From 44ad1666bc1e8f68676f9a1ecc5c65c7181c4844 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dennis=20Vestergaard=20V=C3=A6rum?= <github@varum.dk>
Date: Mon, 22 Sep 2025 19:25:55 +0200
Subject: [PATCH 01/40] rustnet: init at 1.2.0

---
 pkgs/by-name/ru/rustnet/package.nix | 70 +++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 pkgs/by-name/ru/rustnet/package.nix

diff --git a/pkgs/by-name/ru/rustnet/package.nix b/pkgs/by-name/ru/rustnet/package.nix
new file mode 100644
index 000000000000..9b687f956ae2
--- /dev/null
+++ b/pkgs/by-name/ru/rustnet/package.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  versionCheckHook,
+  elfutils,
+  zlib,
+  libbpf,
+  libpcap,
+  clangStdenv,
+}:
+let
+  pname = "rustnet";
+  version = "1.2.0";
+in
+rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } {
+  inherit pname version;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "domcyrus";
+    repo = "rustnet";
+    tag = "v${version}";
+    hash = "sha256-ZTCcPTKlKnUNlD4Ayf5dV7Yi2BuKwJ/0IwO3YqlB6u8=";
+  };
+
+  cargoHash = "sha256-5Zgo6Ypyrhy5IHC1IiWxgP4aOOdyBNEBBHWi0rsDji0=";
+
+  nativeBuildInputs = [
+    pkg-config
+    versionCheckHook
+  ];
+
+  buildInputs = [
+    elfutils
+    libbpf
+    libpcap
+    zlib
+  ];
+
+  # Required for libbpf-sys to build correctly
+  hardeningDisable = [
+    "zerocallusedregs"
+  ];
+
+  # Set environment variables for libbpf-sys
+  env = {
+    LIBBPF_SYS_LIBRARY_PATH = "${libbpf}/lib";
+    LIBBPF_SYS_INCLUDE_PATH = "${libbpf}/include";
+  };
+
+  checkFlags = [
+    "--skip=network::platform::linux::interface_stats::tests::test_get_all_stats"
+    "--skip=network::platform::linux::interface_stats::tests::test_list_interfaces"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "High-performance, cross-platform network monitoring terminal UI tool built with Rust";
+    homepage = "https://github.com/domcyrus/rustnet";
+    changelog = "https://github.com/domcyrus/rustnet/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dvaerum ];
+    mainProgram = "rustnet";
+    platforms = lib.platforms.linux;
+  };
+}

From ac1d85ce8fd8da845add1b735267a1140188ca44 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Tue, 28 Apr 2026 16:25:03 -0400
Subject: [PATCH 02/40] matrix-authentication-service: 1.15.0 -> 1.16.0

Diff: https://github.com/element-hq/matrix-authentication-service/compare/v1.15.0...v1.16.0

Changelog: https://github.com/element-hq/matrix-authentication-service/releases/tag/v1.16.0
---
 pkgs/by-name/ma/matrix-authentication-service/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ma/matrix-authentication-service/package.nix b/pkgs/by-name/ma/matrix-authentication-service/package.nix
index 6a6a22e82b9e..0c5aaf652560 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -18,21 +18,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-authentication-service";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "matrix-authentication-service";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q3MtMRdvuL0olnqvqK8uWeFCT7UpKjZN4zz9ZFlyGd4=";
+    hash = "sha256-pyL2QhvycaGBYgelsHK5Ces195Z1aY2XZyecsPXO/X4=";
   };
 
-  cargoHash = "sha256-FV4ZKR6lq8b5PMj+mZ+/RBWLmoGc6WuAXw00+PGJUi8=";
+  cargoHash = "sha256-gvG6+strULIewJgFdGg3fJ2mjUVjgi9/Q7pDredYuiU=";
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     src = "${finalAttrs.src}/${finalAttrs.npmRoot}";
-    hash = "sha256-OA7T8dTWEb8QiiRBx1A/R8H2Bu/xv3RFr8K9IVU3674=";
+    hash = "sha256-FevzqirT/GyT8urQ79AtJi+q1zcwn73AyiJTf/B9cG0=";
   };
 
   npmRoot = "frontend";

From 05cc3dede90d92092c93dac0c037bd8809b6c1b6 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Sun, 26 Apr 2026 13:46:24 +1000
Subject: [PATCH 03/40] m1n1: add sempiternal-aurora as maintainer

---
 pkgs/by-name/m1/m1n1/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/m1/m1n1/package.nix b/pkgs/by-name/m1/m1n1/package.nix
index 0e2d9009da07..27d8678a7e93 100644
--- a/pkgs/by-name/m1/m1n1/package.nix
+++ b/pkgs/by-name/m1/m1n1/package.nix
@@ -151,7 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
       bsd3
       asl20
     ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ sempiternal-aurora ];
     platforms = lib.platforms.aarch64;
   };
 })

From c992d736096f43564b09a07a5ca64b77e896f7c6 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Sun, 26 Apr 2026 13:47:32 +1000
Subject: [PATCH 04/40] m1n1: fix platforms

M1N1 doesn't actually compile on aarch64-darwin, or any other aarch platform.
It's designed to only be compiled for aarch64-linux. Note this
---
 pkgs/by-name/m1/m1n1/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/m1/m1n1/package.nix b/pkgs/by-name/m1/m1n1/package.nix
index 27d8678a7e93..ba9320acbde9 100644
--- a/pkgs/by-name/m1/m1n1/package.nix
+++ b/pkgs/by-name/m1/m1n1/package.nix
@@ -152,6 +152,6 @@ stdenv.mkDerivation (finalAttrs: {
       asl20
     ];
     maintainers = with lib.maintainers; [ sempiternal-aurora ];
-    platforms = lib.platforms.aarch64;
+    platforms = [ "aarch64-linux" ];
   };
 })

From 4a96c539a8a875118851990e369f80492cbdc542 Mon Sep 17 00:00:00 2001
From: Kira Bruneau <kira.bruneau@pm.me>
Date: Wed, 29 Apr 2026 23:05:14 -0400
Subject: [PATCH 05/40] mangohud: 0.8.2 -> 0.8.3

---
 pkgs/by-name/ma/mangohud/package.nix | 36 ++++++++++++++++++----------
 1 file changed, 23 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/ma/mangohud/package.nix b/pkgs/by-name/ma/mangohud/package.nix
index 36d24d92a496..1cf07b1fc5eb 100644
--- a/pkgs/by-name/ma/mangohud/package.nix
+++ b/pkgs/by-name/ma/mangohud/package.nix
@@ -48,16 +48,16 @@ assert lib.assertMsg (mangoappSupport -> x11Support) "mangoappSupport requires x
 let
   # Derived from subprojects/imgui.wrap
   imgui = rec {
-    version = "1.89.9";
+    version = "1.91.6";
     src = fetchFromGitHub {
       owner = "ocornut";
       repo = "imgui";
       tag = "v${version}";
-      hash = "sha256-0k9jKrJUrG9piHNFQaBBY3zgNIKM23ZA879NY+MNYTU=";
+      hash = "sha256-CLS26CRzzY4vUBgILjSQVvziHMyPGK4fwwcLZcOAzPw=";
     };
     patch = fetchurl {
-      url = "https://wrapdb.mesonbuild.com/v2/imgui_${version}-1/get_patch";
-      hash = "sha256-myEpDFl9dr+NTus/n/oCSxHZ6mxh6R1kjMyQtChD1YQ=";
+      url = "https://wrapdb.mesonbuild.com/v2/imgui_${version}-3/get_patch";
+      hash = "sha256-L3l3EUugfQZVmq+IkKkqTr0lGGWS1ER5VGBaryJEY00=";
     };
   };
 
@@ -78,32 +78,40 @@ let
 
   # Derived from subprojects/vulkan-headers.wrap
   vulkan-headers = rec {
-    version = "1.2.158";
+    version = "1.4.346";
     src = fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-Headers";
       tag = "v${version}";
-      hash = "sha256-5uyk2nMwV1MjXoa3hK/WUeGLwpINJJEvY16kc5DEaks=";
-    };
-    patch = fetchurl {
-      url = "https://wrapdb.mesonbuild.com/v2/vulkan-headers_${version}-2/get_patch";
-      hash = "sha256-hgNYz15z9FjNHoj4w4EW0SOrQh1c4uQSnsOOrt2CDhc=";
+      hash = "sha256-JTBW5CF5hlHWkhCjjRd08hpoAarB5W3FJbHzhQM4YFs=";
     };
   };
+
+  # Derived from subprojects/vulkan-headers.wrap
+  vulkan-utility-libraries = rec {
+    version = "1.4.346";
+    src = fetchFromGitHub {
+      owner = "KhronosGroup";
+      repo = "Vulkan-Utility-Libraries";
+      tag = "v${version}";
+      hash = "sha256-FWZe6NdhLmI/3bm3OIK646vkWkIQ5xmBa4jlSVHSnDs=";
+    };
+  };
+
   libXNVCtrl = linuxPackages.nvidia_x11.settings.libXNVCtrl;
   mangohud32 = pkgsi686Linux.mangohud;
 
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mangohud";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "flightlessmango";
     repo = "MangoHud";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-BZ3R7D2zOlg69rx4y2FzzjpXuPOv913TOz9kSvRN+Wg=";
+    hash = "sha256-fzfSYyz2NMo61Yd7boRxdtbi/KTNbSos0qmHf2/mikk=";
   };
 
   outputs = [
@@ -119,6 +127,7 @@ stdenv.mkDerivation (finalAttrs: {
       cp -R --no-preserve=mode,ownership ${imgui.src} imgui-${imgui.version}
       cp -R --no-preserve=mode,ownership ${implot.src} implot-${implot.version}
       cp -R --no-preserve=mode,ownership ${vulkan-headers.src} Vulkan-Headers-${vulkan-headers.version}
+      cp -R --no-preserve=mode,ownership ${vulkan-utility-libraries.src} Vulkan-Utility-Libraries-${vulkan-utility-libraries.version}
     )
   '';
 
