+
 ### Additions and Improvements {#sec-nixpkgs-release-25.11-lib-additions-improvements}
 
 - `neovim`: Added support for the `vim.o.exrc` option, the `VIMINIT` environment variable, and sourcing of `sysinit.vim`.
diff --git a/lib/cli.nix b/lib/cli.nix
index 487f7f44e969..f0ebeb76c4c2 100644
--- a/lib/cli.nix
+++ b/lib/cli.nix
@@ -40,7 +40,9 @@
     :::
   */
   toGNUCommandLineShell =
-    options: attrs: lib.escapeShellArgs (lib.cli.toGNUCommandLine options attrs);
+    lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511)
+      "lib.cli.toGNUCommandLineShell is deprecated, please use lib.cli.toCommandLineShell or lib.cli.toCommandLineShellGNU instead."
+      (options: attrs: lib.escapeShellArgs (lib.cli.toGNUCommandLine options attrs));
 
   /**
     Automatically convert an attribute set to a list of command-line options.
@@ -114,40 +116,44 @@
     :::
   */
   toGNUCommandLine =
-    {
-      mkOptionName ? k: if builtins.stringLength k == 1 then "-${k}" else "--${k}",
+    lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511)
+      "lib.cli.toGNUCommandLine is deprecated, please use lib.cli.toCommandLine or lib.cli.toCommandLineShellGNU instead."
+      (
+        {
+          mkOptionName ? k: if builtins.stringLength k == 1 then "-${k}" else "--${k}",
 
-      mkBool ? k: v: lib.optional v (mkOptionName k),
+          mkBool ? k: v: lib.optional v (mkOptionName k),
 
-      mkList ? k: v: lib.concatMap (mkOption k) v,
+          mkList ? k: v: lib.concatMap (mkOption k) v,
 
-      mkOption ?
-        k: v:
-        if v == null then
-          [ ]
-        else if optionValueSeparator == null then
-          [
-            (mkOptionName k)
-            (lib.generators.mkValueStringDefault { } v)
-          ]
-        else
-          [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault { } v}" ],
+          mkOption ?
+            k: v:
+            if v == null then
+              [ ]
+            else if optionValueSeparator == null then
+              [
+                (mkOptionName k)
+                (lib.generators.mkValueStringDefault { } v)
+              ]
+            else
+              [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault { } v}" ],
 
-      optionValueSeparator ? null,
-    }:
-    options:
-    let
-      render =
-        k: v:
-        if builtins.isBool v then
-          mkBool k v
-        else if builtins.isList v then
-          mkList k v
-        else
-          mkOption k v;
+          optionValueSeparator ? null,
+        }:
+        options:
+        let
+          render =
+            k: v:
+            if builtins.isBool v then
+              mkBool k v
+            else if builtins.isList v then
+              mkList k v
+            else
+              mkOption k v;
 
-    in
-    builtins.concatLists (lib.mapAttrsToList render options);
+        in
+        builtins.concatLists (lib.mapAttrsToList render options)
+      );
 
   /**
     Converts the given attributes into a single shell-escaped command-line string.
diff --git a/nixos/modules/hardware/printers.nix b/nixos/modules/hardware/printers.nix
index 8dbfea78a516..23f656579fe6 100644
--- a/nixos/modules/hardware/printers.nix
+++ b/nixos/modules/hardware/printers.nix
@@ -10,7 +10,7 @@ let
   ensurePrinter =
     p:
     let
-      args = lib.cli.toGNUCommandLineShell { } (
+      args = lib.cli.toCommandLineShellGNU { } (
         {
           p = p.name;
           v = p.deviceUri;
diff --git a/nixos/modules/services/finance/libeufin/common.nix b/nixos/modules/services/finance/libeufin/common.nix
index 71133248d607..461a96940123 100644
--- a/nixos/modules/services/finance/libeufin/common.nix
+++ b/nixos/modules/services/finance/libeufin/common.nix
@@ -48,7 +48,7 @@ libeufinComponent:
             DynamicUser = true;
             ExecStart =
               let
-                args = lib.cli.toGNUCommandLineShell { } {
+                args = lib.cli.toCommandLineShellGNU { } {
                   c = configFile;
                   L = if cfg.debug then "debug" else null;
                 };
@@ -80,7 +80,7 @@ libeufinComponent:
             initialAccountRegistration = lib.concatMapStringsSep "\n" (
               account:
               let
-                args = lib.cli.toGNUCommandLineShell { } {
+                args = lib.cli.toCommandLineShellGNU { } {
                   c = configFile;
                   inherit (account) username password name;
                   payto_uri = "payto://x-taler-bank/${bankHost}/${account.username}?receiver-name=${account.name}";
@@ -90,7 +90,7 @@ libeufinComponent:
               "${lib.getExe' cfg.package "libeufin-bank"} create-account ${args}"
             ) cfg.initialAccounts;
 
-            args = lib.cli.toGNUCommandLineShell { } {
+            args = lib.cli.toCommandLineShellGNU { } {
               c = configFile;
               L = if cfg.debug then "debug" else null;
             };
diff --git a/nixos/modules/services/hardware/undervolt.nix b/nixos/modules/services/hardware/undervolt.nix
index 5a8ad9806ef1..dd020181a6fe 100644
--- a/nixos/modules/services/hardware/undervolt.nix
+++ b/nixos/modules/services/hardware/undervolt.nix
@@ -16,7 +16,7 @@ let
         limit != null && window != null
       ) "Both power limit and window must be set";
       "${toString limit} ${toString window}";
-  cliArgs = lib.cli.toGNUCommandLine { } {
+  cliArgs = lib.cli.toCommandLineGNU { } {
     inherit (cfg)
       verbose
       temp
diff --git a/nixos/modules/services/home-automation/ebusd.nix b/nixos/modules/services/home-automation/ebusd.nix
index 3b98408ec9cc..7ee7d0751303 100644
--- a/nixos/modules/services/home-automation/ebusd.nix
+++ b/nixos/modules/services/home-automation/ebusd.nix
@@ -170,7 +170,7 @@ in
         serviceConfig = {
           ExecStart =
             let
-              args = lib.cli.toGNUCommandLineShell { optionValueSeparator = "="; } (
+              args = lib.cli.toCommandLineShellGNU { } (
                 lib.foldr (a: b: a // b) { } [
                   {
                     inherit (cfg)
diff --git a/nixos/modules/services/mail/mailpit.nix b/nixos/modules/services/mail/mailpit.nix
index 6bc368e91f5f..c3b888f15c9b 100644
--- a/nixos/modules/services/mail/mailpit.nix
+++ b/nixos/modules/services/mail/mailpit.nix
@@ -22,7 +22,7 @@ let
 
   isNonNull = v: v != null;
   genCliFlags =
-    settings: concatStringsSep " " (cli.toGNUCommandLine { } (filterAttrs (const isNonNull) settings));
+    settings: concatStringsSep " " (cli.toCommandLineGNU { } (filterAttrs (const isNonNull) settings));
 in
 {
   options.services.mailpit.instances = mkOption {
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 8ab3372c75d7..14bb792790a7 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -686,7 +686,7 @@ in
           path = [ manage ];
           script = ''
             paperless-manage document_exporter ${cfg.exporter.directory} ${
-              lib.cli.toGNUCommandLineShell { } cfg.exporter.settings
+              lib.cli.toCommandLineShellGNU { } cfg.exporter.settings
             }
           '';
         };
diff --git a/nixos/modules/services/networking/gns3-server.nix b/nixos/modules/services/networking/gns3-server.nix
index 21679a3d8364..6d69090744be 100644
--- a/nixos/modules/services/networking/gns3-server.nix
+++ b/nixos/modules/services/networking/gns3-server.nix
@@ -187,7 +187,7 @@ in
 
       systemd.services.gns3-server =
         let
-          commandArgs = lib.cli.toGNUCommandLineShell { } {
+          commandArgs = lib.cli.toCommandLineShellGNU { } {
             config = "/etc/gns3/gns3_server.conf";
             pid = "/run/gns3/server.pid";
             log = cfg.log.file;
diff --git a/nixos/modules/services/networking/hylafax/systemd.nix b/nixos/modules/services/networking/hylafax/systemd.nix
index d0cc0f230278..d08c08e6ec42 100644
--- a/nixos/modules/services/networking/hylafax/systemd.nix
+++ b/nixos/modules/services/networking/hylafax/systemd.nix
@@ -14,7 +14,13 @@ let
     mkMerge
     optional
     ;
-  inherit (lib.cli) toGNUCommandLine;
+  inherit (lib.cli) toCommandLine;
+
+  optionFormat = optionName: {
+    option = "-${optionName}";
+    sep = null;
+    explicitBool = false;
+  };
 
   cfg = config.services.hylafax;
   mapModems = lib.forEach (lib.attrValues cfg.modems);
@@ -23,9 +29,7 @@ let
     prefix: program: posArg: options:
     let
       start = "${prefix}${cfg.package}/spool/bin/${program}";
-      optionsList = toGNUCommandLine { mkOptionName = k: "-${k}"; } (
-        { q = cfg.spoolAreaPath; } // options
-      );
+      optionsList = toCommandLine optionFormat ({ q = cfg.spoolAreaPath; } // options);
       posArgList = optional (posArg != null) posArg;
     in
     "${start} ${escapeShellArgs (optionsList ++ posArgList)}";
diff --git a/nixos/modules/services/networking/newt.nix b/nixos/modules/services/networking/newt.nix
index bc2d1cc001a9..9caa45351958 100644
--- a/nixos/modules/services/networking/newt.nix
+++ b/nixos/modules/services/networking/newt.nix
@@ -83,7 +83,7 @@ in
       };
       # the flag values will all be overwritten if also defined in the env file
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} ${lib.cli.toGNUCommandLineShell { } cfg.settings}";
+        ExecStart = "${lib.getExe cfg.package} ${lib.cli.toCommandLineShellGNU { } cfg.settings}";
         DynamicUser = true;
         StateDirectory = "newt";
         StateDirectoryMode = "0700";
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 645852b646d3..f1fcaf855e96 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -947,7 +947,7 @@ in
           ExecStart =
             let
               args = lib.escapeShellArgs (
-                (lib.cli.toGNUCommandLine { } {
+                (lib.cli.toCommandLineGNU { } {
                   "no-browser" = true;
                   "gui-address" = (if isUnixGui then "unix://" else "") + cfg.guiAddress;
                   "config" = cfg.configDir;
diff --git a/nixos/modules/services/networking/wstunnel.nix b/nixos/modules/services/networking/wstunnel.nix
index ce6195ec1011..8d20b37eeea8 100644
--- a/nixos/modules/services/networking/wstunnel.nix
+++ b/nixos/modules/services/networking/wstunnel.nix
@@ -26,7 +26,7 @@ let
         str
         (listOf str)
       ]);
-    generate = lib.cli.toGNUCommandLineShell { };
+    generate = lib.cli.toCommandLineShellGNU { };
   };
 
   hostPortToString = { host, port, ... }: "${host}:${toString port}";
diff --git a/nixos/modules/services/security/tsidp.nix b/nixos/modules/services/security/tsidp.nix
index 4b854cf183ca..5d1a32522875 100644
--- a/nixos/modules/services/security/tsidp.nix
+++ b/nixos/modules/services/security/tsidp.nix
@@ -164,7 +164,7 @@ in
           Type = "simple";
           ExecStart =
             let
-              args = lib.cli.toGNUCommandLineShell { mkOptionName = k: "-${k}"; } {
+              args = lib.cli.toCommandLineShellGNU { } {
                 dir = stateDir;
                 hostname = cfg.settings.hostName;
                 port = cfg.settings.port;
diff --git a/nixos/modules/services/system/earlyoom.nix b/nixos/modules/services/system/earlyoom.nix
index 674e075b9ad4..f52c4b4fb4e2 100644
--- a/nixos/modules/services/system/earlyoom.nix
+++ b/nixos/modules/services/system/earlyoom.nix
@@ -179,7 +179,7 @@ in
       serviceConfig.EnvironmentFile = "";
 
       environment.EARLYOOM_ARGS =
-        lib.cli.toGNUCommandLineShell { } {
+        lib.cli.toCommandLineShellGNU { } {
           m =
             "${toString cfg.freeMemThreshold}"
             + optionalString (cfg.freeMemKillThreshold != null) ",${toString cfg.freeMemKillThreshold}";
diff --git a/nixos/modules/services/system/self-deploy.nix b/nixos/modules/services/system/self-deploy.nix
index 4f11e8df18ad..bde3ac811569 100644
--- a/nixos/modules/services/system/self-deploy.nix
+++ b/nixos/modules/services/system/self-deploy.nix
@@ -179,7 +179,7 @@ in
         ${gitWithRepo} checkout FETCH_HEAD
 
         nix-build${renderNixArgs cfg.nixArgs} ${
-          lib.cli.toGNUCommandLineShell { } {
+          lib.cli.toCommandLineShellGNU { } {
             attr = cfg.nixAttribute;
             out-link = outPath;
           }
diff --git a/nixos/modules/services/web-apps/c2fmzq-server.nix b/nixos/modules/services/web-apps/c2fmzq-server.nix
index f1935e05407f..a7622d384cf3 100644
--- a/nixos/modules/services/web-apps/c2fmzq-server.nix
+++ b/nixos/modules/services/web-apps/c2fmzq-server.nix
@@ -25,10 +25,8 @@ let
           str
         ])
       );
-    generate = lib.cli.toGNUCommandLineShell {
-      mkBool = k: v: [
-        "--${k}=${if v then "true" else "false"}"
-      ];
+    generate = lib.cli.toCommandLineShellGNU {
+      explicitBool = true;
     };
   };
 in
diff --git a/nixos/modules/services/web-apps/libretranslate.nix b/nixos/modules/services/web-apps/libretranslate.nix
index 1664b9ef4581..5ac68ad3c919 100644
--- a/nixos/modules/services/web-apps/libretranslate.nix
+++ b/nixos/modules/services/web-apps/libretranslate.nix
@@ -146,7 +146,7 @@ in
           Type = "simple";
           ExecStart = ''
             ${cfg.package}/bin/libretranslate ${
-              lib.cli.toGNUCommandLineShell { } (
+              lib.cli.toCommandLineShellGNU { } (
                 cfg.extraArgs
                 // {
                   inherit (cfg) host port threads;
diff --git a/nixos/modules/services/web-apps/zitadel.nix b/nixos/modules/services/web-apps/zitadel.nix
index c097d36d9039..6cfd1bbd4680 100644
--- a/nixos/modules/services/web-apps/zitadel.nix
+++ b/nixos/modules/services/web-apps/zitadel.nix
@@ -207,7 +207,7 @@ in
         configFile = settingsFormat.generate "config.yaml" cfg.settings;
         stepsFile = settingsFormat.generate "steps.yaml" cfg.steps;
 
