From 2484cbf8d8677f976a1852e41330ccea20e23ba5 Mon Sep 17 00:00:00 2001
From: euxane <euxane.trangirard@euxane.eu>
Date: Fri, 5 Sep 2025 22:09:55 +0200
Subject: [PATCH 01/61] maintainers/euxane: update email address

---
 maintainers/maintainer-list.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 6cd8bcf8d305..95e441585c28 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7957,7 +7957,7 @@
   };
   euxane = {
     name = "euxane";
-    email = "r9uhdi.nixpkgs@euxane.net";
+    email = "r9uhdi.nixpkgs@euxane.eu";
     github = "pacien";
     githubId = 1449319;
   };

From b45f1ad676635ff4bf9f72997ed42a056418e4af Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Thu, 16 Oct 2025 16:12:35 -0400
Subject: [PATCH 02/61] devbox: modernize

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/development/tools/devbox/default.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/tools/devbox/default.nix b/pkgs/development/tools/devbox/default.nix
index f96af31e73b6..bd844c1b73af 100644
--- a/pkgs/development/tools/devbox/default.nix
+++ b/pkgs/development/tools/devbox/default.nix
@@ -5,21 +5,21 @@
   lib,
   stdenv,
 }:
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "devbox";
   version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "jetify-com";
-    repo = pname;
-    rev = version;
+    repo = "devbox";
+    tag = finalAttrs.version;
     hash = "sha256-+OsFKBtc4UkkI37YJM9uKIJZC1+KkuDJJKjipRzyF7k=";
   };
 
   ldflags = [
     "-s"
     "-w"
-    "-X go.jetify.com/devbox/internal/build.Version=${version}"
+    "-X go.jetify.com/devbox/internal/build.Version=${finalAttrs.version}"
   ];
 
   subPackages = [ "cmd/devbox" ];
@@ -38,14 +38,14 @@ buildGoModule rec {
       --zsh <($out/bin/devbox completion zsh)
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Instant, easy, predictable shells and containers";
     homepage = "https://www.jetify.com/devbox";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       urandom
       lagoja
       madeddie
     ];
   };
-}
+})

From 38b9b6481226ceb722da2a1a9d4445bcf39e4b67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Thu, 30 Oct 2025 00:51:32 -0600
Subject: [PATCH 03/61] linux: cleanup common-config after 5.4 drop

---
 .../linux/kernel/common-config.nix            | 189 ++++++++----------
 1 file changed, 84 insertions(+), 105 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index cb70dfbeeccf..1c6d3ed7bfe8 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -77,7 +77,7 @@ let
       # FIXME: figure out how to actually make BTFs reproducible instead
       # See https://github.com/NixOS/nixpkgs/pull/181456 for details.
       MODULE_ALLOW_BTF_MISMATCH = whenAtLeast "5.18" (option yes);
-      BPF_LSM = whenAtLeast "5.7" (option yes);
+      BPF_LSM = option yes;
       DEBUG_KERNEL = yes;
       DEBUG_DEVRES = no;
       DYNAMIC_DEBUG = yes;
@@ -154,10 +154,10 @@ let
       CPU_FREQ_STAT = yes;
 
       # Enable CPU energy model for scheduling
-      ENERGY_MODEL = whenAtLeast "5.0" yes;
+      ENERGY_MODEL = yes;
 
       # Enable thermal interface netlink API
-      THERMAL_NETLINK = whenAtLeast "5.9" yes;
+      THERMAL_NETLINK = yes;
 
       # Prefer power-efficient workqueue implementation to per-CPU workqueues,
       # which is slightly slower, but improves battery life.
@@ -182,24 +182,24 @@ let
       X86_INTEL_PSTATE = yes;
       X86_AMD_PSTATE = whenAtLeast "5.17" yes;
       # Intel DPTF (Dynamic Platform and Thermal Framework) Support
-      ACPI_DPTF = whenAtLeast "5.10" yes;
+      ACPI_DPTF = yes;
 
       # Required to bring up some Bay Trail devices properly
       I2C = yes;
       I2C_DESIGNWARE_CORE = yes;
       I2C_DESIGNWARE_PLATFORM = yes;
-      PMIC_OPREGION = whenAtLeast "5.10" yes;
-      INTEL_SOC_PMIC = whenAtLeast "5.10" yes;
-      BYTCRC_PMIC_OPREGION = whenAtLeast "5.10" yes;
-      CHTCRC_PMIC_OPREGION = whenAtLeast "5.10" yes;
-      XPOWER_PMIC_OPREGION = whenAtLeast "5.10" yes;
-      BXT_WC_PMIC_OPREGION = whenAtLeast "5.10" yes;
-      INTEL_SOC_PMIC_CHTWC = whenAtLeast "5.10" yes;
-      CHT_WC_PMIC_OPREGION = whenAtLeast "5.10" yes;
-      INTEL_SOC_PMIC_CHTDC_TI = whenAtLeast "5.10" yes;
-      CHT_DC_TI_PMIC_OPREGION = whenAtLeast "5.10" yes;
-      MFD_TPS68470 = whenBetween "5.10" "5.13" yes;
-      TPS68470_PMIC_OPREGION = whenAtLeast "5.10" yes;
+      PMIC_OPREGION = yes;
+      INTEL_SOC_PMIC = yes;
+      BYTCRC_PMIC_OPREGION = yes;
+      CHTCRC_PMIC_OPREGION = yes;
+      XPOWER_PMIC_OPREGION = yes;
+      BXT_WC_PMIC_OPREGION = yes;
+      INTEL_SOC_PMIC_CHTWC = yes;
+      CHT_WC_PMIC_OPREGION = yes;
+      INTEL_SOC_PMIC_CHTDC_TI = yes;
+      CHT_DC_TI_PMIC_OPREGION = yes;
+      MFD_TPS68470 = whenOlder "5.13" yes;
+      TPS68470_PMIC_OPREGION = yes;
 
       # Enable Intel thermal hardware feedback
       INTEL_HFI_THERMAL = whenAtLeast "5.18" yes;
@@ -251,11 +251,9 @@ let
     # Include the CFQ I/O scheduler in the kernel, rather than as a
     # module, so that the initrd gets a good I/O scheduler.
     scheduler = {
-      IOSCHED_CFQ = whenOlder "5.0" yes; # Removed in 5.0-RC1
       BLK_CGROUP = yes; # required by CFQ"
       BLK_CGROUP_IOLATENCY = yes;
       BLK_CGROUP_IOCOST = yes;
-      IOSCHED_DEADLINE = whenOlder "5.0" yes; # Removed in 5.0-RC1
       MQ_IOSCHED_DEADLINE = yes;
       BFQ_GROUP_IOSCHED = yes;
       MQ_IOSCHED_KYBER = yes;
@@ -379,13 +377,13 @@ let
       INET_DIAG_DESTROY = lib.mkDefault yes;
 
       # IPsec over TCP
-      INET_ESPINTCP = whenAtLeast "5.8" yes;
-      INET6_ESPINTCP = whenAtLeast "5.8" yes;
+      INET_ESPINTCP = yes;
+      INET6_ESPINTCP = yes;
 
       # enable multipath-tcp
-      MPTCP = whenAtLeast "5.6" yes;
-      MPTCP_IPV6 = whenAtLeast "5.6" yes;
-      INET_MPTCP_DIAG = whenAtLeast "5.9" (lib.mkDefault module);
+      MPTCP = yes;
+      MPTCP_IPV6 = yes;
+      INET_MPTCP_DIAG = lib.mkDefault module;
 
       # Kernel TLS
       TLS = module;
@@ -444,14 +442,8 @@ let
       RTL8XXXU_UNTESTED = option yes;
 
       RTW88 = module;
-      RTW88_8822BE = lib.mkMerge [
-        (whenOlder "5.8" yes)
-        (whenAtLeast "5.8" module)
-      ];
-      RTW88_8822CE = lib.mkMerge [
-        (whenOlder "5.8" yes)
-        (whenAtLeast "5.8" module)
-      ];
+      RTW88_8822BE = module;
+      RTW88_8822CE = module;
     };
 
     fb = {
@@ -483,7 +475,7 @@ let
       FONT_8x8 = yes;
       FONT_8x16 = yes;
       # High DPI font
-      FONT_TER16x32 = whenAtLeast "5.0" yes;
+      FONT_TER16x32 = yes;
     };
 
     video =
@@ -494,7 +486,7 @@ let
           || isPower64
           || isS390x
           || isx86_64
-          || (lib.versionAtLeast version "5.7" && isAarch64)
+          || isAarch64
           || (lib.versionAtLeast version "6.11" && isRiscV64)
         );
       in
@@ -530,18 +522,15 @@ let
         DRM_DP_AUX_CHARDEV = whenOlder "6.10" yes;
         DRM_DISPLAY_DP_AUX_CHARDEV = whenAtLeast "6.10" yes;
         # amdgpu display core (DC) support
-        DRM_AMD_DC_DCN1_0 = lib.mkIf stdenv.hostPlatform.isx86 (whenOlder "5.6" yes);
-        DRM_AMD_DC_DCN2_0 = lib.mkIf stdenv.hostPlatform.isx86 (whenOlder "5.6" yes);
-        DRM_AMD_DC_DCN2_1 = lib.mkIf stdenv.hostPlatform.isx86 (whenOlder "5.6" yes);
-        DRM_AMD_DC_DCN3_0 = lib.mkIf (with stdenv.hostPlatform; isx86) (whenBetween "5.9" "5.11" yes);
+        DRM_AMD_DC_DCN3_0 = lib.mkIf (with stdenv.hostPlatform; isx86) (whenOlder "5.11" yes);
         DRM_AMD_DC_DCN = lib.mkIf (with stdenv.hostPlatform; isx86 || isPower64) (
           whenBetween "5.11" "6.4" yes
         );
         # Not available when using clang
         # See: https://github.com/torvalds/linux/blob/172a9d94339cea832d89630b89d314e41d622bd8/drivers/gpu/drm/amd/display/Kconfig#L14
         DRM_AMD_DC_FP = lib.mkIf (!stdenv.cc.isClang) (whenAtLeast "6.4" yes);
-        DRM_AMD_DC_HDCP = whenBetween "5.5" "6.4" yes;
-        DRM_AMD_DC_SI = whenAtLeast "5.10" yes;
+        DRM_AMD_DC_HDCP = whenOlder "6.4" yes;
+        DRM_AMD_DC_SI = yes;
 
         # Enable AMD Audio Coprocessor support for HDMI outputs
         DRM_AMD_ACP = yes;
@@ -567,7 +556,7 @@ let
 
         # Enable HDMI-CEC receiver support
         RC_CORE = yes;
-        MEDIA_CEC_RC = whenAtLeast "5.10" yes;
+        MEDIA_CEC_RC = yes;
 
         # Enable CEC over DisplayPort
         DRM_DP_CEC = whenOlder "6.10" yes;
@@ -619,48 +608,43 @@ let
       SND_HDA_RECONFIG = yes; # Support reconfiguration of jack functions
       # Support configuring jack functions via fw mechanism at boot
       SND_HDA_PATCH_LOADER = yes;
-      SND_HDA_CODEC_CA0132_DSP = whenOlder "5.7" yes; # Enable DSP firmware loading on Creative Soundblaster Z/Zx/ZxR/Recon
       SND_HDA_CODEC_CS8409 = whenAtLeast "6.6" module; # Cirrus Logic HDA Bridge CS8409
       SND_OSSEMUL = yes;
       SND_USB_CAIAQ_INPUT = yes;
       SND_USB_AUDIO_MIDI_V2 = whenAtLeast "6.5" yes;
       # Enable Sound Open Firmware support
     }
-    //
-      lib.optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux" && lib.versionAtLeast version "5.5")
-        {
-          SND_SOC_INTEL_SOUNDWIRE_SOF_MACH = whenAtLeast "5.10" module;
-          SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES = whenAtLeast "5.10" yes; # dep of SOF_MACH
-          SND_SOC_SOF_INTEL_SOUNDWIRE_LINK = whenBetween "5.10" "5.11" yes; # dep of SOF_MACH
-          SND_SOC_SOF_TOPLEVEL = yes;
-          SND_SOC_SOF_ACPI = module;
-          SND_SOC_SOF_PCI = module;
-          SND_SOC_SOF_APOLLOLAKE = whenAtLeast "5.12" module;
-          SND_SOC_SOF_APOLLOLAKE_SUPPORT = whenOlder "5.12" yes;
-          SND_SOC_SOF_CANNONLAKE = whenAtLeast "5.12" module;
-          SND_SOC_SOF_CANNONLAKE_SUPPORT = whenOlder "5.12" yes;
-          SND_SOC_SOF_COFFEELAKE = whenAtLeast "5.12" module;
-          SND_SOC_SOF_COFFEELAKE_SUPPORT = whenOlder "5.12" yes;
-          SND_SOC_SOF_COMETLAKE = whenAtLeast "5.12" module;
-          SND_SOC_SOF_COMETLAKE_H_SUPPORT = whenOlder "5.8" yes;
-          SND_SOC_SOF_COMETLAKE_LP_SUPPORT = whenOlder "5.12" yes;
-          SND_SOC_SOF_ELKHARTLAKE = whenAtLeast "5.12" module;
-          SND_SOC_SOF_ELKHARTLAKE_SUPPORT = whenOlder "5.12" yes;
-          SND_SOC_SOF_GEMINILAKE = whenAtLeast "5.12" module;
-          SND_SOC_SOF_GEMINILAKE_SUPPORT = whenOlder "5.12" yes;
-          SND_SOC_SOF_HDA_AUDIO_CODEC = yes;
-          SND_SOC_SOF_HDA_COMMON_HDMI_CODEC = whenOlder "5.7" yes;
-          SND_SOC_SOF_HDA_LINK = yes;
-          SND_SOC_SOF_ICELAKE = whenAtLeast "5.12" module;
-          SND_SOC_SOF_ICELAKE_SUPPORT = whenOlder "5.12" yes;
-          SND_SOC_SOF_INTEL_TOPLEVEL = yes;
-          SND_SOC_SOF_JASPERLAKE = whenAtLeast "5.12" module;
-          SND_SOC_SOF_JASPERLAKE_SUPPORT = whenOlder "5.12" yes;
-          SND_SOC_SOF_MERRIFIELD = whenAtLeast "5.12" module;
-          SND_SOC_SOF_MERRIFIELD_SUPPORT = whenOlder "5.12" yes;
-          SND_SOC_SOF_TIGERLAKE = whenAtLeast "5.12" module;
-          SND_SOC_SOF_TIGERLAKE_SUPPORT = whenOlder "5.12" yes;
-        };
+    // lib.optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
+      SND_SOC_INTEL_SOUNDWIRE_SOF_MACH = module;
+      SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES = yes; # dep of SOF_MACH
+      SND_SOC_SOF_INTEL_SOUNDWIRE_LINK = whenOlder "5.11" yes; # dep of SOF_MACH
+      SND_SOC_SOF_TOPLEVEL = yes;
+      SND_SOC_SOF_ACPI = module;
+      SND_SOC_SOF_PCI = module;
+      SND_SOC_SOF_APOLLOLAKE = whenAtLeast "5.12" module;
+      SND_SOC_SOF_APOLLOLAKE_SUPPORT = whenOlder "5.12" yes;
+      SND_SOC_SOF_CANNONLAKE = whenAtLeast "5.12" module;
+      SND_SOC_SOF_CANNONLAKE_SUPPORT = whenOlder "5.12" yes;
+      SND_SOC_SOF_COFFEELAKE = whenAtLeast "5.12" module;
+      SND_SOC_SOF_COFFEELAKE_SUPPORT = whenOlder "5.12" yes;
+      SND_SOC_SOF_COMETLAKE = whenAtLeast "5.12" module;
+      SND_SOC_SOF_COMETLAKE_LP_SUPPORT = whenOlder "5.12" yes;
+      SND_SOC_SOF_ELKHARTLAKE = whenAtLeast "5.12" module;
+      SND_SOC_SOF_ELKHARTLAKE_SUPPORT = whenOlder "5.12" yes;
+      SND_SOC_SOF_GEMINILAKE = whenAtLeast "5.12" module;
+      SND_SOC_SOF_GEMINILAKE_SUPPORT = whenOlder "5.12" yes;
+      SND_SOC_SOF_HDA_AUDIO_CODEC = yes;
+      SND_SOC_SOF_HDA_LINK = yes;
+      SND_SOC_SOF_ICELAKE = whenAtLeast "5.12" module;
+      SND_SOC_SOF_ICELAKE_SUPPORT = whenOlder "5.12" yes;
+      SND_SOC_SOF_INTEL_TOPLEVEL = yes;
+      SND_SOC_SOF_JASPERLAKE = whenAtLeast "5.12" module;
+      SND_SOC_SOF_JASPERLAKE_SUPPORT = whenOlder "5.12" yes;
+      SND_SOC_SOF_MERRIFIELD = whenAtLeast "5.12" module;
+      SND_SOC_SOF_MERRIFIELD_SUPPORT = whenOlder "5.12" yes;
+      SND_SOC_SOF_TIGERLAKE = whenAtLeast "5.12" module;
+      SND_SOC_SOF_TIGERLAKE_SUPPORT = whenOlder "5.12" yes;
+    };
 
     usb = {
       USB = yes; # compile USB core into kernel, so we can use USB_SERIAL_CONSOLE before modules
@@ -680,7 +664,7 @@ let
       USB_SERIAL = yes;
       USB_SERIAL_GENERIC = yes; # USB Generic Serial Driver
       USB_SERIAL_CONSOLE = yes; # Allow using USB serial adapter as console
-      U_SERIAL_CONSOLE = whenAtLeast "5.10" yes; # Allow using USB gadget as console
+      U_SERIAL_CONSOLE = yes; # Allow using USB gadget as console
     };
 
     # Filesystem options - in particular, enable extended attributes and
@@ -730,11 +714,9 @@ let
 
       F2FS_FS = module;
       F2FS_FS_SECURITY = option yes;
-      F2FS_FS_COMPRESSION = whenAtLeast "5.6" yes;
+      F2FS_FS_COMPRESSION = yes;
       UDF_FS = module;
 
-      NFSD_V2_ACL = whenOlder "5.10" yes;
-      NFSD_V3 = whenOlder "5.10" yes;
       NFSD_V3_ACL = yes;
       NFSD_V4 = yes;
       NFSD_V4_SECURITY_LABEL = yes;
@@ -815,10 +797,9 @@ let
 
       SECURITY_DMESG_RESTRICT = yes;
 
-      RANDOM_TRUST_CPU = lib.mkIf (
-        with stdenv.hostPlatform;
-        isPower64 || isS390 || isx86 || (lib.versionAtLeast version "5.6" && isAarch64)
-      ) (whenOlder "6.2" yes); # allow RDRAND to seed the RNG
+      RANDOM_TRUST_CPU = lib.mkIf (with stdenv.hostPlatform; isPower64 || isS390 || isx86 || isAarch64) (
+        whenOlder "6.2" yes
+      ); # allow RDRAND to seed the RNG
       RANDOM_TRUST_BOOTLOADER = whenOlder "6.2" yes; # allow the bootloader to seed the RNG
 
       MODULE_SIG = no; # r13y, generates a random key during build and bakes it in
@@ -941,7 +922,7 @@ let
       STACK_TRACER = yes;
       UPROBE_EVENTS = option yes;
       BPF_SYSCALL = yes;
-      BPF_UNPRIV_DEFAULT_OFF = whenBetween "5.10" "5.16" yes;
+      BPF_UNPRIV_DEFAULT_OFF = whenOlder "5.16" yes;
       BPF_EVENTS = yes;
       FUNCTION_PROFILER = yes;
       RING_BUFFER_BENCHMARK = no;
@@ -1035,7 +1016,7 @@ let
       ZRAM_BACKEND_ZSTD = whenAtLeast "6.12" yes;
       ZRAM_DEF_COMP_ZSTD = whenAtLeast "5.11" yes;
       ZSWAP = option yes;
-      ZSWAP_COMPRESSOR_DEFAULT_ZSTD = whenAtLeast "5.7" (lib.mkOptionDefault yes);
+      ZSWAP_COMPRESSOR_DEFAULT_ZSTD = lib.mkOptionDefault yes;
       ZPOOL = whenOlder "6.18" yes;
       ZSMALLOC = option yes;
     };
@@ -1065,8 +1046,7 @@ let
       LOCK_TORTURE_TEST = option no;
       MTD_TESTS = option no;
       NOTIFIER_ERROR_INJECTION = option no;
-      RCU_PERF_TEST = whenOlder "5.9" no;
-      RCU_SCALE_TEST = whenAtLeast "5.10" no;
+      RCU_SCALE_TEST = no;
       TEST_ASYNC_DRIVER_PROBE = option no;
       WW_MUTEX_SELFTEST = option no;
       XZ_DEC_TEST = option no;
@@ -1086,7 +1066,7 @@ let
       let
         # Use zstd for kernel compression if 64-bit and newer than 5.9, otherwise xz.
         # i686 issues: https://github.com/NixOS/nixpkgs/pull/117961#issuecomment-812106375
-        useZstd = stdenv.buildPlatform.is64bit && lib.versionAtLeast version "5.9";
+        useZstd = stdenv.buildPlatform.is64bit;
       in
       {
         # stdenv.hostPlatform.linux-kernel.target assumes uncompressed on RISC-V.
@@ -1181,9 +1161,9 @@ let
         BLK_SED_OPAL = yes;
 
         # Enable support for block layer inline encryption
-        BLK_INLINE_ENCRYPTION = whenAtLeast "5.8" yes;
+        BLK_INLINE_ENCRYPTION = yes;
         # ...but fall back to CPU encryption if unavailable
-        BLK_INLINE_ENCRYPTION_FALLBACK = whenAtLeast "5.8" yes;
+        BLK_INLINE_ENCRYPTION_FALLBACK = yes;
 
