From 0234fbb0b1016a1b996f6cf9eb6a4f322deef77b Mon Sep 17 00:00:00 2001
From: Victor Fuentes <victor.fuentes@repl.it>
Date: Wed, 15 Oct 2025 15:08:07 -0700
Subject: [PATCH 01/34] nixos/google-compute-image: add buildMemSize option

---
 nixos/modules/virtualisation/google-compute-image.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nixos/modules/virtualisation/google-compute-image.nix b/nixos/modules/virtualisation/google-compute-image.nix
index e1021c755aea..305758756a38 100644
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@@ -57,6 +57,12 @@ in
       '';
     };
 
+    virtualisation.googleComputeImage.buildMemSize = mkOption {
+      type = types.int;
+      default = 1024;
+      description = "Memory size (in MiB) for the temporary VM used to build the image.";
+    };
+
     virtualisation.googleComputeImage.contents = mkOption {
       type = with types; listOf attrs;
       default = [ ];
@@ -129,6 +135,7 @@ in
       inherit (cfg) contents;
       partitionTableType = if cfg.efi then "efi" else "legacy";
       inherit (config.virtualisation) diskSize;
+      memSize = cfg.buildMemSize;
       inherit config lib pkgs;
     };
 

From 6f83d3e436ff0472215d881915831163678a2184 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Fri, 24 Oct 2025 10:50:37 -0400
Subject: [PATCH 02/34] asciinema_3: 3.0.0 -> 3.0.1

---
 pkgs/by-name/as/asciinema_3/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/as/asciinema_3/package.nix b/pkgs/by-name/as/asciinema_3/package.nix
index 140d97fbda02..69aa09329266 100644
--- a/pkgs/by-name/as/asciinema_3/package.nix
+++ b/pkgs/by-name/as/asciinema_3/package.nix
@@ -10,17 +10,17 @@
 let
   self = rustPlatform.buildRustPackage {
     pname = "asciinema";
-    version = "3.0.0";
+    version = "3.0.1";
 
     src = fetchFromGitHub {
       name = "asciinema-source-${self.version}";
       owner = "asciinema";
       repo = "asciinema";
       rev = "v${self.version}";
-      hash = "sha256-P92EZyg8f/mm66SmXAyPX9f4eMgOP6lyn3Uqhqh+D0I=";
+      hash = "sha256-jWRq/LeDdCETiOMkWr9EIWztb14IYGCSo05QPw5HZZk=";
     };
 
-    cargoHash = "sha256-2DQqtCcvSO43+RcMN2/BGqvf+cp/WvzUY4dxVpNcbGU=";
+    cargoHash = "sha256-bGhShwH4BxE3O4/B8KSK1o7IXNDBmGuVt4kx5s8W/go=";
 
     env.ASCIINEMA_GEN_DIR = "gendir";
 

From fe2d1f226c91bf6064e913eb65db193aa23f36f3 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Fri, 24 Oct 2025 11:57:20 -0400
Subject: [PATCH 03/34] asciinema_3: use finalAttrs

---
 pkgs/by-name/as/asciinema_3/package.nix | 101 ++++++++++++------------
 1 file changed, 49 insertions(+), 52 deletions(-)

diff --git a/pkgs/by-name/as/asciinema_3/package.nix b/pkgs/by-name/as/asciinema_3/package.nix
index 69aa09329266..d3a841bdbf30 100644
--- a/pkgs/by-name/as/asciinema_3/package.nix
+++ b/pkgs/by-name/as/asciinema_3/package.nix
@@ -7,64 +7,61 @@
   testers,
 }:
 
-let
-  self = rustPlatform.buildRustPackage {
-    pname = "asciinema";
-    version = "3.0.1";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "asciinema";
+  version = "3.0.1";
 
-    src = fetchFromGitHub {
-      name = "asciinema-source-${self.version}";
-      owner = "asciinema";
-      repo = "asciinema";
-      rev = "v${self.version}";
-      hash = "sha256-jWRq/LeDdCETiOMkWr9EIWztb14IYGCSo05QPw5HZZk=";
-    };
+  src = fetchFromGitHub {
+    name = "asciinema-source-${finalAttrs.version}";
+    owner = "asciinema";
+    repo = "asciinema";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-jWRq/LeDdCETiOMkWr9EIWztb14IYGCSo05QPw5HZZk=";
+  };
 
-    cargoHash = "sha256-bGhShwH4BxE3O4/B8KSK1o7IXNDBmGuVt4kx5s8W/go=";
+  cargoHash = "sha256-bGhShwH4BxE3O4/B8KSK1o7IXNDBmGuVt4kx5s8W/go=";
 
-    env.ASCIINEMA_GEN_DIR = "gendir";
+  env.ASCIINEMA_GEN_DIR = "gendir";
 
-    nativeCheckInputs = [ python3 ];
-    nativeBuildInputs = [ installShellFiles ];
+  nativeCheckInputs = [ python3 ];
+  nativeBuildInputs = [ installShellFiles ];
 
-    postInstall = ''
-      installManPage gendir/man/*
-      installShellCompletion --cmd asciinema \
-        --bash gendir/completion/asciinema.bash \
-        --fish gendir/completion/asciinema.fish \
-        --zsh gendir/completion/_asciinema
-    '';
+  postInstall = ''
+    installManPage gendir/man/*
+    installShellCompletion --cmd asciinema \
+      --bash gendir/completion/asciinema.bash \
+      --fish gendir/completion/asciinema.fish \
+      --zsh gendir/completion/_asciinema
+  '';
 
-    strictDeps = true;
+  strictDeps = true;
 
-    passthru = {
-      tests.version = testers.testVersion {
-        package = self;
-        command = "asciinema --version";
-      };
-    };
-
-    meta = {
-      homepage = "https://asciinema.org/";
-      description = "Terminal session recorder and the best companion of asciinema.org";
-      longDescription = ''
-        asciinema is a suite of tools for recording, replaying, and sharing
-        terminal sessions. It is free and open-source software (FOSS), created
-        by Marcin Kulik.
-
-        Its typical use cases include creating tutorials, demonstrating
-        command-line tools, and sharing reproducible bug reports. It focuses on
-        simplicity and interoperability, which makes it a popular choice among
-        computer users working with the command-line, such as developers or
-        system administrators.
-      '';
-      license = with lib.licenses; [ gpl3Plus ];
-      mainProgram = "asciinema";
-      maintainers = with lib.maintainers; [
-        jiriks74
-        llakala
-      ];
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      command = "asciinema --version";
     };
   };
-in
-self
+
+  meta = {
+    homepage = "https://asciinema.org/";
+    description = "Terminal session recorder and the best companion of asciinema.org";
+    longDescription = ''
+      asciinema is a suite of tools for recording, replaying, and sharing
+      terminal sessions. It is free and open-source software (FOSS), created
+      by Marcin Kulik.
+
+      Its typical use cases include creating tutorials, demonstrating
+      command-line tools, and sharing reproducible bug reports. It focuses on
+      simplicity and interoperability, which makes it a popular choice among
+      computer users working with the command-line, such as developers or
+      system administrators.
+    '';
+    license = with lib.licenses; [ gpl3Plus ];
+    mainProgram = "asciinema";
+    maintainers = with lib.maintainers; [
+      jiriks74
+      llakala
+    ];
+  };
+})

From 90dfa42149e0f220742115f7faa8be16575c2e75 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Sat, 1 Nov 2025 14:13:04 -0700
Subject: [PATCH 04/34] =?UTF-8?q?biboumi:=209.0=20=E2=86=92=209.0-unstable?=
 =?UTF-8?q?-2025-10-27?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Biboumi was not running as is. Rather than trying keep piling on these
patches, it appear to ‘just work’ if using the latest upstream patches.
Hopefully they will cut a release.
---
 pkgs/by-name/bi/biboumi/catch.patch | 30 -----------------------------
 pkgs/by-name/bi/biboumi/package.nix | 30 ++++-------------------------
 2 files changed, 4 insertions(+), 56 deletions(-)
 delete mode 100644 pkgs/by-name/bi/biboumi/catch.patch

diff --git a/pkgs/by-name/bi/biboumi/catch.patch b/pkgs/by-name/bi/biboumi/catch.patch
deleted file mode 100644
index bbd0a66909fe..000000000000
--- a/pkgs/by-name/bi/biboumi/catch.patch
+++ /dev/null
@@ -1,30 +0,0 @@
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -303,27 +303,6 @@
- endforeach()
- 
- #
--## Add a rule to download the catch unit test framework
--#
--include(ExternalProject)
--ExternalProject_Add(catch
--  GIT_REPOSITORY "https://lab.louiz.org/louiz/Catch.git"
--  PREFIX "external"
--  UPDATE_COMMAND ""
--  CONFIGURE_COMMAND ""
--  BUILD_COMMAND ""
--  INSTALL_COMMAND ""
--  )
--set_target_properties(catch PROPERTIES EXCLUDE_FROM_ALL TRUE)
--ExternalProject_Get_Property(catch SOURCE_DIR)
--if(NOT EXISTS ${CMAKE_SOURCE_DIR}/tests/catch.hpp)
--  target_include_directories(test_suite
--    PUBLIC "${SOURCE_DIR}/single_include/"
--    )
--  add_dependencies(test_suite catch)
--endif()
--
--#
- ## Add some custom rules to launch the tests
- #
- add_custom_target(check COMMAND "test_suite"
diff --git a/pkgs/by-name/bi/biboumi/package.nix b/pkgs/by-name/bi/biboumi/package.nix
index ebc9dfa625e3..ccf3d25dd507 100644
--- a/pkgs/by-name/bi/biboumi/package.nix
+++ b/pkgs/by-name/bi/biboumi/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitea,
-  fetchpatch,
   cmake,
   libuuid,
   expat,
@@ -25,38 +24,18 @@ assert lib.assertMsg (
   withPostgreSQL || withSQLite
 ) "At least one Biboumi database provider required";
 