-        args = lib.cli.toGNUCommandLineShell { } {
+        args = lib.cli.toCommandLineShellGNU { } {
           config = cfg.extraSettingsPaths ++ [ configFile ];
           steps = cfg.extraStepsPaths ++ [ stepsFile ];
           masterkeyFile = cfg.masterKeyFile;
diff --git a/nixos/modules/services/web-servers/fcgiwrap.nix b/nixos/modules/services/web-servers/fcgiwrap.nix
index 992f4a46ff4b..493cd710c1bb 100644
--- a/nixos/modules/services/web-servers/fcgiwrap.nix
+++ b/nixos/modules/services/web-servers/fcgiwrap.nix
@@ -151,7 +151,7 @@ in
       serviceConfig = {
         ExecStart = ''
           ${pkgs.fcgiwrap}/sbin/fcgiwrap ${
-            cli.toGNUCommandLineShell { } (
+            cli.toCommandLineShellGNU { } (
               {
                 c = cfg.process.prefork;
               }
diff --git a/nixos/modules/system/boot/systemd/journald-gateway.nix b/nixos/modules/system/boot/systemd/journald-gateway.nix
index b6cf300d3bfb..f0d80077e6d6 100644
--- a/nixos/modules/system/boot/systemd/journald-gateway.nix
+++ b/nixos/modules/system/boot/systemd/journald-gateway.nix
@@ -8,7 +8,7 @@
 let
   cfg = config.services.journald.gateway;
 
-  cliArgs = lib.cli.toGNUCommandLineShell { } {
+  cliArgs = lib.cli.toCommandLineShellGNU { } {
     # If either of these are null / false, they are not passed in the command-line
     inherit (cfg)
       cert
diff --git a/nixos/modules/system/boot/systemd/journald-remote.nix b/nixos/modules/system/boot/systemd/journald-remote.nix
index 89baf421f591..7216c179b3a0 100644
--- a/nixos/modules/system/boot/systemd/journald-remote.nix
+++ b/nixos/modules/system/boot/systemd/journald-remote.nix
@@ -9,7 +9,7 @@ let
   cfg = config.services.journald.remote;
   format = pkgs.formats.systemd { };
 
-  cliArgs = lib.cli.toGNUCommandLineShell { } {
+  cliArgs = lib.cli.toCommandLineShellGNU { } {
     inherit (cfg) output;
     # "-3" specifies the file descriptor from the .socket unit.
     "listen-${cfg.listen}" = "-3";
diff --git a/nixos/modules/virtualisation/containerd.nix b/nixos/modules/virtualisation/containerd.nix
index 9e061f851126..c43db34dbf99 100644
--- a/nixos/modules/virtualisation/containerd.nix
+++ b/nixos/modules/virtualisation/containerd.nix
@@ -90,7 +90,7 @@ in
         ++ lib.optional config.boot.zfs.enabled config.boot.zfs.package;
       serviceConfig = {
         ExecStart = ''${pkgs.containerd}/bin/containerd ${
-          lib.concatStringsSep " " (lib.cli.toGNUCommandLine { } cfg.args)
+          lib.concatStringsSep " " (lib.cli.toCommandLineGNU { } cfg.args)
         }'';
         Delegate = "yes";
         KillMode = "process";
diff --git a/nixos/modules/virtualisation/virtualbox-image.nix b/nixos/modules/virtualisation/virtualbox-image.nix
index 04d36c9ce82f..25de9ac0ce86 100644
--- a/nixos/modules/virtualisation/virtualbox-image.nix
+++ b/nixos/modules/virtualisation/virtualbox-image.nix
@@ -252,8 +252,8 @@ in
           --ostype ${if pkgs.stdenv.hostPlatform.system == "x86_64-linux" then "Linux26_64" else "Linux26"}
         VBoxManage modifyvm "$vmName" \
           --memory ${toString cfg.memorySize} \
-          ${lib.cli.toGNUCommandLineShell { } cfg.params}
-        VBoxManage storagectl "$vmName" ${lib.cli.toGNUCommandLineShell { } cfg.storageController}
+          ${lib.cli.toCommandLineShellGNU { } cfg.params}
+        VBoxManage storagectl "$vmName" ${lib.cli.toCommandLineShellGNU { } cfg.storageController}
         VBoxManage storageattach "$vmName" --storagectl ${cfg.storageController.name} --port 0 --device 0 --type hdd \
           --medium disk.vdi
         ${lib.optionalString (cfg.extraDisk != null) ''
diff --git a/pkgs/build-support/writers/scripts.nix b/pkgs/build-support/writers/scripts.nix
index bd4e9209ce67..8f2110bdfa58 100644
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@@ -812,7 +812,13 @@ rec {
       strip ? true,
     }:
     let
-      nimCompileCmdArgs = lib.cli.toGNUCommandLineShell { optionValueSeparator = ":"; } (
+      optionFormat = optionName: {
+        option = "--${optionName}";
+        sep = ":";
+        explicitBool = false;
+      };
+
+      nimCompileCmdArgs = lib.cli.toCommandLineShell optionFormat (
         {
           d = "release";
           nimcache = ".";
diff --git a/pkgs/by-name/an/antora/test/default.nix b/pkgs/by-name/an/antora/test/default.nix
index ce5e0d5f50bb..b473a87b1434 100644
--- a/pkgs/by-name/an/antora/test/default.nix
+++ b/pkgs/by-name/an/antora/test/default.nix
@@ -43,7 +43,7 @@ stdenvNoCC.mkDerivation {
       # The --to-dir and --ui-bundle-url options are not included in the
       # playbook due to Antora and Nix limitations.
       antora ${
-        lib.cli.toGNUCommandLineShell { } {
+        lib.cli.toCommandLineShellGNU { } {
           cache-dir = "$(mktemp --directory)";
           extension = if antora-lunr-extension-test then antora-lunr-extension else false;
           to-dir = placeholder "out";
diff --git a/pkgs/by-name/li/lightway/package.nix b/pkgs/by-name/li/lightway/package.nix
index 0bf4c6a92840..82c22ee4df25 100644
--- a/pkgs/by-name/li/lightway/package.nix
+++ b/pkgs/by-name/li/lightway/package.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
 
   cargoHash = "sha256-RFlac10XFJXT3Giayy31kZ3Nn1Q+YsPt/zCdkSV0Atk=";
 
-  cargoBuildFlags = lib.cli.toGNUCommandLine { } {
+  cargoBuildFlags = lib.cli.toCommandLineGNU { } {
     package = [
       "lightway-client"
       "lightway-server"
diff --git a/pkgs/development/interpreters/dhall/build-dhall-package.nix b/pkgs/development/interpreters/dhall/build-dhall-package.nix
index 214fe7f92d28..3ce1c8fceb75 100644
--- a/pkgs/development/interpreters/dhall/build-dhall-package.nix
+++ b/pkgs/development/interpreters/dhall/build-dhall-package.nix
@@ -101,7 +101,7 @@ runCommand name { inherit dependencies; } ''
     mkdir -p $out/${dataDhall}
 
     XDG_DATA_HOME=$out/${data} ${dhall-docs}/bin/dhall-docs --output-link $out/docs ${
-      lib.cli.toGNUCommandLineShell { } {
+      lib.cli.toCommandLineShellGNU { } {
         base-import-url = baseImportUrl;
 
         input = documentationRoot;

From 3e89b0f880c6e81e2a9a4a49034669bdb3cdb90a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 21 Oct 2025 12:44:06 -0700
Subject: [PATCH 25/60] flare-signal: 0.17.1 -> 0.17.2

Diff: https://gitlab.com/schmiddi-on-mobile/flare/-/compare/0.17.1...0.17.2

Changelog: https://gitlab.com/schmiddi-on-mobile/flare/-/blob/0.17.2/CHANGELOG.md
---
 pkgs/by-name/fl/flare-signal/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/fl/flare-signal/package.nix b/pkgs/by-name/fl/flare-signal/package.nix
index a36029891702..92932650eb27 100644
--- a/pkgs/by-name/fl/flare-signal/package.nix
+++ b/pkgs/by-name/fl/flare-signal/package.nix
@@ -28,29 +28,29 @@ let
     owner = "whisperfish";
     repo = "presage";
     # match with commit from Cargo.toml
-    rev = "31a418d0a35ad746590165520b652d6adb7a0384";
-    hash = "sha256-Mf8RvwfrVpbsUj+mA9L7IjnbMKoZDjZKYor2iqFWSx4=";
+    rev = "ed011688fc8d9c0ee07c3d44743c138c1fa4dfda";
+    hash = "sha256-NTSxSOAmA9HOH52GPwl6pL0MQly+NTfJDk7k7TUP9II=";
   };
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flare";
   # NOTE: also update presage commit
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.com";
     owner = "schmiddi-on-mobile";
     repo = "flare";
     tag = finalAttrs.version;
-    hash = "sha256-3SYsVF3aUJYSr3pM/BGXYExQwbwckExYwEcF3cZ/94g=";
+    hash = "sha256-Nezg+fNC29blGhyetJqs9l6/IL08b7tHn+D3pzKj26I=";
   };
 
   cargoDeps =
     let
       cargoDeps = rustPlatform.fetchCargoVendor {
         inherit (finalAttrs) pname version src;
-        hash = "sha256-cxhnfdYcsyXxvTpGGXm2rK3cKVsNk66FYif7/c16NhU=";
+        hash = "sha256-Y6jY588axEcqv0WN6Fcm8Kd5yd2JXvKwMd8h1L6J9TE=";
       };
     in
     # Replace with simpler solution:

From b6ded2688f5fedfe535cc50854292d9751dbc4ab Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 21 Oct 2025 20:35:05 +0000
Subject: [PATCH 26/60] slade-unstable: 3.2.7-unstable-2025-09-30 ->
 3.2.8-unstable-2025-10-21

---
 pkgs/by-name/sl/slade-unstable/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sl/slade-unstable/package.nix b/pkgs/by-name/sl/slade-unstable/package.nix
index 3b40757dbddd..3d4027fd860b 100644
--- a/pkgs/by-name/sl/slade-unstable/package.nix
+++ b/pkgs/by-name/sl/slade-unstable/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation {
   pname = "slade";
-  version = "3.2.7-unstable-2025-09-30";
+  version = "3.2.8-unstable-2025-10-21";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
-    rev = "8ad6609784de6fef6b35f1508b6d5d8a3084aa17";
-    hash = "sha256-XYg0k5ZOZ/M/4X0+6pjJEMK0sIVqu/1LtmJaeq6iOvM=";
+    rev = "fb7cc161a6886c12c5120e30190a7813c6c16b62";
+    hash = "sha256-skJpcxLSInAzBHGtxdTWAqocXQKKQY7vJfUx8ZAlMqc=";
   };
 
   nativeBuildInputs = [

From 24f5f977bbdf4d82fc43c31854d4f2ae7a180bc2 Mon Sep 17 00:00:00 2001
From: Alexander Iliev <ailiev@mamul.org>
Date: Fri, 20 Dec 2024 21:00:10 +0200
Subject: [PATCH 27/60] ubootNanoPiR5S: init

Adds uboot build for FriendlyElec NanoPi R5S.

The board fits well in network scenarios, as it provides three
Ethernet ports (1x1Gbe and 2x2.5Gbe).

