From 3a337a0a52647f3591bde35e1f3b1a2382696784 Mon Sep 17 00:00:00 2001
From: Emi Katagiri-Simpson <emi@alchemi.dev>
Date: Tue, 18 Nov 2025 14:15:51 -0500
Subject: [PATCH 01/68] nixos/send: Add `environmentFile` option for securely
 passing secrets

Currently, NixOS's module for Send (fka. Firefox Send) lacks a way to
securely configure the cloud storage backends supported upstream.  While
it is technically possible to use these backends by passing credentials
using the `environment` option, this creates a well known security risk
by exposing credentials in the Nix store.

This change adds an `environmentFile` option, which accepts a path that
is subsequently passed to the `serviceConfig.EnvironmentFile` systemd
setting, thereby allowing users to use agenix or other secure secret
passing schemes of their chosing.

Module maintainer: @moraxyc (hi again!)
---
 nixos/modules/services/web-servers/send.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/nixos/modules/services/web-servers/send.nix b/nixos/modules/services/web-servers/send.nix
index a80cd15644f6..7b037ae11c92 100644
--- a/nixos/modules/services/web-servers/send.nix
+++ b/nixos/modules/services/web-servers/send.nix
@@ -46,6 +46,22 @@ in
         };
       };
 
+      environmentFile = mkOption {
+        default = null;
+        description = ''
+          Environment file (see {manpage}`systemd.exec(5)` "EnvironmentFile="
+          section for the syntax) passed to the service. This option is the
+          recommended way to pass secrets to Send.
+
+          This is especially important for users using a cloud storage backend.
+
+          A list of environment variables recognized by Send can be found here:
+          <https://github.com/timvisee/send/blob/master/docs/docker.md>
+        '';
+        example = "/run/secrets/send";
+        type = with types; nullOr path;
+      };
+
       dataDir = lib.mkOption {
         type = types.path;
         readOnly = true;
@@ -159,6 +175,7 @@ in
         LoadCredential = lib.optionalString (
           cfg.redis.passwordFile != null
         ) "redis-password:${cfg.redis.passwordFile}";
+        EnvironmentFile = cfg.environmentFile;
 
         # Hardening
         RestrictAddressFamilies = [

From 0ca83edb6d9336d331ccfaffeb9c51ca481bc938 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 29 Jan 2026 12:28:22 +0000
Subject: [PATCH 02/68] jfsw: 20240303 -> 20260105

---
 pkgs/by-name/jf/jfsw/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/jf/jfsw/package.nix b/pkgs/by-name/jf/jfsw/package.nix
index 97e51f48ebbe..ce928fb45b0c 100644
--- a/pkgs/by-name/jf/jfsw/package.nix
+++ b/pkgs/by-name/jf/jfsw/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jfsw";
-  version = "20240303";
+  version = "20260105";
 
   src = fetchFromGitHub {
     owner = "jonof";
     repo = "jfsw";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-bOUgRa9zWufTFEj5huXAKeRerV8PqfqQVDoVUvRrj2I=";
+    hash = "sha256-L/EtdbyU6uZbSajQkI8IclskIfzm15uikSK2EZZZHXA=";
   };
 
   nativeBuildInputs = [

From 8f99b8c4cd54cf1e41805b5802adc3d2da94386a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 21 Feb 2026 18:44:51 +0000
Subject: [PATCH 03/68] grafanaPlugins.grafana-clock-panel: 2.1.9 -> 3.2.2

---
 .../grafana/plugins/grafana-clock-panel/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-clock-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-clock-panel/default.nix
index 0be2c8c210ec..0b9b3b062202 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-clock-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-clock-panel/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-clock-panel";
-  version = "2.1.9";
-  zipHash = "sha256-awc1bA3MHg0z7HDzqhhWOymVPeEsOHUdxX0xneOd7kY=";
+  version = "3.2.2";
+  zipHash = "sha256-VjOg6qJXxhDAl8xYWD9ZZSNqSELMoREuyv+LX5xFOgM=";
   meta = {
     description = "Clock panel for Grafana";
     license = lib.licenses.mit;

From 2f609d7727e711db3468461ee30e28268c9d6a08 Mon Sep 17 00:00:00 2001
From: Tim Schubert <dadada@dadada.li>
Date: Sat, 14 Mar 2026 22:15:09 +0100
Subject: [PATCH 04/68] nixos/soft-serve: fix executing hooks

This fixes #498748
---
 nixos/modules/services/misc/soft-serve.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/misc/soft-serve.nix b/nixos/modules/services/misc/soft-serve.nix
index 0704287862a2..63b4fc120638 100644
--- a/nixos/modules/services/misc/soft-serve.nix
+++ b/nixos/modules/services/misc/soft-serve.nix
@@ -28,7 +28,7 @@ in
         '';
         example = lib.literalExpression ''
           {
-            name = "dadada's repos";
+            name = "user's repos";
             log_format = "text";
             ssh = {
               listen_addr = ":23231";
@@ -60,10 +60,12 @@ in
         DynamicUser = true;
         Restart = "always";
         ExecStart = "${lib.getExe cfg.package} serve";
+
+        # Hooks must be executable, but DynamicUser mounts /var/lib/private as noexec
+        ExecPaths = "${stateDir}/repos";
+
         StateDirectory = "soft-serve";
         WorkingDirectory = stateDir;
-        RuntimeDirectory = "soft-serve";
-        RuntimeDirectoryMode = "0750";
         ProcSubset = "pid";
         ProtectProc = "invisible";
         UMask = "0027";
@@ -86,7 +88,6 @@ in
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
         RestrictRealtime = true;
-        RemoveIPC = true;
         PrivateMounts = true;
         SystemCallArchitectures = "native";
         SystemCallFilter = [

From f70c7cd3c65bc41d4b01b67337ec7c91ed9649a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?=
 =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?=
 =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= <regime_skylark.0y@icloud.com>
Date: Sat, 11 Apr 2026 12:32:44 -0400
Subject: [PATCH 05/68] imapgoose: approved universality

---
 pkgs/by-name/im/imapgoose/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/im/imapgoose/package.nix b/pkgs/by-name/im/imapgoose/package.nix
index 5598ebd4f351..cb1e4a6de2b3 100644
--- a/pkgs/by-name/im/imapgoose/package.nix
+++ b/pkgs/by-name/im/imapgoose/package.nix
@@ -44,7 +44,7 @@ buildGoModule rec {
     homepage = "https://git.sr.ht/~whynothugo/ImapGoose";
     changelog = "https://git.sr.ht/~whynothugo/ImapGoose/refs/v${version}";
     license = lib.licenses.isc;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
     mainProgram = "imapgoose";
     maintainers = with lib.maintainers; [
       bobberb

From 6b01c424537eb8fd2566a21982366307982e661b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?=
 =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?=
 =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= <regime_skylark.0y@icloud.com>
Date: Sat, 11 Apr 2026 12:32:51 -0400
Subject: [PATCH 06/68] imapgoose: added maintainer

---
 pkgs/by-name/im/imapgoose/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/im/imapgoose/package.nix b/pkgs/by-name/im/imapgoose/package.nix
index cb1e4a6de2b3..eb843f9d57bb 100644
--- a/pkgs/by-name/im/imapgoose/package.nix
+++ b/pkgs/by-name/im/imapgoose/package.nix
@@ -47,6 +47,7 @@ buildGoModule rec {
     platforms = lib.platforms.unix;
     mainProgram = "imapgoose";
     maintainers = with lib.maintainers; [
+      philocalyst
       bobberb
     ];
   };

From 003406ee9c8ef4857244ac064ecc557a42b49093 Mon Sep 17 00:00:00 2001
From: Letgamer <alexstephan005@protonmail.com>
Date: Sun, 12 Apr 2026 16:08:39 +0200
Subject: [PATCH 07/68] python3Packages.emv: refactored code

switched to Codeberg
switched to finalAttrs
switched to pythonRelaxDeps and pythonRemoveDeps
---
 .../python-modules/emv/default.nix            | 34 ++++++++++---------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/python-modules/emv/default.nix b/pkgs/development/python-modules/emv/default.nix
index 6b2976b9743e..f41254933402 100644
--- a/pkgs/development/python-modules/emv/default.nix
+++ b/pkgs/development/python-modules/emv/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchFromCodeberg,
   click,
   pyscard,
   pycountry,
@@ -10,27 +10,29 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "emv";
   version = "1.0.14";
   pyproject = true;
 
-  src = fetchFromGitHub {
+  src = fetchFromCodeberg {
     owner = "russss";
     repo = "python-emv";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-MnaeQZ0rA3i0CoUA6HgJQpwk5yo4rm9e+pc5XzRd1eg=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail '"enum-compat==0.0.3",' "" \
-      --replace-fail '"argparse==1.4.0",' "" \
-      --replace-fail "click==7.1.2" "click" \
-      --replace-fail "pyscard==2.0.0" "pyscard" \
-      --replace-fail "pycountry==20.7.3" "pycountry" \
-      --replace-fail "terminaltables==3.1.0" "terminaltables"
-  '';
+  pythonRelaxDeps = [
+    "click"
+    "pyscard"
+    "pycountry"
+    "terminaltables"
+  ];
+
+  pythonRemoveDeps = [
+    "enum-compat"
+    "argparse"
+  ];
 
   build-system = [ setuptools ];
 
@@ -47,10 +49,10 @@ buildPythonPackage rec {
 
   meta = {
     description = "Implementation of the EMV chip-and-pin smartcard protocol";
-    homepage = "https://github.com/russss/python-emv";
-    changelog = "https://github.com/russss/python-emv/releases/tag/v${version}";
+    homepage = "https://codeberg.org/russss/python-emv/";
+    changelog = "https://codeberg.org/russss/python-emv/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ lukegb ];
     mainProgram = "emvtool";
   };
-}
+})

From 0dbd15f3f60b2cf9c628301ad30447f72fc67986 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Wed, 15 Apr 2026 12:50:25 -0600
Subject: [PATCH 08/68] yubioath-flutter: 7.3.2 -> 7.3.3

https://github.com/Yubico/yubioath-flutter/releases/tag/7.3.3
Diff: https://github.com/Yubico/yubioath-flutter/compare/7.3.2...7.3.3
---
 pkgs/by-name/yu/yubioath-flutter/package.nix     |  4 ++--
 .../yu/yubioath-flutter/pubspec.lock.json        | 16 ++++++++--------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/yu/yubioath-flutter/package.nix b/pkgs/by-name/yu/yubioath-flutter/package.nix
index 7bfe461d5048..22136cd0f0b6 100644
--- a/pkgs/by-name/yu/yubioath-flutter/package.nix
+++ b/pkgs/by-name/yu/yubioath-flutter/package.nix
@@ -16,13 +16,13 @@
 
 flutter341.buildFlutterApplication rec {
   pname = "yubioath-flutter";
-  version = "7.3.2";
+  version = "7.3.3";
 
   src = fetchFromGitHub {
     owner = "Yubico";
     repo = "yubioath-flutter";
     tag = version;
-    hash = "sha256-UN3wWM3wa4c+qv5czn1z0bWlJPc4nUIPgF0HHi+9Muc=";
+    hash = "sha256-PB16QOD84i564LufF++tSdutuqUfKms6mTZW1knXTJk=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
diff --git a/pkgs/by-name/yu/yubioath-flutter/pubspec.lock.json b/pkgs/by-name/yu/yubioath-flutter/pubspec.lock.json
index 8636aeec1c79..94871acf6c88 100644
--- a/pkgs/by-name/yu/yubioath-flutter/pubspec.lock.json
+++ b/pkgs/by-name/yu/yubioath-flutter/pubspec.lock.json
@@ -695,11 +695,11 @@
       "dependency": "transitive",
       "description": {
         "name": "matcher",
-        "sha256": "12956d0ad8390bbcc63ca2e1469c0619946ccb52809807067a7020d57e647aa6",
+        "sha256": "dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.12.18"
+      "version": "0.12.19"
     },
     "material_color_utilities": {
       "dependency": "transitive",
@@ -1300,31 +1300,31 @@
       "dependency": "transitive",
       "description": {
         "name": "test",
-        "sha256": "54c516bbb7cee2754d327ad4fca637f78abfc3cbcc5ace83b3eda117e42cd71a",
+        "sha256": "280d6d890011ca966ad08df7e8a4ddfab0fb3aa49f96ed6de56e3521347a9ae7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.29.0"
+      "version": "1.30.0"
     },
     "test_api": {
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "93167629bfc610f71560ab9312acdda4959de4df6fac7492c89ff0d3886f6636",
+        "sha256": "8161c84903fd860b26bfdefb7963b3f0b68fee7adea0f59ef805ecca346f0c7a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.9"
+      "version": "0.7.10"
     },
     "test_core": {
       "dependency": "transitive",
       "description": {
         "name": "test_core",
-        "sha256": "394f07d21f0f2255ec9e3989f21e54d3c7dc0e6e9dbce160e5a9c1a6be0e2943",
+        "sha256": "0381bd1585d1a924763c308100f2138205252fb90c9d4eeaf28489ee65ccde51",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.15"
+      "version": "0.6.16"
     },
     "tray_manager": {
       "dependency": "direct main",

From dfbcfa7130a3791dd929c3c5796d7a34313e04c2 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Sat, 25 Apr 2026 18:30:48 +0200
Subject: [PATCH 09/68] Revert "python313Packages.embreex: drop"

This reverts commit 711876c9053984d32c71fd768cc1dde14bc55295.
---
 .../python-modules/embreex/default.nix        | 72 +++++++++++++++++++
 .../python-modules/trimesh/default.nix        |  5 +-
 pkgs/top-level/python-aliases.nix             |  1 -
 pkgs/top-level/python-packages.nix            |  2 +
 4 files changed, 78 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/python-modules/embreex/default.nix

diff --git a/pkgs/development/python-modules/embreex/default.nix b/pkgs/development/python-modules/embreex/default.nix
new file mode 100644
index 000000000000..38b2904a2cbf
--- /dev/null
+++ b/pkgs/development/python-modules/embreex/default.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  buildPythonPackage,
+  embree2,
+  cython,
+  numpy,
+  setuptools,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "embreex";
+  version = "2.17.7.post6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "trimesh";
+    repo = "embreex";
+    tag = version;
+    hash = "sha256-iLIfhngorSFOdkOvlCAJQXGQrVuRfBSDGzvjXOlQuHk=";
+  };
+
+  patches = [
+    # https://github.com/trimesh/embreex/pull/7
+    (fetchpatch {
+      name = "fix-use-after-free.patch";
+      url = "https://github.com/trimesh/embreex/commit/c6b047285419f8986fae962e2734a01522be7ef7.patch";
+      hash = "sha256-s8x2vsqbsIR3aoNUDrYs2vQttuNY8lLJ6TC7H8FMRyQ=";
+    })
+  ];
+
+  build-system = [
+    setuptools
+    numpy
+    cython
+  ];
+
+  dependencies = [
+    numpy
+  ];
+
+  buildInputs = [
+    embree2
+    embree2.tbb
+  ];
+
+  pythonImportsCheck = [
+    "embreex"
+    "embreex.mesh_construction"
+    "embreex.rtcore"
+    "embreex.rtcore_scene"
+    "embreex.triangles"
+  ];
+
+  preCheck = ''
+    # conflicts with $out
+    rm -rf embreex/
+  '';
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    description = "Maintained PyEmbree fork, wrapper for Embree v2";
+    homepage = "https://github.com/trimesh/embreex";
+    changelog = "https://github.com/trimesh/embreex/releases/tag/${src.tag}";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ pbsds ];
+    inherit (embree2.meta) platforms;
+  };
+}
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index d2e37aa24ae4..3c2cfaed93dd 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -23,6 +23,7 @@
   scipy,
   pillow,
   mapbox-earcut,
+  embreex,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -59,7 +60,9 @@ buildPythonPackage (finalAttrs: {
       pillow
       # vhacdx # not packaged
       mapbox-earcut
-      # embreex # not packaged
+    ]
+    ++ lib.optionals embreex.meta.available [
+      embreex
     ];
   };
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index ae8183aec273..82ef4faf2d21 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -192,7 +192,6 @@ mapAliases {
   elegy = throw "elegy has been removed because it has transitively been marked as broken since 2023."; # Added 2025-10-11
   email_validator = throw "'email_validator' has been renamed to/replaced by 'email-validator'"; # Converted to throw 2025-10-29
   emailthreads = throw "'emailthreads' has been removed because the upstream repository was archived in 2024"; # Added 2026-04-09
-  embreex = throw "embreex has been removed, as it required embree2"; # added 2025-09-14
   enocean = throw "'enocean' was removed because Home Assistant switched to 'enocean-async'"; # added 2026-03-31
   eris = throw "eris has been removed due to a hostile upstream moving tags and breaking src FODs"; # Added 2025-09-01
   et_xmlfile = throw "'et_xmlfile' has been renamed to/replaced by 'et-xmlfile'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d66783552dc8..c88262bcc6a7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4994,6 +4994,8 @@ self: super: with self; {
 
   embrace = callPackage ../development/python-modules/embrace { };
 