         BSD_PROCESS_ACCT_V3 = yes;
 
@@ -1213,7 +1193,7 @@ let
 
         EFI = lib.mkIf stdenv.hostPlatform.isEfi yes;
         EFI_STUB = yes; # EFI bootloader in the bzImage itself
-        EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER = whenOlder "6.2" (whenAtLeast "5.8" yes); # initrd kernel parameter for EFI
+        EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER = whenOlder "6.2" yes; # initrd kernel parameter for EFI
 
         # Generic compression support for EFI payloads
         # Add new platforms only after they have been verified to build and boot.
@@ -1261,7 +1241,7 @@ let
         NVME_TCP_TLS = whenAtLeast "6.7" yes;
 
         NVME_TARGET = module;
-        NVME_TARGET_PASSTHRU = whenAtLeast "5.9" yes;
+        NVME_TARGET_PASSTHRU = yes;
         NVME_TARGET_AUTH = whenAtLeast "6.0" yes;
         NVME_TARGET_TCP_TLS = whenAtLeast "6.7" yes;
 
@@ -1271,7 +1251,7 @@ let
           || isPower64
           || isS390x
           || isx86_64
-          || (lib.versionAtLeast version "5.7" && isAarch64)
+          || isAarch64
           || (lib.versionAtLeast version "6.11" && isRiscV64)
         ) yes;
 
@@ -1313,7 +1293,7 @@ let
 
         HWMON = yes;
         THERMAL_HWMON = yes; # Hardware monitoring support
-        NVME_HWMON = whenAtLeast "5.5" yes; # NVMe drives temperature reporting
+        NVME_HWMON = yes; # NVMe drives temperature reporting
         UEVENT_HELPER = no;
 
         USERFAULTFD = yes;
@@ -1346,7 +1326,7 @@ let
           || isPower64
           || isS390x
           || isx86_64
-          || (lib.versionAtLeast version "5.7" && isAarch64)
+          || isAarch64
           || (lib.versionAtLeast version "6.11" && isRiscV64)
         ) yes;
 
@@ -1387,15 +1367,15 @@ let
         };
         ANDROID_BINDER_IPC = {
           optional = true;
-          tristate = whenAtLeast "5.0" "y";
+          tristate = "y";
         };
         ANDROID_BINDERFS = {
           optional = true;
-          tristate = whenAtLeast "5.0" "y";
+          tristate = "y";
         };
         ANDROID_BINDER_DEVICES = {
           optional = true;
-          freeform = whenAtLeast "5.0" "binder,hwbinder,vndbinder";
+          freeform = "binder,hwbinder,vndbinder";
         };
 
         TASKSTATS = yes;
@@ -1408,7 +1388,7 @@ let
 
         # > CONFIG_KUNIT should not be enabled in a production environment. Enabling KUnit disables Kernel Address-Space Layout Randomization (KASLR), and tests may affect the state of the kernel in ways not suitable for production.
         # https://www.kernel.org/doc/html/latest/dev-tools/kunit/start.html
-        KUNIT = whenAtLeast "5.5" no;
+        KUNIT = no;
 
         # Set system time from RTC on startup and resume
         RTC_HCTOSYS = option yes;
@@ -1418,7 +1398,7 @@ let
 
         # Enable generic kernel watch queues
         # See https://docs.kernel.org/core-api/watch_queue.html
-        WATCH_QUEUE = whenAtLeast "5.8" yes;
+        WATCH_QUEUE = yes;
       }
       //
         lib.optionalAttrs
@@ -1437,7 +1417,7 @@ let
               || isPower
               || isS390
               || isx86
-              || (lib.versionAtLeast version "5.7" && isAarch64)
+              || isAarch64
               || (lib.versionAtLeast version "6.11" && isRiscV)
             ) yes;
             HOTPLUG_CPU = yes;
@@ -1458,8 +1438,7 @@ let
             CROS_EC_I2C = module;
             CROS_EC_SPI = module;
             CROS_KBD_LED_BACKLIGHT = module;
-            MFD_CROS_EC = whenOlder "5.10" module;
-            TCG_TIS_SPI_CR50 = whenAtLeast "5.5" yes;
+            TCG_TIS_SPI_CR50 = yes;
           }
       //
         lib.optionalAttrs
@@ -1521,7 +1500,7 @@ let
         CHROMEOS_PSTORE = module;
 
         # Enable x86 resource control
-        X86_CPU_RESCTRL = whenAtLeast "5.0" yes;
+        X86_CPU_RESCTRL = yes;
 
         # Enable TSX on CPUs where it's not vulnerable
         X86_INTEL_TSX_MODE_AUTO = yes;

From 92e6ad6fc87270af62a059b434840af1f11c75ca Mon Sep 17 00:00:00 2001
From: winston <hey@winston.sh>
Date: Sun, 19 Oct 2025 01:24:44 +0200
Subject: [PATCH 04/61] fastmail-desktop: 1.0.0 -> 1.0.3, add linux support

---
 pkgs/by-name/fa/fastmail-desktop/darwin.nix  | 27 +++++++
 pkgs/by-name/fa/fastmail-desktop/linux.nix   | 84 ++++++++++++++++++++
 pkgs/by-name/fa/fastmail-desktop/package.nix | 36 ++++-----
 pkgs/by-name/fa/fastmail-desktop/sources.nix | 20 +++++
 pkgs/by-name/fa/fastmail-desktop/update.sh   | 41 ++++++++++
 5 files changed, 188 insertions(+), 20 deletions(-)
 create mode 100644 pkgs/by-name/fa/fastmail-desktop/darwin.nix
 create mode 100644 pkgs/by-name/fa/fastmail-desktop/linux.nix
 create mode 100644 pkgs/by-name/fa/fastmail-desktop/sources.nix
 create mode 100755 pkgs/by-name/fa/fastmail-desktop/update.sh

diff --git a/pkgs/by-name/fa/fastmail-desktop/darwin.nix b/pkgs/by-name/fa/fastmail-desktop/darwin.nix
new file mode 100644
index 000000000000..6e815849081c
--- /dev/null
+++ b/pkgs/by-name/fa/fastmail-desktop/darwin.nix
@@ -0,0 +1,27 @@
+{
+  pname,
+  version,
+  src,
+  passthru,
+  meta,
+  stdenvNoCC,
+}:
+stdenvNoCC.mkDerivation {
+  inherit
+    pname
+    version
+    src
+    passthru
+    meta
+    ;
+
+  installPhase = ''
+    mkdir -p $out/Applications
+    cp -R Fastmail.app $out/Applications/
+  '';
+
+  dontBuild = true;
+
+  # Fastmail is notarized
+  dontFixup = true;
+}
diff --git a/pkgs/by-name/fa/fastmail-desktop/linux.nix b/pkgs/by-name/fa/fastmail-desktop/linux.nix
new file mode 100644
index 000000000000..63d8fbeb2ef9
--- /dev/null
+++ b/pkgs/by-name/fa/fastmail-desktop/linux.nix
@@ -0,0 +1,84 @@
+{
+  pname,
+  version,
+  src,
+  passthru,
+  meta,
+  lib,
+  stdenvNoCC,
+  appimageTools,
+  asar,
+  autoPatchelfHook,
+  makeWrapper,
+  electron,
+  libXScrnSaver,
+  libXtst,
+  libappindicator,
+  libgcc,
+  musl,
+  vips,
+}:
+let
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  inherit pname version passthru;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    asar
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libgcc
+    musl
+    vips
+  ];
+
+  libPath = lib.makeLibraryPath [
+    libXScrnSaver
+    libXtst
+    libappindicator
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/opt"
+    cp -r --no-preserve=mode "${appimageContents}/resources" "$out/opt/fastmail"
+    asar extract "$out/opt/fastmail/app.asar" "$out/opt/fastmail/app.asar.unpacked"
+    rm "$out/opt/fastmail/app.asar"
+
+    install -D "${appimageContents}/production.desktop" "$out/share/applications/fastmail.desktop"
+    substituteInPlace "$out/share/applications/fastmail.desktop" \
+      --replace-fail "Exec=AppRun --no-sandbox %U" "Exec=fastmail" \
+      --replace-fail "Icon=production" "Icon=fastmail" \
+
+    for res in 16 24 32 48 64 128 256 512 1024; do
+      resdir="''${res}x''${res}"
+      mkdir -p "$out/share/icons/hicolor/$resdir/apps"
+      cp -r --no-preserve=mode \
+        "${appimageContents}/usr/share/icons/hicolor/$resdir/apps/production.png" \
+        "$out/share/icons/hicolor/$resdir/apps/fastmail.png"
+    done
+
+    makeWrapper "${electron}/bin/electron" "$out/bin/fastmail" \
+      --add-flags "$out/opt/fastmail/app.asar.unpacked" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-wayland-ime=true --wayland-text-input-version=3}}" \
+      --prefix LD_LIBRARY_PATH : ${finalAttrs.libPath}:$out/opt/fastmail \
+      --set-default ELECTRON_IS_DEV 0 \
+      --inherit-argv0
+
+    runHook postInstall
+  '';
+
+  meta = meta // {
+    mainProgram = "fastmail";
+  };
+})
diff --git a/pkgs/by-name/fa/fastmail-desktop/package.nix b/pkgs/by-name/fa/fastmail-desktop/package.nix
index 5e0bb16ac1dc..d05a182e80be 100644
--- a/pkgs/by-name/fa/fastmail-desktop/package.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/package.nix
@@ -1,34 +1,30 @@
 {
   lib,
+  callPackage,
   stdenvNoCC,
+  fetchurl,
   fetchzip,
 }:
-stdenvNoCC.mkDerivation (finalAttrs: {
+let
+  inherit (stdenvNoCC.hostPlatform) isDarwin system;
+
+  sources = import ./sources.nix { inherit fetchurl fetchzip; };
+in
+callPackage (if isDarwin then ./darwin.nix else ./linux.nix) {
   pname = "fastmail-desktop";
-  version = "1.0.0";
+  inherit (sources.${system} or (throw "Unsupported system: ${system}")) version src;
 
-  src = fetchzip {
-    url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-${finalAttrs.version}-arm64-mac.zip";
-    hash = "sha256-wIWU0F08wEQeLjbZz2LqahfyeOfowC+dDQkeMZI6gbk=";
-    stripRoot = false;
-  };
-
-  installPhase = ''
-    mkdir -p $out/Applications
-    cp -R Fastmail.app $out/Applications/
-  '';
-
-  dontBuild = true;
-
-  # Fastmail is notarized
-  dontFixup = true;
+  passthru.updateScript = ./update.sh;
 
   meta = {
     description = "Dedicated desktop app for Fastmail";
     homepage = "https://www.fastmail.com/blog/desktop-app/";
     license = lib.licenses.unfree;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
     maintainers = [ lib.maintainers.Enzime ];
-    platforms = [ "aarch64-darwin" ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-linux"
+    ];
   };
-})
+}
diff --git a/pkgs/by-name/fa/fastmail-desktop/sources.nix b/pkgs/by-name/fa/fastmail-desktop/sources.nix
new file mode 100644
index 000000000000..da373f653e94
--- /dev/null
+++ b/pkgs/by-name/fa/fastmail-desktop/sources.nix
@@ -0,0 +1,20 @@
+# Generated by ./update.sh - do not update manually!
+# Last updated: 2025-10-30
+{ fetchurl, fetchzip }:
+{
+  aarch64-darwin = {
+    version = "1.0.3";
+    src = fetchzip {
+      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.0.3-arm64-mac.zip";
+      hash = "sha512-lqJj0tTwOJx1jzzXtlKOOduUEtSgVHpQCM5WkbXjmOh2OejLRcdJ1Y9CxvZJGSPBGWrErKzytMOB8QmJ1BkIdw==";
+      stripRoot = false;
+    };
+  };
+  x86_64-linux = {
+    version = "1.0.3";
+    src = fetchurl {
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/Fastmail-1.0.3.AppImage";
+      hash = "sha512-L+h0GHAAlZndB4Q5Z7GiHuZqv1kTF5yCAJYYb9tPXnHfdcrwHvfBRnixEnVPPia46rp2IJ56z4ZS8RSut3ATFQ==";
+    };
+  };
+}
diff --git a/pkgs/by-name/fa/fastmail-desktop/update.sh b/pkgs/by-name/fa/fastmail-desktop/update.sh
new file mode 100755
index 000000000000..52c07e300a96
--- /dev/null
+++ b/pkgs/by-name/fa/fastmail-desktop/update.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash --pure -p cacert curl yq nix
+
+set -euo pipefail
+
+cd "$(readlink -e "$(dirname "${BASH_SOURCE[0]}")")"
+
+x86_64_linux_info=$(curl -fsS "https://dl.fastmailcdn.com/desktop/production/linux/x64/latest-linux.yml")
+aarch64_darwin_info=$(curl -fsS "https://dl.fastmailcdn.com/desktop/production/mac/arm64/latest-mac.yml")
+
+x86_64_linux_version=$(yq -r '.version' <<<"$x86_64_linux_info")
+aarch64_darwin_version=$(yq -r '.version' <<<"$aarch64_darwin_info")
+
+x86_64_linux_url="https://dl.fastmailcdn.com/desktop/production/linux/x64/$(yq -r '.path' <<<"$x86_64_linux_info")"
+aarch64_darwin_url="https://dl.fastmailcdn.com/desktop/production/mac/arm64/$(yq -r '.path' <<<"$aarch64_darwin_info")"
+
+x86_64_linux_hash=$(nix-hash --type sha512 --to-sri "$(yq -r '.sha512' <<<"$x86_64_linux_info")")
+aarch64_darwin_hash=$(nix-hash --type sha512 --to-sri "$(yq -r '.sha512' <<<"$aarch64_darwin_info")")
+
+cat >sources.nix <<EOF
+# Generated by ./update.sh - do not update manually!
+# Last updated: $(date +%F)
+{ fetchurl, fetchzip }:
+{
+  aarch64-darwin = {
+    version = "$aarch64_darwin_version";
+    src = fetchzip {
+      url = "$aarch64_darwin_url";
+      hash = "$aarch64_darwin_hash";
+      stripRoot = false;
+    };
+  };
+  x86_64-linux = {
+    version = "$x86_64_linux_version";
+    src = fetchurl {
+      url = "$x86_64_linux_url";
+      hash = "$x86_64_linux_hash";
+    };
+  };
+}
+EOF

From c77215da96ff3037b8ea321b8f47738043bcc9ed Mon Sep 17 00:00:00 2001
From: winston <hey@winston.sh>
Date: Thu, 23 Oct 2025 16:45:36 +0200
Subject: [PATCH 05/61] fastmail-desktop: add nekowinston to maintainers

---
 pkgs/by-name/fa/fastmail-desktop/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/fa/fastmail-desktop/package.nix b/pkgs/by-name/fa/fastmail-desktop/package.nix
index d05a182e80be..531fdce45e84 100644
--- a/pkgs/by-name/fa/fastmail-desktop/package.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/package.nix
@@ -21,7 +21,10 @@ callPackage (if isDarwin then ./darwin.nix else ./linux.nix) {
     homepage = "https://www.fastmail.com/blog/desktop-app/";
     license = lib.licenses.unfree;
     sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
-    maintainers = [ lib.maintainers.Enzime ];
+    maintainers = [
+      lib.maintainers.Enzime
+      lib.maintainers.nekowinston
+    ];
     platforms = [
       "aarch64-darwin"
       "x86_64-linux"

From 03a0f04ca7ccc2e46997670db9ded2fe32fc4331 Mon Sep 17 00:00:00 2001
From: Acid Bong <acidbong@tilde.club>
Date: Fri, 31 Oct 2025 06:57:18 +0200
Subject: [PATCH 06/61] tmux: replace `systemd` with `systemdLibs`

1. SD executables aren't used anyway
2. It noticeably reduces closure size

Tail of `dix result-*` output:
  SIZE: 177 MiB -> 41.4 MiB
  DIFF: -135 MiB
---
 pkgs/by-name/tm/tmux/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tm/tmux/package.nix b/pkgs/by-name/tm/tmux/package.nix
index 830bb3aad435..f3b22356a735 100644
--- a/pkgs/by-name/tm/tmux/package.nix
+++ b/pkgs/by-name/tm/tmux/package.nix
@@ -8,8 +8,8 @@
   ncurses,
   pkg-config,
   runCommand,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
   # broken on i686-linux https://github.com/tmux/tmux/issues/4597
   withUtf8proc ? !(stdenv.hostPlatform.is32bit),
   utf8proc, # gets Unicode updates faster than glibc
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     ncurses
     libevent
   ]
-  ++ lib.optionals withSystemd [ systemd ]
+  ++ lib.optionals withSystemd [ systemdLibs ]
   ++ lib.optionals withUtf8proc [ utf8proc ]
   ++ lib.optionals withUtempter [ libutempter ];
 

From ec72e4fb1505d52c06fec2e9cedd2970648a15fd Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 31 Oct 2025 09:11:53 +0000
Subject: [PATCH 07/61] ruff: 0.14.2 -> 0.14.3

Diff: https://github.com/astral-sh/ruff/compare/0.14.2...0.14.3

Changelog: https://github.com/astral-sh/ruff/releases/tag/0.14.3
---
 pkgs/by-name/ru/ruff/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 1f8b1afdd4a0..3d1547d0bf11 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.14.2";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-bHcmnfbdPzCX/Eqy5o+hVqhggfsPwZeUVjXV9wF6fNE=";
+    hash = "sha256-iYXZyB0s3rlGV3HQLN1fuAohFUm/53VLAwA3Ahj6HzM=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-lAluzoRONfkyspcMCp7wNei0R3dgpAwwwpRAmbTNl1k=";
+  cargoHash = "sha256-dYXFNe+nglKelgzi2Afo0AJyt53qfCAJ7reTMMfjWOI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 507c9d83371b9c8b0e7abee0a0c8793b6e349ba2 Mon Sep 17 00:00:00 2001
From: kero0 <kbakheat@gmail.com>
Date: Fri, 31 Oct 2025 20:25:34 -0400
Subject: [PATCH 08/61] mpd: fix build on darwin

---
 pkgs/by-name/mp/mpd/package.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/mp/mpd/package.nix b/pkgs/by-name/mp/mpd/package.nix
index 3bcc8851ae0a..661f95ed122b 100644
--- a/pkgs/by-name/mp/mpd/package.nix
+++ b/pkgs/by-name/mp/mpd/package.nix
@@ -234,7 +234,13 @@ stdenv.mkDerivation (finalAttrs: {
         substituteInPlace src/output/plugins/OSXOutputPlugin.cxx \
           --replace kAudioObjectPropertyElement{Main,Master} \
           --replace kAudioHardwareServiceDeviceProperty_Virtual{Main,Master}Volume
-      '';
+      ''
+    +
+      lib.optionalString
+        (stdenv.hostPlatform.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "13.3")
+        ''
+          sed -i "/subdir('time')/d" test/meson.build
+        '';
 
   # Otherwise, the meson log says:
   #

From 700c1538acf97ed18d270ba093c9620e9832b7b7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 1 Nov 2025 01:29:49 +0000
Subject: [PATCH 09/61] nakama: 3.32.1 -> 3.33.0

---
 pkgs/by-name/na/nakama/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/na/nakama/package.nix b/pkgs/by-name/na/nakama/package.nix
index 6ea82575b579..7790fe196058 100644
--- a/pkgs/by-name/na/nakama/package.nix
+++ b/pkgs/by-name/na/nakama/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "nakama";
-  version = "3.32.1";
+  version = "3.33.0";
 
   src = fetchFromGitHub {
     owner = "heroiclabs";
     repo = "nakama";
     tag = "v${version}";
-    hash = "sha256-guoKppChjT4f1IOM4Cxg6XZkJrYNVv9gwOTy57t7wDs=";
+    hash = "sha256-GiUufoWLwWBuZxId+vMkJPaJIb/FWLJAJLb7WKoyn5M=";
   };
 
   vendorHash = null;

From ff206f282c10361b6f14290aeac2fd652fcf9a0d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 1 Nov 2025 09:11:05 +0000
Subject: [PATCH 10/61] python3Packages.cysignals: 1.12.5 -> 1.12.6

---
 pkgs/development/python-modules/cysignals/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cysignals/default.nix b/pkgs/development/python-modules/cysignals/default.nix
index 090a8fccd1da..839e3cfd2385 100644
--- a/pkgs/development/python-modules/cysignals/default.nix
+++ b/pkgs/development/python-modules/cysignals/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "cysignals";
-  version = "1.12.5";
+  version = "1.12.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sagemath";
     repo = "cysignals";
     tag = version;
-    hash = "sha256-y7CA0aih2vATLz0Fhwf19/wRw6GnQvNhGo9lS4+VrgI=";
+    hash = "sha256-uZNKmnn1Jf1pERdG4bywpAUClKMw3og+7Q5B0yPlqEY=";
   };
 
   build-system = [

From b2d1946eb28740b5817cc49ff8abd0b8b69bc28f Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 1 Nov 2025 10:52:38 +0100
Subject: [PATCH 11/61] workflows/reviewers: request owners and maintainers at
 once

Instead of requesting owners and maintainer separately, each with their
own limit of 10 review requests, we now run this together. This unties
the logic and allows easier refactoring. Also, it gives us a consistent
threshold of when not to request reviews anymore, which I set to 15.
Before, this could have been anything between 10 and 20, depending on
how the reviewers distributed over owners and maintainers.
---
 .github/workflows/reviewers.yml                  | 10 +++++-----
 ci/request-reviews/request-code-owner-reviews.sh |  5 +----
 ci/request-reviews/request-reviewers.sh          |  2 +-
 3 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index f22e44d7cbff..4b49972e0732 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -69,15 +69,14 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: gh api /rate_limit | jq
 