@@ -163,7 +172,8 @@ stdenv.mkDerivation (finalAttrs: {
       cd subprojects
       unzip ${imgui.patch}
       unzip ${implot.patch}
-      unzip ${vulkan-headers.patch}
+      cp -R --no-preserve=mode,ownership packagefiles/vulkan-headers/* Vulkan-Headers-${vulkan-headers.version}
+      cp -R --no-preserve=mode,ownership packagefiles/vulkan-utility-libraries/* ${vulkan-utility-libraries.src} Vulkan-Utility-Libraries-${vulkan-utility-libraries.version}
     )
   '';
 

From ed6c1b08f9ff07d6e10406650b4924874a2757ec Mon Sep 17 00:00:00 2001
From: Pablo Ovelleiro Corral <mail@pablo.tools>
Date: Wed, 3 Apr 2024 10:16:10 +0200
Subject: [PATCH 06/40] nixos/console: Fix systemd-vconsole-setup

---
 nixos/modules/config/console.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/modules/config/console.nix b/nixos/modules/config/console.nix
index 571f723a823f..74653918f893 100644
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@@ -189,6 +189,9 @@ in
             "/etc/kbd/keymaps" = lib.mkIf (!cfg.earlySetup) {
               source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/keymaps";
             };
+            "/etc/kbd/consolefonts" = lib.mkIf (!cfg.earlySetup && cfg.font != null) {
+              source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/consolefonts";
+            };
           };
           boot.initrd.systemd.additionalUpstreamUnits = [
             "systemd-vconsole-setup.service"

From 4d63ca28b503587809ef14d4633343c6c02a374a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 May 2026 00:02:07 +0000
Subject: [PATCH 07/40] etherpad-lite: 2.6.1 -> 2.7.2

---
 pkgs/by-name/et/etherpad-lite/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/et/etherpad-lite/package.nix b/pkgs/by-name/et/etherpad-lite/package.nix
index 918957c3dc19..b6736566c593 100644
--- a/pkgs/by-name/et/etherpad-lite/package.nix
+++ b/pkgs/by-name/et/etherpad-lite/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "etherpad-lite";
-  version = "2.6.1";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "ether";
     repo = "etherpad-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KzkrJv9eBzzt9PSJGhzC0lxCOfQImSTHcTVlea8HV70=";
+    hash = "sha256-8DCgbfp3ttpMTXS9SNkN1R63LZHaklsNHViRhmWVFuk=";
   };
 
   patches = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-y5T7yerCK9MtTri3eZ+Iih7/DK9IMDC+d7ej746g47E=";
+    hash = "sha256-2nKpmGxC+KVg0oF0BsswS9L84QxzpRF7NvKyqyQ7WJM=";
   };
 
   nativeBuildInputs = [

From c619777a4075ca8e2fa94fca0e6acaa51abcfb18 Mon Sep 17 00:00:00 2001
From: Luke Granger-Brown <git@lukegb.com>
Date: Sat, 2 May 2026 21:15:08 +0100
Subject: [PATCH 08/40] pomerium: migrate to pre-built Envoy binaries

Unfortunately, Pomerium has started producing configurations which don't
work without building in their custom Envoy extensions, and it's too
complex to try to extend the existing Envoy derivation to support this
for now. For now, let's just package their binaries.

This will likely mean the end of the `envoy` from-source Envoy
derivation in nixpkgs until Bazel is more amenable to running under Nix.
---
 ...low-specification-of-external-binary.patch | 61 --------------
 pkgs/by-name/po/pomerium/package.nix          | 84 +++++++++++--------
 2 files changed, 47 insertions(+), 98 deletions(-)
 delete mode 100644 pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch

diff --git a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch b/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch
deleted file mode 100644
index 8356cdc583a2..000000000000
--- a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 640d11fae5bcf1fa8c1a54facbe168a256cacc1b Mon Sep 17 00:00:00 2001
-From: Morgan Helton <mhelton@gmail.com>
-Date: Sun, 26 May 2024 12:17:01 -0500
-Subject: [PATCH] envoy: allow specification of external binary
-
----
- pkg/envoy/envoy.go | 17 +++++++++++++----
- 1 file changed, 13 insertions(+), 4 deletions(-)
-
-diff --git a/pkg/envoy/envoy.go b/pkg/envoy/envoy.go
-index 85c725629..4a726a44b 100644
---- a/pkg/envoy/envoy.go
-+++ b/pkg/envoy/envoy.go
-@@ -8,10 +8,10 @@ import (
- 	"errors"
- 	"fmt"
- 	"io"
-+	"io/fs"
- 	"net"
- 	"net/http"
- 	"net/url"
- 	"os"
- 	"os/exec"
--	"path"
- 	"path/filepath"
-@@ -44,6 +44,11 @@ const (
- 	configFileName = "envoy-config.yaml"
- )
-
-+var OverrideEnvoyPath = ""
-+
-+const workingDirectoryName = ".pomerium-envoy"
-+const embeddedEnvoyPermissions fs.FileMode = 0o700
-+
- // A Server is a pomerium proxy implemented via envoy.
- type Server struct {
- 	ServerOptions
-@@ -100,14 +105,17 @@ func NewServer(
- 		log.Ctx(ctx).Debug().Err(err).Msg("couldn't preserve RLIMIT_NOFILE before starting Envoy")
- 	}
-
--	envoyPath, err := Extract()
-+	envoyPath := OverrideEnvoyPath
-+	wd := filepath.Join(os.TempDir(), workingDirectoryName)
-+
-+	err := os.MkdirAll(wd, embeddedEnvoyPermissions)
- 	if err != nil {
--		return nil, fmt.Errorf("extracting envoy: %w", err)
-+		return nil, fmt.Errorf("error creating temporary working directory for envoy: %w", err)
- 	}
-
- 	srv := &Server{
- 		ServerOptions:        options,
--		wd:                   path.Dir(envoyPath),
-+		wd:                   wd,
- 		builder:              builder,
- 		grpcPort:             src.GetConfig().GRPCPort,
- 		httpPort:             src.GetConfig().HTTPPort,
---
-2.49.0
-
diff --git a/pkgs/by-name/po/pomerium/package.nix b/pkgs/by-name/po/pomerium/package.nix
index dc67aa519332..a93e9924255a 100644
--- a/pkgs/by-name/po/pomerium/package.nix
+++ b/pkgs/by-name/po/pomerium/package.nix
@@ -1,9 +1,9 @@
 {
   buildGoModule,
   buildNpmPackage,
+  runCommand,
   fetchFromGitHub,
   lib,
-  envoy,
   nixosTests,
   pomerium-cli,
 }:
@@ -15,9 +15,7 @@ let
     id
     mapAttrsToList
     ;
-in
-buildGoModule rec {
-  pname = "pomerium";
+
   version = "0.32.6";
   src = fetchFromGitHub {
     owner = "pomerium";
@@ -25,13 +23,50 @@ buildGoModule rec {
     rev = "v${version}";
     hash = "sha256-VwmjuXlYsh2dGKf7ux8DyLZec7xMISuQ7SSb9+LwzfU=";
   };
-
   vendorHash = "sha256-b4H7gAMG7DXEbvkZFsoEZrKpuvPW0vkfv1qqBPBaGAM=";
 
+  getEnvoy = buildGoModule {
+    pname = "pomerium-get-envoy";
+    inherit src version vendorHash;
+
+    subPackages = [
+      "pkg/envoy/get-envoy"
+    ];
+
+    # get-envoy's envoy version is pinned via pkg/envoy/envoyversion, which
+    # relies on a specific version of github.com/pomerium/envoy-custom as a Go module,
+    # and then fetches that version's release binaries from GHCR.
+  };
+in
+buildGoModule (finalAttrs: {
+  pname = "pomerium";
+  inherit src version vendorHash;
+
+  envoyBinaries =
+    runCommand "pomerium-envoy-binaries"
+      {
+        nativeBuildInputs = [ getEnvoy ];
+
+        outputHashAlgo = "sha256";
+        outputHashMode = "recursive";
+        outputHash = "sha256-i2DuOx+fSCwTKavf6zvuRd1AKbk4igrzy2AXinDkyrI=";
+
+        meta = {
+          homepage = "https://github.com/pomerium/envoy-custom";
+          sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+        };
+      }
+      ''
+        mkdir $out
+        cd $out
+        get-envoy
+        chmod +x envoy-darwin-amd64 envoy-darwin-arm64 envoy-linux-amd64 envoy-linux-arm64
+      '';
+
   ui = buildNpmPackage {
     pname = "pomerium-ui";
-    inherit version;
-    src = "${src}/ui";
+    inherit (finalAttrs) version;
+    src = "${finalAttrs.src}/ui";
 
     npmDepsHash = "sha256-2fzINp3LBPHPJlzJnUggPWUZHrjuX9TYPD2XvioonSw=";
 
@@ -46,24 +81,16 @@ buildGoModule rec {
     "cmd/pomerium"
   ];
 