+  embreex = callPackage ../development/python-modules/embreex { };
+
   emcee = callPackage ../development/python-modules/emcee { };
 
   emoji = callPackage ../development/python-modules/emoji { };

From bb9b1423ddc09e1d2551d678e9b24aba8babf059 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Sat, 25 Apr 2026 18:38:31 +0200
Subject: [PATCH 10/68] python3Packages.embreex: 2.17.7.post6 -> 4.4.0

Release: https://github.com/trimesh/embreex/releases/tag/4.4.0
---
 .../python-modules/embreex/default.nix        | 23 +++++--------------
 1 file changed, 6 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/python-modules/embreex/default.nix b/pkgs/development/python-modules/embreex/default.nix
index 38b2904a2cbf..5d76b5a8bbd4 100644
--- a/pkgs/development/python-modules/embreex/default.nix
+++ b/pkgs/development/python-modules/embreex/default.nix
@@ -3,7 +3,7 @@
   fetchFromGitHub,
   fetchpatch,
   buildPythonPackage,
-  embree2,
+  embree,
   cython,
   numpy,
   setuptools,
@@ -12,25 +12,16 @@
 
 buildPythonPackage rec {
   pname = "embreex";
-  version = "2.17.7.post6";
+  version = "4.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "trimesh";
     repo = "embreex";
     tag = version;
-    hash = "sha256-iLIfhngorSFOdkOvlCAJQXGQrVuRfBSDGzvjXOlQuHk=";
+    hash = "sha256-mUPc9CMHsFYb1ELBmj+XXCjYEIW1iV8ZaRCQ40tYS8w=";
   };
 
-  patches = [
-    # https://github.com/trimesh/embreex/pull/7
-    (fetchpatch {
-      name = "fix-use-after-free.patch";
-      url = "https://github.com/trimesh/embreex/commit/c6b047285419f8986fae962e2734a01522be7ef7.patch";
-      hash = "sha256-s8x2vsqbsIR3aoNUDrYs2vQttuNY8lLJ6TC7H8FMRyQ=";
-    })
-  ];
-
   build-system = [
     setuptools
     numpy
@@ -42,8 +33,7 @@ buildPythonPackage rec {
   ];
 
   buildInputs = [
-    embree2
-    embree2.tbb
+    embree
   ];
 
   pythonImportsCheck = [
@@ -51,7 +41,6 @@ buildPythonPackage rec {
     "embreex.mesh_construction"
     "embreex.rtcore"
     "embreex.rtcore_scene"
-    "embreex.triangles"
   ];
 
   preCheck = ''
@@ -62,11 +51,11 @@ buildPythonPackage rec {
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = {
-    description = "Maintained PyEmbree fork, wrapper for Embree v2";
+    description = "Maintained PyEmbree fork, bindings for Intel's Embree ray engine";
     homepage = "https://github.com/trimesh/embreex";
     changelog = "https://github.com/trimesh/embreex/releases/tag/${src.tag}";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ pbsds ];
-    inherit (embree2.meta) platforms;
+    inherit (embree.meta) platforms;
   };
 }

From 5a6c1f5e534d3fe0f1bc2d535400eed9b51770dd Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Sat, 25 Apr 2026 18:46:58 +0200
Subject: [PATCH 11/68] python3Packages.trimesh: 4.11.5 -> 4.12.1, enable
 embreex tests

Release: https://github.com/mikedh/trimesh/releases/tag/4.12.1
---
 .../python-modules/trimesh/default.nix          | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index 3c2cfaed93dd..9fd95c7ecb4d 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -6,7 +6,6 @@
   pytestCheckHook,
   numpy,
   lxml,
-  trimesh,
 
   # optional deps
   colorlog,
@@ -28,14 +27,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "trimesh";
-  version = "4.11.5";
+  version = "4.12.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mikedh";
     repo = "trimesh";
     tag = finalAttrs.version;
-    hash = "sha256-LF7tjthYtsEZJLqBiQZBe4urLjSD3Vbi3g1ZJ++0Tyk=";
+    hash = "sha256-+Xmy3/GSnfj7u1sapMscoCGlRsz00IkUzEo9CJ5Ja3s=";
   };
 
   build-system = [ setuptools ];
@@ -69,6 +68,11 @@ buildPythonPackage (finalAttrs: {
   nativeCheckInputs = [
     lxml
     pytestCheckHook
+  ]
+  # embreex is maintained by trimesh devs
+  ++ lib.optionals embreex.meta.available [
+    embreex
+    rtree
   ];
 
   disabledTests = [
@@ -76,7 +80,12 @@ buildPythonPackage (finalAttrs: {
     "test_load"
   ];
 
-  enabledTestPaths = [ "tests/test_minimal.py" ];
+  enabledTestPaths = [
+    "tests/test_minimal.py"
+  ]
+  ++ lib.optionals embreex.meta.available [
+    "tests/test_ray.py"
+  ];
 
   pythonImportsCheck = [
     "trimesh"

From 44a79d04c01779786c8901507f45c28f1c3442ad Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Thu, 23 Apr 2026 22:41:11 +0200
Subject: [PATCH 12/68] noriskclient-launcher-unwrapped: 0.6.19 -> 0.6.20

diff: https://github.com/NoRiskClient/noriskclient-launcher/compare/v0.6.19...v0.6.20
---
 .../package.nix                               | 22 ++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/no/noriskclient-launcher-unwrapped/package.nix b/pkgs/by-name/no/noriskclient-launcher-unwrapped/package.nix
index 78b692cfb875..a059db197398 100644
--- a/pkgs/by-name/no/noriskclient-launcher-unwrapped/package.nix
+++ b/pkgs/by-name/no/noriskclient-launcher-unwrapped/package.nix
@@ -2,6 +2,8 @@
   cargo-tauri,
   desktop-file-utils,
   fetchFromGitHub,
+  fetchpatch,
+  fetchurl,
   fetchYarnDeps,
   glib,
   gtk3,
@@ -18,18 +20,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "noriskclient-launcher-unwrapped";
-  version = "0.6.19";
+  version = "0.6.20";
 
   src = fetchFromGitHub {
     owner = "NoRiskClient";
     repo = "noriskclient-launcher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SHLYCpflIjslCuCPROyuVsIdNIkHWl2BVflgxAz3RYg=";
+    hash = "sha256-VChMA6XXKgtytLFOORxnpNnTrunKaIJkFge2Xu4FjG0=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-tRvtYeOUn3xm7dhLWnzlpS8SK8NVVQAtNgvyiM48X28=";
+    yarnLock = fetchurl {
+      url = "https://raw.githubusercontent.com/NoRiskClient/noriskclient-launcher/937b275341191552a08757c9b4e5eb7802d54945/yarn.lock";
+      hash = "sha256-IqhgDMthwEAd/rzat119Ajaf8p8LgTDEj/KrS2xVFuQ=";
+    };
+    hash = "sha256-VWl6YqTiBRz85GICFKGwDZRBcITGQdWE7EUzW58wHdY=";
   };
 
   patches = [
@@ -38,6 +43,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
     # Make the launcher find java from PATH, instead of downloading its own, which is not going to work on NixOS.
     ./java-from-path.patch
+
+    # The version of tauri in Cargo.toml and in package.json aren't matching, causing the build to fail. Upstream PR is https://github.com/NoRiskClient/noriskclient-launcher/pull/222.
+    (fetchpatch {
+      name = "fix-tauri-version-mismatch";
+      url = "https://github.com/NoRiskClient/noriskclient-launcher/commit/937b275341191552a08757c9b4e5eb7802d54945.patch";
+      hash = "sha256-jI0KnvUpSJU739BfZeYFMhtZKjno1UrWWGwMLS3I6ag=";
+    })
   ];
 
   postPatch = ''
@@ -45,7 +57,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
   '';
 
-  cargoHash = "sha256-j41whr62i0FlTe/fWoPsMS9kX5aPgCjM9TckeZpnwgw=";
+  cargoHash = "sha256-FiM1FuWeGmfZlnKiIImGOsJnKt3qsLqvY6oRUvOSBWM=";
 
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;

From eb463580c5b834e9c3abbf93506704a12b6595c9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Apr 2026 22:13:10 +0000
Subject: [PATCH 13/68] basedpyright: 1.38.2 -> 1.39.3

---
 pkgs/by-name/ba/basedpyright/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix
index 7502f4660df7..0073245147e2 100644
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -18,16 +18,16 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.38.2";
+  version = "1.39.3";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-99oLlGZRFvIf6kNdDErVKYZbnqrJhwYogHdULayoX2k=";
+    hash = "sha256-80RQO0UwDA9ZxIGQ0/8WaEj9QlqrQ4g7m9+WJDZrZbI=";
   };
 
-  npmDepsHash = "sha256-aZ9kfkW+S6Hjt59Z4Fc5joghs7OQ32354IYevFuKNeo=";
+  npmDepsHash = "sha256-jut63CiYGTNIP27wYCPZnE/Ab90EWJnVkx58Oy3uo9o=";
   npmWorkspace = "packages/pyright";
 
   preBuild = ''

From 35c8d2dc9c22390dd960e26fdf7bc9ef3a0163c1 Mon Sep 17 00:00:00 2001
From: hulr <>
Date: Mon, 13 Apr 2026 21:09:52 +0200
Subject: [PATCH 14/68] iwe: 0.0.67 -> 0.0.70

---
 pkgs/by-name/iw/iwe/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/iw/iwe/package.nix b/pkgs/by-name/iw/iwe/package.nix
index 1f7627403802..fac827819b3d 100644
--- a/pkgs/by-name/iw/iwe/package.nix
+++ b/pkgs/by-name/iw/iwe/package.nix
@@ -8,19 +8,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "iwe";
-  version = "0.0.67";
+  version = "0.0.70";
 
   src = fetchFromGitHub {
     owner = "iwe-org";
     repo = "iwe";
     tag = "iwe-v${finalAttrs.version}";
-    hash = "sha256-/irCQgMDuO2boitdTyl4OlkMvuyFPfsTx8Jo/VhLYuw=";
+    hash = "sha256-ehRth5vBUjswn9oM97WuMYvHs0LohXBwrdN23VRELa0=";
   };
 
-  cargoHash = "sha256-oAIF+ekKzvfT7WzQ+PE4RWUUMMDkBOFBdgwUMXBZsFk=";
+  cargoHash = "sha256-rQre02fRRcf0FCmRpWh1UHsvCpp/iLqCA4QHvSZYBwA=";
 
   cargoBuildFlags = [
     "--package=iwe"
+    "--package=iwec"
     "--package=iwes"
   ];
 

From 4d86f5927893c61ce80e79151e20f2fba6877623 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Apr 2026 20:18:05 +0000
Subject: [PATCH 15/68] home-assistant-custom-components.tibber_local: 2026.3.5
 -> 2026.4.0

---
 .../home-assistant/custom-components/tibber_local/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix b/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix
index e8b272561d58..7a937c53f795 100644
--- a/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/tibber_local/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "marq24";
   domain = "tibber_local";
-  version = "2026.3.5";
+  version = "2026.4.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "ha-tibber-pulse-local";
     tag = version;
-    hash = "sha256-vQT0Ul4/QLQhuROENWXjSLVcml5BRWvqNIWdOLXN9dk=";
+    hash = "sha256-xUyKSR0X9gZhU3SsLmNWr2v5BzPRkIfhZTehLOnCIWc=";
   };
 
   dependencies = [

From eeda6d43ece18093010f65a1a4260f6b93cb34c1 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Thu, 30 Apr 2026 23:37:26 +0200
Subject: [PATCH 16/68] voicevox-core.modelVersion: 0.16.3 -> 0.16.4

---
 pkgs/by-name/vo/voicevox-core/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vo/voicevox-core/package.nix b/pkgs/by-name/vo/voicevox-core/package.nix
index 8797bfa570ec..a49e712280f6 100644
--- a/pkgs/by-name/vo/voicevox-core/package.nix
+++ b/pkgs/by-name/vo/voicevox-core/package.nix
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # Update only together with voicevox and voicevox-engine
   # nixpkgs-update: no auto update
   version = "0.16.2";
-  passthru.modelVersion = "0.16.3";
+  passthru.modelVersion = "0.16.4";
 
   src = fetchFromGitHub {
     owner = "VOICEVOX";
@@ -70,7 +70,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       owner = "VOICEVOX";
       repo = "voicevox_vvm";
       tag = finalAttrs.passthru.modelVersion;
-      hash = "sha256-VqSNEHJV/g9R+4XknRGi/s4C7/uXEGCK5/NC2XwiPcI=";
+      hash = "sha256-/NU9CZcb+gHXHeno3NLF0EgPLw+6f8XyiAE2b9XJmuE=";
     };
 
     nativeBuildInputs = [ python3 ];

From 29b500ebef92282fd85cdc57670cbe10b9f18fc8 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Thu, 30 Apr 2026 23:37:53 +0200
Subject: [PATCH 17/68] voicevox-engine: 0.25.1 -> 0.25.2

---
 pkgs/by-name/vo/voicevox-engine/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vo/voicevox-engine/package.nix b/pkgs/by-name/vo/voicevox-engine/package.nix
index 7934fee85c7d..41466c761e90 100644
--- a/pkgs/by-name/vo/voicevox-engine/package.nix
+++ b/pkgs/by-name/vo/voicevox-engine/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "voicevox-engine";
-  version = "0.25.1";
+  version = "0.25.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "VOICEVOX";
     repo = "voicevox_engine";
     tag = finalAttrs.version;
-    hash = "sha256-4pZs5f6Fe4kHIKcyww1eq9uRTf7rk5KAr/00H8aH9qA=";
+    hash = "sha256-A+ym/ZfHUHqXSGOiIndUeozrK64uJILCmRUm+qSsSNE=";
   };
 
   patches = [
@@ -103,7 +103,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       owner = "VOICEVOX";
       repo = "voicevox_resource";
       tag = finalAttrs.version;
-      hash = "sha256-YaUVlZnpxu/IhLrp1XdcxDyus7DRhyzu4VKfabTsPUY=";
+      hash = "sha256-Byv9ASl1qCeGWJiBtpGoPFgpbwtSdn48XvzIDS0SHN4=";
     };
 
     pyopenjtalk = python3Packages.callPackage ./pyopenjtalk.nix { };