Board Wiki: https://wiki.friendlyelec.com/wiki/index.php/NanoPi_R5S
---
 pkgs/misc/uboot/default.nix     | 11 +++++++++++
 pkgs/top-level/all-packages.nix |  1 +
 2 files changed, 12 insertions(+)

diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 559da3d2c48d..15977020a903 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -395,6 +395,17 @@ in
     ];
   };
 
+  ubootNanoPiR5S = buildUBoot {
+    defconfig = "nanopi-r5s-rk3568_defconfig";
+    extraMeta.platforms = [ "aarch64-linux" ];
+    BL31 = rkbin.BL31_RK3568;
+    ROCKCHIP_TPL = rkbin.TPL_RK3568;
+    filesToInstall = [
+      "idbloader.img"
+      "u-boot.itb"
+    ];
+  };
+
   ubootNovena = buildUBoot {
     defconfig = "novena_defconfig";
     extraMeta.platforms = [ "armv7l-linux" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1084db40b90f..2835fa2de0d4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10371,6 +10371,7 @@ with pkgs;
     ubootLibreTechCC
     ubootNanoPCT4
     ubootNanoPCT6
+    ubootNanoPiR5S
     ubootNovena
     ubootOdroidC2
     ubootOdroidXU3

From 5ce94d31c1d917174c9c7bdaadd895c594469682 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 21 Oct 2025 22:27:21 +0000
Subject: [PATCH 28/60] python3Packages.oelint-parser: 8.6.0 -> 8.6.1

---
 pkgs/development/python-modules/oelint-parser/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index 449ec4e2d1c7..237660e41a60 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "8.6.0";
+  version = "8.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-parser";
     tag = version;
-    hash = "sha256-OHyOlqZpevWEhFAa12VDimMT261A9DK+Cx67TDjh7rg=";
+    hash = "sha256-lKHtKrR5bjBuqBvfsMAIR3K+ERhITBXzrxAvvYopDiM=";
   };
 
   pythonRelaxDeps = [ "regex" ];

From 0a97e091ba05aba074120ef5400974da96eecc79 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Oct 2025 01:20:38 +0000
Subject: [PATCH 29/60] goreleaser: 2.12.5 -> 2.12.6

---
 pkgs/by-name/go/goreleaser/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/goreleaser/package.nix b/pkgs/by-name/go/goreleaser/package.nix
index d30a09c70ea8..2b67e9bfff7e 100644
--- a/pkgs/by-name/go/goreleaser/package.nix
+++ b/pkgs/by-name/go/goreleaser/package.nix
@@ -10,16 +10,16 @@
 }:
 buildGo125Module rec {
   pname = "goreleaser";
-  version = "2.12.5";
+  version = "2.12.6";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = "goreleaser";
     rev = "v${version}";
-    hash = "sha256-EHJ1ARzk6BD5D121u+1UTe90oLOovKKD+LQWLIj81Jk=";
+    hash = "sha256-ZYlT/CkYMPZgVNR0uaDPbLT7WH5EDcUeTwUPFM6fZOg=";
   };
 
-  vendorHash = "sha256-J/OwvPxC8wz/91sWWUBNkW5E71m8EPjTq3h/MOxT/3k=";
+  vendorHash = "sha256-Zv13xWe/wwmq+2lqvsX6oWIyEYlCojgIgH/cvr5rSOI=";
 
   ldflags = [
     "-s"

From 138eb86862f4adbc1fbae1b07b15a8f140338e6b Mon Sep 17 00:00:00 2001
From: Matt Sturgeon <matt@sturgeon.me.uk>
Date: Wed, 22 Oct 2025 01:33:53 +0100
Subject: [PATCH 30/60] =?UTF-8?q?nexusmods-app:=200.18.2=20=E2=86=92=200.1?=
 =?UTF-8?q?9.4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://github.com/Nexus-Mods/NexusMods.App/releases/tag/v0.19.4

Backports a critical SMAPI fix:
https://github.com/Nexus-Mods/NexusMods.App/pull/4026
---
 pkgs/by-name/ne/nexusmods-app/deps.json       | 81 +++++--------------
 pkgs/by-name/ne/nexusmods-app/package.nix     | 18 ++++-
 .../ne/nexusmods-app/vendored/games.json      | 38 ++++-----
 3 files changed, 53 insertions(+), 84 deletions(-)

diff --git a/pkgs/by-name/ne/nexusmods-app/deps.json b/pkgs/by-name/ne/nexusmods-app/deps.json
index 8a7000283848..07856e2cbb8f 100644
--- a/pkgs/by-name/ne/nexusmods-app/deps.json
+++ b/pkgs/by-name/ne/nexusmods-app/deps.json
@@ -1926,23 +1926,23 @@
   },
   {
     "pname": "NexusMods.HyperDuck",
-    "version": "0.28.0",
-    "hash": "sha256-vJW/9DbnSIzxH6CR1CzMru0w/BA7HwxuJ0TiKt6NgcQ="
+    "version": "0.28.2",
+    "hash": "sha256-VErxX62rvY5MA9LGyBcKi1BCgtgzOo4rgWTRczFNrVY="
   },
   {
     "pname": "NexusMods.MnemonicDB",
-    "version": "0.28.0",
-    "hash": "sha256-AzSzn2mdp4sx1ntOfm03kWlfo/mxxURcEMmChxSyEAI="
+    "version": "0.28.2",
+    "hash": "sha256-l6b1r0swnRfqAIk7WvdQv0VaekFRXENhZqEL9ut4AT0="
   },
   {
     "pname": "NexusMods.MnemonicDB.Abstractions",
-    "version": "0.28.0",
-    "hash": "sha256-c6hEojlKk8B//lpEyxrYBy/QlpixzDE4LJq+sk4XZDY="
+    "version": "0.28.2",
+    "hash": "sha256-HJsnz1nQeUG4iln+WDkR3SMEalYM47Z8vdYZf8V+RIU="
   },
   {
     "pname": "NexusMods.MnemonicDB.SourceGenerator",
-    "version": "0.28.0",
-    "hash": "sha256-o888EyOAzDypNzhZTtW8BZp0Ew/fOUsho6IeBbGlmNM="
+    "version": "0.28.2",
+    "hash": "sha256-vmOO/qImh5RrWC3U11D5A4Gd2SvOJvuoDID+b5fI+cA="
   },
   {
     "pname": "NexusMods.Paths",
@@ -1969,51 +1969,6 @@
     "version": "0.20.0",
     "hash": "sha256-k+1dgCZEuEO8xVfdwGKec+FgE//FX1xqIyiyPGYypF0="
   },
-  {
-    "pname": "Nito.AsyncEx",
-    "version": "5.1.2",
-    "hash": "sha256-9o4YLWAHSeApF4E/qNFyaZPh/V9N5JSeF32uquukb5I="
-  },
-  {
-    "pname": "Nito.AsyncEx.Context",
-    "version": "5.1.2",
-    "hash": "sha256-7BCVYJgZyU2/Z4r8CKajorlzajr6GBUBAbY3AcswPC0="
-  },
-  {
-    "pname": "Nito.AsyncEx.Coordination",
-    "version": "5.1.2",
-    "hash": "sha256-NHMnIBkGzzuoZL0qHKAwFC35doB08IDvmCQptC2uu2s="
-  },
-  {
-    "pname": "Nito.AsyncEx.Interop.WaitHandles",
-    "version": "5.1.2",
-    "hash": "sha256-1DgBWnkYggWQk0w2g7Y24Ogl7TJ7bQkc/0NIUFJzN00="
-  },
-  {
-    "pname": "Nito.AsyncEx.Oop",
-    "version": "5.1.2",
-    "hash": "sha256-1hnCagbt6SLbn+RpasWdBH3pLvqm8kC2Ut2iG75OUMM="
-  },
-  {
-    "pname": "Nito.AsyncEx.Tasks",
-    "version": "5.1.2",
-    "hash": "sha256-W5jxZZ0pbPHte6TkWTq4FDtHOejvlrdyb1Inw+Yhl4c="
-  },
-  {
-    "pname": "Nito.Cancellation",
-    "version": "1.1.2",
-    "hash": "sha256-oZKZUymYJiM2AfMpX4pX0FIlut0lEWdy250iVX0w+is="
-  },
-  {
-    "pname": "Nito.Collections.Deque",
-    "version": "1.1.1",
-    "hash": "sha256-6Pmz6XQ+rY32O21Z3cUDVQsLH+i53LId18UCPTAxRZQ="
-  },
-  {
-    "pname": "Nito.Disposables",
-    "version": "2.2.1",
-    "hash": "sha256-FKDLUWysqroSHLU2kLjK1m0g417AAPh6n2TIkwiapcM="
-  },
   {
     "pname": "NLog",
     "version": "6.0.3",
@@ -2689,11 +2644,6 @@
     "version": "4.3.0",
     "hash": "sha256-KMY5DfJnDeIsa13DpqvyN8NkReZEMAFnlmNglVoFIXI="
   },
-  {
-    "pname": "System.Collections.Immutable",
-    "version": "1.7.1",
-    "hash": "sha256-WMMAUqoxT3J1gW9DI8v31VAuhwqTc4Posose5jq1BNo="
-  },
   {
     "pname": "System.Collections.Immutable",
     "version": "5.0.0",
@@ -3069,6 +3019,11 @@
     "version": "5.0.0",
     "hash": "sha256-M5Z8pw8rVb8ilbnTdaOptzk5VFd5DlKa7zzCpuytTtE="
   },
+  {
+    "pname": "System.Reactive",
+    "version": "6.0.0",
+    "hash": "sha256-hXB18OsiUHSCmRF3unAfdUEcbXVbG6/nZxcyz13oe9Y="
+  },
   {
     "pname": "System.Reactive",
     "version": "6.0.1",
@@ -3194,11 +3149,6 @@
     "version": "4.3.0",
     "hash": "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="
   },
-  {
-    "pname": "System.Runtime.CompilerServices.Unsafe",
-    "version": "4.4.0",
-    "hash": "sha256-SeTI4+yVRO2SmAKgOrMni4070OD+Oo8L1YiEVeKDyig="
-  },
   {
     "pname": "System.Runtime.CompilerServices.Unsafe",
     "version": "4.5.3",
@@ -3564,6 +3514,11 @@
     "version": "2.5.0",
     "hash": "sha256-i9TpQJ2+JhSQ7RXkdmC6pkND32V4cLyEaPLGrD/EpYk="
   },
+  {
+    "pname": "Verify.TUnit",
+    "version": "30.11.0",
+    "hash": "sha256-xuP2oetSNIBhCzt7go3S2Icy8wy3pBseq4XcEMMrDV8="
+  },
   {
     "pname": "Verify.Xunit",
     "version": "30.11.0",
diff --git a/pkgs/by-name/ne/nexusmods-app/package.nix b/pkgs/by-name/ne/nexusmods-app/package.nix
index 5bcea550ddf8..29bd3c391a52 100644
--- a/pkgs/by-name/ne/nexusmods-app/package.nix
+++ b/pkgs/by-name/ne/nexusmods-app/package.nix
@@ -5,6 +5,7 @@
   desktop-file-utils,
   dotnetCorePackages,
   fetchFromGitHub,
+  fetchpatch2,
   imagemagick,
   lib,
   xdg-utils,
@@ -22,13 +23,13 @@ let
 in
 buildDotnetModule (finalAttrs: {
   inherit pname;
-  version = "0.18.2";
+  version = "0.19.4";
 
   src = fetchFromGitHub {
     owner = "Nexus-Mods";
     repo = "NexusMods.App";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+ayYRNclxbBedH6gIWTh5wI/AIvMzSq4x5fQXzxOT5c=";
+    hash = "sha256-WKfv5y6UmO3dmzkXrqZ+VtIbXf0FszRdsa5Rmp95rYg=";
     fetchSubmodules = true;
   };
 
@@ -56,10 +57,23 @@ buildDotnetModule (finalAttrs: {
   dotnet-sdk = dotnetCorePackages.sdk_9_0;
   dotnet-runtime = dotnetCorePackages.runtime_9_0;
 
+  patches = [
+    (fetchpatch2 {
+      name = "Fix-SMAPI-installation.patch";
+      url = "https://github.com/Nexus-Mods/NexusMods.App/pull/4026.patch?full_index=1";
+      hash = "sha256-1LgFTi63fVhGUZXZtS6iD2yqd0RxhdpiXKtWMFNEoD4=";
+    })
+  ];
+
   postPatch = ''
     # for some reason these tests fail (intermittently?) with a zero timestamp
     touch tests/NexusMods.UI.Tests/WorkspaceSystem/*.verified.png
 
