From 9acdb8892172f85f7bc40886122d54a20124355b Mon Sep 17 00:00:00 2001
From: Kornelijus Survila <kornholijo@gmail.com>
Date: Wed, 10 Dec 2025 01:02:33 -0700
Subject: [PATCH 01/24] maintainers: add kornholi

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b4ed4ecc2347..bac49b1dcfd9 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13958,6 +13958,12 @@
     githubId = 913109;
     name = "Emil Fresk";
   };
+  kornholi = {
+    email = "kornholijo@gmail.com";
+    github = "kornholi";
+    githubId = 659440;
+    name = "Kornelijus";
+  };
   koschi13 = {
     email = "maximilian.konter@protonmail.com";
     github = "koschi13";

From c2645bc8a1f996ca7acaf4f4f4f8aea4d23f8917 Mon Sep 17 00:00:00 2001
From: Kornelijus Survila <kornholijo@gmail.com>
Date: Wed, 10 Dec 2025 01:05:44 -0700
Subject: [PATCH 02/24] foundationdb: add kornholi as maintainer

---
 pkgs/by-name/fo/foundationdb/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/fo/foundationdb/package.nix b/pkgs/by-name/fo/foundationdb/package.nix
index 4e7b7ee201ab..bea37684bd7b 100644
--- a/pkgs/by-name/fo/foundationdb/package.nix
+++ b/pkgs/by-name/fo/foundationdb/package.nix
@@ -171,6 +171,7 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [
       thoughtpolice
       lostnet
+      kornholi
     ];
   };
 }

From 7d831bec51b321f7d875abfcb3440716b909c746 Mon Sep 17 00:00:00 2001
From: Kornelijus Survila <kornholijo@gmail.com>
Date: Wed, 10 Dec 2025 00:41:15 -0700
Subject: [PATCH 03/24] foundationdb: do not statically link
 libcxx/libstdc++/libgcc

FDB defaults to statically linking libcxx, libstdc++, and libgcc. This leads
to non-obvious problems when the dependencies bring in their own copies. Do
not do that as we're not trying to build and package portable binaries.

Fixes #319537.
Fixes #378888.
---
 pkgs/by-name/fo/foundationdb/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/fo/foundationdb/package.nix b/pkgs/by-name/fo/foundationdb/package.nix
index bea37684bd7b..4929c546d61c 100644
--- a/pkgs/by-name/fo/foundationdb/package.nix
+++ b/pkgs/by-name/fo/foundationdb/package.nix
@@ -107,6 +107,12 @@ stdenv.mkDerivation rec {
 
     "-DBUILD_DOCUMENTATION=FALSE"
 
+    # Disable the default static linking to libc++, libstdc++ and libgcc.
+    #
+    # This leads to various, non-obvious problems as our dependencies bring in
+    # their own copies of these libraries.
+    "-DSTATIC_LINK_LIBCXX=FALSE"
+
     # LTO brings up overall build time, but results in much smaller
     # binaries for all users and the cache.
     "-DUSE_LTO=ON"

From 05a0e8615c7597919b9560d9545ae7f48cd9e136 Mon Sep 17 00:00:00 2001
From: Kornelijus Survila <kornholijo@gmail.com>
Date: Wed, 10 Dec 2025 00:52:53 -0700
Subject: [PATCH 04/24] foundationdb: 7.3.42 -> 7.3.68

This is the latest release validated in production.
---
 pkgs/by-name/fo/foundationdb/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fo/foundationdb/package.nix b/pkgs/by-name/fo/foundationdb/package.nix
index 4929c546d61c..dd4cb12813a5 100644
--- a/pkgs/by-name/fo/foundationdb/package.nix
+++ b/pkgs/by-name/fo/foundationdb/package.nix
@@ -15,6 +15,7 @@
   toml11,
   jemalloc,
   doctest,
+  zlib,
 }:
 let
   boost = boost186;
@@ -29,13 +30,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "foundationdb";
-  version = "7.3.42";
+  version = "7.3.68";
 
   src = fetchFromGitHub {
     owner = "apple";
     repo = "foundationdb";
     tag = version;
-    hash = "sha256-jQcm+HLai5da2pZZ7iLdN6fpQZxf5+/kkfv9OSXQ57c=";
+    hash = "sha256-OaV7YyBggeX3vrnI2EYwlWdIGRHOAeP5OZN0Rmd/dnw=";
   };
 
   patches = [
@@ -80,6 +81,7 @@ stdenv.mkDerivation rec {
     msgpack-cxx
     openssl
     toml11
+    zlib
   ];
 
   checkInputs = [ doctest ];

From e2d490999eb9e4d2f0d387bffd219e4aec21ae1a Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 17 Dec 2025 08:24:09 +0000
Subject: [PATCH 05/24] python3Packages.nanobind: 2.10.1 -> 2.10.2

Diff: https://github.com/wjakob/nanobind/compare/v2.10.1...v2.10.2

Changelog: https://github.com/wjakob/nanobind/blob/v2.10.2/docs/changelog.rst
---
 pkgs/development/python-modules/nanobind/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/nanobind/default.nix b/pkgs/development/python-modules/nanobind/default.nix
index 4c4dd56d8745..6a7683bb5ef2 100644
--- a/pkgs/development/python-modules/nanobind/default.nix
+++ b/pkgs/development/python-modules/nanobind/default.nix
@@ -26,7 +26,7 @@
 }:
 buildPythonPackage rec {
   pname = "nanobind";
-  version = "2.10.1";
+  version = "2.10.2";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     repo = "nanobind";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-LNr3d0ytnkcJOps6DzdZtyiihFwNgv34s5RJsRBD844=";
+    hash = "sha256-io44YhN+VpfHFWyvvLWSanRgbzA0whK8WlDNRi3hahU=";
   };
 
   build-system = [

From f2f3ce2af81912b28e6f99c3f092300cf5b2c860 Mon Sep 17 00:00:00 2001
From: Atlas Yu <pseudoc@163.com>
Date: Fri, 19 Dec 2025 16:57:19 +0800
Subject: [PATCH 06/24] nixos/nixos-generate-config: fix intel-npu imports

The generated configuration during the installation will failed to
evaluate "error: The option `hardware.cpu.intel.npu' does not exist."
on Intel CPUs have NPU support.