From 207df7221d1188aba91dbc111188b7fa46b87e40 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Thu, 30 Apr 2026 23:37:58 +0200
Subject: [PATCH 18/68] voicevox: 0.25.1 -> 0.25.2

---
 pkgs/by-name/vo/voicevox/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vo/voicevox/package.nix b/pkgs/by-name/vo/voicevox/package.nix
index eec83720f5bd..0bcb9ed27ba0 100644
--- a/pkgs/by-name/vo/voicevox/package.nix
+++ b/pkgs/by-name/vo/voicevox/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "voicevox";
-  version = "0.25.1";
+  version = "0.25.2";
 
   src = fetchFromGitHub {
     owner = "VOICEVOX";
     repo = "voicevox";
     tag = finalAttrs.version;
-    hash = "sha256-l9aFuhOylcQrHa+0R0P4Jy5iL2gA6xJsUJt8KvWIMuM=";
+    hash = "sha256-AORB6oxvDUNOxnwgIlAKkgtt0+NpU16Fc4qc1aMhxkQ=";
   };
 
   patches = [

From aabbcaf69ad9e7995e4e38cad1d9b221c58d4f91 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 May 2026 02:22:39 +0000
Subject: [PATCH 19/68] limine-full: 12.0.2 -> 12.1.0

---
 pkgs/by-name/li/limine/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 184e64700b66..ffa19e612a01 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "12.0.2";
+  version = "12.1.0";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/Limine-Bootloader/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-bHHBqQrQLY0J+8RkfS9qsyRGk4fw21xsb0nB2HVkKwg=";
+    hash = "sha256-DcVL7SYEIZKgY/TTsX8mW6wjAituCF+eBeISt6gMZhk=";
   };
 
   enableParallelBuilding = true;

From d0143432b2e499ed77611c3d5178ddca214f4cce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 May 2026 04:50:52 +0000
Subject: [PATCH 20/68] copyparty: 1.20.13 -> 1.20.14

---
 pkgs/by-name/co/copyparty/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/copyparty/package.nix b/pkgs/by-name/co/copyparty/package.nix
index e2320a590d64..e52c42841642 100644
--- a/pkgs/by-name/co/copyparty/package.nix
+++ b/pkgs/by-name/co/copyparty/package.nix
@@ -71,11 +71,11 @@ in
 
 python3Packages.buildPythonApplication rec {
   pname = "copyparty${nameSuffix}";
-  version = "1.20.13";
+  version = "1.20.14";
 
   src = fetchurl {
     url = "https://github.com/9001/copyparty/releases/download/v${version}/copyparty-${version}.tar.gz";
-    hash = "sha256-sq+SUPfvl6XfJt9BLuCCxtK+DwzTHVebT7tqovPlwnE=";
+    hash = "sha256-h4Pcg5C+F2c9MG9CTnoo3Z+bT84AXjVzTTDBspZwfBI=";
   };
 
   pyproject = true;

From a82d9694010371ee3590f48658accc7e9f5a61e7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 15 Apr 2026 21:00:11 +0200
Subject: [PATCH 21/68] esphome: 2026.3.3 -> 2026.4.3

https://esphome.io/changelog/2026.4.0/
https://esphome.io/changelog/2026.4.0/#release-202641---april-20
https://esphome.io/changelog/2026.4.0/#release-202642---april-23
https://esphome.io/changelog/2026.4.0/#release-202643---april-28

Co-authored-by: Karl Beecken <karl@beecken.berlin>
---
 pkgs/by-name/es/esphome/dashboard.nix         |  4 ++--
 pkgs/by-name/es/esphome/package.nix           | 23 +++++++++++--------
 .../esphome/platformio-binary-reference.patch | 13 +++++++++++
 3 files changed, 29 insertions(+), 11 deletions(-)
 create mode 100644 pkgs/by-name/es/esphome/platformio-binary-reference.patch

diff --git a/pkgs/by-name/es/esphome/dashboard.nix b/pkgs/by-name/es/esphome/dashboard.nix
index 444d9205f16c..8c9df558a942 100644
--- a/pkgs/by-name/es/esphome/dashboard.nix
+++ b/pkgs/by-name/es/esphome/dashboard.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "esphome-dashboard";
-  version = "20260210.0";
+  version = "20260408.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "dashboard";
     tag = finalAttrs.version;
-    hash = "sha256-Edd2ZOSBAZSrGVjbncyPhhjFjE0CxBHz16ZHXyzx9LI=";
+    hash = "sha256-OY7s/b0rWmjI9QfmEwj3VxbTFrj99fyf9x1tPl24RbI=";
   };
 
   npmDeps = fetchNpmDeps {
diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 1d7fb10189f6..237d891906ad 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -31,16 +31,16 @@ let
     };
   };
 in
-python.pkgs.buildPythonApplication rec {
+python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "esphome";
-  version = "2026.3.3";
+  version = "2026.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
-    tag = version;
-    hash = "sha256-yMPHz6IZIGM4oJw1wspEL3lIIiPv4WZALUJ7J1UWukY=";
+    tag = finalAttrs.version;
+    hash = "sha256-+esSczOBIT4dJEyzqmEv6YMU4wGkN4lFGmuZKRp5/bo=";
   };
 
   patches = [
@@ -49,6 +49,10 @@ python.pkgs.buildPythonApplication rec {
     # own python environment through `python -m esptool` and then fails to find
     # the esptool library.
     ./esp32-post-build-esptool-reference.patch
+    # Call the platformio binary directly instead of `python -m
+    # esphome.platformio_runner`, which tries to import platformio as a Python
+    # module.
+    ./platformio-binary-reference.patch
   ];
 
   build-system = with python.pkgs; [
@@ -119,7 +123,7 @@ python.pkgs.buildPythonApplication rec {
     }"
     # The dashboard requires esphome to be importable
     # dependencies are added to show better error messages
-    "--prefix PYTHONPATH : $out/${python.sitePackages}:${python.pkgs.makePythonPath dependencies}"
+    "--prefix PYTHONPATH : $out/${python.sitePackages}:${python.pkgs.makePythonPath finalAttrs.passthru.dependencies}"
     "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ stdenv.cc.cc ]}"
     "--set ESPHOME_USE_SUBPROCESS ''"
     # https://github.com/NixOS/nixpkgs/issues/362193
@@ -173,9 +177,10 @@ python.pkgs.buildPythonApplication rec {
     "test_clean_all"
     "test_clean_all_partial_exists"
     # tries to use esptool, which is wrapped in an fhsenv
-    "test_upload_using_esptool_path_conversion"
-    "test_upload_using_esptool_with_file_path"
     "test_upload_using_esptool_passes_crystal_callback"
+    "test_upload_using_esptool_path_conversion"
+    "test_upload_using_esptool_skips_missing_extra_flash_images"
+    "test_upload_using_esptool_with_file_path"
     # AssertionError: Expected 'run_external_command' to have been called once. Called 0 times.
     "test_run_platformio_cli_sets_environment_variables"
     # Expects a full git clone
@@ -190,7 +195,7 @@ python.pkgs.buildPythonApplication rec {
   };
 
   meta = {
-    changelog = "https://github.com/esphome/esphome/releases/tag/${version}";
+    changelog = "https://github.com/esphome/esphome/releases/tag/${finalAttrs.src.tag}";
     description = "Make creating custom firmwares for ESP32/ESP8266 super easy";
     homepage = "https://esphome.io/";
     license = with lib.licenses; [
@@ -204,4 +209,4 @@ python.pkgs.buildPythonApplication rec {
     ];
     mainProgram = "esphome";
   };
-}
+})
diff --git a/pkgs/by-name/es/esphome/platformio-binary-reference.patch b/pkgs/by-name/es/esphome/platformio-binary-reference.patch
new file mode 100644
index 000000000000..7022c0fc0c72
--- /dev/null
+++ b/pkgs/by-name/es/esphome/platformio-binary-reference.patch
@@ -0,0 +1,13 @@
+diff --git a/esphome/platformio_api.py b/esphome/platformio_api.py
+index fc21977f..e5059f1d 100644
+--- a/esphome/platformio_api.py
++++ b/esphome/platformio_api.py
+@@ -63,7 +63,7 @@ def run_platformio_cli(*args, **kwargs) -> str | int:
+     os.environ.setdefault("PYTHONWARNINGS", "ignore::SyntaxWarning")
+     # Increase uv retry count to handle transient network errors (default is 3)
+     os.environ.setdefault("UV_HTTP_RETRIES", "10")
+-    cmd = [sys.executable, "-m", "esphome.platformio_runner"] + list(args)
++    cmd = ["platformio"] + list(args)
+
+     return run_external_process(*cmd, **kwargs)
+

From 786e42045de6c09d26ca077b49d8c7537f1be330 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 May 2026 12:08:46 +0000
Subject: [PATCH 22/68] dprint-plugins.dprint-plugin-biome: 0.12.8 -> 0.12.9

---
 pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
index abb4ce1a531c..d5466e98f7eb 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Biome (JS/TS/JSON) wrapper plugin";
-  hash = "sha256-dje/9QfRL9D16J6NXErK1HdJyMZaLpI/L/lq3WdyQso=";
+  hash = "sha256-SRUOPwe3n15jluYzRi+SKRN9KSRF9KSSWoi898tMC18=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "biome";
@@ -17,6 +17,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-biome";
   updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
-  url = "https://plugins.dprint.dev/biome-0.12.8.wasm";
-  version = "0.12.8";
+  url = "https://plugins.dprint.dev/biome-0.12.9.wasm";
+  version = "0.12.9";
 }

From 3b99d45c86c5b2dcc42fd7f76b89545d1eabdd1a Mon Sep 17 00:00:00 2001
From: Linus Karl <linus@lotz.li>
Date: Fri, 1 May 2026 14:54:35 +0200
Subject: [PATCH 23/68] python3Packages.primp: fix deprecated pytestFlagsArray
 flag

---
 pkgs/development/python-modules/primp/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/primp/default.nix b/pkgs/development/python-modules/primp/default.nix
index d5fc8ca591fc..d3029dd8b2bf 100644
--- a/pkgs/development/python-modules/primp/default.nix
+++ b/pkgs/development/python-modules/primp/default.nix
@@ -45,9 +45,8 @@ buildPythonPackage (finalAttrs: {
   ];
   # pytest runs from the source root but asyncio_mode=auto is configured in
   # crates/primp-python/pyproject.toml, which pytest doesn't pick up from there
-  pytestFlagsArray = [
-    "-o"
-    "asyncio_mode=auto"
+  pytestFlags = [
+    "--override-ini=asyncio_mode=auto"
   ];
 
   disabledTestPaths = [

From e745785f808399b7654c0969a9e0be1c37944c43 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 1 May 2026 13:06:17 +0000
Subject: [PATCH 24/68] .github: Bump korthout/backport-action from 4.4.0 to
 4.5.0

Bumps [korthout/backport-action](https://github.com/korthout/backport-action) from 4.4.0 to 4.5.0.
- [Release notes](https://github.com/korthout/backport-action/releases)
- [Commits](https://github.com/korthout/backport-action/compare/ad30f01dbe543be4a24431001c38f3617af8c745...7c3f6cd5843cac11bc59a04a1b7699af93261670)

---
updated-dependencies:
- dependency-name: korthout/backport-action
  dependency-version: 4.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/backport.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 8ef6e37133f5..755d0d63ac8b 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: Create backport PRs
         id: backport
-        uses: korthout/backport-action@ad30f01dbe543be4a24431001c38f3617af8c745 # v4.4.0
+        uses: korthout/backport-action@7c3f6cd5843cac11bc59a04a1b7699af93261670 # v4.5.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           add_author_as_reviewer: true

From 2debdbcd54f88de49931db79cd801e4d00250867 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 May 2026 13:49:20 +0000
Subject: [PATCH 25/68] llvmPackages.lldbPlugins.llef: 2.2.3 -> 2.2.4

---
 pkgs/development/compilers/llvm/common/lldb-plugins/llef.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/llvm/common/lldb-plugins/llef.nix b/pkgs/development/compilers/llvm/common/lldb-plugins/llef.nix
index c94d4151d231..751584682a10 100644
--- a/pkgs/development/compilers/llvm/common/lldb-plugins/llef.nix
+++ b/pkgs/development/compilers/llvm/common/lldb-plugins/llef.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "llef";
-  version = "2.2.3";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "foundryzero";
     repo = "llef";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dTNp6rmiKTg7STpgFkeB2Jcz5V16SA7cIcql9TUiS5w=";
+    hash = "sha256-pUZ2d9ch1mQzfWqHy0srOJwNULGH7dUgVapCaImLa0g=";
   };
 
   dontBuild = true;

From 22a867f12cf98aa49c17d92fdfdff084b888bb7c Mon Sep 17 00:00:00 2001
From: superherointj <sergiomarcelo@ya.ru>
Date: Fri, 1 May 2026 14:45:17 -0300
Subject: [PATCH 26/68] opencode: 1.14.30 -> 1.14.31

https://github.com/anomalyco/opencode/releases/tag/v1.14.31
---
 pkgs/by-name/op/opencode/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 19306ec32400..1db120bacb9e 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -16,13 +16,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.14.30";
+  version = "1.14.31";
 
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pRMPa0ba71wLo4ZumbV18+y80GbcoU7NN6+P3e8LUTM=";
+    hash = "sha256-VHznPS2OuJ8urQqGK3K0ysQLCk+O8JV7/UCDdFyqafQ=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -75,7 +75,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-0dBgIXkGplKmq/sbXwhLoKUGwTIZU+TeC74YkByNOYk=";
+    outputHash = "sha256-f/cWCr6Oqnq21u9+UyhwE5PGqE9X5K+NtjEGbZ4ORPg=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };

From ddbbe106e1e22e1bfe68903360f1b850f6ea0bfa Mon Sep 17 00:00:00 2001
From: caverav <camilo@fvv.cl>
Date: Sat, 11 Apr 2026 15:32:07 -0400
Subject: [PATCH 27/68] semgrep: 1.152.0 -> 1.161.0

---
 .../python-modules/semgrep/common.nix         | 24 +++++----
 .../python-modules/semgrep/semgrep-core.nix   | 29 +++++++++--
 .../python-modules/semgrep/update.sh          | 49 +++++++++++++++----
 3 files changed, 77 insertions(+), 25 deletions(-)

diff --git a/pkgs/development/python-modules/semgrep/common.nix b/pkgs/development/python-modules/semgrep/common.nix
index 65a674251561..e6b1ef643199 100644
--- a/pkgs/development/python-modules/semgrep/common.nix
+++ b/pkgs/development/python-modules/semgrep/common.nix
@@ -1,9 +1,13 @@
 { lib }:
 
 rec {
-  version = "1.152.0";
+  version = "1.161.0";
 
-  srcHash = "sha256-CwF9URo3nUfkIWP277y03Bq9P6FUC4CQLjuiYwCPR6M=";
+  srcHash = "sha256-WvvEn5PUEXgwtYd72IuEljHUxcJRJh7uHzNLFqaVEbc=";
+
+  # This tag is used to select the correct wheel from PyPI.
+  # It is updated by the update.sh script.
+  pythonWheelTag = "cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314";
 
   # submodule dependencies
   # these are fetched so we:
@@ -13,8 +17,8 @@ rec {
     "cli/src/semgrep/semgrep_interfaces" = {
       owner = "semgrep";
       repo = "semgrep-interfaces";
-      rev = "76ce6450aba3422c297b35a16e38b9fd740fc860";
-      hash = "sha256-hU76aICQEI7n4tWwZX2fRjgiVw811E4UDkfqQqxX8c0=";
+      rev = "8a09b2ed5838118f0ecc45305eb9d956aabcd700";
+      hash = "sha256-jWv0/DADhYmBGJdMpxX8Rq2KQ2wlYIrJGGeYikcskOM=";
     };
   };
 