-      - name: Requesting code owner reviews
+      - name: Determining code owner reviews
         if: steps.app-token.outputs.token
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPOSITORY: ${{ github.repository }}
           NUMBER: ${{ github.event.number }}
-          # Don't do anything on draft PRs
-          DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}
-        run: result/bin/request-code-owner-reviews.sh "$REPOSITORY" "$NUMBER" ci/OWNERS
+        run: |
+          result/bin/request-code-owner-reviews.sh "$REPOSITORY" "$NUMBER" ci/OWNERS > owners.txt
 
       - name: Log current API rate limits (app-token)
         if: ${{ steps.app-token.outputs.token }}
@@ -149,7 +148,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh api /rate_limit | jq
 
-      - name: Requesting maintainer reviews
+      - name: Requesting reviews
         if: ${{ steps.app-token.outputs.token }}
         env:
           GH_TOKEN: ${{ github.token }}
@@ -164,6 +163,7 @@ jobs:
           # There appears to be no API to request reviews based on GitHub IDs
           jq -r 'keys[]' comparison/maintainers.json \
             | while read -r id; do gh api /user/"$id" --jq .login; done \
+            | cat owners.txt - \
             | GH_TOKEN="$APP_GH_TOKEN" result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
 
       - name: Log current API rate limits (app-token)
diff --git a/ci/request-reviews/request-code-owner-reviews.sh b/ci/request-reviews/request-code-owner-reviews.sh
index 663285ae03fe..0ec61ab9f04e 100755
--- a/ci/request-reviews/request-code-owner-reviews.sh
+++ b/ci/request-reviews/request-code-owner-reviews.sh
@@ -31,8 +31,6 @@ prRepo=$(jq -r .head.repo.full_name <<< "$prInfo")
 log "PR repo: $prRepo"
 prBranch=$(jq -r .head.ref <<< "$prInfo")
 log "PR branch: $prBranch"
-prAuthor=$(jq -r .user.login <<< "$prInfo")
-log "PR author: $prAuthor"
 
 extraArgs=()
 if pwdRepo=$(git rev-parse --show-toplevel 2>/dev/null); then
@@ -56,5 +54,4 @@ git -C "$tmp/nixpkgs.git" fetch --no-tags fork "$prBranch"
 headRef=$(git -C "$tmp/nixpkgs.git" rev-parse refs/remotes/fork/"$prBranch")
 
 log "Requesting reviews from code owners"
-"$SCRIPT_DIR"/get-code-owners.sh "$tmp/nixpkgs.git" "$ownersFile" "$baseBranch" "$headRef" | \
-    "$SCRIPT_DIR"/request-reviewers.sh "$baseRepo" "$prNumber" "$prAuthor"
+"$SCRIPT_DIR"/get-code-owners.sh "$tmp/nixpkgs.git" "$ownersFile" "$baseBranch" "$headRef"
diff --git a/ci/request-reviews/request-reviewers.sh b/ci/request-reviews/request-reviewers.sh
index 1c105e385d28..6782b621b70b 100755
--- a/ci/request-reviews/request-reviewers.sh
+++ b/ci/request-reviews/request-reviewers.sh
@@ -68,7 +68,7 @@ for user in "${!users[@]}"; do
     fi
 done
 
-if [[ "${#users[@]}" -gt 10 ]]; then
+if [[ "${#users[@]}" -gt 15 ]]; then
     log "Too many reviewers (${!users[*]}), skipping review requests"
     exit 0
 fi

From d177d6057df8446f21297279047387edb350cf83 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 1 Nov 2025 11:04:46 +0100
Subject: [PATCH 12/61] ci/request-reviews: move git calls out of
 get-code-owners

This is just a refactor, no functional change. It is a preparation for a
future change, where `get-code-owners.sh` can be moved entirely into
eval/compare. This can only happen once we removed the remaining `gh
api` calls from it.
---
 ci/request-reviews/get-code-owners.sh            | 15 ++++-----------
 ci/request-reviews/request-code-owner-reviews.sh |  8 +++++++-
 2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/ci/request-reviews/get-code-owners.sh b/ci/request-reviews/get-code-owners.sh
index 13a377429b92..5d121f69a74c 100755
--- a/ci/request-reviews/get-code-owners.sh
+++ b/ci/request-reviews/get-code-owners.sh
@@ -9,32 +9,25 @@ log() {
 }
 
 if (( "$#" < 4 )); then
-    log "Usage: $0 GIT_REPO OWNERS_FILE BASE_REF HEAD_REF"
+    log "Usage: $0 TOUCHED_FILES_FILE OWNERS_FILE"
     exit 1
 fi
 
-gitRepo=$1
+touchedFilesFile=$1
 ownersFile=$2
-baseRef=$3
-headRef=$4
 
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' exit
 
-git -C "$gitRepo" diff --name-only --merge-base "$baseRef" "$headRef" > "$tmp/touched-files"
-readarray -t touchedFiles < "$tmp/touched-files"
+readarray -t touchedFiles < "$touchedFilesFile"
 log "This PR touches ${#touchedFiles[@]} files"
 
-# Get the owners file from the base, because we don't want to allow PRs to
-# remove code owners to avoid pinging them
-git -C "$gitRepo" show "$baseRef":"$ownersFile" > "$tmp"/codeowners
-
 # Associative array with the user as the key for easy de-duplication
 # Make sure to always lowercase keys to avoid duplicates with different casings
 declare -A users=()
 
 for file in "${touchedFiles[@]}"; do
-    result=$(codeowners --file "$tmp"/codeowners "$file")
+    result=$(codeowners --file "$ownersFile" "$file")
 
     # Remove the file prefix and trim the surrounding spaces
     read -r owners <<< "${result#"$file"}"
diff --git a/ci/request-reviews/request-code-owner-reviews.sh b/ci/request-reviews/request-code-owner-reviews.sh
index 0ec61ab9f04e..09df38304854 100755
--- a/ci/request-reviews/request-code-owner-reviews.sh
+++ b/ci/request-reviews/request-code-owner-reviews.sh
@@ -53,5 +53,11 @@ git -C "$tmp/nixpkgs.git" config remote.fork.promisor true
 git -C "$tmp/nixpkgs.git" fetch --no-tags fork "$prBranch"
 headRef=$(git -C "$tmp/nixpkgs.git" rev-parse refs/remotes/fork/"$prBranch")
 
+git -C "$tmp/nixpkgs.git" diff --name-only --merge-base "$baseBranch" "$headRef" > "$tmp/touched-files"
+
+# Get the owners file from the base, because we don't want to allow PRs to
+# remove code owners to avoid pinging them
+git -C "$tmp/nixpkgs.git" show "$baseBranch":"$ownersFile" > "$tmp"/codeowners
+
 log "Requesting reviews from code owners"
-"$SCRIPT_DIR"/get-code-owners.sh "$tmp/nixpkgs.git" "$ownersFile" "$baseBranch" "$headRef"
+"$SCRIPT_DIR"/get-code-owners.sh "$tmp/touched-files" "$tmp"/codeowners

From 18ab6b721e288ca9b6f9c0000ea62bebd070d5a1 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 1 Nov 2025 12:02:44 +0100
Subject: [PATCH 13/61] ci/request-reviews: move gh api calls out of
 get-code-owners

All the github related logic is now bundled in `request-reviewers.sh`.
This allows moving the `get-code-owners.sh` file into the eval/compare
step in the next commit.
---
 .github/workflows/reviewers.yml         | 14 --------
 ci/request-reviews/get-code-owners.sh   | 43 ++-----------------------
 ci/request-reviews/request-reviewers.sh | 34 ++++++++++++++++++-
 3 files changed, 35 insertions(+), 56 deletions(-)

diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index 4b49972e0732..a6822aa9af0e 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -63,27 +63,13 @@ jobs:
           permission-members: read
           permission-pull-requests: write
 
-      - name: Log current API rate limits (app-token)
-        if: ${{ steps.app-token.outputs.token }}
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
-
       - name: Determining code owner reviews
-        if: steps.app-token.outputs.token
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPOSITORY: ${{ github.repository }}
           NUMBER: ${{ github.event.number }}
         run: |
           result/bin/request-code-owner-reviews.sh "$REPOSITORY" "$NUMBER" ci/OWNERS > owners.txt
 
-      - name: Log current API rate limits (app-token)
-        if: ${{ steps.app-token.outputs.token }}
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
-
       - name: Log current API rate limits (github.token)
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/ci/request-reviews/get-code-owners.sh b/ci/request-reviews/get-code-owners.sh
index 5d121f69a74c..33963bce7f30 100755
--- a/ci/request-reviews/get-code-owners.sh
+++ b/ci/request-reviews/get-code-owners.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Get the code owners of the files changed by a PR, returning one username per line
+# Get the code owners of the files changed by a PR, returning one username or team per line
 
 set -euo pipefail
 
@@ -16,16 +16,9 @@ fi
 touchedFilesFile=$1
 ownersFile=$2
 
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-
 readarray -t touchedFiles < "$touchedFilesFile"
 log "This PR touches ${#touchedFiles[@]} files"
 
-# Associative array with the user as the key for easy de-duplication
-# Make sure to always lowercase keys to avoid duplicates with different casings
-declare -A users=()
-
 for file in "${touchedFiles[@]}"; do
     result=$(codeowners --file "$ownersFile" "$file")
 
@@ -52,39 +45,7 @@ for file in "${touchedFiles[@]}"; do
         # The first regex match is everything after the @
         entry=${BASH_REMATCH[1]}
 
-        if [[ "$entry" =~ (.*)/(.*) ]]; then
-            # Teams look like $org/$team
-            org=${BASH_REMATCH[1]}
-            team=${BASH_REMATCH[2]}
-
-            # Instead of requesting a review from the team itself,
-            # we request reviews from the individual users.
-            # This is because once somebody from a team reviewed the PR,
-            # the API doesn't expose that the team was already requested for a review,
-            # so we wouldn't be able to avoid rerequesting reviews
-            # without saving some some extra state somewhere
-
-            # We could also consider implementing a more advanced heuristic
-            # in the future that e.g. only pings one team member,
-            # but escalates to somebody else if that member doesn't respond in time.
-            gh api \
-                --cache=1h \
-                -H "Accept: application/vnd.github+json" \
-                -H "X-GitHub-Api-Version: 2022-11-28" \
-                "/orgs/$org/teams/$team/members" \
-                --jq '.[].login' > "$tmp/team-members"
-            readarray -t members < "$tmp/team-members"
-            log "Team $entry has these members: ${members[*]}"
-
-            for user in "${members[@]}"; do
-                users[${user,,}]=
-            done
-        else
-            # Everything else is a user
-            users[${entry,,}]=
-        fi
+        echo "$entry"
     done
 
 done
-
-printf "%s\n" "${!users[@]}"
diff --git a/ci/request-reviews/request-reviewers.sh b/ci/request-reviews/request-reviewers.sh
index 6782b621b70b..b4288669db93 100755
--- a/ci/request-reviews/request-reviewers.sh
+++ b/ci/request-reviews/request-reviewers.sh
@@ -33,9 +33,41 @@ prAuthor=$3
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' exit
 
+# Associative array with the user as the key for easy de-duplication
+# Make sure to always lowercase keys to avoid duplicates with different casings
 declare -A users=()
 while read -r handle && [[ -n "$handle" ]]; do
-    users[${handle,,}]=
+    if [[ "$handle" =~ (.*)/(.*) ]]; then
+        # Teams look like $org/$team
+        org=${BASH_REMATCH[1]}
+        team=${BASH_REMATCH[2]}
+
+        # Instead of requesting a review from the team itself,
+        # we request reviews from the individual users.
+        # This is because once somebody from a team reviewed the PR,
+        # the API doesn't expose that the team was already requested for a review,
+        # so we wouldn't be able to avoid rerequesting reviews
+        # without saving some some extra state somewhere
+
+        # We could also consider implementing a more advanced heuristic
+        # in the future that e.g. only pings one team member,
+        # but escalates to somebody else if that member doesn't respond in time.
+        gh api \
+            --cache=1h \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "/orgs/$org/teams/$team/members" \
+            --jq '.[].login' > "$tmp/team-members"
+        readarray -t members < "$tmp/team-members"
+        log "Team $entry has these members: ${members[*]}"
+
+        for user in "${members[@]}"; do
+            users[${user,,}]=
+        done
+    else
+        # Everything else is a user
+        users[${handle,,}]=
+    fi
 done
 
 # Cannot request a review from the author

From 3bef0dcf6588c23c95ce882e17a592d6ec66aa21 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 1 Nov 2025 14:27:15 +0100
Subject: [PATCH 14/61] ci/request-reviews: move get-code-owners to
 eval/compare

This moves the parsing of ci/OWNERS into the Nix sandbox. We also get
rid of checking out the nixpkgs repo another time in the reviewers
workflow - we already have everything we need in the eval/compare job.

The creation of owners.txt in this way is only temporary, it should
eventually be moved further, similar to how maintainers.json is
currently migrating to a maintainer map for the whole repo stored on the
target branch as artifact.
---
 .github/workflows/reviewers.yml               |  9 +--
 ci/eval/compare/default.nix                   | 39 ++++++++++++
 ci/request-reviews/default.nix                |  8 ---
 ci/request-reviews/get-code-owners.sh         | 51 ---------------
 .../request-code-owner-reviews.sh             | 63 -------------------
 5 files changed, 40 insertions(+), 130 deletions(-)
 delete mode 100755 ci/request-reviews/get-code-owners.sh
 delete mode 100755 ci/request-reviews/request-code-owner-reviews.sh

diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index a6822aa9af0e..03d8caa2661b 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -63,13 +63,6 @@ jobs:
           permission-members: read
           permission-pull-requests: write
 
-      - name: Determining code owner reviews
-        env:
-          REPOSITORY: ${{ github.repository }}
-          NUMBER: ${{ github.event.number }}
-        run: |
-          result/bin/request-code-owner-reviews.sh "$REPOSITORY" "$NUMBER" ci/OWNERS > owners.txt
-
       - name: Log current API rate limits (github.token)
         env:
           GH_TOKEN: ${{ github.token }}
@@ -149,7 +142,7 @@ jobs:
           # There appears to be no API to request reviews based on GitHub IDs
           jq -r 'keys[]' comparison/maintainers.json \
             | while read -r id; do gh api /user/"$id" --jq .login; done \
-            | cat owners.txt - \
+            | cat comparison/owners.txt - \
             | GH_TOKEN="$APP_GH_TOKEN" result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
 
       - name: Log current API rate limits (app-token)
diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index eabc28af4d36..571e6ba41068 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -7,6 +7,7 @@
   python3,
   stdenvNoCC,
   makeWrapper,
+  codeowners,
 }:
 let
   python = python3.withPackages (ps: [
@@ -48,6 +49,7 @@ in
 {
   combinedDir,
   touchedFilesJson,
+  ownersFile ? ../../OWNERS,
 }:
 let
   # Usually we expect a derivation, but when evaluating in multiple separate steps, we pass
@@ -174,6 +176,7 @@ runCommand "compare"
     nativeBuildInputs = map lib.getBin [
       jq
       cmp-stats
+      codeowners
     ];
     maintainers = builtins.toJSON maintainers;
     packages = builtins.toJSON packages;
@@ -222,6 +225,42 @@ runCommand "compare"
       } >> $out/step-summary.md
     fi
 
+    jq -r '.[]' "${touchedFilesJson}" > ./touched-files
+    readarray -t touchedFiles < ./touched-files
+    echo "This PR touches ''${#touchedFiles[@]} files"
+
+    # TODO: Move ci/OWNERS to Nix and produce owners.json instead of owners.txt.
+    for file in "''${touchedFiles[@]}"; do
+        result=$(codeowners --file "${ownersFile}" "$file")
+
+        # Remove the file prefix and trim the surrounding spaces
+        read -r owners <<< "''${result#"$file"}"
+        if [[ "$owners" == "(unowned)" ]]; then
+            echo "File $file is unowned"
+            continue
+        fi
+        echo "File $file is owned by $owners"
+
+        # Split up multiple owners, separated by arbitrary amounts of spaces
+        IFS=" " read -r -a entries <<< "$owners"
+
+        for entry in "''${entries[@]}"; do
+            # GitHub technically also supports Emails as code owners,
+            # but we can't easily support that, so let's not
+            if [[ ! "$entry" =~ @(.*) ]]; then
+                echo -e "\e[33mCodeowner \"$entry\" for file $file is not valid: Must start with \"@\"\e[0m"
+                # Don't fail, because the PR for which this script runs can't fix it,
+                # it has to be fixed in the base branch
+                continue
+            fi
+            # The first regex match is everything after the @
+            entry=''${BASH_REMATCH[1]}
+
+            echo "$entry" >> "$out/owners.txt"
+        done
+
+    done
+
     cp "$maintainersPath" "$out/maintainers.json"
     cp "$packagesPath" "$out/packages.json"
   ''
diff --git a/ci/request-reviews/default.nix b/ci/request-reviews/default.nix
index 075ff52fd564..55a1889fe89f 100644
--- a/ci/request-reviews/default.nix
+++ b/ci/request-reviews/default.nix
@@ -3,20 +3,15 @@
   stdenvNoCC,
   makeWrapper,
   coreutils,
-  codeowners,
   jq,
-  curl,
   github-cli,
-  gitMinimal,
 }:
 stdenvNoCC.mkDerivation {
   name = "request-reviews";
   src = lib.fileset.toSource {
     root = ./.;
     fileset = lib.fileset.unions [
-      ./get-code-owners.sh
       ./request-reviewers.sh
-      ./request-code-owner-reviews.sh
     ];
   };
   nativeBuildInputs = [ makeWrapper ];
@@ -29,11 +24,8 @@ stdenvNoCC.mkDerivation {
         --set PATH ${
           lib.makeBinPath [
             coreutils
-            codeowners
             jq
-            curl
             github-cli
-            gitMinimal
           ]
         }
     done
diff --git a/ci/request-reviews/get-code-owners.sh b/ci/request-reviews/get-code-owners.sh
deleted file mode 100755
index 33963bce7f30..000000000000
--- a/ci/request-reviews/get-code-owners.sh
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/usr/bin/env bash
-
-# Get the code owners of the files changed by a PR, returning one username or team per line
-
-set -euo pipefail
-
-log() {
-    echo "$@" >&2
-}
-
-if (( "$#" < 4 )); then
-    log "Usage: $0 TOUCHED_FILES_FILE OWNERS_FILE"
-    exit 1
-fi
-
-touchedFilesFile=$1
-ownersFile=$2
-
-readarray -t touchedFiles < "$touchedFilesFile"
-log "This PR touches ${#touchedFiles[@]} files"
-
-for file in "${touchedFiles[@]}"; do
-    result=$(codeowners --file "$ownersFile" "$file")
-
-    # Remove the file prefix and trim the surrounding spaces
-    read -r owners <<< "${result#"$file"}"
-    if [[ "$owners" == "(unowned)" ]]; then
-        log "File $file is unowned"
-        continue
-    fi
-    log "File $file is owned by $owners"
-
-    # Split up multiple owners, separated by arbitrary amounts of spaces
-    IFS=" " read -r -a entries <<< "$owners"
-
-    for entry in "${entries[@]}"; do
-        # GitHub technically also supports Emails as code owners,
-        # but we can't easily support that, so let's not
-        if [[ ! "$entry" =~ @(.*) ]]; then
-            warn -e "\e[33mCodeowner \"$entry\" for file $file is not valid: Must start with \"@\"\e[0m" >&2
-            # Don't fail, because the PR for which this script runs can't fix it,
-            # it has to be fixed in the base branch
-            continue
-        fi
-        # The first regex match is everything after the @
-        entry=${BASH_REMATCH[1]}
-
-        echo "$entry"
-    done
-
-done
diff --git a/ci/request-reviews/request-code-owner-reviews.sh b/ci/request-reviews/request-code-owner-reviews.sh
deleted file mode 100755
index 09df38304854..000000000000
--- a/ci/request-reviews/request-code-owner-reviews.sh
+++ /dev/null
@@ -1,63 +0,0 @@
-#!/usr/bin/env bash
-
-# Requests reviews for a PR
-
-set -euo pipefail
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-SCRIPT_DIR=$(dirname "$0")
-
-log() {
-    echo "$@" >&2
-}
-
-if (( $# < 3 )); then
-    log "Usage: $0 GITHUB_REPO PR_NUMBER OWNERS_FILE"
-    exit 1
-fi
-baseRepo=$1
-prNumber=$2
-ownersFile=$3
-
-log "Fetching PR info"
-prInfo=$(gh api \
-  -H "Accept: application/vnd.github+json" \
-  -H "X-GitHub-Api-Version: 2022-11-28" \
-  "/repos/$baseRepo/pulls/$prNumber")
-
-baseBranch=$(jq -r .base.ref <<< "$prInfo")
-log "Base branch: $baseBranch"
-prRepo=$(jq -r .head.repo.full_name <<< "$prInfo")
-log "PR repo: $prRepo"
-prBranch=$(jq -r .head.ref <<< "$prInfo")
-log "PR branch: $prBranch"
-
-extraArgs=()
-if pwdRepo=$(git rev-parse --show-toplevel 2>/dev/null); then
-    # Speedup for local runs
-    extraArgs+=(--reference-if-able "$pwdRepo")
-fi
-
-log "Fetching Nixpkgs commit history"
-# We only need the commit history, not the contents, so we can do a tree-less clone using tree:0
-# https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/#user-content-quick-summary
-git clone --bare --filter=tree:0 --no-tags --origin upstream "${extraArgs[@]}" https://github.com/"$baseRepo".git "$tmp"/nixpkgs.git
-
-log "Fetching the PR commit history"
-# Fetch the PR
-git -C "$tmp/nixpkgs.git" remote add fork https://github.com/"$prRepo".git
-# This remote config is the same as --filter=tree:0 when cloning
-git -C "$tmp/nixpkgs.git" config remote.fork.partialclonefilter tree:0
-git -C "$tmp/nixpkgs.git" config remote.fork.promisor true
-
-git -C "$tmp/nixpkgs.git" fetch --no-tags fork "$prBranch"
-headRef=$(git -C "$tmp/nixpkgs.git" rev-parse refs/remotes/fork/"$prBranch")
-
-git -C "$tmp/nixpkgs.git" diff --name-only --merge-base "$baseBranch" "$headRef" > "$tmp/touched-files"
-
-# Get the owners file from the base, because we don't want to allow PRs to
-# remove code owners to avoid pinging them
-git -C "$tmp/nixpkgs.git" show "$baseBranch":"$ownersFile" > "$tmp"/codeowners
-
-log "Requesting reviews from code owners"
-"$SCRIPT_DIR"/get-code-owners.sh "$tmp/touched-files" "$tmp"/codeowners