- Fix this by adding the missing imports when PCI ID matches.
- Also update the PCI ID list (linux v6.18).

Closes: #470638
---
 .../installer/tools/nixos-generate-config.pl        | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 77139976e7ad..bbd0a093b998 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -205,10 +205,15 @@ sub pciCheck {
         ($device eq "0x4229" || $device eq "0x4230" ||
          $device eq "0x4222" || $device eq "0x4227");
 
-    push @attrs, "hardware.cpu.intel.npu.enable = true;" if
-        $vendor eq "0x8086" &&
-        ($device eq "0x7d1d" || $device eq "0xad1d" ||
-         $device eq "0x643e" || $device eq "0xb03e");
+    # Intel NPU driver
+    # list taken from linux(v6.18): drivers/accel/ivpu/ivpu_drv.h
+    if ($vendor eq "0x8086" &&
+        ($device eq "0xfd3e" || $device eq "0x7d1d" || $device eq "0xad1d" ||
+         $device eq "0x643e" || $device eq "0xb03e"))
+    {
+        push @imports, "(modulesPath + \"/hardware/cpu/intel-npu.nix\")";
+        push @attrs, "hardware.cpu.intel.npu.enable = true;";
+    }
 
     # Assume that all NVIDIA cards are supported by the NVIDIA driver.
     # There may be exceptions (e.g. old cards).

From f37523a63e04d5fdef2743c5605be6212beb5887 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Dec 2025 10:38:59 +0000
Subject: [PATCH 07/24] s7: 11.7-unstable-2025-12-12 ->
 11.7-unstable-2025-12-19

---
 pkgs/by-name/s7/s7/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/s7/s7/package.nix b/pkgs/by-name/s7/s7/package.nix
index 95494ac5e6fb..2e420a04a186 100644
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.7-unstable-2025-12-12";
+  version = "11.7-unstable-2025-12-19";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "0aae934b91975b85eba6de9fb041ec85e55efc8f";
-    hash = "sha256-gjmeP9qKEMrz7dWH5SoLldwZ7wrFswd8gLIN+ae7y5E=";
+    rev = "7fb6a59b5150e6146c6d3df3bb9e9cba7ae449bc";
+    hash = "sha256-nZMvdlaVyI2zH0r8yrZn1ESN+7/Wk2D+OWujzPahnZU=";
   };
 
   buildInputs =

From 15730df1c255c9c5d1d005d7a2a192e6eb7ace81 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Dec 2025 01:07:00 +0000
Subject: [PATCH 08/24] fosrl-olm: 1.2.0 -> 1.3.0

---
 pkgs/by-name/fo/fosrl-olm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/fosrl-olm/package.nix b/pkgs/by-name/fo/fosrl-olm/package.nix
index 5bf3a2eb27ca..99725ad52b3b 100644
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "olm";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "olm";
     tag = version;
-    hash = "sha256-NVd0kPfP9JzCOBoBtz+9MPmuoX353XyOx4L/m9q8zY0=";
+    hash = "sha256-HwmWwGs62Dy/65HTgApuXLv4YRrFzi37A4JoL7vdLdo=";
   };
 
-  vendorHash = "sha256-BhMJ7x4WDOC6pSi9nW4F2H3cumOeoHkbrQ6Xq9njkog=";
+  vendorHash = "sha256-hLnoQof899zLnjbHrzvW2Y3Jj6fegxCVCRnz3XYKCeQ=";
 
   ldflags = [
     "-s"

From acd9e71eccc8897d5364d513a3a33c211c55b1cb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Dec 2025 07:57:48 +0000
Subject: [PATCH 09/24] certinfo-go: 0.1.49 -> 0.1.50

---
 pkgs/by-name/ce/certinfo-go/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ce/certinfo-go/package.nix b/pkgs/by-name/ce/certinfo-go/package.nix
index f3d2dfb75dcf..26e1e6ec53f4 100644
--- a/pkgs/by-name/ce/certinfo-go/package.nix
+++ b/pkgs/by-name/ce/certinfo-go/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "certinfo-go";
-  version = "0.1.49";
+  version = "0.1.50";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "certinfo";
     tag = "v${version}";
-    hash = "sha256-28RlCPr3Y43MmVlzzdXp3fSti1zBGuBIYQMkszggAUs=";
+    hash = "sha256-MR7JYhYGE0WUwsBoie8wWEWqCGdpl+k4eUWIVVS5CEg=";
   };
 
-  vendorHash = "sha256-3Jnk2K1ZBfIXt4Oo8Znxqi6y7JzPG6gAKfZ30gHiFsw=";
+  vendorHash = "sha256-3GjVPV8Lwi4yNbIl/IT0fe9yFlWaqqCU1hzfR8H5r7Y=";
 
   ldflags = [
     "-s"