@@ -24,20 +28,20 @@ rec {
   # on github releases
   core = {
     x86_64-linux = {
-      platform = "musllinux_1_0_x86_64.manylinux2014_x86_64";
-      hash = "sha256-XFZfCxvfCSAs2NxCCbmIU2uN0StNwEPSGaTmaHpYMPo=";
+      platform = "manylinux_2_35_x86_64";
+      hash = "sha256-ioIlfWVDSPlCUPQQcB8RJNxwoMQzhGGsxe5xPhAbDZ0=";
     };
     aarch64-linux = {
-      platform = "musllinux_1_0_aarch64.manylinux2014_aarch64";
-      hash = "sha256-XdmzHKizsxrls1Ry7pW40f4BRjA6HEayhDUXuxDHoWk=";
+      platform = "manylinux_2_35_aarch64";
+      hash = "sha256-yDFnKdVIgt7eFNcWb0za9hdJJ7BYldEoiK46D0eRx4U=";
     };
     x86_64-darwin = {
       platform = "macosx_10_14_x86_64";
-      hash = "sha256-4ZVFhsN5VyDE/VTnzfellv2dHQIT2nCTKd/54UBRPw0=";
+      hash = "sha256-NFBo32ZfO0h0KunOaWefWRnyuu1XkYku5RTxOpCfWWQ=";
     };
     aarch64-darwin = {
       platform = "macosx_11_0_arm64";
-      hash = "sha256-rEK6kAEKdwIOcmdMhyjTn5MIXbEwLPqrZV3pg3cQINk=";
+      hash = "sha256-H51DqX94yMqbwvDrlIa3D64hBtvYAvelK7HLnVj588g=";
     };
   };
 
diff --git a/pkgs/development/python-modules/semgrep/semgrep-core.nix b/pkgs/development/python-modules/semgrep/semgrep-core.nix
index ea6f1f58eaba..97012ad1912e 100644
--- a/pkgs/development/python-modules/semgrep/semgrep-core.nix
+++ b/pkgs/development/python-modules/semgrep/semgrep-core.nix
@@ -1,23 +1,25 @@
 {
   lib,
-  stdenvNoCC,
+  stdenv,
   fetchPypi,
   unzip,
+  autoPatchelfHook,
 }:
 
 let
   common = import ./common.nix { inherit lib; };
 in
-stdenvNoCC.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "semgrep-core";
   inherit (common) version;
+
   # fetch pre-built semgrep-core since the ocaml build is complex and relies on
   # the opam package manager at some point
   # pulling it out of the python wheel as r2c no longer release a built binary
   # on github releases
   src =
     let
-      inherit (stdenvNoCC.hostPlatform) system;
+      inherit (stdenv.hostPlatform) system;
       data = common.core.${system} or (throw "Unsupported system: ${system}");
     in
     fetchPypi rec {
@@ -25,11 +27,16 @@ stdenvNoCC.mkDerivation rec {
       inherit version;
       format = "wheel";
       dist = python;
-      python = "cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314";
+      python = common.pythonWheelTag;
       inherit (data) platform hash;
     };
 
-  nativeBuildInputs = [ unzip ];
+  nativeBuildInputs = [
+    unzip
+  ]
+  ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
+
+  buildInputs = lib.optional stdenv.hostPlatform.isLinux stdenv.cc.cc.lib;
 
   # _tryUnzip from unzip's setup-hook doesn't recognise .whl
   # "do not know how to unpack source archive"
@@ -46,6 +53,18 @@ stdenvNoCC.mkDerivation rec {
   installPhase = ''
     runHook preInstall
     install -Dm 755 -t $out/bin semgrep-${version}.data/purelib/semgrep/bin/semgrep-core
+
+    # copy bundled libs as well
+    # keeping them in bin/libs matches the layout in the wheel
+    if [ -d semgrep-${version}.data/purelib/semgrep/bin/libs ]; then
+      mkdir -p $out/bin/libs
+      cp -rf semgrep-${version}.data/purelib/semgrep/bin/libs/* $out/bin/libs/
+
+      # help autoPatchelfHook find these libs
+      if [ -n "''${autoPatchelfHook:-}" ]; then
+        appendAutoPatchelfSearchPath $out/bin/libs
+      fi
+    fi
     runHook postInstall
   '';
 
diff --git a/pkgs/development/python-modules/semgrep/update.sh b/pkgs/development/python-modules/semgrep/update.sh
index f4f847f1113f..c5eecc39491f 100755
--- a/pkgs/development/python-modules/semgrep/update.sh
+++ b/pkgs/development/python-modules/semgrep/update.sh
@@ -19,7 +19,7 @@ NIXPKGS_ROOT="$ROOT/../../../.."
 COMMON_FILE="$ROOT/common.nix"
 
 instantiateClean() {
-    nix-instantiate -A "$1" --eval --strict | cut -d\" -f2
+    nix-instantiate "$NIXPKGS_ROOT" -A "$1" --eval --strict | cut -d\" -f2
 }
 
 # get latest version
@@ -40,10 +40,25 @@ replace() {
 
 fetchgithub() {
     set +eo pipefail
-    nix-build -A "$1" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g'
+    nix-build "$NIXPKGS_ROOT" -A "$1" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g'
     set -eo pipefail
 }
-replace "$OLD_VERSION" "$NEW_VERSION" "$COMMON_FILE"
+
+if [[ "$OLD_VERSION" != "$NEW_VERSION" ]]; then
+    replace "$OLD_VERSION" "$NEW_VERSION" "$COMMON_FILE"
+fi
+
+echo "Fetching PyPI metadata for $NEW_VERSION"
+PYPI_JSON=$(curl -s "https://pypi.org/pypi/semgrep/$NEW_VERSION/json")
+
+# Update Python compatibility tag from any Linux wheel
+NEW_PYTHON_TAG=$(echo "$PYPI_JSON" | jq -r '.urls[].filename' | grep 'manylinux' | head -n 1 | sed -E 's/semgrep-.*-(.*)-none-.*\.whl/\1/')
+OLD_PYTHON_TAG=$(instantiateClean semgrep.passthru.common.pythonWheelTag)
+
+if [[ "$OLD_PYTHON_TAG" != "$NEW_PYTHON_TAG" ]]; then
+    echo "Updating Python wheel tag: $OLD_PYTHON_TAG -> $NEW_PYTHON_TAG"
+    replace "$OLD_PYTHON_TAG" "$NEW_PYTHON_TAG" "$COMMON_FILE"
+fi
 
 echo "Updating src"
 
@@ -60,24 +75,38 @@ echo "Updated src"
 
 update_core_platform() {
     SYSTEM=$1
+    PYPI_ARCH=$2
+    PYPI_DISTRO=$3
     echo "Updating core src $SYSTEM"
 
-    PLATFORM="$(instantiateClean "semgrep.passthru.common.core.$SYSTEM.platform")"
+    OLD_PLATFORM="$(instantiateClean "semgrep.passthru.common.core.$SYSTEM.platform")"
+    NEW_PLATFORM=$(echo "$PYPI_JSON" | jq -r '.urls[].filename' | grep "$PYPI_DISTRO" | grep "$PYPI_ARCH" | head -n 1 | sed -E 's/semgrep-.*-none-(.*)\.whl/\1/')
+
+    if [[ -z "$NEW_PLATFORM" ]]; then
+        echo "Error: Could not find platform tag for $SYSTEM ($PYPI_DISTRO, $PYPI_ARCH) on PyPI" >&2
+        exit 1
+    fi
+
+    if [[ "$OLD_PLATFORM" != "$NEW_PLATFORM" ]]; then
+        echo "Updating platform: $OLD_PLATFORM -> $NEW_PLATFORM"
+        replace "$OLD_PLATFORM" "$NEW_PLATFORM" "$COMMON_FILE"
+    fi
 
     OLD_HASH="$(instantiateClean "semgrep.passthru.common.core.$SYSTEM.hash")"
-    URL="$(nix-instantiate -A "semgrep.passthru.semgrep-core.src.url" --raw --eval --strict --argstr system "$SYSTEM")"
+    URL="$(nix-instantiate "$NIXPKGS_ROOT" -A "semgrep.passthru.semgrep-core.src.url" --raw --eval --strict --argstr system "$SYSTEM")"
     echo "Old core hash $OLD_HASH"
-    NEW_HASH="$(nix hash convert --hash-algo sha256 --to sri $(nix-prefetch-url $URL))"
+    NEW_HASH="$(nix-hash --to-sri --type sha256 "$(nix-prefetch-url --type sha256 "$URL")")"
     echo "New core hash $NEW_HASH"
     replace "$OLD_HASH" "$NEW_HASH" "$COMMON_FILE"
 
     echo "Updated core src $SYSTEM"
 }
 
-update_core_platform "x86_64-linux"
-update_core_platform "aarch64-linux"
-update_core_platform "x86_64-darwin"
-update_core_platform "aarch64-darwin"
+# update_core_platform <nix-system> <pypi-arch> <pypi-distro>
+update_core_platform "x86_64-linux" "x86_64" "manylinux"
+update_core_platform "aarch64-linux" "aarch64" "manylinux"
+update_core_platform "x86_64-darwin" "x86_64" "macosx"
+update_core_platform "aarch64-darwin" "arm64" "macosx"
 
 OLD_PWD=$PWD
 TMPDIR="$(mktemp -d)"

From ebb711af78478cb6538ec3828865ab7c8e2412c1 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 1 May 2026 12:03:43 +0200
Subject: [PATCH 28/68] cargo-tauri: 2.9.6 -> 2.11.0

changelog: https://raw.githubusercontent.com/tauri-apps/tauri/refs/tags/tauri-cli-v2.11.0/crates/tauri-cli/CHANGELOG.md

diff: https://github.com/tauri-apps/tauri/compare/tauri-cli-v2.9.6...tauri-cli-v2.11.0
---
 pkgs/by-name/ca/cargo-tauri/package.nix   | 12 +++++++++---
 pkgs/by-name/ca/cargo-tauri/test-app.nix  |  2 +-
 pkgs/by-name/ca/cargo-tauri_1/package.nix |  2 ++
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-tauri/package.nix b/pkgs/by-name/ca/cargo-tauri/package.nix
index 6f07914f90f0..9f92cc247530 100644
--- a/pkgs/by-name/ca/cargo-tauri/package.nix
+++ b/pkgs/by-name/ca/cargo-tauri/package.nix
@@ -14,21 +14,27 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tauri";
-  version = "2.9.6";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "tauri-apps";
     repo = "tauri";
     tag = "tauri-cli-v${finalAttrs.version}";
-    hash = "sha256-VtZxFkxOLMNwl3A/2qoNJ/HXr5FXFKQYw+ri5Yp8eOE=";
+    hash = "sha256-hbTpLeWMc5nSJeq1vWKbVpfhp1KZjiBgmaiQMUs/MIQ=";
   };
 
-  cargoHash = "sha256-uAjEQBHDpVv73MbeoU86tObiXSUKKjImpMTLHXKMRNs=";
+  cargoHash = "sha256-PrvlPfK/9qyBWOs6hG3C3w9TMK7p1TCoKpjSWkhN2rY=";
 
   nativeBuildInputs = lib.optionals (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isLinux) [
     pkg-config
   ];
 
+  # Explicitly enable optional `rustls` dependency.
+  postPatch = ''
+    substituteInPlace crates/tauri/Cargo.toml \
+      --replace-fail 'dep:rustls' 'rustls'
+  '';
+
   buildInputs =
     # Required for tauri-macos-sign and RPM support in tauri-bundler
     lib.optionals (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isLinux) [
diff --git a/pkgs/by-name/ca/cargo-tauri/test-app.nix b/pkgs/by-name/ca/cargo-tauri/test-app.nix
index d2f442755197..56476795e708 100644
--- a/pkgs/by-name/ca/cargo-tauri/test-app.nix
+++ b/pkgs/by-name/ca/cargo-tauri/test-app.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     pnpm = pnpm_9;
 
     fetcherVersion = 3;
-    hash = "sha256-/g+2jZQq3nTJnKpj0PlT6zB3UcUBE2ND8797XRwVZ0s=";
+    hash = "sha256-DiRho0tmR/4XJi7cAZxesVA1iR8uiwknCfmIP2x9i5I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/cargo-tauri_1/package.nix b/pkgs/by-name/ca/cargo-tauri_1/package.nix
index 3bfc766dc9cb..167596c9f2fc 100644
--- a/pkgs/by-name/ca/cargo-tauri_1/package.nix
+++ b/pkgs/by-name/ca/cargo-tauri_1/package.nix
@@ -19,6 +19,8 @@ cargo-tauri.overrideAttrs (
 
     patches = [ ];
 
+    postPatch = "";
+
     # Manually specify the sourceRoot since this crate depends on other crates in the workspace. Relevant info at
     # https://discourse.nixos.org/t/difficulty-using-buildrustpackage-with-a-src-containing-multiple-cargo-workspaces/10202
     sourceRoot = "${finalAttrs.src.name}/tooling/cli";

From 9fc8a5c02d5551dc8b4a1ae2df684f751dd6b32d Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Sat, 2 May 2026 00:40:55 +0200
Subject: [PATCH 29/68] pmix: split outputs everywhere

---
 pkgs/by-name/pm/pmix/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pm/pmix/package.nix b/pkgs/by-name/pm/pmix/package.nix
index 20949e93ddbd..bb6debaa03a3 100644
--- a/pkgs/by-name/pm/pmix/package.nix
+++ b/pkgs/by-name/pm/pmix/package.nix
@@ -30,7 +30,10 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
-  outputs = [ "out" ] ++ lib.optionals stdenv.hostPlatform.isLinux [ "dev" ];
+  outputs = [
+    "out"
+    "dev"
+  ];
 
   postPatch = ''
     patchShebangs --build ./autogen.pl

From 92e61a6a4433c7d73f1aea67fe43c34fc1fb4489 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 2 May 2026 02:05:08 +0200
Subject: [PATCH 30/68] evcc: 0.305.1 -> 0.306.0

https://github.com/evcc-io/evcc/releases/tag/0.306.0
---
 pkgs/by-name/ev/evcc/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index df22d30414b5..40c909016665 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,16 +17,16 @@
 }:
 
 let
-  version = "0.305.1";
+  version = "0.306.0";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-XRaowjOErq+gAarBNcSydWbjuq4KUQkXb4YBbL7pCas=";
+    hash = "sha256-zg/DIh/HKJZraMIGcB2KKxiRQhuSrRDDcAEoL2prhFg=";
   };
 
-  vendorHash = "sha256-dQwbg1gTpDVnNGAN3scvohfsy2LCe4v9eGtNBVdZ1Hs=";
+  vendorHash = "sha256-0X8rzETUgLa83EA/GQnZUrWXUYnAm8H60kk6ZKsH9Yo=";
 
   commonMeta = {
     license = lib.licenses.mit;
@@ -52,7 +52,7 @@ buildGo126Module rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-9txp8CgwWRDiNt9ulIpvaWg41N4lsvJ05AyVBT15ESM=";
+    hash = "sha256-PL16KEA5XaJjE5SvziMxdjlG2j7fQutfOoSvruxGJHQ=";
   };
 
   nativeBuildInputs = [

From 4ac9c293d84fee8d50d1d561bd082c3d7912c3f0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 00:31:34 +0000
Subject: [PATCH 31/68] mint-themes: 2.3.8 -> 2.3.9