+    # Fix expected version number in text fixture
+    # https://github.com/Nexus-Mods/NexusMods.App/issues/4030
+    substituteInPlace tests/NexusMods.Backend.Tests/EventTrackerTests.Test_PrepareRequest.verified.txt \
+      --replace-fail 0.0.1 ${finalAttrs.version}
+
     # Specify a fixed date to improve build reproducibility
     echo "1970-01-01T00:00:00Z" >buildDate.txt
     substituteInPlace src/NexusMods.Sdk/NexusMods.Sdk.csproj \
diff --git a/pkgs/by-name/ne/nexusmods-app/vendored/games.json b/pkgs/by-name/ne/nexusmods-app/vendored/games.json
index 1ee7cae625b9..478145604579 100644
--- a/pkgs/by-name/ne/nexusmods-app/vendored/games.json
+++ b/pkgs/by-name/ne/nexusmods-app/vendored/games.json
@@ -6,12 +6,12 @@
     "forum_url": "https://forums.nexusmods.com/games/19-stardew-valley/",
     "nexusmods_url": "https://www.nexusmods.com/stardewvalley",
     "genre": "Simulation",
-    "file_count": 141993,
-    "downloads": 619854329,
+    "file_count": 143212,
+    "downloads": 627187655,
     "domain_name": "stardewvalley",
     "approved_date": 1457432329,
-    "mods": 25658,
-    "collections": 2049
+    "mods": 25945,
+    "collections": 2020
   },
   {
     "id": 1704,
@@ -20,12 +20,12 @@
     "forum_url": "https://forums.nexusmods.com/games/6-skyrim/",
     "nexusmods_url": "https://www.nexusmods.com/skyrimspecialedition",
     "genre": "RPG",
-    "file_count": 656636,
-    "downloads": 9072303822,
+    "file_count": 661698,
+    "downloads": 9193533035,
     "domain_name": "skyrimspecialedition",
     "approved_date": 1477480498,
-    "mods": 117768,
-    "collections": 4872
+    "mods": 118807,
+    "collections": 4852
   },
   {
     "id": 3174,
@@ -34,11 +34,11 @@
     "forum_url": "https://forums.nexusmods.com/games/9-mount-blade-ii-bannerlord/",
     "nexusmods_url": "https://www.nexusmods.com/mountandblade2bannerlord",
     "genre": "Strategy",
-    "file_count": 50300,
-    "downloads": 115343239,
+    "file_count": 50603,
+    "downloads": 116400189,
     "domain_name": "mountandblade2bannerlord",
     "approved_date": 1582898627,
-    "mods": 6294,
+    "mods": 6341,
     "collections": 293
   },
   {
@@ -48,12 +48,12 @@
     "forum_url": "https://forums.nexusmods.com/games/1-cyberpunk-2077/",
     "nexusmods_url": "https://www.nexusmods.com/cyberpunk2077",
     "genre": "Action",
-    "file_count": 123906,
-    "downloads": 908587568,
+    "file_count": 125224,
+    "downloads": 930909718,
     "domain_name": "cyberpunk2077",
     "approved_date": 1607433331,
-    "mods": 17809,
-    "collections": 1602
+    "mods": 18032,
+    "collections": 1588
   },
   {
     "id": 3474,
@@ -62,11 +62,11 @@
     "forum_url": "https://forums.nexusmods.com/games/2-baldurs-gate-3/",
     "nexusmods_url": "https://www.nexusmods.com/baldursgate3",
     "genre": "RPG",
-    "file_count": 104549,
-    "downloads": 345662936,
+    "file_count": 105632,
+    "downloads": 351591575,
     "domain_name": "baldursgate3",
     "approved_date": 1602863114,
-    "mods": 14843,
-    "collections": 1805
+    "mods": 15020,
+    "collections": 1752
   }
 ]

From 40c8149187de143a4718f1a9215b71b2a8d0805b Mon Sep 17 00:00:00 2001
From: Matt Sturgeon <matt@sturgeon.me.uk>
Date: Wed, 22 Oct 2025 00:49:40 +0100
Subject: [PATCH 31/60] nexusmods-app: predicate test patches on `doCheck`

Only bother with the test patches when `finalAttrs.doCheck` is true.
---
 pkgs/by-name/ne/nexusmods-app/package.nix | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/ne/nexusmods-app/package.nix b/pkgs/by-name/ne/nexusmods-app/package.nix
index 29bd3c391a52..5b993929fc93 100644
--- a/pkgs/by-name/ne/nexusmods-app/package.nix
+++ b/pkgs/by-name/ne/nexusmods-app/package.nix
@@ -66,14 +66,6 @@ buildDotnetModule (finalAttrs: {
   ];
 
   postPatch = ''
-    # for some reason these tests fail (intermittently?) with a zero timestamp
-    touch tests/NexusMods.UI.Tests/WorkspaceSystem/*.verified.png
-
-    # Fix expected version number in text fixture
-    # https://github.com/Nexus-Mods/NexusMods.App/issues/4030
-    substituteInPlace tests/NexusMods.Backend.Tests/EventTrackerTests.Test_PrepareRequest.verified.txt \
-      --replace-fail 0.0.1 ${finalAttrs.version}
-
     # Specify a fixed date to improve build reproducibility
     echo "1970-01-01T00:00:00Z" >buildDate.txt
     substituteInPlace src/NexusMods.Sdk/NexusMods.Sdk.csproj \
@@ -86,6 +78,16 @@ buildDotnetModule (finalAttrs: {
     # Use a vendored version of the nexus API's games.json data
     substituteInPlace src/NexusMods.Networking.NexusWebApi/NexusMods.Networking.NexusWebApi.csproj \
       --replace-fail '$(BaseIntermediateOutputPath)games.json' ${./vendored/games.json}
+
+    ${lib.optionalString finalAttrs.doCheck ''
+      # For some reason these tests fail (intermittently?) with a zero timestamp
+      touch tests/NexusMods.UI.Tests/WorkspaceSystem/*.verified.png
+
+      # Fix expected version number in text fixture
+      # https://github.com/Nexus-Mods/NexusMods.App/issues/4030
+      substituteInPlace tests/NexusMods.Backend.Tests/EventTrackerTests.Test_PrepareRequest.verified.txt \
+        --replace-fail 0.0.1 ${finalAttrs.version}
+    ''}
   '';
 
   makeWrapperArgs = [

From 86f3462f211269ff586f0e109049acbbb70e12b2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Oct 2025 05:25:32 +0000
Subject: [PATCH 32/60] laravel: 5.21.0 -> 5.22.0

---
 pkgs/by-name/la/laravel/composer.lock | 32 +++++++++++++--------------
 pkgs/by-name/la/laravel/package.nix   |  6 ++---
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/pkgs/by-name/la/laravel/composer.lock b/pkgs/by-name/la/laravel/composer.lock
index 8989fcdb1e51..d9fae099ba7a 100644
--- a/pkgs/by-name/la/laravel/composer.lock
+++ b/pkgs/by-name/la/laravel/composer.lock
@@ -167,7 +167,7 @@
         },
         {
             "name": "illuminate/collections",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/collections.git",
@@ -226,7 +226,7 @@
         },
         {
             "name": "illuminate/conditionable",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/conditionable.git",
@@ -272,7 +272,7 @@
         },
         {
             "name": "illuminate/contracts",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/contracts.git",
@@ -320,7 +320,7 @@
         },
         {
             "name": "illuminate/filesystem",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/filesystem.git",
@@ -387,7 +387,7 @@
         },
         {
             "name": "illuminate/macroable",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/macroable.git",
@@ -433,16 +433,16 @@
         },
         {
             "name": "illuminate/support",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/support.git",
-                "reference": "89291f59ef6c170c00f10a41c566c49ee32ca09a"
+                "reference": "eefcefcf6edff2c986f746f10fad3da3e79a1223"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/illuminate/support/zipball/89291f59ef6c170c00f10a41c566c49ee32ca09a",
-                "reference": "89291f59ef6c170c00f10a41c566c49ee32ca09a",
+                "url": "https://api.github.com/repos/illuminate/support/zipball/eefcefcf6edff2c986f746f10fad3da3e79a1223",
+                "reference": "eefcefcf6edff2c986f746f10fad3da3e79a1223",
                 "shasum": ""
             },
             "require": {
@@ -508,7 +508,7 @@
                 "issues": "https://github.com/laravel/framework/issues",
                 "source": "https://github.com/laravel/framework"
             },
-            "time": "2025-10-13T21:11:33+00:00"
+            "time": "2025-10-18T13:23:12+00:00"
         },
         {
             "name": "laravel/prompts",
@@ -2262,16 +2262,16 @@
         },
         {
             "name": "nikic/php-parser",
-            "version": "v5.6.1",
+            "version": "v5.6.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nikic/PHP-Parser.git",
-                "reference": "f103601b29efebd7ff4a1ca7b3eeea9e3336a2a2"
+                "reference": "3a454ca033b9e06b63282ce19562e892747449bb"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/f103601b29efebd7ff4a1ca7b3eeea9e3336a2a2",
-                "reference": "f103601b29efebd7ff4a1ca7b3eeea9e3336a2a2",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/3a454ca033b9e06b63282ce19562e892747449bb",
+                "reference": "3a454ca033b9e06b63282ce19562e892747449bb",
                 "shasum": ""
             },
             "require": {
@@ -2314,9 +2314,9 @@
             ],
             "support": {
                 "issues": "https://github.com/nikic/PHP-Parser/issues",
-                "source": "https://github.com/nikic/PHP-Parser/tree/v5.6.1"
+                "source": "https://github.com/nikic/PHP-Parser/tree/v5.6.2"
             },
-            "time": "2025-08-13T20:13:15+00:00"
+            "time": "2025-10-21T19:32:17+00:00"
         },
         {
             "name": "phar-io/manifest",
diff --git a/pkgs/by-name/la/laravel/package.nix b/pkgs/by-name/la/laravel/package.nix
index 8ed1ade24a71..c7c3626719ec 100644
--- a/pkgs/by-name/la/laravel/package.nix
+++ b/pkgs/by-name/la/laravel/package.nix
@@ -7,19 +7,19 @@
 }:
 php.buildComposerProject2 (finalAttrs: {
   pname = "laravel";
-  version = "5.21.0";
+  version = "5.22.0";
 
   src = fetchFromGitHub {
     owner = "laravel";
     repo = "installer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2UfLzB3m/WjzJC7h/wYX9MHCUQFCVWRlXWVUpmDtUoE=";
+    hash = "sha256-kC6RD+rtjHXrOGhF/E9l8/eArTnDrXIw3D6lnDpsl7I=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-My17A7xl2HacrVP5SMzYpSar6cJ0MONznkJIPLFTII8=";
+  vendorHash = "sha256-s+wBvGnDyKbzniZoKJ4wUcv0FCo7XnrD6KYvYhllBFM=";
 
   # Adding npm (nodejs) and php composer to path
   postInstall = ''

From c56fff34f9e28184c066447adcd272427013e041 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Wed, 22 Oct 2025 07:40:03 +0200
Subject: [PATCH 33/60] gitlab: 18.5.0 -> 18.5.1

https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/
---
 pkgs/by-name/gi/gitaly/package.nix                  |  4 ++--
 pkgs/by-name/gi/gitlab-pages/package.nix            |  4 ++--
 pkgs/by-name/gi/gitlab/data.json                    | 12 ++++++------
 pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix |  2 +-
 pkgs/by-name/gi/gitlab/rubyEnv/Gemfile              |  3 ++-
 pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock         | 10 +++++-----
 pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix           |  8 ++++----
 7 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index c17b59e72158..f4860607a84e 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.5.0";
+  version = "18.5.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-kVFO8brtXWWGU2nWTtHR1q5RrTIXy2ssra9YjtWsglU=";
+      hash = "sha256-719FC9+OBX9Li9gkIpusFoZrpMyeDwCsoWxt9pfhI1A=";
     };
 
     vendorHash = "sha256-I2YMn84wEAY+Z02bmkyP/b0eix7FW3hP/noyEKYsEaQ=";
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index e9ebdcf15885..9f57f4318c51 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.5.0";
+  version = "18.5.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-7jMiKN2L4rF4YyqoJW8pzj5rP5g6ScwZ3qkY+OCZOZ8=";
+    hash = "sha256-UrVH5Ky5aiqquQ2o6bSkqLD4ULl9/vUViOoACantT1Q=";
   };
 
   vendorHash = "sha256-VWD/AXqEVWo7G9p1q1BM2LUNwAFmkPm+Gm2s9EPu6nM=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index 59c57336b8f2..a9150fdb3e22 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,16 +1,16 @@
 {
-  "version": "18.5.0",
-  "repo_hash": "0r1q6byqv3zziwsw63z7km5jjap7q6222j91lnr048w6cf425n1w",
+  "version": "18.5.1",
+  "repo_hash": "0h80pzsfn6lb8mz8igbpkmazzj3kkdwhrqxazjq6g9zrsqsvydx5",
   "yarn_hash": "16f7r4v4mjjdsfbzy5vy1g18p0l3gnjvfvzrl2xrxdibx7a3b4xs",
   "frontend_islands_yarn_hash": "0kks9hzm5fq3fss9ys8zxls3d3860l1fvsfcrbhf9rccmwvmjn3l",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.5.0-ee",
+  "rev": "v18.5.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.5.0",
-    "GITLAB_PAGES_VERSION": "18.5.0",
+    "GITALY_SERVER_VERSION": "18.5.1",
+    "GITLAB_PAGES_VERSION": "18.5.1",
     "GITLAB_SHELL_VERSION": "14.45.3",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.9.4",
-    "GITLAB_WORKHORSE_VERSION": "18.5.0"
+    "GITLAB_WORKHORSE_VERSION": "18.5.1"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 1e3add758495..a91f24c0e36c 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.5.0";
+  version = "18.5.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
index 49c314934630..868611f74092 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
@@ -331,7 +331,8 @@ gem 'js_regex', '~> 3.8', feature_category: :shared
 gem 'device_detector', feature_category: :shared
 
