From 26598134d5c33b9f1b9e081b2011bfa7ae62cece Mon Sep 17 00:00:00 2001
From: Alexander Tomokhov <alexoundos@gmail.com>
Date: Thu, 16 Jan 2025 00:18:19 +0400
Subject: [PATCH 01/95] nixos/castopod: fix database.passwordFile in
 castopod-setup-start script

---
 nixos/modules/services/web-apps/castopod.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/castopod.nix b/nixos/modules/services/web-apps/castopod.nix
index 018dafd07bda..891e1f7e4168 100644
--- a/nixos/modules/services/web-apps/castopod.nix
+++ b/nixos/modules/services/web-apps/castopod.nix
@@ -240,7 +240,7 @@ in
           ${
             if (cfg.database.passwordFile != null) then
               ''
-                echo "database.default.password=$(cat "$CREDENTIALS_DIRECTORY/dbpasswordfile)" >> ${envFile}
+                echo "database.default.password=$(<"$CREDENTIALS_DIRECTORY/dbpasswordfile")" >> ${envFile}
               ''
             else
               ''

From 7fbf9ed09a2cde0d33ff41db745b9e384fb59939 Mon Sep 17 00:00:00 2001
From: MakiseKurisu <MakiseKurisu@users.noreply.github.com>
Date: Sat, 15 Mar 2025 18:42:22 +0800
Subject: [PATCH 02/95] iscc: stdenv -> stdenvNoCC

---
 pkgs/by-name/is/iscc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/is/iscc/package.nix b/pkgs/by-name/is/iscc/package.nix
index cc402d9cbd46..394d9623bdb3 100644
--- a/pkgs/by-name/is/iscc/package.nix
+++ b/pkgs/by-name/is/iscc/package.nix
@@ -1,5 +1,5 @@
 {
-  stdenv,
+  stdenvNoCC,
   fetchurl,
   innoextract,
   runtimeShell,
@@ -11,7 +11,7 @@ let
   version = "6.2.2";
   majorVersion = builtins.substring 0 1 version;
 in
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "iscc";
   inherit version;
   src = fetchurl {

From a30471969e900fcdc73d95536c9bf4cee8c6eddc Mon Sep 17 00:00:00 2001
From: MakiseKurisu <MakiseKurisu@users.noreply.github.com>
Date: Sat, 15 Mar 2025 18:46:16 +0800
Subject: [PATCH 03/95] iscc: add meta.mainProgram

---
 pkgs/by-name/is/iscc/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/is/iscc/package.nix b/pkgs/by-name/is/iscc/package.nix
index 394d9623bdb3..d424a8b637b3 100644
--- a/pkgs/by-name/is/iscc/package.nix
+++ b/pkgs/by-name/is/iscc/package.nix
@@ -59,6 +59,7 @@ stdenvNoCC.mkDerivation rec {
     changelog = "https://jrsoftware.org/files/is6-whatsnew.htm";
     license = licenses.unfreeRedistributable;
     maintainers = [ ];
+    mainProgram = "iscc";
     platforms = wineWow64Packages.stable.meta.platforms;
   };
 }

From ff4aab81d36e21a918bd1ee040adc381490b6c14 Mon Sep 17 00:00:00 2001
From: Sophie Taylor <sophie@spacekitteh.moe>
Date: Tue, 8 Apr 2025 08:58:05 +1000
Subject: [PATCH 04/95] nixos/suricata: update rule source names; add update
 timer

---
 .../services/networking/suricata/default.nix   | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/networking/suricata/default.nix b/nixos/modules/services/networking/suricata/default.nix
index 5473fc913ebc..0289e25048cc 100644
--- a/nixos/modules/services/networking/suricata/default.nix
+++ b/nixos/modules/services/networking/suricata/default.nix
@@ -117,15 +117,16 @@ in
       type = types.listOf types.str;
       # see: nix-shell -p suricata python3Packages.pyyaml --command 'suricata-update list-sources'
       default = [
+        "abuse.ch/sslbl-blacklist"
+        "abuse.ch/sslbl-c2"
+        "abuse.ch/sslbl-ja3"
         "et/open"
         "etnetera/aggressive"
         "stamus/lateral"
         "oisf/trafficid"
         "tgreen/hunting"
-        "sslbl/ja3-fingerprints"
-        "sslbl/ssl-fp-blacklist"
-        "malsilo/win-malware"
         "pawpatrules"
+        "ptrules/open"
       ];
       description = ''
         List of sources that should be enabled.
@@ -197,6 +198,17 @@ in
         "d ${cfg.settings."default-rule-path"} 755 ${cfg.settings.run-as.user} ${cfg.settings.run-as.group}"
       ];
 
+      systemd.timers = {
+        suricata-update = {
+          timerConfig = {
+            OnBootSec = lib.mkDefault "30s";
+            OnUnitActiveSec = lib.mkDefault "24h";
+            Persistent = true;
+            Unit = config.systemd.services.suricata-update.name;
+          };
+        };
+      };
+
       systemd.services = {
         suricata-update = {
           description = "Update Suricata Rules";

From f2244d88ecbd6c062edab4911fff88bbe7cf6843 Mon Sep 17 00:00:00 2001
From: MakiseKurisu <MakiseKurisu@users.noreply.github.com>
Date: Sat, 15 Mar 2025 18:53:56 +0800
Subject: [PATCH 05/95] innoextract: 1.9 -> 1.9-unstable-2025-02-06

---
 pkgs/by-name/in/innoextract/package.nix | 23 +++++++----------------
 1 file changed, 7 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/in/innoextract/package.nix b/pkgs/by-name/in/innoextract/package.nix
index 6e145f31300c..e6faaf372b1b 100644
--- a/pkgs/by-name/in/innoextract/package.nix
+++ b/pkgs/by-name/in/innoextract/package.nix
@@ -1,8 +1,7 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  fetchpatch,
+  fetchFromGitHub,
   cmake,
   makeWrapper,
   boost,
@@ -14,23 +13,15 @@
 
 stdenv.mkDerivation rec {
   pname = "innoextract";
-  version = "1.9";
+  version = "1.9-unstable-2025-02-06";
 
-  src = fetchurl {
-    url = "https://constexpr.org/innoextract/files/innoextract-${version}.tar.gz";
-    sha256 = "09l1z1nbl6ijqqwszdwch9mqr54qb7df0wp2sd77v17dq6gsci33";
+  src = fetchFromGitHub {
+    owner = "dscharrer";
+    repo = "innoextract";
+    rev = "6e9e34ed0876014fdb46e684103ef8c3605e382e";
+    hash = "sha256-bgACPDo1phjIiwi336JEB1UAJKyL2NmCVOhyZxBFLJo=";
   };
 
-  patches = [
-    # Fix boost-1.86 build:
-    #   https://github.com/dscharrer/innoextract/pull/169
-    (fetchpatch {
-      name = "boost-1.86.patch";
-      url = "https://github.com/dscharrer/innoextract/commit/264c2fe6b84f90f6290c670e5f676660ec7b2387.patch";
-      hash = "sha256-QYwrqLXC7FE4oYi6G1erpX/RUUtS5zNBv7/fO7AdZQg=";
-    })
-  ];
-
   buildInputs = [
     xz
     boost

From 8ad15bf85bce80e5e973416066b0d7a63b17022a Mon Sep 17 00:00:00 2001
From: MakiseKurisu <MakiseKurisu@users.noreply.github.com>
Date: Sat, 15 Mar 2025 18:54:16 +0800
Subject: [PATCH 06/95] iscc: 6.2.2 -> 6.4.1

The latest 6.4.2 is not supported by the innoextract.
---
 pkgs/by-name/is/iscc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/is/iscc/package.nix b/pkgs/by-name/is/iscc/package.nix
index d424a8b637b3..043727e8edcd 100644
--- a/pkgs/by-name/is/iscc/package.nix
+++ b/pkgs/by-name/is/iscc/package.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "6.2.2";
+  version = "6.4.1";
   majorVersion = builtins.substring 0 1 version;
 in
 stdenvNoCC.mkDerivation rec {
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation rec {
   inherit version;
   src = fetchurl {
     url = "https://files.jrsoftware.org/is/${majorVersion}/innosetup-${version}.exe";
-    hash = "sha256-gRfRDQCirTOhOQl46jhyhhwzDgh5FEEKY3eyLExbhWM=";
+    hash = "sha256-9Bdg4fGuFdIIm7arFi4hcguSrnUG7XBmezkgAGPWjjQ=";
   };
   nativeBuildInputs = [
     innoextract

From 77b23f012c443e4bf25cd32c0cc2a399b07171aa Mon Sep 17 00:00:00 2001
From: Uriel <imurx@proton.me>
Date: Sat, 15 Nov 2025 16:51:38 -0300
Subject: [PATCH 07/95] webcamize: init at 2.0.1

---
 pkgs/by-name/we/webcamize/package.nix | 43 +++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 pkgs/by-name/we/webcamize/package.nix

diff --git a/pkgs/by-name/we/webcamize/package.nix b/pkgs/by-name/we/webcamize/package.nix
new file mode 100644
index 000000000000..8d6696014af9
--- /dev/null
+++ b/pkgs/by-name/we/webcamize/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  ffmpeg,
+  libgphoto2,
+  kmod,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "webcamize";
+  version = "2.0.1";
+
+  src = fetchFromGitHub {
+    owner = "cowtoolz";
+    repo = "webcamize";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rmATEcAcngCHidMFXNocrhP06LKNLEb+9jfFMGL4AKU=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    ffmpeg
+    libgphoto2
+    kmod
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install -Dm755 -t $out/bin bin/webcamize
+  '';
+
+  meta = {
+    description = "Use (almost) any camera as a webcam";
+    homepage = "https://github.com/cowtoolz/webcamize";
+    changelog = "https://github.com/cowtoolz/webcamize/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.bsd2;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ imurx ];
+    mainProgram = "webcamize";
+  };
+})

From a85d008af6ff0bd0933875b9712ae26059c40d0e Mon Sep 17 00:00:00 2001
From: n0099 <git@n0099.com>
Date: Mon, 5 Jan 2026 11:59:49 +0000
Subject: [PATCH 08/95] wrapNonDeterministicGcc: override the param `cc` of
 `ccWrapper` instead of override drv attr `env.cc`

This affect the value of attr path `pkgs.fastStdenv.cc.cc.buildFlags`:
before: `[ ]`
after: `[ "profiledbootstrap" ]`

ref: c577eb6892a1128c1dd52846596217653ea87f14
---
 pkgs/top-level/all-packages.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 45fda231747f..42944853d2ad 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4263,12 +4263,10 @@ with pkgs;
   wrapNonDeterministicGcc =
     stdenv: ccWrapper:
     if ccWrapper.isGNU then
-      ccWrapper.overrideAttrs (old: {
-        env = old.env // {
-          cc = old.env.cc.override {
-            reproducibleBuild = false;
-            profiledCompiler = with stdenv; (!isDarwin && hostPlatform.isx86);
-          };
+      ccWrapper.override (prev: {
+        cc = prev.cc.override {
+          reproducibleBuild = false;
+          profiledCompiler = with stdenv; (!isDarwin && hostPlatform.isx86);
         };
       })
     else

From 5eee032d671f6f1feb481cf64d00c5e5188cb98c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 20 Jan 2026 22:58:42 +0000
Subject: [PATCH 09/95] groovy: 5.0.2 -> 5.0.4

---
 pkgs/by-name/gr/groovy/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/groovy/package.nix b/pkgs/by-name/gr/groovy/package.nix
index 2f898a97000f..453da0c52e72 100644
--- a/pkgs/by-name/gr/groovy/package.nix
+++ b/pkgs/by-name/gr/groovy/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "groovy";
-  version = "5.0.2";
+  version = "5.0.4";
 
   src = fetchurl {
     url = "mirror://apache/groovy/${finalAttrs.version}/distribution/apache-groovy-binary-${finalAttrs.version}.zip";
-    sha256 = "sha256-cPgvEbG3ZOIH3PVWiILHjcdyk/MHgWJCOUo/enTyDoE=";
+    hash = "sha256-Xl6aRo1DRODI7gzWjGJ1HM9OX4+E162birxqAQFLn3k=";
   };
 
   nativeBuildInputs = [

From a614681c9152cbb65648d5352907211f00254989 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 28 Dec 2025 18:01:37 +0000
Subject: [PATCH 10/95] gpclient: 2.5.0 -> 2.5.1

---
 pkgs/by-name/gp/gpauth/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gp/gpauth/package.nix b/pkgs/by-name/gp/gpauth/package.nix
index 37f4afd5aa29..0ebd8cb93433 100644
--- a/pkgs/by-name/gp/gpauth/package.nix
+++ b/pkgs/by-name/gp/gpauth/package.nix
@@ -12,19 +12,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gpauth";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "yuezk";
     repo = "GlobalProtect-openconnect";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dxRqf5iOlgJegeAqtTwoVqNHXU3eOse5eMYFknhAh2M=";
+    hash = "sha256-rux2rToqs5GZEDTryPAkm62yGdhWfEqapTMQOGyqCRI=";
     fetchSubmodules = true;
   };
 
   buildAndTestSubdir = "apps/gpauth";
 
-  cargoHash = "sha256-VkDq98Y6uBSal7m4V9vjW1XermOPOWulo3Jo34QFRsA=";
+  cargoHash = "sha256-xza7AfuOcSUkDyliGHUx9bEd+M94d23xVrVVvZo2nas=";
 
   nativeBuildInputs = [
     perl

From 39a0975daf894ddf11c1e71e58b85a94aa68e878 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sat, 31 Jan 2026 16:20:59 -0500
Subject: [PATCH 11/95] gpclient: use postFixup instead of preFixup

---
 pkgs/by-name/gp/gpclient/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/gp/gpclient/package.nix b/pkgs/by-name/gp/gpclient/package.nix
index 14c334bb4a5e..815ae56486fc 100644
--- a/pkgs/by-name/gp/gpclient/package.nix
+++ b/pkgs/by-name/gp/gpclient/package.nix
@@ -76,7 +76,7 @@ rustPlatform.buildRustPackage {
     cp packaging/files/usr/share/applications/gpgui.desktop $out/share/applications/gpgui.desktop
   '';
 
-  preFixup = ''
+  postFixup = ''
     wrapProgram "$out/bin/gpclient" \
       --prefix GIO_EXTRA_MODULES : ${glib-networking}/lib/gio/modules
   '';

From 6f76e5c7d2418fbdfbbe99192dd31732996177a4 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sat, 31 Jan 2026 16:14:44 -0500
Subject: [PATCH 12/95] gpclient: adopt postPatch and postInstall from upstream
 flake

Note that all gpgui related files are dropped because they require an
external proprietary gpgui binary that we don't package.
---
 pkgs/by-name/gp/gpclient/package.nix | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/gp/gpclient/package.nix b/pkgs/by-name/gp/gpclient/package.nix
index 815ae56486fc..9a47df29ac9d 100644
--- a/pkgs/by-name/gp/gpclient/package.nix
+++ b/pkgs/by-name/gp/gpclient/package.nix
@@ -63,17 +63,27 @@ rustPlatform.buildRustPackage {
   ];
 
   postPatch = ''
-    substituteInPlace crates/common/src/constants.rs \
-      --replace-fail /usr/bin/gpauth ${gpauth}/bin/gpauth
     substituteInPlace crates/openconnect/src/vpn_utils.rs \
-      --replace-fail /usr/sbin/vpnc-script ${vpnc-scripts}/bin/vpnc-script
-    substituteInPlace packaging/files/usr/share/applications/gpgui.desktop \
-      --replace-fail /usr/bin/gpclient gpclient
+      --replace-fail /etc/vpnc/vpnc-script ${vpnc-scripts}/bin/vpnc-script \
+      --replace-fail /usr/libexec/gpclient/hipreport.sh $out/libexec/gpclient/hipreport.sh
+
+    substituteInPlace crates/common/src/constants.rs \
+      --replace-fail /usr/bin/gpclient $out/bin/gpclient \
+      --replace-fail /usr/bin/gpservice $out/bin/gpservice \
+      --replace-fail /usr/bin/gpauth ${gpauth}/bin/gpauth \
+      --replace-fail /opt/homebrew/ $out/
   '';
 
-  postInstall = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    mkdir -p $out/share/applications
-    cp packaging/files/usr/share/applications/gpgui.desktop $out/share/applications/gpgui.desktop
+  postInstall = ''
+    cp -r packaging/files/usr/libexec $out/libexec
+
+    substituteInPlace $out/libexec/gpclient/hipreport.sh \
+      --replace-fail /usr/bin/gpclient $out/bin/gpclient
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    cp -r packaging/files/usr/lib $out/lib
+    substituteInPlace $out/lib/NetworkManager/dispatcher.d/pre-down.d/gpclient.down \
+      --replace-fail /usr/bin/gpclient $out/bin/gpclient
   '';
 
   postFixup = ''

From 88decd13caabf38c27733c0c1a03d37770e30d7e Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sat, 31 Jan 2026 16:47:17 -0500
Subject: [PATCH 13/95] gpclient: avoid unnecessary dependencies on darwin

---
 pkgs/by-name/gp/gpclient/package.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/gp/gpclient/package.nix b/pkgs/by-name/gp/gpclient/package.nix
index 9a47df29ac9d..17aa124679e1 100644
--- a/pkgs/by-name/gp/gpclient/package.nix
+++ b/pkgs/by-name/gp/gpclient/package.nix
@@ -50,16 +50,18 @@ rustPlatform.buildRustPackage {
     openssl
     glib-networking
     glib
-    pango
-    cairo
-    atk
-    gtk3
 
     # used for vendored openconnect
+    gnutls
     libxml2
     lz4
     p11-kit
-    gnutls
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    atk
+    cairo
+    gtk3
+    pango
   ];
 
   postPatch = ''

From 44915d8213bad6b1b015643419ae1abdea52a794 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sat, 31 Jan 2026 16:52:44 -0500
Subject: [PATCH 14/95] gpclient: use makeBinaryWrapper

---
 pkgs/by-name/gp/gpclient/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gp/gpclient/package.nix b/pkgs/by-name/gp/gpclient/package.nix
index 17aa124679e1..8d9324b538e0 100644
--- a/pkgs/by-name/gp/gpclient/package.nix
+++ b/pkgs/by-name/gp/gpclient/package.nix
@@ -4,7 +4,7 @@
   glib-networking,
   stdenv,
   gpauth,
-  makeWrapper,
+  makeBinaryWrapper,
   autoconf,
   automake,
   libtool,
@@ -37,7 +37,7 @@ rustPlatform.buildRustPackage {
 
   nativeBuildInputs = [
     perl
-    makeWrapper
+    makeBinaryWrapper
     pkg-config
 
     # used to build vendored openconnect

From 423aa922019e990ffc8788e45a767881d88f3ea8 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sat, 31 Jan 2026 16:53:32 -0500
Subject: [PATCH 15/95] gpclient: sort arguments and variables

---
 pkgs/by-name/gp/gpclient/package.nix | 34 ++++++++++++++--------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/pkgs/by-name/gp/gpclient/package.nix b/pkgs/by-name/gp/gpclient/package.nix
index 8d9324b538e0..bdd6c40375ac 100644
--- a/pkgs/by-name/gp/gpclient/package.nix
+++ b/pkgs/by-name/gp/gpclient/package.nix
@@ -1,43 +1,43 @@
 {
   lib,
   rustPlatform,
-  glib-networking,
   stdenv,
-  gpauth,
-  makeBinaryWrapper,
+  atk,
   autoconf,
   automake,
+  cairo,
+  glib,
+  glib-networking,
+  gnutls,
+  gpauth,
+  gtk3,
   libtool,
+  libxml2,
+  lz4,
+  makeBinaryWrapper,
   openssl,
+  p11-kit,
+  pango,
   perl,
   pkg-config,
   vpnc-scripts,
-  glib,
-  pango,
-  cairo,
-  atk,
-  gtk3,
-  libxml2,
-  p11-kit,
-  lz4,
-  gnutls,
 }:
 
 rustPlatform.buildRustPackage {
   pname = "gpclient";
 
   inherit (gpauth)
-    src
-    version
     cargoHash
     meta
+    src
+    version
     ;
 
   buildAndTestSubdir = "apps/gpclient";
 
   nativeBuildInputs = [
-    perl
     makeBinaryWrapper
+    perl
     pkg-config
 
     # used to build vendored openconnect
@@ -46,10 +46,10 @@ rustPlatform.buildRustPackage {
     libtool
   ];
   buildInputs = [
+    glib
+    glib-networking
     gpauth
     openssl
-    glib-networking
-    glib
 