---
 pkgs/by-name/mi/mint-themes/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/mint-themes/package.nix b/pkgs/by-name/mi/mint-themes/package.nix
index 58340f387320..372e8bb91e5f 100644
--- a/pkgs/by-name/mi/mint-themes/package.nix
+++ b/pkgs/by-name/mi/mint-themes/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-themes";
-  version = "2.3.8";
+  version = "2.3.9";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-themes";
     rev = version;
-    hash = "sha256-cIXEg6Crq4DrHBeJUgwCF5k8A5bsR4trO0UC5wMZLpk=";
+    hash = "sha256-Zvy/qqyzc6Yu6TJC+vbJ660MYeyX27LIm1TovwbRjMs=";
   };
 
   nativeBuildInputs = [

From baf771f9e9d8ba1adb984f4d005ebe6b1406ef97 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 03:41:04 +0000
Subject: [PATCH 32/68] pantheon.elementary-dock: 8.3.2 -> 8.3.3

---
 pkgs/desktops/pantheon/apps/elementary-dock/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/desktops/pantheon/apps/elementary-dock/default.nix b/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
index 8271addfc595..3d2f6065b81d 100644
--- a/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-dock/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "elementary-dock";
-  version = "8.3.2";
+  version = "8.3.3";
 
   outputs = [
     "out"
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "elementary";
     repo = "dock";
     rev = finalAttrs.version;
-    hash = "sha256-knnr9uKBf27tovucAgAX5N//3t70KtO++Ei/1l74ZFg=";
+    hash = "sha256-13wXBqN4vovmiXXQyciy4yxIrByuLBvm+ypg2MLVMB4=";
   };
 
   depsBuildBuild = [ pkg-config ];

From b3d8ee4a11dbc2d78ed98964e94aa3d4112603ba Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 04:54:09 +0000
Subject: [PATCH 33/68] github-copilot-cli: 1.0.32 -> 1.0.40

---
 pkgs/by-name/gi/github-copilot-cli/sources.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/gi/github-copilot-cli/sources.json b/pkgs/by-name/gi/github-copilot-cli/sources.json
index aa1ce96c7ba5..9e56176f088d 100644
--- a/pkgs/by-name/gi/github-copilot-cli/sources.json
+++ b/pkgs/by-name/gi/github-copilot-cli/sources.json
@@ -1,19 +1,19 @@
 {
-  "version": "1.0.32",
+  "version": "1.0.40",
   "x86_64-linux": {
     "name": "copilot-linux-x64",
-    "hash": "sha256-K0UH4DsBNpKnypnOWjyVBF/tKQFRC/Se06RA1eZPt3M="
+    "hash": "sha256-ETlF92PA96vJX3oEBeQpxYV6oKhCK0EwAEiy35kGzPY="
   },
   "aarch64-linux": {
     "name": "copilot-linux-arm64",
-    "hash": "sha256-9snR+MC8EZESZde/xRQ28z8h/5vTFDMboAm60gOjilk="
+    "hash": "sha256-PxO+OiogtG0S8OChIVAh1WXC4UJSMn67cayiDtMKwAs="
   },
   "x86_64-darwin": {
     "name": "copilot-darwin-x64",
-    "hash": "sha256-fGY8ahkymJXAlcREgVB8UkICtn3zP52w1Lhur+F7LaY="
+    "hash": "sha256-kbP/ZMXUcG2kpdmsoBlUT+/I0paFSVymlkii5raiLkU="
   },
   "aarch64-darwin": {
     "name": "copilot-darwin-arm64",
-    "hash": "sha256-8Lzl6JJc1tpR1hO9gv/ck+zRy4zO7/ieLwfnppgKsLM="
+    "hash": "sha256-hmyWfR8EBLvKZ4we9DkEOgblkS8IZQvoLqTBlZWIauM="
   }
 }

From e27a0d60dc6a3c5a97ea834049eb08d0637e9298 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 07:27:31 +0000
Subject: [PATCH 34/68] silver-platter: 0.8.3 -> 0.8.4

---
 pkgs/by-name/si/silver-platter/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/si/silver-platter/package.nix b/pkgs/by-name/si/silver-platter/package.nix
index 8fb47feed802..e57a94b423b7 100644
--- a/pkgs/by-name/si/silver-platter/package.nix
+++ b/pkgs/by-name/si/silver-platter/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "silver-platter";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "jelmer";
     repo = "silver-platter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u/OmHvmMyBS+e3FzgIAtWQINzikFGHlBpLB1mbzwDs0=";
+    hash = "sha256-KafDAd457Kp2SK9ZCmslaTMd6Wx45fszQ0tzuqInT+o=";
   };
 
-  cargoHash = "sha256-hh9kjr2XN0g2QUznn8aJfDHNzgXdWJzY3Z6PxWOVmd0=";
+  cargoHash = "sha256-j+zKH4ZLYdaJnHp2vU1yZXEx0k17dwb7iZmC2najFPk=";
 
   buildInputs = [
     python3

From 9dd3056bd4471e08e01b411f19482669efc7fd4f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 08:13:12 +0000
Subject: [PATCH 35/68] vscode-extensions.ms-python.flake8: 2025.2.0 ->
 2026.4.0

---
 .../editors/vscode/extensions/ms-python.flake8/default.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix
index 3b56e76b7b4b..a228ae85084d 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.flake8/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-python";
     name = "flake8";
-    version = "2025.2.0";
-    hash = "sha256-DbPm/ekturW31jqZw0fvVOvzxAY286eJmgDcahDt0K0=";
+    version = "2026.4.0";
+    hash = "sha256-2o6a0wPYVFa+XWQoKBxKcWxlH8IPOzKxtXNt7qUi9mM=";
   };
 
   meta = {

From 48987fc730e5262c53aa1721e034b244adad4d07 Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Sat, 2 May 2026 10:17:37 +0200
Subject: [PATCH 36/68] isso: 0.13.0 -> 0.14.0

Fixes the NixOS test.
Removes EOL node version (#515284).
---
 pkgs/by-name/is/isso/package.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/is/isso/package.nix b/pkgs/by-name/is/isso/package.nix
index cd8486a3de53..975ae03df330 100644
--- a/pkgs/by-name/is/isso/package.nix
+++ b/pkgs/by-name/is/isso/package.nix
@@ -4,25 +4,25 @@
   fetchFromGitHub,
   nixosTests,
   fetchNpmDeps,
-  nodejs_20,
+  nodejs,
   npmHooks,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "isso";
-  version = "0.13.0";
+  version = "0.14.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "posativ";
     repo = "isso";
     tag = finalAttrs.version;
-    hash = "sha256-kZNf7Rlb1DZtQe4dK1B283OkzQQcCX+pbvZzfL65gsA=";
+    hash = "sha256-8kXqqiMXxF0wCJ+AzYT8j0rjuhlXO3F6UJbump672b4=";
   };
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-RBpuhFI0hdi8bB48Pks9Ac/UdcQ/DJw+WFnNj5f7IYE=";
+    hash = "sha256-e3r5iZLmXlf5YBPGgeNBDkdgfbNcIZIXbRLyyoyJiTU=";
   };
 
   outputs = [
@@ -40,6 +40,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     itsdangerous
     jinja2
     misaka
+    mistune
     html5lib
     werkzeug
     bleach
@@ -50,7 +51,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     python3Packages.cffi
     python3Packages.sphinxHook
     python3Packages.sphinx
-    nodejs_20
+    nodejs
     npmHooks.npmConfigHook
   ];
 

From 301eb24cc51491909f2c0949e0f1f721483ca239 Mon Sep 17 00:00:00 2001
From: Joel Pepper <pepper@bronze-deer.de>
Date: Sat, 2 May 2026 10:39:12 +0200
Subject: [PATCH 37/68] zsh-completion-sync: add updateScript

---
 pkgs/by-name/zs/zsh-completion-sync/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/zs/zsh-completion-sync/package.nix b/pkgs/by-name/zs/zsh-completion-sync/package.nix
index d094b8964c78..5d309f3cb4c0 100644
--- a/pkgs/by-name/zs/zsh-completion-sync/package.nix
+++ b/pkgs/by-name/zs/zsh-completion-sync/package.nix
@@ -2,6 +2,7 @@
   stdenvNoCC,
   lib,
   fetchFromGitHub,
+  gitUpdater,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -23,6 +24,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     install -D zsh-completion-sync.plugin.zsh  $out/share/zsh-completion-sync/zsh-completion-sync.plugin.zsh
   '';
 
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
   meta = {
     description = "Automatically loads completions added dynamically to FPATH or XDG_DATA_DIRS";
     homepage = "https://github.com/BronzeDeer/zsh-completion-sync";

From aa2408ccfa94a95eda87e7fdd631d34aeeff6c8c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 09:00:10 +0000
Subject: [PATCH 38/68] nwg-displays: 0.3.28 -> 0.4.0

---
 pkgs/by-name/nw/nwg-displays/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nw/nwg-displays/package.nix b/pkgs/by-name/nw/nwg-displays/package.nix
index c99bc98ffa15..13ab658b81d9 100644
--- a/pkgs/by-name/nw/nwg-displays/package.nix
+++ b/pkgs/by-name/nw/nwg-displays/package.nix
@@ -15,14 +15,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nwg-displays";
-  version = "0.3.28";
+  version = "0.4.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-displays";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PiE3d/o3ym2WmOzRsq7VRKt8TDQ4KCnePVObeI7+oKo=";
+    hash = "sha256-e1vAVJ6wsPWbKWnVQcp1f1Z+TP3whoMHopN0N0aS9fE=";
   };
 
   nativeBuildInputs = [

From d062d65d6118ccd28d06dba4fa44229f33277d2f Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Fri, 1 May 2026 10:10:51 +0200
Subject: [PATCH 39/68] kanidm_1_10: init at 1.10.0

Changelog: https://github.com/kanidm/kanidm/releases/tag/v1.10.0
---
 nixos/tests/kanidm-provisioning.nix           |   2 +-
 nixos/tests/kanidm.nix                        |   2 +-
 pkgs/servers/kanidm/1_10.nix                  |   5 +
 pkgs/servers/kanidm/1_9.nix                   |   1 +
 pkgs/servers/kanidm/generic.nix               |   9 +-
 .../1_10/oauth2-basic-secret-modify.patch     | 159 ++++++++++++++++++
 .../1_10/recover-account.patch                | 128 ++++++++++++++
 pkgs/top-level/all-packages.nix               |   6 +
 8 files changed, 309 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/servers/kanidm/1_10.nix
 create mode 100644 pkgs/servers/kanidm/provision-patches/1_10/oauth2-basic-secret-modify.patch
 create mode 100644 pkgs/servers/kanidm/provision-patches/1_10/recover-account.patch

diff --git a/nixos/tests/kanidm-provisioning.nix b/nixos/tests/kanidm-provisioning.nix
index 8813be497abe..133bd0d10cb2 100644
--- a/nixos/tests/kanidm-provisioning.nix
+++ b/nixos/tests/kanidm-provisioning.nix
@@ -18,7 +18,7 @@ in
   name = "kanidm-provisioning-${kanidmPackage.version}";
   meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_8;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_10;
 
   nodes.provision =
     { pkgs, lib, ... }:
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index 3edc4a8b239f..1d17d84908cf 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -22,7 +22,7 @@ in
     oddlama
   ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_8;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_10;
 
   nodes.server =
     { pkgs, ... }:
diff --git a/pkgs/servers/kanidm/1_10.nix b/pkgs/servers/kanidm/1_10.nix
new file mode 100644
index 000000000000..f87019c71ebb
--- /dev/null
+++ b/pkgs/servers/kanidm/1_10.nix
@@ -0,0 +1,5 @@
+import ./generic.nix {
+  version = "1.10.0";
+  hash = "sha256-VKzeyhps9NC+tU7NaGZf2kTCCK6J5LU1ewJBhS/Noek=";
+  cargoHash = "sha256-hvWZLGJBsMbpZQixafdYzqT+zMbk2vAtPYpJ4OBVhoU=";
+}
diff --git a/pkgs/servers/kanidm/1_9.nix b/pkgs/servers/kanidm/1_9.nix
index 2952a9f73a67..1e3c888071e3 100644
--- a/pkgs/servers/kanidm/1_9.nix
+++ b/pkgs/servers/kanidm/1_9.nix
@@ -2,4 +2,5 @@ import ./generic.nix {
   version = "1.9.3";
   hash = "sha256-YI2nShQhsCd1vn7S4VeCELfcU0HsmZrFs60kllJJFAo=";
   cargoHash = "sha256-b6kBDA/CDJHbybfvbRRZ++q9H+SVRu0BmgkwzN2i/YU=";
+  eolDate = "2026-05-31";
 }
diff --git a/pkgs/servers/kanidm/generic.nix b/pkgs/servers/kanidm/generic.nix
index dfaf78ba4b86..fcd8c3e543a9 100644
--- a/pkgs/servers/kanidm/generic.nix
+++ b/pkgs/servers/kanidm/generic.nix
@@ -59,6 +59,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit hash;
   };
 
+  __structuredAttrs = true;
+
   env.KANIDM_BUILD_PROFILE = "release_nixpkgs_${arch}";
 
   patches =
@@ -105,13 +107,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   buildInputs = [
-    openssl
     sqlite
     pam
     rust-jemalloc-sys
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     udev
+  ]
+  ++ lib.optionals (lib.versionOlder finalAttrs.version "1.10") [
+    openssl
   ];
 
   # The UI needs to be in place before the tests are run.
@@ -133,6 +137,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ''profile.release.lto="off"''
   ];
 