From 5ae966b9dcdf07cd5ac4534edcab2a1b67596b17 Mon Sep 17 00:00:00 2001
From: Heitor Augusto <44377258+HeitorAugustoLN@users.noreply.github.com>
Date: Wed, 29 Oct 2025 13:07:25 -0300
Subject: [PATCH 15/61] libcosmicAppHook: include only fallback themes from
 settings

---
 pkgs/by-name/li/libcosmicAppHook/package.nix | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libcosmicAppHook/package.nix b/pkgs/by-name/li/libcosmicAppHook/package.nix
index f4bc7bd4f34f..f3042e13ac8e 100644
--- a/pkgs/by-name/li/libcosmicAppHook/package.nix
+++ b/pkgs/by-name/li/libcosmicAppHook/package.nix
@@ -7,6 +7,7 @@
   lib,
   stdenv,
   makeSetupHook,
+  runCommand,
   makeBinaryWrapper,
   pkg-config,
   targetPackages,
@@ -44,8 +45,16 @@ makeSetupHook {
     ];
 
   substitutions = {
-    fallbackXdgDirs = "${lib.optionalString includeSettings "${targetPackages.cosmic-settings}/share:"}${targetPackages.cosmic-icons}/share";
-
+    fallbackXdgDirs =
+      let
+        fallbackThemes = runCommand "cosmic-fallback-themes" { } ''
+          mkdir -p $out/share
+          ln -s ${targetPackages.cosmic-settings}/share/cosmic $out/share/cosmic
+        '';
+      in
+      lib.makeSearchPath "share" (
+        lib.optionals includeSettings [ fallbackThemes ] ++ [ targetPackages.cosmic-icons ]
+      );
     cargoLinkerVar = targetPackages.stdenv.hostPlatform.rust.cargoEnvVarTarget;
     # force linking for all libraries that may be dlopen'd by libcosmic/iced apps
     cargoLinkLibs = lib.escapeShellArgs (

From 3fd62da27fa06cfcf1e7f4bc8b84b9709d9ef8d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicolas=20M=C3=A9meint?= <git@nicomem.com>
Date: Thu, 25 Sep 2025 18:58:00 +0200
Subject: [PATCH 16/61] nixos/crowdsec-firewall-bouncer: init module

---
 .../manual/release-notes/rl-2511.section.md   |   2 +
 nixos/modules/module-list.nix                 |   1 +
 .../security/crowdsec-firewall-bouncer.nix    | 390 ++++++++++++++++++
 3 files changed, 393 insertions(+)
 create mode 100644 nixos/modules/services/security/crowdsec-firewall-bouncer.nix

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 2e73fe06aa0e..24ca7061f630 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -100,6 +100,8 @@
 
 - [crowdsec](https://www.crowdsec.net/), a free, open-source and collaborative IPS. Available as [services.crowdsec](#opt-services.crowdsec.enable).
 
+- [crowdsec-firewall-bouncer](https://www.crowdsec.net/), the CrowdSec Remediation Component for fetching new and old decisions from a CrowdSec API and adding them to a blocklist used by supported firewalls. Available as [services.crowdsec-firewall-bouncer](#opt-services.crowdsec-firewall-bouncer.enable).
+
 - [tsidp](https://github.com/tailscale/tsidp), a simple OIDC / OAuth Identity Provider (IdP) server for your tailnet. Available as [services.tsidp](#opt-services.tsidp.enable).
 
 - [Newt](https://github.com/fosrl/newt), a fully user space WireGuard tunnel client and TCP/UDP proxy, designed to securely expose private resources controlled by Pangolin. Available as [services.newt](options.html#opt-services.newt.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index f66d92bf6f77..09a858a434db 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1460,6 +1460,7 @@
   ./services/security/certmgr.nix
   ./services/security/cfssl.nix
   ./services/security/clamav.nix
+  ./services/security/crowdsec-firewall-bouncer.nix
   ./services/security/crowdsec.nix
   ./services/security/e-imzo.nix
   ./services/security/endlessh-go.nix
diff --git a/nixos/modules/services/security/crowdsec-firewall-bouncer.nix b/nixos/modules/services/security/crowdsec-firewall-bouncer.nix
new file mode 100644
index 000000000000..5091ba4156a4
--- /dev/null
+++ b/nixos/modules/services/security/crowdsec-firewall-bouncer.nix
@@ -0,0 +1,390 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.crowdsec-firewall-bouncer;
+  format = pkgs.formats.yaml { };
+in
+{
+  options.services.crowdsec-firewall-bouncer =
+    let
+      inherit (lib)
+        types
+        mkOption
+        mkEnableOption
+        mkPackageOption
+        ;
+    in
+    {
+      enable = mkEnableOption "CrowdSec Firewall Bouncer";
+
+      package = mkPackageOption pkgs "crowdsec-firewall-bouncer" { };
+
+      createRulesets = mkOption {
+        type = types.bool;
+        description = ''
+          Whether to have the module create the appropriate firewall configuration
+          based on the bouncer settings.
+          You may disable this option to manually configure it.
+        '';
+        default = true;
+      };
+
+      registerBouncer = {
+        enable = mkOption {
+          type = types.bool;
+          description = ''
+            Whether to automatically register the bouncer to the locally running
+            `crowdsec` service.
+
+            When authenticating to an external CrowdSec API, you may use the
+            [](#opt-services.crowdsec-firewall-bouncer.secrets.apiKeyPath) option
+            instead.
+          '';
+          default = config.services.crowdsec.enable;
+          defaultText = lib.literalExpression ''config.services.crowdsec.enable'';
+        };
+        bouncerName = mkOption {
+          type = types.nonEmptyStr;
+          description = "Name to register the bouncer as to the CrowdSec API";
+          default = "crowdsec-firewall-bouncer";
+        };
+      };
+
+      secrets = {
+        apiKeyPath = mkOption {
+          type = types.nullOr types.path;
+          description = ''
+            Path to the API key to authenticate with a local CrowdSec API.
+
+            You need to call `cscli bouncers add <bouncer-name>` to register
+            the bouncer and get this API key.
+
+            When authenticating to the locally running `crowdsec` service, you may use the
+            [](#opt-services.crowdsec-firewall-bouncer.registerBouncer.enable) option instead.
+          '';
+          default = null;
+        };
+      };
+
+      settings = mkOption {
+        description = ''
+          Settings for the main CrowdSec Firewall Bouncer.
+
+          Refer to the defaults at <https://github.com/crowdsecurity/cs-firewall-bouncer/blob/main/config/crowdsec-firewall-bouncer.yaml>.
+        '';
+        default = { };
+        type = types.submodule {
+          freeformType = format.type;
+          options = {
+            mode = mkOption {
+              type = types.str;
+              description = "Firewall mode to use.";
+              default = if config.networking.nftables.enable then "nftables" else "iptables";
+              defaultText = lib.literalExpression ''if config.networking.nftables.enable then "nftables" else "iptables"'';
+            };
+            api_url = mkOption {
+              type = types.str;
+              description = "URL of the local API.";
+              example = "http://127.0.0.1:8080";
+              default = "http://${config.services.crowdsec.settings.general.api.server.listen_uri}";
+              defaultText = lib.literalExpression ''http://$\{config.services.crowdsec.settings.general.api.server.listen_uri}'';
+            };
+            api_key = mkOption {
+              type = types.nullOr types.str;
+              description = ''
+                API key to authenticate with a local crowdsec API.
+
+                You need to call `cscli bouncers add <bouncer-name>` to register
+                the bouncer and get this API key.
+
+                Setting this option will store this secret in the Nix store.
+                Instead, you should set the `services.crowdsec-firewall-bouncer.secrets.apiKeyPath`
+                option, which will read the value at runtime.
+              '';
+              default = null;
+            };
+          };
+        };
+      };
+    };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          cfg.registerBouncer.enable || (cfg.secrets.apiKeyPath != null) || (cfg.settings.api_key != null);
+        message = ''
+          An API key must be set for the bouncer to be able to authenticate to a local crowdsec API.
+
+          See the `registerBouncer.enable` and `secrets.apiKeyPath` options of
+          `services.crowdsec-firewall-bouncer` for more information.
+        '';
+      }
+      {
+        assertion = !(cfg.registerBouncer.enable && (cfg.secrets.apiKeyPath != null));
+        message = ''
+          The `registerBouncer.enable` and `secrets.apiKeyPath` options of
+          `services.crowdsec-firewall-bouncer` are mutually exclusive.
+        '';
+      }
+      {
+        assertion = !(cfg.registerBouncer.enable && !config.services.crowdsec.enable);
+        message = ''
+          The `services.crowdsec-firewall-bouncer.registerBouncer.enable` option
+          requires the `crowdsec` service to be enabled.
+        '';
+      }
+      {
+        assertion = !(cfg.settings.mode == "ipset" && cfg.createRulesets);
+        message = ''
+          The crowdsec-firewall-bouncer module is currently not able to configure the firewall in "ipset" mode.
+
+          Either set the `services.crowdsec-firewall-bouncer.settings.mode` to "iptables" to leave the bouncer
+          manage the firewall configuration, or disable the `services.crowdsec-firewall-bouncer.createRulesets`
+          option and manually configure your firewall.
+        '';
+      }
+    ];
+
+    # Default settings
+    services.crowdsec-firewall-bouncer.settings = {
+      update_frequency = lib.mkDefault "10s";
+      log_mode = lib.mkDefault "stdout";
+      log_level = lib.mkDefault "info";
+
+      # iptables-specific config
+      blacklists_ipv4 = lib.mkDefault "crowdsec-blacklists";
+      blacklists_ipv6 = lib.mkDefault "crowdsec6-blacklists";
+      iptables_chains = lib.mkDefault [ "INPUT" ];
+
+      # nftables-specific config
+      nftables = {
+        ipv4 = {
+          enabled = lib.mkDefault true;
+          set-only = lib.mkDefault true;
+          table = lib.mkDefault "crowdsec";
+          chain = lib.mkDefault "crowdsec-chain";
+        };
+        ipv6 = {
+          enabled = lib.mkDefault true;
+          set-only = lib.mkDefault true;
+          table = lib.mkDefault "crowdsec6";
+          chain = lib.mkDefault "crowdsec6-chain";
+        };
+      };
+    };
+
+    # Use a placeholder for the api_key if it is to be read from a file at runtime
+    services.crowdsec-firewall-bouncer.settings.api_key = lib.mkIf (
+      cfg.registerBouncer.enable || (cfg.secrets.apiKeyPath != null)
+    ) "@API_KEY_FILE@";
+
+    networking.nftables.tables = lib.mkIf (cfg.settings.mode == "nftables") {
+      "${cfg.settings.nftables.ipv4.table}" =
+        lib.mkIf
+          (cfg.createRulesets && cfg.settings.nftables.ipv4.enabled && cfg.settings.nftables.ipv4.set-only)
+          {
+            family = "ip";
+            content = ''
+              set crowdsec-blacklists {
+                type ipv4_addr
+                flags timeout
+              }
+
+              chain ${cfg.settings.nftables.ipv4.chain} {
+                type filter hook input priority filter; policy accept;
+                ip saddr @crowdsec-blacklists drop
+              }
+            '';
+          };
+      "${cfg.settings.nftables.ipv6.table}" =
+        lib.mkIf
+          (cfg.createRulesets && cfg.settings.nftables.ipv6.enabled && cfg.settings.nftables.ipv6.set-only)
+          {
+            family = "ip6";
+            content = ''
+              set crowdsec6-blacklists {
+                type ipv6_addr
+                flags timeout
+              }
+
+              chain ${cfg.settings.nftables.ipv6.chain} {
+                type filter hook input priority filter; policy accept;
+                ip6 saddr @crowdsec6-blacklists drop
+              }
+            '';
+          };
+    };
+
+    systemd.services =
+      let
+        apiKeyFile = "/var/lib/crowdsec-firewall-bouncer-register/api-key.cred";
+      in
+      {
+        crowdsec-firewall-bouncer-register = lib.mkIf cfg.registerBouncer.enable rec {
+          description = "Register the CrowdSec Firewall Bouncer to the local CrowdSec service";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "crowdsec.service" ];
+          wants = after;
+          script = ''
+            cscli=/run/current-system/sw/bin/cscli
+            if $cscli bouncers list --output json | ${lib.getExe pkgs.jq} -e -- ${lib.escapeShellArg "any(.[]; .name == \"${cfg.registerBouncer.bouncerName}\")"} >/dev/null; then
+              # Bouncer already registered. Verify the API key is still present
+              if [ ! -f ${apiKeyFile} ]; then
+                echo "Bouncer registered but API key is not present"
+                exit 1
+              fi
+            else
+              # Bouncer not registered
+              # Remove any previously saved API key
+              rm -f '${apiKeyFile}'
+              # Register the bouncer and save the new API key
+              if ! $cscli bouncers add --output raw -- ${lib.escapeShellArg cfg.registerBouncer.bouncerName} >${apiKeyFile}; then
+                # Failed to register the bouncer
+                rm ${apiKeyFile}
+                exit 1
+              fi
+            fi
+          '';
+          serviceConfig = {
+            Type = "oneshot";
+
+            # Run as crowdsec user to be able to use cscli
+            User = config.services.crowdsec.user;
+            Group = config.services.crowdsec.group;
+
+            StateDirectory = "crowdsec-firewall-bouncer-register";
+
+            ReadWritePaths = [
+              # Needs write permissions to add the bouncer
+              "/var/lib/crowdsec"
+            ];
+
+            DynamicUser = true;
+            LockPersonality = true;
+            PrivateDevices = true;
+            ProcSubset = "pid";
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = true;
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            SystemCallArchitectures = "native";
+
+            RestrictAddressFamilies = "none";
+            CapabilityBoundingSet = [ "" ];
+            SystemCallFilter = [
+              "@system-service"
+              "~@privileged"
+              "~@resources"
+            ];
+            UMask = "0077";
+          };
+        };
+
+        crowdsec-firewall-bouncer =
+          let
+            runtime-dir-name = "crowdsec-firewall-bouncer";
+            final-config-file = "/run/${runtime-dir-name}/config.yaml";
+            generateConfig = pkgs.writeShellScript "crowdsec-firewall-bouncer-config" ''
+              set -euo pipefail
+              umask 077
+
+              # Copy the template to the final location
+              cp ${format.generate "crowdsec-firewall-bouncer-config-template.yml" cfg.settings} ${final-config-file}
+              chmod 0600 ${final-config-file}
+
+              # Replace the api_key placeholder with the secret
+              ${lib.getExe pkgs.replace-secret} '@API_KEY_FILE@' "$CREDENTIALS_DIRECTORY/API_KEY_FILE" ${final-config-file}
+            '';
+          in
+          rec {
+            description = "CrowdSec Firewall Bouncer";
+            wantedBy = [ "multi-user.target" ];
+            after = [ "network.target" ] ++ (lib.optional config.services.crowdsec.enable "crowdsec.service");
+            wants = after;
+            requires = lib.optional cfg.registerBouncer.enable "crowdsec-firewall-bouncer-register.service";
+
+            # When using iptables/ipset modes, the bouncer calls external binaries so they must be added to the path.
+            # For nftables mode, it does not depend on external binaries.
+            path = lib.optionals ((cfg.settings.mode == "iptables") || (cfg.settings.mode == "ipset")) [
+              pkgs.iptables
+              pkgs.ipset
+            ];
+
+            serviceConfig = rec {
+              Type = "notify";
+              ExecStartPre = [
+                generateConfig
+                "${lib.getExe cfg.package} -c ${final-config-file} -t"
+              ];
+              ExecStart = [
+                "${lib.getExe cfg.package} -c ${final-config-file}"
+              ];
+
+              # Same as upstream
+              LimitNOFILE = 65536;
+              KillMode = "mixed";
+
+              # Load the api_key secret to be able to use it when generating the final config
+              LoadCredential =
+                if (cfg.registerBouncer.enable) then
+                  "API_KEY_FILE:${apiKeyFile}"
+                else if (cfg.secrets.apiKeyPath != null) then
+                  "API_KEY_FILE:${cfg.secrets.apiKeyPath}"
+                else
+                  null;
+
+              DynamicUser = true;
+              RuntimeDirectory = runtime-dir-name;
+
+              LockPersonality = true;
+              PrivateDevices = true;
+              ProcSubset = "pid";
+              ProtectClock = true;
+              ProtectControlGroups = true;
+              ProtectHome = true;
+              ProtectHostname = true;
+              ProtectKernelLogs = true;
+              ProtectKernelModules = true;
+              ProtectKernelTunables = true;
+              ProtectProc = "invisible";
+              RestrictNamespaces = true;
+              RestrictRealtime = true;
+              SystemCallArchitectures = "native";
+
+              RestrictAddressFamilies = [
+                "AF_NETLINK"
+                "AF_UNIX"
+                "AF_INET"
+                "AF_INET6"
+              ];
+              AmbientCapabilities = [
+                # Needed to be able to manipulate the rulesets
+                "CAP_NET_ADMIN"
+              ];
+              CapabilityBoundingSet = AmbientCapabilities;
+              SystemCallFilter = [
+                "@system-service"
+                "~@privileged"
+                "~@resources"
+              ];
+              UMask = "0077";
+            };
+          };
+      };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ nicomem ];
+  };
+}

From eb93e57d6464e3cdf758203d5bc29563d8b36ec2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 1 Nov 2025 21:51:45 +0000
Subject: [PATCH 17/61] cursor-cli: 0-unstable-2025-10-22 ->
 0-unstable-2025-10-28

---
 pkgs/by-name/cu/cursor-cli/package.nix | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/cu/cursor-cli/package.nix b/pkgs/by-name/cu/cursor-cli/package.nix
index 55d794f0ac5c..bdb8015ce19e 100644
--- a/pkgs/by-name/cu/cursor-cli/package.nix
+++ b/pkgs/by-name/cu/cursor-cli/package.nix
@@ -9,26 +9,26 @@ let
   inherit (stdenv) hostPlatform;
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.22-f894c20/linux/x64/agent-cli-package.tar.gz";
-      hash = "sha256-bblnHWrPXJ9UmStfjUis1jLYLyawRchF0+UBMmPHy7M=";
+      url = "https://downloads.cursor.com/lab/2025.10.28-0a91dc2/linux/x64/agent-cli-package.tar.gz";
+      hash = "sha256-mZ0T7rrKzwvaNUbrHBy3XO04vZSO6RQ4RmJmrdfaoJA=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.22-f894c20/linux/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-MnL1TLI7ggi9qaicUN//8o3EJoCPd0gF9KKfekIhUM0=";
+      url = "https://downloads.cursor.com/lab/2025.10.28-0a91dc2/linux/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-bchHYPQ0O/0YWiPdj3wnq43p/fKFoP4KXpeSVWpLYpE=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.22-f894c20/darwin/x64/agent-cli-package.tar.gz";
-      hash = "sha256-UEQyHEopNKf5uDUlZVzTESXVi8e2wHp83cD01diAISY=";
+      url = "https://downloads.cursor.com/lab/2025.10.28-0a91dc2/darwin/x64/agent-cli-package.tar.gz";
+      hash = "sha256-PWx5QAs84gWNOHYZL20uFnW+m4rApRT6g4LtabjL+lw=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.22-f894c20/darwin/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-18u5K/4Mc9+R32umaBWD5chgMoatkd/ZSMCiPElmPJU=";
+      url = "https://downloads.cursor.com/lab/2025.10.28-0a91dc2/darwin/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-VW76Lx2VKspiGkphp74ib4+F5FCdu8793f+xvD67OpM=";
     };
   };
 in
 stdenv.mkDerivation {
   pname = "cursor-cli";
-  version = "0-unstable-2025-10-22";
+  version = "0-unstable-2025-10-28";
 
   src = sources.${hostPlatform.system};
 

From f72cb1669a015e175d0f09efabc67e451fa9874f Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Sat, 1 Nov 2025 17:53:42 -0400
Subject: [PATCH 18/61] linux/common-config: Disable `LEGACY_TIOCSTI`

See the commit message adding the kconfig:
https://github.com/torvalds/linux/commit/83efeeeb3d04b22aaed1df99bc70a48fe9d22c4d

At least Fedora and Arch both appear to disable this on their kernels.
---
 pkgs/os-specific/linux/kernel/common-config.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 4fa16a094bdc..db639b58f417 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1409,6 +1409,8 @@ let
         TASK_XACCT = yes;
         TASK_IO_ACCOUNTING = yes;
 
+        LEGACY_TIOCSTI = whenAtLeast "6.2" no;
+
         # Fresh toolchains frequently break -Werror build for minor issues.
         WERROR = whenAtLeast "5.15" no;
 