 # Redis
-gem 'redis', '~> 5.4.0', feature_category: :redis
+# Do NOT upgrade until Rails is upgraded with a version that contains https://github.com/rails/rails/pull/55359.
+gem 'redis', '= 5.4.0', feature_category: :redis
 gem 'redis-client', '~> 0.25', feature_category: :redis
 gem 'redis-cluster-client', '~> 0.13', feature_category: :redis
 gem 'redis-clustering', '~> 5.4.0', feature_category: :redis
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index cf4481484644..5bbab0aec3a3 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -1624,7 +1624,7 @@ GEM
       json
     recursive-open-struct (1.1.3)
     redcarpet (3.6.0)
-    redis (5.4.1)
+    redis (5.4.0)
       redis-client (>= 0.22.0)
     redis-actionpack (5.5.0)
       actionpack (>= 5)
@@ -1634,8 +1634,8 @@ GEM
       connection_pool
     redis-cluster-client (0.13.5)
       redis-client (~> 0.24)
-    redis-clustering (5.4.1)
-      redis (= 5.4.1)
+    redis-clustering (5.4.0)
+      redis (= 5.4.0)
       redis-cluster-client (>= 0.10.0)
     redis-namespace (1.11.0)
       redis (>= 4)
@@ -2364,7 +2364,7 @@ DEPENDENCIES
   rbtrace (~> 0.4)
   re2 (~> 2.15)
   recaptcha (~> 5.12)
-  redis (~> 5.4.0)
+  redis (= 5.4.0)
   redis-actionpack (~> 5.5.0)
   redis-client (~> 0.25)
   redis-cluster-client (~> 0.13)
@@ -2452,4 +2452,4 @@ DEPENDENCIES
   yard (~> 0.9)
 
 BUNDLED WITH
-   2.7.1
+   2.7.2
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
index 1f5b15a95a5a..a109fcdc6d3f 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@@ -7528,10 +7528,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bpsh5dbvybsa8qnv4dg11a6f2zn4sndarf7pk4iaayjgaspbrmm";
+      sha256 = "0syhyw1bp9nbb0fvcmm58y1c6iav6xw6b4bzjz1rz2j1d7c012br";
       type = "gem";
     };
-    version = "5.4.1";
+    version = "5.4.0";
   };
   redis-actionpack = {
     dependencies = [
@@ -7579,10 +7579,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sj4b3j7i3rb5a276g7yyd95kji4j9sl6wmqfgpz39gx06qlni47";
+      sha256 = "0fsnfi15xiy8sal6av11fqfjmdmjpy93amf790i0zwqcf1iq1qbw";
       type = "gem";
     };
-    version = "5.4.1";
+    version = "5.4.0";
   };
   redis-namespace = {
     dependencies = [ "redis" ];

From cad26e44ca96766faf1966beec0c9acf796858d5 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Wed, 22 Oct 2025 11:06:52 +0300
Subject: [PATCH 34/60] maintainers/team-list: drop myself from ACME team

I haven't been really active there for a while, and am not in the ACME
github team (anymore) either.
---
 maintainers/team-list.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 9708249e5fdb..036a2eba1cff 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -37,7 +37,6 @@ with lib.maintainers;
       aanderse
       arianvp
       emily
-      flokli
       m1cr0man
     ];
     scope = "Maintain ACME-related packages and modules.";

From a81c05b311e3a9e48b8d98cf72fba4f28d65fe98 Mon Sep 17 00:00:00 2001
From: Robert Helgesson <robert@rycee.net>
Date: Wed, 22 Oct 2025 09:29:32 +0200
Subject: [PATCH 35/60] grav: 1.7.49.5 -> 1.7.50.2

---
 pkgs/by-name/gr/grav/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/grav/package.nix b/pkgs/by-name/gr/grav/package.nix
index 0f2fa5f4c49b..89ea0e66bcca 100644
--- a/pkgs/by-name/gr/grav/package.nix
+++ b/pkgs/by-name/gr/grav/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.7.49.5";
+  version = "1.7.50.2";
 in
 stdenvNoCC.mkDerivation {
   pname = "grav";
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchzip {
     url = "https://github.com/getgrav/grav/releases/download/${version}/grav-admin-v${version}.zip";
-    hash = "sha256-zhjsYWma0qze8zdzX01EauzMONeEC6TRkhdQJUoJEUQ=";
+    hash = "sha256-UaaROMdUNFX6gcbJnfRn9CopZ3nuIMD91CkHnujtnE4=";
   };
 
   patches = [

From ce8c42d995342ee602c658d688be86b25428743d Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 20 Oct 2025 21:52:04 +0200
Subject: [PATCH 36/60] ci/README: add github-script policy

Over the last couple of months we have been migrating a lot of the old
bash code to JavaScript, which is supported in GitHub Actions via
`actions/github-script`. This change documents a "manual ratchet check"
for this migration - new code should only be introduced as JavaScript
and not as Bash. This will help us to eventually succeed with the
migration and ensure quality and maintainability.

We are migrating to JavaScript, because:

1. Using JavaScript is GitHub's [recommendation] against injection attacks.
   Using `actions/github-script` has first-class support for the event
   context and does not require to resort back to environment variables in
   most cases. When environment variables need to be used, these are
   accessed via `process.env`, without a risk for accidental injections.
   Using `actions/github-script` is also recommended in a recent
   [survey] of open source supply chain compromises:

   > Finally, since two out of three compromises were due to shell injection,
   > it might be safer to use a proper programming language, like JavaScript
   > with actions/github-script, or any other language accessing the context
   > via environment variables instead of YAML interpolation.

2. Handling even environment variables in Bash safely is almost
   impossible. For example arithmetic expressions cause arbitrary code
   execution vulnerabilities. While a lot of contributors are somehwat
   familiar writing Bash code for builders, writing *safe* Bash code for
   CI is a very different matter. Few people, if any, know how to do
   this.

3. GitHub Action's security model is quite unintuitive and even if some
   code runs with trusted inputs today, it may later be used in a more
   exposed context. Instead of making judgement calls about language
   choice case by case, a clear policy helps writing things defensively
   from the beginning.

4. We have developed a framework around our github-script based tools in
   `ci/github-script`. This provides a local `nix-shell` environment
   with the right dependencies and a local runner for these scripts for
   quick testing, debugging and development. No matter, whether you're
   developing a new feature, fixing bugs or reviewing a PR - this allows
   much quicker verification of the scripts, *without* running
   everything in a fork or test organization.

5. This framework also provides helpers for challenges that come up with
   GHA. One example is rate-limiting, where we have a helper script that
   will handle all rate-limiting needs for us, preventing us from
   running out of API calls and thus breaking CI entirely. We can only
   use these tools consistently, if we consistently use JavaScript code.

6. Using JavaScript allows us to handle JSON natively. Using
   `octokit/rest.js` provides first-class integration with GitHub's API.
   Together, this makes these scripts much more maintainable than
   resorting to `gh` and `jq`.

[recommendation]: https://docs.github.com/en/actions/reference/security/secure-use#use-an-action-instead-of-an-inline-script
[survey]: https://words.filippo.io/compromise-survey/
---
 ci/README.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/ci/README.md b/ci/README.md
index 797f231aea62..389ef59f57b9 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -10,6 +10,14 @@ In order to ensure that the needed packages are generally available without buil
 
 Run [`update-pinned.sh`](./update-pinned.sh) to update it.
 
+## GitHub specific code
+
+Some of the code is specific to GitHub.
+This code is currently spread out over multiple places and written in both Bash and JavaScript.
+The goal is to eventually have all GitHub specific code in `ci/github-script` and written in JavaScript via `actions/github-script`.
+A lot of code has already been migrated, but some Bash code still remains.
+New CI features need to be introduced in JavaScript, not Bash.
+
 ## `ci/nixpkgs-vet.sh BASE_BRANCH [REPOSITORY]`
 
 Runs the [`nixpkgs-vet` tool](https://github.com/NixOS/nixpkgs-vet) on the HEAD commit, closely matching what CI does.

From 0fa3eee10dfe160f4e80c250d813d2da23bc32df Mon Sep 17 00:00:00 2001
From: Marie Ramlow <me@nycode.dev>
Date: Wed, 22 Oct 2025 10:36:43 +0200
Subject: [PATCH 37/60] fritz-exporter: 2.5.2 -> 2.6.0

Diff: https://github.com/pdreker/fritz_exporter/compare/fritzexporter-v2.5.2...fritzexporter-v2.6.0
Release-Notes: https://github.com/pdreker/fritz_exporter/releases/tag/fritzexporter-v2.6.0
---
 pkgs/by-name/fr/fritz-exporter/package.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/fritz-exporter/package.nix b/pkgs/by-name/fr/fritz-exporter/package.nix
index 7c18ee1f1932..f45cf5b6e39a 100644
--- a/pkgs/by-name/fr/fritz-exporter/package.nix
+++ b/pkgs/by-name/fr/fritz-exporter/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fritz-exporter";
-  version = "2.5.2";
+  version = "2.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdreker";
     repo = "fritz_exporter";
     tag = "fritzexporter-v${version}";
-    hash = "sha256-xQLTI6b8X22aU6dj7Tmkzxn7vE4y8r/djUetG3Qg9Qw=";
+    hash = "sha256-m2jDQN6c3S4xDIrmRFdD+stwutBxcespLKZvxp1VC0I=";
   };
 
   postPatch = ''
@@ -43,6 +43,9 @@ python3.pkgs.buildPythonApplication rec {
     pytestCheckHook
   ];
 
+  # Required for tests
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     changelog = "https://github.com/pdreker/fritz_exporter/blob/${src.tag}/CHANGELOG.md";
     description = "Prometheus exporter for Fritz!Box home routers";

From 6a26c663358dec6488c8a9f71ee124a462c6e11f Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Wed, 22 Oct 2025 13:33:41 +0200
Subject: [PATCH 38/60] ci/eval/compare/maintainers: disable aliases

We should never try to ping maintainers through package aliases, this
can only lead to errors. One example case is, where an attribute is a
throw alias, but then re-introduced in a PR. This would trigger the
throw. By disabling aliases, we can fallback gracefully.
---
 ci/eval/compare/maintainers.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index fef5ecb8d9b9..b3ebf6aee569 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -7,7 +7,13 @@
   removedattrs,
 }:
 let
-  pkgs = import ../../.. { system = "x86_64-linux"; };
+  pkgs = import ../../.. {
+    system = "x86_64-linux";
+    # We should never try to ping maintainers through package aliases, this can only lead to errors.
+    # One example case is, where an attribute is a throw alias, but then re-introduced in a PR.
+    # This would trigger the throw. By disabling aliases, we can fallback gracefully below.
+    config.allowAliases = false;
+  };
 
   changedpaths = lib.importJSON changedpathsjson;
 

From 8edb1fc3c2b2dfdf212e0e32d1efe2e2bf47e723 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Wed, 22 Oct 2025 13:39:38 +0200
Subject: [PATCH 39/60] workflows/prepare: retry automatically

We have seen API errors in the prepare scripts frequently the last
couple of days. A quick fix should be to retry these requests.
---
 .github/workflows/pr.yml   | 1 +
 .github/workflows/test.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 9f4a2ba4d0b4..d443d68cdad9 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -40,6 +40,7 @@ jobs:
       - id: prepare
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
+          retries: 3
           script: |
             require('./ci/github-script/prepare.js')({
               github,
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0d5f20e3b57b..4431e89954f3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -27,6 +27,7 @@ jobs:
       - id: prepare
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
+          retries: 3
           script: |
             require('./ci/github-script/prepare.js')({
               github,

From db8d5de6f55767477ba0fd02a0ea4be9b82914c5 Mon Sep 17 00:00:00 2001
From: Thibault Gagnaux <thibault.gagnaux@bit.admin.ch>
Date: Tue, 21 Oct 2025 11:44:03 +0200
Subject: [PATCH 40/60] {gpclient,gpauth}: update 2.4.1 -> 2.4.6

---
 pkgs/by-name/gp/gpauth/package.nix   |  6 +++---
 pkgs/by-name/gp/gpclient/package.nix | 10 ++++++++++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gp/gpauth/package.nix b/pkgs/by-name/gp/gpauth/package.nix
index a78cddb2f7fe..2b31edcb2836 100644
--- a/pkgs/by-name/gp/gpauth/package.nix
+++ b/pkgs/by-name/gp/gpauth/package.nix
@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gpauth";
-  version = "2.4.1";
+  version = "2.4.6";
 
   src = fetchFromGitHub {
     owner = "yuezk";
     repo = "GlobalProtect-openconnect";
     rev = "v${version}";
-    hash = "sha256-MY4JvftrC6sR8M0dFvnGZOkvHIhPRcyct9AG/8527gw=";
+    hash = "sha256-AxerhMQBgEgeecKAhedokMdpra1C9iqhutPrdAQng6Q=";
   };
 
   buildAndTestSubdir = "apps/gpauth";
 