     # used for vendored openconnect
     gnutls

From 2223676b88fec70a84975c60795292c3a0fc0527 Mon Sep 17 00:00:00 2001
From: structix <janek@schoff.it>
Date: Tue, 17 Feb 2026 22:23:11 +0100
Subject: [PATCH 16/95] maintainers: add STRUCTiX

---
 maintainers/maintainer-list.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f645780eb509..c54239f4c32d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -25649,6 +25649,11 @@
     githubId = 7543617;
     name = "Struan Robertson";
   };
+  structix = {
+    github = "STRUCTiX";
+    githubId = 15931333;
+    name = "Janek";
+  };
   stteague = {
     email = "stteague505@yahoo.com";
     github = "stteague";

From 7955514b04b6514e8bbc8e654a71a72287e92eb8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 08:08:18 +0000
Subject: [PATCH 17/95] fermyon-spin: 3.5.1 -> 3.6.2

---
 pkgs/by-name/fe/fermyon-spin/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/fe/fermyon-spin/package.nix b/pkgs/by-name/fe/fermyon-spin/package.nix
index 8329af29b065..104ebe0d78d9 100644
--- a/pkgs/by-name/fe/fermyon-spin/package.nix
+++ b/pkgs/by-name/fe/fermyon-spin/package.nix
@@ -20,17 +20,17 @@ let
     .${system} or (throw "Unsupported system: ${system}");
 
   packageHashes = {
-    x86_64-linux = "sha256-B+LKXK7DFakiFNdanaqMeGxnfxoEI4caNtxnyZEcWgQ=";
-    aarch64-linux = "sha256-FMYIO1miEulnz9logtXxau2mIuR1zS8oCG04DMx0HyQ=";
-    x86_64-darwin = "sha256-I3Z1QqIu0iJBZWq6fUWouGfTYzNr/wj+0UFfq0wSy4Y=";
-    aarch64-darwin = "sha256-AL1TUJO5jSNhjfZ/rLo9Do22oqVhpLqiRdGnvVaqvog=";
+    x86_64-linux = "sha256-xlBByHwsyV/ygbQZf1k4cWCI7jqcuufseVpNc4lERaM=";
+    aarch64-linux = "sha256-7/UEYdPsedLEqa/kCR23lz4tmhkhYVwFkXutRAtF8eo=";
+    x86_64-darwin = "sha256-IeA5VWobAZtBsmE15U57PmwWRGhW0l+abytRA9AEERk=";
+    aarch64-darwin = "sha256-HwO3G6MnQP8yG4rzQKt1GkxCfuSSOtC1zOrSNWQzxx4=";
   };
 
   packageHash = packageHashes.${system} or (throw "Unsupported system: ${system}");
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fermyon-spin";
-  version = "3.5.1";
+  version = "3.6.2";
 
   # Use fetchurl rather than fetchzip as these tarballs are built by the project
   # and not by GitHub (and thus are stable) - this simplifies the update script

From e6133abf885901c2c3e3ddb0335cbba380ac5597 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Fri, 27 Feb 2026 14:02:10 +0100
Subject: [PATCH 18/95] vitess: 23.0.0 -> 23.0.3

Fixes https://github.com/NixOS/nixpkgs/issues/494765 / CVE-2026-27969
Fixes https://github.com/NixOS/nixpkgs/issues/494756 / CVE-2026-27965

Changes:
https://github.com/vitessio/vitess/releases/tag/v23.0.3
https://github.com/vitessio/vitess/blob/main/changelog/23.0/23.0.2/changelog.md
https://github.com/vitessio/vitess/blob/main/changelog/23.0/23.0.1/changelog.md
---
 pkgs/by-name/vi/vitess/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vi/vitess/package.nix b/pkgs/by-name/vi/vitess/package.nix
index 1024dea0ad9c..4532cc40fa3c 100644
--- a/pkgs/by-name/vi/vitess/package.nix
+++ b/pkgs/by-name/vi/vitess/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vitess";
-  version = "23.0.0";
+  version = "23.0.3";
 
   src = fetchFromGitHub {
     owner = "vitessio";
     repo = "vitess";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gP++iix4jonsSgrAblhnT7XFCggCEMG7ve3GKTJuOoo=";
+    hash = "sha256-cLpVpdYpMzJX5Y4RBuUp2SbedBHiqG+SRu8Oh+dowFY=";
   };
 
-  vendorHash = "sha256-jwlIOfBuIi1D40p21jF3LJw508zrovw0ukXUn27Sb9U=";
+  vendorHash = "sha256-YhWa5eUeMCqmA+8Mi3lxQTSQ29xMpWWAb2BQPN1/+N8=";
 
   buildInputs = [ sqlite ];
 

From 4fb8b7678b3e6956ffb6951597e7f0dfcc802c2c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 27 Feb 2026 19:21:57 +0000
Subject: [PATCH 19/95] zarf: 0.70.1 -> 0.73.0

---
 pkgs/by-name/za/zarf/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/za/zarf/package.nix b/pkgs/by-name/za/zarf/package.nix
index 900d518803f8..8ff433db8ad7 100644
--- a/pkgs/by-name/za/zarf/package.nix
+++ b/pkgs/by-name/za/zarf/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "zarf";
-  version = "0.70.1";
+  version = "0.73.0";
 
   src = fetchFromGitHub {
     owner = "zarf-dev";
     repo = "zarf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3ucUB6KAIm4dPf/8CysZVwKbWp9QZIeP435Aclyzhfs=";
+    hash = "sha256-zl33nIUsThq1+uuT7C6OVkoICsQwx+RM8xGqZQt8Tm8=";
   };
 
-  vendorHash = "sha256-WjnM9G5Dcn0dawghw6NLGUebIGQ7zJ97nMPL3JgqRKM=";
+  vendorHash = "sha256-K8natFIvEomIcPTu73NsMWbN8D0qzWqLTLGjHrLSaK0=";
   proxyVendor = true;
 
   nativeBuildInputs = [

From f6d7a099bea84f490ed38d9d682048221aef6b6a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sat, 28 Feb 2026 12:09:18 +0100
Subject: [PATCH 20/95] opencv: move env variables into env for structuredAttrs

---
 pkgs/development/libraries/opencv/4.x.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index b2381fee1d08..3e81c8a5b008 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -459,9 +459,11 @@ effectiveStdenv.mkDerivation {
     cudaPackages.cuda_nvcc
   ];
 
-  # Configure can't find the library without this.
-  OpenBLAS_HOME = optionalString withOpenblas openblas_.dev;
-  OpenBLAS = optionalString withOpenblas openblas_;
+  env = {
+    # Configure can't find the library without this.
+    OpenBLAS_HOME = optionalString withOpenblas openblas_.dev;
+    OpenBLAS = optionalString withOpenblas openblas_;
+  };
 
   cmakeFlags = [
     (cmakeBool "BUILD_INFO_SKIP_SYSTEM_VERSION" true)

From 949f73fcf983e5e3bd627ce62187d7684192d93a Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sat, 28 Feb 2026 16:15:30 +0200
Subject: [PATCH 21/95] nixos/shadow: use su from sudo-rs when enabled

When security.sudo-rs.enable is true, use the memory-safe su
implementation from sudo-rs instead of the one from shadow.
---
 nixos/modules/programs/shadow.nix  | 9 ++++++++-
 nixos/modules/security/sudo-rs.nix | 2 ++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/programs/shadow.nix b/nixos/modules/programs/shadow.nix
index 12c9a84333bf..d6d48af0f877 100644
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@@ -22,6 +22,13 @@ in
       '';
     };
 
+    security.shadow.su.package = lib.mkPackageOption pkgs [ "shadow" "su" ] {
+      extraDescription = ''
+        This can be overridden by other modules (e.g. sudo-rs) to provide
+        an alternative `su` implementation.
+      '';
+    };
+
     security.loginDefs = {
       package = lib.mkPackageOption pkgs "shadow" { };
 
@@ -262,7 +269,7 @@ in
           };
         in
         {
-          su = mkSetuidRoot "${cfg.package.su}/bin/su";
+          su = mkSetuidRoot "${config.security.shadow.su.package}/bin/su";
           sg = mkSetuidRoot "${cfg.package.out}/bin/sg";
           newgrp = mkSetuidRoot "${cfg.package.out}/bin/newgrp";
           newuidmap = mkSetuidRoot "${cfg.package.out}/bin/newuidmap";
diff --git a/nixos/modules/security/sudo-rs.nix b/nixos/modules/security/sudo-rs.nix
index 50e50e77b851..7965bbe3c7f3 100644
--- a/nixos/modules/security/sudo-rs.nix
+++ b/nixos/modules/security/sudo-rs.nix
@@ -215,6 +215,8 @@ in
     ];
     security.sudo.enable = lib.mkDefault false;
 
+    security.shadow.su.package = lib.mkDefault cfg.package;
+
     security.sudo-rs.extraRules =
       let
         defaultRule =

From 8546851bc2f8f386c5906f90e800d3713f87fa7a Mon Sep 17 00:00:00 2001
From: blenderfreaky <blenderfreaky@mailbox.org>
Date: Mon, 26 Jan 2026 11:35:32 +0100
Subject: [PATCH 22/95] oxdraw: init at 0.2.0

---
 pkgs/by-name/ox/oxdraw/font-lookup.patch | 25 ++++++++
 pkgs/by-name/ox/oxdraw/package.nix       | 79 ++++++++++++++++++++++++
 2 files changed, 104 insertions(+)
 create mode 100644 pkgs/by-name/ox/oxdraw/font-lookup.patch
 create mode 100644 pkgs/by-name/ox/oxdraw/package.nix

diff --git a/pkgs/by-name/ox/oxdraw/font-lookup.patch b/pkgs/by-name/ox/oxdraw/font-lookup.patch
new file mode 100644
index 000000000000..1111d0c816da
--- /dev/null
+++ b/pkgs/by-name/ox/oxdraw/font-lookup.patch
@@ -0,0 +1,25 @@
+diff --git a/app/layout.tsx b/app/layout.tsx
+index f589fac..56ccb67 100644
+--- a/app/layout.tsx
++++ b/app/layout.tsx
+@@ -1,15 +1,15 @@
+ import type { Metadata } from "next";
+-import { Geist, Geist_Mono } from "next/font/google";
++import localFont from "next/font/local";
+ import "./globals.css";
+ 
+-const geistSans = Geist({
++const geistSans = localFont({
++  src: '../Geist-Regular.otf',
+   variable: "--font-geist-sans",
+-  subsets: ["latin"],
+ });
+ 
+-const geistMono = Geist_Mono({
++const geistMono = localFont({
++  src: '../GeistMono-Regular.otf',
+   variable: "--font-geist-mono",
+-  subsets: ["latin"],
+ });
+ 
+ export const metadata: Metadata = {
diff --git a/pkgs/by-name/ox/oxdraw/package.nix b/pkgs/by-name/ox/oxdraw/package.nix
new file mode 100644
index 000000000000..d8fe85772f44
--- /dev/null
+++ b/pkgs/by-name/ox/oxdraw/package.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  buildNpmPackage,
+  geist-font,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    # We manually build the frontend because otherwise it'll try to download stuff from within the sandbox and fail
+    frontend = buildNpmPackage {
+      pname = "oxdraw-frontend";
+      inherit (finalAttrs) version src;
+
+      sourceRoot = "source/frontend";
+
+      patches = [
+        # By default, NextJS tries to fetch fonts from google
+        # Because of sandboxing, that fails, so we use the
+        # font from nixpkgs
+        ./font-lookup.patch
+      ];
+
+      buildPhase = ''
+        runHook preBuild
+        cp ${geist-font}/share/fonts/opentype/Geist{,Mono}-Regular.otf .
+        npm run build
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+        cp -r out $out
+        runHook postInstall
+      '';
+
+      npmDepsHash = "sha256-Yyox/x78spQqCJDJkPVuzfeAbtd/fdyihDHudIqruo4=";
+    };
+  in
+  {
+    pname = "oxdraw";
+    version = "0.2.0";
+
+    src = fetchFromGitHub {
+      owner = "RohanAdwankar";
+      repo = "oxdraw";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-2B0G5aWRtUvZiCsX1fOw6M2UhShZaDj11r/fXCemGVc=";
+    };
+
+    cargoHash = "sha256-YedNESkXKbfl7FWea7VpDR+59b9WLtZ7GNcyJ7D9yPg=";
+
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ openssl ];
+
+    preBuild = ''
+      # The build.rs builds the frontend, which we manually build via Nix already
+      rm build.rs
+    '';
+
+    env.OXDRAW_BUNDLED_WEB_DIST = frontend;
+
+    passthru.updateScript = nix-update-script { };
+
+    meta = {
+      description = "Diagram as Code Tool Written in Rust with Draggable Editing";
+      homepage = "https://github.com/RohanAdwankar/oxdraw";
+      changelog = "https://github.com/RohanAdwankar/oxdraw/releases/tag/v${finalAttrs.version}";
+      license = lib.licenses.mit;
+      maintainers = [ lib.maintainers.kilyanni ];
+      mainProgram = "oxdraw";
+      platforms = lib.platforms.linux;
+    };
+  }
+)

From 4f52b3562c31dd909804e744f5f5cb36b18f0d78 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 2 Mar 2026 09:13:36 +0000
Subject: [PATCH 23/95] python3Packages.disposable-email-domains: 0.0.162 ->
 0.0.165

---
 .../python-modules/disposable-email-domains/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/disposable-email-domains/default.nix b/pkgs/development/python-modules/disposable-email-domains/default.nix
index 591994c20de4..3710c72e89fa 100644
--- a/pkgs/development/python-modules/disposable-email-domains/default.nix
+++ b/pkgs/development/python-modules/disposable-email-domains/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "disposable-email-domains";
-  version = "0.0.162";
+  version = "0.0.165";
   pyproject = true;
 
   # No tags on GitHub
   src = fetchPypi {
     pname = "disposable_email_domains";
     inherit (finalAttrs) version;
-    hash = "sha256-qgiH+yx9URguWMgeaTUI12RkRpmv2e4ZSl0UUoPyyrg=";
+    hash = "sha256-mYxdUIbCJIPnrEAJ5xMf8sVvgk0DElrPHcp+emAMNgY=";
   };
 
   build-system = [

From 982fdfe48eb5053dbe2a503c66f5f4aab47e263b Mon Sep 17 00:00:00 2001
From: Roland Coeurjoly <rolandcoeurjoly@gmail.com>
Date: Mon, 2 Mar 2026 21:37:44 +0100
Subject: [PATCH 24/95] nextpnr-xilinx: init at 0.8.2-unstable-2026-02-25

---
 pkgs/by-name/ne/nextpnr-xilinx/package.nix | 107 +++++++++++++++++++++
 1 file changed, 107 insertions(+)
 create mode 100644 pkgs/by-name/ne/nextpnr-xilinx/package.nix

diff --git a/pkgs/by-name/ne/nextpnr-xilinx/package.nix b/pkgs/by-name/ne/nextpnr-xilinx/package.nix
new file mode 100644
index 000000000000..09d2fc588f53
--- /dev/null
+++ b/pkgs/by-name/ne/nextpnr-xilinx/package.nix
@@ -0,0 +1,107 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gitMinimal,
+  nix-update-script,
+  python312,
+  python312Packages,
+  eigen,
+  llvmPackages,
+}:
+
+let
+  prjxrayDb = fetchFromGitHub {
+    owner = "openxc7";
+    repo = "prjxray-db";
+    rev = "381966a746cb4cf4a7f854f0e53caa3bf74fbe62";
+    hash = "sha256-tQ1KfYj6kQq3fKBv6PAsqxm9btMNWFd5fT9UzOGMlkE=";
+  };
+
+  nextpnrXilinxMeta = fetchFromGitHub {
+    owner = "openxc7";
+    repo = "nextpnr-xilinx-meta";
+    rev = "491aefcc15be159efc8ad8bff2a1a4b93fe487fe";
+    hash = "sha256-oRVFPzdw9ctzT6iQ8YI3Q92LZTIlRPBZvJVjMqvDJQE=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nextpnr-xilinx";
+  version = "0.8.2-unstable-2026-02-25";
+
+  src = fetchFromGitHub {
+    owner = "openXC7";
+    repo = "nextpnr-xilinx";
+    rev = "72d8217b80cafed22cbac1253a2f23ca1ee10806";
+    hash = "sha256-YIwJfh6epUDGfWwHS0zjfcrx5A68NUY6gxyuEBb0g3A=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    gitMinimal
+    python312
+  ];
+
+  buildInputs = [
+    # Newer python fails with 'No version of Boost::Python 3.x could be found'
+    python312Packages.boost
+    python312
+    eigen
+  ]
+  ++ (lib.optional stdenv.cc.isClang llvmPackages.openmp);
+
+  cmakeFlags = [
+    "-DCURRENT_GIT_VERSION=${lib.substring 0 7 finalAttrs.src.rev}"
+    "-DARCH=xilinx"
+    "-DBUILD_GUI=OFF"
+    "-DBUILD_TESTS=OFF"
+    "-DUSE_OPENMP=ON"
+  ];
+
+  postPatch = ''
+    # Boost.System is header-only in modern Boost; requiring the component fails
+    # with CMake's FindBoost in nixpkgs.
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "set(boost_libs filesystem thread program_options iostreams system)" \
+                     "set(boost_libs filesystem thread program_options iostreams)"
+
+    # GCC 15 requires explicit <cstdint> include for uint8_t in vendored json11.
+    substituteInPlace 3rdparty/json11/json11.cpp \
+      --replace-fail "#include <climits>" $'#include <climits>\n#include <cstdint>'
+
+    rm -rf xilinx/external/prjxray-db xilinx/external/nextpnr-xilinx-meta
+    ln -s ${prjxrayDb} xilinx/external/prjxray-db
+    ln -s ${nextpnrXilinxMeta} xilinx/external/nextpnr-xilinx-meta
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp nextpnr-xilinx bbasm $out/bin/
+
+    mkdir -p $out/share/nextpnr/external
+    ln -s ${prjxrayDb} $out/share/nextpnr/external/prjxray-db
+    cp -r ../xilinx/external/nextpnr-xilinx-meta $out/share/nextpnr/external/
+    cp -r ../xilinx/python $out/share/nextpnr/
+    cp ../xilinx/constids.inc $out/share/nextpnr/
+
+    runHook postInstall
+  '';
+
+  strictDeps = true;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Place and route tool for Xilinx 7-series FPGAs";
+    homepage = "https://github.com/openXC7/nextpnr-xilinx";
+    license = lib.licenses.isc;
+    mainProgram = "nextpnr-xilinx";
+    maintainers = with lib.maintainers; [ rcoeurjoly ];
+    platforms = lib.platforms.unix;
+  };
+})

From 00f0474eee21ca58c7850afc2d16f41e660cec1b Mon Sep 17 00:00:00 2001
From: Theo Paris <theo@theoparis.com>
Date: Tue, 3 Mar 2026 00:07:02 -0800
Subject: [PATCH 25/95] aws-lc: 1.67.0 -> 1.69.0

Signed-off-by: Theo Paris <theo@theoparis.com>
Change-Id: Ie7ea34cb477ab2e26aec7b93b121f9426a6a6964
---
 pkgs/by-name/aw/aws-lc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/aw/aws-lc/package.nix b/pkgs/by-name/aw/aws-lc/package.nix
index 29d3068f3676..82c9506c9ca5 100644
--- a/pkgs/by-name/aw/aws-lc/package.nix
+++ b/pkgs/by-name/aw/aws-lc/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
-  version = "1.67.0";
+  version = "1.69.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-p58Re3HvBY/nzyCFvM5Ntx7Mb5OgcNQoZNloAJitDTY=";
+    hash = "sha256-ykpPbMONAJK6rEANOn0O7JfIkXPSoPXs1Zr4Bv+eXqQ=";
   };
 
   outputs = [

From 88bb95f3628e3fecf6d10cb4fac4c04facab187b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 3 Mar 2026 13:55:00 +0000
Subject: [PATCH 26/95] yash: 2.60 -> 2.61