From 45e80db7d19d70926ca182ada77878d3335faf63 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 02:04:57 +0000
Subject: [PATCH 19/61] go-httpbin: 2.18.3 -> 2.19.0

---
 pkgs/by-name/go/go-httpbin/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/go/go-httpbin/package.nix b/pkgs/by-name/go/go-httpbin/package.nix
index 9a77b98f4619..3ae14e615cb7 100644
--- a/pkgs/by-name/go/go-httpbin/package.nix
+++ b/pkgs/by-name/go/go-httpbin/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-httpbin";
-  version = "2.18.3";
+  version = "2.19.0";
 
   src = fetchFromGitHub {
     owner = "mccutchen";
     repo = "go-httpbin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ixEbmppQ+4Udc5ytV4YPOpOT/iEbhjQIYGoOGL0dIw8=";
+    hash = "sha256-agElHziDwv2MGwTUKPsyDMVlTNNkuSZp4OAR2/zbW1U=";
   };
 
   vendorHash = null;

From 7f89ec838a10595141645f7cee7f474b914db543 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 03:21:29 +0000
Subject: [PATCH 20/61] backrest: 1.9.2 -> 1.10.1

---
 pkgs/by-name/ba/backrest/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ba/backrest/package.nix b/pkgs/by-name/ba/backrest/package.nix
index 56315431180a..2ab3f13341b0 100644
--- a/pkgs/by-name/ba/backrest/package.nix
+++ b/pkgs/by-name/ba/backrest/package.nix
@@ -14,13 +14,13 @@
 }:
 let
   pname = "backrest";
-  version = "1.9.2";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "garethgeorge";
     repo = "backrest";
     tag = "v${version}";
-    hash = "sha256-3lAWViC9K34R8la/z57kjGJmMmletGd8pJ1dDt+BeKQ=";
+    hash = "sha256-8WWs7XEVKAc/XmeL+dsw25azfLjUbHKp2MsB6Be14VE=";
   };
 
   frontend = stdenv.mkDerivation (finalAttrs: {
@@ -64,7 +64,7 @@ buildGoModule {
       internal/resticinstaller/resticinstaller.go
   '';
 
-  vendorHash = "sha256-oycV8JAJQF/PNc7mmYGzkZbpG8pMwxThmuys9e0+hcc=";
+  vendorHash = "sha256-cYqK/sddLI38K9bzCpnomcZOYbSRDBOEru4Y26rBLFw=";
 
   nativeBuildInputs = [
     gzip

From 963c65f4ec7058b06f3e2375942ffc1e7c672855 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 05:23:56 +0000
Subject: [PATCH 21/61] protoc-gen-swift: 1.32.0 -> 1.33.3

---
 pkgs/by-name/pr/protoc-gen-swift/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pr/protoc-gen-swift/package.nix b/pkgs/by-name/pr/protoc-gen-swift/package.nix
index 939702ab34ca..c725f9afe1ca 100644
--- a/pkgs/by-name/pr/protoc-gen-swift/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-swift/package.nix
@@ -11,13 +11,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "protoc-gen-swift";
-  version = "1.32.0";
+  version = "1.33.3";
 
   src = fetchFromGitHub {
     owner = "apple";
     repo = "swift-protobuf";
     rev = "${finalAttrs.version}";
-    hash = "sha256-YirKJjEA5zFVVs8U1/D3TYCgv+3FMO7dusCZ7ZuIeZs=";
+    hash = "sha256-FFFHnxuynKfcmWCgJ38rKk3FS/o5buLYS7VcEivF0v0=";
   };
 
   nativeBuildInputs = [

From df033f9879b8c2bcbee8ffefc0f93ece37856fb3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 05:24:21 +0000
Subject: [PATCH 22/61] pop-hp-wallpapers: 0-unstable-2022-04-01 ->
 0-unstable-2025-10-28

---
 pkgs/by-name/po/pop-hp-wallpapers/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/po/pop-hp-wallpapers/package.nix b/pkgs/by-name/po/pop-hp-wallpapers/package.nix
index 92e10c5e06b1..535476b673cb 100644
--- a/pkgs/by-name/po/pop-hp-wallpapers/package.nix
+++ b/pkgs/by-name/po/pop-hp-wallpapers/package.nix
@@ -8,15 +8,15 @@
 
 stdenvNoCC.mkDerivation {
   pname = "pop-hp-wallpapers";
-  version = "0-unstable-2022-04-01";
+  version = "0-unstable-2025-10-28";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "hp-wallpapers";
-    rev = "df86078846b0a2a4e3e64f584aaf2a21be47a7eb";
+    rev = "94f7df30f6bf1c3d71522018852d77c10b920ea3";
     forceFetchGit = true;
     fetchLFS = true;
-    hash = "sha256-NGSvPC9GadqqqgGH9uDNAYuSwfagosmCAE6QmDtmdMw=";
+    hash = "sha256-AthVQ9kQO+CvSH1xxz/U6WzAtpcXK1gvRwKyeo0vMSs=";
   };
 
   nativeBuildInputs = [ imagemagick ];

From ddee1c92686d329a880f4da82be1d2762acc265d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 05:35:50 +0000
Subject: [PATCH 23/61] vivify: 0.10.0 -> 0.11.0

---
 pkgs/by-name/vi/vivify/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vi/vivify/package.nix b/pkgs/by-name/vi/vivify/package.nix
index 32e76c26cb4c..e466377401d0 100644
--- a/pkgs/by-name/vi/vivify/package.nix
+++ b/pkgs/by-name/vi/vivify/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vivify";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "jannis-baum";
     repo = "Vivify";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n2l0+CFQ7EXnTZXr+JO7NE1OVSzpphs6lUgHfjebX4M=";
+    hash = "sha256-LQX7HBTWDR43aMqJrogL9rDFL5qRF0Xzw/O35Uq7R3g=";
   };
 
   yarnOfflineCache = fetchYarnDeps {

From 426108bd43077e454c98db74d380f82ace47a8cc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 06:34:58 +0000
Subject: [PATCH 24/61] python3Packages.onedrive-personal-sdk: 0.0.14 -> 0.0.15

---
 .../python-modules/onedrive-personal-sdk/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/onedrive-personal-sdk/default.nix b/pkgs/development/python-modules/onedrive-personal-sdk/default.nix
index 73d47cff1c08..6fecc2fdcfba 100644
--- a/pkgs/development/python-modules/onedrive-personal-sdk/default.nix
+++ b/pkgs/development/python-modules/onedrive-personal-sdk/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "onedrive-personal-sdk";
-  version = "0.0.14";
+  version = "0.0.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zweckj";
     repo = "onedrive-personal-sdk";
     tag = "v${version}";
-    hash = "sha256-WdnkIMmTzvid2bl7n9NHMtF153O91hutMib8bs5BgIs=";
+    hash = "sha256-XKFTwaerAtN0GEZGpJ4Uq81cIrENEkNFhqqqM+eNVII=";
   };
 
   build-system = [ setuptools ];

From c1e46857ccd2080e4fe6d386d644aced5f865808 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 06:58:16 +0000
Subject: [PATCH 25/61] amp-cli: 0.0.1761583653-gd8c2df ->
 0.0.1762056193-g37ad2e

---
 pkgs/by-name/am/amp-cli/package-lock.json | 8 ++++----
 pkgs/by-name/am/amp-cli/package.nix       | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/am/amp-cli/package-lock.json b/pkgs/by-name/am/amp-cli/package-lock.json
index a177c3c17851..7a393abfde79 100644
--- a/pkgs/by-name/am/amp-cli/package-lock.json
+++ b/pkgs/by-name/am/amp-cli/package-lock.json
@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@sourcegraph/amp": "^0.0.1761583653-gd8c2df"
+        "@sourcegraph/amp": "^0.0.1762056193-g37ad2e"
       }
     },
     "node_modules/@napi-rs/keyring": {
@@ -228,9 +228,9 @@
       }
     },
     "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1761583653-gd8c2df",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1761583653-gd8c2df.tgz",
-      "integrity": "sha512-/sAPMVQkj3sLtuYfv4GAXRBfqrWPHcMXbeWXXqW0+i8GKMsrMIenawwkEzQdCoTH94eZYeS8JlBPde3YFsdDOA==",
+      "version": "0.0.1762056193-g37ad2e",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1762056193-g37ad2e.tgz",
+      "integrity": "sha512-dWhc7ajnw1QGCYwrOGwCbpyzedf5n2RoTCM97ibpzgpphDLCdyGTXh2XTC6mrxM2CNQLp5jJaWxvcDk9nM80Vg==",
       "dependencies": {
         "@napi-rs/keyring": "1.1.9"
       },
diff --git a/pkgs/by-name/am/amp-cli/package.nix b/pkgs/by-name/am/amp-cli/package.nix
index d981668628e3..0dfeb0d3eac1 100644
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@@ -9,11 +9,11 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1761583653-gd8c2df";
+  version = "0.0.1762056193-g37ad2e";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-Q6iBVtSIXoy6r+9/s3GefLq5c9SFRSQoBxUjBlg/wh8=";
+    hash = "sha256-so/nlX4N9qhNLsK0OllmpfiqzyEBtPrt7KD/MoAChGc=";
   };
 
   postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
     chmod +x bin/amp-wrapper.js
   '';
 
-  npmDepsHash = "sha256-n8dRIJPTFFhS3aQQKKRdqYcEeHxfpU9XGbeV+2XAVeY=";
+  npmDepsHash = "sha256-xhN5XJs8E7yCRQWRPlH9iZyh5FocUjFMto5QweaV8aI=";
 
   propagatedBuildInputs = [
     ripgrep

From e84aa97ae0140cd168e1f36c8d4b6ebf4cc2139f Mon Sep 17 00:00:00 2001
From: Jhony Angulo <leohjaf@gmail.com>
Date: Sun, 2 Nov 2025 01:53:37 -0500
Subject: [PATCH 26/61] docker-language-server: 0.16.0 -> 0.20.1

---
 pkgs/by-name/do/docker-language-server/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/do/docker-language-server/package.nix b/pkgs/by-name/do/docker-language-server/package.nix
index c08d016dfcc2..06d64fb121dd 100644
--- a/pkgs/by-name/do/docker-language-server/package.nix
+++ b/pkgs/by-name/do/docker-language-server/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "docker-language-server";
-  version = "0.16.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "docker-language-server";
     tag = "v${version}";
-    hash = "sha256-P3DwlCjQllFtf05ssXYNraQFGEEzChSE5eJvcODdF6Q=";
+    hash = "sha256-OSAySCTK2temrVxmkRnrl5YWVbmkp8DRlXFVxTzEW3Q=";
   };
 
-  vendorHash = "sha256-xvRHxi7aem88mrmdAmSyRNtBUSZD4rjUut2VjPeoejg=";
+  vendorHash = "sha256-ztA+/4l180UKTKrsqTyysDcD4oQSDgnBYUaiKDF6LvI=";
 
   nativeCheckInputs = [
     docker

From d826563a62fd86fe48fb92da0b5345999ef205ce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 07:44:43 +0000
Subject: [PATCH 27/61] jdt-language-server: 1.51.0 -> 1.52.0

---
 pkgs/by-name/jd/jdt-language-server/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/jd/jdt-language-server/package.nix b/pkgs/by-name/jd/jdt-language-server/package.nix
index c7987d0602b3..21a0d9d7f2da 100644
--- a/pkgs/by-name/jd/jdt-language-server/package.nix
+++ b/pkgs/by-name/jd/jdt-language-server/package.nix
@@ -7,15 +7,15 @@
 }:
 
 let
-  timestamp = "202510022025";
+  timestamp = "202510301627";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "jdt-language-server";
-  version = "1.51.0";
+  version = "1.52.0";
 
   src = fetchurl {
     url = "https://download.eclipse.org/jdtls/milestones/${finalAttrs.version}/jdt-language-server-${finalAttrs.version}-${timestamp}.tar.gz";
-    hash = "sha256-ilk3IReIG/W9wCIPIlRHKEa4gTfAWPNEsAp9QUJ3RaE=";
+    hash = "sha256-V+a0U2ZTVLQqiYgn0quTij7GtBwScsEJmDw7emDsR4U=";
   };
 
   sourceRoot = ".";

From 9182aaa0481b32fb19944d46ab61fe48d238a026 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 2 Nov 2025 12:11:33 +0800
Subject: [PATCH 28/61] nixosTests.xfce: Add tests for screensaver

Same as what is done in nixosTests.cinnamon.
---
 nixos/tests/xfce.nix | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/xfce.nix b/nixos/tests/xfce.nix
index cdd1f3ffc676..ae203c5ca26d 100644
--- a/nixos/tests/xfce.nix
+++ b/nixos/tests/xfce.nix
@@ -21,6 +21,7 @@
       environment.systemPackages = [ pkgs.xfce.xfce4-whiskermenu-plugin ];
 
       programs.thunar.plugins = [ pkgs.xfce.thunar-archive-plugin ];
+      programs.ydotool.enable = true;
     };
 
   enableOCR = true;
@@ -44,8 +45,9 @@
       with subtest("Check if Xfce components actually start"):
         machine.wait_for_window("xfce4-panel")
         machine.wait_for_window("Desktop")
-        for i in ["xfwm4", "xfsettingsd", "xfdesktop", "xfce4-screensaver", "xfce4-notifyd", "xfconfd"]:
-          machine.wait_until_succeeds(f"pgrep -f {i}")
+        for i in ["xfwm4", "xfsettingsd", "xfdesktop", "xfce4-notifyd", "xfconfd"]:
+          machine.wait_until_succeeds(f"pgrep {i}")
+        machine.wait_until_succeeds("pgrep -xf xfce4-screensaver")
 
       with subtest("Open whiskermenu"):
         machine.succeed("su - ${user.name} -c 'DISPLAY=:0 ${bus} xfconf-query -c xfce4-panel -p /plugins/plugin-1 -t string -s whiskermenu -n >&2 &'")
@@ -63,6 +65,17 @@
         machine.succeed("su - ${user.name} -c 'DISPLAY=:0 xfce4-terminal >&2 &'")
         machine.wait_for_window("Terminal")
 
+      with subtest("Lock the screen"):
+        machine.succeed("su - ${user.name} -c '${bus} xflock4 >&2 &'")
+        machine.wait_until_succeeds("su - ${user.name} -c '${bus} xfce4-screensaver-command -q' | grep 'The screensaver is active'")
+        machine.sleep(5)
+        machine.succeed("ydotool click 0xC0")
+        machine.wait_for_text("${user.description}|Unlock")
+        machine.screenshot("screensaver")
+        machine.send_chars("${user.password}\n", delay=0.2)
+        machine.wait_until_succeeds("su - ${user.name} -c '${bus} xfce4-screensaver-command -q' | grep 'The screensaver is inactive'")
+        machine.sleep(2)
+
       with subtest("Open Thunar"):
         machine.succeed("su - ${user.name} -c 'DISPLAY=:0 thunar >&2 &'")
         machine.wait_for_window("Thunar")

From 74bd4f8bf27d34dc89b7daec3f60b24d4206bf27 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 09:02:56 +0000
Subject: [PATCH 29/61] incus-ui-canonical: 0.18.2 -> 0.18.3

---
 pkgs/by-name/in/incus-ui-canonical/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/incus-ui-canonical/package.nix b/pkgs/by-name/in/incus-ui-canonical/package.nix
index 2a3af34055bc..3f172a72a8d8 100644
--- a/pkgs/by-name/in/incus-ui-canonical/package.nix
+++ b/pkgs/by-name/in/incus-ui-canonical/package.nix
@@ -20,14 +20,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "incus-ui-canonical";
-  version = "0.18.2";
+  version = "0.18.3";
 
   src = fetchFromGitHub {
     owner = "zabbly";
     repo = "incus-ui-canonical";
     # only use tags prefixed by incus- they are the tested fork versions
     tag = "incus-${version}";
-    hash = "sha256-MVhyKV3NGeChsLnoKw7mC9bAQRQ9Rpg8cIWkelNFXeg=";
+    hash = "sha256-0wKGPH+ffJ/S8FA46ve5SzyNZJ9C2fv8Psiqu8p6D0s=";
   };
 
   offlineCache = fetchYarnDeps {

From 26860103b3344dc3938e65b87afb58d62ca2fc7d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 09:08:17 +0000
Subject: [PATCH 30/61] gemini-cli: 0.10.0 -> 0.11.3

---
 pkgs/by-name/ge/gemini-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ge/gemini-cli/package.nix b/pkgs/by-name/ge/gemini-cli/package.nix
index 789b24efd95a..5f151e0010f9 100644
--- a/pkgs/by-name/ge/gemini-cli/package.nix
+++ b/pkgs/by-name/ge/gemini-cli/package.nix
@@ -13,16 +13,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "gemini-cli";
-  version = "0.10.0";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "google-gemini";
     repo = "gemini-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-h6JyiIh0+PI/5JHlztMKlXlK5XQC8x6V7Yq1VyboaXs=";
+    hash = "sha256-43ohCUqdM0quxwoN3s/3vOq4IRc+sck+BkAfqMEDq8g=";
   };
 
-  npmDepsHash = "sha256-4RsZAs9+Q7vnRiyA1OMXC185d9Y9k6mwG+QkOE+5Pas=";
+  npmDepsHash = "sha256-wqzsHBFXo5NhsFHOErxVVG9Y08daEQs6YdRZHFeOq98=";
 
   nativeBuildInputs = [
     jq

From 22cb2ce30608b358741a7c7bf3309033b1e2a3ad Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 09:17:17 +0000
Subject: [PATCH 31/61] foundry: 1.4.3 -> 1.4.4

---
 pkgs/by-name/fo/foundry/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/foundry/package.nix b/pkgs/by-name/fo/foundry/package.nix
index 63b91c4b32ca..8db1a61165df 100644
--- a/pkgs/by-name/fo/foundry/package.nix
+++ b/pkgs/by-name/fo/foundry/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "foundry";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "foundry-rs";
     repo = "foundry";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SrkFfc9+cb3nDqEOj3gRkQq9aKOSfk3s7a3EGka5ACw=";
+    hash = "sha256-u+JCurH1gx4onC5Poxxd9+gVrUyyebcd6xnXY4Le6Rs=";
   };
 
-  cargoHash = "sha256-PoPfuMNeK6ArZddBd0lsR2r8UrvRieqkxYZ8jCCxw5o=";
+  cargoHash = "sha256-JLuCZckiNv0t+kPuDk6TWmPIXKOvqf3HR/oFrQ5fKKQ=";
 
   nativeBuildInputs = [
     pkg-config

From e3bb18193415323b0d43c9be1b6673639a6ec646 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 09:53:43 +0000
Subject: [PATCH 32/61] terraform-providers.newrelic_newrelic: 3.73.0 -> 3.74.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 093947426af2..eb518b76241a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -949,13 +949,13 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-/vHE+Eys773WyYMDe7xG3p0pgKvRc9U73s4jSDijNxY=",
+    "hash": "sha256-1OpvSayWq194591u/z9oHz80ZmPA9fSZpKSBwDHL/tk=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.73.0",
+    "rev": "v3.74.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-45psSf69IetY0o8LjBDEv2GnOxaOzaQcPCnV2YHPXGs="
+    "vendorHash": "sha256-7zUUV3cqVesItNnE/EcO5/l+nafV04JdoNkmTxnulio="
   },
   "ns1-terraform_ns1": {
     "hash": "sha256-S0ji/gZsbMTgug7DwPODAcPx3IfRaw1JHYPJ6V+tqeM=",

From 325198bba9e47c9753e92339b2abeceec241b1aa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 10:12:00 +0000
Subject: [PATCH 33/61] postgresqlPackages.pg_repack: 1.5.2 -> 1.5.3

---
 pkgs/servers/sql/postgresql/ext/pg_repack.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/pg_repack.nix b/pkgs/servers/sql/postgresql/ext/pg_repack.nix
index 8131f5d49ed8..d56ef90deba4 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_repack.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_repack.nix
@@ -10,7 +10,7 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_repack";
-  version = "1.5.2";
+  version = "1.5.3";
 
   buildInputs = postgresql.buildInputs;
 
@@ -18,7 +18,7 @@ postgresqlBuildExtension (finalAttrs: {
     owner = "reorg";
     repo = "pg_repack";
     tag = "ver_${finalAttrs.version}";
-    hash = "sha256-wfjiLkx+S3zVrAynisX1GdazueVJ3EOwQEPcgUQt7eA=";
+    hash = "sha256-Ufh/dKrKumRKeQ/CpwvxbjAmgILAn04BduPZMRvS+nU=";
   };
 
   passthru.updateScript = gitUpdater {

From c8dc99fdc79dcbd7924884680e18efcf375f6fd6 Mon Sep 17 00:00:00 2001
From: Pavel Anpin <pavel@anpin.fyi>
Date: Sun, 2 Nov 2025 08:05:27 -0300
Subject: [PATCH 34/61] thinkfan: fix missing sleep bin in
 thinkfan-sleep.service

---
 pkgs/by-name/th/thinkfan/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/th/thinkfan/package.nix b/pkgs/by-name/th/thinkfan/package.nix
index 57347b91052d..17b964ee7286 100644
--- a/pkgs/by-name/th/thinkfan/package.nix
+++ b/pkgs/by-name/th/thinkfan/package.nix
@@ -7,6 +7,7 @@
   yaml-cpp,
   pkg-config,
   procps,
+  coreutils,
   smartSupport ? false,
   libatasmart,
 }:
@@ -31,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
   + ''
     substituteInPlace rcscripts/systemd/thinkfan-sleep.service \
       --replace-fail "/usr/bin/pkill" "${lib.getExe' procps "pkill"}"
+    substituteInPlace rcscripts/systemd/thinkfan-sleep.service \
+      --replace-fail "ExecStart=sleep " "ExecStart=${lib.getExe' coreutils "sleep"} "
     substituteInPlace rcscripts/systemd/thinkfan-wakeup.service \
       --replace-fail "/usr/bin/pkill" "${lib.getExe' procps "pkill"}"
     substituteInPlace rcscripts/systemd/thinkfan.service.cmake \