+  # A bunch of the tests break due to the sandboxing.
+  doCheck = false;
+
   preFixup = ''
     installShellCompletion \
       --bash $releaseDir/build/completions/*.bash \
diff --git a/pkgs/servers/kanidm/provision-patches/1_10/oauth2-basic-secret-modify.patch b/pkgs/servers/kanidm/provision-patches/1_10/oauth2-basic-secret-modify.patch
new file mode 100644
index 000000000000..5101273d30d1
--- /dev/null
+++ b/pkgs/servers/kanidm/provision-patches/1_10/oauth2-basic-secret-modify.patch
@@ -0,0 +1,159 @@
+From 5b97267c49def10f5a4b7bb372963261c0f4b08d Mon Sep 17 00:00:00 2001
+From: oddlama <oddlama@oddlama.org>
+Date: Fri, 1 May 2026 15:01:05 +0200
+Subject: [PATCH 1/2] oauth2 basic secret modify
+
+---
+ server/core/src/actors/v1_write.rs  | 42 +++++++++++++++++++++++++++++
+ server/core/src/https/v1.rs         |  6 ++++-
+ server/core/src/https/v1_oauth2.rs  | 29 ++++++++++++++++++++
+ server/lib/src/server/migrations.rs | 16 +++++++++++
+ 4 files changed, 92 insertions(+), 1 deletion(-)
+
+diff --git a/server/core/src/actors/v1_write.rs b/server/core/src/actors/v1_write.rs
+index 977292ae9..bf79c42a1 100644
+--- a/server/core/src/actors/v1_write.rs
++++ b/server/core/src/actors/v1_write.rs
+@@ -326,6 +326,48 @@ impl QueryServerWriteV1 {
+             .and_then(|_| idms_prox_write.commit().map(|_| ()))
+     }
+ 
++    #[instrument(
++        level = "info",
++        skip_all,
++        fields(uuid = ?eventid)
++    )]
++    pub async fn handle_oauth2_basic_secret_write(
++        &self,
++        client_auth_info: ClientAuthInfo,
++        filter: Filter<FilterInvalid>,
++        new_secret: String,
++        eventid: Uuid,
++    ) -> Result<(), OperationError> {
++        // Given a protoEntry, turn this into a modification set.
++        let ct = duration_from_epoch_now();
++        let mut idms_prox_write = self.idms.proxy_write(ct).await?;
++        let ident = idms_prox_write
++            .validate_client_auth_info_to_ident(client_auth_info, ct)
++            .map_err(|e| {
++                admin_error!(err = ?e, "Invalid identity");
++                e
++            })?;
++
++        let modlist = ModifyList::new_purge_and_set(
++            Attribute::OAuth2RsBasicSecret,
++            Value::SecretValue(new_secret),
++        );
++
++        let mdf =
++            ModifyEvent::from_internal_parts(ident, &modlist, &filter, &idms_prox_write.qs_write)
++                .map_err(|e| {
++                admin_error!(err = ?e, "Failed to begin modify during handle_oauth2_basic_secret_write");
++                e
++            })?;
++
++        trace!(?mdf, "Begin modify event");
++
++        idms_prox_write
++            .qs_write
++            .modify(&mdf)
++            .and_then(|_| idms_prox_write.commit())
++    }
++
+     #[instrument(
+         level = "info",
+         skip_all,
+diff --git a/server/core/src/https/v1.rs b/server/core/src/https/v1.rs
+index ba3ea2827..489ce0002 100644
+--- a/server/core/src/https/v1.rs
++++ b/server/core/src/https/v1.rs
+@@ -10,7 +10,7 @@ use axum::extract::{Path, State};
+ use axum::http::{HeaderMap, HeaderValue};
+ use axum::middleware::from_fn;
+ use axum::response::{IntoResponse, Response};
+-use axum::routing::{delete, get, post, put};
++use axum::routing::{delete, get, post, put, patch};
+ use axum::{Extension, Json, Router};
+ use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
+ use compact_jwt::{Jwk, Jws, JwsSigner};
+@@ -3156,6 +3156,10 @@ pub(crate) fn route_setup(state: ServerState) -> Router<ServerState> {
+             "/v1/oauth2/{rs_name}/_basic_secret",
+             get(super::v1_oauth2::oauth2_id_get_basic_secret),
+         )
++        .route(
++            "/v1/oauth2/{rs_name}/_basic_secret",
++            patch(super::v1_oauth2::oauth2_id_patch_basic_secret),
++        )
+         .route(
+             "/v1/oauth2/{rs_name}/_scopemap/{group}",
+             post(super::v1_oauth2::oauth2_id_scopemap_post)
+diff --git a/server/core/src/https/v1_oauth2.rs b/server/core/src/https/v1_oauth2.rs
+index fdc3647b4..ed4709d27 100644
+--- a/server/core/src/https/v1_oauth2.rs
++++ b/server/core/src/https/v1_oauth2.rs
+@@ -149,6 +149,35 @@ pub(crate) async fn oauth2_id_get_basic_secret(
+         .map_err(WebError::from)
+ }
+ 
++#[utoipa::path(
++    patch,
++    path = "/v1/oauth2/{rs_name}/_basic_secret",
++    request_body=ProtoEntry,
++    responses(
++        DefaultApiResponse,
++    ),
++    security(("token_jwt" = [])),
++    tag = "v1/oauth2",
++    operation_id = "oauth2_id_patch_basic_secret"
++)]
++/// Overwrite the basic secret for a given OAuth2 Resource Server.
++#[instrument(level = "info", skip(state, new_secret))]
++pub(crate) async fn oauth2_id_patch_basic_secret(
++    State(state): State<ServerState>,
++    Extension(kopid): Extension<KOpId>,
++    VerifiedClientInformation(client_auth_info): VerifiedClientInformation,
++    Path(rs_name): Path<String>,
++    Json(new_secret): Json<String>,
++) -> Result<Json<()>, WebError> {
++    let filter = oauth2_id(&rs_name);
++    state
++        .qe_w_ref
++        .handle_oauth2_basic_secret_write(client_auth_info, filter, new_secret, kopid.eventid)
++        .await
++        .map(Json::from)
++        .map_err(WebError::from)
++}
++
+ #[utoipa::path(
+     patch,
+     path = "/v1/oauth2/{rs_name}",
+diff --git a/server/lib/src/server/migrations.rs b/server/lib/src/server/migrations.rs
+index b3effb95b..5c6a56d24 100644
+--- a/server/lib/src/server/migrations.rs
++++ b/server/lib/src/server/migrations.rs
+@@ -220,6 +220,22 @@ impl QueryServer {
+             reload_required = true;
+         };
+ 
++        // secret provisioning: allow idm_admin to modify OAuth2RsBasicSecret.
++        write_txn.internal_modify_uuid(
++            UUID_IDM_ACP_OAUTH2_MANAGE_V1,
++            &ModifyList::new_append(
++                Attribute::AcpCreateAttr,
++                Attribute::OAuth2RsBasicSecret.into(),
++            ),
++        )?;
++        write_txn.internal_modify_uuid(
++            UUID_IDM_ACP_OAUTH2_MANAGE_V1,
++            &ModifyList::new_append(
++                Attribute::AcpModifyPresentAttr,
++                Attribute::OAuth2RsBasicSecret.into(),
++            ),
++        )?;
++
+         // Execute whatever operations we have batched up and ready to go. This is needed
+         // to preserve ordering of the operations - if we reloaded after a remigrate then
+         // we would have skipped the patch level fix which needs to have occurred *first*.
+-- 
+2.53.0
+
diff --git a/pkgs/servers/kanidm/provision-patches/1_10/recover-account.patch b/pkgs/servers/kanidm/provision-patches/1_10/recover-account.patch
new file mode 100644
index 000000000000..a462c14d5d1c
--- /dev/null
+++ b/pkgs/servers/kanidm/provision-patches/1_10/recover-account.patch
@@ -0,0 +1,128 @@
+From e8cd69afcee9d8d37233fa998cf9d1fa124ae90d Mon Sep 17 00:00:00 2001
+From: oddlama <oddlama@oddlama.org>
+Date: Fri, 1 May 2026 15:01:14 +0200
+Subject: [PATCH 2/2] recover account
+
+---
+ server/core/src/actors/internal.rs |  5 +++--
+ server/core/src/admin.rs           |  6 +++---
+ server/daemon/src/main.rs          | 24 +++++++++++++++++++++++-
+ server/daemon/src/opt.rs           |  7 +++++++
+ 4 files changed, 36 insertions(+), 6 deletions(-)
+
+diff --git a/server/core/src/actors/internal.rs b/server/core/src/actors/internal.rs
+index deed7350d..f4e9e486a 100644
+--- a/server/core/src/actors/internal.rs
++++ b/server/core/src/actors/internal.rs
+@@ -189,17 +189,18 @@ impl QueryServerWriteV1 {
+ 
+     #[instrument(
+         level = "info",
+-        skip(self, eventid),
++        skip(self, password, eventid),
+         fields(uuid = ?eventid)
+     )]
+     pub(crate) async fn handle_admin_recover_account(
+         &self,
+         name: String,
++        password: Option<String>,
+         eventid: Uuid,
+     ) -> Result<String, OperationError> {
+         let ct = duration_from_epoch_now();
+         let mut idms_prox_write = self.idms.proxy_write(ct).await?;
+-        let pw = idms_prox_write.recover_account(name.as_str(), None)?;
++        let pw = idms_prox_write.recover_account(name.as_str(), password.as_deref())?;
+ 
+         idms_prox_write.commit().map(|()| pw)
+     }
+diff --git a/server/core/src/admin.rs b/server/core/src/admin.rs
+index 6a13dcaab..6b1070113 100644
+--- a/server/core/src/admin.rs
++++ b/server/core/src/admin.rs
+@@ -27,7 +27,7 @@ const REPL_CTRL_TIMEOUT: Duration = Duration::from_secs(15);
+ 
+ #[derive(Serialize, Deserialize, Debug)]
+ pub enum AdminTaskRequest {
+-    RecoverAccount { name: String },
++    RecoverAccount { name: String, password: Option<String> },
+     DisableAccount { name: String },
+     ShowReplicationCertificate,
+     ShowReplicationCertificateMetadata,
+@@ -416,8 +416,8 @@ async fn handle_client(
+ 
+         let resp = async {
+             match req {
+-                AdminTaskRequest::RecoverAccount { name } => {
+-                    match server_rw.handle_admin_recover_account(name, eventid).await {
++                AdminTaskRequest::RecoverAccount { name, password } => {
++                    match server_rw.handle_admin_recover_account(name, password, eventid).await {
+                         Ok(password) => AdminTaskResponse::RecoverAccount { password },
+                         Err(e) => {
+                             error!(err = ?e, "error during recover-account");
+diff --git a/server/daemon/src/main.rs b/server/daemon/src/main.rs
+index 13653a5cb..ae560f9ce 100644
+--- a/server/daemon/src/main.rs
++++ b/server/daemon/src/main.rs
+@@ -380,11 +380,32 @@ fn check_file_ownership(opt: &KanidmdParser) -> Result<(), ExitCode> {
+ 
+ async fn scripting_command(cmd: ScriptingCommand, config: Configuration) -> ExitCode {
+     match cmd {
+-        ScriptingCommand::RecoverAccount { name } => {
++        ScriptingCommand::RecoverAccount { name, from_environment } => {
++            let password = if from_environment {
++                match std::env::var("KANIDM_RECOVER_ACCOUNT_PASSWORD_FILE") {
++                    Ok(path) => match tokio::fs::read_to_string(&path).await {
++                        Ok(contents) => Some(contents),
++                        Err(e) => {
++                            error!("Failed to read password file '{}': {}", path, e);
++                            return ExitCode::FAILURE;
++                        }
++                    },
++                    Err(_) => match std::env::var("KANIDM_RECOVER_ACCOUNT_PASSWORD") {
++                        Ok(val) => Some(val),
++                        Err(_) => {
++                            error!("Neither KANIDM_RECOVER_ACCOUNT_PASSWORD_FILE nor KANIDM_RECOVER_ACCOUNT_PASSWORD was set");
++                            return ExitCode::FAILURE;
++                        }
++                    }
++                }
++            } else {
++                None
++            };
+             submit_admin_req_json(
+                 config.adminbindpath.as_str(),
+                 AdminTaskRequest::RecoverAccount {
+                     name: name.to_owned(),
++                    password,
+                 },
+             )
+             .await;
+@@ -1008,6 +1029,7 @@ async fn kanidm_main(config: Configuration, opt: KanidmdParser) -> ExitCode {
+                 config.adminbindpath.as_str(),
+                 AdminTaskRequest::RecoverAccount {
+                     name: name.to_owned(),
++                    password: None,
+                 },
+             )
+             .await;
+diff --git a/server/daemon/src/opt.rs b/server/daemon/src/opt.rs
+index 524ba3134..fa3d70f44 100644
+--- a/server/daemon/src/opt.rs
++++ b/server/daemon/src/opt.rs
+@@ -128,6 +128,13 @@ enum ScriptingCommand {
+         #[clap(value_parser)]
+         /// The account name to recover credentials for.
+         name: String,
++        /// Use a password given via an environment variable.
++        /// - `KANIDM_RECOVER_ACCOUNT_PASSWORD_FILE` takes precedence and reads the desired
++        ///    password from the given file
++        /// - `KANIDM_RECOVER_ACCOUNT_PASSWORD` directly takes a
++        ///    password - beware that this will leave the password in the environment
++        #[clap(long = "from-environment")]
++        from_environment: bool,
+     },
+     /// Backup
+     Backup {
+-- 
+2.53.0
+
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 787d1b82a9fc..9f4fb5eb6498 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7976,14 +7976,20 @@ with pkgs;
       kanidm_1_9 = callPackage ../servers/kanidm/1_9.nix {
         kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_9;
       };
+      kanidm_1_10 = callPackage ../servers/kanidm/1_10.nix {
+        kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_10;
+      };
 
       kanidmWithSecretProvisioning_1_8 = kanidm_1_8.override { enableSecretProvisioning = true; };
       kanidmWithSecretProvisioning_1_9 = kanidm_1_9.override { enableSecretProvisioning = true; };
+      kanidmWithSecretProvisioning_1_10 = kanidm_1_10.override { enableSecretProvisioning = true; };
     })
     kanidm_1_8
     kanidm_1_9
+    kanidm_1_10
     kanidmWithSecretProvisioning_1_8
     kanidmWithSecretProvisioning_1_9
+    kanidmWithSecretProvisioning_1_10
     ;
 
   lemmy-server = callPackage ../servers/web-apps/lemmy/server.nix { };

From f5da79e88556a9fef3d5f1a5ead7ac7121fea328 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 2 May 2026 11:12:34 +0200
Subject: [PATCH 40/68] offat: relax openapi-spec-validator

---
 pkgs/by-name/of/offat/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/of/offat/package.nix b/pkgs/by-name/of/offat/package.nix
index 20eadf422de8..fa54cdcc3472 100644
--- a/pkgs/by-name/of/offat/package.nix
+++ b/pkgs/by-name/of/offat/package.nix
@@ -19,6 +19,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   sourceRoot = "${finalAttrs.src.name}/src";
 
   pythonRelaxDeps = [
+    "openapi-spec-validator"
     "rich"
     "setuptools"
     "tenacity"

From 06406868077892179a9e01edcd0d780f92776b0e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 09:12:59 +0000
Subject: [PATCH 41/68] vscode-extensions.amazonwebservices.amazon-q-vscode:
 2.0.0 -> 2.1.0

---
 .../extensions/amazonwebservices.amazon-q-vscode/default.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
index 73edb990c966..c6beff3fa30a 100644
--- a/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   mktplcRef = {
     name = "amazon-q-vscode";
     publisher = "AmazonWebServices";
-    version = "2.0.0";
-    hash = "sha256-XK0xCwvG5HBqTrERRkjpzbZCiAiK54d9vOt0Na3fzRI=";
+    version = "2.1.0";
+    hash = "sha256-DTh8IoJfKuAoNx5XS41wZlafoJwi68g0oJn0vXbEGDo=";
   };
 
   meta = {

From 29db8b3f9290ff41dedec3f8d00160d06577cb3f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 09:29:47 +0000
Subject: [PATCH 42/68] drawterm: 0-unstable-2026-04-14 ->
 0-unstable-2026-04-24

---
 pkgs/by-name/dr/drawterm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/dr/drawterm/package.nix b/pkgs/by-name/dr/drawterm/package.nix
index 7680b4b60d04..651ee0d5dd81 100644
--- a/pkgs/by-name/dr/drawterm/package.nix
+++ b/pkgs/by-name/dr/drawterm/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "drawterm";
-  version = "0-unstable-2026-04-14";
+  version = "0-unstable-2026-04-24";
 
   src = fetchFrom9Front {
     owner = "plan9front";
     repo = "drawterm";
-    rev = "aeb3be64bfc4c8d8c0b5fce70b26d12f7a59156a";
-    hash = "sha256-YHcdAjM5+NEuyjz2sYFZEFhr0nQzstfdJtZ/HvksNHQ=";
+    rev = "10b439425b074ec0934ee6145331e6f31423f00f";
+    hash = "sha256-jkjbLuJ2BstAdA8Gu2R8XKtw2MgFABYYurHcpM59HR8=";
   };
 
   enableParallelBuilding = true;

From 3322a56ef63da343cd76456baec6a1950186050f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 09:51:57 +0000
Subject: [PATCH 43/68] chhoto-url: 6.5.9 -> 6.6.0