---
 pkgs/by-name/ya/yash/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ya/yash/package.nix b/pkgs/by-name/ya/yash/package.nix
index 41736ab834a1..faf8dca5497d 100644
--- a/pkgs/by-name/ya/yash/package.nix
+++ b/pkgs/by-name/ya/yash/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yash";
-  version = "2.60";
+  version = "2.61";
 
   src = fetchFromGitHub {
     owner = "magicant";
     repo = "yash";
     rev = finalAttrs.version;
-    hash = "sha256-iHM1f+zdYsfuqmyel+vlFi+TQukmN91SyZCHJLXPnTs=";
+    hash = "sha256-ih5BXzhG/DNeWghptXXTXVbZLT63AE8blWTzzfssqXU=";
   };
 
   strictDeps = true;

From bdd52ca582637a7bd85f8c589d27c7f8b9a76697 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 3 Mar 2026 21:51:43 +0000
Subject: [PATCH 27/95] charls: 2.4.2 -> 2.4.3

---
 pkgs/by-name/ch/charls/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ch/charls/package.nix b/pkgs/by-name/ch/charls/package.nix
index d62da5e9670f..d00e450b37f5 100644
--- a/pkgs/by-name/ch/charls/package.nix
+++ b/pkgs/by-name/ch/charls/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "charls";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "team-charls";
     repo = "charls";
     tag = finalAttrs.version;
-    hash = "sha256-c1wrk6JLcAH7TFPwjARlggaKXrAsLWyUQF/3WHlqoqg=";
+    hash = "sha256-U21SdVRTPNI5BFGOyM3Y/ByKDP6ZI2g/BtAJYXH5Dv4=";
   };
 
   postPatch = ''

From 4fd1cb40f692d6db8fd033c6b916fe7426de4be0 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Wed, 4 Mar 2026 23:20:26 +0200
Subject: [PATCH 28/95] nixos/tests: verify su wrapper source in shadow and
 sudo-rs tests

Add subtests to confirm that the su setuid wrapper points to the
correct package: shadow by default, and sudo-rs when enabled.
---
 nixos/tests/shadow.nix  | 5 +++++
 nixos/tests/sudo-rs.nix | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/nixos/tests/shadow.nix b/nixos/tests/shadow.nix
index 04ee0a2bf95d..17ab1a3710ae 100644
--- a/nixos/tests/shadow.nix
+++ b/nixos/tests/shadow.nix
@@ -171,5 +171,10 @@ in
         shadow.wait_for_file("/tmp/leo")
         assert "leo" in shadow.succeed("cat /tmp/leo")
         shadow.send_chars("logout\n")
+
+    with subtest("su wrapper should point to shadow by default"):
+        output = shadow.succeed("grep -aoP '/nix/store/[a-z0-9]{32}-[^\\x00]+' /run/wrappers/bin/su | head -1").strip()
+        assert "shadow" in output, \
+            f"su should come from shadow, but points to: {output}"
   '';
 }
diff --git a/nixos/tests/sudo-rs.nix b/nixos/tests/sudo-rs.nix
index 7e691ef7e51b..62891ed01d53 100644
--- a/nixos/tests/sudo-rs.nix
+++ b/nixos/tests/sudo-rs.nix
@@ -162,5 +162,10 @@ in
 
       with subtest("non-wheel users should be unable to run sudo thanks to execWheelOnly"):
           strict.fail('faketty -- su - noadmin -c "sudo --help"')
+
+      with subtest("su should come from sudo-rs"):
+          output = machine.succeed("grep -aoP '/nix/store/[a-z0-9]{32}-[^\\x00]+' /run/wrappers/bin/su | head -1").strip()
+          assert "sudo-rs" in output, \
+              f"su should come from sudo-rs, but points to: {output}"
     '';
 }

From 817e86963f1506021126ace8d9b2293e4904df4f Mon Sep 17 00:00:00 2001
From: Tyce Herrman <Tyce.Herrman@pm.me>
Date: Wed, 4 Mar 2026 22:06:23 -0500
Subject: [PATCH 29/95] mise: 2026.2.20 -> 2026.3.3

---
 pkgs/by-name/mi/mise/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 600463ef09d8..cdfe74b26461 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mise";
-  version = "2026.2.20";
+  version = "2026.3.3";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vZzfXsnOw0HIuPfQIfVxCKcl5EQd+zARO/IqzGtNMDk=";
+    hash = "sha256-ZDlzFSjOqizj6eBBk1UOL6BgAqsbnchVHc0BwsO67L8=";
   };
 
-  cargoHash = "sha256-dWCDYcIkkopg7SMqAHjKoj0Wp4P47T7IdnXu9BriY00=";
+  cargoHash = "sha256-Vl66x8fJkt04JmQm9Z3wvv6Bvb1r/IrI3g49HC3mmFw=";
 
   nativeBuildInputs = [
     installShellFiles

From db79762312386b3431dcf468e4b4b64c00d3d7a1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 5 Mar 2026 13:44:15 +0000
Subject: [PATCH 30/95] metabase: 0.58.5 -> 0.59.1

---
 pkgs/by-name/me/metabase/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/me/metabase/package.nix b/pkgs/by-name/me/metabase/package.nix
index d56fe12b05bb..c90fe4294efc 100644
--- a/pkgs/by-name/me/metabase/package.nix
+++ b/pkgs/by-name/me/metabase/package.nix
@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "metabase";
-  version = "0.58.5";
+  version = "0.59.1";
 
   src = fetchurl {
     url = "https://downloads.metabase.com/v${finalAttrs.version}/metabase.jar";
-    hash = "sha256-JjpDsI7G0b5YVjICXe9ZeprnipeyVg79qW42LTcE4U4=";
+    hash = "sha256-pPJdFljzzNuhRvH6ofPkNGq0Ly/RpHcqeQQh3JTG08I=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 6a81dfe456b6f86d374518cf1a77874177f01960 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=A9clairevoyant?=
 <848000+eclairevoyant@users.noreply.github.com>
Date: Thu, 5 Mar 2026 11:54:31 -0500
Subject: [PATCH 31/95] alt-tab-macos: 8.3.4 -> 10.4.0

---
 pkgs/by-name/al/alt-tab-macos/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alt-tab-macos/package.nix b/pkgs/by-name/al/alt-tab-macos/package.nix
index e788ac297efb..b70c74a9f021 100644
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alt-tab-macos";
-  version = "8.3.4";
+  version = "10.4.0";
 
   src = fetchurl {
     url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-I5Dx/71+rY6qThE8ton4EtDtcfMQzx4Yle+1tpOAkDI=";
+    hash = "sha256-CbeQi50EbGP+GoXLN/M8iLJ65RI6awXjDoPzEB8Pb38=";
   };
 
   sourceRoot = ".";

From cf06a924ac2056176e01095d875cf4d1abbfffec Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 5 Mar 2026 21:53:33 +0000
Subject: [PATCH 32/95] faiss: 1.13.2 -> 1.14.1

Diff: https://github.com/facebookresearch/faiss/compare/v1.13.2...v1.14.1

Changelog: https://github.com/facebookresearch/faiss/blob/v1.14.1/CHANGELOG.md
---
 pkgs/by-name/fa/faiss/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fa/faiss/package.nix b/pkgs/by-name/fa/faiss/package.nix
index c38b23b0704d..184c1cc53b22 100644
--- a/pkgs/by-name/fa/faiss/package.nix
+++ b/pkgs/by-name/fa/faiss/package.nix
@@ -42,7 +42,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "faiss";
-  version = "1.13.2";
+  version = "1.14.1";
 
   outputs = [ "out" ] ++ lib.optionals pythonSupport [ "dist" ];
 
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebookresearch";
     repo = "faiss";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EiqkOkMI65T2kNNMQvjl51GIN4XGzTKpkpQ3ImFa3rs=";
+    hash = "sha256-+7BgxSvVEqdwT3fGqK62nysFLZMpLXeQwVXcvP9pgqQ=";
   };
 
   nativeBuildInputs = [
@@ -107,7 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Library for efficient similarity search and clustering of dense vectors by Facebook Research";
     mainProgram = "demo_ivfpq_indexing";
     homepage = "https://github.com/facebookresearch/faiss";
-    changelog = "https://github.com/facebookresearch/faiss/blob/v${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/facebookresearch/faiss/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ SomeoneSerge ];

From 5471d921f98b34afeebfa09f9599c86300272077 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 6 Mar 2026 04:00:43 +0000
Subject: [PATCH 33/95] python3Packages.dbt-common: 1.37.2-unstable-2026-02-16
 -> 1.37.3-unstable-2026-03-02

---
 pkgs/development/python-modules/dbt-common/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/dbt-common/default.nix b/pkgs/development/python-modules/dbt-common/default.nix
index ef8b3b25c92c..81f52aefd1e0 100644
--- a/pkgs/development/python-modules/dbt-common/default.nix
+++ b/pkgs/development/python-modules/dbt-common/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-common";
-  version = "1.37.2-unstable-2026-02-16";
+  version = "1.37.3-unstable-2026-03-02";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = "dbt-common";
-    rev = "db568b8aa2d7c081f36a144c379668dd65007803"; # They don't tag releases
-    hash = "sha256-FIc98xjdmEQ8QJQwvEktj7oT/hJwwqCg4agpR4gaZIc=";
+    rev = "5b0fcac03a1a01e4001ef1ff75a4132cdb412886"; # They don't tag releases
+    hash = "sha256-b4nMtIkQ8RzBjVexwoiv+V26P/7emdSEEj58BdaggnM=";
   };
 
   build-system = [ hatchling ];

From 95e78f07cdb791afe3b9b4ef1d4451e779497d5b Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 6 Mar 2026 10:34:16 +0100
Subject: [PATCH 34/95] performous: fix build

---
 pkgs/by-name/pe/performous/package.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pe/performous/package.nix b/pkgs/by-name/pe/performous/package.nix
index 9256a64c627a..71fc1b56f3bd 100644
--- a/pkgs/by-name/pe/performous/package.nix
+++ b/pkgs/by-name/pe/performous/package.nix
@@ -7,7 +7,7 @@
   aubio,
   boost,
   cmake,
-  ffmpeg_7,
+  ffmpeg,
   fmt,
   gettext,
   glew,
@@ -62,6 +62,12 @@ stdenv.mkDerivation rec {
       extraPrefix = "ced-src/";
       hash = "sha256-23VD/4X4BOtcX5k+koSlRMowlbo2jAXbp3XKTXP7VrM=";
     })
+    (fetchpatch {
+      name = "performous-ffmpeg_8.patch";
+      url = "https://github.com/performous/performous/commit/783befe576051458da7ea0d915d2b4cb986eaf86.patch";
+      excludes = [ "osx-utils/macos-bundler.py" ];
+      hash = "sha256-Srkjr8BI98N8Ws853goonvjOrEyWvzjHAIhypgEydns=";
+    })
   ];
 
   prePatch = ''
@@ -72,6 +78,8 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace data/CMakeLists.txt \
       --replace "/usr" "$out"
+    substituteInPlace {game,testing}/CMakeLists.txt \
+      --replace-fail "system locale" "locale"
   '';
 
   nativeBuildInputs = [
@@ -84,7 +92,7 @@ stdenv.mkDerivation rec {
     SDL2
     aubio
     boost
-    ffmpeg_7
+    ffmpeg
     fmt
     glew
     glibmm

From 60f96eb34459a8f736ca242ddd5fced7509a4e7e Mon Sep 17 00:00:00 2001
From: ehrenschwan <luca@ehrenschwan.dev>
Date: Thu, 25 Dec 2025 12:55:45 +0100
Subject: [PATCH 35/95] maintainer: add ehrenschwan-gh

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3fb6c89bf258..8d9eb2e17b2b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7583,6 +7583,12 @@
     githubId = 20847625;
     name = "Elizabeth Paź";
   };
+  ehrenschwan-gh = {
+    email = "luca@ehrenschwan.dev";
+    github = "ehrenschwan-gh";
+    githubId = 25820532;
+    name = "Luca Schwan";
+  };
   eigengrau = {
     email = "seb@schattenkopie.de";
     name = "Sebastian Reuße";

From 9f8280e9c2d7e63994dae864338f83360c9d52a2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 6 Mar 2026 12:27:35 +0000
Subject: [PATCH 36/95] zookeeper: 3.9.4 -> 3.9.5

---
 pkgs/by-name/zo/zookeeper/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/zo/zookeeper/package.nix b/pkgs/by-name/zo/zookeeper/package.nix
index 8b5b21cf7a3d..ad6c01e43717 100644
--- a/pkgs/by-name/zo/zookeeper/package.nix
+++ b/pkgs/by-name/zo/zookeeper/package.nix
@@ -10,16 +10,16 @@
 }:
 let
   # Latest supported LTS JDK for Zookeeper 3.9:
-  # https://zookeeper.apache.org/doc/r3.9.4/zookeeperAdmin.html#sc_requiredSoftware
+  # https://zookeeper.apache.org/doc/r3.9.5/zookeeperAdmin.html#sc_requiredSoftware
   jre = jdk11_headless;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zookeeper";
-  version = "3.9.4";
+  version = "3.9.5";
 
   src = fetchurl {
     url = "mirror://apache/zookeeper/zookeeper-${finalAttrs.version}/apache-zookeeper-${finalAttrs.version}-bin.tar.gz";
-    hash = "sha512-Nr/65kQO0Nce2DpiG4xSxYOGC0FIEhlzcyN/DBSL0W5rWZl3yQ5euBwPzmuC70SqeCYhU1QXz/xMKgpRpW8s3w==";
+    hash = "sha512-uqHCHdpNVyOPynUeT6K78dr/mihhKxJeSX3M1cGI7mRJ4veZR+R0wt1NGZknidTTayexui/rgMKwxF598OIqqA==";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 78d85b72c5d393ea78bc480a4a5ac1261fa6810b Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Fri, 6 Mar 2026 10:42:27 +0100
Subject: [PATCH 37/95] vitejs: init at 7.3.1

---
 pkgs/by-name/vi/vitejs/package.nix | 70 ++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 pkgs/by-name/vi/vitejs/package.nix

diff --git a/pkgs/by-name/vi/vitejs/package.nix b/pkgs/by-name/vi/vitejs/package.nix
new file mode 100644
index 000000000000..c1829197c7ad
--- /dev/null
+++ b/pkgs/by-name/vi/vitejs/package.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pnpm_10,
+  nodejs_24,
+  makeWrapper,
+  pnpmConfigHook,
+  fetchPnpmDeps,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vitejs";
+  version = "7.3.1";
+
+  src = fetchFromGitHub {
+    owner = "vitejs";
+    repo = "vite";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ewtFvWeNFb6LowvA83p53+ilsMDugLzXK1I63lhZUAU=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    nodejs_24
+    pnpmConfigHook
+    pnpm_10
+  ];
+
+  pnpmWorkspaces = [ "vite" ];
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      pnpmWorkspaces
+      ;
+    fetcherVersion = 3;
+    hash = "sha256-02s37dcEvxFlaGO+RNxTMPuTV0/sx7hiX1Nzc3A/qro=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm --filter=vite build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,lib/vite}
+    cp -r {packages,node_modules} $out/lib/vite
+
+    makeWrapper ${lib.getExe nodejs_24} $out/bin/vite \
+      --inherit-argv0 \
+      --add-flags $out/lib/vite/packages/vite/bin/vite.js
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Frontend tooling for NodeJS";
+    homepage = "https://github.com/vitejs/vite";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    mainProgram = "vite";
+  };
+})

From 89924a7205ba1531790a1968ad9387eab451b7e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@cachix.org>
Date: Fri, 6 Mar 2026 10:26:45 -0800
Subject: [PATCH 38/95] devenv: 2.0.2 -> 2.0.3

---
 pkgs/by-name/de/devenv/package.nix | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 208cdc7e6988..d00a52ada07f 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -23,16 +23,16 @@
 }:
 
 let
-  version = "2.0.2";
+  version = "2.0.3";
   devenvNixVersion = "2.32";
-  devenvNixRev = "7eb6c427c7a86fdc3ebf9e6cbf2a84e80e8974fd";
+  devenvNixRev = "41eee9d3b1f611b1b90d51caa858b6d83834c44a";
 
   nix_components =
     (nixVersions.nixComponents_git.overrideSource (fetchFromGitHub {
       owner = "cachix";
       repo = "nix";
       rev = devenvNixRev;
-      hash = "sha256-H26FQmOyvIGnedfAioparJQD8Oe+/byD6OpUpnI/hkE=";
+      hash = "sha256-vtf03lfgQKNkPH9FdXdboBDS5DtFkXB8xRw5EBpuDas=";
     })).overrideScope
       (
         finalScope: prevScope: {
@@ -48,16 +48,15 @@ rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     tag = "v${version}";
-    hash = "sha256-38crLoAfEOdnEDDZD2NyAEDVlBSFn+MlZyLwztAsC8Q=";
+    hash = "sha256-1DpF5F7zgOZ7QrRjz23315pUoF532dHnsU/V4UQithk=";
   };
 
-  cargoHash = "sha256-e56HmkS+p8P/X7vS+hTT78lfQ2YDCuONM+6yW0RIfSE=";
+  cargoHash = "sha256-gZFRbTDPQNKf2msBv9wOavaH1iB1Tk3shYf0/4TSZBQ=";
 
   env = {
     RUSTFLAGS = "--cfg tracing_unstable";
     LIBSQLITE3_SYS_USE_PKG_CONFIG = "1";
-    VERGEN_IDEMPOTENT = "1";
-    DEVENV_ON_RELEASE_TAG = true;
+    DEVENV_IS_RELEASE = true;
   };
 
   cargoBuildFlags = [

From 0b83b49cd1b8072ed5955cbaed1c8df587362776 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 6 Mar 2026 19:46:46 +0000
Subject: [PATCH 39/95] rclone-ui: 3.4.3 -> 3.5.0

---
 pkgs/by-name/rc/rclone-ui/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/rc/rclone-ui/package.nix b/pkgs/by-name/rc/rclone-ui/package.nix
index b89245f10ba0..c39ce507afce 100644
--- a/pkgs/by-name/rc/rclone-ui/package.nix
+++ b/pkgs/by-name/rc/rclone-ui/package.nix
@@ -20,26 +20,26 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rclone-ui";
-  version = "3.4.3";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "rclone-ui";
     repo = "rclone-ui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YKlznqgKePx6x6P+1nE6sZwYSRZwvpAvMSDjd+MKCvg=";
+    hash = "sha256-U2bhhNqw2dWqyd5You1L8vTe30Q81DQd7YwHf6KcdBQ=";
   };
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src;
     forceGitDeps = true;
-    hash = "sha256-SW2bWKM/H3fuRD0Q0Sctbpk13bfpMawU+HohJxfWg+E=";
+    hash = "sha256-omZprG5ozCrwkxB7G9n82wvpF7wXz+IWPEI8FEnOJvk=";
   };
 
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-toq1lscvDvVyQP0oPtf4IeNpxBTxrqJa8JH3cC3iQzk=";
+  cargoHash = "sha256-5JlqhhrHyHGTQ+9gYLgSQm+jF8th5UYdnLvXMRPKCTY=";
 
   # Disable tauri bundle updater, can be removed when #389107 is merged
   patches = [ ./remove_updater.patch ];

From c41cdb3f8e0db03068aed4b2f4fc1898baf2aebe Mon Sep 17 00:00:00 2001
From: isabel <isabel@isabelroses.com>
Date: Fri, 6 Mar 2026 21:11:25 +0000
Subject: [PATCH 40/95] moonlight: 2026.2.2 -> 2026.3.0