From 8cfe61aeee6e1e6ac6453ec57d3e58f8c6aa4646 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Tue, 23 Dec 2025 11:28:16 +0100
Subject: [PATCH 10/24] blockbench: 5.0.4 -> 5.0.6

---
 pkgs/by-name/bl/blockbench/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bl/blockbench/package.nix b/pkgs/by-name/bl/blockbench/package.nix
index cdbfd7a99efd..e47e9bcdd314 100644
--- a/pkgs/by-name/bl/blockbench/package.nix
+++ b/pkgs/by-name/bl/blockbench/package.nix
@@ -12,13 +12,13 @@
 
 buildNpmPackage rec {
   pname = "blockbench";
-  version = "5.0.4";
+  version = "5.0.6";
 
   src = fetchFromGitHub {
     owner = "JannisX11";
     repo = "blockbench";
     tag = "v${version}";
-    hash = "sha256-f7+/OXdQEyN9XSkVRDRVUUdNGGEgyu3e/Y2oS7De96Y=";
+    hash = "sha256-AQAyxNVt8PCDCU/jViYY3IlPdNiesgx5kT9W7yrNJ4I=";
   };
 
   nativeBuildInputs = [

From 87a4c9da2cd3b483abfe5f12c16e58843388f27d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Dec 2025 13:57:53 +0000
Subject: [PATCH 11/24] gogup: 0.28.1 -> 0.28.2

---
 pkgs/by-name/go/gogup/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/gogup/package.nix b/pkgs/by-name/go/gogup/package.nix
index aaf667871d58..d85cc4a9a471 100644
--- a/pkgs/by-name/go/gogup/package.nix
+++ b/pkgs/by-name/go/gogup/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gogup";
-  version = "0.28.1";
+  version = "0.28.2";
 
   src = fetchFromGitHub {
     owner = "nao1215";
     repo = "gup";
     rev = "v${version}";
-    hash = "sha256-n8bYmQcVtiuc55a+/LfS44PbVHCUZ7WUAWOmcodcy9Y=";
+    hash = "sha256-ETUCMDF0dU2p/nKC07T2rVtDvKRSatqijRu4PanbxXc=";
   };
 
-  vendorHash = "sha256-ldsGHIKiuVP48taK4kMqtF/xELl+JqAJUCGFKYZdJGU=";
+  vendorHash = "sha256-Dm9g2SA5qYYcmnQ1xApVVvWG7+CaQs5blv7qJOANL8Q=";
   doCheck = false;
 
   ldflags = [

From fc835d293a5ab75ec36199f2da5de5f120a5dc22 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Dec 2025 16:14:31 +0000
Subject: [PATCH 12/24] tutanota-desktop: 315.251204.0 -> 317.251217.0

---
 pkgs/by-name/tu/tutanota-desktop/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/tu/tutanota-desktop/package.nix b/pkgs/by-name/tu/tutanota-desktop/package.nix
index 07547a27c877..a0b7883b676b 100644
--- a/pkgs/by-name/tu/tutanota-desktop/package.nix
+++ b/pkgs/by-name/tu/tutanota-desktop/package.nix
@@ -8,11 +8,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "tutanota-desktop";
-  version = "315.251204.0";
+  version = "317.251217.0";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-abXveYT07uLrM5jJb9gd/u+CzhFnFQj2Zcg+AMp+UC4=";
+    hash = "sha256-XvMeH3WPTO1W7B0QhnJjbXz7k9ViJqOHBHxvopuDjSc=";
   };
 
   extraPkgs = pkgs: [ pkgs.libsecret ];

From 3e790fae7666a18986f26364b7ad6a3917691f0e Mon Sep 17 00:00:00 2001
From: pmenke <info@pmenke.de>
Date: Sat, 20 Dec 2025 19:23:47 +0100
Subject: [PATCH 13/24] sdrplay: fix missing udev rules

udev rules were moved from `66-mirics.rules` into `install_lib.sh` in source.

fixes #472729
---
 pkgs/by-name/sd/sdrplay/linux.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/sd/sdrplay/linux.nix b/pkgs/by-name/sd/sdrplay/linux.nix
index 1f5393b5df5e..48fc7a86c692 100644
--- a/pkgs/by-name/sd/sdrplay/linux.nix
+++ b/pkgs/by-name/sd/sdrplay/linux.nix
@@ -43,12 +43,13 @@ stdenv.mkDerivation rec {
   };
 
   installPhase = ''
-    mkdir -p $out/{bin,lib,include}
+    mkdir -p $out/{bin,lib,include,lib/udev/rules.d}
     libName="libsdrplay_api"
     cp "${arch}/$libName.so.$majorMinorVersion" $out/lib/
     ln -s "$out/lib/$libName.so.$majorMinorVersion" "$out/lib/$libName.so.$majorVersion"
     ln -s "$out/lib/$libName.so.$majorVersion" "$out/lib/$libName.so"
     cp "${arch}/sdrplay_apiService" $out/bin/
     cp -r inc/* $out/include/
+    awk 'index($0, "cat > /etc/udev/rules.d/66-sdrplay.rules"){flag=1; next} /EOF/{flag=0} flag' install_lib.sh > $out/lib/udev/rules.d/66-sdrplay.rules
   '';
 }

From cfed7c575340928b91305defce77d891ec3b682b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Dec 2025 18:04:54 +0000
Subject: [PATCH 14/24] libvmi: 0.14.0-unstable-2025-12-14 ->
 0.14.0-unstable-2025-12-17