-  # patch pomerium to allow use of external envoy
-  patches = [
-    ./0001-envoy-allow-specification-of-external-binary.patch
-  ];
-
   ldflags =
     let
       # Set a variety of useful meta variables for stamping the build with.
       setVars = {
         "github.com/pomerium/pomerium/internal/version" = {
-          Version = "v${version}";
+          Version = "v${finalAttrs.version}";
           BuildMeta = "nixpkgs";
           ProjectName = "pomerium";
           ProjectURL = "github.com/pomerium/pomerium";
         };
-        "github.com/pomerium/pomerium/pkg/envoy" = {
-          OverrideEnvoyPath = "${envoy}/bin/envoy";
-        };
       };
       concatStringsSpace = list: concatStringsSep " " list;
       mapAttrsToFlatList = fn: list: concatMap id (mapAttrsToList fn list);
@@ -79,28 +106,11 @@ buildGoModule rec {
     ];
 
   preBuild = ''
-    # Replace embedded envoy with nothing.
-    # We set OverrideEnvoyPath above, so rawBinary should never get looked at
-    # but we still need to set a checksum/version.
-    rm pkg/envoy/files/files_{darwin,linux}*.go
-    cat <<EOF >pkg/envoy/files/files_external.go
-    package files
-
-    import _ "embed" // embed
-
-    var rawBinary []byte
-
-    //go:embed envoy.sha256
-    var rawChecksum string
-
-    //go:embed envoy.version
-    var rawVersion string
-    EOF
-    sha256sum '${envoy}/bin/envoy' > pkg/envoy/files/envoy.sha256
-    echo '${envoy.version}' > pkg/envoy/files/envoy.version
+    # Insert embedded envoy.
+    cp -r ${finalAttrs.envoyBinaries}/* pkg/envoy/files
 
     # put the built UI files where they will be picked up as part of binary build
-    cp -r ${ui}/* ui/dist
+    cp -r ${finalAttrs.ui}/* ui/dist
   '';
 
   installPhase = ''
@@ -129,4 +139,4 @@ buildGoModule rec {
       "aarch64-linux"
     ];
   };
-}
+})

From 372468a7c967a97a274b0ea4a9b75fd140baad6b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 3 May 2026 12:44:32 +0000
Subject: [PATCH 09/40] docker: 29.4.1 -> 29.4.2

---
 pkgs/applications/virtualization/docker/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index defcd8a39988..02c9f2578f26 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -438,14 +438,14 @@ in
 
   docker_29 =
     let
-      version = "29.4.1";
+      version = "29.4.2";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
       cliHash = "sha256-jGD+Z3koM0a2Te7cq2HdKFizZj39djvTQUmn815Mn4o=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-R+rCR8DG4IyEdn9ol7PjawixgymjrEVMrTjaZM1wReU=";
+      mobyHash = "sha256-jPmFYGOxvMof32fQeI4iHLG12ElwysYLSTkIrlluEXM=";
       runcRev = "v1.3.5";
       runcHash = "sha256-Swphxbu/OLkUrfRjLMZIVGwYb7AN0xHdyxm0ysAVam0=";
       containerdRev = "v2.2.3";

From d95c666bb3acf16ad160d9b88e8e657e4275d789 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 4 May 2026 10:11:07 +0000
Subject: [PATCH 10/40] sensu-go-backend: 6.14.0 -> 6.14.1

---
 pkgs/servers/monitoring/sensu-go/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/monitoring/sensu-go/default.nix b/pkgs/servers/monitoring/sensu-go/default.nix
index e16ee5826846..8975d692ac0f 100644
--- a/pkgs/servers/monitoring/sensu-go/default.nix
+++ b/pkgs/servers/monitoring/sensu-go/default.nix
@@ -14,19 +14,19 @@ let
     }:
     buildGoModule rec {
       inherit pname;
-      version = "6.14.0";
+      version = "6.14.1";
       shortRev = "591ed6e"; # for internal version info
 
       src = fetchFromGitHub {
         owner = "sensu";
         repo = "sensu-go";
         rev = "v${version}";
-        sha256 = "sha256-/1oQz7mZyhH5U7DoVhRYnLv7AvwFrN1OBx9EEK+sCEw=";
+        sha256 = "sha256-1/yV+NdRfB0dTGWcQUx/vgDNvshn+lYN0gxMQMm/+I0=";
       };
 
       inherit subPackages postInstall;
 
-      vendorHash = "sha256-ylzMqc+zTtuttLl75ILG0OzA/PqfrpvsiKhW6cPx+ls=";
+      vendorHash = "sha256-lww3dO4kdYqql6fZj/wOVmwENFaUSWdgNyXvBwwvasE=";
 
       doCheck = false;
 

From abfd48c7e1de789e643f9e00b248c79ce126b821 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Mon, 4 May 2026 17:02:12 +0200
Subject: [PATCH 11/40] kodiPackages.kodi-platform: set license

source: https://github.com/xbmc/kodi-platform/blob/844cf3ef5ad0649b8d97894d422928ec8a7a7d71/src/util/XMLUtils.cpp#L2-L18
---
 .../applications/video/kodi/addons/kodi-platform/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/applications/video/kodi/addons/kodi-platform/default.nix b/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
index 0b4682ce94e3..7bf24912818a 100644
--- a/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
+++ b/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   stdenv,
   fetchFromGitHub,
   cmake,
@@ -23,4 +24,8 @@ stdenv.mkDerivation rec {
     libcec_platform
     tinyxml
   ];
+
+  meta = {
+    license = lib.licenses.gpl2Plus;
+  };
 }

From b586d27741f345315e5e7d8d7be551202affdb68 Mon Sep 17 00:00:00 2001
From: Robert Rose <robert.rose@mailbox.org>
Date: Fri, 1 May 2026 09:53:06 +0200
Subject: [PATCH 12/40] nixos/k3s: run tests only for linux platforms

All k3s packages are also built exclusively for linux platforms.
---
 nixos/tests/all-tests.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index b276d07786bc..959dc92a4304 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -813,8 +813,12 @@ in
   jool = import ./jool.nix { inherit pkgs runTest; };
   jotta-cli = runTest ./jotta-cli.nix;
   k3s = import ./rancher {
-    inherit pkgs runTest;
+    inherit pkgs;
     inherit (pkgs) lib;
+    runTest = runTestOn [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
     rancherDistro = "k3s";
   };
   kafka = handleTest ./kafka { };

From 3e398600381ccd518fb43bea3ec81cb0360efb43 Mon Sep 17 00:00:00 2001
From: yaya <github@uwu.is>
Date: Tue, 5 May 2026 12:23:59 +0200
Subject: [PATCH 13/40] akkoma: 3.18.1 -> 3.19.0

https://akkoma.dev/AkkomaGang/akkoma/src/tag/v3.19.0/CHANGELOG.md
---
 .../ak/akkoma/akkoma-imagemagick.patch        | 60 -------------------
 pkgs/by-name/ak/akkoma/package.nix            | 16 +----
 2 files changed, 3 insertions(+), 73 deletions(-)
 delete mode 100644 pkgs/by-name/ak/akkoma/akkoma-imagemagick.patch

diff --git a/pkgs/by-name/ak/akkoma/akkoma-imagemagick.patch b/pkgs/by-name/ak/akkoma/akkoma-imagemagick.patch
deleted file mode 100644
index 11e291f6dbc5..000000000000
--- a/pkgs/by-name/ak/akkoma/akkoma-imagemagick.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From c48f5d57b6e57f42b668c0c6b8744e4620c77320 Mon Sep 17 00:00:00 2001
-From: Mikael Voss <mvs@nyantec.com>
-Date: Tue, 19 Nov 2024 20:47:27 +0100
-Subject: [PATCH] Use magick command from ImageMagick
-
-With ImageMagick version 7 the convert command has been deprecated in
-favour of magick. Calling convert instead results in the logs being
-spammed with warning messages.
-
-The mogrify Elixir wrapper also runs magick with the mogrify argument
-in current releases.
----
- lib/pleroma/application_requirements.ex | 8 ++++----
- lib/pleroma/helpers/media_helper.ex     | 4 ++--
- 2 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/lib/pleroma/application_requirements.ex b/lib/pleroma/application_requirements.ex
-index c3777d8f1..55ee674a2 100644
---- a/lib/pleroma/application_requirements.ex
-+++ b/lib/pleroma/application_requirements.ex
-@@ -166,10 +166,10 @@ defp check_system_commands!(:ok) do
-     filter_commands_statuses = [
-       check_filter(Pleroma.Upload.Filter.Exiftool.StripMetadata, "exiftool"),
-       check_filter(Pleroma.Upload.Filter.Exiftool.ReadDescription, "exiftool"),
--      check_filter(Pleroma.Upload.Filter.Mogrify, "mogrify"),
--      check_filter(Pleroma.Upload.Filter.Mogrifun, "mogrify"),
--      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "mogrify"),
--      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "convert"),
-+      check_filter(Pleroma.Upload.Filter.Mogrify, "magick"),
-+      check_filter(Pleroma.Upload.Filter.Mogrifun, "magick"),
-+      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "magick"),
-+      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "magick"),
-       check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "ffprobe")
-     ]
- 
-diff --git a/lib/pleroma/helpers/media_helper.ex b/lib/pleroma/helpers/media_helper.ex
-index cb95d0e68..17cd9629d 100644
---- a/lib/pleroma/helpers/media_helper.ex
-+++ b/lib/pleroma/helpers/media_helper.ex
-@@ -12,7 +12,7 @@ defmodule Pleroma.Helpers.MediaHelper do
-   require Logger
- 
-   def missing_dependencies do
--    Enum.reduce([imagemagick: "convert", ffmpeg: "ffmpeg"], [], fn {sym, executable}, acc ->
-+    Enum.reduce([imagemagick: "magick", ffmpeg: "ffmpeg"], [], fn {sym, executable}, acc ->
-       if Pleroma.Utils.command_available?(executable) do
-         acc
-       else
-@@ -22,7 +22,7 @@ def missing_dependencies do
-   end
- 
-   def image_resize(url, options) do
--    with executable when is_binary(executable) <- System.find_executable("convert"),
-+    with executable when is_binary(executable) <- System.find_executable("magick"),
-          {:ok, args} <- prepare_image_resize_args(options),
-          {:ok, env} <- HTTP.get(url, [], []),
-          {:ok, fifo_path} <- mkfifo() do
--- 
-2.43.0
-
diff --git a/pkgs/by-name/ak/akkoma/package.nix b/pkgs/by-name/ak/akkoma/package.nix
index c2568cc4c6f3..f5ebc61c42fd 100644
--- a/pkgs/by-name/ak/akkoma/package.nix
+++ b/pkgs/by-name/ak/akkoma/package.nix
@@ -20,14 +20,14 @@ let
 in
 beamPackages.mixRelease rec {
   pname = "akkoma";
-  version = "3.18.1";
+  version = "3.19.0";
 
   src = fetchFromGitea {
     domain = "akkoma.dev";
     owner = "AkkomaGang";
     repo = "akkoma";
     tag = "v${version}";
-    hash = "sha256-4HIIgTNcNAMCpHyT6zBcmxXeFbMrt38Z7PtT9Onvz+U=";
+    hash = "sha256-ASLnsmuWpfQKwpNNLUgI32Gdn/j+jUW5IBLlT8RUmcE=";
 