Diff: https://github.com/moonlight-mod/moonlight/compare/v2026.2.2...v2026.3.0

Changelog: https://raw.githubusercontent.com/moonlight-mod/moonlight/refs/tags/v2026.3.0/CHANGELOG.md
---
 pkgs/by-name/mo/moonlight/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index c6c59fc92ed7..11cf3e28b49f 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "2026.2.2";
+  version = "2026.3.0";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wZEpoUlDEbObXD5d2uA5vNBRrFOw4A6VLAc/MVNC4EE=";
+    hash = "sha256-Tuv0IFhvZzvmf29EWNtrb5Y6YOCn+lIBzXpt7lfLVS8=";
   };
 
   nativeBuildInputs = [

From 9cccb7cdf2ad56519863ca79e6eba3d19d251dd7 Mon Sep 17 00:00:00 2001
From: structix <janek@schoff.it>
Date: Mon, 23 Feb 2026 15:51:47 +0100
Subject: [PATCH 41/95] fokus: init at 2.3.3

---
 pkgs/by-name/fo/fokus/package.nix | 48 +++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 pkgs/by-name/fo/fokus/package.nix

diff --git a/pkgs/by-name/fo/fokus/package.nix b/pkgs/by-name/fo/fokus/package.nix
new file mode 100644
index 000000000000..0ac85516f8a5
--- /dev/null
+++ b/pkgs/by-name/fo/fokus/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  kdePackages,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "fokus";
+  version = "2.3.3";
+
+  src = fetchFromGitLab {
+    owner = "divinae";
+    repo = "focus-plasmoid";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-S/0hAAt9zzj8pP5juFDvT0Z2B+GKpFnBsIVdJjSEakI=";
+  };
+
+  dontWrapQtApps = true;
+
+  postPatch = ''
+    substituteInPlace package/contents/config/main.xml package/contents/ui/configNotifications.qml \
+         --replace-fail "/usr/share/sounds" "${kdePackages.ocean-sound-theme}/share/sounds"
+
+    substituteInPlace package/contents/ui/configNotifications.qml package/contents/ui/configScripts.qml package/contents/ui/main.qml package/contents/ui/NotificationManager.qml \
+         --replace-fail 'import QtMultimedia' 'import "file://${kdePackages.qtmultimedia}/lib/qt-6/qml/QtMultimedia"'
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/plasma/plasmoids/com.dv.fokus
+    cp -r package/* $out/share/plasma/plasmoids/com.dv.fokus/
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple pomodoro KDE Plasma plasmoid";
+    homepage = "https://gitlab.com/divinae/focus-plasmoid";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ structix ];
+    platforms = lib.platforms.linux;
+  };
+})

From 332990ef9f056faa026be3cf9c4f57e75e4ab8db Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 01:19:45 +0000
Subject: [PATCH 42/95] apko: 1.1.11 -> 1.1.12

---
 pkgs/by-name/ap/apko/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ap/apko/package.nix b/pkgs/by-name/ap/apko/package.nix
index 988c6ea5f160..8f825e95c3b8 100644
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.1.11";
+  version = "1.1.12";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vBX1uFYIDOLrws6LQ2lccPxCwNVes8mw2Mx4uXSZhm0=";
+    hash = "sha256-UqvmHIHHMNJ3VX6UT/CdK6vhrAW6TLwtfvmRPPGXjVI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-9UWCqFSKCrjPUaOypcmkk6TvMZE9xPLPj06fEzduqMY=";
+  vendorHash = "sha256-Pi0egpWT/12CZI84NtJKYpRT7OwzwF9MTq9Q+9DN2cw=";
 
   excludedPackages = [
     "internal/gen-jsonschema"

From 93fd1b5187217181c62cdc46f8ca1c0a1356838a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 02:31:00 +0000
Subject: [PATCH 43/95] intel-compute-runtime: 26.01.36711.4 -> 26.05.37020.3

---
 pkgs/by-name/in/intel-compute-runtime/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/intel-compute-runtime/package.nix b/pkgs/by-name/in/intel-compute-runtime/package.nix
index 9f8462c012f4..fde782d02e58 100644
--- a/pkgs/by-name/in/intel-compute-runtime/package.nix
+++ b/pkgs/by-name/in/intel-compute-runtime/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "intel-compute-runtime";
-  version = "26.01.36711.4";
+  version = "26.05.37020.3";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     tag = finalAttrs.version;
-    hash = "sha256-77fVA2T6niK2a9i6v6sAR98fHnExbHqRdHexKBkqd7M=";
+    hash = "sha256-V5PoGvUJtNL9Y7RkFWqhpYEbpiqv3Gj4GB1uBUKOvNg=";
   };
 
   nativeBuildInputs = [

From 4ed976945e40239a6f99e687a6bbe90167ea713d Mon Sep 17 00:00:00 2001
From: Tomodachi94 <tomodachi94@protonmail.com>
Date: Fri, 6 Mar 2026 18:44:48 -0800
Subject: [PATCH 44/95] maven: add meta.changelog

---
 pkgs/by-name/ma/maven/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/ma/maven/package.nix b/pkgs/by-name/ma/maven/package.nix
index fda649544867..a5a3030fe81e 100644
--- a/pkgs/by-name/ma/maven/package.nix
+++ b/pkgs/by-name/ma/maven/package.nix
@@ -78,6 +78,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       manage a project's build, reporting and documentation from a central piece
       of information.
     '';
+    changelog = "https://maven.apache.org/docs/${finalAttrs.version}/release-notes.html";
     sourceProvenance = with lib.sourceTypes; [
       binaryBytecode
       binaryNativeCode

From cdf448de601993a1dd47924c7b37f3c77d7b88a5 Mon Sep 17 00:00:00 2001
From: Brian McGillion <bmg.avoin@gmail.com>
Date: Sat, 7 Mar 2026 09:55:35 +0400
Subject: [PATCH 45/95] edk2: Fix cross-compile

  deep-merge env in mkDerivation to preserve GCC5 prefix

  The shallow `//` merge in edk2.mkDerivation allowed consumers' `env`
  attrs to completely overwrite the base `env` containing GCC5_*_PREFIX,
  causing cross-compilation failures (e.g. x86_64 -> aarch64 OVMF) with
  `gcc: error: unrecognized command-line option '-mlittle-endian'`.

  Exclude `env` from the consumer attrs spread and explicitly deep-merge
  it, ensuring GCC5_*_PREFIX is always set as a base while consumer `env`
  keys (NIX_CFLAGS_COMPILE, PYTHON_COMMAND, etc.) are merged on top.

  Fixes regression from c7b9734f4ae8 ("edk2: move env variable(s) into
  env for structuredAttrs").

Signed-off-by: Brian McGillion <bmg.avoin@gmail.com>
---
 pkgs/by-name/ed/edk2/package.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ed/edk2/package.nix b/pkgs/by-name/ed/edk2/package.nix
index f37043b1d54e..32d2848178e1 100644
--- a/pkgs/by-name/ed/edk2/package.nix
+++ b/pkgs/by-name/ed/edk2/package.nix
@@ -182,8 +182,6 @@ stdenv.mkDerivation (finalAttrs: {
           ++ attrs.nativeBuildInputs or [ ];
           strictDeps = true;
 
-          env.${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
-
           prePatch = ''
             rm -rf BaseTools
             ln -sv ${buildPackages.edk2}/BaseTools BaseTools
@@ -211,7 +209,14 @@ stdenv.mkDerivation (finalAttrs: {
         // removeAttrs attrs [
           "nativeBuildInputs"
           "depsBuildBuild"
+          "env"
         ]
+        // {
+          env = {
+            ${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
+          }
+          // (attrs.env or { });
+        }
       );
   };
 })

From 89efd7eba63e4fd2f82cf419e4818070aa6e3b0b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 07:34:44 +0000
Subject: [PATCH 46/95] python3Packages.python-watcherclient: 4.9.0 -> 4.10.0

---
 .../python-modules/python-watcherclient/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-watcherclient/default.nix b/pkgs/development/python-modules/python-watcherclient/default.nix
index 5733e4bb5fd9..e83e3940b97f 100644
--- a/pkgs/development/python-modules/python-watcherclient/default.nix
+++ b/pkgs/development/python-modules/python-watcherclient/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "python-watcherclient";
-  version = "4.9.0";
+  version = "4.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openstack";
     repo = "python-watcherclient";
     tag = version;
-    hash = "sha256-ik//J9R9F4SCljexijcfXuSbDgDUNnMTqfpxIPd2Jm8=";
+    hash = "sha256-TYMV55uvTCvHKj5w5QA2zRqVr6pXCXh2Oc07Yo7epjs=";
   };
 
   env.PBR_VERSION = version;

From 781f8ca45c06da874e81cdad44d887cedebe044c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 09:41:00 +0000
Subject: [PATCH 47/95] terraform-providers.yandex-cloud_yandex: 0.189.0 ->
 0.191.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1e95db1e8c72..775fe245a926 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1499,12 +1499,12 @@
     "vendorHash": "sha256-Z4DfoG4ApXbPNXZs9YvBWQj1bH7moLNI6P+nKDHt/Jc="
   },
   "yandex-cloud_yandex": {
-    "hash": "sha256-TitL9PaqN2j4mDz1yCz4Mqde1CxIG4Z2sJFm3emsVRM=",
+    "hash": "sha256-/rOaPVyWKEdcHMfjpetpVCxaibOWQT6O+32vQ6Zp324=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.189.0",
+    "rev": "v0.191.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ZYVGqcviq7auN2JwqHEFWiFPvy+PkaYV7MamNKF8Frc="
+    "vendorHash": "sha256-RXyiOBOedsA+DzbTXaeKMeZhM/ABMSDwzprDMpfSvmU="
   }
 }

From 510d15adf2ab9fec7afb27b465c1a5537b8ea82f Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Sat, 7 Mar 2026 14:18:19 +0400
Subject: [PATCH 48/95] python3Packages.nexusformat: fix build

---
 pkgs/development/python-modules/nexusformat/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/nexusformat/default.nix b/pkgs/development/python-modules/nexusformat/default.nix
index b9c9ffdc7117..8d218dd2d041 100644
--- a/pkgs/development/python-modules/nexusformat/default.nix
+++ b/pkgs/development/python-modules/nexusformat/default.nix
@@ -2,10 +2,12 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  colored,
   h5py,
   hdf5plugin,
   numpy,
   pytestCheckHook,
+  python-dateutil,
   scipy,
   setuptools-scm,
   setuptools,
@@ -27,9 +29,11 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
+    colored
     h5py
     hdf5plugin
     numpy
+    python-dateutil
     scipy
   ];
 

From 5abf66a6709ba29506afd8ef3ccea7927035ec72 Mon Sep 17 00:00:00 2001
From: ollybeck <14896256+ollybeck@users.noreply.github.com>
Date: Sat, 7 Mar 2026 11:49:42 +0100
Subject: [PATCH 49/95] opencode: 1.2.17 -> 1.2.20

Changelog: https://github.com/anomalyco/opencode/releases/tag/v1.2.20

Diff: https://github.com/anomalyco/opencode/compare/v1.2.17...v1.2.20
---
 pkgs/by-name/op/opencode/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 78feb72062a9..ef7df20122a6 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -14,12 +14,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.2.17";
+  version = "1.2.20";
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4I243hvqQjPU09GsIyQu/3Cv+THKFf5QTbC3x0aO83Q=";
+    hash = "sha256-FBmF7/uwZYY/qY1252Hz+XhXdE+Qp5axySAy5Jw7XUQ=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -68,7 +68,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-orNyesv8Y3vooV1upr+X1CKHUdygyDQ3hmyPVlHC6Zk=";
+    outputHash = "sha256-OwlJRAeKnX5YMwQgaV4op40rjt5kxsP4WrOzpp9t90w=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };

From 372c4b3db098d486c8a0ee7d51d35a333cd8f225 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 11:40:14 +0000
Subject: [PATCH 50/95] devcontainer: 0.83.0 -> 0.84.0

---
 pkgs/by-name/de/devcontainer/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/de/devcontainer/package.nix b/pkgs/by-name/de/devcontainer/package.nix
index ff4b6d705edd..325de7adbae2 100644
--- a/pkgs/by-name/de/devcontainer/package.nix
+++ b/pkgs/by-name/de/devcontainer/package.nix
@@ -16,18 +16,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "devcontainer";
-  version = "0.83.0";
+  version = "0.84.0";
 
   src = fetchFromGitHub {
     owner = "devcontainers";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rFp7u+swJdA3wKR6bAfPUIXomwyN5v1oKfu/Y/hflx0=";
+    hash = "sha256-gXhGMMSTBEK5uwtTjc/NxUiaW8unjAihbLsH6qM8ukk=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-aVjhIb46CjUS+IEfS5O7I2apAC51UfjPj16q/GNsIzI=";
+    hash = "sha256-yTetnr4Z1qqSPwfQHuR7uqQpDFPFHlGu6+//yoIx1jA=";
   };
 
   nativeBuildInputs = [

From 268c24dc58322f9132cf31f7ce911d5878381153 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 12:00:46 +0000
Subject: [PATCH 51/95] home-assistant-custom-components.octopus_energy: 18.0.0
 -> 18.1.0

---
 .../custom-components/octopus_energy/package.nix              | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
index 7fa157eafeae..c4e99fa654db 100644
--- a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "BottlecapDave";
   domain = "octopus_energy";
-  version = "18.0.0";
+  version = "18.1.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "HomeAssistant-OctopusEnergy";
     tag = "v${version}";
-    hash = "sha256-nCE3cdvaDTIeallI+0gr8IRHyXORzJyWgC4gxXIfLh8=";
+    hash = "sha256-V8y/td0873X+rXxu9kQGQq0D3Vs+TuPk4KTqd3oagtE=";
   };
 
   dependencies = [ pydantic ];

From acf115cd402a44cf98902ecdc871e41d96b7fc15 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 12:27:52 +0000
Subject: [PATCH 52/95] libgff: 2.0.0 -> 2.0.1

---
 pkgs/by-name/li/libgff/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libgff/package.nix b/pkgs/by-name/li/libgff/package.nix
index 0f0e7d808927..866a905f9f4f 100644
--- a/pkgs/by-name/li/libgff/package.nix
+++ b/pkgs/by-name/li/libgff/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgff";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "COMBINE-lab";
     repo = "libgff";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZCb3UyuB/+ykrYFQ9E5VytT65gAAULiOzIEu5IXISTc=";
+    hash = "sha256-OgXnNGIgWZDIChRdEfmHwvl+oQM03V3a/HnndGLjcHk=";
   };
 
   nativeBuildInputs = [ cmake ];

From 3dac64dde7ea33e7313fa7d4df7d15d3119c565d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 12:39:16 +0000
Subject: [PATCH 53/95] openpgp-card-tools: 0.11.10 -> 0.11.11

---
 pkgs/by-name/op/openpgp-card-tools/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/openpgp-card-tools/package.nix b/pkgs/by-name/op/openpgp-card-tools/package.nix
index 411789da106f..74d9d1c303f5 100644
--- a/pkgs/by-name/op/openpgp-card-tools/package.nix
+++ b/pkgs/by-name/op/openpgp-card-tools/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "openpgp-card-tools";
-  version = "0.11.10";
+  version = "0.11.11";
 
   src = fetchFromCodeberg {
     owner = "openpgp-card";
     repo = "openpgp-card-tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1sm/zaKhUPMGdYg8sX/IXAI4vIRRZezSD89rljG4S/Y=";
+    hash = "sha256-4kmBWbfB9A36359zhR5fz0XFcN839gTtJFRFhJL1lL0=";
   };
 
-  cargoHash = "sha256-S+TOSUh/sr647aUBjo+aaZgVrrOubwa+XVFcwNBOxmI=";
+  cargoHash = "sha256-kXBPDwHkoB/W2sSIjChf4VnoNykvIKSSIv8YsW3iu1Y=";
 
   nativeBuildInputs = [
     installShellFiles

From ccad08dc9268b6d52f09651eb393788a250bb5b0 Mon Sep 17 00:00:00 2001
From: FelixLusseau <felix.lusseau@gmail.com>
Date: Fri, 20 Feb 2026 13:53:08 +0100
Subject: [PATCH 54/95] deezer-desktop: init at 7.1.100

---
 pkgs/by-name/de/deezer-desktop/package.nix | 74 ++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 pkgs/by-name/de/deezer-desktop/package.nix

diff --git a/pkgs/by-name/de/deezer-desktop/package.nix b/pkgs/by-name/de/deezer-desktop/package.nix
new file mode 100644
index 000000000000..ee9556a02ace
--- /dev/null
+++ b/pkgs/by-name/de/deezer-desktop/package.nix
@@ -0,0 +1,74 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  makeWrapper,
+  electron,
+}:
+
+let
+  version = "7.1.100";
+  srcs = {
+    x86_64-linux = fetchurl {
+      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
+      hash = "sha256-KU7dmXXJGLVoDf/iHP3LBcbc/+ldTdYsRD3LyGvbvZc=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
+      hash = "sha256-sLso74DJaJK/o8cYYHEI/XNXjcl1MgfkegsCEOw+79Y=";
+    };
+  };
+
+  src = srcs.${stdenv.hostPlatform.system} or (throw "${stdenv.hostPlatform.system} not supported");
+
+  # Architecture string for directory names
+  archDir =
+    if stdenv.hostPlatform.isx86_64 then
+      "x64"
+    else if stdenv.hostPlatform.isAarch64 then
+      "arm64"
+    else
+      throw "Unsupported architecture";
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "deezer-desktop";
+  inherit version src;
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  sourceRoot = ".";
+
+  dontBuild = true;
+  installPhase = ''
+    runHook preInstall
+    install -d $out/bin $out/share/deezer-desktop/resources $out/share/applications $out/share/icons/hicolor/scalable/apps
+
+    substituteInPlace deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.desktop \
+      --replace-fail "run.sh" "deezer-desktop" \
+      --replace-fail "dev.aunetx.deezer" "deezer-desktop"
+    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.desktop $out/share/applications/deezer-desktop.desktop
+    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.svg $out/share/icons/hicolor/scalable/apps/deezer-desktop.svg
+    cp -r deezer-desktop-${version}-${archDir}/resources/{app.asar,linux} $out/share/deezer-desktop/resources/
+
+    makeWrapper "${lib.getExe electron}" "$out/bin/deezer-desktop" \
+      --inherit-argv0 \
+      --add-flags "$out/share/deezer-desktop/resources/app.asar" \
+      --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+      --set DZ_RESOURCES_PATH "$out/share/deezer-desktop/resources"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Unofficial Linux port of the music streaming application";
+    homepage = "https://github.com/aunetx/deezer-linux";
+    downloadPage = "https://github.com/aunetx/deezer-linux/releases";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ FelixLusseau ];
+    mainProgram = "deezer-desktop";
+  };
+})

From 21bc088d21cbafe615531a0f37ec95882cbb19e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Bori?= <theobori@disroot.org>
Date: Sat, 7 Mar 2026 14:49:04 +0100
Subject: [PATCH 55/95] taterclient-ddnet: 10.8.5 -> 10.8.6

---
 pkgs/by-name/ta/taterclient-ddnet/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ta/taterclient-ddnet/package.nix b/pkgs/by-name/ta/taterclient-ddnet/package.nix
index 81c5ac4f3cb3..b73722c26036 100644
--- a/pkgs/by-name/ta/taterclient-ddnet/package.nix
+++ b/pkgs/by-name/ta/taterclient-ddnet/package.nix
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taterclient-ddnet";
-  version = "10.8.5";
+  version = "10.8.6";
 
   src = fetchFromGitHub {
     owner = "TaterClient";
     repo = "TClient";
     tag = "V${finalAttrs.version}";
-    hash = "sha256-wdX7AZG4hDzRDUl6XjzL2bTMwBxMWdRt4geE7NuqpdQ=";
+    hash = "sha256-7NhRJMQjap+9ppGeCYRSGgB+D3H/THmJ/PgZ4mTPls0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -103,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Since we are not building the server executable, the `run_tests` Makefile target
   # will not be generated.
   #
-  # See https://github.com/TaterClient/TClient/blob/V10.7.0/CMakeLists.txt#L3207
+  # See https://github.com/TaterClient/TClient/blob/V10.8.6/CMakeLists.txt#L3260
   doCheck = false;
 
   preFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''