---
 pkgs/by-name/li/libvmi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libvmi/package.nix b/pkgs/by-name/li/libvmi/package.nix
index aec24a470286..b9fa32d99f22 100644
--- a/pkgs/by-name/li/libvmi/package.nix
+++ b/pkgs/by-name/li/libvmi/package.nix
@@ -24,14 +24,14 @@
 
 let
   pname = "libvmi";
-  version = "0.14.0-unstable-2025-12-14";
+  version = "0.14.0-unstable-2025-12-17";
   libVersion = "0.0.15";
 
   src = fetchFromGitHub {
     owner = "libvmi";
     repo = "libvmi";
-    rev = "b196d72af1c549a494a321a15f725fbd90cd4686";
-    hash = "sha256-JxATmUI/rsWUF/ChavD0lHNNSeblzV5xtG/4BDcJ9T4=";
+    rev = "77a677aa6621927495f1954eded11e601937798b";
+    hash = "sha256-qwZEU41xhY/prgD72CBOKcQ4GqujXeMlUU+NDRJ9U3M=";
   };
 in
 

From 1f2e0b96395335d95e4ac995af6a67f98d24d514 Mon Sep 17 00:00:00 2001
From: luftmensch-luftmensch <valentinobocchetti59@gmail.com>
Date: Tue, 23 Dec 2025 20:02:31 +0100
Subject: [PATCH 15/24] errands: 46.2.9 -> 46.2.10

---
 pkgs/by-name/er/errands/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/er/errands/package.nix b/pkgs/by-name/er/errands/package.nix
index 410d054f3ac2..b6c9d4842811 100644
--- a/pkgs/by-name/er/errands/package.nix
+++ b/pkgs/by-name/er/errands/package.nix
@@ -18,7 +18,7 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "errands";
-  version = "46.2.9";
+  version = "46.2.10";
 
   pyproject = false;
 
@@ -26,7 +26,7 @@ python3Packages.buildPythonApplication rec {
     owner = "mrvladus";
     repo = "Errands";
     tag = version;
-    hash = "sha256-+x6zp14leFryxwQJdI0UKPp4N0IuJRIX5/94QrlzDAU=";
+    hash = "sha256-YgKn6tBW1gG6H1zEAzaQjJWzSXh4Na44yZ7lfAnqUFA=";
   };
 
   nativeBuildInputs = [

From 34aeafef214e60f58fc81835216a7de9bf8bed06 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Dec 2025 20:57:48 +0000
Subject: [PATCH 16/24] coc-rust-analyzer: 0-unstable-2025-12-15 ->
 0-unstable-2025-12-23

---
 pkgs/by-name/co/coc-rust-analyzer/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/coc-rust-analyzer/package.nix b/pkgs/by-name/co/coc-rust-analyzer/package.nix
index 68bd8a91c9e3..bc6162299386 100644
--- a/pkgs/by-name/co/coc-rust-analyzer/package.nix
+++ b/pkgs/by-name/co/coc-rust-analyzer/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage {
   pname = "coc-rust-analyzer";
-  version = "0-unstable-2025-12-15";
+  version = "0-unstable-2025-12-23";
 
   src = fetchFromGitHub {
     owner = "fannheyward";
     repo = "coc-rust-analyzer";
-    rev = "493f10d0537e82d49eb13aba5f9bc4973f92ed2c";
-    hash = "sha256-MmoI4Bu883PNi6t6MBmMbEd+OTcN/dfOfsbJi2EsnzM=";
+    rev = "e64fabb840a35ad1feeedc88b181dd8593c88d8b";
+    hash = "sha256-npAMi7652BUG4coQjkLIcWcSQ4kH+aDwZXsPsLCeZdY=";
   };
 
   npmDepsHash = "sha256-Qksi1G4YeFU94mIccyMpphER9d/UiCOriqbe0w7LA6c=";

From fd6d844f130bf6e17292599f8cc8c989488194c5 Mon Sep 17 00:00:00 2001
From: Varun Narravula <varun@snare.dev>
Date: Tue, 23 Dec 2025 13:19:33 -0800
Subject: [PATCH 17/24] fosrl-gerbil: add water-sucks to maintainers

---
 pkgs/by-name/fo/fosrl-gerbil/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/fo/fosrl-gerbil/package.nix b/pkgs/by-name/fo/fosrl-gerbil/package.nix
index dd0e9120a9c9..b3f3ff83116a 100644
--- a/pkgs/by-name/fo/fosrl-gerbil/package.nix
+++ b/pkgs/by-name/fo/fosrl-gerbil/package.nix
@@ -33,6 +33,7 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [
       jackr
       sigmasquadron
+      water-sucks
     ];
     platforms = lib.platforms.linux;
   };

From 19337832c62d9cde49840a3e392859f401e60f0e Mon Sep 17 00:00:00 2001
From: Varun Narravula <varun@snare.dev>
Date: Tue, 23 Dec 2025 13:19:47 -0800
Subject: [PATCH 18/24] fosrl-olm: add water-sucks to maintainers

---
 pkgs/by-name/fo/fosrl-olm/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/fo/fosrl-olm/package.nix b/pkgs/by-name/fo/fosrl-olm/package.nix
index 5bf3a2eb27ca..7eb6a0886411 100644
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -32,6 +32,7 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [
       jackr
       sigmasquadron
+      water-sucks
     ];
     mainProgram = "olm";
   };

From 93a73d3f4dc4bc6cec1e61ce4689f97ed251ef81 Mon Sep 17 00:00:00 2001
From: Varun Narravula <varun@snare.dev>
Date: Tue, 23 Dec 2025 13:19:58 -0800
Subject: [PATCH 19/24] fosrl-pangolin: add water-sucks to maintainers