From 46a653ad1fdaa857b9328aecbfe87da2fb2cff8f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 11:10:05 +0000
Subject: [PATCH 35/61] windsurf: 1.12.25 -> 1.12.27

---
 pkgs/by-name/wi/windsurf/info.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
index 803b03a35fc6..c5b1d6180859 100644
--- a/pkgs/by-name/wi/windsurf/info.json
+++ b/pkgs/by-name/wi/windsurf/info.json
@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "1.12.25",
+    "version": "1.12.27",
     "vscodeVersion": "1.105.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/3dde4f1e45c3c089540abe588074eb5a4fe122c3/Windsurf-darwin-arm64-1.12.25.zip",
-    "sha256": "9fba99838189f4ad12ec35c0f0ee97e99652b43492fb19fe17908848a5f2b13c"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/94ec85969ebc38d14c35c87a0284fafd84bff116/Windsurf-darwin-arm64-1.12.27.zip",
+    "sha256": "294f3a3aab7665caf936ef43b384540695849928c956c28b4b783bb3b34913a2"
   },
   "x86_64-darwin": {
-    "version": "1.12.25",
+    "version": "1.12.27",
     "vscodeVersion": "1.105.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/3dde4f1e45c3c089540abe588074eb5a4fe122c3/Windsurf-darwin-x64-1.12.25.zip",
-    "sha256": "893b0cf579b4fa4354f5f014b9caf8f0e7ae9f98b9bb0d4b597e2322863eb278"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/94ec85969ebc38d14c35c87a0284fafd84bff116/Windsurf-darwin-x64-1.12.27.zip",
+    "sha256": "61e0dac30fa014f42f99138434f289504d4d2a79aaa9f4cc61c30c663c6ab979"
   },
   "x86_64-linux": {
-    "version": "1.12.25",
+    "version": "1.12.27",
     "vscodeVersion": "1.105.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/3dde4f1e45c3c089540abe588074eb5a4fe122c3/Windsurf-linux-x64-1.12.25.tar.gz",
-    "sha256": "c170f3249c95220b8e1b26feb4f2452d4a8be5dcbcfb2a1f1768fb0c0137101e"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/94ec85969ebc38d14c35c87a0284fafd84bff116/Windsurf-linux-x64-1.12.27.tar.gz",
+    "sha256": "8f380755df34a1b466c28448f22fc92d3cfb13da55e9d8f2c9db5a4db83f6cac"
   }
 }

From 38c5f68a0809cc2b67907d6bc591b402b98eb15d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 11:28:23 +0000
Subject: [PATCH 36/61] bitrise: 2.34.5 -> 2.34.6

---
 pkgs/by-name/bi/bitrise/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bi/bitrise/package.nix b/pkgs/by-name/bi/bitrise/package.nix
index 09139984a44e..0241eb4d667c 100644
--- a/pkgs/by-name/bi/bitrise/package.nix
+++ b/pkgs/by-name/bi/bitrise/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "bitrise";
-  version = "2.34.5";
+  version = "2.34.6";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${version}";
-    hash = "sha256-QsGF5lDnY55OGdFagGJfXcq9/2P6qzmoHx64ijOkRfo=";
+    hash = "sha256-wA+IknAOkVxTwBohw8D4suksENoWymqPJycbfx6cFYQ=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access

From 5444145fcee81ee239e34dcc874e54a958d13e97 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 2 Nov 2025 12:30:47 +0100
Subject: [PATCH 37/61] nextcloudPackages: update

Closes #457582
---
 pkgs/servers/nextcloud/packages/31.json | 42 +++++++++++-----------
 pkgs/servers/nextcloud/packages/32.json | 48 ++++++++++++-------------
 2 files changed, 45 insertions(+), 45 deletions(-)

diff --git a/pkgs/servers/nextcloud/packages/31.json b/pkgs/servers/nextcloud/packages/31.json
index 89d4f58322d4..0c4a2d4ba82d 100644
--- a/pkgs/servers/nextcloud/packages/31.json
+++ b/pkgs/servers/nextcloud/packages/31.json
@@ -30,9 +30,9 @@
     ]
   },
   "collectives": {
-    "hash": "sha256-vWPT3FBSZlgA1z1zH1o1Kpd9JOmt2Ykfh3JMtMLWTjI=",
-    "url": "https://github.com/nextcloud/collectives/releases/download/v3.2.1/collectives-3.2.1.tar.gz",
-    "version": "3.2.1",
+    "hash": "sha256-ezFo8Vv8qFNzW9ZevcOmZdKBtmpDY6SpRqX4R/2UT1E=",
+    "url": "https://github.com/nextcloud/collectives/releases/download/v3.2.4/collectives-3.2.4.tar.gz",
+    "version": "3.2.4",
     "description": "Collectives is a Nextcloud App for activist and community projects to organize together.\nCome and gather in collectives to build shared knowledge.\n\n* 👥 **Collective and non-hierarchical workflow by heart**: Collectives are\n  tied to a [Nextcloud Team](https://github.com/nextcloud/circles) and\n  owned by the collective.\n* 📝 **Collaborative page editing** like known from Etherpad thanks to the\n  [Text app](https://github.com/nextcloud/text).\n* 🔤 **Well-known [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax**\n  for page formatting.\n\n## Installation\n\nIn your Nextcloud instance, simply navigate to **»Apps«**, find the\n**»Teams«** and **»Collectives«** apps and enable them.",
     "homepage": "https://github.com/nextcloud/collectives",
     "licenses": [
@@ -40,9 +40,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-J5ce01iRxpx4g24W5NAt7PgNX2hDjmA9VUzQAkLUrFE=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.3.4/contacts-v7.3.4.tar.gz",
-    "version": "7.3.4",
+    "hash": "sha256-aViRCE48yy52yz7xSVlNKR6yFCVdu9hfjysL81QjazU=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.3.5/contacts-v7.3.5.tar.gz",
+    "version": "7.3.5",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -50,9 +50,9 @@
     ]
   },
   "cookbook": {
-    "hash": "sha256-pdmltxubvC2+h5U5edTB8X5M8WW+wBShIEpkbR0yaQ0=",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.4/cookbook-0.11.4.tar.gz",
-    "version": "0.11.4",
+    "hash": "sha256-Bw5Oga5zawiicIR9tOLSflK0258Uy7q/9zJsXS5Ggd4=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.5/cookbook-0.11.5.tar.gz",
+    "version": "0.11.5",
     "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
     "homepage": "https://github.com/nextcloud/cookbook/",
     "licenses": [
@@ -140,9 +140,9 @@
     ]
   },
   "gpoddersync": {
-    "hash": "sha256-xMSo5D3w/qIMxLclSTmBPVBHwNkyTbluqlXWtdbLUYk=",
-    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.13.2/gpoddersync.tar.gz",
-    "version": "3.13.1",
+    "hash": "sha256-EQVs1fe0ierjqFZ5+KVc1Yj67zrwjLBAzY5A+QsC7AU=",
+    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.13.2r/gpoddersync.tar.gz",
+    "version": "3.13.2",
     "description": "Expose GPodder API to sync podcast consumer apps like AntennaPod",
     "homepage": "https://github.com/thrillfall/nextcloud-gpodder",
     "licenses": [
@@ -230,9 +230,9 @@
     ]
   },
   "news": {
-    "hash": "sha256-K93swGriEwm1zBq9H7F4P2fHmTanYddFARfQp456bds=",
-    "url": "https://github.com/nextcloud/news/releases/download/27.0.1/news.tar.gz",
-    "version": "27.0.1",
+    "hash": "sha256-bKIEeRVmDoDjab8dusdG+q7Ms/gaOUFUyCH1C1pKJ04=",
+    "url": "https://github.com/nextcloud/news/releases/download/27.1.0/news.tar.gz",
+    "version": "27.1.0",
     "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
     "homepage": "https://github.com/nextcloud/news",
     "licenses": [
@@ -360,9 +360,9 @@
     ]
   },
   "sociallogin": {
-    "hash": "sha256-zuzQKtU+sEEYhBZ4UMfY1eMSsDfe7o/ymWYv2SJBiHw=",
-    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.2.2/release.tar.gz",
-    "version": "6.2.2",
+    "hash": "sha256-/vYEBgrlTImksgNfJafTvIiBxAZ8obwou8YjDM2P+aw=",
+    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.2.3/release.tar.gz",
+    "version": "6.2.3",
     "description": "# Social Login\n\nMake it possible to create users and log in via Telegram, OAuth, or OpenID.\n\nFor OAuth, you must create an app with certain providers. Login buttons will appear on the login page if an app ID is specified. Settings are located in the \"Social login\" section of the settings page.\n\n## Installation\n\nLog in to your Nextcloud installation as an administrator. Under \"Apps\", click \"Download and enable\" next to the \"Social Login\" app.\n\nSee below for setup and configuration instructions.\n\n## Custom OAuth2/OIDC Groups\n\nYou can use groups from your custom provider. For this, specify the \"Groups claim\" in the custom OAuth2/OIDC provider settings. This claim should be returned from the provider in the `id_token` or at the user info endpoint. The format should be an `array` or a comma-separated string. E.g., (with a claim named `roles`):\n\n```json\n{\"roles\": [\"admin\", \"user\"]}\n```\nor\n```json\n{\"roles\": \"admin,user\"}\n```\n\nNested claims are also supported. For example, `resource_access.client-id.roles` for:\n\n```json\n\"resource_access\": {\n   \"client-id\": {\n     \"roles\": [\n       \"client-role-1\",\n       \"client-role-2\"\n     ]\n   }\n}\n```\n\n**DisplayName** support is also available:\n```json\n{\"roles\": [{\"gid\": 1, \"displayName\": \"admin\"}, {\"gid\": 2, \"displayName\": \"user\"}]}\n```\n\nYou can use provider groups in two ways:\n\n1. Map provider groups to existing Nextcloud groups.\n2. Create provider groups in Nextcloud and associate them with users (if the appropriate option is enabled).\n\nTo sync groups on every login, ensure the \"Update user profile every login\" setting is checked.\n\n## Examples for Groups\n\n* Configure WSO2IS to return a roles claim with OIDC [here](https://medium.com/@dewni.matheesha/claim-mapping-and-retrieving-end-user-information-in-wso2is-cffd5f3937ff).\n* [GitLab OIDC configuration to allow specific GitLab groups](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md).\n\n## Built-in OAuth Providers\n\nCopy the link from a specific login button to get the correct \"redirect URL\" for OAuth app settings.\n\n* [Amazon](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html)\n* [Apple](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/apple.md)\n* [Codeberg](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/codeberg.md)\n* [Discord](#configure-discord)\n* [Facebook](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/facebook.md)\n* [GitHub](https://github.com/settings/developers)\n* [GitLab](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md)\n* [Google](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/google.md)\n* [Keycloak](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/keycloak.md)\n* [Mail.ru](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/mailru.md)\n* **PlexTv**: Use any title as the app ID.\n* [Telegram](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/telegram.md)\n* [Twitter](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/twitter.md)\n\nFor details about Google's \"Allow login only from specified domain\" setting, see [#44](https://github.com/zorn-v/nextcloud-social-login/issues/44). Use a comma-separated list for multiple domains.\n\n## Configuration\n\nAdd `'social_login_auto_redirect' => true` to `config.php` to automatically redirect unauthorized users to social login if only one provider is configured. To temporarily disable this (e.g., for local admin login), add `noredir=1` to the login URL: `https://cloud.domain.com/login?noredir=1`.\n\nConfigure HTTP client options using:\n```php\n  'social_login_http_client' => [\n    'timeout' => 45,\n    'proxy' => 'socks4://127.0.0.1:9050', // See <https://curl.se/libcurl/c/CURLOPT_PROXY.html> for allowed formats\n  ],\n```\nin `config.php`.\n\n### Configure a Provider via CLI\n\nUse the `occ` utility to configure providers via the command line. Replace variables and URLs with your deployment values:\n```bash\nphp occ config:app:set sociallogin custom_providers --value='{\"custom_oidc\": [{\"name\": \"gitlab_oidc\", \"title\": \"Gitlab\", \"authorizeUrl\": \"https://gitlab.my-domain.org/oauth/authorize\", \"tokenUrl\": \"https://gitlab.my-domain.org/oauth/token\", \"userInfoUrl\": \"https://gitlab.my-domain.org/oauth/userinfo\", \"logoutUrl\": \"\", \"clientId\": \"$my_application_id\", \"clientSecret\": \"$my_super_secret_secret\", \"scope\": \"openid\", \"groupsClaim\": \"groups\", \"style\": \"gitlab\", \"defaultGroup\": \"\"}]}'\n```\nFor Docker, prepend `docker exec -t -uwww-data CONTAINER_NAME` to the command or run interactively via `docker exec -it -uwww-data CONTAINER_NAME sh`.\n\nTo inspect configurations:\n```sql\nmysql -u nextcloud -p nextcloud\nPassword: <yourpassword>\n\n> SELECT * FROM oc_appconfig WHERE appid='sociallogin';\n```\nOr run:\n```bash\ndocker exec -t -uwww-data CONTAINER_NAME php occ config:app:get sociallogin custom_providers\n```\n\n### Configure Discord\n\n1. Create a Discord application at [Discord Developer Portal](https://discord.com/developers/applications).\n2. Navigate to `Settings > OAuth2 > General`. Add a redirect URL: `https://nextcloud.mydomain.com/apps/sociallogin/oauth/discord`.\n3. Copy the `CLIENT ID` and generate a `CLIENT SECRET`.\n4. In Nextcloud, go to `Settings > Social Login`. Paste the `CLIENT ID` into \"App id\" and `CLIENT SECRET` into \"Secret\".\n5. Select a default group for new users.\n6. For group mapping, see [#395](https://github.com/zorn-v/nextcloud-social-login/pull/395).\n\n## Hint\n\n### Callback (Reply) URL\nCopy the link from a login button on the Nextcloud login page and use it as the callback URL on your provider's site. To make the button visible temporarily, fill provider settings with placeholder data and update later.\n\nIf you encounter callback URL errors despite correct settings, ensure your Nextcloud server generates HTTPS URLs by adding `'overwriteprotocol' => 'https'` to `config.php`.",
     "homepage": "https://github.com/zorn-v/nextcloud-social-login",
     "licenses": [
@@ -480,9 +480,9 @@
     ]
   },
   "whiteboard": {
-    "hash": "sha256-2CSc9gRXAHaKiq4KfVl+44eWhtBFgjHYbMeTwE18xuA=",
-    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.3.0/whiteboard-v1.3.0.tar.gz",
-    "version": "1.3.0",
+    "hash": "sha256-i8qk1RZrLbF0Mex4lgVZp092ZrsUvosYeiLcJ4WMosQ=",
+    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.4.0/whiteboard-v1.4.0.tar.gz",
+    "version": "1.4.0",
     "description": "The official whiteboard app for Nextcloud. It allows users to create and share whiteboards with other users and collaborate in real-time.\n\n**Whiteboard requires a separate collaboration server to work.** Please see the [documentation](https://github.com/nextcloud/whiteboard?tab=readme-ov-file#backend) on how to install it.\n\n- 🎨 Drawing shapes, writing text, connecting elements\n- 📝 Real-time collaboration\n- 🖼️ Add images with drag and drop\n- 📊 Easily add mermaid diagrams\n- ✨ Use the Smart Picker to embed other elements from Nextcloud\n- 📦 Image export\n- 💪 Strong foundation: We use Excalidraw as our base library",
     "homepage": "https://github.com/nextcloud/whiteboard",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/32.json b/pkgs/servers/nextcloud/packages/32.json
index 4efd07211f29..f0eaf8531e14 100644
--- a/pkgs/servers/nextcloud/packages/32.json
+++ b/pkgs/servers/nextcloud/packages/32.json
@@ -20,9 +20,9 @@
     ]
   },
   "collectives": {
-    "hash": "sha256-vWPT3FBSZlgA1z1zH1o1Kpd9JOmt2Ykfh3JMtMLWTjI=",
-    "url": "https://github.com/nextcloud/collectives/releases/download/v3.2.1/collectives-3.2.1.tar.gz",
-    "version": "3.2.1",
+    "hash": "sha256-ezFo8Vv8qFNzW9ZevcOmZdKBtmpDY6SpRqX4R/2UT1E=",
+    "url": "https://github.com/nextcloud/collectives/releases/download/v3.2.4/collectives-3.2.4.tar.gz",
+    "version": "3.2.4",
     "description": "Collectives is a Nextcloud App for activist and community projects to organize together.\nCome and gather in collectives to build shared knowledge.\n\n* 👥 **Collective and non-hierarchical workflow by heart**: Collectives are\n  tied to a [Nextcloud Team](https://github.com/nextcloud/circles) and\n  owned by the collective.\n* 📝 **Collaborative page editing** like known from Etherpad thanks to the\n  [Text app](https://github.com/nextcloud/text).\n* 🔤 **Well-known [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax**\n  for page formatting.\n\n## Installation\n\nIn your Nextcloud instance, simply navigate to **»Apps«**, find the\n**»Teams«** and **»Collectives«** apps and enable them.",
     "homepage": "https://github.com/nextcloud/collectives",
     "licenses": [
@@ -30,9 +30,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-GTIsL5oY6Kb8Ga79VL7WGD51lmxUvE2cHN38anvyf6w=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.0.4/contacts-v8.0.4.tar.gz",
-    "version": "8.0.4",
+    "hash": "sha256-DKCZD5wMZu2yWy6Wjv2/L8ZQG1nBgtXJmUEsAVICFjo=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.0.5/contacts-v8.0.5.tar.gz",
+    "version": "8.0.5",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -40,9 +40,9 @@
     ]
   },
   "cookbook": {
-    "hash": "sha256-pdmltxubvC2+h5U5edTB8X5M8WW+wBShIEpkbR0yaQ0=",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.4/cookbook-0.11.4.tar.gz",
-    "version": "0.11.4",
+    "hash": "sha256-Bw5Oga5zawiicIR9tOLSflK0258Uy7q/9zJsXS5Ggd4=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.5/cookbook-0.11.5.tar.gz",
+    "version": "0.11.5",
     "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
     "homepage": "https://github.com/nextcloud/cookbook/",
     "licenses": [
@@ -120,9 +120,9 @@
     ]
   },
   "gpoddersync": {
-    "hash": "sha256-xMSo5D3w/qIMxLclSTmBPVBHwNkyTbluqlXWtdbLUYk=",
-    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.13.2/gpoddersync.tar.gz",
-    "version": "3.13.1",
+    "hash": "sha256-EQVs1fe0ierjqFZ5+KVc1Yj67zrwjLBAzY5A+QsC7AU=",
+    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.13.2r/gpoddersync.tar.gz",
+    "version": "3.13.2",
     "description": "Expose GPodder API to sync podcast consumer apps like AntennaPod",
     "homepage": "https://github.com/thrillfall/nextcloud-gpodder",
     "licenses": [
@@ -200,9 +200,9 @@
     ]
   },
   "news": {
-    "hash": "sha256-K93swGriEwm1zBq9H7F4P2fHmTanYddFARfQp456bds=",
-    "url": "https://github.com/nextcloud/news/releases/download/27.0.1/news.tar.gz",
-    "version": "27.0.1",
+    "hash": "sha256-bKIEeRVmDoDjab8dusdG+q7Ms/gaOUFUyCH1C1pKJ04=",
+    "url": "https://github.com/nextcloud/news/releases/download/27.1.0/news.tar.gz",
+    "version": "27.1.0",
     "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
     "homepage": "https://github.com/nextcloud/news",
     "licenses": [
@@ -320,9 +320,9 @@
     ]
   },
   "sociallogin": {
-    "hash": "sha256-zuzQKtU+sEEYhBZ4UMfY1eMSsDfe7o/ymWYv2SJBiHw=",
-    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.2.2/release.tar.gz",
-    "version": "6.2.2",
+    "hash": "sha256-/vYEBgrlTImksgNfJafTvIiBxAZ8obwou8YjDM2P+aw=",
+    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.2.3/release.tar.gz",
+    "version": "6.2.3",
     "description": "# Social Login\n\nMake it possible to create users and log in via Telegram, OAuth, or OpenID.\n\nFor OAuth, you must create an app with certain providers. Login buttons will appear on the login page if an app ID is specified. Settings are located in the \"Social login\" section of the settings page.\n\n## Installation\n\nLog in to your Nextcloud installation as an administrator. Under \"Apps\", click \"Download and enable\" next to the \"Social Login\" app.\n\nSee below for setup and configuration instructions.\n\n## Custom OAuth2/OIDC Groups\n\nYou can use groups from your custom provider. For this, specify the \"Groups claim\" in the custom OAuth2/OIDC provider settings. This claim should be returned from the provider in the `id_token` or at the user info endpoint. The format should be an `array` or a comma-separated string. E.g., (with a claim named `roles`):\n\n```json\n{\"roles\": [\"admin\", \"user\"]}\n```\nor\n```json\n{\"roles\": \"admin,user\"}\n```\n\nNested claims are also supported. For example, `resource_access.client-id.roles` for:\n\n```json\n\"resource_access\": {\n   \"client-id\": {\n     \"roles\": [\n       \"client-role-1\",\n       \"client-role-2\"\n     ]\n   }\n}\n```\n\n**DisplayName** support is also available:\n```json\n{\"roles\": [{\"gid\": 1, \"displayName\": \"admin\"}, {\"gid\": 2, \"displayName\": \"user\"}]}\n```\n\nYou can use provider groups in two ways:\n\n1. Map provider groups to existing Nextcloud groups.\n2. Create provider groups in Nextcloud and associate them with users (if the appropriate option is enabled).\n\nTo sync groups on every login, ensure the \"Update user profile every login\" setting is checked.\n\n## Examples for Groups\n\n* Configure WSO2IS to return a roles claim with OIDC [here](https://medium.com/@dewni.matheesha/claim-mapping-and-retrieving-end-user-information-in-wso2is-cffd5f3937ff).\n* [GitLab OIDC configuration to allow specific GitLab groups](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md).\n\n## Built-in OAuth Providers\n\nCopy the link from a specific login button to get the correct \"redirect URL\" for OAuth app settings.\n\n* [Amazon](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html)\n* [Apple](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/apple.md)\n* [Codeberg](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/codeberg.md)\n* [Discord](#configure-discord)\n* [Facebook](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/facebook.md)\n* [GitHub](https://github.com/settings/developers)\n* [GitLab](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md)\n* [Google](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/google.md)\n* [Keycloak](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/keycloak.md)\n* [Mail.ru](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/mailru.md)\n* **PlexTv**: Use any title as the app ID.\n* [Telegram](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/telegram.md)\n* [Twitter](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/twitter.md)\n\nFor details about Google's \"Allow login only from specified domain\" setting, see [#44](https://github.com/zorn-v/nextcloud-social-login/issues/44). Use a comma-separated list for multiple domains.\n\n## Configuration\n\nAdd `'social_login_auto_redirect' => true` to `config.php` to automatically redirect unauthorized users to social login if only one provider is configured. To temporarily disable this (e.g., for local admin login), add `noredir=1` to the login URL: `https://cloud.domain.com/login?noredir=1`.\n\nConfigure HTTP client options using:\n```php\n  'social_login_http_client' => [\n    'timeout' => 45,\n    'proxy' => 'socks4://127.0.0.1:9050', // See <https://curl.se/libcurl/c/CURLOPT_PROXY.html> for allowed formats\n  ],\n```\nin `config.php`.\n\n### Configure a Provider via CLI\n\nUse the `occ` utility to configure providers via the command line. Replace variables and URLs with your deployment values:\n```bash\nphp occ config:app:set sociallogin custom_providers --value='{\"custom_oidc\": [{\"name\": \"gitlab_oidc\", \"title\": \"Gitlab\", \"authorizeUrl\": \"https://gitlab.my-domain.org/oauth/authorize\", \"tokenUrl\": \"https://gitlab.my-domain.org/oauth/token\", \"userInfoUrl\": \"https://gitlab.my-domain.org/oauth/userinfo\", \"logoutUrl\": \"\", \"clientId\": \"$my_application_id\", \"clientSecret\": \"$my_super_secret_secret\", \"scope\": \"openid\", \"groupsClaim\": \"groups\", \"style\": \"gitlab\", \"defaultGroup\": \"\"}]}'\n```\nFor Docker, prepend `docker exec -t -uwww-data CONTAINER_NAME` to the command or run interactively via `docker exec -it -uwww-data CONTAINER_NAME sh`.\n\nTo inspect configurations:\n```sql\nmysql -u nextcloud -p nextcloud\nPassword: <yourpassword>\n\n> SELECT * FROM oc_appconfig WHERE appid='sociallogin';\n```\nOr run:\n```bash\ndocker exec -t -uwww-data CONTAINER_NAME php occ config:app:get sociallogin custom_providers\n```\n\n### Configure Discord\n\n1. Create a Discord application at [Discord Developer Portal](https://discord.com/developers/applications).\n2. Navigate to `Settings > OAuth2 > General`. Add a redirect URL: `https://nextcloud.mydomain.com/apps/sociallogin/oauth/discord`.\n3. Copy the `CLIENT ID` and generate a `CLIENT SECRET`.\n4. In Nextcloud, go to `Settings > Social Login`. Paste the `CLIENT ID` into \"App id\" and `CLIENT SECRET` into \"Secret\".\n5. Select a default group for new users.\n6. For group mapping, see [#395](https://github.com/zorn-v/nextcloud-social-login/pull/395).\n\n## Hint\n\n### Callback (Reply) URL\nCopy the link from a login button on the Nextcloud login page and use it as the callback URL on your provider's site. To make the button visible temporarily, fill provider settings with placeholder data and update later.\n\nIf you encounter callback URL errors despite correct settings, ensure your Nextcloud server generates HTTPS URLs by adding `'overwriteprotocol' => 'https'` to `config.php`.",
     "homepage": "https://github.com/zorn-v/nextcloud-social-login",
     "licenses": [
@@ -330,9 +330,9 @@
     ]
   },
   "spreed": {
-    "hash": "sha256-tWWFUrJ5XQdXYb8BfoxHCFrMCKj+cwLit1zkoJtWfwk=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.0/spreed-v22.0.0.tar.gz",
-    "version": "22.0.0",
+    "hash": "sha256-w1rNmKWWhPbwhcc6F8WX5ouW8zsrl6vqpHQZGlHdSJM=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.2/spreed-v22.0.2.tar.gz",
+    "version": "22.0.2",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
@@ -430,9 +430,9 @@
     ]
   },
   "whiteboard": {
-    "hash": "sha256-2CSc9gRXAHaKiq4KfVl+44eWhtBFgjHYbMeTwE18xuA=",
-    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.3.0/whiteboard-v1.3.0.tar.gz",
-    "version": "1.3.0",
+    "hash": "sha256-i8qk1RZrLbF0Mex4lgVZp092ZrsUvosYeiLcJ4WMosQ=",
+    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.4.0/whiteboard-v1.4.0.tar.gz",
+    "version": "1.4.0",
     "description": "The official whiteboard app for Nextcloud. It allows users to create and share whiteboards with other users and collaborate in real-time.\n\n**Whiteboard requires a separate collaboration server to work.** Please see the [documentation](https://github.com/nextcloud/whiteboard?tab=readme-ov-file#backend) on how to install it.\n\n- 🎨 Drawing shapes, writing text, connecting elements\n- 📝 Real-time collaboration\n- 🖼️ Add images with drag and drop\n- 📊 Easily add mermaid diagrams\n- ✨ Use the Smart Picker to embed other elements from Nextcloud\n- 📦 Image export\n- 💪 Strong foundation: We use Excalidraw as our base library",
     "homepage": "https://github.com/nextcloud/whiteboard",
     "licenses": [