From 787689860ba729fc7d2f934a706036430aea23d9 Mon Sep 17 00:00:00 2001
From: 360ied <19516527+360ied@users.noreply.github.com>
Date: Fri, 6 Mar 2026 14:32:32 -0500
Subject: [PATCH 56/95] classicube: 1.3.7 -> 1.3.8

---
 pkgs/by-name/cl/classicube/fix-linking.patch | 14 -----------
 pkgs/by-name/cl/classicube/package.nix       | 26 +++++++++-----------
 2 files changed, 12 insertions(+), 28 deletions(-)
 delete mode 100644 pkgs/by-name/cl/classicube/fix-linking.patch

diff --git a/pkgs/by-name/cl/classicube/fix-linking.patch b/pkgs/by-name/cl/classicube/fix-linking.patch
deleted file mode 100644
index a35d19caaca4..000000000000
--- a/pkgs/by-name/cl/classicube/fix-linking.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/Makefile b/Makefile
-index a10eb5214..70e2f720e 100644
---- a/Makefile
-+++ b/Makefile
-@@ -55,7 +55,7 @@ endif
- 
- ifeq ($(PLAT),linux)
- 	CFLAGS  += -DCC_BUILD_ICON
--	LIBS    =  -lX11 -lXi -lpthread -lGL -ldl
-+	LIBS    =  -lX11 -lXi -lpthread -lGL -ldl -lcurl -lopenal
- 	BUILD_DIR = build-linux
- endif
- 
-
diff --git a/pkgs/by-name/cl/classicube/package.nix b/pkgs/by-name/cl/classicube/package.nix
index 4076d261d389..8caab86b7259 100644
--- a/pkgs/by-name/cl/classicube/package.nix
+++ b/pkgs/by-name/cl/classicube/package.nix
@@ -14,15 +14,15 @@
   liberation_ttf,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ClassiCube";
-  version = "1.3.7";
+  version = "1.3.8";
 
   src = fetchFromGitHub {
     owner = "UnknownShadow200";
     repo = "ClassiCube";
-    rev = version;
-    sha256 = "sha256-ZITyfxkQB4Jpm2ZsQyM+ouPLqCVmGB7UZRXDSU/BX0k=";
+    tag = finalAttrs.version;
+    hash = "sha256-AF4cr3ZXCixwiihS+2ayrzVH5eYShkjlfF0myb2PbHM=";
   };
 
   nativeBuildInputs = [
@@ -33,8 +33,8 @@ stdenv.mkDerivation rec {
 
   desktopItems = [
     (makeDesktopItem {
-      name = pname;
-      desktopName = pname;
+      name = finalAttrs.pname;
+      desktopName = finalAttrs.pname;
       genericName = "Sandbox Block Game";
       exec = "ClassiCube";
       icon = "CCicon";
@@ -52,9 +52,6 @@ stdenv.mkDerivation rec {
   patches = [
     # Fix hardcoded font paths
     ./font-location.patch
-    # For some reason, the Makefile doesn't link
-    # with libcurl and openal when ClassiCube requires them.
-    ./fix-linking.patch
   ];
 
   font_path = "${liberation_ttf}/share/fonts/truetype";
@@ -66,11 +63,12 @@ stdenv.mkDerivation rec {
     # This changes the hardcoded location
     # to the path of liberation_ttf instead
     substituteInPlace src/Platform_Posix.c \
-      --replace '%NIXPKGS_FONT_PATH%' "${font_path}"
-    # ClassiCube's Makefile hardcodes JOBS=1 for some reason,
-    # even though it works perfectly well multi-threaded.
+      --replace-fail '%NIXPKGS_FONT_PATH%' "${finalAttrs.font_path}"
+    # For some reason, the Makefile doesn't link
+    # with libcurl and openal when ClassiCube requires them.
     substituteInPlace Makefile \
-      --replace 'JOBS=1' "JOBS=$NIX_BUILD_CORES"
+      --replace-fail '-lX11 -lXi -lpthread -lGL -ldl -lm' \
+                     '-lX11 -lXi -lpthread -lGL -ldl -lm -lcurl -lopenal'
   '';
 
   buildInputs = [
@@ -111,4 +109,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ _360ied ];
     mainProgram = "ClassiCube";
   };
-}
+})

From ff2bf86c752d862808a9b6eddd71e655d9695ab2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 7 Mar 2026 15:12:08 +0100
Subject: [PATCH 57/95] svgo: 4.0.0 -> 4.0.1

https://github.com/svg/svgo/releases/tag/v4.0.1
https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673

Fixes: CVE-2026-29074
---
 pkgs/by-name/sv/svgo/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sv/svgo/package.nix b/pkgs/by-name/sv/svgo/package.nix
index 2cd74ca00403..f691b0adcd61 100644
--- a/pkgs/by-name/sv/svgo/package.nix
+++ b/pkgs/by-name/sv/svgo/package.nix
@@ -12,20 +12,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "svgo";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "svg";
     repo = "svgo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eSttRNHxcZquIxrTogk+7YS7rhp083qnOwJI71cmO20=";
+    hash = "sha256-HYI3E14MN0XhREQMYkhLB1gZOBtrpjayC1RyVEhvkOU=";
   };
 
   missingHashes = ./missing-hashes.json;
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-DrIbnm0TWviCfylCI/12XYsx7YOIk7JFVV18Q4dImwU=";
+    hash = "sha256-oBWUTYlMa3wi7TYAOTXSNBbSMiAZI6APXZvPyQzoPbM=";
   };
 
   nativeBuildInputs = [

From c05b857880ebf096a279d67feb8c95a1e8f0b06c Mon Sep 17 00:00:00 2001
From: GnomedDev <daisy2005thomas@gmail.com>
Date: Sat, 7 Mar 2026 12:43:09 +0000
Subject: [PATCH 58/95] dolphin-emu,sfml: Fix build on Darwin by vendoring
 miniaudio

---
 pkgs/by-name/do/dolphin-emu/package.nix | 4 ----
 pkgs/by-name/sf/sfml/package.nix        | 5 +++--
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/do/dolphin-emu/package.nix b/pkgs/by-name/do/dolphin-emu/package.nix
index b23dab82c6a7..5d520d64927d 100644
--- a/pkgs/by-name/do/dolphin-emu/package.nix
+++ b/pkgs/by-name/do/dolphin-emu/package.nix
@@ -198,10 +198,6 @@ stdenv.mkDerivation (finalAttrs: {
     branch = "master";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
-    badPlatforms = [
-      # error: implicit instantiation of undefined template 'std::char_traits<unsigned int>'
-      lib.systems.inspect.patterns.isDarwin
-    ];
     maintainers = with lib.maintainers; [ pbsds ];
   };
 })
diff --git a/pkgs/by-name/sf/sfml/package.nix b/pkgs/by-name/sf/sfml/package.nix
index 75172272f475..9c5991f7801e 100644
--- a/pkgs/by-name/sf/sfml/package.nix
+++ b/pkgs/by-name/sf/sfml/package.nix
@@ -34,7 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-YqlrY0iIsxcjlLb+buMU0zpXo7/eKSKxOsITWf7BX6s=";
   };
 
-  patches = [
+  # Only unvendor miniaudio on non-Darwin as Darwin cannot build the miniaudio package.
+  patches = lib.optional (!stdenv.hostPlatform.isDarwin) [
     # Not upstreamble in the near future, see https://github.com/SFML/SFML/pull/3555
     ./unvendor-miniaudio.patch
   ];
@@ -49,10 +50,10 @@ stdenv.mkDerivation (finalAttrs: {
     glew
     libjpeg
     libvorbis
-    miniaudio
   ]
   ++ lib.optional stdenv.hostPlatform.isLinux udev
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    miniaudio
     libx11
     libxi
     libxcursor

From 296000dab0b04bd2929e3eb5e254e50cceb544fa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 15:30:47 +0000
Subject: [PATCH 59/95] enzyme: 0.0.249 -> 0.0.250

---
 pkgs/by-name/en/enzyme/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/en/enzyme/package.nix b/pkgs/by-name/en/enzyme/package.nix
index 9f34ddd41e0a..5613977152eb 100644
--- a/pkgs/by-name/en/enzyme/package.nix
+++ b/pkgs/by-name/en/enzyme/package.nix
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.249";
+  version = "0.0.250";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-M15AUk5x/vB6TpWVXueXGAChnlVvKCgrQxJb6tY2Y0M=";
+    hash = "sha256-wyvYVI/HmCtBwIb1mIYJ/p2YQTH8fleP3xPUZsMeb1U=";
   };
 
   postPatch = ''

From 139cae20530f6d0d28a71deefdfa9f9c2506fc21 Mon Sep 17 00:00:00 2001
From: Matteo Pacini <m+github@matteopacini.me>
Date: Sat, 7 Mar 2026 16:46:25 +0000
Subject: [PATCH 60/95] duckstation: drop matteopacini as maintainer

---
 pkgs/by-name/du/duckstation/package.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/by-name/du/duckstation/package.nix b/pkgs/by-name/du/duckstation/package.nix
index 374380073240..c6c7bef1f66d 100644
--- a/pkgs/by-name/du/duckstation/package.nix
+++ b/pkgs/by-name/du/duckstation/package.nix
@@ -51,9 +51,7 @@ let
     '';
     homepage = "https://duckstation.org";
     license = lib.licenses.cc-by-nc-nd-40;
-    maintainers = with lib.maintainers; [
-      matteopacini
-    ];
+    maintainers = [ ];
   };
 
   pkgSources = lib.importJSON ./sources.json;

From 0b4d069bccc2c8b96907385879f06453fdcca0f2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 17:25:58 +0000
Subject: [PATCH 61/95] vimPlugins.codesnap-nvim: 2.0.0 -> 2.0.1

---
 .../vim/plugins/non-generated/codesnap-nvim/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix
index 9c886ec01a33..4d2f7094ba13 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix
@@ -10,12 +10,12 @@
   nix-update-script,
 }:
 let
-  version = "2.0.0";
+  version = "2.0.1";
   src = fetchFromGitHub {
     owner = "mistricky";
     repo = "codesnap.nvim";
     tag = "v${version}";
-    hash = "sha256-gpsNug6lSc/AifW8DeJy9R3LYuiTStuYZV02MiIZhq8=";
+    hash = "sha256-pYBB647UX3okpfUlZ3MhrlEwILXv/V0r42j7xp4aDO0=";
   };
   codesnap-lib = rustPlatform.buildRustPackage {
     pname = "codesnap-lib";

From 6e61c8b195b9dfb34a8478e2478b13afc8e0b5e5 Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Tue, 30 Dec 2025 13:23:52 +0100
Subject: [PATCH 62/95] apl387: init at 0-unstable-2025-12-13

Co-authored-by: Sigmanificient <edhyjox@gmail.com>
---
 pkgs/by-name/ap/apl387/package.nix | 52 ++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 pkgs/by-name/ap/apl387/package.nix

diff --git a/pkgs/by-name/ap/apl387/package.nix b/pkgs/by-name/ap/apl387/package.nix
new file mode 100644
index 000000000000..2e776e644600
--- /dev/null
+++ b/pkgs/by-name/ap/apl387/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  installFonts,
+  python3,
+  fontforge,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "apl387";
+  version = "0-unstable-2025-12-13";
+
+  src = fetchFromGitHub {
+    owner = "dyalog";
+    repo = "APL387";
+    rev = "60ff47a728ee043f878dc2ed801d53e29fcebe9d";
+    hash = "sha256-VyO+7PUYcmmhbFVAW37yvWQLUpt0K/ihA/JGmbt+4Uk=";
+  };
+
+  nativeBuildInputs = [
+    python3
+    fontforge
+    installFonts
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    ${python3.executable} script.py . "${finalAttrs.src.rev}"
+    runHook postBuild
+  '';
+
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
+  postInstall = ''
+    installFont svg $out/share/fonts/svg
+  '';
+
+  meta = {
+    homepage = "https://dyalog.github.io/APL387";
+    description = "Redrawn and extended version of Adrian Smith's classic APL385 font with clean rounded look";
+    license = lib.licenses.unlicense;
+    maintainers = [
+      lib.maintainers.sternenseemann
+      lib.maintainers.sigmanificient
+    ];
+    platforms = lib.platforms.all;
+  };
+})

From a6b2ef98038e1c6bc1bb8abcd89e7e2bff457b0f Mon Sep 17 00:00:00 2001
From: Shaun Ren <shaun@sren.org>
Date: Fri, 2 Jan 2026 14:08:10 -0500
Subject: [PATCH 63/95] maintainers: add shaunren

---
 maintainers/maintainer-list.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3afb70d5de9b..f45dafabbc75 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -24497,6 +24497,11 @@
     githubId = 46294732;
     name = "Sharzy";
   };
+  shaunren = {
+    name = "Shaun Ren";
+    github = "shaunren";
+    githubId = 388428;
+  };
   shavyn = {
     name = "Marco Desiderati";
     email = "desideratimarco@gmail.com";

From 4c50462215802b4b96ea7d4afb16faff4d430b4b Mon Sep 17 00:00:00 2001
From: Vinetos <contact+git@vinetos.fr>
Date: Sat, 7 Mar 2026 20:50:51 +0100
Subject: [PATCH 64/95] python3Packages.python-swiftclient: 4.9.0 -> 4.10.0

---
 .../python-swiftclient/default.nix            | 80 +++++++++++++------
 1 file changed, 55 insertions(+), 25 deletions(-)

diff --git a/pkgs/development/python-modules/python-swiftclient/default.nix b/pkgs/development/python-modules/python-swiftclient/default.nix
index af7def06f0c7..72bea8934f72 100644
--- a/pkgs/development/python-modules/python-swiftclient/default.nix
+++ b/pkgs/development/python-modules/python-swiftclient/default.nix
@@ -1,59 +1,89 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  installShellFiles,
-  mock,
-  openstacksdk,
+  fetchFromGitHub,
   pbr,
+  setuptools,
+  installShellFiles,
+
+  # direct
   python-keystoneclient,
+
+  # tests
+  stestrCheckHook,
+  versionCheckHook,
+  hacking,
+  coverage,
+  keystoneauth1,
   stestr,
+  openstacksdk,
+
+  # docs
+  sphinxHook,
+  openstackdocstheme,
+  sphinxcontrib-apidoc,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-swiftclient";
-  version = "4.9.0";
+  version = "4.10.0";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "python_swiftclient";
-    inherit version;
-    hash = "sha256-niB7guwxeG8Q24/vbiBWgcJJl6C2ANKKGU+dFakO13I=";
-  };
-
-  nativeBuildInputs = [ installShellFiles ];
-
   build-system = [
     pbr
+    setuptools
   ];
 
+  env.PBR_VERSION = finalAttrs.version;
+
+  src = fetchFromGitHub {
+    owner = "openstack";
+    repo = "python-swiftclient";
+    tag = finalAttrs.version;
+    hash = "sha256-G3o9R3+hDQgvSnmle0paZo/KV56OMU38tIXqUJGmUaQ=";
+  };
+
+  nativeBuildInputs = [
+    openstackdocstheme
+    sphinxcontrib-apidoc
+    sphinxHook
+    installShellFiles
+  ];
+
+  sphinxBuilders = [ "man" ];
+
   dependencies = [
     python-keystoneclient
   ];
 
   nativeCheckInputs = [
-    mock
+    stestrCheckHook
     openstacksdk
+    hacking
+    coverage
+    keystoneauth1
     stestr
+    openstacksdk
   ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   postInstall = ''
-    installShellCompletion --cmd swift \
-      --bash tools/swift.bash_completion
+    installShellCompletion --cmd swift --bash tools/swift.bash_completion
     installManPage doc/manpages/*
   '';
 
-  checkPhase = ''
-    stestr run
-  '';
-
-  pythonImportsCheck = [ "swiftclient" ];
+  pythonImportsCheck = [
+    "swiftclient"
+  ];
 
   meta = {
-    homepage = "https://github.com/openstack/python-swiftclient";
-    description = "Python bindings to the OpenStack Object Storage API";
+    description = "Client library for OpenStack Swift API";
     mainProgram = "swift";
+    homepage = "https://docs.openstack.org/python-swiftclient/latest/";
+    downloadPage = "https://github.com/openstack/python-swiftclient/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     teams = [ lib.teams.openstack ];
   };
-}
+})

From 58a43653b37bac955f18450796629b7ee01a6bcf Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 3 Mar 2026 23:31:41 +0000
Subject: [PATCH 65/95] python3Packages.pymatting: cleanup

---
 .../python-modules/pymatting/default.nix      | 34 ++++++++++++-------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/pymatting/default.nix b/pkgs/development/python-modules/pymatting/default.nix
index 6daa3f4950c3..f53b44996d1e 100644
--- a/pkgs/development/python-modules/pymatting/default.nix
+++ b/pkgs/development/python-modules/pymatting/default.nix
@@ -2,19 +2,27 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   numba,
   numpy,
   pillow,
-  pytestCheckHook,
   scipy,
-  setuptools,
-  config,
-  cudaSupport ? config.cudaSupport,
+  # cuda-only
   cupy,
   pyopencl,
+
+  # tests
+  pytestCheckHook,
+
+  config,
+  cudaSupport ? config.cudaSupport,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pymatting";
   version = "1.1.15";
   pyproject = true;
@@ -22,7 +30,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "pymatting";
     repo = "pymatting";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-rcatlQE+YgppY//ZgGY9jO5KI0ED30fLlqW9N+xRNqk=";
   };
 
@@ -39,10 +47,10 @@ buildPythonPackage rec {
     pyopencl
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
   pythonImportsCheck = [ "pymatting" ];
 
+  nativeCheckInputs = [ pytestCheckHook ];
+
   disabledTests = [
     # no access to input data set
     # see: https://github.com/pymatting/pymatting/blob/master/tests/download_images.py
@@ -52,14 +60,16 @@ buildPythonPackage rec {
     "test_lkm"
   ];
 
-  # pyopencl._cl.LogicError: clGetPlatformIDs failed: PLATFORM_NOT_FOUND_KHR
-  disabledTestPaths = lib.optional cudaSupport "tests/test_foreground.py";
+  disabledTestPaths = lib.optionals cudaSupport [
+    # pyopencl._cl.LogicError: clGetPlatformIDs failed: PLATFORM_NOT_FOUND_KHR
+    "tests/test_foreground.py"
+  ];
 
   meta = {
     description = "Python library for alpha matting";
     homepage = "https://github.com/pymatting/pymatting";
-    changelog = "https://github.com/pymatting/pymatting/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/pymatting/pymatting/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})

From 58aa5edb020e344484d0845eff456ff734143cec Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 3 Mar 2026 23:37:41 +0000
Subject: [PATCH 66/95] python3Packages.pyamttings: fix cuda build

---
 .../python-modules/pymatting/default.nix          | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pymatting/default.nix b/pkgs/development/python-modules/pymatting/default.nix
index f53b44996d1e..e74dbd1eb9fd 100644
--- a/pkgs/development/python-modules/pymatting/default.nix
+++ b/pkgs/development/python-modules/pymatting/default.nix
@@ -16,7 +16,9 @@
   pyopencl,
 
   # tests
+  pocl,
   pytestCheckHook,
+  writableTmpDirAsHomeHook,
 
   config,
   cudaSupport ? config.cudaSupport,
@@ -49,7 +51,16 @@ buildPythonPackage (finalAttrs: {
 
   pythonImportsCheck = [ "pymatting" ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ]
+  ++ lib.optionals cudaSupport [
+    # Provides a CPU-based OpenCL ICD so that pyopencl's module-level
+    # cl.create_some_context() succeeds without GPU hardware.
+    pocl
+    # pocl needs a writable $HOME for its kernel cache directory.
+    writableTmpDirAsHomeHook
+  ];
 
   disabledTests = [
     # no access to input data set
@@ -61,7 +72,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTestPaths = lib.optionals cudaSupport [
-    # pyopencl._cl.LogicError: clGetPlatformIDs failed: PLATFORM_NOT_FOUND_KHR
+    # Requires a CUDA driver for cupy GPU operations
     "tests/test_foreground.py"
   ];
 

From 3f023e4cebd32eb21f1703de4160a74f492a02af Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 28 Feb 2026 10:37:51 +0000
Subject: [PATCH 67/95] python3Packages.apache-tvm-ffi: init at 0.1.9