-let
-  catch = fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "poezio";
-    repo = "catch";
-    tag = "v2.2.1";
-    hash = "sha256-dGUnB/KPONqPno1aO5cOSiE5N4lUiTbMUcH0X6HUoCk=";
-  };
-
-  pname = "biboumi";
-  version = "9.0";
-in
 stdenv.mkDerivation {
-  inherit pname version;
+  pname = "biboumi";
+  version = "9.0-unstable-2025-10-27";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "poezio";
     repo = "biboumi";
-    tag = version;
-    hash = "sha256-yjh9WFuFjaoZLfXTfZajmdRO+3KZqJYBEd0HgqcC28A=";
+    rev = "61242c35bc825d58c9db4301b5696bc17428bf98";
+    hash = "sha256-BZTqu2Qvfqag9pwymlGrItLbOXQf3VMKQS2+3pxlJbE=";
   };
 
-  patches = [
-    ./catch.patch
-    (fetchpatch {
-      name = "update_botan_to_version_3.patch";
-      url = "https://codeberg.org/poezio/biboumi/commit/e4d32f939240ed726e9981e42c0dc251cd9879da.patch";
-      hash = "sha256-QUt2ZQtoouLHAeEUlJh+yfCYEmLboL/tk6O2TbHR67Q=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -87,7 +66,6 @@ stdenv.mkDerivation {
 
   preConfigure = ''
     substituteInPlace CMakeLists.txt --replace /etc/biboumi $out/etc/biboumi
-    cp ${catch}/single_include/catch.hpp tests/
   '';
 
   doCheck = true;

From 2550e30b0ff449bcb5bdc91eb90c0427a4395124 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 4 Nov 2025 13:32:28 +0100
Subject: [PATCH 05/34] igvm-tooling: remove

python3Packages.ecdsa has been marked vulnerable, and igvm-tooling
depends on it. There won't be a fix to the ecdsa lib, and it isn't
likely upstream will move to another dependency as the vulnerability
doesn't really affect igvm-tooling's use case.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/by-name/ig/igvm-tooling/package.nix | 81 ------------------------
 pkgs/top-level/aliases.nix               |  1 +
 2 files changed, 1 insertion(+), 81 deletions(-)
 delete mode 100644 pkgs/by-name/ig/igvm-tooling/package.nix

diff --git a/pkgs/by-name/ig/igvm-tooling/package.nix b/pkgs/by-name/ig/igvm-tooling/package.nix
deleted file mode 100644
index 05629f538466..000000000000
--- a/pkgs/by-name/ig/igvm-tooling/package.nix
+++ /dev/null
@@ -1,81 +0,0 @@
-{
-  lib,
-  python3,
-  fetchFromGitHub,
-  fetchpatch,
-  which,
-  acpica-tools,
-  unstableGitUpdater,
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "igvm-tooling";
-  version = "1.5.0-unstable-2024-06-06";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "microsoft";
-    repo = "igvm-tooling";
-    rev = "53656ddde294bbafcae6349b5acfc5da9f7dbb92";
-    hash = "sha256-X9Gi+kTmc/ZcsgbHldEj9zPnOmd5puDD7/+J1s1CVws=";
-  };
-
-  patches = [
-    # drop unused libclang dependency
-    # remove once https://github.com/microsoft/igvm-tooling/pull/53 is merged
-    (fetchpatch {
-      name = "0001-setup.py-remove-unused-libclang-dependency.patch";
-      url = "https://github.com/microsoft/igvm-tooling/commit/7182e925de9b5e9f5c8c3a3ce6e3942a92506064.patch";
-      hash = "sha256-tcVxcuLxknyEdo2YjeHOqSG9xQna8US+YyvlcfX+Htw=";
-      stripLen = 1;
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace igvm/acpi.py \
-      --replace-fail 'os.path.join(os.path.dirname(__file__), "acpi", "acpi.zip")' "\"$out/share/igvm-tooling/acpi/acpi.zip\""
-  '';
-
-  sourceRoot = "${src.name}/src";
-
-  nativeBuildInputs = [ acpica-tools ];
-
-  propagatedBuildInputs =
-    (with python3.pkgs; [
-      setuptools
-      ecdsa
-      cstruct
-      pyelftools
-      pytest
-      cached-property
-      frozendict
-    ])
-    ++ [
-      acpica-tools
-      which
-    ];
-
-  postInstall = ''
-    mkdir -p $out/share/igvm-tooling/acpi/acpi-clh
-    cp -rT igvm/acpi/acpi-clh $out/share/igvm-tooling/acpi/acpi-clh
-    cp igvm/acpi/acpi.zip $out/share/igvm-tooling/acpi/acpi.zip
-    find $out/share/igvm-tooling/acpi -name "*.dsl" -exec iasl -f {} \;
-  '';
-
-  passthru.updateScript = unstableGitUpdater {
-    tagPrefix = "igvm-";
-  };
-
-  meta = {
-    description = "IGVM Image Generator";
-    homepage = "https://github.com/microsoft/igvm-tooling";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [
-      malt3
-      katexochen
-    ];
-    changelog = "https://github.com/microsoft/igvm-tooling/releases/tag/igvm-${version}";
-    mainProgram = "igvmgen";
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8e4071c5bcc9..24151b9c552c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -700,6 +700,7 @@ mapAliases {
   hydra_unstable = throw "'hydra_unstable' has been renamed to/replaced by 'hydra'"; # Converted to throw 2025-10-27
   i3-gaps = throw "'i3-gaps' has been renamed to/replaced by 'i3'"; # Converted to throw 2025-10-27
   ibm-sw-tpm2 = throw "ibm-sw-tpm2 has been removed, as it was broken"; # Added 2025-08-25
+  igvm-tooling = throw "'igvm-tooling' has been removed as it is poorly maintained upstream and a dependency has been marked insecure."; # Added 2025-09-03
   ikos = throw "ikos has been removed, as it does not build with supported LLVM versions"; # Added 2025-08-10
   imaginer = throw "'imaginer' has been removed due to lack of upstream maintenance"; # Added 2025-08-15
   immersed-vr = throw "'immersed-vr' has been renamed to/replaced by 'immersed'"; # Converted to throw 2025-10-27

From ad77908bb10af6c159023548801757b98be58358 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 5 Nov 2025 03:53:41 +0000
Subject: [PATCH 06/34] postman: 11.67.0 -> 11.70.2

---
 pkgs/by-name/po/postman/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/po/postman/package.nix b/pkgs/by-name/po/postman/package.nix
index bc1241c7b0fc..eecbbad5fa98 100644
--- a/pkgs/by-name/po/postman/package.nix
+++ b/pkgs/by-name/po/postman/package.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "postman";
-  version = "11.67.0";
+  version = "11.70.2";
 
   src =
     let
@@ -27,10 +27,10 @@ let
       name = "postman-${version}.${if stdenvNoCC.hostPlatform.isLinux then "tar.gz" else "zip"}";
       url = "https://dl.pstmn.io/download/version/${version}/${system}";
       hash = selectSystem {
-        aarch64-darwin = "sha256-WDXYSHhwvNo4IifeuYOZmF7KX/5ZArPXtoBe30bmGIg=";
-        aarch64-linux = "sha256-7rtKBx5axftXEXmps1mUPIKPypFUVwhSGA/yJstVU2I=";
-        x86_64-darwin = "sha256-7cm9u0zdvEBfjId6Xp0i4X2E/dtAZ0HeI3y0guzyMp4=";
-        x86_64-linux = "sha256-xg9d1E3S6yR3BOMLb5OXmMfZj5e+GmW9p1FFMBj/5mI=";
+        aarch64-darwin = "sha256-IJrASCvoYvJMrPr5wrpveOy457iRgp+cqFEsCPUcegA=";
+        aarch64-linux = "sha256-Pig0ZVFb+CVxcbPIwnWVxypxalAmLVcNTegBaDBLjAE=";
+        x86_64-darwin = "sha256-gI4vww6XkUti5RMc8fr9769t+emVpo0u3OozlxQdar8=";
+        x86_64-linux = "sha256-T0O6Y3ElK7eJ7ekEx8BjGiYOM8S4S3t0skkZBYh9AQ4=";
       };
     };
 