---
 pkgs/by-name/ch/chhoto-url/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ch/chhoto-url/package.nix b/pkgs/by-name/ch/chhoto-url/package.nix
index 2ac30a4d55ff..97d633ad6797 100644
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "6.5.9";
+  version = "6.6.0";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-mpFyvzvAL/8vSM3gmS0+vaXEB0TxBdBXQtfcYdFrcEk=";
+    hash = "sha256-IJ7KUYUdLkaE8XP53SjSORzQYR7HiNoNgafktutnHzo=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
   '';
 
-  cargoHash = "sha256-bn+u5KPZ8tk7iMSygFdIYQsczUahblsfZNgYrxA+CyI=";
+  cargoHash = "sha256-PZHynhVBqMqpUD/COro3F3nvaolSC3Eq9z/tUdXpQoA=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url

From 81a57ef8dcabf5974d75aa7f9cbf987bdde79f64 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 2 May 2026 11:54:45 +0200
Subject: [PATCH 44/68] python3Packages.timezonefinder: 8.2.2 -> 8.2.4

Diff: https://github.com/jannikmi/timezonefinder/compare/8.2.2...8.2.4

Changelog: https://github.com/jannikmi/timezonefinder/blob/8.2.4/CHANGELOG.rst
---
 pkgs/development/python-modules/timezonefinder/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/timezonefinder/default.nix b/pkgs/development/python-modules/timezonefinder/default.nix
index 6e48eaf0a262..10452676e90e 100644
--- a/pkgs/development/python-modules/timezonefinder/default.nix
+++ b/pkgs/development/python-modules/timezonefinder/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "timezonefinder";
-  version = "8.2.2";
+  version = "8.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jannikmi";
     repo = "timezonefinder";
     tag = finalAttrs.version;
-    hash = "sha256-af5ylGW3NIbMfJojfAUPJl9aGNDkhijj1YWLuE0o3/A=";
+    hash = "sha256-f0JEnXQHhROe6jQ377xQlM21Afp1Lqs2fHfme1ah4QM=";
   };
 
   build-system = [ setuptools ];

From 7593b2a16782f2883c74b807a3b4a32820e6a193 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 2 May 2026 11:55:17 +0200
Subject: [PATCH 45/68] python3Packages.xiaomi-ble: 1.10.1 -> 1.11.0

Diff: https://github.com/Bluetooth-Devices/xiaomi-ble/compare/v1.10.1...v1.11.0

Changelog: https://github.com/Bluetooth-Devices/xiaomi-ble/releases/tag/v1.11.0
---
 pkgs/development/python-modules/xiaomi-ble/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index 0f69942ae3e3..0af15e1f58d4 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "xiaomi-ble";
-  version = "1.10.1";
+  version = "1.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = "xiaomi-ble";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-60n47FZy5m7aBCRPgwNCPMZ1sMofYZET0S5o2OjGKbg=";
+    hash = "sha256-ZxsG9qA69ocZc3M3r6EnnQfmBKf13N5EYM6J0VmXNy0=";
   };
 
   build-system = [ poetry-core ];

From 13049b146329be2d4709983b2fb3d3ded52cb7b2 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 2 May 2026 11:58:55 +0200
Subject: [PATCH 46/68] python3Packages.velbus-aio: 2026.4.0 -> 2026.4.1

Changelog: https://github.com/Cereal2nd/velbus-aio/releases/tag/2026.4.1
---
 pkgs/development/python-modules/velbus-aio/default.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/velbus-aio/default.nix b/pkgs/development/python-modules/velbus-aio/default.nix
index 773351f8062e..71855f7edd6b 100644
--- a/pkgs/development/python-modules/velbus-aio/default.nix
+++ b/pkgs/development/python-modules/velbus-aio/default.nix
@@ -6,24 +6,23 @@
   buildPythonPackage,
   fetchFromGitHub,
   lxml,
-  pyserial,
-  pyserial-asyncio-fast,
   pytest-asyncio,
   pytestCheckHook,
+  serialx,
   setuptools,
   writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "velbus-aio";
-  version = "2026.4.0";
+  version = "2026.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Cereal2nd";
     repo = "velbus-aio";
     tag = finalAttrs.version;
-    hash = "sha256-bFR4iZdvkY8pg4OzAH7E0vEw7E5kyEII2iLfeG5p3OQ=";
+    hash = "sha256-l77L2JI2jXw+cQw/yO1LvyWBxvUF0IBctM5V02BGtO8=";
     fetchSubmodules = true;
   };
 
@@ -34,8 +33,7 @@ buildPythonPackage (finalAttrs: {
     backoff
     beautifulsoup4
     lxml
-    pyserial
-    pyserial-asyncio-fast
+    serialx
   ];
 
   nativeCheckInputs = [

From 6319ceb42e3223717f21ced9600f8ff093327f97 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 09:59:36 +0000
Subject: [PATCH 47/68] moor: 2.12.1 -> 2.12.3

---
 pkgs/by-name/mo/moor/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mo/moor/package.nix b/pkgs/by-name/mo/moor/package.nix
index 78df49597cff..c170924d2e89 100644
--- a/pkgs/by-name/mo/moor/package.nix
+++ b/pkgs/by-name/mo/moor/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "moor";
-  version = "2.12.1";
+  version = "2.12.3";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z2N8zEeP3wSrq3PPBXQgEEGz6EZnuzdLAu/Ce5c9JvA=";
+    hash = "sha256-nqwdWDJ4lpWJL79Bjk17U81xqz4l0Q75jG2tJfYmV/w=";
   };
 
   vendorHash = "sha256-fHOatNwedbDNGp7V8ynW1NiTkqSJmo8vrv6S64gUQqM=";

From 986634a8f29e97992ab7960d8667eae3e2441651 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 10:23:19 +0000
Subject: [PATCH 48/68] oci-cli: 3.80.0 -> 3.81.0

---
 pkgs/by-name/oc/oci-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/oc/oci-cli/package.nix b/pkgs/by-name/oc/oci-cli/package.nix
index a393bb78e132..220c7c292dbb 100644
--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@@ -26,14 +26,14 @@ in
 
 py.pkgs.buildPythonApplication (finalAttrs: {
   pname = "oci-cli";
-  version = "3.80.0";
+  version = "3.81.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "oci-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ss7nKT4dIyJxJNBK8HgAPXG0lS5MMZw7sw8hPjLqYUQ=";
+    hash = "sha256-8fZxGvgk46BDeNraEfzA4V/Lptk4QpjlZ+2mvfsWMb0=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

From 2f2f52ca57b9afdd4b35e0946f381091ea80ec7e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 10:31:10 +0000
Subject: [PATCH 49/68] vscode-extensions.ms-python.pylint: 2025.2.0 ->
 2026.4.0

---
 .../editors/vscode/extensions/ms-python.pylint/default.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.pylint/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.pylint/default.nix
index 7fda5a1d09bc..1cc22b7a7a3e 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.pylint/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.pylint/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-python";
     name = "pylint";
-    version = "2025.2.0";
-    hash = "sha256-3RqY/uugtJvT2lWxsA8NWFWel/CxMZzo7PnS9SaRdGg=";
+    version = "2026.4.0";
+    hash = "sha256-yWp7poC1PCoou+1XADmW0ftzyQDtJbqb3YyMf24Jprc=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/ms-python.pylint/changelog";

From a6bbaf3f21d1d969368a2d748bd6673db9f404b3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 10:44:14 +0000
Subject: [PATCH 50/68] serie: 0.7.2 -> 0.8.0

---
 pkgs/by-name/se/serie/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/se/serie/package.nix b/pkgs/by-name/se/serie/package.nix
index aac622dd99fb..4735ebfb1fdf 100644
--- a/pkgs/by-name/se/serie/package.nix
+++ b/pkgs/by-name/se/serie/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "serie";
-  version = "0.7.2";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "lusingander";
     repo = "serie";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/w/LKU2ObPjoO7RQ5HehCAqWv3Hfu7a+6Rk+rPx5MSM=";
+    hash = "sha256-+kiNeMhturrWWxU9/GrQnen4vxZEaxQEUbA8sCYHvk8=";
   };
 
-  cargoHash = "sha256-JeK2UIlG4MmOxGPxy2HbFTgpi14/zyibuFQyrQooItg=";
+  cargoHash = "sha256-0VkBnKF3DEkaoqn4r6aUMteUSzabpoHyCrqBXQ0UELs=";
 
   nativeCheckInputs = [ gitMinimal ];
 

From 72369a83b4479b80c8302cdfbbb46e4c15796dbc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 11:52:44 +0000
Subject: [PATCH 51/68] go-sendxmpp: 0.15.5 -> 0.15.6

---
 pkgs/by-name/go/go-sendxmpp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/go-sendxmpp/package.nix b/pkgs/by-name/go/go-sendxmpp/package.nix
index 6cfd1d7884e5..b1fe5902ade5 100644
--- a/pkgs/by-name/go/go-sendxmpp/package.nix
+++ b/pkgs/by-name/go/go-sendxmpp/package.nix
@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-sendxmpp";
-  version = "0.15.5";
+  version = "0.15.6";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "mdosch";
     repo = "go-sendxmpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uOJ7pI+6ETjb0iRMM3XDeztXHjxNQlU05ODTiBi72LY=";
+    hash = "sha256-HoK13rhsH5OyRHLuuCC+zGpcrK1591Zqy0hUinHbhcE=";
   };
 
-  vendorHash = "sha256-tt70h/JG8t9tbhqJoPu0KPVJ8ZbNKq0h7oLfiPAL4jg=";
+  vendorHash = "sha256-Zy3oewVeoKEIOmh2lxyjBIHNCJX/YtWxuGOk6IM9CXs=";
 
   passthru = {
     tests = { inherit (nixosTests) ejabberd prosody; };

From 17e83e3afbb346f1293bf2f7e01756adda1e1339 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 2 May 2026 14:05:52 +0200
Subject: [PATCH 52/68] python3Packages.pydantic-graph: 1.88.0 -> 1.89.1

https://github.com/pydantic/pydantic-ai/compare/v1.88.0...v1.89.1
---
 pkgs/development/python-modules/pydantic-graph/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pydantic-graph/default.nix b/pkgs/development/python-modules/pydantic-graph/default.nix
index 82ccbaf2a39c..9cc4ddeccc36 100644
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-graph";
-  version = "1.88.0";
+  version = "1.89.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2DyPJNbGFkbgYd2qLqhlTkmsgpLcTkkq3+7JKMocnBk=";
+    hash = "sha256-AD4tFynt+CO/Tjhndbg8WrQ/qPmaWMPjBsz7xZQOfSo=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_graph";

From 99d6974ce0b047aaa3603f3c2c346e1ce76d7f63 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 12:07:26 +0000
Subject: [PATCH 53/68] ghciwatch: 1.3.2 -> 1.3.5

---
 pkgs/by-name/gh/ghciwatch/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/ghciwatch/package.nix b/pkgs/by-name/gh/ghciwatch/package.nix
index e5ba6c38acbc..d2025871b576 100644
--- a/pkgs/by-name/gh/ghciwatch/package.nix
+++ b/pkgs/by-name/gh/ghciwatch/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ghciwatch";
-  version = "1.3.2";
+  version = "1.3.5";
 
   src = fetchFromGitHub {
     owner = "MercuryTechnologies";
     repo = "ghciwatch";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3S9nw2wvl/ORwPGfWknqhsooH3XkF87OyiGFVLK/YqA=";
+    hash = "sha256-ivSn1q/E0akz2JEkGcfB8i46Vom8/Pp/DlFBI+Zmo5Q=";
   };
 
-  cargoHash = "sha256-3vv6WPbxvZdcAr/ynzbmh6xHAPFB2Z/1TS7fMrq0EHE=";
+  cargoHash = "sha256-LZIBQ5dKtqTsMjLrhBucsgSAdmsGKkhOFtMCGh3clPk=";
 
   # integration tests are not run but the macros need this variable to be set
   env.GHC_VERSIONS = "";

From 287019e10a6dbabea4afc863e708569bc193d1ac Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 2 May 2026 14:07:28 +0200
Subject: [PATCH 54/68] python3Packages.pydantic-ai-slim: 1.88.0 -> 1.89.1

https://github.com/pydantic/pydantic-ai/compare/v1.88.0...v1.89.1
---
 pkgs/development/python-modules/pydantic-ai-slim/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pydantic-ai-slim/default.nix b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
index acbd447db5cd..9dfad31b46de 100644
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-ai-slim";
-  version = "1.88.0";
+  version = "1.89.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2DyPJNbGFkbgYd2qLqhlTkmsgpLcTkkq3+7JKMocnBk=";
+    hash = "sha256-AD4tFynt+CO/Tjhndbg8WrQ/qPmaWMPjBsz7xZQOfSo=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";

From 5ba0c7ac65f884e14a49c22f0fb8a21e7ed7b795 Mon Sep 17 00:00:00 2001
From: Karl Beecken <karl@beecken.berlin>
Date: Sun, 26 Apr 2026 15:29:29 +0200
Subject: [PATCH 55/68] esphome: maintainers: add karlbeecken

---
 pkgs/by-name/es/esphome/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 237d891906ad..7dd6ee371525 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -206,6 +206,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
       hexa
       picnoir
       thanegill
+      karlbeecken
     ];
     mainProgram = "esphome";
   };

From 055510b96f31a0f106c6d47d9aaf8a0ec7879fac Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 12:14:21 +0000
Subject: [PATCH 56/68] notesnook: 3.3.15 -> 3.3.16

---
 pkgs/by-name/no/notesnook/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/no/notesnook/package.nix b/pkgs/by-name/no/notesnook/package.nix
index df3f9b4b74c4..472c4e91cf83 100644
--- a/pkgs/by-name/no/notesnook/package.nix
+++ b/pkgs/by-name/no/notesnook/package.nix
@@ -9,7 +9,7 @@
 
 let
   pname = "notesnook";
-  version = "3.3.15";
+  version = "3.3.16";
 
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "Unsupported system: ${system}";
@@ -27,10 +27,10 @@ let
     url = "https://github.com/streetwriters/notesnook/releases/download/v${version}/notesnook_${suffix}";
     hash =
       {
-        x86_64-linux = "sha256-CGFLiDxhr9VC9U1fppjJX/x0ZWgDWKPymLY4LJAnGxY=";
-        aarch64-linux = "sha256-dqpYjvxjSb/rSJ4wLJsPGPzdPPOxzpa8LUsdqlPzT/M=";
-        x86_64-darwin = "sha256-hLKA3z1HDhPzMCBVxDl05DsDexG73rcKHhR5ERQCgJo=";
-        aarch64-darwin = "sha256-j1SQ/hn/IZ7aZQiIx6UgkOSxs6vqPGS0y4AXkXWcFGM=";
+        x86_64-linux = "sha256-zwAGZHNbD58s5dsn2N76VQJlyCuYUtNNEEMJJh/yxqc=";
+        aarch64-linux = "sha256-AEY1s7K/HKEmWYU16ibE3qXZL2EyETsr6Wzhz2hiSdk=";
+        x86_64-darwin = "sha256-HXcrlOwHqYASVobtoES1+A1jXvGBPI/hPNp3MSjSRjg=";
+        aarch64-darwin = "sha256-a4S/9U/wc9XGiWh1YS7AeEP3bAGwCLcgGWJ+qL7cTJA=";
       }
       .${system} or throwSystem;
   };

From b3f946cb31f8b7988d4994e9dd065912cc56c704 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 12:16:29 +0000
Subject: [PATCH 57/68] rumdl: 0.1.80 -> 0.1.86