-  cargoHash = "sha256-8LSGuRnWRWeaY6t25GdZ2y4hGIJ+mP3UBXRjcvPuD6U=";
+  cargoHash = "sha256-oPnBpwE8bdYgve1Dh64WNjWXClSRoHL5PVwrB1ovU6Y=";
 
   nativeBuildInputs = [
     perl
diff --git a/pkgs/by-name/gp/gpclient/package.nix b/pkgs/by-name/gp/gpclient/package.nix
index 78e6c0a975bf..0412494e614b 100644
--- a/pkgs/by-name/gp/gpclient/package.nix
+++ b/pkgs/by-name/gp/gpclient/package.nix
@@ -8,6 +8,11 @@
   perl,
   pkg-config,
   vpnc-scripts,
+  glib,
+  pango,
+  cairo,
+  atk,
+  gtk3,
 }:
 
 rustPlatform.buildRustPackage {
@@ -32,6 +37,11 @@ rustPlatform.buildRustPackage {
     openconnect
     openssl
     glib-networking
+    glib
+    pango
+    cairo
+    atk
+    gtk3
   ];
 
   preConfigure = ''

From 1d5d744033d75dbf141a4fe9acd214ba43f03d56 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Wed, 22 Oct 2025 13:13:33 +0200
Subject: [PATCH 41/60] python3Packages.django-treenode: init at 0.23.2

required for paperless-ngx 2.19.0
---
 .../django-treenode/default.nix               | 40 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 42 insertions(+)
 create mode 100644 pkgs/development/python-modules/django-treenode/default.nix

diff --git a/pkgs/development/python-modules/django-treenode/default.nix b/pkgs/development/python-modules/django-treenode/default.nix
new file mode 100644
index 000000000000..a445a478121d
--- /dev/null
+++ b/pkgs/development/python-modules/django-treenode/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  django,
+}:
+
+buildPythonPackage rec {
+  pname = "django-treenode";
+  version = "0.23.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fabiocaccamo";
+    repo = "django-treenode";
+    tag = version;
+    hash = "sha256-9AG8ntuXHB3jUHRKFDh7OOT5c0Nt8uAZnf5dR7xC/Bc=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    django
+  ];
+
+  pythonImportsCheck = [
+    "treenode"
+  ];
+
+  meta = {
+    description = "Deciduous_tree: probably the best abstract model/admin for your tree based stuff";
+    homepage = "https://github.com/fabiocaccamo/django-treenode";
+    changelog = "https://github.com/fabiocaccamo/django-treenode/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ leona ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ea017e16abb6..0ede87779691 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4156,6 +4156,8 @@ self: super: with self; {
 
   django-treebeard = callPackage ../development/python-modules/django-treebeard { };
 
+  django-treenode = callPackage ../development/python-modules/django-treenode { };
+
   django-two-factor-auth = callPackage ../development/python-modules/django-two-factor-auth { };
 
   django-types = callPackage ../development/python-modules/django-types { };

From 997e93908aed94b8d97d3e14265fd6934040629d Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Wed, 22 Oct 2025 13:13:33 +0200
Subject: [PATCH 42/60] python3Packages.gotenberg-client: 0.11.0 -> 0.12.0

---
 pkgs/development/python-modules/gotenberg-client/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gotenberg-client/default.nix b/pkgs/development/python-modules/gotenberg-client/default.nix
index 3f2cb9c04844..85a752ea301d 100644
--- a/pkgs/development/python-modules/gotenberg-client/default.nix
+++ b/pkgs/development/python-modules/gotenberg-client/default.nix
@@ -9,14 +9,14 @@
 }:
 buildPythonPackage rec {
   pname = "gotenberg-client";
-  version = "0.11.0";
+  version = "0.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stumpylog";
     repo = "gotenberg-client";
     tag = version;
-    hash = "sha256-a/GXVhZtxGgmx5mb8hozbXAI9ecrl0c6BIz3BNekA8Q=";
+    hash = "sha256-+beO1Pp+ikfk4gqpfvIEHCOPZGLanGX6Kw4mqJglJTI=";
   };
 
   build-system = [ hatchling ];

From d28f7498c973875ccd097cb030d2c12f0fcbf515 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Wed, 22 Oct 2025 13:13:33 +0200
Subject: [PATCH 43/60] paperless-ngx: 2.18.4 -> 2.19.0

https://github.com/paperless-ngx/paperless-ngx/releases/tag/v2.19.0
---
 pkgs/by-name/pa/paperless-ngx/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 0fad77fe6a12..a518dc7625f9 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -28,13 +28,13 @@
   xorg,
 }:
 let
-  version = "2.18.4";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     tag = "v${version}";
-    hash = "sha256-sQ5laFO6DSg+4tF9jk2yuV0q2Vp7VC/+hu2XrVj8/bY=";
+    hash = "sha256-t2T42K+F3PaMfNDFa3NF/rAcG6izKTXMIzgD68WdVFE=";
   };
 
   python = python3.override {
@@ -80,7 +80,7 @@ let
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname version src;
       fetcherVersion = 2;
-      hash = "sha256-fs9a2uI/TnWalQ/qRb6m4d1CsU7O6VYCJMz2xWLdC0I=";
+      hash = "sha256-AJp796oO8qOltPKndOXlLx1luCOfzsRSFscCUCe6MZo=";
     };
 
     nativeBuildInputs = [
@@ -168,10 +168,9 @@ python.pkgs.buildPythonApplication rec {
 
   pythonRelaxDeps = [
     "django-allauth"
-    "django-guardian"
+    "django-cors-headers"
+    "drf-spectacular-sidecar"
     "filelock"
-    "ocrmypdf"
-    "rapidfuzz"
     "redis"
   ];
 
@@ -207,6 +206,7 @@ python.pkgs.buildPythonApplication rec {
       django-guardian
       django-multiselectfield
       django-soft-delete
+      django-treenode
       djangorestframework
       djangorestframework-guardian
       drf-spectacular

From 13a6d7fc6d56ce5e4514dfe06e0c2a184f48a471 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Oct 2025 13:29:17 +0000
Subject: [PATCH 44/60] opentabletdriver: 0.6.6.1 -> 0.6.6.2

---
 pkgs/by-name/op/opentabletdriver/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/opentabletdriver/package.nix b/pkgs/by-name/op/opentabletdriver/package.nix
index 2e5a79bdb483..04a3730acb58 100644
--- a/pkgs/by-name/op/opentabletdriver/package.nix
+++ b/pkgs/by-name/op/opentabletdriver/package.nix
@@ -23,13 +23,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "OpenTabletDriver";
-  version = "0.6.6.1";
+  version = "0.6.6.2";
 
   src = fetchFromGitHub {
     owner = "OpenTabletDriver";
     repo = "OpenTabletDriver";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ixckDFE/LCSncNGjXqPT5GurPhm5aSVALOw4ZrBa5Ww=";
+    hash = "sha256-OeioFdevYPiLl9w7FXVmpbcp1cIMoMYnSLgoBisOOOU=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;

From 2bebb656992db02d4e217a57427f69e751a18cd4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Oct 2025 13:35:04 +0000
Subject: [PATCH 45/60] nemu: 3.3.1 -> 3.4.0

---
 pkgs/by-name/ne/nemu/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ne/nemu/package.nix b/pkgs/by-name/ne/nemu/package.nix
index 0ec873b2faac..329754fe2c1b 100644
--- a/pkgs/by-name/ne/nemu/package.nix
+++ b/pkgs/by-name/ne/nemu/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nemu";
-  version = "3.3.1";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "nemuTUI";
     repo = "nemu";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6WzqBkspKKs1e8kg1i71ntZHa78s5pJ1u02mXvzpiEc=";
+    hash = "sha256-QvyCBHZmahZPIghPX53HcL5HsOVvhsVwdMZosVQ9A5U=";
   };
 
   cmakeFlags = [

From 89f2026b8e7d9cc41b4481cea968cba302c8352e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Oct 2025 14:04:36 +0000
Subject: [PATCH 46/60] postgresqlPackages.pg_ivm: 1.12 -> 1.13

---
 pkgs/servers/sql/postgresql/ext/pg_ivm.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
index fa58af91cb6c..1d9bd45d3680 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
@@ -7,13 +7,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_ivm";
-  version = "1.12";
+  version = "1.13";
 
   src = fetchFromGitHub {
     owner = "sraoss";
     repo = "pg_ivm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UeRcxoUkpPw4EcQXKUxHamjczOaE59d00kSrYsijnH8=";
+    hash = "sha256-DKU5jwnRo/kMycnq4nAdQTiZwv/wXybyjXLtz4xdaBo=";
   };
 
   meta = {

From 9521fd2fbbb3eb68a71e10f78e5360d17635e4e7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Sep 2025 05:22:53 +0000
Subject: [PATCH 47/60] kdePackages.qt6gtk2: 0.5 -> 0.6

---
 pkgs/tools/misc/qt6gtk2/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/qt6gtk2/default.nix b/pkgs/tools/misc/qt6gtk2/default.nix
index b2ffaac64abe..0bcd31da1850 100644
--- a/pkgs/tools/misc/qt6gtk2/default.nix
+++ b/pkgs/tools/misc/qt6gtk2/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qt6gtk2";
-  version = "0.5";
+  version = "0.6";
 
   src = fetchFromGitLab {
     domain = "opencode.net";
     owner = "trialuser";
     repo = "qt6gtk2";
     tag = finalAttrs.version;
-    hash = "sha256-G2TQ4LU8Cmvd+u6/s1ugbUkZcRXHTBm3+ISY0g/5/60=";
+    hash = "sha256-RJybIm0HllnYaPfsnci+9ZCGvvL9F2MC7dDbiK+L7bU=";
   };
 
   buildInputs = [
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "GTK+2.0 integration plugins for Qt6";
     license = lib.licenses.gpl2Plus;
-    homepage = "https://github.com/trialuser02/qt6gtk2";
+    homepage = "https://www.opencode.net/trialuser/qt6gtk2";
     maintainers = [ lib.maintainers.misterio77 ];
     platforms = lib.platforms.linux;
   };

From e53e10938c73da21f3fc763485aee70ea56f8e3b Mon Sep 17 00:00:00 2001
From: John Titor <50095635+JohnRTitor@users.noreply.github.com>
Date: Wed, 22 Oct 2025 19:50:35 +0530
Subject: [PATCH 48/60] nixosTests.limine.secureBoot: fix secure boot check

An easier way to check if secureBoot is enabled is by running mokutil --sb-state

We have to do this way now because on systemd v258 `bootctl status` returns non 0 value if systemd-boot is not properly installed, which is to be expected when using Limine.
---
 nixos/tests/limine/secure-boot.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/limine/secure-boot.nix b/nixos/tests/limine/secure-boot.nix
index 52508f7eb385..9811734db5cb 100644
--- a/nixos/tests/limine/secure-boot.nix
+++ b/nixos/tests/limine/secure-boot.nix
@@ -26,10 +26,12 @@
       boot.loader.limine.secureBoot.enable = true;
       boot.loader.limine.secureBoot.createAndEnrollKeys = true;
       boot.loader.timeout = 0;
+
+      environment.systemPackages = [ pkgs.mokutil ];
     };
 
   testScript = ''
     machine.start()
-    assert "Secure Boot: enabled (user)" in machine.succeed("bootctl status")
+    assert "SecureBoot enabled" in machine.succeed("mokutil --sb-state")
   '';
 }

From 312201f83f1b8e378340e75318951090aab1f848 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Oct 2025 14:37:13 +0000
Subject: [PATCH 49/60] pixi-pack: 0.7.3 -> 0.7.4

---
 pkgs/by-name/pi/pixi-pack/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pi/pixi-pack/package.nix b/pkgs/by-name/pi/pixi-pack/package.nix
index 18090d797625..591fafd8ba92 100644
--- a/pkgs/by-name/pi/pixi-pack/package.nix
+++ b/pkgs/by-name/pi/pixi-pack/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pixi-pack";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "Quantco";
     repo = "pixi-pack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IYY5moAxZ+pDF6G6KxfuB6DI+Y5V8AseFUyWGs77+bQ=";
+    hash = "sha256-R+JydhsYha4bQu7KBMEyV5IijnPtJZphbSib9JpchrI=";
   };
 
-  cargoHash = "sha256-EM1xCQGIXI2Q5OkfXcReGvPSLiVq98sleo0+rYa0bkw=";
+  cargoHash = "sha256-U2Ty8ZzNkhDc2O3I3ceFcZRk3fu0aSzwsdIuo6Edcx0=";
 
   buildInputs = [ openssl ];
 

From 155bcc68661df145de1540ea6ee59de72f7edc7a Mon Sep 17 00:00:00 2001
From: adam <me@adamperkowski.dev>
Date: Tue, 21 Oct 2025 15:31:33 +0200
Subject: [PATCH 50/60] julec.hook: init

Co-authored-by: philiptaron <philip.taron@gmail.com>
---
 .editorconfig                                 |  4 +
 doc/hooks/index.md                            |  1 +
 doc/hooks/julec.section.md                    | 77 ++++++++++++++++++
 doc/redirects.json                            | 36 +++++++++
 pkgs/by-name/ju/julec/hook.nix                | 15 ++++
 pkgs/by-name/ju/julec/hook.sh                 | 80 +++++++++++++++++++
 pkgs/by-name/ju/julec/package.nix             |  7 ++
 pkgs/by-name/ju/julec/test/default.nix        | 19 +++++
 .../by-name/ju/julec/test/hello-jule/jule.mod |  0
 .../ju/julec/test/hello-jule/src/_test.jule   |  8 ++
 .../ju/julec/test/hello-jule/src/main.jule    |  7 ++
 11 files changed, 254 insertions(+)
 create mode 100644 doc/hooks/julec.section.md
 create mode 100644 pkgs/by-name/ju/julec/hook.nix
 create mode 100644 pkgs/by-name/ju/julec/hook.sh
 create mode 100644 pkgs/by-name/ju/julec/test/default.nix
 create mode 100644 pkgs/by-name/ju/julec/test/hello-jule/jule.mod
 create mode 100644 pkgs/by-name/ju/julec/test/hello-jule/src/_test.jule
 create mode 100644 pkgs/by-name/ju/julec/test/hello-jule/src/main.jule

diff --git a/.editorconfig b/.editorconfig
index 2d877d20b825..6972df7013d6 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -89,6 +89,10 @@ trim_trailing_whitespace = unset
 end_of_line = unset
 insert_final_newline = unset
 