From d213dae9bddf494358fac0314e25be9d46da8827 Mon Sep 17 00:00:00 2001
From: FKouhai <frandres00@gmail.com>
Date: Sat, 8 Nov 2025 01:54:14 +0100
Subject: [PATCH 07/34] hygg: skip test_stdin_processing on darwin

---
 pkgs/by-name/hy/hygg/package.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/hy/hygg/package.nix b/pkgs/by-name/hy/hygg/package.nix
index ff1901af28cd..00f166181a7e 100644
--- a/pkgs/by-name/hy/hygg/package.nix
+++ b/pkgs/by-name/hy/hygg/package.nix
@@ -28,7 +28,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # e2e test fails since it cant find the input pdf file
     "--skip=tests::test_end_to_end"
     "--skip=test_epub_processing"
-  ];
+  ]
+  ## Skipping this test due to the high variability of its outcome
+  ## When the package was merged the test was passing but on hydra its not
+  ## Look at PR #448907
+  ++ (if pkgs.stdenv.isDarwin then [ "--skip=test_stdin_processing" ] else [ ]);
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

From 6c02c61c05ccbaf28580e76292489788ab8b747d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Nov 2025 05:17:43 +0000
Subject: [PATCH 08/34] cherry-studio: 1.6.5 -> 1.6.7

---
 pkgs/by-name/ch/cherry-studio/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ch/cherry-studio/package.nix b/pkgs/by-name/ch/cherry-studio/package.nix
index 5e8bc1f788c4..d9fcf2e7ff8e 100644
--- a/pkgs/by-name/ch/cherry-studio/package.nix
+++ b/pkgs/by-name/ch/cherry-studio/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cherry-studio";
-  version = "1.6.5";
+  version = "1.6.7";
 
   src = fetchFromGitHub {
     owner = "CherryHQ";
     repo = "cherry-studio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9oEMnGaloY3tFY/qpjTlYbO7n1ORIK49s3N9SGSMvHE=";
+    hash = "sha256-F5TlgWorsBJ4B6/j+3WbbVMirtqCrDq+TrWW257MMek=";
   };
 
   postPatch = ''
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-LstTTVKXVL6hIC5TiUKeBIcDFaRPdmEjO2LmvVXB7dQ=";
+    hash = "sha256-noZ3R4kxYw26z2qavaIb+iv7iFj5ID7O0V5fSVcAd48=";
   };
 
   nativeBuildInputs = [

From 958321447e73493e12c6df455b73e9dd70e8ab95 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Nov 2025 09:00:16 +0000
Subject: [PATCH 09/34] koboldcpp: 1.101 -> 1.101.1

---
 pkgs/by-name/ko/koboldcpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ko/koboldcpp/package.nix b/pkgs/by-name/ko/koboldcpp/package.nix
index 949081fc8774..72cd7a7bbae9 100644
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@@ -41,13 +41,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "koboldcpp";
-  version = "1.101";
+  version = "1.101.1";
 
   src = fetchFromGitHub {
     owner = "LostRuins";
     repo = "koboldcpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WwTl+u7FJ4E+x+jjwh0wmPM7fjsPxu7+TrEwKQQfyLA=";
+    hash = "sha256-gPbvzbbgm13HjXISPY5hpcCgUejQ5OHkmMu2zCwm/sQ=";
   };
 
   enableParallelBuilding = true;

From 7a8f7f8e7cc5596e46b6037b9b904f32dde48f50 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Nov 2025 10:37:05 +0000
Subject: [PATCH 10/34] ast-grep: 0.39.7 -> 0.39.9

---
 pkgs/by-name/as/ast-grep/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/as/ast-grep/package.nix b/pkgs/by-name/as/ast-grep/package.nix
index 94c1cc3909fd..108bc700447c 100644
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.39.7";
+  version = "0.39.9";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-D/fdy2oMwlXVMzoSCcYSz1fiazVCypvj4X3G6vBWBUw=";
+    hash = "sha256-OzDx1/U4uZuMGanTaDi1Bu3ueMaf83jJIqy+20+cX0g=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-AuVD3n+T9UNLw6+IuM9l2AoMb7eEFhr+ZlktYZQYI80=";
+  cargoHash = "sha256-YtukqwUvpAQf8Dxf0rhowylt8h1VhN9PcnF+QiB8WmA=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From ff5c8584d0faedb0614451b553ab22ffe92d0c32 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Sun, 9 Nov 2025 12:21:20 +0700
Subject: [PATCH 11/34] =?UTF-8?q?h2o:=202.3.0-rolling-2025-10-17=20?=
 =?UTF-8?q?=E2=86=92=202.3.0-rolling-2025-11-08?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/h2/h2o/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index a73f5a770eef..e168cd2e9e43 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "h2o";
-  version = "2.3.0-rolling-2025-10-17";
+  version = "2.3.0-rolling-2025-11-08";
 
   src = fetchFromGitHub {
     owner = "h2o";
     repo = "h2o";
-    rev = "562d7bd089173da03e71bc4c0824468751c5b411";
-    hash = "sha256-/P4S8ng1kQPPHNSNuqgLasu2c2Y9BD2Y9v0hlMiPCIM=";
+    rev = "607b732b668a06826709c0f72bd4fd680f2372bc";
+    hash = "sha256-JdtBedmz84LnlePKif3vnq5YbTAIumvzPcjlJ/Br5hQ=";
   };
 
   outputs = [

From 20501b5a276492cc71a3952bb0a1ee0e852b3c46 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 9 Nov 2025 15:22:41 +0100
Subject: [PATCH 12/34] nixos/lib/make-{single,multi}-disk-zfs-image: fix
 references to kernel modules

Closes #455144

Previously, image builds with ZFS would fail with

    kernel-modules-shrunk> root module: 9p
    kernel-modules-shrunk> modprobe: FATAL: Module 9p not found in directory /nix/store/r4m7bmihmr40377yh33pn76wp9w33da2-kernel-modules/lib/modules/6.12.53

with said store-path only containing out-of-tree modules.

I'm pretty sure this was just missed to update in
f71277d66db862f2cef133e9d63cb858f38d0a0c.
---
 nixos/lib/make-multi-disk-zfs-image.nix  | 1 +
 nixos/lib/make-single-disk-zfs-image.nix | 1 +
 2 files changed, 2 insertions(+)

diff --git a/nixos/lib/make-multi-disk-zfs-image.nix b/nixos/lib/make-multi-disk-zfs-image.nix
index cbb2fdf7b6c5..55e54b3b2f0d 100644
--- a/nixos/lib/make-multi-disk-zfs-image.nix
+++ b/nixos/lib/make-multi-disk-zfs-image.nix
@@ -126,6 +126,7 @@ let
     with config.boot;
     [
       kernelPackages.kernel
+      (lib.getOutput "modules" kernelPackages.kernel)
       kernelPackages.${pkgs.zfs.kernelModuleAttribute}
     ]
   );
diff --git a/nixos/lib/make-single-disk-zfs-image.nix b/nixos/lib/make-single-disk-zfs-image.nix
index 74cbaaa7edfe..dbd68a768847 100644
--- a/nixos/lib/make-single-disk-zfs-image.nix
+++ b/nixos/lib/make-single-disk-zfs-image.nix
@@ -114,6 +114,7 @@ let
     with config.boot;
     [
       kernelPackages.kernel
+      (lib.getOutput "modules" kernelPackages.kernel)
       kernelPackages.${pkgs.zfs.kernelModuleAttribute}
     ]
   );

From 9ab2c7619ecb7c7bea3dcba1f523a8483042446f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Sun, 9 Nov 2025 12:49:23 +0700
Subject: [PATCH 13/34] nixos/tests/h2o: use ports from the actual machines

---
 nixos/tests/web-servers/h2o/basic.nix         | 27 ++++----
 nixos/tests/web-servers/h2o/mruby.nix         |  8 +--
 .../web-servers/h2o/tls-recommendations.nix   | 63 +++++++++++--------
 3 files changed, 53 insertions(+), 45 deletions(-)

diff --git a/nixos/tests/web-servers/h2o/basic.nix b/nixos/tests/web-servers/h2o/basic.nix
index 622bb96929bf..9b67f3397536 100644
--- a/nixos/tests/web-servers/h2o/basic.nix
+++ b/nixos/tests/web-servers/h2o/basic.nix
@@ -8,11 +8,6 @@ let
     TLS = "acme.test";
   };
 