---
 pkgs/by-name/ru/rumdl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rumdl/package.nix b/pkgs/by-name/ru/rumdl/package.nix
index 0c8c863888b4..cf045a0dfcd9 100644
--- a/pkgs/by-name/ru/rumdl/package.nix
+++ b/pkgs/by-name/ru/rumdl/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rumdl";
-  version = "0.1.80";
+  version = "0.1.86";
 
   src = fetchFromGitHub {
     owner = "rvben";
     repo = "rumdl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xa5mk62VUdsZVipD1gwTK9kR5GSXEyxu02t6zcMff0E=";
+    hash = "sha256-DtI1GIljCksY4zQf6eCf1J5iF/jWSs0yT8QGepEDawI=";
   };
 
-  cargoHash = "sha256-zxj60PE3CpNnF/h3nTHX4yKh2QfR8TLZkl1Purc058k=";
+  cargoHash = "sha256-mJHsMt+Hv4t20iKZezQqhyPpqWjQRIYSDfUSx6Fog0A=";
 
   cargoBuildFlags = [
     "--bin=rumdl"

From c6bdaeb1a0ebe460758a35a0c5e816f8a5398642 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 12:30:39 +0000
Subject: [PATCH 58/68] mint-l-theme: 2.0.6 -> 2.0.7

---
 pkgs/by-name/mi/mint-l-theme/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/mint-l-theme/package.nix b/pkgs/by-name/mi/mint-l-theme/package.nix
index e30eacb2ae15..bcff5c4af2ea 100644
--- a/pkgs/by-name/mi/mint-l-theme/package.nix
+++ b/pkgs/by-name/mi/mint-l-theme/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mint-l-theme";
-  version = "2.0.6";
+  version = "2.0.7";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-l-theme";
     tag = finalAttrs.version;
-    hash = "sha256-Lss8P0L6gxbP88MiTfv3VfOFkvkEUDXIPBoFHPxLWqE=";
+    hash = "sha256-Wk480v9AHUfcaZP9sm/boIFWcbuhmJ5cH14qV4BRtuw=";
   };
 
   nativeBuildInputs = [

From 882a7e9c12aaa86e8e0a414ba0147d628e2c561d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 12:42:44 +0000
Subject: [PATCH 59/68] driversi686Linux.mesa: 26.0.5 -> 26.0.6

---
 pkgs/development/libraries/mesa/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
index bf631907ad72..b784cb02ea93 100644
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "26.0.5";
+  version = "26.0.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-fhe3mHZQmZ3lm0XMKWWL8MKBbK5aAJCFFvDPyiI9K/A=";
+    hash = "sha256-rSX+dVcquTIdITfTy+heipeq6xktOaA3psn6vXm1S34=";
   };
 
   meta = {

From 043674eaf9b1325381837db420f14afa63b4e980 Mon Sep 17 00:00:00 2001
From: superherointj <sergiomarcelo@ya.ru>
Date: Sat, 2 May 2026 09:54:10 -0300
Subject: [PATCH 60/68] openspec: unpin nodejs

Satisfies request from #515284
---
 pkgs/by-name/op/openspec/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/openspec/package.nix b/pkgs/by-name/op/openspec/package.nix
index 749e4f05f146..b7a39c0ba90b 100644
--- a/pkgs/by-name/op/openspec/package.nix
+++ b/pkgs/by-name/op/openspec/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
-  nodejs_20,
+  nodejs,
   pnpm_9,
   fetchPnpmDeps,
   pnpmConfigHook,
@@ -30,7 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    nodejs_20
+    nodejs
     pnpmConfigHook
     pnpm_9
     makeWrapper
@@ -51,7 +51,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     mkdir -p $out/bin $out/lib/openspec
 
     substituteInPlace bin/openspec.js \
-      --replace '#!/usr/bin/env node' '#!${nodejs_20}/bin/node' \
+      --replace '#!/usr/bin/env node' '#!${nodejs}/bin/node' \
       --replace "../dist" "$out/lib/openspec/dist"
     install -Dm755 bin/openspec.js $out/bin/openspec
 

From ae5a262779e34d1f6f16de08ebd09d510d8b51da Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 2 May 2026 15:13:19 +0200
Subject: [PATCH 61/68] python3Packages.esp-idf-size: 2.1.0 -> 2.2.0

https://github.com/espressif/esp-idf-size/blob/v2.2.0/CHANGELOG.md
---
 .../python-modules/esp-idf-size/1.x-compat.patch   | 14 +++++++-------
 .../python-modules/esp-idf-size/default.nix        |  4 ++--
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/esp-idf-size/1.x-compat.patch b/pkgs/development/python-modules/esp-idf-size/1.x-compat.patch
index b1386aee06f0..e0b0c0fe94ce 100644
--- a/pkgs/development/python-modules/esp-idf-size/1.x-compat.patch
+++ b/pkgs/development/python-modules/esp-idf-size/1.x-compat.patch
@@ -1,13 +1,13 @@
 diff --git a/esp_idf_size/main.py b/esp_idf_size/main.py
-index a600b90..cfe3618 100644
+index 13bfa9d..b44289f 100644
 --- a/esp_idf_size/main.py
 +++ b/esp_idf_size/main.py
-@@ -45,6 +45,8 @@ def main() -> None:
-     parser = argparse.ArgumentParser(prog='esp_idf_size',
-                                      description='This tool displays firmware size information for project built by ESP-IDF')
+@@ -49,6 +49,8 @@ def main() -> None:
+         prog='esp_idf_size', description='This tool displays firmware size information for project built by ESP-IDF'
+     )
  
 +    parser.add_argument('--ng', action='store_true', help="stub for 1.x compat")
 +
-     parser.add_argument('input_file',
-                         metavar='MAP_FILE',
-                         help='Path to the link map file generated by the ESP-IDF build system.')
+     parser.add_argument(
+         'input_file', metavar='MAP_FILE', help='Path to the link map file generated by the ESP-IDF build system.'
+     )
diff --git a/pkgs/development/python-modules/esp-idf-size/default.nix b/pkgs/development/python-modules/esp-idf-size/default.nix
index cf253d2ad7da..4484902d066a 100644
--- a/pkgs/development/python-modules/esp-idf-size/default.nix
+++ b/pkgs/development/python-modules/esp-idf-size/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "esp-idf-size";
-  version = "2.1.0";
+  version = "2.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "espressif";
     repo = "esp-idf-size";
     tag = "v${version}";
-    hash = "sha256-A78sbuxn26gJqZ84EhYWKCVtkZE3gRT3jbjWLpwjXpQ=";
+    hash = "sha256-tiNk1yh8FPwLEKAw+h+Lp5n0aY/FpTwqZjtAQtZK6eY=";
   };
 
   patches = [

From 8676817f1434f2f138305f039e15329b6eb7bd73 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 13:54:54 +0000
Subject: [PATCH 62/68] vencord: 1.14.10 -> 1.14.11

---
 pkgs/by-name/ve/vencord/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 5467002ebef5..fcd21a782cb1 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -19,7 +19,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.14.10";
+  version = "1.14.11";
 
   src = fetchFromGitHub {
     owner = "Vendicated";

From da99a94413fae93c1a40b2ca7ab87f61fac90a7a Mon Sep 17 00:00:00 2001
From: Angelo Delefortrie <angelo.delefortrie@gmail.com>
Date: Tue, 28 Apr 2026 10:53:14 +0200
Subject: [PATCH 63/68] swagger-typescript-api: 13.6.5 -> 13.7.2

---
 pkgs/by-name/sw/swagger-typescript-api/package.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sw/swagger-typescript-api/package.nix b/pkgs/by-name/sw/swagger-typescript-api/package.nix
index a8dd7f797fcc..564483ef58f0 100644
--- a/pkgs/by-name/sw/swagger-typescript-api/package.nix
+++ b/pkgs/by-name/sw/swagger-typescript-api/package.nix
@@ -9,10 +9,10 @@
 }:
 let
   pname = "swagger-typescript-api";
-  version = "13.6.5";
+  version = "13.7.2";
 
   node-modules-hash = {
-    "x86_64-linux" = "sha256-N19ocmrqQ8SpDNhmpCNC1wdWGrkBXCdio+ZfEXceaUA=";
+    "x86_64-linux" = "sha256-1Wy9RWNvMmxSY72Qcam/jCVwurGk4ms9PTR5tt6t03I=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -22,19 +22,27 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "acacode";
     repo = "swagger-typescript-api";
     rev = "v${version}";
-    hash = "sha256-DAgE88JBJLNkg9WOO2qVI2dpdfNFvvBIcy++S/PX2NY=";
+    hash = "sha256-2sAE3wD/vUjaxvlhfrBRSErB3PsjQfi4UAcc4tU0le4=";
   };
 
   node_modules = stdenv.mkDerivation {
     inherit (finalAttrs) src version;
     pname = "${pname}-node_modules";
 
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND"
+      "SOCKS_SERVER"
+    ];
+
     nativeBuildInputs = [
       bun
       writableTmpDirAsHomeHook
     ];
 
     dontConfigure = true;
+    # Prevent patchShebangs from rewriting node_modules/.bin shebangs to store
+    # paths, which would make this fixed-output derivation's output hash unstable.
+    dontPatchShebangs = true;
 
     buildPhase = ''
       runHook preBuild

From a4baa5d47d4bb90ce9d21c30d3d68e1d7149c4d9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 14:08:46 +0000
Subject: [PATCH 64/68] sub-store-frontend: 2.16.59 -> 2.16.79

---
 pkgs/by-name/su/sub-store-frontend/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/su/sub-store-frontend/package.nix b/pkgs/by-name/su/sub-store-frontend/package.nix
index d181d61e6f9a..3de1b23a1b9e 100644
--- a/pkgs/by-name/su/sub-store-frontend/package.nix
+++ b/pkgs/by-name/su/sub-store-frontend/package.nix
@@ -13,13 +13,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "sub-store-frontend";
-  version = "2.16.59";
+  version = "2.16.79";
 
   src = fetchFromGitHub {
     owner = "sub-store-org";
     repo = "Sub-Store-Front-End";
     tag = finalAttrs.version;
-    hash = "sha256-dTjKRkYtt7BA2Q95skXdn2TZNEt1NnXlVzRGUlRdly4=";
+    hash = "sha256-CwLvnxR6MSX+ZwogXEgQHny+IsH4sZrItChXWho3ZP8=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,7 @@ buildNpmPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-gQe5AMRZgjp1G95bFgCBMlhVql+ZHgPfJ2DOklFyk2k=";
+    hash = "sha256-L3uoUFks3QonOQl0kOHYwOM1deFiNSqe0chv5YFpH4o=";
   };
 
   npmConfigHook = pnpmConfigHook;

From 25abaa96e43a01ace15e86954db5a86a4e726aa5 Mon Sep 17 00:00:00 2001
From: 2kybe3 <kybe@kybe.xyz>
Date: Sat, 2 May 2026 16:18:09 +0200
Subject: [PATCH 65/68] ffmpeg-normalize: 1.37.3 -> 1.37.6

Diff: https://github.com/slhck/ffmpeg-normalize/compare/v1.37.3...v1.37.6
Changelogs:
> https://github.com/slhck/ffmpeg-normalize/releases/tag/v1.37.6
> https://github.com/slhck/ffmpeg-normalize/releases/tag/v1.37.5
> https://github.com/slhck/ffmpeg-normalize/releases/tag/v1.37.4
---
 pkgs/by-name/ff/ffmpeg-normalize/package.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ff/ffmpeg-normalize/package.nix b/pkgs/by-name/ff/ffmpeg-normalize/package.nix
index 503bf797b9dc..ef76e3111299 100644
--- a/pkgs/by-name/ff/ffmpeg-normalize/package.nix
+++ b/pkgs/by-name/ff/ffmpeg-normalize/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ffmpeg-normalize";
-  version = "1.37.3";
+  version = "1.37.6";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "ffmpeg_normalize";
-    hash = "sha256-mN4vmiST+LV5Bv/QZ9Pvo3qzhTaeD3MpDa8sLNqjeW0=";
+    hash = "sha256-zsfWqdGyEI8OT4/L0wTxkmdqcI6NEfr5SAc7+O7FYu4=";
   };
 
   build-system = with python3Packages; [ uv-build ];
@@ -29,9 +29,6 @@ python3Packages.buildPythonApplication rec {
 
   postPatch = with python3Packages; ''
     substituteInPlace pyproject.toml \
-      --replace-fail \
-      'requires = ["uv_build>=0.8.14,<0.9.0"]' \
-      'requires = ["uv_build==${uv-build.version}"]' \
       --replace-fail \
       'colorlog==6.7.0' \
       'colorlog==${colorlog.version}'

From f30fa91f3382e136add47744c65858a92925a782 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 14:31:25 +0000
Subject: [PATCH 66/68] exploitdb: 2026-04-30 -> 2026-05-01

---
 pkgs/by-name/ex/exploitdb/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/exploitdb/package.nix b/pkgs/by-name/ex/exploitdb/package.nix
index 5d87e1feba31..eaeed731d09f 100644
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "exploitdb";
-  version = "2026-04-30";
+  version = "2026-05-01";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     tag = finalAttrs.version;
-    hash = "sha256-ApOecbOVoriicvhtQ87n+8jnwbKlQqbZsmBwsI0A9B0=";
+    hash = "sha256-BZ1X9SpXf+HSY/4xz9imnCwK3si7c130Havg/ATI/LQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 161817a94589ac8196bfd8caa6b41ee01ef49bfc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 14:35:38 +0000
Subject: [PATCH 67/68] sub-store: 2.22.6 -> 2.22.15

---
 pkgs/by-name/su/sub-store/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/su/sub-store/package.nix b/pkgs/by-name/su/sub-store/package.nix
index effe58a1a440..8b7b2580f12a 100644
--- a/pkgs/by-name/su/sub-store/package.nix
+++ b/pkgs/by-name/su/sub-store/package.nix
@@ -15,13 +15,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "sub-store";
-  version = "2.22.6";
+  version = "2.22.15";
 
   src = fetchFromGitHub {
     owner = "sub-store-org";
     repo = "Sub-Store";
     tag = finalAttrs.version;
-    hash = "sha256-bK9N1/HodME8XEHA07h8IEMXDtnBKzBf8waMBQsEYbA=";
+    hash = "sha256-bgqIJagIdP9NJAcfGxoAVgKEWiR2t+gu1QWDiCfCPjE=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/backend";

From 0be42b759c890cba0d7062d9baed58e5f64fe23e Mon Sep 17 00:00:00 2001
From: 2kybe3 <kybe@kybe.xyz>
Date: Sat, 2 May 2026 16:40:29 +0200
Subject: [PATCH 68/68] clock-rs: 0.1.216 -> 0.2.0

Diff: https://github.com/Oughie/clock-rs/compare/v0.1.216...0.2.0
---
 pkgs/by-name/cl/clock-rs/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/cl/clock-rs/package.nix b/pkgs/by-name/cl/clock-rs/package.nix
index 7aa2947f2de8..1007f978bd74 100644
--- a/pkgs/by-name/cl/clock-rs/package.nix
+++ b/pkgs/by-name/cl/clock-rs/package.nix
@@ -6,16 +6,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "clock-rs";
-  version = "0.1.216";
+  version = "0.2.0";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Oughie";
     repo = "clock-rs";
-    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-sSofMZThR025O2J4PnOMWVEuBt/+oZ01yDAQAijca0A=";
+    tag = finalAttrs.version;
+    hash = "sha256-mC7jZ0ZCSfjpF+p2TtNjt7oRowYkOujSkbuFzChYJ3U=";
   };
 
-  cargoHash = "sha256-7gpD7aAma9Ye7sxqm1wGekcovXxdd11XOMf7fKWZrcA=";
+  cargoHash = "sha256-K5AdTjRz1GEWmbqW/D/7faYABUo71tpiyyOrCjHd1GM=";
 
   meta = {
     description = "Modern, digital clock that effortlessly runs in your terminal";