+# see https://manual.jule.dev/project/code-style.html#indentions
+[*.jule]
+indent_style = tab
+
 # Keep this hint at the bottom:
 # Please don't add entries for subfolders here.
 # Create <subfolder>/.editorconfig instead.
diff --git a/doc/hooks/index.md b/doc/hooks/index.md
index cd04fd84495a..cd769cec0373 100644
--- a/doc/hooks/index.md
+++ b/doc/hooks/index.md
@@ -20,6 +20,7 @@ ghc.section.md
 gnome.section.md
 haredo.section.md
 installShellFiles.section.md
+julec.section.md
 just.section.md
 libiconv.section.md
 libxml2.section.md
diff --git a/doc/hooks/julec.section.md b/doc/hooks/julec.section.md
new file mode 100644
index 000000000000..f85619ac39e7
--- /dev/null
+++ b/doc/hooks/julec.section.md
@@ -0,0 +1,77 @@
+# julec.hook {#julec-hook}
+
+[Jule](https://jule.dev) is an effective programming language designed to build efficient, fast, reliable and safe software while maintaining simplicity.
+
+In Nixpkgs, `jule.hook` overrides the default build, check and install phases.
+
+## Example code snippet {#julec-hook-example-code-snippet}
+
+```nix
+{
+  julec,
+  clangStdenv,
+}:
+
+clangStdenv.mkDerivation (finalAttrs: {
+  # ...
+
+  nativeBuildInputs = [ julec.hook ];
+
+  # Customize filenames if needed
+  JULE_SRC_DIR = "./src";
+  JULE_OUT_DIR = "./bin";
+  JULE_OUT_NAME = "hello-jule";
+  JULE_TEST_DIR = "./tests";
+  JULE_TEST_OUT_DIR = "./test-bin";
+  JULE_TEST_OUT_NAME = "hello-jule-test";
+
+  # ...
+})
+```
+
+## Variables controlling julec.hook {#julec-hook-variables}
+
+### `JULE_SRC_DIR` {#julec-hook-variable-jule-src-dir}
+
+Specifies the source directory containing `main.jule`.
+Default is `./src`.
+
+### `JULE_OUT_DIR` {#julec-hook-variable-jule-out-dir}
+
+Specifies the output directory for the compiled binary.
+Default is `./bin`.
+
+### `JULE_OUT_NAME` {#julec-hook-variable-jule-out-name}
+
+Specifies the name of the compiled binary.
+Default is `output`.
+
+### `JULE_TEST_DIR` {#julec-hook-variable-jule-test-dir}
+
+Specifies the directory containing test files.
+Default is the value of [`JULE_SRC_DIR`](#julec-hook-variable-jule-src-dir).
+
+### `JULE_TEST_OUT_DIR` {#julec-hook-variable-jule-test-out-dir}
+
+Specifies the output directory for compiled test binaries.
+Default is the value of [`JULE_OUT_DIR`](#julec-hook-variable-jule-out-dir).
+
+### `JULE_TEST_OUT_NAME` {#julec-hook-variable-jule-test-out-name}
+
+Specifies the name of the compiled test binary.
+Default is the value of [`JULE_OUT_NAME`](#julec-hook-variable-jule-out-name) with `-test` suffix.
+
+### `dontUseJulecBuild` {#julec-hook-variable-dontusejulecbuild}
+
+When set to true, doesn't use the predefined `julecBuildHook`.
+Default is false.
+
+### `dontUseJulecCheck` {#julec-hook-variable-dontusejuleccheck}
+
+When set to true, doesn't use the predefined `julecCheckHook`.
+Default is false.
+
+### `dontUseJulecInstall` {#julec-hook-variable-dontusejulecinstall}
+
+When set to true, doesn't use the predefined `julecInstallHook`.
+Default is false.
diff --git a/doc/redirects.json b/doc/redirects.json
index b4cec3d403eb..4198cee6ca48 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -124,6 +124,42 @@
   "inkscape-plugins": [
     "index.html#inkscape-plugins"
   ],
+  "julec-hook": [
+    "index.html#julec-hook"
+  ],
+  "julec-hook-example-code-snippet": [
+    "index.html#julec-hook-example-code-snippet"
+  ],
+  "julec-hook-variable-dontusejulecbuild": [
+    "index.html#julec-hook-variable-dontusejulecbuild"
+  ],
+  "julec-hook-variable-dontusejuleccheck": [
+    "index.html#julec-hook-variable-dontusejuleccheck"
+  ],
+  "julec-hook-variable-dontusejulecinstall": [
+    "index.html#julec-hook-variable-dontusejulecinstall"
+  ],
+  "julec-hook-variable-jule-out-dir": [
+    "index.html#julec-hook-variable-jule-out-dir"
+  ],
+  "julec-hook-variable-jule-out-name": [
+    "index.html#julec-hook-variable-jule-out-name"
+  ],
+  "julec-hook-variable-jule-src-dir": [
+    "index.html#julec-hook-variable-jule-src-dir"
+  ],
+  "julec-hook-variable-jule-test-dir": [
+    "index.html#julec-hook-variable-jule-test-dir"
+  ],
+  "julec-hook-variable-jule-test-out-dir": [
+    "index.html#julec-hook-variable-jule-test-out-dir"
+  ],
+  "julec-hook-variable-jule-test-out-name": [
+    "index.html#julec-hook-variable-jule-test-out-name"
+  ],
+  "julec-hook-variables": [
+    "index.html#julec-hook-variables"
+  ],
   "major-ghc-deprecation": [
     "index.html#major-ghc-deprecation"
   ],
diff --git a/pkgs/by-name/ju/julec/hook.nix b/pkgs/by-name/ju/julec/hook.nix
new file mode 100644
index 000000000000..d6cccb165979
--- /dev/null
+++ b/pkgs/by-name/ju/julec/hook.nix
@@ -0,0 +1,15 @@
+{
+  julec,
+  clang,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "julec-hook";
+
+  propagatedBuildInputs = [ julec ];
+
+  meta = {
+    inherit (julec.meta) maintainers;
+  };
+} ./hook.sh
diff --git a/pkgs/by-name/ju/julec/hook.sh b/pkgs/by-name/ju/julec/hook.sh
new file mode 100644
index 000000000000..112dc48d0c81
--- /dev/null
+++ b/pkgs/by-name/ju/julec/hook.sh
@@ -0,0 +1,80 @@
+# shellcheck shell=bash disable=SC2154,SC2034
+
+julecSetEnv() {
+  if [ -z "$JULE_SRC_DIR" ]; then
+    export JULE_SRC_DIR='./src'
+  fi
+  if [ -z "$JULE_OUT_DIR" ]; then
+    export JULE_OUT_DIR='./bin'
+  fi
+  if [ -z "$JULE_OUT_NAME" ]; then
+    export JULE_OUT_NAME='output'
+  fi
+  if [ -z "$JULE_TEST_DIR" ]; then
+    export JULE_TEST_DIR="$JULE_SRC_DIR"
+  fi
+  if [ -z "$JULE_TEST_OUT_DIR" ]; then
+    export JULE_TEST_OUT_DIR="$JULE_OUT_DIR"
+  fi
+  if [ -z "$JULE_TEST_OUT_NAME" ]; then
+    export JULE_TEST_OUT_NAME="$JULE_OUT_NAME-test"
+  fi
+}
+
+julecBuildHook() {
+  echo "Executing julecBuildHook"
+
+  runHook preBuild
+
+  julecSetEnv
+  mkdir -p "$JULE_OUT_DIR"
+  julec --opt L2 -p -o "$JULE_OUT_DIR/$JULE_OUT_NAME" "$JULE_SRC_DIR"
+
+  runHook postBuild
+
+  echo "Finished julecBuildHook"
+}
+
+julecCheckHook() {
+  echo "Executing julecCheckHook"
+
+  runHook preCheck
+
+  echo "Building tests..."
+
+  julecSetEnv
+  mkdir -p "$JULE_TEST_OUT_DIR"
+  julec test -o "$JULE_TEST_OUT_DIR/$JULE_TEST_OUT_NAME" "$JULE_TEST_DIR"
+
+  echo "Running tests..."
+
+  "$JULE_TEST_OUT_DIR/$JULE_TEST_OUT_NAME"
+
+  runHook postCheck
+
+  echo "Finished julecCheckHook"
+}
+
+julecInstallHook() {
+  echo "Executing julecInstallHook"
+
+  runHook preInstall
+
+  julecSetEnv
+  mkdir -p "$out/bin"
+  cp -r "$JULE_OUT_DIR/$JULE_OUT_NAME" "$out/bin/"
+
+  runHook postInstall
+
+  echo "Finished julecInstallHook"
+}
+
+if [ -z "${dontUseJulecBuild-}" ] && [ -z "${buildPhase-}" ]; then
+  buildPhase=julecBuildHook
+fi
+if [ -z "${dontUseJulecCheck-}" ] && [ -z "${checkPhase-}" ]; then
+  checkPhase=julecCheckHook
+fi
+if [ -z "${dontUseJulecInstall-}" ] && [ -z "${installPhase-}" ]; then
+  installPhase=julecInstallHook
+fi
diff --git a/pkgs/by-name/ju/julec/package.nix b/pkgs/by-name/ju/julec/package.nix
index 27a007a791ee..e22298483855 100644
--- a/pkgs/by-name/ju/julec/package.nix
+++ b/pkgs/by-name/ju/julec/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   clangStdenv,
+  callPackage,
   fetchFromGitHub,
 }:
 
@@ -93,6 +94,12 @@ clangStdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru = {
+    # see doc/hooks/julec.section.md
+    hook = callPackage ./hook.nix { julec = finalAttrs.finalPackage; };
+    tests.hello-jule = callPackage ./test { julec = finalAttrs.finalPackage; };
+  };
+
   meta = {
     description = "Jule Programming Language Compiler";
     longDescription = ''
diff --git a/pkgs/by-name/ju/julec/test/default.nix b/pkgs/by-name/ju/julec/test/default.nix
new file mode 100644
index 000000000000..6717600389c9
--- /dev/null
+++ b/pkgs/by-name/ju/julec/test/default.nix
@@ -0,0 +1,19 @@
+{
+  julec,
+  clangStdenv,
+}:
+
+clangStdenv.mkDerivation (finalAttrs: {
+  pname = "hello-jule";
+  inherit (julec) version;
+
+  src = ./hello-jule;
+
+  nativeBuildInputs = [ julec.hook ];
+
+  doCheck = true;
+
+  meta = {
+    inherit (julec.meta) platforms;
+  };
+})
diff --git a/pkgs/by-name/ju/julec/test/hello-jule/jule.mod b/pkgs/by-name/ju/julec/test/hello-jule/jule.mod
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/pkgs/by-name/ju/julec/test/hello-jule/src/_test.jule b/pkgs/by-name/ju/julec/test/hello-jule/src/_test.jule
new file mode 100644
index 000000000000..53b23c3cf884
--- /dev/null
+++ b/pkgs/by-name/ju/julec/test/hello-jule/src/_test.jule
@@ -0,0 +1,8 @@
+use "std/testing"
+
+#test
+fn testPi(t: &testing::T) {
+		if getPi() != 3.14 {
+				t.Errorf("PI not precise enough")
+		}
+}
diff --git a/pkgs/by-name/ju/julec/test/hello-jule/src/main.jule b/pkgs/by-name/ju/julec/test/hello-jule/src/main.jule
new file mode 100644
index 000000000000..322bd3111649
--- /dev/null
+++ b/pkgs/by-name/ju/julec/test/hello-jule/src/main.jule
@@ -0,0 +1,7 @@
+fn main() {
+		println("Hello, Jule!");
+}
+
+fn getPi(): f64 {
+		ret 3.14;
+}

From 8a45925d3567391944a2f50c009cc3a9730fb252 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Oct 2025 15:06:56 +0000
Subject: [PATCH 51/60] dependabot-cli: 1.76.0 -> 1.76.1

---
 pkgs/by-name/de/dependabot-cli/package.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix
index 9e4f43601691..e2fe18a1e96f 100644
--- a/pkgs/by-name/de/dependabot-cli/package.nix
+++ b/pkgs/by-name/de/dependabot-cli/package.nix
@@ -12,20 +12,20 @@
 }:
 let
   pname = "dependabot-cli";
-  version = "1.76.0";
+  version = "1.76.1";
 