-  port = {
-    HTTP = 8080;
-    TLS = 8443;
-  };
-
   sawatdi_chao_lok = "สวัสดีชาวโลก";
 
   hello_world_txt = hostPkgs.writeTextFile {
@@ -41,7 +36,7 @@ in
 
   nodes = {
     server =
-      { pkgs, ... }:
+      { pkgs, config, ... }:
       {
         environment.systemPackages = [
           pkgs.curl
@@ -49,8 +44,8 @@ in
 
         services.h2o = {
           enable = true;
-          defaultHTTPListenPort = port.HTTP;
-          defaultTLSListenPort = port.TLS;
+          defaultHTTPListenPort = 8080;
+          defaultTLSListenPort = 8443;
           hosts = {
             "${domain.HTTP}" = {
               settings = {
@@ -107,12 +102,12 @@ in
 
         networking = {
           firewall = {
-            allowedTCPPorts = with port; [
-              HTTP
-              TLS
+            allowedTCPPorts = with config.services.h2o; [
+              defaultHTTPListenPort
+              defaultTLSListenPort
             ];
-            allowedUDPPorts = with port; [
-              TLS
+            allowedUDPPorts = with config.services.h2o; [
+              defaultTLSListenPort
             ];
           };
           extraHosts = ''
@@ -123,9 +118,11 @@ in
       };
   };
   testScript =
+    { nodes, ... }:
     let
-      portStrHTTP = builtins.toString port.HTTP;
-      portStrTLS = builtins.toString port.TLS;
+      inherit (nodes) server;
+      portStrHTTP = builtins.toString server.services.h2o.defaultHTTPListenPort;
+      portStrTLS = builtins.toString server.services.h2o.defaultTLSListenPort;
     in
     # python
     ''
diff --git a/nixos/tests/web-servers/h2o/mruby.nix b/nixos/tests/web-servers/h2o/mruby.nix
index b99a4c840b15..803e6c96de83 100644
--- a/nixos/tests/web-servers/h2o/mruby.nix
+++ b/nixos/tests/web-servers/h2o/mruby.nix
@@ -3,8 +3,6 @@
 let
   domain = "h2o.local";
 
-  port = 8080;
-
   sawatdi_chao_lok = "สวัสดีชาวโลก";
 in
 {
@@ -22,7 +20,7 @@ in
           enable = true;
           package = pkgs.h2o.override { withMruby = true; };
           settings = {
-            listen = port;
+            listen = 8080;
             hosts = {
               "${domain}" = {
                 paths = {
@@ -50,8 +48,10 @@ in
   };
 
   testScript =
+    { nodes, ... }:
     let
-      portStr = builtins.toString port;
+      inherit (nodes) server;
+      portStr = builtins.toString server.services.h2o.settings.listen;
     in
     # python
     ''
diff --git a/nixos/tests/web-servers/h2o/tls-recommendations.nix b/nixos/tests/web-servers/h2o/tls-recommendations.nix
index a99725f19b10..be80b9ee9e38 100644
--- a/nixos/tests/web-servers/h2o/tls-recommendations.nix
+++ b/nixos/tests/web-servers/h2o/tls-recommendations.nix
@@ -2,7 +2,6 @@
 
 let
   domain = "acme.test";
-  port = 8443;
 
   hello_txt =
     name:
@@ -13,7 +12,12 @@ let
 
   mkH2OServer =
     recommendations:
-    { pkgs, lib, ... }:
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
     {
       services.h2o = {
         enable = true;
@@ -31,7 +35,8 @@ let
         hosts = {
           "${domain}" = {
             tls = {
-              inherit port recommendations;
+              inherit recommendations;
+              port = 8443;
               policy = "force";
               identity = [
                 {
@@ -59,7 +64,9 @@ let
       ];
 
       networking = {
-        firewall.allowedTCPPorts = [ port ];
+        firewall.allowedTCPPorts = [
+          config.services.h2o.hosts.${domain}.tls.port
+        ];
         extraHosts = "127.0.0.1 ${domain}";
       };
     };
@@ -78,43 +85,47 @@ in
   };
 
   testScript =
+    { nodes, ... }:
     let
-      portStr = builtins.toString port;
+      inherit (nodes) server_modern server_intermediate server_old;
+      modernPortStr = builtins.toString server_modern.services.h2o.hosts.${domain}.tls.port;
+      intermediatePortStr = builtins.toString server_intermediate.services.h2o.hosts.${domain}.tls.port;
+      oldPortStr = builtins.toString server_old.services.h2o.hosts.${domain}.tls.port;
     in
     # python
     ''
-      curl_basic = "curl -v --tlsv1.3 --http2 'https://${domain}:${portStr}/'"
-      curl_head = "curl -v --head 'https://${domain}:${portStr}/'"
-      curl_max_tls1_2 ="curl -v --tlsv1.0 --tls-max 1.2 'https://${domain}:${portStr}/'"
-      curl_max_tls1_2_intermediate_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' 'https://${domain}:${portStr}/'"
-      curl_max_tls1_2_old_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256' 'https://${domain}:${portStr}/'"
+      curl_basic = "curl -v --tlsv1.3 --http2 'https://${domain}:{port}/'"
+      curl_head = "curl -v --head 'https://${domain}:{port}/'"
+      curl_max_tls1_2 ="curl -v --tlsv1.0 --tls-max 1.2 'https://${domain}:{port}/'"
+      curl_max_tls1_2_intermediate_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' 'https://${domain}:{port}/'"
+      curl_max_tls1_2_old_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256' 'https://${domain}:{port}/'"
 
       server_modern.wait_for_unit("h2o.service")
-      server_modern.wait_for_open_port(${portStr})
-      modern_response = server_modern.succeed(curl_basic)
+      server_modern.wait_for_open_port(${modernPortStr})
+      modern_response = server_modern.succeed(curl_basic.format(port="${modernPortStr}"))
       assert "Hello, modern!" in modern_response
-      modern_head = server_modern.succeed(curl_head)
+      modern_head = server_modern.succeed(curl_head.format(port="${modernPortStr}"))
       assert "strict-transport-security" in modern_head
-      server_modern.fail(curl_max_tls1_2)
+      server_modern.fail(curl_max_tls1_2.format(port="${modernPortStr}"))
 
       server_intermediate.wait_for_unit("h2o.service")
-      server_intermediate.wait_for_open_port(${portStr})
-      intermediate_response = server_intermediate.succeed(curl_basic)
+      server_intermediate.wait_for_open_port(${intermediatePortStr})
+      intermediate_response = server_intermediate.succeed(curl_basic.format(port="${intermediatePortStr}"))
       assert "Hello, intermediate!" in intermediate_response
-      intermediate_head = server_modern.succeed(curl_head)
+      intermediate_head = server_modern.succeed(curl_head.format(port="${intermediatePortStr}"))
       assert "strict-transport-security" in intermediate_head
-      server_intermediate.succeed(curl_max_tls1_2)
-      server_intermediate.succeed(curl_max_tls1_2_intermediate_cipher)
-      server_intermediate.fail(curl_max_tls1_2_old_cipher)
+      server_intermediate.succeed(curl_max_tls1_2.format(port="${intermediatePortStr}"))
+      server_intermediate.succeed(curl_max_tls1_2_intermediate_cipher.format(port="${intermediatePortStr}"))
+      server_intermediate.fail(curl_max_tls1_2_old_cipher.format(port="${intermediatePortStr}"))
 
       server_old.wait_for_unit("h2o.service")
-      server_old.wait_for_open_port(${portStr})
-      old_response = server_old.succeed(curl_basic)
+      server_old.wait_for_open_port(${oldPortStr})
+      old_response = server_old.succeed(curl_basic.format(port="${oldPortStr}"))
       assert "Hello, old!" in old_response
-      old_head = server_modern.succeed(curl_head)
+      old_head = server_modern.succeed(curl_head.format(port="${oldPortStr}"))
       assert "strict-transport-security" in old_head
-      server_old.succeed(curl_max_tls1_2)
-      server_old.succeed(curl_max_tls1_2_intermediate_cipher)
-      server_old.succeed(curl_max_tls1_2_old_cipher)
+      server_old.succeed(curl_max_tls1_2.format(port="${oldPortStr}"))
+      server_old.succeed(curl_max_tls1_2_intermediate_cipher.format(port="${oldPortStr}"))
+      server_old.succeed(curl_max_tls1_2_old_cipher.format(port="${oldPortStr}"))
     '';
 }

From cb89189157d6db26a9eb37b155defee5a6a9a1a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Sun, 9 Nov 2025 13:21:23 +0700
Subject: [PATCH 14/34] nixos/tests/h2o: use client to check + start_all()
 machines