     # upstream repository archive fetching is broken
     forceFetchGit = true;
@@ -36,20 +36,10 @@ beamPackages.mixRelease rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ file ];
 
-  patches = [
-    # See <https://akkoma.dev/AkkomaGang/akkoma/pulls/854>
-    # Akkoma uses the deprecated “convert” command instead of “magick”, which
-    # results in the logs being spammed with warning messages. Upstream is
-    # reluctant to change this, to ensure compatibility with Debian stable,
-    # which does not yet provide ImageMagick 7.
-    # Remove this patch once merged upstream.
-    ./akkoma-imagemagick.patch
-  ];
-
   mixFodDeps = beamPackages.fetchMixDeps {
     pname = "mix-deps-akkoma";
     inherit src version;
-    hash = "sha256-igXEX6I+7G7tNCLjEf0VBOaii0r7jXCdF6x78LMcUv0=";
+    hash = "sha256-O9A7XuQSSczGMcLMc6Fk0eh7PkjQ6sYJKSwdqoEPJJI=";
 
     postInstall = ''
       substituteInPlace "$out/http_signatures/mix.exs" \

From ee752016e2d9ecb11e6e5c7b123fe783e57b18c7 Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Tue, 5 May 2026 15:56:52 +0200
Subject: [PATCH 14/40] esdm: 1.2.1 -> 1.2.3

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/by-name/es/esdm/package.nix | 40 +++++++++++++++++++++++++-------
 1 file changed, 31 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/es/esdm/package.nix b/pkgs/by-name/es/esdm/package.nix
index 2092cf4f8585..57f1b2e2749e 100644
--- a/pkgs/by-name/es/esdm/package.nix
+++ b/pkgs/by-name/es/esdm/package.nix
@@ -18,22 +18,31 @@
   # A brief explanation is given.
 
   # general options
-  selinux ? true, # enable selinux support
-  fips140 ? true, # enable FIPS 140 checksum support
+  selinux ? false, # enable selinux support
+  fips140 ? false, # enable FIPS 140 checksum support
   ais2031 ? true, # set the seeding strategy to be compliant with AIS 20/31
   sp80090c ? true, # set compliance with NIST SP800-90C
   cryptoBackend ? "botan", # set backend for hash and drbg operations
   linuxDevFiles ? true, # enable linux /dev/random and /dev/urandom support
   linuxGetRandom ? true, # enable linux getrandom support
   openSSLRandProvider ? true, # build ESDM provider for OpenSSL 3.x
-  maxThreads ? 1024, # number of RPC handler threads
+  maxThreads ? 64, # number of RPC handler threads
   validationHelpers ? true, # used to analyze entropy output from esdm_es
   numAuxPools ? 128, # use multiple hash pools for e.g. smartcard input
-  serverTermOnSignal ? false, # use select with timeout in server watch loop
+  auxHasFullEntropy ? false, # is already conditioned data inserted into aux pool?
+
+  # DRNG-related options
+  drngReseedThresholdBits ? lib.fromHexString "0xffffffff",
+  drngMaxReseedBits ? lib.fromHexString "0xffffffff",
 
   # entropy sources
   esJitterRng ? true, # enable support for the entropy source: jitter rng (running in user space)
   esJitterRngEntropyRate ? 256, # amount of entropy to account for jitter rng source
+  esJitterRngNtg1 ? false, # configures jitterentropy NTG.1 mode
+  esJitterRngAllCaches ? false, # use all caches in calculating size of memory buffer?
+  esJitterRngMaxMem ? -1, # set static maximum size of memory buffer, -1 disables it
+  esJitterRngHashLoopCount ? -1, # set increased hashloop count, -1 disables it
+  esJitterRngOsr ? 3, # set larger oversampling rate if necessary, (default 3)
   esJitterRngEntropyBlocks ? 128, # number of cached entropy blocks for jitterentropy
   esJitterRngKernel ? false, # enable support for the entropy source: jitter rng (running in kernel space)
   esJitterRngKernelEntropyRate ? 256, # amount of entropy to account for kernel jitter rng source
@@ -41,6 +50,8 @@
   esCPUEntropyRate ? 256, # amount of entropy to account for cpu rng source
   esKernel ? false, # enable support for the entropy source: kernel-based entropy
   esKernelEntropyRate ? 256, # amount of entropy to account for kernel-based source
+  esTPM2 ? true, # enable support for the entropy source: TPM-based entropy
+  esTPM2EntropyRate ? 256, # amount of entropy to account for TPM-based source
   esIRQ ? false, # enable support for the entropy source: interrupt-based entropy
   esIRQEntropyRate ? 256, # amount of entropy to account for interrupt-based source (only set irq XOR sched != 0)
   esSched ? false, # enable support for the entropy source: scheduler-based entropy
@@ -50,20 +61,20 @@
 
   # kernel seeding
   linuxKernelReseedInterval ? 60, # how often to push entropy into Linux kernel, iff seeder service is started
-  linuxKernelReseedEntropyRate ? 256, # how many bits to account on kernel (re-)seeding
+  linuxKernelReseedEntropyRate ? 512, # how many bits to account on kernel (re-)seeding
 }:
 
 assert cryptoBackend == "openssl" || cryptoBackend == "botan";
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "esdm";
-  version = "1.2.1";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "smuellerDD";
     repo = "esdm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-41vc5mB2MiQJu0HXFzSjiudlu1sRj2IP8FcFPQfu5uo=";
+    hash = "sha256-0s9YOqa+sn0rk5YoMWZczO1TB5/wpbFsdkaVWFf4ipI=";
   };
 
   nativeBuildInputs = [
@@ -89,13 +100,18 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "sp80090c" sp80090c)
     (lib.mesonEnable "node" true) # multiple DRNGs
     (lib.mesonEnable "systemd" true) # systemd notify and socket support
-    (lib.mesonOption "threading_max_threads" (toString maxThreads))
+    (lib.mesonOption "threading_max_worker_threads" (toString maxThreads))
     (lib.mesonOption "crypto_backend" cryptoBackend)
     (lib.mesonEnable "linux-devfiles" linuxDevFiles)
     (lib.mesonEnable "linux-getrandom" linuxGetRandom)
     (lib.mesonEnable "es_jent" esJitterRng)
     (lib.mesonOption "es_jent_entropy_rate" (toString esJitterRngEntropyRate))
     (lib.mesonOption "es_jent_entropy_blocks" (toString esJitterRngEntropyBlocks))
+    (lib.mesonEnable "es_jent_ntg1" esJitterRngNtg1)
+    (lib.mesonEnable "es_jent_all_caches" esJitterRngAllCaches)
+    (lib.mesonOption "es_jent_max_mem" (toString esJitterRngMaxMem))
+    (lib.mesonOption "es_jent_hash_loop_count" (toString esJitterRngHashLoopCount))
+    (lib.mesonOption "es_jent_osr" (toString esJitterRngOsr))
     (lib.mesonEnable "es_jent_kernel" esJitterRngKernel)
     (lib.mesonOption "es_jent_kernel_entropy_rate" (toString esJitterRngKernelEntropyRate))
     (lib.mesonEnable "es_cpu" esCPU)
@@ -108,13 +124,17 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "es_sched_entropy_rate" (toString esSchedEntropyRate))
     (lib.mesonEnable "es_hwrand" esHwrand)
     (lib.mesonOption "es_hwrand_entropy_rate" (toString esHwrandEntropyRate))
+    (lib.mesonEnable "es_tpm2" esTPM2)
+    (lib.mesonOption "es_tpm2_entropy_rate" (toString esTPM2EntropyRate))
     (lib.mesonEnable "selinux" selinux)
     (lib.mesonEnable "openssl-rand-provider" openSSLRandProvider)
     (lib.mesonOption "linux-reseed-interval" (toString linuxKernelReseedInterval))
     (lib.mesonOption "linux-reseed-entropy-count" (toString linuxKernelReseedEntropyRate))
     (lib.mesonEnable "validation-helpers" validationHelpers)
     (lib.mesonOption "num-aux-pools" (toString numAuxPools))
-    (lib.mesonBool "esdm-server-term-on-signal" serverTermOnSignal)
+    (lib.mesonEnable "aux-has-full-entropy" auxHasFullEntropy)
+    (lib.mesonOption "drng_reseed_threshold_bits" (toString drngReseedThresholdBits))
+    (lib.mesonOption "drng_max_reseed_bits" (toString drngMaxReseedBits))
   ];
 
   postFixup = lib.optionals fips140 ''
@@ -125,6 +145,8 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   strictDeps = true;
+  __structuredAttrs = true;
+
   mesonBuildType = "release";
 
   meta = {

From bee10e416c51df9e15f0f1b7ac34e652b4bf8c03 Mon Sep 17 00:00:00 2001
From: gwg313 <gwg313@pm.me>
Date: Tue, 5 May 2026 13:22:32 -0400
Subject: [PATCH 15/40] rustlens: init at 0.2.1