---
 .../python-modules/apache-tvm-ffi/default.nix | 69 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 71 insertions(+)
 create mode 100644 pkgs/development/python-modules/apache-tvm-ffi/default.nix

diff --git a/pkgs/development/python-modules/apache-tvm-ffi/default.nix b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
new file mode 100644
index 000000000000..b4cd7aa67562
--- /dev/null
+++ b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  cmake,
+  cython,
+  ninja,
+  scikit-build-core,
+  setuptools-scm,
+
+  # dependencies
+  typing-extensions,
+
+  # tests
+  numpy,
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "apache-tvm-ffi";
+  version = "0.1.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "tvm-ffi";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-XnlM//WW2TbjbmzYBq6itJQ7R3J646UMVQUVhV5Afwc=";
+  };
+
+  build-system = [
+    cmake
+    cython
+    ninja
+    scikit-build-core
+    setuptools-scm
+  ];
+  dontUseCmakeConfigure = true;
+
+  dependencies = [
+    typing-extensions
+  ];
+
+  optional-dependencies = {
+    cpp = [
+      ninja
+    ];
+  };
+
+  pythonImportsCheck = [ "tvm_ffi" ];
+
+  nativeCheckInputs = [
+    numpy
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  meta = {
+    description = "Open ABI and FFI for Machine Learning Systems";
+    changelog = "https://github.com/apache/tvm-ffi/releases/tag/${finalAttrs.src.tag}";
+    homepage = "https://github.com/apache/tvm-ffi";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b6bb7a027f12..1d89c5e30dd5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -834,6 +834,8 @@ self: super: with self; {
 
   apache-beam = callPackage ../development/python-modules/apache-beam { };
 
+  apache-tvm-ffi = callPackage ../development/python-modules/apache-tvm-ffi { };
+
   apcaccess = callPackage ../development/python-modules/apcaccess { };
 
   apeye = callPackage ../development/python-modules/apeye { };

From f5c6e65f0faabf63d6aae72cefabed424822aa68 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 28 Feb 2026 10:30:34 +0000
Subject: [PATCH 68/95] python3Packages.flashinfer: 0.6.1 -> 0.6.4

Diff: https://github.com/flashinfer-ai/flashinfer/compare/v0.6.1...v0.6.4
---
 .../python-modules/flashinfer/default.nix     | 25 ++++++++-----------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index 2e1119edc390..b66cce0288ff 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -9,9 +9,9 @@
   config,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch2,
 
   # build-system
+  apache-tvm-ffi,
   setuptools,
 
   # nativeBuildInputs
@@ -29,30 +29,24 @@
   tqdm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "flashinfer";
-  version = "0.6.1";
+  version = "0.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "flashinfer-ai";
     repo = "flashinfer";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-NRjas11VvvCY6MZiZaYtxG5MXEaFqfbhJxflUT/uraE=";
+    hash = "sha256-Hq3oTeEJHRvXwThI8vc06E3Ot/FnPP0sZUfze3ISa2o=";
   };
 
-  patches = [
-    # TODO: remove patch with update to v0.5.2+
-    # Switch pynvml to nvidia-ml-py
-    (fetchpatch2 {
-      url = "https://github.com/flashinfer-ai/flashinfer/commit/a42f99255d68d1a54b689bd4985339c6b44963a6.patch?full_index=1";
-      hash = "sha256-3XJFcdQeZ/c5fwiQvd95z4p9BzTn8pjle21WzeBxUgk=";
-    })
+  build-system = [
+    apache-tvm-ffi
+    setuptools
   ];
 
-  build-system = [ setuptools ];
-
   nativeBuildInputs = [
     cmake
     ninja
@@ -91,6 +85,7 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [
     "nvidia-cudnn-frontend"
+    "nvidia-cutlass-dsl"
   ];
   dependencies = [
     click
@@ -119,4 +114,4 @@ buildPythonPackage rec {
       daniel-fahey
     ];
   };
-}
+})

From 8f8587ec4509138a8ad7c95ef25701b536e60db7 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 28 Feb 2026 11:03:02 +0000
Subject: [PATCH 69/95] python3Packages.cuda-pathfinder: init at 1.4.0

---
 .../cuda-pathfinder/default.nix               | 52 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 54 insertions(+)
 create mode 100644 pkgs/development/python-modules/cuda-pathfinder/default.nix

diff --git a/pkgs/development/python-modules/cuda-pathfinder/default.nix b/pkgs/development/python-modules/cuda-pathfinder/default.nix
new file mode 100644
index 000000000000..1ca842a476d4
--- /dev/null
+++ b/pkgs/development/python-modules/cuda-pathfinder/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+  setuptools-scm,
+
+  # tests
+  pytest-mock,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "cuda-pathfinder";
+  version = "1.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "cuda-python";
+    tag = "cuda-pathfinder-v${finalAttrs.version}";
+    hash = "sha256-Bsou6vLyMBNbVMPT4vtnWpoi05lXG6pjhuee6Hg/Mm8=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/cuda_pathfinder";
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  pythonImportsCheck = [
+    "cuda"
+    "cuda.pathfinder"
+  ];
+
+  nativeCheckInputs = [
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "one-stop solution for locating CUDA components";
+    homepage = "https://github.com/NVIDIA/cuda-python/tree/main/cuda_pathfinder";
+    changelog = "https://nvidia.github.io/cuda-python/cuda-pathfinder/${finalAttrs.version}/release/${finalAttrs.version}-notes.html";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1d89c5e30dd5..5749d69bc2fd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3386,6 +3386,8 @@ self: super: with self; {
 
   cuda-bindings = callPackage ../development/python-modules/cuda-bindings { };
 
+  cuda-pathfinder = callPackage ../development/python-modules/cuda-pathfinder { };
+
   cupy = callPackage ../development/python-modules/cupy {
     cudaPackages =
       # CuDNN 9 is not supported:

From 72762bccf8966363ce0a489b0d9d66805bd16e89 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 28 Feb 2026 10:45:47 +0000
Subject: [PATCH 70/95] python3Packages.cupy: add GaetanLepage to maintainers

---
 pkgs/development/python-modules/cupy/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/cupy/default.nix b/pkgs/development/python-modules/cupy/default.nix
index c8793df35e88..c4ba16d92cdd 100644
--- a/pkgs/development/python-modules/cupy/default.nix
+++ b/pkgs/development/python-modules/cupy/default.nix
@@ -130,6 +130,6 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
       "aarch64-linux"
       "x86_64-linux"
     ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ GaetanLepage ];
   };
 }

From f54a1182d6c76df387a1e80c2aeaea757f2dd88b Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 28 Feb 2026 10:44:34 +0000
Subject: [PATCH 71/95] python3Packages.cupy: 13.6.0 -> 14.0.1

Diff: https://github.com/cupy/cupy/compare/v13.6.0...v14.0.1

Changelog: https://github.com/cupy/cupy/releases/tag/v14.0.1
---
 .../python-modules/cupy/default.nix           | 46 ++++++++++++-------
 1 file changed, 29 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/python-modules/cupy/default.nix b/pkgs/development/python-modules/cupy/default.nix
index c4ba16d92cdd..024c99843ba0 100644
--- a/pkgs/development/python-modules/cupy/default.nix
+++ b/pkgs/development/python-modules/cupy/default.nix
@@ -1,17 +1,24 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   cython,
-  fastrlock,
-  numpy,
-  pytestCheckHook,
-  mock,
   setuptools,
+
+  # nativeBuildInputs
   cudaPackages,
-  addDriverRunpath,
   symlinkJoin,
+  addDriverRunpath,
+
+  # dependencies
+  numpy,
+  cuda-pathfinder,
+
+  # tests
+  pytest-mock,
+  pytestCheckHook,
 }:
 
 let
@@ -39,8 +46,7 @@ let
       libcurand
       libcusolver
       libcusparse
-      # NOTE: libcusparse_lt is too new for CuPy, so we must do without.
-      # libcusparse_lt
+      libcusparse_lt # cusparseLt.h
     ]
   );
   cudatoolkit-joined = symlinkJoin {
@@ -49,19 +55,26 @@ let
       outpaths ++ lib.concatMap (outpath: lib.map (output: outpath.${output}) outpath.outputs) outpaths;
   };
 in
-buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
+buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs: {
   pname = "cupy";
-  version = "13.6.0";
+  version = "14.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cupy";
     repo = "cupy";
-    tag = "v${version}";
-    hash = "sha256-nU3VL0MSCN+mI5m7C5sKAjBSL6ybM6YAk5lJiIDY0ck=";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
+    hash = "sha256-TaEJ0BveUCXCRrNq9L49Tfbu0334+cANcVm5qnSOE1Q=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail \
+        "Cython>=3.1,<3.2" \
+        "Cython"
+  '';
+
   env = {
     LDFLAGS = toString [
       # Fake libcuda.so (the real one is deployed impurely)
@@ -83,7 +96,6 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
 
   build-system = [
     cython
-    fastrlock
     setuptools
   ];
 
@@ -100,13 +112,13 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
   ];
 
   dependencies = [
-    fastrlock
+    cuda-pathfinder
     numpy
   ];
 
   nativeCheckInputs = [
+    pytest-mock
     pytestCheckHook
-    mock
   ];
 
   # Won't work with the GPU, whose drivers won't be accessible from the build
@@ -124,7 +136,7 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
   meta = {
     description = "NumPy-compatible matrix library accelerated by CUDA";
     homepage = "https://cupy.chainer.org/";
-    changelog = "https://github.com/cupy/cupy/releases/tag/${src.tag}";
+    changelog = "https://github.com/cupy/cupy/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     platforms = [
       "aarch64-linux"
@@ -132,4 +144,4 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
     ];
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})

From b44e970d8ff6077e199fdb378ec8207aea73b8b9 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 6 Mar 2026 20:52:23 +0000
Subject: [PATCH 72/95] python3Packages.rembg: fix cuda build

---
 .../python-modules/rembg/default.nix          | 25 ++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/rembg/default.nix b/pkgs/development/python-modules/rembg/default.nix
index 209a1df7c07f..4100177c2646 100644
--- a/pkgs/development/python-modules/rembg/default.nix
+++ b/pkgs/development/python-modules/rembg/default.nix
@@ -33,8 +33,12 @@
 
   # tests
   versionCheckHook,
+  pocl,
 
   withCli ? false,
+  config,
+  cudaSupport ? config.cudaSupport,
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -100,9 +104,24 @@ buildPythonPackage (finalAttrs: {
   postInstall = lib.optionalString (!withCli) "rm -r $out/bin";
 
   # not running python tests, as they require network access
-  nativeCheckInputs = lib.optionals withCli [
-    versionCheckHook
-  ];
+  nativeCheckInputs =
+    lib.optionals
+      (
+        withCli
+        # Crashes in the sandbox as no drivers are available
+        # opencl._cl.RuntimeError: no CL platforms available to ICD loader
+        && (!cudaSupport)
+      )
+      [
+        versionCheckHook
+      ]
+    ++ lib.optionals cudaSupport [
+      # Provides a CPU-based OpenCL ICD so that pyopencl's module-level
+      # cl.create_some_context() succeeds without GPU hardware.
+      pocl
+      # pocl needs a writable $HOME for its kernel cache directory.
+      writableTmpDirAsHomeHook
+    ];
   versionCheckKeepEnvironment = [
     # Otherwise, fail with:
     # RuntimeError: cannot cache function '_make_tree': no locator available for file

From 6fe1428ce75b25b5626f387680688c963457b446 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 6 Mar 2026 23:57:36 +0000
Subject: [PATCH 73/95] python3Packages.pynndescent: skip failing tests

---
 .../python-modules/pynndescent/default.nix    | 20 ++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/pynndescent/default.nix b/pkgs/development/python-modules/pynndescent/default.nix
index 22d4e586f3bd..4be6ffb850da 100644
--- a/pkgs/development/python-modules/pynndescent/default.nix
+++ b/pkgs/development/python-modules/pynndescent/default.nix
@@ -17,7 +17,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pynndescent";
   version = "0.6.0";
   pyproject = true;
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "lmcinnes";
     repo = "pynndescent";
-    tag = "release-${version}";
+    tag = "release-${finalAttrs.version}";
     hash = "sha256-RfIbPPyx+Y7niuFrLjA02cUDHTSv9s5E4JiXv4ZBNEc=";
   };
 
@@ -39,14 +39,24 @@ buildPythonPackage rec {
     scipy
   ];
 
+  pythonImportsCheck = [ "pynndescent" ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [ "pynndescent" ];
+  disabledTests = [
+    # AssertionError: Arrays are not almost equal to 6 decimals
+    "test_seuclidean"
+
+    # sklearn.utils._param_validation.InvalidParameterError: The 'metric' parameter of
+    # pairwise_distances must be a str among ...
+    "test_binary_check"
+    "test_sparse_binary_check"
+  ];
 
   meta = {
     description = "Nearest Neighbor Descent";
     homepage = "https://github.com/lmcinnes/pynndescent";
-    changelog = "https://github.com/lmcinnes/pynndescent/releases/tag/release-${src.tag}";
+    changelog = "https://github.com/lmcinnes/pynndescent/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ mic92 ];
     badPlatforms = [
@@ -55,4 +65,4 @@ buildPythonPackage rec {
       "aarch64-linux"
     ];
   };
-}
+})

From bc459417582f99c48b8995aaf2f2c9ab358cf958 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 7 Mar 2026 00:01:02 +0000
Subject: [PATCH 74/95] python3Packages.hatch-min-requirements: cleanup, fix

---
 .../hatch-min-requirements/default.nix         | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/hatch-min-requirements/default.nix b/pkgs/development/python-modules/hatch-min-requirements/default.nix
index f04a12949468..dd650dd811f9 100644
--- a/pkgs/development/python-modules/hatch-min-requirements/default.nix
+++ b/pkgs/development/python-modules/hatch-min-requirements/default.nix
@@ -1,12 +1,17 @@
 {
+  lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   hatch-vcs,
   hatchling,
-  lib,
+
+  # dependencies
+  tomlkit,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "hatch-min-requirements";
   version = "0.2.0";
   pyproject = true;
@@ -14,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tlambert03";
     repo = "hatch-min-requirements";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-QKO5fVvjSqwY+48Fc8sAiZazrxZ4eBYxzVElHr2lcEA=";
   };
 
@@ -23,6 +28,10 @@ buildPythonPackage rec {
     hatch-vcs
   ];
 
+  dependencies = [
+    tomlkit
+  ];
+
   # As of v0.1.0 all tests attempt to use the network
   doCheck = false;
 
@@ -31,9 +40,10 @@ buildPythonPackage rec {
   meta = {
     description = "Hatchling plugin to create optional-dependencies pinned to minimum versions";
     homepage = "https://github.com/tlambert03/hatch-min-requirements";
+    changelog = "https://github.com/tlambert03/hatch-min-requirements/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       samuela
     ];
   };
-}
+})

From 04f9a5f5c41ce41670095ac36c024ee171b4f8b1 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 7 Mar 2026 00:39:35 +0000
Subject: [PATCH 75/95] python3Packages.scanpy: fix build

---
 pkgs/development/python-modules/scanpy/default.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/python-modules/scanpy/default.nix b/pkgs/development/python-modules/scanpy/default.nix
index 88b1f4c7f624..6d4880c5f0b4 100644
--- a/pkgs/development/python-modules/scanpy/default.nix
+++ b/pkgs/development/python-modules/scanpy/default.nix
@@ -45,6 +45,7 @@
   scikit-misc,
 
   # tests
+  dependency-groups,
   jinja2,
   pytest-cov-stub,
   pytest-mock,
@@ -156,6 +157,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   nativeCheckInputs = [
+    dependency-groups
     jinja2
     pytest-cov-stub
     pytest-mock
@@ -172,6 +174,12 @@ buildPythonPackage (finalAttrs: {
     export NUMBA_CACHE_DIR=$(mktemp -d);
   '';
 
+  pytestFlagsArray = [
+    # UserWarning: 'where' used without 'out', expect unitialized memory in output.
+    # If this is intentional, use out=None.
+    "-Wignore::UserWarning"
+  ];
+
   disabledTestPaths = [
     # try to download data:
     "tests/test_aggregated.py"
@@ -221,6 +229,11 @@ buildPythonPackage (finalAttrs: {
     # 'write/test.h5ad', errno = 2, error message = 'No such file or directory', flags = 13, o_flags
     # = 242)
     "test_write"
+
+    # Snapshot tests failing because of warnings in output
+    "scanpy.datasets._datasets.krumsiek11"
+    "scanpy.datasets._datasets.toggleswitch"
+    "scanpy.preprocessing._simple.filter_cells"
   ];
 
   pythonImportsCheck = [ "scanpy" ];

From c2f1b88ee8e930f88d9e2e38d86130f754a93402 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 7 Mar 2026 00:55:58 +0000
Subject: [PATCH 76/95] python3Packages.skrl: cleanup, fix

---
 .../python-modules/skrl/default.nix           | 70 +++++++++++--------
 1 file changed, 41 insertions(+), 29 deletions(-)

diff --git a/pkgs/development/python-modules/skrl/default.nix b/pkgs/development/python-modules/skrl/default.nix
index 991899643be9..0b37d4d0261b 100644
--- a/pkgs/development/python-modules/skrl/default.nix
+++ b/pkgs/development/python-modules/skrl/default.nix
@@ -2,18 +2,30 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   setuptools,
+
+  # dependencies
   gym,
   gymnasium,
-  torch,
+  packaging,
   tensorboard,
+  torch,
   tqdm,
   wandb,
-  packaging,
+
+  # tests
+  flax,
+  jax,
+  optax,
+  pettingzoo,
+  pygame,
+  pymunk,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "skrl";
   version = "1.4.3";
   pyproject = true;
@@ -21,49 +33,49 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Toni-SM";
     repo = "skrl";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-5lkoYAmMIWqK3+E3WxXMWS9zal2DhZkfl30EkrHKpdI=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     gym
     gymnasium
-    torch
+    packaging
     tensorboard
+    torch
     tqdm
     wandb
-    packaging
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-  doCheck = torch.cudaSupport;
+  pythonImportsCheck = [ "skrl" ];
 
-  pythonImportsCheck = [
-    "skrl"
-    "skrl.agents"
-    "skrl.agents.torch"
-    "skrl.envs"
-    "skrl.envs.torch"
-    "skrl.models"
-    "skrl.models.torch"
-    "skrl.resources"
-    "skrl.resources.noises"
-    "skrl.resources.noises.torch"
-    "skrl.resources.schedulers"
-    "skrl.resources.schedulers.torch"
-    "skrl.trainers"
-    "skrl.trainers.torch"
-    "skrl.utils"
-    "skrl.utils.model_instantiators"
+  nativeCheckInputs = [
+    flax
+    jax
+    optax
+    pettingzoo
+    pygame
+    pymunk
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # TypeError: The array passed to from_dlpack must have __dlpack__ and __dlpack_device__ methods
+    "test_env"
+    "test_multi_agent_env"
+
+    # OverflowError
+    "test_key"
   ];
 
   meta = {
     description = "Reinforcement learning library using PyTorch focusing on readability and simplicity";
-    changelog = "https://github.com/Toni-SM/skrl/releases/tag/${version}";
     homepage = "https://skrl.readthedocs.io";
+    downloadPage = "https://github.com/Toni-SM/skrl";
+    changelog = "https://github.com/Toni-SM/skrl/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ bcdarwin ];
   };
-}
+})

From 8ad1990cacc77530a05857f1f22575da2779fc68 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 7 Mar 2026 00:58:13 +0000
Subject: [PATCH 77/95] python3Packages.kmapper: cleanup, fix

---
 .../python-modules/kmapper/default.nix            | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/kmapper/default.nix b/pkgs/development/python-modules/kmapper/default.nix
index 895e94b1db51..7208df3a28d0 100644
--- a/pkgs/development/python-modules/kmapper/default.nix
+++ b/pkgs/development/python-modules/kmapper/default.nix
@@ -22,7 +22,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "kmapper";
   version = "2.1.0";
   pyproject = true;
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "scikit-tda";
     repo = "kepler-mapper";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-i909J0yI8v8BqGbCkcjBAdA02Io+qpILdDkojZj0wv4=";
   };
 