   # `tag` is what `dependabot` uses to find the relevant docker images.
   tag = "nixpkgs-dependabot-cli-${version}";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy --image-tag latest --final-image-name dependabot-update-job-proxy --final-image-tag ${tag}
-  updateJobProxy.imageDigest = "sha256:42b2a171891f4667d9a443cbfdc5f10a58e5b5d7f1b9eae6c12ec9815bec72fd";
-  updateJobProxy.hash = "sha256-+GcGyip8cgVBZeji6Zn3oN8Mc3xZvASohbPVNUbHOgA=";
+  updateJobProxy.imageDigest = "sha256:d40c689e947e78ecdaccb3da1d070a458b7f1d1cfb3052cf5751e43583d89560";
+  updateJobProxy.hash = "sha256-6VhY+7pg6+LXQ1F58ghKdabqpgPcbxWI91KNz6FntJA=";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/dependabot/dependabot-updater-github-actions --image-tag latest --final-image-name dependabot-updater-github-actions --final-image-tag ${tag}
-  updaterGitHubActions.imageDigest = "sha256:d26d4ce071684b63d935c550552ae0d129f845254cb1e2f8635f15c62f43319e";
-  updaterGitHubActions.hash = "sha256-21E8q1+cwYlD8FL5njGhpsGRd/YkGQNS/y0howQFp6g=";
+  updaterGitHubActions.imageDigest = "sha256:e2cfbdde4014cd17cd85b9b411cb87a41d985bc27569e5fe1457ec68d16400b1";
+  updaterGitHubActions.hash = "sha256-VC+F0139+7n6rBLAw6MCgMf6yHCci7blaeLkHJ22fVc=";
 in
 buildGoModule {
   inherit pname version;
@@ -34,10 +34,10 @@ buildGoModule {
     owner = "dependabot";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-fSb2zzddwGJ1r9NhPEhE1WCndyoBK4VLOP3CmQUcjy0=";
+    hash = "sha256-i/Kr+69ws3HDWS+cQSn3cZzvW6GzKT+Avd3fZfvSA/c=";
   };
 
-  vendorHash = "sha256-xdouoPEPPhHcXNWxMdcdxVQsgRlFXBXjyZQ7CcROA4U=";
+  vendorHash = "sha256-dD48OKpuGAJAro7qV4tqpf/uENV2X1VQ2kUvAuJLXc0=";
 
   ldflags = [
     "-s"

From e0da918f8f010d0a0f369b0e1bd5da6b18403040 Mon Sep 17 00:00:00 2001
From: Rafael Ieda <git@ieda.me>
Date: Wed, 22 Oct 2025 12:15:07 -0300
Subject: [PATCH 52/60] mbusd: fix build with cmake4

---
 pkgs/by-name/mb/mbusd/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/mb/mbusd/package.nix b/pkgs/by-name/mb/mbusd/package.nix
index baba9df86a83..a80cf02fd297 100644
--- a/pkgs/by-name/mb/mbusd/package.nix
+++ b/pkgs/by-name/mb/mbusd/package.nix
@@ -22,6 +22,11 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.2)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = {
     description = "Modbus TCP to Modbus RTU (RS-232/485) gateway";
     homepage = "https://github.com/3cky/mbusd";

From bb7dd24c07ffb410ef8d30ae7ad32d094b06ed6f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Oct 2025 15:22:16 +0000
Subject: [PATCH 53/60] postfix-tlspol: 1.8.19 -> 1.8.20

---
 pkgs/by-name/po/postfix-tlspol/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/po/postfix-tlspol/package.nix b/pkgs/by-name/po/postfix-tlspol/package.nix
index 700e77578310..627a0309d56f 100644
--- a/pkgs/by-name/po/postfix-tlspol/package.nix
+++ b/pkgs/by-name/po/postfix-tlspol/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "postfix-tlspol";
-  version = "1.8.19";
+  version = "1.8.20";
 
   src = fetchFromGitHub {
     owner = "Zuplu";
     repo = "postfix-tlspol";
     tag = "v${version}";
-    hash = "sha256-DSkWE76GSQKkrXAlnMvjTPAa4I4J07mZL9eea06Dzb8=";
+    hash = "sha256-/+FWTrb39PB1L6UDXAr3w0c0bMrpptX23g8WHI794GA=";
   };
 
   vendorHash = null;

From 9f4aae33c9e0a66598a368050170f395e5c53c3b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Oct 2025 15:54:37 +0000
Subject: [PATCH 54/60] switchfin: 0.7.5 -> 0.7.6

---
 pkgs/by-name/sw/switchfin/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sw/switchfin/package.nix b/pkgs/by-name/sw/switchfin/package.nix
index 5331a060a489..c3e64cfe49e8 100644
--- a/pkgs/by-name/sw/switchfin/package.nix
+++ b/pkgs/by-name/sw/switchfin/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "switchfin";
-  version = "0.7.5";
+  version = "0.7.6";
 
   src = fetchFromGitHub {
     owner = "dragonflylee";
     repo = "switchfin";
     rev = version;
-    hash = "sha256-vmf7urq3lnfvmdZUJ+G5zn4ZpNA2N4jlLo8D5ZG3tUQ=";
+    hash = "sha256-WEqscGd7K5tTQcK8XXc02EQU2yCbTIdrzw40eXw8lYY=";
     fetchSubmodules = true;
   };
 

From 15b473ecb1f9a3fcbe43e269bafb4549a16cf006 Mon Sep 17 00:00:00 2001
From: networkException <git@nwex.de>
Date: Wed, 22 Oct 2025 17:59:15 +0200
Subject: [PATCH 55/60] ungoogled-chromium: 141.0.7390.107-1 ->
 141.0.7390.122-1

https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_21.html

This update includes 1 security fix.

CVEs:
CVE-2025-12036
---
 .../networking/browsers/chromium/info.json             | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 60470a5e6638..3ce8d2d65f6e 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -808,7 +808,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "141.0.7390.107",
+    "version": "141.0.7390.122",
     "deps": {
       "depot_tools": {
         "rev": "3f41e54ae17d53d4a39feecad64c3d3e6871b219",
@@ -820,16 +820,16 @@
         "hash": "sha256-WERLGrReUATmn3RhxtmyZcJBxdIY/WZqBDranCLDYEg="
       },
       "ungoogled-patches": {
-        "rev": "141.0.7390.107-1",
-        "hash": "sha256-IQoIcOlFhbSBpmZ6bpoX43XMPrKWRVExETjBBT4TCs0="
+        "rev": "141.0.7390.122-1",
+        "hash": "sha256-xFJdvGHLMXNcotHTamh9Q4M2/ctoJ3b5ORHBWtZOY90="
       },
       "npmHash": "sha256-i1eQ4YlrWSgY522OlFtGDDPmxE2zd1hDM03AzR8RafE="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "1c008349f76ff3a317bf28316fc5008c0120deb4",
-        "hash": "sha256-NRqWOkGrg/Y4wZi4WQDJ6CvsDpeseVgTc/iAnuPRy/U=",
+        "rev": "b477534e7e10d193e916cd4e2967c589383625b2",
+        "hash": "sha256-3sVHRzERwlLzXl2qSn2Lil4U4d6N63MUOomSUrjy2YY=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {

From 2eec0ae2454a0793dee81ea44b865de8a2680267 Mon Sep 17 00:00:00 2001
From: cr0n <cr0n@cypherpunks.cc>
Date: Wed, 22 Oct 2025 18:04:37 +0200
Subject: [PATCH 56/60] necesse-server: 1.0.1-20456269 -> 1.0.1-20495154

---
 pkgs/by-name/ne/necesse-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ne/necesse-server/package.nix b/pkgs/by-name/ne/necesse-server/package.nix
index 684d4c5d9b1e..c1e39ebe2d40 100644
--- a/pkgs/by-name/ne/necesse-server/package.nix
+++ b/pkgs/by-name/ne/necesse-server/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.0.1-20456269";
+  version = "1.0.1-20495154";
   urlVersion = lib.replaceStrings [ "." ] [ "-" ] version;
 
 in
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchzip {
     url = "https://necessegame.com/content/server/${urlVersion}/necesse-server-linux64-${urlVersion}.zip";
-    hash = "sha256-1Du0r/R7wLqnWRkihW3Kwzo58HEmUt8NgNYWSyJwwdc=";
+    hash = "sha256-1k+4ywYjVddAb4yyGx1Fi/RXMyJzPIiQIyUzA0VhpAI=";
   };
 
   # removing packaged jre since we use our own

From 927416baa9fe083b6f9ddf842fff875685c4b920 Mon Sep 17 00:00:00 2001
From: Rafael Ieda <git@ieda.me>
Date: Wed, 22 Oct 2025 13:09:39 -0300
Subject: [PATCH 57/60] wesnoth-devel: 1.19.16.1 -> 1.19.17

---
 pkgs/by-name/we/wesnoth/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/we/wesnoth/package.nix b/pkgs/by-name/we/wesnoth/package.nix
index 0c03fa0d7b7f..be34a6058bc8 100644
--- a/pkgs/by-name/we/wesnoth/package.nix
+++ b/pkgs/by-name/we/wesnoth/package.nix
@@ -39,7 +39,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wesnoth${suffix}";
-  version = if enableDevel then "1.19.16.1" else "1.18.5";
+  version = if enableDevel then "1.19.17" else "1.18.5";
 
   src = fetchFromGitHub {
     owner = "wesnoth";
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     tag = finalAttrs.version;
     hash =
       if enableDevel then
-        "sha256-ekpyQnP5r3jl98qyNkO6SwUGc9qvz2OTidUu0k3m28c="
+        "sha256-8JFJR4ghL2uSI5zG63MPX5NwlvIc3/xR0SQ2FjG5JCw="
       else
         "sha256-0VZJAmaCg12x4S07H1kl5s2NGMEo/NSVnzMniREmPJk=";
   };

From cad599f3526b0f1515e323a817fb5821a4a175b0 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Tue, 21 Oct 2025 11:37:59 +0200
Subject: [PATCH 58/60] top-level/by-name-overlay: remove optimization TODO

We tried to apply this, but this won't consistently help performance.
While it can potentially make full eval a tad faster, we'd pay the price
when evaluating single packages.
---
 pkgs/top-level/by-name-overlay.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/top-level/by-name-overlay.nix b/pkgs/top-level/by-name-overlay.nix
index 9a011439596a..e6fe5b721556 100644
--- a/pkgs/top-level/by-name-overlay.nix
+++ b/pkgs/top-level/by-name-overlay.nix
@@ -41,10 +41,6 @@ let
   # if the overlay has to be applied multiple times
   packageFiles = mergeAttrsList (mapAttrsToList namesForShard (readDir baseDirectory));
 in
-# TODO: Consider optimising this using `builtins.deepSeq packageFiles`,
-# which could free up the above thunks and reduce GC times.
-# Currently this would be hard to measure until we have more packages
-# and ideally https://github.com/NixOS/nix/pull/8895
 self: super:
 {
   # This attribute is necessary to allow CI to ensure that all packages defined in `pkgs/by-name`

From a548bd706f4a213842488dd9742085dee57de322 Mon Sep 17 00:00:00 2001
From: SkohTV <contact@skoh.dev>
Date: Wed, 22 Oct 2025 13:31:44 -0400
Subject: [PATCH 59/60] libnl-tiny: 2025-03-19 -> 2025-10-20

---
 pkgs/by-name/li/libnl-tiny/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libnl-tiny/package.nix b/pkgs/by-name/li/libnl-tiny/package.nix
index f0fefcc64767..d814fbab6ce7 100644
--- a/pkgs/by-name/li/libnl-tiny/package.nix
+++ b/pkgs/by-name/li/libnl-tiny/package.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation {
   pname = "libnl-tiny";
-  version = "0-unstable-2025-03-19";
+  version = "0-unstable-2025-10-20";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libnl-tiny.git";
-    rev = "c0df580adbd4d555ecc1962dbe88e91d75b67a4e";
-    hash = "sha256-j5oIEbWqVWd7rNpCMm9+WZwud43uTGeHG81lmzQOoeY=";
+    rev = "c69fb5ef80b9780fe9add345052aef9ccb5d51f4";
+    hash = "sha256-QH4w++kekejvvgTye6djs0jYzcNsxfrE3XCBed+Oizo=";
   };
 
   nativeBuildInputs = [

From 73a21101d677580bb7de49f1a996f7ba19f40400 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Oct 2025 17:35:31 +0000
Subject: [PATCH 60/60] fflogs: 8.17.71 -> 8.17.83

---
 pkgs/by-name/ff/fflogs/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ff/fflogs/package.nix b/pkgs/by-name/ff/fflogs/package.nix
index 85e0168b4713..0bd801ac94b0 100644
--- a/pkgs/by-name/ff/fflogs/package.nix
+++ b/pkgs/by-name/ff/fflogs/package.nix
@@ -6,10 +6,10 @@
 
 let
   pname = "fflogs";
-  version = "8.17.71";
+  version = "8.17.83";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-fflogs/releases/download/v${version}/fflogs-v${version}.AppImage";
-    hash = "sha256-ey2hfndsLxViy7dYtIwfUgsk9kQycgBpsHGoBwO9LUs=";
+    hash = "sha256-orVUCf7+OzJQ561maIYEBKgSgLuKfuSXFGMLZV/HMjM=";
   };
   extracted = appimageTools.extractType2 { inherit pname version src; };
 in