From 9214a1d2c5f522caa002117a01bd8770c27d39dc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 11:34:40 +0000
Subject: [PATCH 38/61] beam26Packages.elixir_1_19: 1.19.1 -> 1.19.2

---
 pkgs/development/interpreters/elixir/1.19.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/elixir/1.19.nix b/pkgs/development/interpreters/elixir/1.19.nix
index 125028eef3a4..e864b3111c78 100644
--- a/pkgs/development/interpreters/elixir/1.19.nix
+++ b/pkgs/development/interpreters/elixir/1.19.nix
@@ -1,6 +1,6 @@
 import ./generic-builder.nix {
-  version = "1.19.1";
-  hash = "sha256-0rJx1BoJGDS0FsXyngBfQL3LhhNZvwh+TLQZjqOPFQw=";
+  version = "1.19.2";
+  hash = "sha256-sJNwWl6iCWzf8iDVG90DUxU8H3piKyGoU0mIAqfsphQ=";
   # https://hexdocs.pm/elixir/1.19.0-rc.1/compatibility-and-deprecations.html#between-elixir-and-erlang-otp
   minimumOTPVersion = "26";
   maximumOTPVersion = "28";

From 5f36f3ef6b530d6b5581623fce67b4342882a142 Mon Sep 17 00:00:00 2001
From: oddlama <oddlama@oddlama.org>
Date: Sun, 2 Nov 2025 13:03:47 +0100
Subject: [PATCH 39/61] nixos/actual: revert 452544: add environmentFile option

This reverts commit c13f744cdf287c4c2d85422668be22d0e266436d.
---
 nixos/modules/services/web-apps/actual.nix | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/nixos/modules/services/web-apps/actual.nix b/nixos/modules/services/web-apps/actual.nix
index 1ece9f7f04f1..af15471521f1 100644
--- a/nixos/modules/services/web-apps/actual.nix
+++ b/nixos/modules/services/web-apps/actual.nix
@@ -32,16 +32,6 @@ in
       description = "Whether to open the firewall for the specified port.";
     };
 
-    environmentFile = mkOption {
-      type = types.nullOr types.path;
-      default = null;
-      description = ''
-        Environment file for specifying additional settings such as secrets.
-
-        See <https://actualbudget.org/docs/config/oauth-auth#environment-variables>.
-      '';
-    };
-
     settings = mkOption {
       default = { };
       description = "Server settings, refer to [the documentation](https://actualbudget.org/docs/config/) for available options.";
@@ -86,7 +76,6 @@ in
         Group = "actual";
         StateDirectory = "actual";
         WorkingDirectory = dataDir;
-        EnvironmentFile = cfg.environmentFile;
         LimitNOFILE = "1048576";
         PrivateTmp = true;
         PrivateDevices = true;

From 40171764ab012446c7e20611e4e5445a1c22cc63 Mon Sep 17 00:00:00 2001
From: oddlama <oddlama@oddlama.org>
Date: Sun, 2 Nov 2025 13:12:08 +0100
Subject: [PATCH 40/61] nixos/actual: allow specifying secretus using
 genJqSecretsReplacementSnippet

---
 nixos/modules/services/web-apps/actual.nix | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/web-apps/actual.nix b/nixos/modules/services/web-apps/actual.nix
index af15471521f1..0e0bd29c4236 100644
--- a/nixos/modules/services/web-apps/actual.nix
+++ b/nixos/modules/services/web-apps/actual.nix
@@ -2,6 +2,7 @@
   lib,
   pkgs,
   config,
+  utils,
   ...
 }:
 let
@@ -16,7 +17,6 @@ let
     ;
 
   cfg = config.services.actual;
-  configFile = formatType.generate "config.json" cfg.settings;
   dataDir = "/var/lib/actual";
 
   formatType = pkgs.formats.json { };
@@ -34,7 +34,10 @@ in
 
     settings = mkOption {
       default = { };
-      description = "Server settings, refer to [the documentation](https://actualbudget.org/docs/config/) for available options.";
+      description = ''
+        Server settings, refer to [the documentation](https://actualbudget.org/docs/config/) for available options.
+        You can specify secret values in this configuration by setting `somevalue._secret = "/path/to/file"` instead of setting `somevalue` directly.
+      '';
       type = types.submodule {
         freeformType = formatType.type;
 
@@ -68,13 +71,20 @@ in
       description = "Actual server, a local-first personal finance app";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      environment.ACTUAL_CONFIG_PATH = configFile;
+      environment.ACTUAL_CONFIG_PATH = "/run/actual/config.json";
+
+      preStart = ''
+        # Generate config including secret values.
+        ${utils.genJqSecretsReplacementSnippet cfg.settings "/run/actual/config.json"}
+      '';
+
       serviceConfig = {
         ExecStart = getExe cfg.package;
         DynamicUser = true;
         User = "actual";
         Group = "actual";
         StateDirectory = "actual";
+        RuntimeDirectory = "actual";
         WorkingDirectory = dataDir;
         LimitNOFILE = "1048576";
         PrivateTmp = true;

From 816f60e96388d5f2d030f30d930143581c56cb18 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 12:50:43 +0000
Subject: [PATCH 41/61] beam26Packages.ex_doc: 0.39.0 -> 0.39.1

---
 pkgs/development/beam-modules/ex_doc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/beam-modules/ex_doc/default.nix b/pkgs/development/beam-modules/ex_doc/default.nix
index d0f121b41aa1..3d1f5a0e6320 100644
--- a/pkgs/development/beam-modules/ex_doc/default.nix
+++ b/pkgs/development/beam-modules/ex_doc/default.nix
@@ -14,12 +14,12 @@
 
 let
   pname = "ex_doc";
-  version = "0.39.0";
+  version = "0.39.1";
   src = fetchFromGitHub {
     owner = "elixir-lang";
     repo = "${pname}";
     rev = "v${version}";
-    hash = "sha256-7f4TQgQIeWb+SRMYLsqnOWnPHY7Pqi8qtruVe8OaZRY=";
+    hash = "sha256-edK484d5Fn5Kb/UEV1g3XinFF1rQJ1DypLEueET//Bg=";
   };
 in
 mixRelease {

From 270d00096d68f56427e3a23084a0b1194bd0d881 Mon Sep 17 00:00:00 2001
From: Pavol Rusnak <pavol@rusnak.io>
Date: Sun, 2 Nov 2025 15:05:17 +0100
Subject: [PATCH 42/61] bitcoin-knots: add libsodium

---
 pkgs/applications/blockchains/bitcoin-knots/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix
index 6d934130acd1..f4c67304d565 100644
--- a/pkgs/applications/blockchains/bitcoin-knots/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@@ -10,6 +10,7 @@
   wrapQtAppsHook ? null,
   boost,
   libevent,
+  libsodium,
   zeromq,
   zlib,
   db48,
@@ -67,6 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     boost
     libevent
+    libsodium
     zeromq
     zlib
   ]

From fe055834a87bb0c31edc9c0c9d5fcdb210b372fd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 14:09:13 +0000
Subject: [PATCH 43/61] ghostfolio: 2.211.0 -> 2.214.0

---
 pkgs/by-name/gh/ghostfolio/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix
index 5e3d2437af2f..29918109ef51 100644
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@@ -11,13 +11,13 @@
 
 buildNpmPackage rec {
   pname = "ghostfolio";
-  version = "2.211.0";
+  version = "2.214.0";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = version;
-    hash = "sha256-RoIOk0MIf1IAQLPO4MwemkXqQfJuDZtYYqn+OS6IUb0=";
+    hash = "sha256-x8GUlC1/TxA40rDQu3Ae2P5v5LFtberOQWtx5GJ7rMw=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +27,7 @@ buildNpmPackage rec {
     '';
   };
 
-  npmDepsHash = "sha256-Isy32xdxWlsGflqtcDJ6/lNaCA+IRbEOP8Z/BI0uV0s=";
+  npmDepsHash = "sha256-hHfT4gsf0D5XPY4RuQCKWNWp+iav9B75YMs70xayqtc=";
 
   nativeBuildInputs = [
     prisma

From d5ad86fed690a6baeea7eb91dc5418052e06b967 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Sun, 2 Nov 2025 15:08:43 +0100
Subject: [PATCH 44/61] fastd-exporter: Use `hash` attribute in
 `fetchFromGitHub`

`sha256` shouldn't be used anymore. Use the `hash` attribute.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 pkgs/by-name/fa/fastd-exporter/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/fa/fastd-exporter/package.nix b/pkgs/by-name/fa/fastd-exporter/package.nix
index 229bb7ee2caf..df9a6ccfb567 100644
--- a/pkgs/by-name/fa/fastd-exporter/package.nix
+++ b/pkgs/by-name/fa/fastd-exporter/package.nix
@@ -12,7 +12,7 @@ buildGoModule {
     owner = "freifunk-darmstadt";
     repo = "fastd-exporter";
     rev = "374e4334af6661f4c91a3e83bf7ce071a2a72eca";
-    sha256 = "sha256-0oU4+9G19XP5qtGdcfMz08T04hjcoXX/O+FkaUPxzXE=";
+    hash = "sha256-0oU4+9G19XP5qtGdcfMz08T04hjcoXX/O+FkaUPxzXE=";
   };
 
   vendorHash = "sha256-r0W64dct6XWa9sIrzy0UdyoMw+kAq73Qc/QchmsYZkY=";

From 40fc08ff7dd0fe9d0ca42ab3804866b944f3a63a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 14:20:17 +0000
Subject: [PATCH 45/61] grafana-alloy: 1.11.2 -> 1.11.3

---
 pkgs/by-name/gr/grafana-alloy/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/grafana-alloy/package.nix b/pkgs/by-name/gr/grafana-alloy/package.nix
index c39c9f33df0d..86423689c708 100644
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "grafana-alloy";
-  version = "1.11.2";
+  version = "1.11.3";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "alloy";
     tag = "v${version}";
-    hash = "sha256-HWnldpmt5M2+2zuEcA4doySgRyCBl4OnCCuXqtcYGkA=";
+    hash = "sha256-yO1r7GLXlD7f5Fpooit7SwkB7EB1hDO42o3BLvWY8Qo=";
   };
 
   proxyVendor = true;

From 94c64967fb3caa7f3f775070e2cf6bc6d81be220 Mon Sep 17 00:00:00 2001
From: myypo <nikirsmcgl@gmail.com>
Date: Sun, 2 Nov 2025 17:20:40 +0200
Subject: [PATCH 46/61] postgres-language-server: 0.16.1 -> 0.17.2

---
 pkgs/by-name/po/postgres-language-server/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/po/postgres-language-server/package.nix b/pkgs/by-name/po/postgres-language-server/package.nix
index 290bc26f02f7..52668006deaf 100644
--- a/pkgs/by-name/po/postgres-language-server/package.nix
+++ b/pkgs/by-name/po/postgres-language-server/package.nix
@@ -8,22 +8,22 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "postgres-language-server";
-  version = "0.16.1";
+  version = "0.17.2";
 
   src = fetchgit {
     url = "https://github.com/supabase-community/postgres-language-server";
     tag = finalAttrs.version;
-    hash = "sha256-zdFgfZ9GtZObn839kkAIT71bBt7YHs28qkAWlp3k7kw=";
+    hash = "sha256-gUE6OlDFlqS+Y+gX1qYs2E8sJfNUSmS/ypMsh/q7VtE=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-psgo5/tDHaQd0dkiD/3uhrKuxlOBLi/xG4x3gVPLZbw=";
+  cargoHash = "sha256-QP63SmAxjMdoz3yHLkvgM8xRleHXQmSRwTkyghbvJ+c=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
 
     # Required to build the custom tree-sitter grammar
-    # https://github.com/supabase-community/postgres-language-server/blob/main/crates/pgt_treesitter_grammar/grammar.js
+    # https://github.com/supabase-community/postgres-language-server/blob/main/crates/pgls_treesitter_grammar/grammar.js
     tree-sitter
     nodejs
   ];
@@ -37,10 +37,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
     # As specified in the upstream: https://github.com/supabase-community/postgres-language-server/blob/main/.github/workflows/release.yml
     RUSTFLAGS = "-C strip=symbols -C codegen-units=1";
-    PGT_VERSION = finalAttrs.version;
+    PGLS_VERSION = finalAttrs.version;
   };
 
-  cargoBuildFlags = [ "-p=pgt_cli" ];
+  cargoBuildFlags = [ "-p=pgls_cli" ];
   cargoTestFlags = finalAttrs.cargoBuildFlags;
   checkFlags = [
     # Tries to write to the file system relatively to the current path

From c7766c637f4fe5a59761c293c78e7bc7375c6882 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 2 Nov 2025 10:11:42 +0100
Subject: [PATCH 47/61] ci/github-script/merge: improve caching of team members

This removes the need to `await` committers further down in the function
and allows re-using the cache for other teams later.
---
 ci/github-script/merge.js | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 10e957db0362..1877a296f7e9 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -1,27 +1,32 @@
-// Caching the list of committers saves API requests when running the bot on the schedule and
+// Caching the list of team members saves API requests when running the bot on the schedule and
 // processing many PRs at once.
-let committers
+const members = {}
 
 async function runChecklist({ github, context, pull_request, maintainers }) {
   const pull_number = pull_request.number
 
-  if (!committers) {
+  function getTeamMembers(team_slug) {
     if (context.eventName === 'pull_request') {
       // We have no chance of getting a token in the pull_request context with the right
       // permissions to access the members endpoint below. Thus, we're pretending to have
-      // no committers. This is OK; because this is only for the Test workflow, not for
+      // no members. This is OK; because this is only for the Test workflow, not for
       // real use.
-      committers = new Set()
-    } else {
-      committers = github
+      return new Set()
+    }
+
+    if (!members[team_slug]) {
+      members[team_slug] = github
         .paginate(github.rest.teams.listMembersInOrg, {
           org: context.repo.owner,
-          team_slug: 'nixpkgs-committers',
+          team_slug,
           per_page: 100,
         })
         .then((members) => new Set(members.map(({ id }) => id)))
     }
+
+    return members[team_slug]
   }
+  committers = await getTeamMembers('nixpkgs-committers')
 
   const files = await github.paginate(github.rest.pulls.listFiles, {
     ...context.repo,
@@ -50,7 +55,7 @@ async function runChecklist({ github, context, pull_request, maintainers }) {
     ),
     'PR authored by r-ryantm or committer.':
       pull_request.user.login === 'r-ryantm' ||
-      (await committers).has(pull_request.user.id),
+      committers.has(pull_request.user.id),
     'PR has maintainers eligible for merge.': eligible.size > 0,
   }
 

From 7ea127c83a3e898fd5d4d75a80a8c824af1eb89c Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 2 Nov 2025 10:16:42 +0100
Subject: [PATCH 48/61] ci/github-script/merge: move API requests out of
 runChecklist