---
 nixos/tests/web-servers/h2o/basic.nix         | 46 +++++++++++++------
 nixos/tests/web-servers/h2o/mruby.nix         | 23 +++++++---
 .../web-servers/h2o/tls-recommendations.nix   |  4 ++
 3 files changed, 52 insertions(+), 21 deletions(-)

diff --git a/nixos/tests/web-servers/h2o/basic.nix b/nixos/tests/web-servers/h2o/basic.nix
index 9b67f3397536..6c8c863475c0 100644
--- a/nixos/tests/web-servers/h2o/basic.nix
+++ b/nixos/tests/web-servers/h2o/basic.nix
@@ -36,12 +36,8 @@ in
 
   nodes = {
     server =
-      { pkgs, config, ... }:
+      { config, ... }:
       {
-        environment.systemPackages = [
-          pkgs.curl
-        ];
-
         services.h2o = {
           enable = true;
           defaultHTTPListenPort = 8080;
@@ -111,12 +107,30 @@ in
             ];
           };
           extraHosts = ''
-            127.0.0.1 ${domain.HTTP}
-            127.0.0.1 ${domain.TLS}
+            ${config.networking.primaryIPAddress} ${domain.HTTP}
+            ${config.networking.primaryIPAddress} ${domain.TLS}
           '';
         };
       };
+
+    client =
+      { nodes, pkgs, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.curl
+        ];
+
+        security.pki.certificates = [
+          (builtins.readFile ../../common/acme/server/ca.cert.pem)
+        ];
+
+        networking.extraHosts = ''
+          ${nodes.server.networking.primaryIPAddress} ${domain.HTTP}
+          ${nodes.server.networking.primaryIPAddress} ${domain.TLS}
+        '';
+      };
   };
+
   testScript =
     { nodes, ... }:
     let
@@ -126,30 +140,32 @@ in
     in
     # python
     ''
+      start_all()
+
       server.wait_for_unit("h2o.service")
       server.wait_for_open_port(${portStrHTTP})
       server.wait_for_open_port(${portStrTLS})
 
-      assert "${sawatdi_chao_lok}" in server.succeed("curl --fail-with-body 'http://${domain.HTTP}:${portStrHTTP}/hello_world.txt'")
+      assert "${sawatdi_chao_lok}" in client.succeed("curl --fail-with-body 'http://${domain.HTTP}:${portStrHTTP}/hello_world.txt'")
 
-      tls_hello_world_head = server.succeed("curl -v --head --compressed --http2 --tlsv1.3 --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'").lower()
+      tls_hello_world_head = client.succeed("curl -v --head --compressed --http2 --tlsv1.3 --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'").lower()
       assert "http/2 200" in tls_hello_world_head
       assert "server: h2o" in tls_hello_world_head
       assert "content-type: text/x-rst" in tls_hello_world_head
 
-      assert "${sawatdi_chao_lok}" in server.succeed("curl -v --http2 --tlsv1.3 --compressed --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'")
+      assert "${sawatdi_chao_lok}" in client.succeed("curl -v --http2 --tlsv1.3 --compressed --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'")
 
-      quic_hello_world_head = server.succeed("curl -v --head --compressed --http3-only --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'").lower()
+      quic_hello_world_head = client.succeed("curl -v --head --compressed --http3-only --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'").lower()
       assert "http/3 200" in quic_hello_world_head
       assert "server: h2o" in quic_hello_world_head
       assert "content-type: text/x-rst" in quic_hello_world_head
 
-      assert "${sawatdi_chao_lok}" in server.succeed("curl -v --http3-only --compressed --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'")
+      assert "${sawatdi_chao_lok}" in client.succeed("curl -v --http3-only --compressed --fail-with-body 'https://${domain.TLS}:${portStrTLS}/hello_world.rst'")
 
-      assert "redirected" in server.succeed("curl -v --head --fail-with-body 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'").lower()
+      assert "redirected" in client.succeed("curl -v --head --fail-with-body 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'").lower()
 
-      server.fail("curl --location --max-redirs 0 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'")
+      client.fail("curl --location --max-redirs 0 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'")
 
-      assert "${sawatdi_chao_lok}" in server.succeed("curl -v --location --fail-with-body 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'")
+      assert "${sawatdi_chao_lok}" in client.succeed("curl -v --location --fail-with-body 'http://${domain.TLS}:${portStrHTTP}/hello_world.rst'")
     '';
 }
diff --git a/nixos/tests/web-servers/h2o/mruby.nix b/nixos/tests/web-servers/h2o/mruby.nix
index 803e6c96de83..c9a4d95c056b 100644
--- a/nixos/tests/web-servers/h2o/mruby.nix
+++ b/nixos/tests/web-servers/h2o/mruby.nix
@@ -14,7 +14,7 @@ in
 
   nodes = {
     server =
-      { pkgs, ... }:
+      { pkgs, config, ... }:
       {
         services.h2o = {
           enable = true;
@@ -41,9 +41,17 @@ in
           };
         };
 
-        networking.extraHosts = ''
-          127.0.0.1 ${domain}
-        '';
+        networking.firewall.allowedTCPPorts = [
+          config.services.h2o.settings.listen
+        ];
+      };
+
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          pkgs.curl
+        ];
       };
   };
 
@@ -52,14 +60,17 @@ in
     let
       inherit (nodes) server;
       portStr = builtins.toString server.services.h2o.settings.listen;
+      origin = "http://server:${portStr}";
     in
     # python
     ''
+      start_all()
+
       server.wait_for_unit("h2o.service")
       server.wait_for_open_port(${portStr})
 
-      assert "${sawatdi_chao_lok}" in server.succeed("curl --fail-with-body http://${domain}:${portStr}/hello_world")
+      assert "${sawatdi_chao_lok}" in client.succeed("curl --fail-with-body ${origin}/hello_world")
 
-      assert "FILE_HANDLER" in server.succeed("curl --fail-with-body http://${domain}:${portStr}/file_handler")
+      assert "FILE_HANDLER" in client.succeed("curl --fail-with-body ${origin}/file_handler")
     '';
 }
diff --git a/nixos/tests/web-servers/h2o/tls-recommendations.nix b/nixos/tests/web-servers/h2o/tls-recommendations.nix
index be80b9ee9e38..0fca6dbbb1b9 100644
--- a/nixos/tests/web-servers/h2o/tls-recommendations.nix
+++ b/nixos/tests/web-servers/h2o/tls-recommendations.nix
@@ -78,6 +78,8 @@ in
     maintainers = with lib.maintainers; [ toastal ];
   };
 
+  # not using a `client` since it’s easiest to test with acme.test pointing at
+  # localhost for these machines
   nodes = {
     server_modern = mkH2OServer "modern";
     server_intermediate = mkH2OServer "intermediate";
@@ -100,6 +102,8 @@ in
       curl_max_tls1_2_intermediate_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' 'https://${domain}:{port}/'"
       curl_max_tls1_2_old_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256' 'https://${domain}:{port}/'"
 
+      start_all()
+
       server_modern.wait_for_unit("h2o.service")
       server_modern.wait_for_open_port(${modernPortStr})
       modern_response = server_modern.succeed(curl_basic.format(port="${modernPortStr}"))

From a01aeeb9b1bb9a646bdbc2f590b29285bf65a3e7 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 9 Nov 2025 19:23:47 +0100
Subject: [PATCH 15/34] lib/modules: Add false positive info to check coherence
 assertion

Unfortunately, we don't have a good enough way to discern this
possibility. Technically we could add yet another attribute, but
that does not seem to be worth the cost at this point, in terms
of complexity and possibly even performance.

I take the blame for this one. I identified the need for the second
merge commit in review but didn't require it in the first merge.
These changes really should have been done in a single merge.
That would have prevented this situation.
---
 lib/modules.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/modules.nix b/lib/modules.nix
index a78bd1a92488..e545f9c9707d 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -1147,6 +1147,9 @@ let
         instead of:
 
           baseType // { check = value: /* your check */; }
+
+        Alternatively, this message may also occur as false positive when mixing Nixpkgs
+        versions, if one Nixpkgs is between 83fed2e6..58696117 (Aug 28 - Oct 28 2025)
       '';
 
   # Merge definitions of a value of a given type.

From 1074781d345dd31d1096121681a897f28edc62e4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 10 Nov 2025 11:16:52 +0000
Subject: [PATCH 16/34] z3: 4.15.3 -> 4.15.4

---
 pkgs/by-name/z3/z3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/z3/z3/package.nix b/pkgs/by-name/z3/z3/package.nix
index 4d56cbb93755..0ca299fbd846 100644
--- a/pkgs/by-name/z3/z3/package.nix
+++ b/pkgs/by-name/z3/z3/package.nix
@@ -28,13 +28,13 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "z3";
-  version = "4.15.3";
+  version = "4.15.4";
 
   src = fetchFromGitHub {
     owner = "Z3Prover";
     repo = "z3";
     rev = "z3-${finalAttrs.version}";
-    hash = "sha256-Lw037Z0t0ySxkgMXkbjNW5CB4QQLRrrSEBsLJqiomZ4=";
+    hash = "sha256-eyF3ELv81xEgh9Km0Ehwos87e4VJ82cfsp53RCAtuTo=";
   };
 
   patches = lib.optionals useCmakeBuild [

From 6f9fd01bc1e2e8962ebfdc4c22c136e0c48653a3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 10 Nov 2025 13:41:34 +0000
Subject: [PATCH 17/34] toml-f: 0.4.2 -> 0.4.3