@@ -55,11 +55,18 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # UnboundLocalError: cannot access local variable 'X_blend' where it is not associated with a value
+    "test_tuple_projection"
+    "test_tuple_projection_fit"
+  ];
+
   meta = {
     description = "Python implementation of Mapper algorithm for Topological Data Analysis";
     homepage = "https://kepler-mapper.scikit-tda.org/";
-    changelog = "https://github.com/scikit-tda/kepler-mapper/releases/tag/v${version}";
+    downloadPage = "https://github.com/scikit-tda/kepler-mapper";
+    changelog = "https://github.com/scikit-tda/kepler-mapper/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})

From 5f31ca7ca1ff9b3c1453c2d9bc80572329cb0242 Mon Sep 17 00:00:00 2001
From: Christopher Kaster <me@atomicptr.de>
Date: Wed, 25 Feb 2026 17:19:14 +0100
Subject: [PATCH 78/95] intelephense: 1.16.1 -> 1.16.5

---
 .../by-name/in/intelephense/package-lock.json | 374 +++++++++++-------
 pkgs/by-name/in/intelephense/package.nix      |   6 +-
 2 files changed, 225 insertions(+), 155 deletions(-)

diff --git a/pkgs/by-name/in/intelephense/package-lock.json b/pkgs/by-name/in/intelephense/package-lock.json
index 0a4d34dffaf5..66b106df25bd 100644
--- a/pkgs/by-name/in/intelephense/package-lock.json
+++ b/pkgs/by-name/in/intelephense/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "intelephense",
-  "version": "1.16.1",
+  "version": "1.16.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "intelephense",
-      "version": "1.16.1",
+      "version": "1.16.5",
       "license": "SEE LICENSE IN LICENSE.txt",
       "dependencies": {
         "@bmewburn/js-beautify": "1.15.2",
@@ -198,9 +198,9 @@
       }
     },
     "node_modules/@azure/opentelemetry-instrumentation-azure-sdk/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.5.1.tgz",
+      "integrity": "sha512-Dwlc+3HAZqpgTYq0MUyZABjFkcrKTePwuiFVLjahGD8cx3enqihmpAmdgNFO1R4m/sIe5afjJrA25Prqy4NXlA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@opentelemetry/semantic-conventions": "^1.29.0"
@@ -233,13 +233,13 @@
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.28.5.tgz",
-      "integrity": "sha512-KKBU1VGYR7ORr3At5HAtUQ+TV3SzRCXmA/8OdDZiLDBIZxVyzXuztPjfLd3BV1PRAQGCMWWSHYhL0F8d5uHBDQ==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz",
+      "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.28.5"
+        "@babel/types": "^7.29.0"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -249,9 +249,9 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.28.5.tgz",
-      "integrity": "sha512-qQ5m48eI/MFLQ5PxQj4PFaprjyCTLI37ElWMmNs0K8Lk3dVeOdNpB3ks8jc7yM5CDmVC73eMVk/trk3fgmrUpA==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
+      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -405,13 +405,13 @@
       }
     },
     "node_modules/@jsdoc/salty": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/@jsdoc/salty/-/salty-0.2.9.tgz",
-      "integrity": "sha512-yYxMVH7Dqw6nO0d5NIV8OQWnitU8k6vXH8NtgqAfIa/IUqRMxRv/NUJJ08VEKbAakwxlgBl5PJdrU0dMPStsnw==",
+      "version": "0.2.10",
+      "resolved": "https://registry.npmjs.org/@jsdoc/salty/-/salty-0.2.10.tgz",
+      "integrity": "sha512-VFHSsQAQp8y1NJvAJBpLs9I2shHE6hz9TwukocDObuUgGVAq62yZGbTgJg04Z3Fj0XSMWe0sJqGg5dhKGTV92A==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "lodash": "^4.17.21"
+        "lodash": "^4.17.23"
       },
       "engines": {
         "node": ">=v12.0.0"
@@ -475,6 +475,7 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
       "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
       "license": "Apache-2.0",
+      "peer": true,
       "engines": {
         "node": ">=8.0.0"
       }
@@ -586,13 +587,13 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-web/-/sdk-trace-web-2.2.0.tgz",
-      "integrity": "sha512-x/LHsDBO3kfqaFx5qSzBljJ5QHsRXrvS4MybBDy1k7Svidb8ZyIPudWVzj3s5LpPkYZIgi9e+7tdsNCnptoelw==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-web/-/sdk-trace-web-2.5.1.tgz",
+      "integrity": "sha512-4PWFtMJ5nqWMP2YqgKjcMlQlUeN1imUYSXdhy6Xl/3bnO0/Ryo5Y3/kWG8T66uMHo2RpTQLloZjoQACKdbHbxg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0"
+        "@opentelemetry/core": "2.5.1",
+        "@opentelemetry/sdk-trace-base": "2.5.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -602,9 +603,9 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.5.1.tgz",
+      "integrity": "sha512-Dwlc+3HAZqpgTYq0MUyZABjFkcrKTePwuiFVLjahGD8cx3enqihmpAmdgNFO1R4m/sIe5afjJrA25Prqy4NXlA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@opentelemetry/semantic-conventions": "^1.29.0"
@@ -617,12 +618,12 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.5.1.tgz",
+      "integrity": "sha512-BViBCdE/GuXRlp9k7nS1w6wJvY5fnFX5XvuEtWsTAOQFIO89Eru7lGW3WbfbxtCuZ/GbrJfAziXG0w0dpxL7eQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
+        "@opentelemetry/core": "2.5.1",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
@@ -633,13 +634,13 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.5.1.tgz",
+      "integrity": "sha512-iZH3Gw8cxQn0gjpOjJMmKLd9GIaNh/E3v3ST67vyzLSxHBs14HsG4dy7jMYyC5WXGdBVEcM7U/XTF5hCQxjDMw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
+        "@opentelemetry/core": "2.5.1",
+        "@opentelemetry/resources": "2.5.1",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
@@ -650,9 +651,9 @@
       }
     },
     "node_modules/@opentelemetry/semantic-conventions": {
-      "version": "1.38.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.38.0.tgz",
-      "integrity": "sha512-kocjix+/sSggfJhwXqClZ3i9Y/MI0fp7b+g7kCRm6psy2dsf8uApTRclwG18h8Avm7C9+fnt+O36PspJ/OzoWg==",
+      "version": "1.39.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.39.0.tgz",
+      "integrity": "sha512-R5R9tb2AXs2IRLNKLBJDynhkfmx7mX0vi8NkhZb3gUkPWHn6HXk5J8iQ/dql0U3ApfWym4kXXmBDRGO+oeOfjg==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=14"
@@ -756,9 +757,9 @@
       }
     },
     "node_modules/@sinonjs/fake-timers": {
-      "version": "13.0.5",
-      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-13.0.5.tgz",
-      "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
+      "version": "15.1.0",
+      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-15.1.0.tgz",
+      "integrity": "sha512-cqfapCxwTGsrR80FEgOoPsTonoefMBY7dnUEbQ+GRcved0jvkJLzvX6F4WtN+HBqbPX/SiFsIRUp+IrCW/2I2w==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -938,6 +939,7 @@
       "integrity": "sha512-promo4eFwuiW+TfGxhi+0x3czqTYJkG8qB17ZUJiVF10Xm7NLVRSLUsfRTU/6h1e24VvRnXCx+hG7li58lkzog==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/linkify-it": "^5",
         "@types/mdurl": "^2"
@@ -968,10 +970,11 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "22.19.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.1.tgz",
-      "integrity": "sha512-LCCV0HdSZZZb34qifBsyWlUmok6W7ouER+oQIGBScS8EsZsQbrtFTUrDX4hOl+CS6p7cnNC4td+qrSVGSCTUfQ==",
+      "version": "22.19.11",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.11.tgz",
+      "integrity": "sha512-BH7YwL6rA93ReqeQS1c4bsPpcfOmJasG+Fkr6Y59q83f9M1WcBRHR2vM+P9eOisYRcN3ujQoiZY8uk5W+1WL8w==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": "~6.21.0"
       }
@@ -1007,9 +1010,9 @@
       "license": "MIT"
     },
     "node_modules/@typespec/ts-http-runtime": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.2.tgz",
-      "integrity": "sha512-IlqQ/Gv22xUC1r/WQm4StLkYQmaaTsXAhUVsNE0+xiyf0yRFiH5++q78U3bw6bLKDCTmh0uqKB9eG9+Bt75Dkg==",
+      "version": "0.3.3",
+      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.3.tgz",
+      "integrity": "sha512-91fp6CAAJSRtH5ja95T1FHSKa8aPW9/Zw6cta81jlZTUw/+Vq8jM/AfF/14h2b71wwR84JUTW/3Y8QPhDAawFA==",
       "license": "MIT",
       "dependencies": {
         "http-proxy-agent": "^7.0.0",
@@ -1293,10 +1296,11 @@
       }
     },
     "node_modules/acorn": {
-      "version": "8.15.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
-      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
+      "version": "8.16.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
+      "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -1337,9 +1341,9 @@
       }
     },
     "node_modules/acorn-walk": {
-      "version": "8.3.4",
-      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.3.4.tgz",
-      "integrity": "sha512-ueEepnujpqee2o5aIYnvHU6C0A42MNdsIDeqy5BydrkuC5R1ZuUFnm27EeFJGoEHJQgn3uleRvmTXaJgfXbt4g==",
+      "version": "8.3.5",
+      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.3.5.tgz",
+      "integrity": "sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1362,11 +1366,12 @@
       }
     },
     "node_modules/ajv": {
-      "version": "8.17.1",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
-      "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==",
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
+      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
         "fast-uri": "^3.0.1",
@@ -1562,19 +1567,22 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.8.30",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.8.30.tgz",
-      "integrity": "sha512-aTUKW4ptQhS64+v2d6IkPzymEzzhw+G0bA1g3uBRV3+ntkH+svttKseW5IOR4Ed6NUVKqnY7qT3dKvzQ7io4AA==",
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.0.tgz",
+      "integrity": "sha512-lIyg0szRfYbiy67j9KN8IyeD7q7hcmqnJ1ddWmNt19ItGpNN64mnllmxUNFIOdOm6by97jlL6wfpTTJrmnjWAA==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/basic-ftp": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.0.5.tgz",
-      "integrity": "sha512-4Bcg1P8xhUuqcii/S0Z9wiHIrQVPMermM1any+MX5GeGD7faD3/msQUDGLol9wOcz4/jbg/WJnGqoJF6LiBdtg==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.0.tgz",
+      "integrity": "sha512-VoMINM2rqJwJgfdHq6RiUudKt2BV+FY5ZFezP/ypmwayk68+NzzAQy4XXLlqsGD4MCzq3DrmNFD/uUmBJuGoXw==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -1616,9 +1624,9 @@
       "license": "ISC"
     },
     "node_modules/browserslist": {
-      "version": "4.28.0",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.0.tgz",
-      "integrity": "sha512-tbydkR/CxfMwelN0vwdP/pLkDwyAASZ+VfWm4EOwlB6SWhx1sYnWLqo8N5j0rAzPfzfRaxt0mM/4wPU/Su84RQ==",
+      "version": "4.28.1",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
+      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
       "dev": true,
       "funding": [
         {
@@ -1635,12 +1643,13 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
-        "baseline-browser-mapping": "^2.8.25",
-        "caniuse-lite": "^1.0.30001754",
-        "electron-to-chromium": "^1.5.249",
+        "baseline-browser-mapping": "^2.9.0",
+        "caniuse-lite": "^1.0.30001759",
+        "electron-to-chromium": "^1.5.263",
         "node-releases": "^2.0.27",
-        "update-browserslist-db": "^1.1.4"
+        "update-browserslist-db": "^1.2.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -1683,9 +1692,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001756",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001756.tgz",
-      "integrity": "sha512-4HnCNKbMLkLdhJz3TToeVWHSnfJvPaq6vu/eRP0Ahub/07n484XHhBF5AJoSGHdVrS8tKFauUQz8Bp9P7LVx7A==",
+      "version": "1.0.30001774",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001774.tgz",
+      "integrity": "sha512-DDdwPGz99nmIEv216hKSgLD+D4ikHQHjBC/seF98N9CPqRX4M5mSxT9eTV6oyisnJcuzxtZy4n17yKKQYmYQOA==",
       "dev": true,
       "funding": [
         {
@@ -1717,9 +1726,9 @@
       }
     },
     "node_modules/chai": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.1.tgz",
-      "integrity": "sha512-p4Z49OGG5W/WBCPSS/dH3jQ73kD6tiMmUM+bckNK6Jr5JHMG3k9bg/BvKR8lKmtVBKmOiuVaV2ws8s9oSbwysg==",
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2119,6 +2128,7 @@
       "resolved": "https://registry.npmjs.org/diagnostic-channel/-/diagnostic-channel-1.1.1.tgz",
       "integrity": "sha512-r2HV5qFkUICyoaKlBEpLKHjxMXATUf/l+h8UZPGBHGLy4DDiY2sOLcIctax4eRnTw5wH2jTMExLntGPJ8eOJxw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "semver": "^7.5.3"
       }
@@ -2236,9 +2246,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.259",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.259.tgz",
-      "integrity": "sha512-I+oLXgpEJzD6Cwuwt1gYjxsDmu/S/Kd41mmLA3O+/uH2pFRO/DvOjUyGozL8j3KeLV6WyZ7ssPwELMsXCcsJAQ==",
+      "version": "1.5.302",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.302.tgz",
+      "integrity": "sha512-sM6HAN2LyK82IyPBpznDRqlTQAtuSaO+ShzFiWTvoMJLHyZ+Y39r8VMfHzwbU8MVBzQ4Wdn85+wlZl2TLGIlwg==",
       "dev": true,
       "license": "ISC"
     },
@@ -2258,14 +2268,14 @@
       "license": "MIT"
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.18.3",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.18.3.tgz",
-      "integrity": "sha512-d4lC8xfavMeBjzGr2vECC3fsGXziXZQyJxD868h2M/mBI3PwAuODxAkLkq5HYuvrPYcUtiLzsTo8U3PgX3Ocww==",
+      "version": "5.19.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.19.0.tgz",
+      "integrity": "sha512-phv3E1Xl4tQOShqSte26C7Fl84EwUdZsyOuSSk9qtAGyyQs2s3jJzComh+Abf4g187lUUAvH+H26omrqia2aGg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.4",
-        "tapable": "^2.2.0"
+        "tapable": "^2.3.0"
       },
       "engines": {
         "node": ">=10.13.0"
@@ -2284,9 +2294,9 @@
       }
     },
     "node_modules/envinfo": {
-      "version": "7.20.0",
-      "resolved": "https://registry.npmjs.org/envinfo/-/envinfo-7.20.0.tgz",
-      "integrity": "sha512-+zUomDcLXsVkQ37vUqWBvQwLaLlj8eZPSi61llaEFAVBY5mhcXdaSw1pSJVl4yTYD5g/gEfpNl28YYk4IPvrrg==",
+      "version": "7.21.0",
+      "resolved": "https://registry.npmjs.org/envinfo/-/envinfo-7.21.0.tgz",
+      "integrity": "sha512-Lw7I8Zp5YKHFCXL7+Dz95g4CcbMEpgvqZNNq3AmlT5XAV6CgAAk6gyAMqn2zjw08K9BHfcNuKrMiCPLByGafow==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -2583,9 +2593,9 @@
       }
     },
     "node_modules/fastq": {
-      "version": "1.19.1",
-      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.19.1.tgz",
-      "integrity": "sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==",
+      "version": "1.20.1",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
+      "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==",
       "license": "ISC",
       "dependencies": {
         "reusify": "^1.0.4"
@@ -2663,9 +2673,9 @@
       }
     },
     "node_modules/fs-extra": {
-      "version": "11.3.2",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.2.tgz",
-      "integrity": "sha512-Xr9F6z6up6Ws+NjzMCZc6WXg2YFRlrLP9NQDO3VQrWrfiojdhS56TzueT88ze0uBdCTwEIhQ3ptnmKeWGFAe0A==",
+      "version": "11.3.3",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.3.tgz",
+      "integrity": "sha512-VWSRii4t0AFm6ixFFmLLx1t7wS1gh+ckoa84aOeapGum0h+EZd1EhEumSB+ZdDLnEPuucsVB9oB7cxJHap6Afg==",
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.0",
@@ -2757,6 +2767,7 @@
       "version": "10.5.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
       "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "license": "ISC",
       "dependencies": {
         "foreground-child": "^3.1.0",
@@ -2793,13 +2804,34 @@
       "dev": true,
       "license": "BSD-2-Clause"
     },
+    "node_modules/glob/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/glob/node_modules/brace-expansion": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
+      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.8",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.8.tgz",
+      "integrity": "sha512-reYkDYtj/b19TeqbNZCV4q9t+Yxylf/rYBsLb42SXJatTv4/ylq5lEiAmhA/IToxO7NI2UzNMghHoHuaqDkAjw==",
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -3351,9 +3383,9 @@
       }
     },
     "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.17.23",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
       "dev": true,
       "license": "MIT"
     },
@@ -3381,10 +3413,10 @@
       "license": "Apache-2.0"
     },
     "node_modules/lru-cache": {
-      "version": "11.2.2",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.2.tgz",
-      "integrity": "sha512-F9ODfyqML2coTIsQpSkRHnLSZMtkU8Q+mSfcaIyKwy58u+8k5nvAYeiNhsyMARvzNcXJ9QfWVrcPsC9e9rAxtg==",
-      "license": "ISC",
+      "version": "11.2.6",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.6.tgz",
+      "integrity": "sha512-ESL2CrkS/2wTPfuend7Zhkzo2u0daGJ/A2VucJOgQ/C48S/zB8MMeMHSGKYpXhIjbPxfuezITkaBH1wqv00DDQ==",
+      "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
       }
@@ -3397,11 +3429,12 @@
       "license": "ISC"
     },
     "node_modules/markdown-it": {
-      "version": "14.1.0",
-      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.0.tgz",
-      "integrity": "sha512-a54IwgWPaeBCAAsv13YgmALOF1elABB08FxO9i+r4VFk5Vl4pKokRPeX8u5TCgSsPi6ec1otfLjdOpVcgbpshg==",
+      "version": "14.1.1",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.1.tgz",
+      "integrity": "sha512-BuU2qnTti9YKgK5N+IeMubp14ZUKUUw7yeJbkjtosvHiP0AZ5c8IAgEMk79D0eC8F23r4Ac/q8cAIFdm2FtyoA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "argparse": "^2.0.1",
         "entities": "^4.4.0",
@@ -3530,10 +3563,10 @@
       }
     },
     "node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-      "license": "ISC",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=16 || 14 >=14.17"
       }
@@ -3588,14 +3621,37 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/mocha/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/mocha/node_modules/brace-expansion": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
+      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/mocha/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.8",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.8.tgz",
+      "integrity": "sha512-reYkDYtj/b19TeqbNZCV4q9t+Yxylf/rYBsLb42SXJatTv4/ylq5lEiAmhA/IToxO7NI2UzNMghHoHuaqDkAjw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -3985,6 +4041,7 @@
       "integrity": "sha512-CvexbZtbov6jW2eXAvLukXjXUW1TzFaivC46BpWc/3BpcCysb5Vffu+B3XHMm8lVEuy2Mm4XGex8hBSg1yapPg==",
       "hasInstallScript": true,
       "license": "BSD-3-Clause",
+      "peer": true,
       "dependencies": {
         "@protobufjs/aspromise": "^1.1.2",
         "@protobufjs/base64": "^1.1.2",
@@ -4036,7 +4093,7 @@
       "version": "8.1.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-8.1.0.tgz",
       "integrity": "sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -4054,9 +4111,9 @@
       }
     },
     "node_modules/protobufjs-cli/node_modules/minimatch": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -4376,9 +4433,9 @@
       }
     },
     "node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -4450,16 +4507,16 @@
       }
     },
     "node_modules/sinon": {
-      "version": "21.0.0",
-      "resolved": "https://registry.npmjs.org/sinon/-/sinon-21.0.0.tgz",
-      "integrity": "sha512-TOgRcwFPbfGtpqvZw+hyqJDvqfapr1qUlOizROIk4bBLjlsjlB00Pg6wMFXNtJRpu+eCZuVOaLatG7M8105kAw==",
+      "version": "21.0.1",
+      "resolved": "https://registry.npmjs.org/sinon/-/sinon-21.0.1.tgz",
+      "integrity": "sha512-Z0NVCW45W8Mg5oC/27/+fCqIHFnW8kpkFOq0j9XJIev4Ld0mKmERaZv5DMLAb9fGCevjKwaEeIQz5+MBXfZcDw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
         "@sinonjs/commons": "^3.0.1",
-        "@sinonjs/fake-timers": "^13.0.5",
-        "@sinonjs/samsam": "^8.0.1",
-        "diff": "^7.0.0",
+        "@sinonjs/fake-timers": "^15.1.0",
+        "@sinonjs/samsam": "^8.0.3",
+        "diff": "^8.0.2",
         "supports-color": "^7.2.0"
       },
       "funding": {
@@ -4467,6 +4524,16 @@
         "url": "https://opencollective.com/sinon"
       }
     },
+    "node_modules/sinon/node_modules/diff": {
+      "version": "8.0.3",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.3.tgz",
+      "integrity": "sha512-qejHi7bcSD4hQAZE0tNAawRK1ZtafHDmMTMkrrIGgSLl7hTnQHmKCeB45xAcbfTqK2zowkM3j3bHt/4b/ARbYQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.3.1"
+      }
+    },
     "node_modules/sinon/node_modules/supports-color": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
@@ -4706,9 +4773,9 @@
       }
     },
     "node_modules/terser": {
-      "version": "5.44.1",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.44.1.tgz",
-      "integrity": "sha512-t/R3R/n0MSwnnazuPpPNVO60LX0SKL45pyl9YlvxIdkH0Of7D5qM2EVe+yASRIlY5pZ73nclYJfNANGWPwFDZw==",
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.46.0.tgz",
+      "integrity": "sha512-jTwoImyr/QbOWFFso3YoU3ik0jBBDJ6JTOQiy/J2YxVJdZCc+5u7skhNwiOR3FQIygFqVUPHl7qbbxtjW2K3Qg==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -4725,9 +4792,9 @@
       }
     },
     "node_modules/terser-webpack-plugin": {
-      "version": "5.3.14",
-      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.14.tgz",
-      "integrity": "sha512-vkZjpUjb6OMS7dhV+tILUW6BhpDR7P2L/aQSAv+Uwk+m8KATX9EccViHTJR2qDtACKPIYndLGCyl3FMo+r2LMw==",
+      "version": "5.3.16",
+      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.16.tgz",
+      "integrity": "sha512-h9oBFCWrq78NyWWVcSwZarJkZ01c2AyGrzs1crmHZO3QUg9D61Wu4NPjBy69n7JqylFF5y+CsUZYmYEIZ3mR+Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4807,6 +4874,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -4912,9 +4980,9 @@
       }
     },
     "node_modules/ts-node/node_modules/diff": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.2.tgz",
-      "integrity": "sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.4.tgz",
+      "integrity": "sha512-X07nttJQkwkfKfvTPG/KSnE2OMdcUCao6+eXF3wmnIQRn2aPAHH3VxDbDOdegkd6JbPsXqShpvEOHfAT+nCNwQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -4970,6 +5038,7 @@
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -4999,9 +5068,9 @@
       }
     },
     "node_modules/underscore": {
-      "version": "1.13.7",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.7.tgz",
-      "integrity": "sha512-GMXzWtsc57XAtguZgaQViUOzs0KTkk8ojr3/xAxXLITqf/3EMwxC0inyETfDFjH/Krbhuep0HNbbjI9i/q3F3g==",
+      "version": "1.13.8",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.8.tgz",
+      "integrity": "sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -5021,9 +5090,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.4.tgz",
-      "integrity": "sha512-q0SPT4xyU84saUX+tomz1WLkxUbuaJnR1xWt17M7fJtEJigJeWUNGUqrauFXsHnqev9y9JTRGwk13tFBuKby4A==",
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
+      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
       "dev": true,
       "funding": [
         {
@@ -5068,9 +5137,9 @@
       "license": "MIT"
     },
     "node_modules/vscode-css-languageservice": {
-      "version": "6.3.8",
-      "resolved": "https://registry.npmjs.org/vscode-css-languageservice/-/vscode-css-languageservice-6.3.8.tgz",
-      "integrity": "sha512-dBk/9ullEjIMbfSYAohGpDOisOVU1x2MQHOeU12ohGJQI7+r0PCimBwaa/pWpxl/vH4f7ibrBfxIZY3anGmHKQ==",
+      "version": "6.3.10",
+      "resolved": "https://registry.npmjs.org/vscode-css-languageservice/-/vscode-css-languageservice-6.3.10.tgz",
+      "integrity": "sha512-eq5N9Er3fC4vA9zd9EFhyBG90wtCCuXgRSpAndaOgXMh1Wgep5lBgRIeDgjZBW9pa+332yC9+49cZMW8jcL3MA==",
       "license": "MIT",
       "dependencies": {
         "@vscode/l10n": "^0.0.18",
@@ -5080,9 +5149,9 @@
       }
     },
     "node_modules/vscode-html-languageservice": {
-      "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/vscode-html-languageservice/-/vscode-html-languageservice-5.6.0.tgz",
-      "integrity": "sha512-FIVz83oGw2tBkOr8gQPeiREInnineCKGCz3ZD1Pi6opOuX3nSRkc4y4zLLWsuop+6ttYX//XZCI6SLzGhRzLmA==",
+      "version": "5.6.2",
+      "resolved": "https://registry.npmjs.org/vscode-html-languageservice/-/vscode-html-languageservice-5.6.2.tgz",
+      "integrity": "sha512-ulCrSnFnfQ16YzvwnYUgEbUEl/ZG7u2eV27YhvLObSHKkb8fw1Z9cgsnUwjTEeDIdJDoTDTDpxuhQwoenoLNMg==",
       "license": "MIT",
       "dependencies": {
         "@vscode/l10n": "^0.0.18",
@@ -5141,9 +5210,9 @@
       "license": "MIT"
     },
     "node_modules/watchpack": {
-      "version": "2.4.4",
-      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.4.tgz",
-      "integrity": "sha512-c5EGNOiyxxV5qmTtAB7rbiXxi1ooX1pQKMLX/MIabJjRA0SJBQOjKF+KSVfHkr9U1cADPon0mRiVe/riyaiDUA==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.1.tgz",
+      "integrity": "sha512-Zn5uXdcFNIA1+1Ei5McRd+iRzfhENPCe7LeABkJtNulSxjma+l7ltNx55BWZkRlwRnpOgHqxnjyaDgJnNXnqzg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5160,6 +5229,7 @@
       "integrity": "sha512-7h/weGm9d/ywQ6qzJ+Xy+r9n/3qgp/thalBbpOi5i223dPXKi04IBtqPN9nTd+jBc7QKfvDbaBnFipYp4sJAUQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/eslint-scope": "^3.7.7",
         "@types/estree": "^1.0.8",
@@ -5272,9 +5342,9 @@
       }
     },
     "node_modules/webpack-sources": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.3.3.tgz",
-      "integrity": "sha512-yd1RBzSGanHkitROoPFd6qsrxt+oFhg/129YzheDGqeustzX0vTZJZsSsQjVQC4yzBQ56K55XU8gaNCtIzOnTg==",
+      "version": "3.3.4",
+      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.3.4.tgz",
+      "integrity": "sha512-7tP1PdV4vF+lYPnkMR0jMY5/la2ub5Fc/8VQrrU+lXkiM6C4TjVfGw7iKfyhnTQOsD+6Q/iKw0eFciziRgD58Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/pkgs/by-name/in/intelephense/package.nix b/pkgs/by-name/in/intelephense/package.nix
index 0383ce4147d2..8941e7675c29 100644
--- a/pkgs/by-name/in/intelephense/package.nix
+++ b/pkgs/by-name/in/intelephense/package.nix
@@ -4,7 +4,7 @@
   fetchurl,
 }:
 let
-  version = "1.16.1";
+  version = "1.16.5";
 in
 buildNpmPackage {
   pname = "intelephense";
@@ -12,14 +12,14 @@ buildNpmPackage {
 