This makes runChecklist mostly a pure function (except for logging) to
allow calling it repeatedly later.
---
 ci/github-script/merge.js | 88 ++++++++++++++++++++-------------------
 1 file changed, 45 insertions(+), 43 deletions(-)

diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 1877a296f7e9..481ea105f37b 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -1,39 +1,4 @@
-// Caching the list of team members saves API requests when running the bot on the schedule and
-// processing many PRs at once.
-const members = {}
-
-async function runChecklist({ github, context, pull_request, maintainers }) {
-  const pull_number = pull_request.number
-
-  function getTeamMembers(team_slug) {
-    if (context.eventName === 'pull_request') {
-      // We have no chance of getting a token in the pull_request context with the right
-      // permissions to access the members endpoint below. Thus, we're pretending to have
-      // no members. This is OK; because this is only for the Test workflow, not for
-      // real use.
-      return new Set()
-    }
-
-    if (!members[team_slug]) {
-      members[team_slug] = github
-        .paginate(github.rest.teams.listMembersInOrg, {
-          org: context.repo.owner,
-          team_slug,
-          per_page: 100,
-        })
-        .then((members) => new Set(members.map(({ id }) => id)))
-    }
-
-    return members[team_slug]
-  }
-  committers = await getTeamMembers('nixpkgs-committers')
-
-  const files = await github.paginate(github.rest.pulls.listFiles, {
-    ...context.repo,
-    pull_number,
-    per_page: 100,
-  })
-
+function runChecklist({ committers, files, pull_request, log, maintainers }) {
   const packages = files
     .filter(({ filename }) => filename.startsWith('pkgs/by-name/'))
     .map(({ filename }) => filename.split('/')[3])
@@ -59,10 +24,16 @@ async function runChecklist({ github, context, pull_request, maintainers }) {
     'PR has maintainers eligible for merge.': eligible.size > 0,
   }
 
+  const result = Object.values(checklist).every(Boolean)
+
+  log('checklist', JSON.stringify(checklist))
+  log('eligible', JSON.stringify(Array.from(eligible)))
+  log('result', result)
+
   return {
     checklist,
     eligible,
-    result: Object.values(checklist).every(Boolean),
+    result,
   }
 }
 
@@ -91,6 +62,10 @@ async function handleMergeComment({ github, body, node_id, reaction }) {
   )
 }
 
+// Caching the list of team members saves API requests when running the bot on the schedule and
+// processing many PRs at once.
+const members = {}
+
 async function handleMerge({
   github,
   context,
@@ -103,15 +78,42 @@ async function handleMerge({
 }) {
   const pull_number = pull_request.number
 
-  const { checklist, eligible, result } = await runChecklist({
-    github,
-    context,
+  function getTeamMembers(team_slug) {
+    if (context.eventName === 'pull_request') {
+      // We have no chance of getting a token in the pull_request context with the right
+      // permissions to access the members endpoint below. Thus, we're pretending to have
+      // no members. This is OK; because this is only for the Test workflow, not for
+      // real use.
+      return new Set()
+    }
+
+    if (!members[team_slug]) {
+      members[team_slug] = github
+        .paginate(github.rest.teams.listMembersInOrg, {
+          org: context.repo.owner,
+          team_slug,
+          per_page: 100,
+        })
+        .then((members) => new Set(members.map(({ id }) => id)))
+    }
+
+    return members[team_slug]
+  }
+  const committers = await getTeamMembers('nixpkgs-committers')
+
+  const files = await github.paginate(github.rest.pulls.listFiles, {
+    ...context.repo,
+    pull_number,
+    per_page: 100,
+  })
+
+  const { checklist, eligible, result } = runChecklist({
+    committers,
+    files,
     pull_request,
+    log,
     maintainers,
   })
-  log('checklist', JSON.stringify(checklist))
-  log('eligible', JSON.stringify(Array.from(eligible)))
-  log('result', result)
 
   // Only look through comments *after* the latest (force) push.
   const latestChange = events.findLast(({ event }) =>

From 6a3c294f6f0f3c171746434e1753a1a7fc153ffb Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 2 Nov 2025 10:36:52 +0100
Subject: [PATCH 49/61] ci/github-script/merge: move all conditions into
 runChecklist

No special casing anymore, all conditions are in the same place. This
also has the benefit of hiding the "has maintainers eligible for merge"
condition from comments, because it is only really relevant for
labeling.
---
 ci/github-script/merge.js | 56 ++++++++++++++++++++++++++-------------
 1 file changed, 38 insertions(+), 18 deletions(-)

diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 481ea105f37b..255446c457b2 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -1,4 +1,12 @@
-function runChecklist({ committers, files, pull_request, log, maintainers }) {
+function runChecklist({
+  committers,
+  files,
+  pull_request,
+  log,
+  maintainers,
+  user,
+  userIsMaintainer,
+}) {
   const packages = files
     .filter(({ filename }) => filename.startsWith('pkgs/by-name/'))
     .map(({ filename }) => filename.split('/')[3])
@@ -21,7 +29,16 @@ function runChecklist({ committers, files, pull_request, log, maintainers }) {
     'PR authored by r-ryantm or committer.':
       pull_request.user.login === 'r-ryantm' ||
       committers.has(pull_request.user.id),
-    'PR has maintainers eligible for merge.': eligible.size > 0,
+  }
+
+  if (user) {
+    checklist[`${user.login} can use the merge bot.`] = userIsMaintainer
+    checklist[
+      `${user.login} is eligible to merge changes to the touched packages.`
+    ] = eligible.has(user.id)
+  } else {
+    // This is only used when no user is passed, i.e. for labeling.
+    checklist['PR has maintainers eligible to merge.'] = eligible.size > 0
   }
 
   const result = Object.values(checklist).every(Boolean)
@@ -32,7 +49,6 @@ function runChecklist({ committers, files, pull_request, log, maintainers }) {
 
   return {
     checklist,
-    eligible,
     result,
   }
 }
@@ -107,14 +123,6 @@ async function handleMerge({
     per_page: 100,
   })
 
-  const { checklist, eligible, result } = runChecklist({
-    committers,
-    files,
-    pull_request,
-    log,
-    maintainers,
-  })
-
   // Only look through comments *after* the latest (force) push.
   const latestChange = events.findLast(({ event }) =>
     ['committed', 'head_ref_force_pushed'].includes(event),
@@ -224,9 +232,15 @@ async function handleMerge({
       }
     }
 
-    const canUseMergeBot = await isMaintainer(comment.user.login)
-    const isEligible = eligible.has(comment.user.id)
-    const canMerge = result && canUseMergeBot && isEligible
+    const { result, checklist } = runChecklist({
+      committers,
+      files,
+      pull_request,
+      log,
+      maintainers,
+      user: comment.user,
+      userIsMaintainer: await isMaintainer(comment.user.login),
+    })
 
     const body = [
       `<!-- comment: ${comment.node_id} -->`,
@@ -235,12 +249,10 @@ async function handleMerge({
       ...Object.entries(checklist).map(
         ([msg, res]) => `- :${res ? 'white_check_mark' : 'x'}: ${msg}`,
       ),
-      `- :${canUseMergeBot ? 'white_check_mark' : 'x'}: ${comment.user.login} can use the merge bot.`,
-      `- :${isEligible ? 'white_check_mark' : 'x'}: ${comment.user.login} is eligible to merge changes to the touched packages.`,
       '',
     ]
 
-    if (canMerge) {
+    if (result) {
       await react('ROCKET')
       try {
         body.push(`:heavy_check_mark: ${await merge()} (#306934)`)
@@ -264,9 +276,17 @@ async function handleMerge({
       })
     }
 
-    if (canMerge) break
+    if (result) break
   }
 
+  const { result } = runChecklist({
+    committers,
+    files,
+    pull_request,
+    log,
+    maintainers,
+  })
+
   // Returns a boolean, which indicates whether the PR is merge-bot eligible in principle.
   // This is used to set the respective label in bot.js.
   return result

From 2d0a8791fea8a1b16161d3d0e41f6fad10986da8 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 2 Nov 2025 10:44:02 +0100
Subject: [PATCH 50/61] ci/github-script/merge: improve maintainer check

---
 ci/github-script/merge.js | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 255446c457b2..8abc6a2ec2bd 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -7,6 +7,10 @@ function runChecklist({
   user,
   userIsMaintainer,
 }) {
+  const allByName = files.every(({ filename }) =>
+    filename.startsWith('pkgs/by-name/'),
+  )
+
   const packages = files
     .filter(({ filename }) => filename.startsWith('pkgs/by-name/'))
     .map(({ filename }) => filename.split('/')[3])
@@ -23,9 +27,7 @@ function runChecklist({
       'staging',
       'staging-next',
     ].includes(pull_request.base.ref),
-    'PR touches only files in `pkgs/by-name/`.': files.every(({ filename }) =>
-      filename.startsWith('pkgs/by-name/'),
-    ),
+    'PR touches only files in `pkgs/by-name/`.': allByName,
     'PR authored by r-ryantm or committer.':
       pull_request.user.login === 'r-ryantm' ||
       committers.has(pull_request.user.id),
@@ -33,9 +35,12 @@ function runChecklist({
 
   if (user) {
     checklist[`${user.login} can use the merge bot.`] = userIsMaintainer
-    checklist[
-      `${user.login} is eligible to merge changes to the touched packages.`
-    ] = eligible.has(user.id)
+    if (allByName) {
+      // We can only determine the below, if all packages are in by-name, since
+      // we can't reliably relate changed files to packages outside by-name.
+      checklist[`${user.login} is a maintainer of all touched packages.`] =
+        eligible.has(user.id)
+    }
   } else {
     // This is only used when no user is passed, i.e. for labeling.
     checklist['PR has maintainers eligible to merge.'] = eligible.size > 0

From db8f50b4de82a81f2f79410a2ad4bad1423443fe Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 1 Nov 2025 22:24:37 +0100
Subject: [PATCH 51/61] ci/github-script/merge: improve wording

---
 ci/README.md              | 2 +-
 ci/github-script/merge.js | 9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/ci/README.md b/ci/README.md
index df0b9a12384a..4d8c57a70d28 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -43,7 +43,7 @@ These issues effectively list PRs the merge bot has interacted with.
 To ensure security and a focused utility, the bot adheres to specific limitations:
 
 - The PR targets `master`, `staging`, or `staging-next`.
-- The PR only touches files located under `pkgs/by-name/*`.
+- The PR only touches packages located under `pkgs/by-name/*`.
 - The PR is authored by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/) or a [committer][@NixOS/nixpkgs-committers].
 - The user attempting to merge is a member of [@NixOS/nixpkgs-maintainers].
 - The user attempting to merge is a maintainer of all packages touched by the PR.
diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 8abc6a2ec2bd..de3d2b020e8f 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -27,14 +27,16 @@ function runChecklist({
       'staging',
       'staging-next',
     ].includes(pull_request.base.ref),
-    'PR touches only files in `pkgs/by-name/`.': allByName,
+    'PR touches only packages in `pkgs/by-name/`.': allByName,
     'PR authored by r-ryantm or committer.':
       pull_request.user.login === 'r-ryantm' ||
       committers.has(pull_request.user.id),
   }
 
   if (user) {
-    checklist[`${user.login} can use the merge bot.`] = userIsMaintainer
+    checklist[
+      `${user.login} is a member of [@NixOS/nixpkgs-maintainers](https://github.com/orgs/NixOS/teams/nixpkgs-maintainers).`
+    ] = userIsMaintainer
     if (allByName) {
       // We can only determine the below, if all packages are in by-name, since
       // we can't reliably relate changed files to packages outside by-name.
@@ -249,8 +251,9 @@ async function handleMerge({
 
     const body = [
       `<!-- comment: ${comment.node_id} -->`,
+      `@${comment.user.login} wants to merge this PR.`,
       '',
-      'Requirements to merge this PR:',
+      'Requirements to merge this PR with `@NixOS/nixpkgs-merge-bot merge`:',
       ...Object.entries(checklist).map(
         ([msg, res]) => `- :${res ? 'white_check_mark' : 'x'}: ${msg}`,
       ),

From 6848f93842ac3def2769c70ab213685c26f7be1e Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 1 Nov 2025 22:25:11 +0100
Subject: [PATCH 52/61] ci/github-script/merge: add TODO about second merge
 method

We have not observed this merge method being used in practice, yet. Not
in the new bot, not in the old bot. It seems like auto-merge works for
all cases.
---
 ci/github-script/merge.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index de3d2b020e8f..40ab02ae09d9 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -180,6 +180,7 @@ async function handleMerge({
       log('Auto Merge failed', e.response.errors[0].message)
     }
 
+    // TODO: Observe whether the below is true and whether manual enqueue is actually needed.
     // Auto-merge doesn't work if the target branch has already run all CI, in which
     // case the PR must be enqueued explicitly.
     // We now have merge queues enabled on all development branches, thus don't need a

From 84d6678f3bfd87436e25995abef9412ef5071e12 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 1 Nov 2025 22:28:29 +0100
Subject: [PATCH 53/61] ci/github-script/merge: support OR conditions

This supports AND on the first and OR on the second level, which is
needed for some follow up work like backports, approval based merges or
trusted maintainers.
---
 ci/README.md              |  4 +++-
 ci/github-script/merge.js | 23 +++++++++++++++++------
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/ci/README.md b/ci/README.md
index 4d8c57a70d28..500abbfb637f 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -44,7 +44,9 @@ To ensure security and a focused utility, the bot adheres to specific limitation
 
 - The PR targets `master`, `staging`, or `staging-next`.
 - The PR only touches packages located under `pkgs/by-name/*`.
-- The PR is authored by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/) or a [committer][@NixOS/nixpkgs-committers].
+- The PR is either:
+  - authored by a [committer][@NixOS/nixpkgs-committers], or
+  - created by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/).
 - The user attempting to merge is a member of [@NixOS/nixpkgs-maintainers].
 - The user attempting to merge is a maintainer of all packages touched by the PR.
 
diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 40ab02ae09d9..5128124ac2eb 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -28,9 +28,10 @@ function runChecklist({
       'staging-next',
     ].includes(pull_request.base.ref),
     'PR touches only packages in `pkgs/by-name/`.': allByName,
-    'PR authored by r-ryantm or committer.':
-      pull_request.user.login === 'r-ryantm' ||
-      committers.has(pull_request.user.id),
+    'PR is at least one of:': {
+      'Authored by a committer.': committers.has(pull_request.user.id),
+      'Created by r-ryantm.': pull_request.user.login === 'r-ryantm',
+    },
   }
 
   if (user) {
@@ -48,7 +49,9 @@ function runChecklist({
     checklist['PR has maintainers eligible to merge.'] = eligible.size > 0
   }
 
-  const result = Object.values(checklist).every(Boolean)
+  const result = Object.values(checklist).every((v) =>
+    typeof v === 'boolean' ? v : Object.values(v).some(Boolean),
+  )
 
   log('checklist', JSON.stringify(checklist))
   log('eligible', JSON.stringify(Array.from(eligible)))
@@ -255,8 +258,16 @@ async function handleMerge({
       `@${comment.user.login} wants to merge this PR.`,
       '',
       'Requirements to merge this PR with `@NixOS/nixpkgs-merge-bot merge`:',
-      ...Object.entries(checklist).map(
-        ([msg, res]) => `- :${res ? 'white_check_mark' : 'x'}: ${msg}`,
+      ...Object.entries(checklist).flatMap(([msg, res]) =>
+        typeof res === 'boolean'
+          ? `- :${res ? 'white_check_mark' : 'x'}: ${msg}`
+          : [
+              `- :${Object.values(res).some(Boolean) ? 'white_check_mark' : 'x'}: ${msg}`,
+              ...Object.entries(res).map(
+                ([msg, res]) =>
+                  `  - ${res ? ':white_check_mark:' : ':white_large_square:'} ${msg}`,
+              ),
+            ],
       ),
       '',
     ]

From 7279555db7de1078ddfde3329d50faefbbd5b164 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 2 Nov 2025 23:37:24 +0800
Subject: [PATCH 54/61] xfce.xfce4-panel-profiles: Add missing meta.license

Forgotten when porting this from mkXfceDerivation.
---
 .../xfce/applications/xfce4-panel-profiles/default.nix     | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/desktops/xfce/applications/xfce4-panel-profiles/default.nix b/pkgs/desktops/xfce/applications/xfce4-panel-profiles/default.nix
index 88d2741a52f5..2cb7dea4c316 100644
--- a/pkgs/desktops/xfce/applications/xfce4-panel-profiles/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-panel-profiles/default.nix
@@ -57,11 +57,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.updateScript = gitUpdater { rev-prefix = "xfce4-panel-profiles-"; };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://docs.xfce.org/apps/xfce4-panel-profiles/start";
     description = "Simple application to manage Xfce panel layouts";
+    license = lib.licenses.gpl3Plus;
     mainProgram = "xfce4-panel-profiles";
-    teams = [ teams.xfce ];
-    platforms = platforms.linux;
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
 })

From 51637f824a92b2017da1e156edbbb205e75255d6 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 2 Nov 2025 18:49:42 +0300
Subject: [PATCH 55/61] linux_6_17: 6.17.6 -> 6.17.7

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 5dc249ac5b4c..8a7956575e0c 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,8 +30,8 @@
         "lts": true
     },
     "6.17": {
-        "version": "6.17.6",
-        "hash": "sha256:17662dpl1rd24n20ihb1fsf66c8n3r6x1a24c6sanj1ld5mvrkwf",
+        "version": "6.17.7",
+        "hash": "sha256:03lxl2p8hvi4hdzbf72v3xh8yigr58826dmy6rqxbq9r8h6ymwnx",
         "lts": false
     }
 }

From c0d45e9e9eaf99a757ba2a87c5567f03fca26ee5 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 2 Nov 2025 18:49:45 +0300
Subject: [PATCH 56/61] linux_6_12: 6.12.56 -> 6.12.57

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 8a7956575e0c..9f8274cc7a64 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -25,8 +25,8 @@
         "lts": true
     },
     "6.12": {
-        "version": "6.12.56",
-        "hash": "sha256:15pclwn3nbwccdfwcqd3lkmdxwpjkmadhj63acqbzxsjycm2nhsm",
+        "version": "6.12.57",
+        "hash": "sha256:06jlsawz1wgk13gyxphkglb8a4iiwg0vg5hrfc7bj1s6gk1s2p0n",
         "lts": true
     },
     "6.17": {

From bf7a2d396b3398410f8a905180651cb1ae9e8c05 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 2 Nov 2025 18:49:48 +0300
Subject: [PATCH 57/61] linux_6_6: 6.6.115 -> 6.6.116

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 9f8274cc7a64..bcbd01d44244 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,8 +20,8 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.115",
-        "hash": "sha256:0iwhzlrqcw9hzr21gn0pmsjix0d022a7g38vszx4jsqgimgc160a",
+        "version": "6.6.116",
+        "hash": "sha256:07d5629579apc1d8yb0ki226iyb5n3lwp1yw0p189qlvq919g9d9",
         "lts": true
     },
     "6.12": {

From cf5ad65f9cb0224783f9cd36a9663bdaa6cf0e37 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 15:58:17 +0000
Subject: [PATCH 58/61] anilibria-winmaclinux: 2.2.31 -> 2.2.32

---
 pkgs/applications/video/anilibria-winmaclinux/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/video/anilibria-winmaclinux/default.nix b/pkgs/applications/video/anilibria-winmaclinux/default.nix
index 5b1fa114902d..6e4b6d9f18eb 100644
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@@ -21,13 +21,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "2.2.31";
+  version = "2.2.32";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-czLEYPz+5vXHisXexzRXLhwN4onka31hn69F4MaSnCs=";
+    hash = "sha256-Wxzv1iLJ+OWw+g6ndBX36AR2v9cSu2uZysegz97+XaM=";
   };
 
   sourceRoot = "${src.name}/src";

From 008ea3df2c95416552f41029742603a36b883458 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 2 Nov 2025 17:10:07 +0100
Subject: [PATCH 59/61] ci/request-reviews: fix request-reviewers.sh

We recently moved some code around and forgot to adjust the log line
here.
---
 ci/request-reviews/request-reviewers.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci/request-reviews/request-reviewers.sh b/ci/request-reviews/request-reviewers.sh
index b4288669db93..a7cde16eb97b 100755
--- a/ci/request-reviews/request-reviewers.sh
+++ b/ci/request-reviews/request-reviewers.sh
@@ -59,7 +59,7 @@ while read -r handle && [[ -n "$handle" ]]; do
             "/orgs/$org/teams/$team/members" \
             --jq '.[].login' > "$tmp/team-members"
         readarray -t members < "$tmp/team-members"
-        log "Team $entry has these members: ${members[*]}"
+        log "Team $handle has these members: ${members[*]}"
 
         for user in "${members[@]}"; do
             users[${user,,}]=

From c0b6cc938773fd1beb71a57a2cfd38682f390526 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 2 Nov 2025 17:30:46 +0100
Subject: [PATCH 60/61] ci/eval/compare: fix without owners

Even without relevant owners, the owners.txt file must be created,
otherwise the next job will fail.
---
 ci/eval/compare/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index 571e6ba41068..9791d26e9550 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -230,6 +230,7 @@ runCommand "compare"
     echo "This PR touches ''${#touchedFiles[@]} files"
 
     # TODO: Move ci/OWNERS to Nix and produce owners.json instead of owners.txt.
+    touch "$out/owners.txt"
     for file in "''${touchedFiles[@]}"; do
         result=$(codeowners --file "${ownersFile}" "$file")
 

From bfef391973a38fb14d0be856c54f496f52c934d2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Nov 2025 17:09:57 +0000
Subject: [PATCH 61/61] quickjs-ng: 0.10.1 -> 0.11.0

---
 pkgs/by-name/qu/quickjs-ng/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/qu/quickjs-ng/package.nix b/pkgs/by-name/qu/quickjs-ng/package.nix
index 15c563d00844..a96fd2804048 100644
--- a/pkgs/by-name/qu/quickjs-ng/package.nix
+++ b/pkgs/by-name/qu/quickjs-ng/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quickjs-ng";
-  version = "0.10.1";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "quickjs-ng";
     repo = "quickjs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WtjHyqxibP6bAO9HsXuqAW/Y1qgt/Tpj401CIk4bY7o=";
+    hash = "sha256-Mb0YyxTWU6a8HFTVBmlJ5yGEDmjKXHqTSszAvb8Y01U=";
   };
 
   outputs = [