---
 pkgs/by-name/to/toml-f/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/to/toml-f/package.nix b/pkgs/by-name/to/toml-f/package.nix
index 9b82c4ce6f57..aef8af6711b4 100644
--- a/pkgs/by-name/to/toml-f/package.nix
+++ b/pkgs/by-name/to/toml-f/package.nix
@@ -20,13 +20,13 @@ assert (
 
 stdenv.mkDerivation rec {
   pname = "toml-f";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "toml-f";
     repo = "toml-f";
     rev = "v${version}";
-    hash = "sha256-+cac4rUNpd2w3yBdH1XoCKdJ9IgOHZioZg8AhzGY0FE=";
+    hash = "sha256-QRghnzsLGuQ5MHoVVTDg6ACtwVIkIRexNx/zrrQ0Icc=";
   };
 
   patches = [

From 1ce4af8d88b060023ec99e6281b8e11a11342fc7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 10 Nov 2025 16:27:15 +0000
Subject: [PATCH 18/34] bikeshed: 5.3.4 -> 5.4.0

---
 pkgs/by-name/bi/bikeshed/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bi/bikeshed/package.nix b/pkgs/by-name/bi/bikeshed/package.nix
index f7f48af594ea..bd5df8ca9e6b 100644
--- a/pkgs/by-name/bi/bikeshed/package.nix
+++ b/pkgs/by-name/bi/bikeshed/package.nix
@@ -6,12 +6,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "bikeshed";
-  version = "5.3.4";
+  version = "5.4.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QcypdeFIzEt2cx8PWWWhnMMhnc2oEWZUOm8kge4KJQY=";
+    hash = "sha256-lI05x3IYiXyInjm/It8c3JwR1H1m6VVBuehjKiNEZzo=";
   };
 
   build-system = [ python3Packages.setuptools ];

From e2e42a4e9fe164ea81b73139825f4815b8df941b Mon Sep 17 00:00:00 2001
From: Schahin Rouhanizadeh <schahin@rouhanizadeh.de>
Date: Mon, 10 Nov 2025 18:21:22 +0100
Subject: [PATCH 19/34] maintainers: add SchahinRohani

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 689b137da2f2..f1950d6b1a3d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -23249,6 +23249,12 @@
     github = "scd31";
     githubId = 57571338;
   };
+  SchahinRohani = {
+    email = "schahin@rouhanizadeh.de";
+    github = "SchahinRohani";
+    githubId = 24507823;
+    name = "Schahin Rouhanizadeh";
+  };
   schinmai-akamai = {
     email = "schinmai@akamai.com";
     github = "tchinmai7";

From 01b0c2aab8839254667b89769c2dd9e07f589233 Mon Sep 17 00:00:00 2001
From: Schahin Rouhanizadeh <schahin@rouhanizadeh.de>
Date: Mon, 10 Nov 2025 18:22:41 +0100
Subject: [PATCH 20/34] flyctl: add SchahinRohani as maintainer

---
 pkgs/by-name/fl/flyctl/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/fl/flyctl/package.nix b/pkgs/by-name/fl/flyctl/package.nix
index 109016e70fb4..31d17695f3fe 100644
--- a/pkgs/by-name/fl/flyctl/package.nix
+++ b/pkgs/by-name/fl/flyctl/package.nix
@@ -78,6 +78,7 @@ buildGoModule rec {
       jsierles
       techknowlogick
       RaghavSood
+      SchahinRohani
     ];
     mainProgram = "flyctl";
   };

From e707a4eb7f23b3ae54494e2a566ef52c6cf5a798 Mon Sep 17 00:00:00 2001
From: Schahin Rouhanizadeh <schahin@rouhanizadeh.de>
Date: Mon, 10 Nov 2025 18:24:33 +0100
Subject: [PATCH 21/34] flyctl: 0.3.172 -> 0.3.209

---
 pkgs/by-name/fl/flyctl/package.nix | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fl/flyctl/package.nix b/pkgs/by-name/fl/flyctl/package.nix
index 31d17695f3fe..4f6a45b2b426 100644
--- a/pkgs/by-name/fl/flyctl/package.nix
+++ b/pkgs/by-name/fl/flyctl/package.nix
@@ -6,20 +6,23 @@
   testers,
   flyctl,
   installShellFiles,
+  git,
 }:
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.3.172";
+  version = "0.3.209";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-jKzlKOdE+SrCzY81ciI9sKN0iiFZMsKp04A+1TV1+i0=";
+    leaveDotGit = true;
+    hash = "sha256-D1MSlg6oFmdyiEaq10DUwzADzleilFIQ22oQd8LGfRk=";
   };
 
-  vendorHash = "sha256-D6b+dLoE4IdhsmnWILe7Thkggq3p0ur4C3BOz7Cuk98=";
+  proxyVendor = true;
+  vendorHash = "sha256-ezGA1LGwQVFMzV/Ogj26pooD06O7FNTXMrYWkv6AwWM=";
 
   subPackages = [ "." ];
 
@@ -31,11 +34,17 @@ buildGoModule rec {
   ];
   tags = [ "production" ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    git
+  ];
 
   patches = [ ./disable-auto-update.patch ];
 
   preBuild = ''
+    # Embed VCS Infos
+    export GOFLAGS="$GOFLAGS -buildvcs=true"
+
     GOOS= GOARCH= CGO_ENABLED=0 go generate ./...
   '';
 

From c1a4f1da330ddccf48fed947763ddc6d6e45f8de Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 10 Nov 2025 20:28:53 +0100
Subject: [PATCH 22/34] python313Packages.pygitguardian: 1.25.0 -> 1.26.0

Diff: https://github.com/GitGuardian/py-gitguardian/compare/v1.25.0...v1.26.0

Changelog: https://github.com/GitGuardian/py-gitguardian/blob/v1.26.0/CHANGELOG.md
---
 pkgs/development/python-modules/pygitguardian/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pygitguardian/default.nix b/pkgs/development/python-modules/pygitguardian/default.nix
index 2c5468f77363..ec4cd9420f14 100644
--- a/pkgs/development/python-modules/pygitguardian/default.nix
+++ b/pkgs/development/python-modules/pygitguardian/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pygitguardian";
-  version = "1.25.0";
+  version = "1.26.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "GitGuardian";
     repo = "py-gitguardian";
     tag = "v${version}";
-    hash = "sha256-XcmLaEnQ5cUTd71xvgvdS418RGOzpKydUDoSdVC/mgo=";
+    hash = "sha256-CwGmNyY4U1vt7CHuO4nS1TuUJWm6Ok8vIE3kRG/qles=";
   };
 
   pythonRelaxDeps = [

From c348d5656e5028db9b602e4c6c5b62cc80efd765 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 10 Nov 2025 14:34:51 -0800
Subject: [PATCH 23/34] python3Packages.aiomusiccast: 0.14.8 -> 0.15.0

Diff: https://github.com/vigonotion/aiomusiccast/compare/0.14.8...0.15.0

Changelog: https://github.com/vigonotion/aiomusiccast/releases/tag/0.15.0
---
 .../python-modules/aiomusiccast/default.nix   | 25 ++++++++-----------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/aiomusiccast/default.nix b/pkgs/development/python-modules/aiomusiccast/default.nix
index 3ec1903f0228..5e6d1f494344 100644
--- a/pkgs/development/python-modules/aiomusiccast/default.nix
+++ b/pkgs/development/python-modules/aiomusiccast/default.nix
@@ -1,25 +1,21 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
-  poetry-core,
+  hatchling,
   aiohttp,
-  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "aiomusiccast";
-  version = "0.14.8";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.8";
+  version = "0.15.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "vigonotion";
     repo = "aiomusiccast";
     tag = version;
-    hash = "sha256-V4xl2QY+pPEnJtx7dxSNj/aXqHvV9Z6uuWgbVHNyLjA=";
+    hash = "sha256-oFA8i/cdDqOQ9Fq0VWd8eiOg8F1+MNxWanNqoao5+pM=";
   };
 
   postPatch = ''
@@ -27,11 +23,10 @@ buildPythonPackage rec {
       --replace '"0.0.0"' '"${version}"'
   '';
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
-    setuptools
   ];
 
   # upstream has no tests
@@ -39,11 +34,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "aiomusiccast" ];
 
-  meta = with lib; {
+  meta = {
     description = "Companion library for musiccast devices intended for the Home Assistant integration";
     homepage = "https://github.com/vigonotion/aiomusiccast";
-    changelog = "https://github.com/vigonotion/aiomusiccast/releases/tag/${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ dotlambda ];
+    changelog = "https://github.com/vigonotion/aiomusiccast/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 }

From 25481c5e851d8a509f5013914f8e2ce2b2c51a28 Mon Sep 17 00:00:00 2001
From: Matteo Pacini <m+github@matteopacini.me>
Date: Mon, 10 Nov 2025 23:45:18 +0000
Subject: [PATCH 24/34] opensupaplex: modernize