---
 nixos/modules/services/networking/pangolin.nix | 1 +
 nixos/tests/pangolin.nix                       | 1 +
 pkgs/by-name/fo/fosrl-pangolin/package.nix     | 1 +
 3 files changed, 3 insertions(+)

diff --git a/nixos/modules/services/networking/pangolin.nix b/nixos/modules/services/networking/pangolin.nix
index fa2ca634138b..8f5b78ec7e11 100644
--- a/nixos/modules/services/networking/pangolin.nix
+++ b/nixos/modules/services/networking/pangolin.nix
@@ -555,5 +555,6 @@ in
   meta.maintainers = with lib.maintainers; [
     jackr
     sigmasquadron
+    water-sucks
   ];
 }
diff --git a/nixos/tests/pangolin.nix b/nixos/tests/pangolin.nix
index 696f3626cd4e..dc69f8116ae1 100644
--- a/nixos/tests/pangolin.nix
+++ b/nixos/tests/pangolin.nix
@@ -16,6 +16,7 @@ in
   meta.maintainers = with lib.maintainers; [
     jackr
     sigmasquadron
+    water-sucks
   ];
 
   # The full test is not yet implemented, but once upstream supports a way to
diff --git a/pkgs/by-name/fo/fosrl-pangolin/package.nix b/pkgs/by-name/fo/fosrl-pangolin/package.nix
index 818f44b685f8..0d9a1aaad83a 100644
--- a/pkgs/by-name/fo/fosrl-pangolin/package.nix
+++ b/pkgs/by-name/fo/fosrl-pangolin/package.nix
@@ -168,6 +168,7 @@ buildNpmPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       jackr
       sigmasquadron
+      water-sucks
     ];
     platforms = lib.platforms.linux;
     mainProgram = "pangolin";

From 691424f5013f95187aa949771b5a6d3cf91e42a4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Dec 2025 23:28:22 +0000
Subject: [PATCH 20/24] ipxe: 1.21.1-unstable-2025-12-15 ->
 1.21.1-unstable-2025-12-22

---
 pkgs/by-name/ip/ipxe/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ip/ipxe/package.nix b/pkgs/by-name/ip/ipxe/package.nix
index 6a9a8148e969..7ff095a8d759 100644
--- a/pkgs/by-name/ip/ipxe/package.nix
+++ b/pkgs/by-name/ip/ipxe/package.nix
@@ -48,7 +48,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2025-12-15";
+  version = "1.21.1-unstable-2025-12-22";
 
   nativeBuildInputs = [
     mtools
@@ -66,8 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "3d5cd3d79e8d8adb723e9e560a636947e19114a3";
-    hash = "sha256-6wALX6PtiMxZN164eDZ3ty/QHi42Lg+hm3xkSYSMtYs=";
+    rev = "3832147944209ece35557234102548413ef1b460";
+    hash = "sha256-b65XWsWbMwROEYj3pVgCy6NNTreaQLkAtyCNQZ2xLPs=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.

From 192ac6ac34b3f905d60e4135973d04553fe06982 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Tue, 23 Dec 2025 20:17:39 -0500
Subject: [PATCH 21/24] Revert "nixos/nixos-generate-config: fix intel-npu
 imports"

---
 .../installer/tools/nixos-generate-config.pl        | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index bbd0a093b998..77139976e7ad 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -205,15 +205,10 @@ sub pciCheck {
         ($device eq "0x4229" || $device eq "0x4230" ||
          $device eq "0x4222" || $device eq "0x4227");
 
-    # Intel NPU driver
-    # list taken from linux(v6.18): drivers/accel/ivpu/ivpu_drv.h
-    if ($vendor eq "0x8086" &&
-        ($device eq "0xfd3e" || $device eq "0x7d1d" || $device eq "0xad1d" ||
-         $device eq "0x643e" || $device eq "0xb03e"))
-    {
-        push @imports, "(modulesPath + \"/hardware/cpu/intel-npu.nix\")";
-        push @attrs, "hardware.cpu.intel.npu.enable = true;";
-    }
+    push @attrs, "hardware.cpu.intel.npu.enable = true;" if
+        $vendor eq "0x8086" &&
+        ($device eq "0x7d1d" || $device eq "0xad1d" ||
+         $device eq "0x643e" || $device eq "0xb03e");
 
     # Assume that all NVIDIA cards are supported by the NVIDIA driver.
     # There may be exceptions (e.g. old cards).

From e8d9e1d828b1b345b4b6ebd48141f70409b4a296 Mon Sep 17 00:00:00 2001
From: t4ccer <t4ccer@gmail.com>
Date: Tue, 23 Dec 2025 21:48:08 -0330
Subject: [PATCH 22/24] mslicer: fix startup on X11

---
 pkgs/by-name/ms/mslicer/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/ms/mslicer/package.nix b/pkgs/by-name/ms/mslicer/package.nix
index ff428aad600b..dde4bd56edaf 100644
--- a/pkgs/by-name/ms/mslicer/package.nix
+++ b/pkgs/by-name/ms/mslicer/package.nix
@@ -7,6 +7,7 @@
   rustPlatform,
   vulkan-loader,
   wayland,
+  xorg,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -27,17 +28,27 @@ rustPlatform.buildRustPackage (finalAttrs: {
     libxkbcommon
     vulkan-loader
     wayland
+    xorg.libXcursor
+    xorg.libXrandr
+    xorg.libXi
+    xorg.libX11
   ];
 