Signed-off-by: gwg313 <gwg313@pm.me>
---
 pkgs/by-name/ru/rustlens/package.nix | 38 ++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 pkgs/by-name/ru/rustlens/package.nix

diff --git a/pkgs/by-name/ru/rustlens/package.nix b/pkgs/by-name/ru/rustlens/package.nix
new file mode 100644
index 000000000000..a83344c31e30
--- /dev/null
+++ b/pkgs/by-name/ru/rustlens/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rustlens";
+  version = "0.2.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "yashksaini-coder";
+    repo = "Rustlens";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BYROEUBa9RZXuJbNbKUbWXu9mPYIuAyO6JwPlNmj244=";
+  };
+
+  cargoHash = "sha256-WvUu2M2WFLo5Ve+ER7vpl7q/cpPR4g1vY4z9hRl3On0=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  meta = {
+    description = "Rustlens is a terminal-based application for exploring Rust codebases.";
+    homepage = "https://github.com/yashksaini-coder/Rustlens";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ gwg313 ];
+    mainProgram = "rustlens";
+  };
+})

From 4ce460ed8d09d04fac487199b782eda138b4ef0d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 5 May 2026 18:26:20 +0000
Subject: [PATCH 16/40] mirrord: 3.206.1 -> 3.209.1

---
 pkgs/by-name/mi/mirrord/manifest.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index d5f7d69c6140..afb56d1c4d5d 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.206.1",
+  "version": "3.209.1",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_linux_x86_64",
-      "hash": "sha256-RWhqtP8gVAz2H6OU/ZSiL9kBD0rMs/NfsaNnDzjfriw="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_linux_x86_64",
+      "hash": "sha256-XXSU13UhffwgIIdfPW3vjPOcvtrggs2bKpsMkwUdv8Y="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_linux_aarch64",
-      "hash": "sha256-3uzh324H6c43Xcx49ynh6S540G3cxBXQL+Jv3SXaY2Q="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_linux_aarch64",
+      "hash": "sha256-RiQsrGAOfRe8kRmNF8imJjP+ZktUpUuMvNGmMI0fboc="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_mac_universal",
-      "hash": "sha256-jcTlTcCD3hi74e9a87WmiqpnKyLifxWWDu5Pbw9qQOY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_mac_universal",
+      "hash": "sha256-Lkqk9CgOnMFMUut6JRU5V4IimI1ys/iVX1M5DxOtOMk="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_mac_universal",
-      "hash": "sha256-jcTlTcCD3hi74e9a87WmiqpnKyLifxWWDu5Pbw9qQOY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_mac_universal",
+      "hash": "sha256-Lkqk9CgOnMFMUut6JRU5V4IimI1ys/iVX1M5DxOtOMk="
     }
   }
 }

From f6efcb8613c8b7b5aa75b07f7dfc32c9a10ebb7b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= <kmein@posteo.de>
Date: Tue, 5 May 2026 19:41:20 +0200
Subject: [PATCH 17/40] flake-du: init at 0.1.0

---
 pkgs/by-name/fl/flake-du/package.nix | 29 ++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 pkgs/by-name/fl/flake-du/package.nix

diff --git a/pkgs/by-name/fl/flake-du/package.nix b/pkgs/by-name/fl/flake-du/package.nix
new file mode 100644
index 000000000000..5f722207eea3
--- /dev/null
+++ b/pkgs/by-name/fl/flake-du/package.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  rustPlatform,
+  fetchgit,
+}:
+let
+  version = "0.1.0";
+in
+rustPlatform.buildRustPackage {
+  pname = "flake-du";
+  inherit version;
+
+  src = fetchgit {
+    url = "https://github.com/kmein/flake-du";
+    rev = "v${version}";
+    sha256 = "sha256-+YfQRi6QE4xNUcIcEc9HWIbnin6GCVp4SYrjvBwksys=";
+  };
+
+  cargoHash = "sha256-DYVT9jM9WcgoVSOnoUIWWR9EmNywR1f4xZOAzkbNkCk=";
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Tool for managing flake inputs with disk usage insights";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/kmein/flake-du";
+    maintainers = [ lib.maintainers.kmein ];
+  };
+}

From 569248d0e0745e702c0b159d2d30e794693a2e70 Mon Sep 17 00:00:00 2001
From: Tristan Ross <tristan.ross@determinate.systems>
Date: Tue, 5 May 2026 12:41:53 -0700
Subject: [PATCH 18/40] llvmPackages_22: 22.1.2 -> 22.1.5

---
 pkgs/development/compilers/llvm/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index e75e834bab87..3dcc77a981bc 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -26,7 +26,7 @@ let
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
-    "22.1.2".officialRelease.sha256 = "sha256-z6YcxgDd3F3JwfU5Y/wMw5MK+ZPISI3KLwHwUaraTuw=";
+    "22.1.5".officialRelease.sha256 = "sha256-eunfMOH+HVpefZJ+CG7hXDoM+pi6iYvHpD3DoSAsjoE=";
     "23.0.0-git".gitRelease = {
       rev = "cd6119c00b461c36139f1f4a0ca1653a6ab2a32b";
       rev-version = "23.0.0-unstable-2026-05-03";

From 5ca3d032e1fd0f3835a894b0198317dfcb489bbb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 6 May 2026 00:48:05 +0200
Subject: [PATCH 19/40] ollama: 0.23.0 -> 0.23.1

Diff: https://github.com/ollama/ollama/compare/v0.23.0...v0.23.1

Changelog: https://github.com/ollama/ollama/releases/tag/v0.23.1
---
 pkgs/by-name/ol/ollama/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 52ccb92dd010..f8d770154a24 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -141,13 +141,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VYaFCSqhIlJPJv1SUiNDgSzLqySK3NTfucdWA7IZaAk=";
+    hash = "sha256-19rx+PNCpvRxhVr1+bgqsQIwpZzgdazlCoppxlDKzvE=";
   };
 
   vendorHash = "sha256-Lc1Ktdqtv2VhJQssk8K1UOimeEjVNvDWePE9WkamCos=";

From 777fe76e6cbc491698d4b4b722948acab2f0a80b Mon Sep 17 00:00:00 2001
From: pacaroha <187338595+pacaroha@users.noreply.github.com>
Date: Tue, 5 May 2026 15:13:31 -0700
Subject: [PATCH 20/40] gitlab-runner: update skipped tests to fix builds

(hopefully fixes flakiness that has kept this from the binary cache
sometimes, reduces the scope of some old removals, also fixes builds on
Darwin when the sandbox is enabled)
---
 pkgs/by-name/gi/gitlab-runner/package.nix | 30 ++++++++++++++---------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/gi/gitlab-runner/package.nix b/pkgs/by-name/gi/gitlab-runner/package.nix
index dc94606246a4..da2c49252ccf 100644
--- a/pkgs/by-name/gi/gitlab-runner/package.nix
+++ b/pkgs/by-name/gi/gitlab-runner/package.nix
@@ -38,26 +38,30 @@ buildGoModule (finalAttrs: {
     substituteInPlace commands/helpers/file_archiver_test.go \
       --replace-fail "func TestCacheArchiverAddingUntrackedFiles" "func OFF_TestCacheArchiverAddingUntrackedFiles" \
       --replace-fail "func TestCacheArchiverAddingUntrackedUnicodeFiles" "func OFF_TestCacheArchiverAddingUntrackedUnicodeFiles"
-    rm shells/abstract_test.go
 
-    # No writable developer environment
+    # Needs `make development_setup` (git repo at tmp/gitlab-test/)
     rm common/build_settings_test.go
     rm common/build_test.go
     rm executors/custom/custom_test.go
 
-    # No Docker during build
-    rm executors/docker/docker_test.go
-    rm executors/docker/services_test.go
-    rm executors/docker/terminal_test.go
-    rm helpers/docker/auth/auth_test.go
-
-    # No Kubernetes during build
-    rm executors/kubernetes/feature_test.go
+    # Timing-dependent test causes spurious failures on Hydra.
+    # Might be fixed upstream in this MR: https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6623
+    # Try dropping it on next major version bump
+    rm executors/kubernetes/internal/watchers/pod_test.go
+  ''
+  + lib.optionalString (!stdenv.buildPlatform.isx86_64) ''
+    # Kubernetes tests actually work fine inside the network sandbox (they don't
+    # expect real Kubernetes), but they fail on aarch64-linux because their
+    # mocks expect x86_64
     rm executors/kubernetes/kubernetes_test.go
     rm executors/kubernetes/overwrites_test.go
   ''
   + lib.optionalString stdenv.buildPlatform.isDarwin ''
-    # Invalid bind arguments break Unix socket tests
+    # Darwin's sandbox blocks sendfile(2) during local HTTP PUT uploads
+    substituteInPlace commands/helpers/cache_archiver_test.go \
+      --replace-fail "func TestUploadExistingArchiveIfNeeded" "func OFF_TestUploadExistingArchiveIfNeeded"
+
+    # Invalid bind arguments break Unix socket tests.
     substituteInPlace commands/wrapper_test.go \
       --replace-fail "func TestRunnerWrapperCommand_createListener" "func OFF_TestRunnerWrapperCommand_createListener"
 