---
 pkgs/by-name/op/opensupaplex/package.nix | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/op/opensupaplex/package.nix b/pkgs/by-name/op/opensupaplex/package.nix
index b1cbe51469f0..9181bd82045f 100644
--- a/pkgs/by-name/op/opensupaplex/package.nix
+++ b/pkgs/by-name/op/opensupaplex/package.nix
@@ -18,15 +18,15 @@ let
     sha256 = "sha256-nKeSBUGjSulbEP7xxc6smsfCRjyc/xsLykH0o3Rq5wo=";
   };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "opensupaplex";
   version = "7.1.2";
 
   src = fetchFromGitHub {
     owner = "sergiou87";
     repo = "open-supaplex";
-    rev = "v${version}";
-    sha256 = "sha256-hP8dJlLXE5J/oxPhRkrrBl1Y5e9MYbJKi8OApFM3+GU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hP8dJlLXE5J/oxPhRkrrBl1Y5e9MYbJKi8OApFM3+GU=";
   };
 
   nativeBuildInputs = [
@@ -66,18 +66,17 @@ stdenv.mkDerivation rec {
   passthru.tests.version = testers.testVersion {
     package = opensupaplex;
     command = "opensupaplex --help";
-    version = "v${version}";
+    version = "v${finalAttrs.version}";
   };
 
   desktopItems = [
     (makeDesktopItem {
       name = "opensupaplex";
-      exec = meta.mainProgram;
+      exec = finalAttrs.meta.mainProgram;
       icon = "open-supaplex";
       desktopName = "OpenSupaplex";
-      comment = meta.description;
+      comment = finalAttrs.meta.description;
       categories = [
-        "Application"
         "Game"
       ];
     })
@@ -86,10 +85,10 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Decompilation of Supaplex in C and SDL";
     homepage = "https://github.com/sergiou87/open-supaplex";
-    changelog = "https://github.com/sergiou87/open-supaplex/blob/master/changelog/v${version}.txt";
+    changelog = "https://github.com/sergiou87/open-supaplex/blob/master/changelog/v${finalAttrs.version}.txt";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ matteopacini ];
     platforms = lib.platforms.linux; # Many more are supported upstream, but only linux is tested.
     mainProgram = "opensupaplex";
   };
-}
+})

From f8960b06c25d07d0f3b0e5ef91b7e91e0c231246 Mon Sep 17 00:00:00 2001
From: Matteo Pacini <m+github@matteopacini.me>
Date: Mon, 10 Nov 2025 23:46:10 +0000
Subject: [PATCH 25/34] opensupaplex: darwin support

---
 pkgs/by-name/op/opensupaplex/darwin.patch       | 16 ++++++++++++++++
 pkgs/by-name/op/opensupaplex/package.nix        | 15 ++++++++++++++-
 .../op/opensupaplex/reproducible-build.patch    | 17 +++++++++++++++++
 3 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/op/opensupaplex/darwin.patch
 create mode 100644 pkgs/by-name/op/opensupaplex/reproducible-build.patch

diff --git a/pkgs/by-name/op/opensupaplex/darwin.patch b/pkgs/by-name/op/opensupaplex/darwin.patch
new file mode 100644
index 000000000000..7db9432f7302
--- /dev/null
+++ b/pkgs/by-name/op/opensupaplex/darwin.patch
@@ -0,0 +1,16 @@
+diff --git a/src/sdl_common/audio.c b/src/sdl_common/audio.c
+index 797c678..ebb9eda 100644
+--- a/src/sdl_common/audio.c
++++ b/src/sdl_common/audio.c
+@@ -25,11 +25,7 @@
+ 
+ #if HAVE_SDL2
+ #include <SDL2/SDL.h>
+-#if TARGET_OS_MAC
+-#include <SDL2_mixer/SDL_mixer.h>
+-#else
+ #include <SDL2/SDL_mixer.h>
+-#endif
+ #elif HAVE_SDL
+ #include <SDL/SDL.h>
+ #include <SDL/SDL_mixer.h>
diff --git a/pkgs/by-name/op/opensupaplex/package.nix b/pkgs/by-name/op/opensupaplex/package.nix
index 9181bd82045f..cb95343bec73 100644
--- a/pkgs/by-name/op/opensupaplex/package.nix
+++ b/pkgs/by-name/op/opensupaplex/package.nix
@@ -9,6 +9,7 @@
   opensupaplex,
   SDL2,
   SDL2_mixer,
+  desktopToDarwinBundle,
 }:
 
 let
@@ -29,10 +30,19 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-hP8dJlLXE5J/oxPhRkrrBl1Y5e9MYbJKi8OApFM3+GU=";
   };
 
+  patches = [
+    ./reproducible-build.patch
+    ./darwin.patch
+  ];
+
   nativeBuildInputs = [
     SDL2 # For "sdl2-config"
     copyDesktopItems
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    desktopToDarwinBundle
   ];
+
   buildInputs = [ SDL2_mixer ];
 
   enableParallelBuilding = true;
@@ -82,13 +92,16 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  # Strip only the main binary, not the data files which would corrupt them.
+  stripExclude = [ "lib/opensupaplex/*" ];
+
   meta = {
     description = "Decompilation of Supaplex in C and SDL";
     homepage = "https://github.com/sergiou87/open-supaplex";
     changelog = "https://github.com/sergiou87/open-supaplex/blob/master/changelog/v${finalAttrs.version}.txt";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ matteopacini ];
-    platforms = lib.platforms.linux; # Many more are supported upstream, but only linux is tested.
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "opensupaplex";
   };
 })
diff --git a/pkgs/by-name/op/opensupaplex/reproducible-build.patch b/pkgs/by-name/op/opensupaplex/reproducible-build.patch
new file mode 100644
index 000000000000..3c2a14917064
--- /dev/null
+++ b/pkgs/by-name/op/opensupaplex/reproducible-build.patch
@@ -0,0 +1,17 @@
+diff --git a/linux/Makefile b/linux/Makefile
+index 6041a89..588341c 100644
+--- a/linux/Makefile
++++ b/linux/Makefile
+@@ -5,6 +5,12 @@ LDFLAGS += -lSDL2_mixer -lvorbis -logg `sdl2-config --libs` -lm
+ 
+ CFLAGS += `sdl2-config --cflags` -DHAVE_SDL2
+ 
++UNAME_S := $(shell uname -s)
++ifeq ($(UNAME_S),Darwin)
++# Darwin-specific reproducible build flags
++LDFLAGS += -Wl,-no_uuid
++endif
++
+ opensupaplex: $(obj)
+ 	$(CC) -o $@ $^ $(LDFLAGS)
+ 

From 75d4287f7e518bcb56f8c49cf74b74d0529af430 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 11 Nov 2025 00:37:07 +0000
Subject: [PATCH 26/34] myks: 5.1.0 -> 5.2.0

---
 pkgs/by-name/my/myks/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/my/myks/package.nix b/pkgs/by-name/my/myks/package.nix
index 69db57b6e89b..1d14a6d1b691 100644
--- a/pkgs/by-name/my/myks/package.nix
+++ b/pkgs/by-name/my/myks/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "myks";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "mykso";
     repo = "myks";
     tag = "v${version}";
-    hash = "sha256-nVm5AmfKfoBDBIFt2g4PXc5Ff2kbrBGTThqdpslpYow=";
+    hash = "sha256-Uywbhz+dMX49fYOypybNLP8Jrvxo8gN/YAOcODcThM8=";
   };
 
-  vendorHash = "sha256-jprXaNd/S2fJcejSG5nH7rvg/yNmRRRgCOkJrUkiwmY=";
+  vendorHash = "sha256-GZWXiL8VJTx0EcwWKy4jryr1jzoT44tWO2U7TCjhhfU=";
 
   subPackages = ".";
 

From 88c2af43cca9d41fc5934ad323743e5743802dd1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 11 Nov 2025 01:28:18 +0000
Subject: [PATCH 27/34] dwarf-fortress-packages.dwarf-fortress-original: 53.02
 -> 53.03

---
 pkgs/games/dwarf-fortress/df.lock.json | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/pkgs/games/dwarf-fortress/df.lock.json b/pkgs/games/dwarf-fortress/df.lock.json
index a31c7c48efde..edc7c2755a7a 100644
--- a/pkgs/games/dwarf-fortress/df.lock.json
+++ b/pkgs/games/dwarf-fortress/df.lock.json
@@ -1,28 +1,28 @@
 {
   "game": {
     "latest": {
-      "linux": "53.02",
+      "linux": "53.03",
       "darwin": "0.47.05"
     },
     "versions": {
-      "53.02": {
+      "53.03": {
         "df": {
-          "version": "53.02",
+          "version": "53.03",
           "urls": {
             "linux": {
-              "url": "https://www.bay12games.com/dwarves/df_53_02_linux.tar.bz2",
-              "outputHash": "sha256-SprD05MMynNCBr2oKnBYvimm+RmOoceEC2MF9IhCc5Q="
+              "url": "https://www.bay12games.com/dwarves/df_53_03_linux.tar.bz2",
+              "outputHash": "sha256-xvpgkUjZzAeayWEK6KFLHoikDZLwh3PnTmosqjlL3m8="
             }
           }
         },
         "hack": {
-          "version": "53.02-r1",
+          "version": "53.03-r1",
           "git": {
             "url": "https://github.com/DFHack/dfhack.git",
-            "revision": "53.02-r1",
-            "outputHash": "sha256-ybDaFYNVhNS1xJU/dD8KBzNu3ceetFbvX7xNp5DLzyU="
+            "revision": "53.03-r1",
+            "outputHash": "sha256-q0IWKUGfpFdA8VyXmmsZvx7v9S2kD7pI0fUr74sj4pU="
           },
-          "xmlRev": "99cb51ac849a17652dbb74efa757df5b5716a9ba"
+          "xmlRev": "145f317340ac9327854318c7ba758ee2af5e1928"
         }
       },
       "52.05": {
@@ -136,12 +136,12 @@
     }
   },
   "therapist": {
-    "version": "42.1.20",
-    "maxDfVersion": "52.05",
+    "version": "42.1.21",
+    "maxDfVersion": "53.02",
     "git": {
       "url": "https://github.com/Dwarf-Therapist/Dwarf-Therapist.git",
-      "revision": "v42.1.20",
-      "outputHash": "sha256-nKMQSDrxhqRRaCDUK7GbexFHdxeD/P9c2UDkiMdWsyU="
+      "revision": "v42.1.21",
+      "outputHash": "sha256-chdMle+HEKwALuef36RjKbijYk+zXcNBWQNsaZXs2us="
     }
   }
 }