   # Force linking to libEGL, which is always dlopen()ed, and to
   # libwayland-client & libxkbcommon, which is dlopen()ed based on the
   # winit backend.
   NIX_LDFLAGS = [
+    "--push-state"
     "--no-as-needed"
     "-lEGL"
     "-lvulkan"
     "-lwayland-client"
     "-lxkbcommon"
+    "-lX11"
+    "-lXcursor"
+    "-lXrandr"
+    "-lXi"
+    "--pop-state"
   ];
 
   strictDeps = true;

From 18d2bcef8042ef5d1af94349537df6931650c181 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sun, 30 Nov 2025 17:25:19 -0500
Subject: [PATCH 23/24] osmtogeojson: regnerate lockfile, run tests

Fixes CVE-2022-39353, CVE-2024-4068, and 6 other security issues with dependencies.
---
 .../by-name/os/osmtogeojson/package-lock.json | 229 ++++++++----------
 pkgs/by-name/os/osmtogeojson/package.nix      |  26 +-
 2 files changed, 132 insertions(+), 123 deletions(-)

diff --git a/pkgs/by-name/os/osmtogeojson/package-lock.json b/pkgs/by-name/os/osmtogeojson/package-lock.json
index 92979c78b203..294e62c0fa78 100644
--- a/pkgs/by-name/os/osmtogeojson/package-lock.json
+++ b/pkgs/by-name/os/osmtogeojson/package-lock.json
@@ -10,7 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "@mapbox/geojson-rewind": "0.5.2",
-        "@xmldom/xmldom": "0.8.3",
+        "@xmldom/xmldom": "^0.8.10",
         "concat-stream": "2.0.0",
         "geojson-numeric": "0.2.1",
         "htmlparser2": "3.5.1",
@@ -26,7 +26,7 @@
         "expect.js": "~0.2.0",
         "faucet": "~0.0.1",
         "istanbul": "^0.4.5",
-        "mocha": "~10.1.0",
+        "mocha": "^10.1.0",
         "tape": "~5.6.1"
       },
       "engines": {
@@ -55,9 +55,10 @@
       "optional": true
     },
     "node_modules/@xmldom/xmldom": {
-      "version": "0.8.3",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.3.tgz",
-      "integrity": "sha512-Lv2vySXypg4nfa51LY1nU8yDAGo/5YwF+EY/rUZgIbfvwVARcd67ttCM8SMsTeJy51YhHYavEq+FS6R0hW9PFQ==",
+      "version": "0.8.11",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz",
+      "integrity": "sha512-cQzWCtO6C8TQiYl1ruKNn2U6Ao4o4WBBcbL61yJl84x+j5sOWWFU9X7DpND8XZG3daDppSsigMdfAIl2upQBRw==",
+      "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
       }
@@ -79,10 +80,11 @@
       }
     },
     "node_modules/ansi-colors": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/ansi-colors/-/ansi-colors-4.1.1.tgz",
-      "integrity": "sha512-JoX0apGbHaUJBNl6yF+p6JAFYZ666/hhCGKN5t9QFjbJQKUU/g8MNbFDbvfrgKXvI1QpZplPOnwIo99lX/AAmA==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/ansi-colors/-/ansi-colors-4.1.3.tgz",
+      "integrity": "sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==",
       "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">=6"
       }
@@ -300,22 +302,24 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
         "concat-map": "0.0.1"
       }
     },
     "node_modules/braces": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
-      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "fill-range": "^7.0.1"
+        "fill-range": "^7.1.1"
       },
       "engines": {
         "node": ">=8"
@@ -482,12 +486,13 @@
       "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ=="
     },
     "node_modules/debug": {
-      "version": "4.3.4",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
-      "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "ms": "2.1.2"
+        "ms": "^2.1.3"
       },
       "engines": {
         "node": ">=6.0"
@@ -498,12 +503,6 @@
         }
       }
     },
-    "node_modules/debug/node_modules/ms": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
-      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
-      "dev": true
-    },
     "node_modules/decamelize": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-4.0.0.tgz",
@@ -576,10 +575,11 @@
       }
     },
     "node_modules/diff": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-5.0.0.tgz",
-      "integrity": "sha512-/VTCrvm5Z0JGty/BWHljh+BAiw3IK+2j87NGMu8Nwc/f48WoDAC395uomO9ZD117ZOBaHmkX1oyLvkVM/aIT3w==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-5.2.0.tgz",
+      "integrity": "sha512-uIFDxqpRZGZ6ThOk84hEfqWoHx2devRFvpTZcTHur85vImfaxUbTW9Ryh4CpCuDnToOP1CEtXKIgytHBPVff5A==",
       "dev": true,
+      "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.3.1"
       }
@@ -888,10 +888,11 @@
       }
     },
     "node_modules/fill-range": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
-      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "to-regex-range": "^5.0.1"
       },
@@ -1490,6 +1491,7 @@
       "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
       "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
       "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">=0.12.0"
       }
@@ -1689,10 +1691,11 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "3.14.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
-      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+      "version": "3.14.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
+      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "argparse": "^1.0.7",
         "esprima": "^4.0.0"
@@ -1811,32 +1814,32 @@
       }
     },
     "node_modules/mocha": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/mocha/-/mocha-10.1.0.tgz",
-      "integrity": "sha512-vUF7IYxEoN7XhQpFLxQAEMtE4W91acW4B6En9l97MwE9stL1A9gusXfoHZCLVHDUJ/7V5+lbCM6yMqzo5vNymg==",
+      "version": "10.8.2",
+      "resolved": "https://registry.npmjs.org/mocha/-/mocha-10.8.2.tgz",
+      "integrity": "sha512-VZlYo/WE8t1tstuRmqgeyBgCbJc/lEdopaa+axcKzTBJ+UIdlAB9XnmvTCAH4pwR4ElNInaedhEBmZD8iCSVEg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "ansi-colors": "4.1.1",
-        "browser-stdout": "1.3.1",
-        "chokidar": "3.5.3",
-        "debug": "4.3.4",
-        "diff": "5.0.0",
-        "escape-string-regexp": "4.0.0",
-        "find-up": "5.0.0",
-        "glob": "7.2.0",
-        "he": "1.2.0",
-        "js-yaml": "4.1.0",
-        "log-symbols": "4.1.0",
-        "minimatch": "5.0.1",
-        "ms": "2.1.3",
-        "nanoid": "3.3.3",
-        "serialize-javascript": "6.0.0",
-        "strip-json-comments": "3.1.1",
-        "supports-color": "8.1.1",
-        "workerpool": "6.2.1",
-        "yargs": "16.2.0",
-        "yargs-parser": "20.2.4",
-        "yargs-unparser": "2.0.0"
+        "ansi-colors": "^4.1.3",
+        "browser-stdout": "^1.3.1",
+        "chokidar": "^3.5.3",
+        "debug": "^4.3.5",
+        "diff": "^5.2.0",
+        "escape-string-regexp": "^4.0.0",