@@ -68,6 +72,10 @@ buildGoModule (finalAttrs: {
       --replace-fail "func TestClientInvalidSSL" "func OFF_TestClientInvalidSSL"
   '';
 
+  postPatch = ''
+    patchShebangs --build helpers/docker/auth/testdata/docker-credential-bin.sh
+  '';
+
   excludedPackages = [
     # Nested dependency Go module, used with go.mod replace directive
     #

From 63d871626a52baded8e685b9b27d48e726ec15d9 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Wed, 6 May 2026 01:24:19 +0200
Subject: [PATCH 21/40] python3Packages.hdbscan: unbreak, remove merged patch

---
 pkgs/development/python-modules/hdbscan/default.nix | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/pkgs/development/python-modules/hdbscan/default.nix b/pkgs/development/python-modules/hdbscan/default.nix
index a712625fa08f..70c165ddfd95 100644
--- a/pkgs/development/python-modules/hdbscan/default.nix
+++ b/pkgs/development/python-modules/hdbscan/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   cython,
   numpy,
@@ -27,15 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-4uwWoNkrdLB2KzDAksPupdgkIFBgTahzravOtu1WYws=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Replace obsolete use of assert_raises with pytest.raises
-      name = "replace-assert_raises";
-      url = "https://github.com/scikit-learn-contrib/hdbscan/pull/667/commits/04d6a4dcdcd2bb2597419b8aa981d7620765809f.patch";
-      hash = "sha256-z/u5b2rNPKOCe+3/GVE8rMB5ajeU5PrvLVesjEgj9TA=";
-    })
-  ];
-
   pythonRemoveDeps = [ "cython" ];
 
   nativeBuildInputs = [

From c9928880cc497b8f4af9290caab1db3f933445f3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 6 May 2026 01:20:17 +0000
Subject: [PATCH 22/40] google-lighthouse: 13.1.0 -> 13.2.0

---
 pkgs/by-name/go/google-lighthouse/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/google-lighthouse/package.nix b/pkgs/by-name/go/google-lighthouse/package.nix
index ed4917caf5c0..64ea99c1681b 100644
--- a/pkgs/by-name/go/google-lighthouse/package.nix
+++ b/pkgs/by-name/go/google-lighthouse/package.nix
@@ -13,18 +13,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "google-lighthouse";
-  version = "13.1.0";
+  version = "13.2.0";
 
   src = fetchFromGitHub {
     owner = "GoogleChrome";
     repo = "lighthouse";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nSXIA1yRwcetv9u/UJ445iDP3i+dX0rhzozxzQvXkf0=";
+    hash = "sha256-D/HQP34/EGJLWgRneiYP8eByUNSjKwQQLD0FScgYAVo=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-naB9TOFiggKNiJcXkHF5VbvsLtNAYQD84/pL//76fuE=";
+    hash = "sha256-DKFPnSj3jujCWb+KitgTZaIJB8XkHJBoncaNvzcuIVU=";
   };
 
   yarnBuildScript = "build-report";

From c5f64e5168c1b93df2af7dd71ad2059538e3a466 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 6 May 2026 01:21:28 +0000
Subject: [PATCH 23/40] moonlight: 2026.4.0 -> 2026.5.0

---
 pkgs/by-name/mo/moonlight/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index fc5d45400dc7..d5fc3de191b8 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "2026.4.0";
+  version = "2026.5.0";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jbIdFHPomN0zD2I6UoClofvSNVdOqpf0nM1s5pbn7ew=";
+    hash = "sha256-RZ7fmgzENSt9bXuhPWW9wBaJ1dss/b23R1VS+tEU7io=";
   };
 
   nativeBuildInputs = [

From 1fa7769a6a32ef8e5f9927e1c0c1b9e91a8c3567 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 6 May 2026 02:00:16 +0000
Subject: [PATCH 24/40] nvidia-mig-parted: 0.14.0 -> 0.14.1

---
 pkgs/by-name/nv/nvidia-mig-parted/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nv/nvidia-mig-parted/package.nix b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
index c6c27f49aa56..7757ddad5851 100644
--- a/pkgs/by-name/nv/nvidia-mig-parted/package.nix
+++ b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nvidia-mig-parted";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "mig-parted";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b+/Rz1Lj+Ef7fIw4g2el8td982SGKXb0iPboP53XGKQ=";
+    hash = "sha256-05WbIEvHN/CAvd5ex4I8FZx0NreIg5QDOgXmAda/mzc=";
   };
 
   vendorHash = null;

From 8dc824f22d33aca683e77054a1bbc897b0abb5c1 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Tue, 5 May 2026 23:41:07 -0400
Subject: [PATCH 25/40] ci/OWNERS: add neovim team as owners of nvim-treesitter

---
 ci/OWNERS | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ci/OWNERS b/ci/OWNERS
index cf158b7b9154..dbe5e829bb59 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -377,8 +377,8 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 # VimPlugins
 /pkgs/applications/editors/vim/plugins         @NixOS/neovim
 ## nvim-treesitter
-/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix @figsoda
-/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter         @figsoda
+/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix @NixOS/neovim @figsoda
+/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter         @NixOS/neovim @figsoda
 
 # VsCode Extensions
 /pkgs/applications/editors/vscode/extensions

From eaf3faa714e51d3ba412c5c10a392149a61d586f Mon Sep 17 00:00:00 2001
From: Daniel Baker <dan@djacu.dev>
Date: Wed, 22 Apr 2026 19:19:18 -0700
Subject: [PATCH 26/40] envoy: fix deps fetch by pinning go and providing
 hashes

Pin Go SDK downloads to avoid fetching the mutable version listing from
https://go.dev/dl/?mode=json&include=all. Without explicit sdks, each
go_download_sdk call downloads that listing (which changes with every Go
release) and caches it in repository_cache, causing the deps hash to
drift. See: io_bazel_rules_go/go/private/sdk.bzl lines 74-93 (rules_go
v0.50.0)

Co-Authored-By: ejiektpobehuk
Co-Authored-By: samestep
---
 .../0005-nixpkgs-pin-go-sdk-downloads.patch   | 79 +++++++++++++++++++
 pkgs/by-name/en/envoy/package.nix             | 12 ++-
 2 files changed, 89 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/by-name/en/envoy/0005-nixpkgs-pin-go-sdk-downloads.patch

diff --git a/pkgs/by-name/en/envoy/0005-nixpkgs-pin-go-sdk-downloads.patch b/pkgs/by-name/en/envoy/0005-nixpkgs-pin-go-sdk-downloads.patch
new file mode 100644
index 000000000000..ebf12f1ff0e4
--- /dev/null
+++ b/pkgs/by-name/en/envoy/0005-nixpkgs-pin-go-sdk-downloads.patch
@@ -0,0 +1,79 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Baker <dan@djacu.dev>
+Date: Thu, 30 Apr 2026 08:42:44 -0700
+Subject: [PATCH] nixpkgs: pin Go SDK downloads
+
+Pin Go SDK downloads to avoid fetching the mutable version listing from
+https://go.dev/dl/?mode=json&include=all. Without explicit sdks, each
+go_download_sdk call downloads that listing (which changes with every Go
+release) and caches it in repository_cache, causing the deps hash to
+drift. See: io_bazel_rules_go/go/private/sdk.bzl lines 74-93 (rules_go
+v0.50.0)
+
+Signed-off-by: Daniel Baker <dan@djacu.dev>
+---
+ bazel/dependency_imports.bzl | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
+index 90e49d5ceb0024b57481b816518990f58fc2ad5f..26091a877ea3951bfe69944ab8580857e787bb64 100644
+--- a/bazel/dependency_imports.bzl
++++ b/bazel/dependency_imports.bzl
+@@ -27,6 +27,18 @@ load("@rules_rust//rust:repositories.bzl", "rules_rust_dependencies", "rust_regi
+ # go version for rules_go
+ GO_VERSION = "1.24.6"
+ 
++# Pin Go SDK downloads to avoid fetching the mutable version listing from
++# https://go.dev/dl/?mode=json&include=all. Without explicit sdks, each
++# go_download_sdk call downloads that listing (which changes with every Go
++# release) and caches it in repository_cache, causing the deps hash to drift.
++# See: io_bazel_rules_go/go/private/sdk.bzl lines 74-93 (rules_go v0.50.0)
++_GO_SDKS = {
++    "linux_amd64": ["go" + GO_VERSION + ".linux-amd64.tar.gz", "bbca37cc395c974ffa4893ee35819ad23ebb27426df87af92e93a9ec66ef8712"],
++    "linux_arm64": ["go" + GO_VERSION + ".linux-arm64.tar.gz", "124ea6033a8bf98aa9fbab53e58d134905262d45a022af3a90b73320f3c3afd5"],
++    "darwin_amd64": ["go" + GO_VERSION + ".darwin-amd64.tar.gz", "4a8d7a32052f223e71faab424a69430455b27b3fff5f4e651f9d97c3e51a8746"],
++    "darwin_arm64": ["go" + GO_VERSION + ".darwin-arm64.tar.gz", "4e29202c49573b953be7cc3500e1f8d9e66ddd12faa8cf0939a4951411e09a2a"],
++}
++
+ JQ_VERSION = "1.7"
+ YQ_VERSION = "4.24.4"
+ 
+@@ -46,7 +58,8 @@ def envoy_dependency_imports(
+         register_preinstalled_tools=True,  # use host tools (default)
+     )
+     go_rules_dependencies()
+-    go_register_toolchains(go_version)
++    go_download_sdk(name = "go_sdk", version = go_version, sdks = _GO_SDKS)
++    go_register_toolchains()
+     if go_version != "host":
+         envoy_download_go_sdks(go_version)
+     gazelle_dependencies(go_sdk = "go_sdk")
+@@ -218,24 +231,28 @@ def envoy_download_go_sdks(go_version):
+         goos = "linux",
+         goarch = "amd64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+     go_download_sdk(
+         name = "go_linux_arm64",
+         goos = "linux",
+         goarch = "arm64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+     go_download_sdk(
+         name = "go_darwin_amd64",
+         goos = "darwin",
+         goarch = "amd64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+     go_download_sdk(
+         name = "go_darwin_arm64",
+         goos = "darwin",
+         goarch = "arm64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+ 
+ def crates_repositories():
diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 58486835903b..a61b122769a4 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -43,14 +43,19 @@ let
     hash = "sha256-dT6ehfmW/huuyitqIlYAlEzUE6WrVA39sDKxatkZGaY=";
   };
 