From 69b0b93e040fe4d0a3929095292851aa6ca4136a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 11 Nov 2025 01:40:56 +0000
Subject: [PATCH 28/34] home-manager: 0-unstable-2025-11-03 ->
 0-unstable-2025-11-10

---
 pkgs/by-name/ho/home-manager/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix
index d3ba7e38295e..a77fed189b93 100644
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2025-11-03";
+  version = "0-unstable-2025-11-10";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "aa6936bb637e46a49cf1292486200ba41dd4bcf7";
-    hash = "sha256-Y5950vzoyJ8+u4U6dlI/2VEbf3JQnIJsmRWWWcsgpRg=";
+    rev = "37a3d97f2873e0f68711117c34d04b7c7ead8f4e";
+    hash = "sha256-t2U/GLLXHa2+kJkwnFNRVc2fEJ/lUfyZXBE5iKzJdcs=";
   };
 
   nativeBuildInputs = [

From 330e69c5e4979feb6e6b00254667c54524fd8c92 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 11 Nov 2025 01:45:21 +0000
Subject: [PATCH 29/34] nixbit: 0.1.5 -> 0.2.0

---
 pkgs/by-name/ni/nixbit/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixbit/package.nix b/pkgs/by-name/ni/nixbit/package.nix
index 5c507514b6d7..7141ae86fabc 100644
--- a/pkgs/by-name/ni/nixbit/package.nix
+++ b/pkgs/by-name/ni/nixbit/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nixbit";
-  version = "0.1.5";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "pbek";
     repo = "nixbit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DpjLPvmn61rEn6ui8cFfqeZEPYGyCUVVP/V7mQw1l5Y=";
+    hash = "sha256-sMi3hQZCzHbWTgRdqwGy6srfkmmY11B0OIqJKp5/HB0=";
   };
 
   nativeBuildInputs = [

From be50a3118c3722e7a4c60fd886f5392e22ab31d6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 11 Nov 2025 02:25:04 +0000
Subject: [PATCH 30/34] telepresence2: 2.25.0 -> 2.25.1

---
 pkgs/by-name/te/telepresence2/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/telepresence2/package.nix b/pkgs/by-name/te/telepresence2/package.nix
index 92529d59f4be..216fc379a228 100644
--- a/pkgs/by-name/te/telepresence2/package.nix
+++ b/pkgs/by-name/te/telepresence2/package.nix
@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.25.0";
+  version = "2.25.1";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    hash = "sha256-ke3Si55CVc3JJgzwcCXmeGiT1GQKF+8ocrNfiLtRRcA=";
+    hash = "sha256-Itj+tC5OclTXsRdJ6Rh4xQ1YwMSZTTdcRzpUQrmpC0M=";
   };
 
   propagatedBuildInputs = [
@@ -51,7 +51,7 @@ buildGoModule rec {
     export CGO_ENABLED=0
   '';
 
-  vendorHash = "sha256-R+7tw2nX2rM46ETOgcQuwMCRLU23ejtNOGA3Bt/+Guw=";
+  vendorHash = "sha256-iNvvFl05Q/6uXDSYyAijayXfvObmwh6aDR6XmFQkSHI=";
 
   ldflags = [
     "-s"

From b2ddc71a88b17035ac5a89d4bd4b0315de057f80 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 11 Nov 2025 05:56:02 +0000
Subject: [PATCH 31/34] monkeysAudio: 11.80 -> 11.82

---
 pkgs/by-name/mo/monkeysAudio/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mo/monkeysAudio/package.nix b/pkgs/by-name/mo/monkeysAudio/package.nix
index a9874a5aab18..05c8af165a66 100644
--- a/pkgs/by-name/mo/monkeysAudio/package.nix
+++ b/pkgs/by-name/mo/monkeysAudio/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.80";
+  version = "11.82";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-Y1Zeuelx4fAWYm9dCETM47t80b4w2biTBrLujkgH1oA=";
+    hash = "sha256-M/ndWIga0FTqOQcekFRT4sQ3gpPsQKSdOVHmx8kiQZI=";
     stripRoot = false;
   };
 

From a14f80c97ab0b0f459ee10c7d8497889dc91b1c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 11 Nov 2025 07:11:40 +0000
Subject: [PATCH 32/34] geminicommit: 0.5.0 -> 0.6.0

---
 pkgs/by-name/ge/geminicommit/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ge/geminicommit/package.nix b/pkgs/by-name/ge/geminicommit/package.nix
index adca1bc69f2a..2a8c84288da2 100644
--- a/pkgs/by-name/ge/geminicommit/package.nix
+++ b/pkgs/by-name/ge/geminicommit/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "geminicommit";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "tfkhdyt";
     repo = "geminicommit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wUqu6/j9AyD/THblX0w+Wt43FK//WammB6c425pTwbc=";
+    hash = "sha256-PH9IYVlHZuXEzpRvT0luSZej1dFzUyxGzoQ+z79u5kU=";
   };
 
   vendorHash = "sha256-4aVUD16zhzWvgD90gttmoDRoKKb0dRgDdH1HMfgd3LU=";
@@ -29,8 +29,8 @@ buildGoModule (finalAttrs: {
       cmd = finalAttrs.meta.mainProgram;
       goDefaultCmd = finalAttrs.pname;
     in
-    # The official github released binary is renamed since v0.5.0,
-    # see: https://github.com/tfkhdyt/geminicommit/releases/tag/v0.5.0
+    # The official github released binary is renamed since v0.6.0,
+    # see: https://github.com/tfkhdyt/geminicommit/releases/tag/v0.6.0
     # Here we link the old name (which is also the `go build` default name)
     # for backward compatibility:
     ''

From 699808657b7b69ad29aa00fb38c7cdaf24b97b27 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 11 Nov 2025 07:46:13 +0000
Subject: [PATCH 33/34] pyradio: 0.9.3.11.20 -> 0.9.3.11.21

---
 pkgs/by-name/py/pyradio/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/py/pyradio/package.nix b/pkgs/by-name/py/pyradio/package.nix
index f294c5138555..2c6592de1d24 100644
--- a/pkgs/by-name/py/pyradio/package.nix
+++ b/pkgs/by-name/py/pyradio/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.9.3.11.20";
+  version = "0.9.3.11.21";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = "pyradio";
     tag = version;
-    hash = "sha256-dcs9kwuS1/pNtBPhj6Z1VAHFJw/ajwzc2aTWGU/h4W0=";
+    hash = "sha256-elNApj+zslOd2BvXKxLPaCrUhLYBN38yqi6xgFAponI=";
   };
 
   nativeBuildInputs = [

From 783c88af4cf5934d0edffad2bb6b09287083fb83 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Tue, 11 Nov 2025 10:26:21 +0100
Subject: [PATCH 34/34] asciinema_3: use `versionCheckHook`

---
 pkgs/by-name/as/asciinema_3/package.nix | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/as/asciinema_3/package.nix b/pkgs/by-name/as/asciinema_3/package.nix
index d3a841bdbf30..2803cd784ab2 100644
--- a/pkgs/by-name/as/asciinema_3/package.nix
+++ b/pkgs/by-name/as/asciinema_3/package.nix
@@ -4,7 +4,7 @@
   installShellFiles,
   python3,
   rustPlatform,
-  testers,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -12,10 +12,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   version = "3.0.1";
 
   src = fetchFromGitHub {
-    name = "asciinema-source-${finalAttrs.version}";
     owner = "asciinema";
     repo = "asciinema";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-jWRq/LeDdCETiOMkWr9EIWztb14IYGCSo05QPw5HZZk=";
   };
 
@@ -23,6 +22,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   env.ASCIINEMA_GEN_DIR = "gendir";
 
+  strictDeps = true;
+
   nativeCheckInputs = [ python3 ];
   nativeBuildInputs = [ installShellFiles ];
 
@@ -34,14 +35,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --zsh gendir/completion/_asciinema
   '';
 
-  strictDeps = true;
-
-  passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      command = "asciinema --version";
-    };
-  };
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
 
   meta = {
     homepage = "https://asciinema.org/";