+        "find-up": "^5.0.0",
+        "glob": "^8.1.0",
+        "he": "^1.2.0",
+        "js-yaml": "^4.1.0",
+        "log-symbols": "^4.1.0",
+        "minimatch": "^5.1.6",
+        "ms": "^2.1.3",
+        "serialize-javascript": "^6.0.2",
+        "strip-json-comments": "^3.1.1",
+        "supports-color": "^8.1.1",
+        "workerpool": "^6.5.1",
+        "yargs": "^16.2.0",
+        "yargs-parser": "^20.2.9",
+        "yargs-unparser": "^2.0.0"
       },
       "bin": {
         "_mocha": "bin/_mocha",
@@ -1844,10 +1847,6 @@
       },
       "engines": {
         "node": ">= 14.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/mochajs"
       }
     },
     "node_modules/mocha/node_modules/argparse": {
@@ -1856,38 +1855,37 @@
       "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
       "dev": true
     },
-    "node_modules/mocha/node_modules/glob": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.0.tgz",
-      "integrity": "sha512-lmLf6gtyrPq8tTjSmrO94wBeQbFR3HbLHbuyD69wuyQkImp2hWqMGB47OX65FBkPffO641IP9jWa1z4ivqG26Q==",
+    "node_modules/mocha/node_modules/brace-expansion": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
       "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/mocha/node_modules/glob": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-8.1.0.tgz",
+      "integrity": "sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==",
+      "deprecated": "Glob versions prior to v9 are no longer supported",
+      "dev": true,
+      "license": "ISC",
       "dependencies": {
         "fs.realpath": "^1.0.0",
         "inflight": "^1.0.4",
         "inherits": "2",
-        "minimatch": "^3.0.4",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
+        "minimatch": "^5.0.1",
+        "once": "^1.3.0"
       },
       "engines": {
-        "node": "*"
+        "node": ">=12"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/mocha/node_modules/glob/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
-      "dev": true,
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/mocha/node_modules/has-flag": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
@@ -1898,10 +1896,11 @@
       }
     },
     "node_modules/mocha/node_modules/js-yaml": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
       },
@@ -1910,10 +1909,11 @@
       }
     },
     "node_modules/mocha/node_modules/minimatch": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.0.1.tgz",
-      "integrity": "sha512-nLDxIFRyhDblz3qMuq+SoRZED4+miJ/G+tdDrjkkkRnjAsBexeGpgjLEQ0blJy7rHhR2b93rhQY4SvyWu9v03g==",
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
+      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
       "dev": true,
+      "license": "ISC",
       "dependencies": {
         "brace-expansion": "^2.0.1"
       },
@@ -1921,15 +1921,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/mocha/node_modules/minimatch/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
-      "dev": true,
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
     "node_modules/mocha/node_modules/supports-color": {
       "version": "8.1.1",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
@@ -1951,18 +1942,6 @@
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true
     },
-    "node_modules/nanoid": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.3.tgz",
-      "integrity": "sha512-p1sjXuopFs0xg+fPASzQ28agW1oHD7xDsd9Xkf3T15H3c/cifrFHVwrh74PdoklAPi+i7MdRsE47vm2r6JoB+w==",
-      "dev": true,
-      "bin": {
-        "nanoid": "bin/nanoid.cjs"
-      },
-      "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
-      }
-    },
     "node_modules/neo-async": {
       "version": "2.6.2",
       "resolved": "https://registry.npmjs.org/neo-async/-/neo-async-2.6.2.tgz",
@@ -2218,6 +2197,7 @@
       "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
       "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "safe-buffer": "^5.1.0"
       }
@@ -2336,10 +2316,11 @@
       }
     },
     "node_modules/serialize-javascript": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.0.tgz",
-      "integrity": "sha512-Qr3TosvguFt8ePWqsvRfrKyQXIiW+nGbYpy8XK24NQHE83caxWt+mIymTT19DGFbNWNLfEwsrkSmN64lVWB9ag==",
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz",
+      "integrity": "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==",
       "dev": true,
+      "license": "BSD-3-Clause",
       "dependencies": {
         "randombytes": "^2.1.0"
       }
@@ -2704,6 +2685,7 @@
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
       "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "is-number": "^7.0.0"
       },
@@ -2839,10 +2821,11 @@
       }
     },
     "node_modules/word-wrap": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz",
-      "integrity": "sha512-Hz/mrNwitNRh/HUAtM/VT/5VH+ygD6DV7mYKZAtHOrbs8U7lvPS6xf7EJKMF0uW1KJCl0H701g3ZGus+muE5vQ==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
       "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
       }
@@ -2854,10 +2837,11 @@
       "dev": true
     },
     "node_modules/workerpool": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/workerpool/-/workerpool-6.2.1.tgz",
-      "integrity": "sha512-ILEIE97kDZvF9Wb9f6h5aXK4swSlKGUcOEGiIYb2OOu/IrDU9iwj0fD//SsA6E5ibwJxpEvhullJY4Sl4GcpAw==",
-      "dev": true
+      "version": "6.5.1",
+      "resolved": "https://registry.npmjs.org/workerpool/-/workerpool-6.5.1.tgz",
+      "integrity": "sha512-Fs4dNYcsdpYSAfVxhnl1L5zTksjvOJxtC5hzMNl+1t9B8hTJTdKDyZ5ju7ztgPy+ft9tBFXoOlDNiOT9WUXZlA==",
+      "dev": true,
+      "license": "Apache-2.0"
     },
     "node_modules/wrap-ansi": {
       "version": "7.0.0",
@@ -2928,10 +2912,11 @@
       }
     },
     "node_modules/yargs-parser": {
-      "version": "20.2.4",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.4.tgz",
-      "integrity": "sha512-WOkpgNhPTlE73h4VFAFsOnomJVaovO8VqLDzy5saChRBFQFBoMYirowyW+Q9HB4HFF4Z7VZTiG3iSzJJA29yRA==",
+      "version": "20.2.9",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.9.tgz",
+      "integrity": "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==",
       "dev": true,
+      "license": "ISC",
       "engines": {
         "node": ">=10"
       }
diff --git a/pkgs/by-name/os/osmtogeojson/package.nix b/pkgs/by-name/os/osmtogeojson/package.nix
index 9939dbf87974..ddca9e272ac1 100644
--- a/pkgs/by-name/os/osmtogeojson/package.nix
+++ b/pkgs/by-name/os/osmtogeojson/package.nix
@@ -2,6 +2,8 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  fetchpatch,
+  nodePackages,
 }:
 