+  # When GO_VERSION changes upstream, update the four sha256 hex strings in the
+  # _GO_SDKS dict in 0005-nixpkgs-pin-go-sdk-downloads.patch using output from
+  # this command (set the version literal in `select` to match GO_VERSION):
+  #   curl -s 'https://go.dev/dl/?mode=json&include=all' | jq -r '.[] | select(.version == "go1.24.6") | .files[] | select(.kind == "archive" and (.os == "linux" or .os == "darwin") and (.arch == "amd64" or .arch == "arm64")) | "\(.os)_\(.arch): \(.sha256)"'
+
   # these need to be updated for any changes to fetchAttrs
   depsHash' =
     if depsHash != null then
       depsHash
     else
       {
-        x86_64-linux = "sha256-dQpkB4jRfJOB14AO5ynoL3VObI1af7nTI3vbMr5N6/g=";
-        aarch64-linux = "sha256-59sY+bpGsKMDthcj+jw00WhN+vsP5MOTXy0m8HJxebM=";
+        x86_64-linux = "sha256-+oEQV3VfZu+p/f6Sif9pj2AkaA9+u0M8k+czdlcDLXI=";
+        aarch64-linux = "sha256-FcZfRinOd5KO6VnO9cx6ZQxJJ+KCFfB3Nk2k7zMuVU4";
       }
       .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
@@ -80,6 +85,9 @@ buildBazelPackage rec {
 
       # bump rules_rust to support newer Rust
       ./0004-nixpkgs-bump-rules_rust-to-0.60.0.patch
+
+      # pin Go SDK downloads so the deps hash doesn't drift on every Go release
+      ./0005-nixpkgs-pin-go-sdk-downloads.patch
     ];
     postPatch = ''
       chmod -R +w .

From c20ea3e0002543156b024b34af1f59458c3f30d6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 6 May 2026 04:52:10 +0000
Subject: [PATCH 27/40] gitkraken: 12.0.1 -> 12.1.0

---
 pkgs/by-name/gi/gitkraken/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/gi/gitkraken/package.nix b/pkgs/by-name/gi/gitkraken/package.nix
index 33dae3c156f5..41f8c9b178d7 100644
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@@ -56,24 +56,24 @@
 
 let
   pname = "gitkraken";
-  version = "12.0.1";
+  version = "12.1.0";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/linux/x64/${version}/gitkraken-amd64.tar.gz";
-      hash = "sha256-Tn4j9zmH8hr5rKaPFgox/LopTvEWghnPGf4JiM8y86k=";
+      hash = "sha256-HLo5cNkA59JBZ43Aea5W4vj2X4UDN0NtaB4VEjDQwvM=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/x64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-bKbqu94JPI4VOPcphkw/vAN/ihb5wc5qh/qaw7bweG0=";
+      hash = "sha256-SzGcT/2X4OXgtUqKCfE9UkKJsBCrKqj++vTdz2Rqfrc=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/arm64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-h2RSdK75i1NbchGauDSvaYJyz39Bncgf+RQIfRdDQuE=";
+      hash = "sha256-WYhSqRR0bHB1CKGbwSYHWvaCa/GpZCO6X4q6GMLuFpI=";
     };
   };
 

From d45400474af4b049fc7667569bb2fcb9d9574174 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Wed, 6 May 2026 07:12:17 +0200
Subject: [PATCH 28/40] blockbench: 5.1.3 -> 5.1.4

changelog: https://github.com/JannisX11/blockbench/releases/tag/v5.1.4

diff: https://github.com/JannisX11/blockbench/compare/v5.1.3...v5.1.4
---
 pkgs/by-name/bl/blockbench/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bl/blockbench/package.nix b/pkgs/by-name/bl/blockbench/package.nix
index cdf69b209b90..0d31dc1f86b4 100644
--- a/pkgs/by-name/bl/blockbench/package.nix
+++ b/pkgs/by-name/bl/blockbench/package.nix
@@ -12,13 +12,13 @@
 
 buildNpmPackage rec {
   pname = "blockbench";
-  version = "5.1.3";
+  version = "5.1.4";
 
   src = fetchFromGitHub {
     owner = "JannisX11";
     repo = "blockbench";
     tag = "v${version}";
-    hash = "sha256-aGGvYIYQ3fw1fk5NUwJsMkq2YSugQD94xfy52LvHOKc=";
+    hash = "sha256-lYsd8KegoO4amtRL5o3JPXW4vu4z3p/dXlOVn3zKgeA=";
   };
 
   patches = [

From 8d35007a2b70a022b34f457497d43a92230a0d87 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 6 May 2026 06:56:13 +0000
Subject: [PATCH 29/40] pi-coding-agent: 0.70.5 -> 0.73.0

---
 pkgs/by-name/pi/pi-coding-agent/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pi/pi-coding-agent/package.nix b/pkgs/by-name/pi/pi-coding-agent/package.nix
index 396540029231..e61574f72bc7 100644
--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -10,16 +10,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "pi-coding-agent";
-  version = "0.70.5";
+  version = "0.73.0";
 
   src = fetchFromGitHub {
     owner = "badlogic";
     repo = "pi-mono";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jn+hvS/DIwbwAff+UovdIVnmrb4o8gsC4IR24MnwF1I=";
+    hash = "sha256-oE4zMH5KEH185Vdp0CE221sa9rJJw35jFLlfhTa3Sg4=";
   };
 
-  npmDepsHash = "sha256-MZgcHJdGFGSNgQ26/24iA12FdmO7S5vWv4crSNFhHi0=";
+  npmDepsHash = "sha256-rBlAzAnP9aif1tZ984AO4HftIJsDgLQ+02J3td4jcRg=";
 
   npmWorkspace = "packages/coding-agent";
 

From e3bfdbef829a4605910862a119c6df83fbcaa930 Mon Sep 17 00:00:00 2001
From: yaya <github@uwu.is>
Date: Wed, 6 May 2026 09:01:25 +0200
Subject: [PATCH 30/40] pleroma: drop yayayayaka from maintainers

---
 pkgs/by-name/pl/pleroma/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/pl/pleroma/package.nix b/pkgs/by-name/pl/pleroma/package.nix
index 4c99d73b22f7..ffe434bf14f9 100644
--- a/pkgs/by-name/pl/pleroma/package.nix
+++ b/pkgs/by-name/pl/pleroma/package.nix
@@ -232,7 +232,6 @@ beamPackages.mixRelease rec {
     maintainers = with lib.maintainers; [
       picnoir
       kloenk
-      yayayayaka
     ];
     platforms = lib.platforms.unix;
   };

From 3f259d5ce25d853ebb82e997bf222b3378b2a804 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 6 May 2026 08:08:58 +0000
Subject: [PATCH 31/40] nats-server: 2.12.8 -> 2.14.0

---
 pkgs/by-name/na/nats-server/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index 00e3e431a306..33fdbf837a49 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nats-server";
-  version = "2.12.8";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats-server";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-iJMF6OyfukTYOwET+wxFpJZ8R0b7/JMEZns5dAkx5DE=";
+    hash = "sha256-S4IbxeiagiAXHidXBXniHKEUGnYaPWoGFNk2DPOkSNo=";
   };
 
-  vendorHash = "sha256-4idiVBtE+e2jf9uS3at+5+C3dnLxjtsLJIBC8zye5Pg=";
+  vendorHash = "sha256-oEYc8cT6OUQ7imbfDskIxnSNhHWpvSpMCxPdS6O2oZA=";
 
   doCheck = false;
 

From 1960099e7f148d51babab23a39a5d7296db8daeb Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 6 May 2026 15:10:07 +0700
Subject: [PATCH 32/40] piglit: unstable-2025-04-15 -> unstable-2026-05-04

---
 pkgs/by-name/pi/piglit/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pi/piglit/package.nix b/pkgs/by-name/pi/piglit/package.nix
index a761cf3c950a..b9b4c0bfdb3d 100644
--- a/pkgs/by-name/pi/piglit/package.nix
+++ b/pkgs/by-name/pi/piglit/package.nix
@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation {
   pname = "piglit";
-  version = "unstable-2025-04-15";
+  version = "unstable-2026-05-04";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "piglit";
-    rev = "d06f7bac988e67db53cbc05dc0b096b00856ab93";
-    hash = "sha256-bH9NjLEldlZwylq7S0q2vC5IQhUej0xZ6wD+mrWBK5A=";
+    rev = "1bb2910c3fced64396feddd205e356d80e5ff7d9";
+    hash = "sha256-/3OQeZiK7fHfPpSlFtbW7DLEFV3YFBL1cLMndXyxwYs=";
   };
 
   buildInputs = [

From 2c1812385418a17cdf8b57737169d26a92706fbd Mon Sep 17 00:00:00 2001
From: Ingo Blechschmidt <iblech@speicherleck.de>
Date: Wed, 6 May 2026 10:12:27 +0200
Subject: [PATCH 33/40] magic-wormhole: 0.23.0 -> 0.24.0

---
 pkgs/development/python-modules/magic-wormhole/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/magic-wormhole/default.nix b/pkgs/development/python-modules/magic-wormhole/default.nix
index 825eecad6baf..d5aef570ca8b 100644
--- a/pkgs/development/python-modules/magic-wormhole/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "magic-wormhole";
-  version = "0.23.0";
+  version = "0.24.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "magic-wormhole";
     repo = "magic-wormhole";
     tag = finalAttrs.version;
-    hash = "sha256-knvQwdPfe9uHpSNqaEz4w2LY6LjCPVoUcFG0bhHQl+g=";
+    hash = "sha256-aY8dI5K2qroY+Nbc00R5XK0AjHpdnXFYWABgPqf8gQ8=";
   };
 
   postPatch =

From 52e5e8c4883c054fe24218b0b684cebdd7cfdee4 Mon Sep 17 00:00:00 2001
From: Xiangyan Sun <wishstudio@gmail.com>
Date: Wed, 6 May 2026 01:21:17 -0700
Subject: [PATCH 34/40] ink: fix build with gcc15

---
 pkgs/by-name/in/ink/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/in/ink/package.nix b/pkgs/by-name/in/ink/package.nix
index 502c5b4b208c..f986dc11295e 100644
--- a/pkgs/by-name/in/ink/package.nix
+++ b/pkgs/by-name/in/ink/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchDebianPatch,
   libinklevel,
 }:
 
@@ -14,6 +15,16 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "1fk0b8vic04a3i3vmq73hbk7mzbi57s8ks6ighn3mvr6m2v8yc9d";
   };
 
+  patches = [
+    (fetchDebianPatch {
+      pname = "ink";
+      version = "0.5.3";
+      debianRevision = "7";
+      patch = "gcc15.patch";
+      hash = "sha256-2Qn8jDAY/ub8MEiG68J7nEnz9GQ/8ScF9nweTkuCibQ=";
+    })
+  ];
+
   buildInputs = [
     libinklevel
   ];

From 8b1c78f402ff4403b7f4632bcbe85284830f0adb Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Wed, 6 May 2026 10:31:52 +0200
Subject: [PATCH 35/40] rustnet: 1.2.0 -> 1.3.0

Diff: https://github.com/domcyrus/rustnet/compare/v1.2.0...v1.3.0

Changelog: https://github.com/domcyrus/rustnet/releases/tag/v1.3.0
---
 pkgs/by-name/ru/rustnet/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rustnet/package.nix b/pkgs/by-name/ru/rustnet/package.nix
index 9b687f956ae2..70081d80608e 100644
--- a/pkgs/by-name/ru/rustnet/package.nix
+++ b/pkgs/by-name/ru/rustnet/package.nix
@@ -13,7 +13,7 @@
 }:
 let
   pname = "rustnet";
-  version = "1.2.0";
+  version = "1.3.0";
 in
 rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } {
   inherit pname version;
@@ -23,10 +23,10 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } {
     owner = "domcyrus";
     repo = "rustnet";
     tag = "v${version}";
-    hash = "sha256-ZTCcPTKlKnUNlD4Ayf5dV7Yi2BuKwJ/0IwO3YqlB6u8=";
+    hash = "sha256-E2ItYSnT3WRSgPb5B+HDAlAPPmSLdt8qnE+2TiXHPk8=";
   };
 
-  cargoHash = "sha256-5Zgo6Ypyrhy5IHC1IiWxgP4aOOdyBNEBBHWi0rsDji0=";
+  cargoHash = "sha256-B1IdFOKYNaLiq6t64mdR3zUUcvojevcV6/nqYGbsbAY=";
 
   nativeBuildInputs = [
     pkg-config

From aac795740f935b0628d1ed1e74a0528be5216ded Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Wed, 6 May 2026 10:50:56 +0200
Subject: [PATCH 36/40] lib.licenses: add w3c-19980720

---
 lib/licenses/licenses.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/licenses/licenses.nix b/lib/licenses/licenses.nix
index fbc915a6ce5b..8e40dacdbeb3 100644
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -1560,6 +1560,11 @@ lib.mapAttrs mkLicense (
       fullName = "W3C Software Notice and License";
     };
 
+    w3c-19980720 = {
+      spdxId = "W3C-19980720";
+      fullName = "W3C Software Notice and License (1998-07-20)";
+    };
+
     wadalab = {
       fullName = "Wadalab Font License";
       url = "https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab";

From f98632e456ed3b8f5e5d0273ee7e6a5ba33f2a66 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Wed, 6 May 2026 10:52:39 +0200
Subject: [PATCH 37/40] zed-editor: 1.0.0 -> 1.0.1

https://github.com/zed-industries/zed/releases/tag/v1.0.1
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index ee17f813df39..23e80e10348a 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -97,7 +97,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "1.0.0";
+  version = "1.0.1";
 
   outputs = [
     "out"
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D5V0pvL3WCwhcC8dnNKTXRdnFq8LMZZ0/GDjw8xf95g=";
+    hash = "sha256-wru2i6Zu3gnqy3zTpS2jfKaVRTVuhI0yaM2vF3bKtD4=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-xtw7r7VluCEqXWKnxpVk8BPqr+mJV5rB3Eq/PvsKPBk=";
+  cargoHash = "sha256-lBKexuOri/bI0Xc8ludVtLssGjdk+it83u/RtasaJFs=";
 
   __structuredAttrs = true;
 

From 2f6387d8b0bca6832712ee90c3aad734a90305cd Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 6 May 2026 15:58:23 +0700
Subject: [PATCH 38/40] rtl_fm_streamer: fix build with gcc 15

---
 pkgs/by-name/rt/rtl_fm_streamer/package.nix    |  4 ++++
 .../rt/rtl_fm_streamer/use-stdbool.patch       | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 pkgs/by-name/rt/rtl_fm_streamer/use-stdbool.patch

diff --git a/pkgs/by-name/rt/rtl_fm_streamer/package.nix b/pkgs/by-name/rt/rtl_fm_streamer/package.nix
index 435744ea7666..777e927c92e5 100644
--- a/pkgs/by-name/rt/rtl_fm_streamer/package.nix
+++ b/pkgs/by-name/rt/rtl_fm_streamer/package.nix
@@ -30,6 +30,10 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "cmake_minimum_required(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
   '';
 
+  patches = [
+    ./use-stdbool.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/by-name/rt/rtl_fm_streamer/use-stdbool.patch b/pkgs/by-name/rt/rtl_fm_streamer/use-stdbool.patch
new file mode 100644
index 000000000000..4e5dd2b70180
--- /dev/null
+++ b/pkgs/by-name/rt/rtl_fm_streamer/use-stdbool.patch
@@ -0,0 +1,18 @@
+Drop the hand-rolled bool enum: `bool`, `true`, and `false` are reserved
+keywords in C23 (the default since GCC 15), so the typedef no longer compiles.
+
+--- a/src/rtl_fm_streamer.c
++++ b/src/rtl_fm_streamer.c
+@@ -100,11 +100,7 @@
+
+ #define DEFAULT_PORT_NUMBER "2346"
+
+-typedef enum
+-{
+-    false = 0,
+-    true
+-}bool;
++#include <stdbool.h>
+
+ struct dongle_state
+ {

From c19401508b97df2c57c03d51fea33d39851c67ab Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Wed, 6 May 2026 11:07:13 +0200
Subject: [PATCH 39/40] xhtml1: set license

source: https://www.w3.org/Consortium/Legal/copyright-software-19980720.html
---
 pkgs/by-name/xh/xhtml1/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/xh/xhtml1/package.nix b/pkgs/by-name/xh/xhtml1/package.nix
index 4d13bd1624dc..020abcab5419 100644
--- a/pkgs/by-name/xh/xhtml1/package.nix
+++ b/pkgs/by-name/xh/xhtml1/package.nix
@@ -33,5 +33,6 @@ stdenv.mkDerivation {
     homepage = "https://www.w3.org/TR/xhtml1/";
     description = "DTDs for XHTML 1.0, the Extensible HyperText Markup Language";
     platforms = lib.platforms.unix;
+    license = lib.licenses.w3c-19980720;
   };
 }

From 692dacabe52e1f9c4eb8a4ea00a07f75a9d31483 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 6 May 2026 10:13:10 +0000
Subject: [PATCH 40/40] spicedb-zed: 1.0.0 -> 1.1.1

---
 pkgs/by-name/sp/spicedb-zed/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sp/spicedb-zed/package.nix b/pkgs/by-name/sp/spicedb-zed/package.nix
index 74541fb64c27..14efa4ded236 100644
--- a/pkgs/by-name/sp/spicedb-zed/package.nix
+++ b/pkgs/by-name/sp/spicedb-zed/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "zed";
-  version = "1.0.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kF16ZmIOw80esknKJvHYFWrx4FG/kn+Il5xnC1JmAn4=";
+    hash = "sha256-rlTcC2+faNZKvzouGC9nJBBCsDabxozTE/SFbf8YKQ8=";
   };
 
-  vendorHash = "sha256-e/VrFEKVVAAtClAzFw2XV3cWVmto90qzMKVLpZjKZ8o=";
+  vendorHash = "sha256-/nnPVy+pjcgkgJW8630IycmGF4Qq4I01htEDlsWvZbM=";
 
   ldflags = [ "-X 'github.com/jzelinskie/cobrautil/v2.Version=${finalAttrs.src.tag}'" ];