 buildNpmPackage rec {
@@ -15,13 +17,35 @@ buildNpmPackage rec {
     hash = "sha256-T6d/KQQGoXHgV0iNhOms8d9zfjYMfnBNwPLShrEkHG4=";
   };
 
+  patches = [
+    # Fix critical xmldom security issue
+    # Se https://github.com/tyrasd/osmtogeojson/pull/146
+    (fetchpatch {
+      url = "https://github.com/tyrasd/osmtogeojson/commit/536ce2e9cfc3987b7596216223ce40dfbc9603e9.patch";
+      hash = "sha256-+LRithLPalcTROoJXGim7S10rxlnLxfH5mvn0dkFKIo=";
+    })
+  ];
+
   postPatch = ''
     cp ${./package-lock.json} ./package-lock.json
+    # Fix 3 moderate-severity vulnerabilities
+    substituteInPlace package.json --replace-fail '"mocha": "~10.1.0",' '"mocha": "^10.1.0",'
   '';
 
-  npmDepsHash = "sha256-stAVuyjuRQthQ3jQdekmZYjeau9l0GzEEMkV1q5fT2k=";
+  npmDepsHash = "sha256-tjdws4+xIEFa67bfAumewaYjGjjGbTJOiXbcTp/285U=";
   dontNpmBuild = true;
 
+  # "browserify: command not found"
+  nativeBuildInputs = [ nodePackages.browserify ];
+  postBuild = "patchShebangs osmtogeojson";
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    npm run test
+    runHook postCheck
+  '';
+
   meta = {
     description = "Converts OSM data to GeoJSON";
     homepage = "https://tyrasd.github.io/osmtogeojson/";

From 1a34e84586f01a4a2d0e9e8e79ba142720599fe2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Dec 2025 02:32:27 +0000
Subject: [PATCH 24/24] pkgsite: 0-unstable-2025-12-15 -> 0-unstable-2025-12-23

---
 pkgs/by-name/pk/pkgsite/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pk/pkgsite/package.nix b/pkgs/by-name/pk/pkgsite/package.nix
index 6dfc66220b0f..5c4562bfa15d 100644
--- a/pkgs/by-name/pk/pkgsite/package.nix
+++ b/pkgs/by-name/pk/pkgsite/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "pkgsite";
-  version = "0-unstable-2025-12-15";
+  version = "0-unstable-2025-12-23";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "pkgsite";
-    rev = "4eb0af2c34bf5ae5d7e04cc47cd8f7b6269ef079";
-    hash = "sha256-BpNB8wrb3vR5NXAxwRfrQjwcSllWB1YlQJU25OlS8Hw=";
+    rev = "1a3bd3c788fea11057a8e696fd274c4c3f3e952c";
+    hash = "sha256-GnjzJhmH9mOBdpc+r3Hco0KFsTp4LMkbTn/oMBthemQ=";
   };
 
   vendorHash = "sha256-6wgJNDzUzSCkwzjqGwzpa63+0HoN5PapKxMBFBuu16M=";