   src = fetchurl {
     url = "https://registry.npmjs.org/intelephense/-/intelephense-${version}.tgz";
-    hash = "sha256-hbKl0kCdqGnVMJvGeWgz8ivQnpS9qzyLUwToQQQ7uMY=";
+    hash = "sha256-Qqc5canlBafwCeLxquT+K3MdH5SqdZVuYBZNfinAXIk=";
   };
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
   '';
 
-  npmDepsHash = "sha256-gzalO/qXD2ZXXeb3FmzIWBbHpeBrQcNcu2j4udmsZvc=";
+  npmDepsHash = "sha256-BKnv65e+BgJrBKQ2J1glvfbd0Gt3BF9shgGDk9cNWcQ=";
 
   dontNpmBuild = true;
 

From 73be0fe9758ea09c193a086dc9358a6597d49c45 Mon Sep 17 00:00:00 2001
From: Swastik <swstkbaranwal@gmail.com>
Date: Sun, 8 Mar 2026 01:47:08 +0530
Subject: [PATCH 79/95] vlang: 0.4.11 -> 0.5

---
 pkgs/by-name/vl/vlang/package.nix | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/vl/vlang/package.nix b/pkgs/by-name/vl/vlang/package.nix
index ef330235d743..3c9b30ee5e2f 100644
--- a/pkgs/by-name/vl/vlang/package.nix
+++ b/pkgs/by-name/vl/vlang/package.nix
@@ -16,7 +16,7 @@
 }:
 
 let
-  version = "0.4.11";
+  version = "0.5";
   ptraceSubstitution = ''
     #include <sys/types.h>
     #include <sys/ptrace.h>
@@ -25,12 +25,12 @@ let
   # So we fix its rev to correspond to the V version.
   vc = stdenv.mkDerivation {
     pname = "v.c";
-    version = "0.4.11";
+    version = "0.5";
     src = fetchFromGitHub {
       owner = "vlang";
       repo = "vc";
-      rev = "a17f1105aa18b604ed8dac8fa5ca9424362c6e15";
-      hash = "sha256-DAsVr1wtRfGbKO74Vfq7ejci+zQabSWeir8njbHYV3o=";
+      rev = "294bff4ef87427743d0b35c0f7eb1b34a6dd061b";
+      hash = "sha256-NZR9Sxa9+iI0hGjB7Hwxl24K0Ra6ZJiUTk9yHp1J7kw=";
     };
 
     # patch the ptrace reference for darwin
@@ -63,7 +63,7 @@ stdenv.mkDerivation {
     owner = "vlang";
     repo = "v";
     rev = version;
-    hash = "sha256-K5B/fjdCYLE14LPg3ccS+sGC8CS7jZiuuxYkHvljGFA=";
+    hash = "sha256-iS9tXeEsEjxEpgJNjz/08MQfZkSfFZWHy0CMurITr+E=";
   };
 
   propagatedBuildInputs = [
@@ -107,6 +107,11 @@ stdenv.mkDerivation {
     ln -s $out/lib/v $out/bin/v
     wrapProgram $out/bin/v --prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}
 
+    # gen_vc is a V-maintainer tool for pushing bootstrap C files to the vc
+    # repo; it requires network/SSH access and a v.mod root that doesn't exist
+    # in the installed layout, so it cannot be built in the Nix sandbox.
+    rm $out/lib/cmd/tools/gen_vc.v
+
     mkdir -p $HOME/.vmodules;
     ln -sf ${markdown} $HOME/.vmodules/markdown
     $out/lib/v -v build-tools
@@ -120,6 +125,7 @@ stdenv.mkDerivation {
 
   meta = {
     homepage = "https://vlang.io/";
+    changelog = "https://github.com/vlang/v/releases/tag/${version}";
     description = "Simple, fast, safe, compiled language for developing maintainable software";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [

From 2e66a7f937e8e9e18b9be1289a4db246f0daf504 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 4 Mar 2026 21:01:38 +0000
Subject: [PATCH 80/95] python3Packages.langchain-core: 1.2.12 -> 1.2.17

---
 .../python-modules/langchain-core/default.nix     | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index 1ce07affc04d..c2b31f9710ff 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -21,7 +21,6 @@
   blockbuster,
   freezegun,
   grandalf,
-  httpx,
   langchain-core,
   langchain-tests,
   numpy,
@@ -35,19 +34,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-core";
-  version = "1.2.12";
+  version = "1.2.17";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-core==${version}";
-    hash = "sha256-KSZhuABk5OpfJ1e1/h/Vr7RA5f9eSK7VBJKaJ5i6xv4=";
+    tag = "langchain-core==${finalAttrs.version}";
+    hash = "sha256-vuMVNRQSgj3o1KRBgspUglLECPF+YYWpH4/e5iE8ZYY=";
   };
 
-  sourceRoot = "${src.name}/libs/core";
+  sourceRoot = "${finalAttrs.src.name}/libs/core";
 
   build-system = [ hatchling ];
 
@@ -136,11 +135,11 @@ buildPythonPackage rec {
   meta = {
     description = "Building applications with LLMs through composability";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/core";
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       natsukium
       sarahec
     ];
   };
-}
+})

From 33d75cef6d48f60663ee320cf17e107d5430e0ef Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 4 Mar 2026 21:00:03 +0000
Subject: [PATCH 81/95] python3Packages.langchain: 1.2.7 -> 1.2.10

---
 .../python-modules/langchain/default.nix      | 24 +++++++------------
 1 file changed, 9 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index 1282a6a0c1a6..cb439c307d79 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -30,6 +30,7 @@
   runtimeShell,
 
   # tests
+  blockbuster,
   langchain-tests,
   pytest-asyncio,
   pytest-mock,
@@ -43,19 +44,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain";
-  version = "1.2.7";
+  version = "1.2.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain==${version}";
-    hash = "sha256-vwd8FoXeMLQyFcEViXx/3LqpNieyp4HHevMAv2AxNVY=";
+    tag = "langchain==${finalAttrs.version}";
+    hash = "sha256-Icgka7z1wLuxEjUO5baxMya7KfltYsK8TXtCMg73E1Q=";
   };
 
-  sourceRoot = "${src.name}/libs/langchain_v1";
+  sourceRoot = "${finalAttrs.src.name}/libs/langchain_v1";
 
   postPatch = ''
     substituteInPlace langchain/agents/middleware/shell_tool.py \
@@ -64,14 +65,6 @@ buildPythonPackage rec {
 
   build-system = [ hatchling ];
 
-  pythonRelaxDeps = [
-    # Each component release requests the exact latest core.
-    # That prevents us from updating individual components.
-    "langchain-core"
-    "numpy"
-    "tenacity"
-  ];
-
   dependencies = [
     langchain-core
     langgraph
@@ -98,6 +91,7 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
+    blockbuster
     langchain-tests
     # langchain-openai -- causes recursion error
     pytest-asyncio
@@ -150,11 +144,11 @@ buildPythonPackage rec {
   meta = {
     description = "Building applications with LLMs through composability";
     homepage = "https://github.com/langchain-ai/langchain";
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       natsukium
       sarahec
     ];
   };
-}
+})

From 37113a9b76df916ce9ab7cb474c6d765da7b765d Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 4 Mar 2026 21:00:18 +0000
Subject: [PATCH 82/95] python3Packages.langchain-anthropic: 1.3.3 -> 1.3.4

---
 .../python-modules/langchain-anthropic/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-anthropic/default.nix b/pkgs/development/python-modules/langchain-anthropic/default.nix
index f925977727d5..3ca06b41a74d 100644
--- a/pkgs/development/python-modules/langchain-anthropic/default.nix
+++ b/pkgs/development/python-modules/langchain-anthropic/default.nix
@@ -22,19 +22,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-anthropic";
-  version = "1.3.3";
+  version = "1.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-anthropic==${version}";
-    hash = "sha256-vQ2h92oP3gpSEu3HjQUF+1KWX9gm4Q7osTynu77UlvA=";
+    tag = "langchain-anthropic==${finalAttrs.version}";
+    hash = "sha256-8dGP26N2aheMTtI2wYMBVitlzrTsJZa5Zt5xVl+vqI4=";
   };
 
-  sourceRoot = "${src.name}/libs/partners/anthropic";
+  sourceRoot = "${finalAttrs.src.name}/libs/partners/anthropic";
 
   build-system = [ hatchling ];
 
@@ -72,7 +72,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain-anthropic/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain-anthropic/releases/tag/${finalAttrs.src.tag}";
     description = "Build LangChain applications with Anthropic";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/partners/anthropic";
     license = lib.licenses.mit;
@@ -80,4 +80,4 @@ buildPythonPackage rec {
       lib.maintainers.sarahec
     ];
   };
-}
+})

From 63176180ab02c9c845609da7c7abed094e212370 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 7 Mar 2026 12:04:52 -0800
Subject: [PATCH 83/95] python3Packages.langchain-classic: 1.0.1 -> 1.0.2

---
 .../langchain-classic/default.nix               | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-classic/default.nix b/pkgs/development/python-modules/langchain-classic/default.nix
index b6302540fc5d..4484a351fae5 100644
--- a/pkgs/development/python-modules/langchain-classic/default.nix
+++ b/pkgs/development/python-modules/langchain-classic/default.nix
@@ -40,27 +40,22 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-classic";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-classic==${version}";
-    hash = "sha256-4DlKOxt5OoPm38szMEJpw6gDl247eRsx4LZpofUKpUk=";
+    tag = "langchain-classic==${finalAttrs.version}";
+    hash = "sha256-NH2l2Htt5nAzzvwKUgQNwvQBLxZKhOLxnxthvK/Yh4I=";
   };
 
-  sourceRoot = "${src.name}/libs/langchain";
+  sourceRoot = "${finalAttrs.src.name}/libs/langchain";
 
   build-system = [ hatchling ];
 
-  pythonRelaxDeps = [
-    # Each component release requests the exact latest core.
-    "langchain-core"
-  ];
-
   dependencies = [
     langchain-core
     langchain-text-splitters
@@ -121,4 +116,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sarahec ];
   };
-}
+})

From cb8f9bcd3c2ae74147a33f36a12d73cc7cfd9fd5 Mon Sep 17 00:00:00 2001
From: Vinetos <contact+git@vinetos.fr>
Date: Sat, 7 Mar 2026 21:32:47 +0100
Subject: [PATCH 84/95] python3Packages.python-openstackclient: enable bash
 completion

---
 .../python-modules/python-openstackclient/default.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/python-modules/python-openstackclient/default.nix b/pkgs/development/python-modules/python-openstackclient/default.nix
index bc21af90799d..a3f49b0f63a3 100644
--- a/pkgs/development/python-modules/python-openstackclient/default.nix
+++ b/pkgs/development/python-modules/python-openstackclient/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   ddt,
+  installShellFiles,
   openstackdocstheme,
   osc-lib,
   osc-placement,
@@ -27,6 +28,7 @@
   setuptools,
   sphinxHook,
   sphinxcontrib-apidoc,
+  stdenv,
   stestrCheckHook,
   versionCheckHook,
 }:
@@ -68,6 +70,10 @@ buildPythonPackage (finalAttrs: {
   # to support proxy envs like ALL_PROXY in requests
   ++ requests.optional-dependencies.socks;
 
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
   nativeCheckInputs = [
     ddt
     requests-mock
@@ -116,6 +122,11 @@ buildPythonPackage (finalAttrs: {
   ];
   doInstallCheck = true;
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd openstack \
+      --bash <($out/bin/openstack complete)
+  '';
+
   meta = {
     description = "OpenStack Command-line Client";
     mainProgram = "openstack";

From 5407eaec288c8c8aec57c2fb9fd670fb9f3f3a4f Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 4 Mar 2026 21:01:20 +0000
Subject: [PATCH 85/95] python3Packages.langchain-aws: 1.2.5 -> 1.3.1

---
 .../python-modules/langchain-aws/default.nix  | 34 ++++++++++++-------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-aws/default.nix b/pkgs/development/python-modules/langchain-aws/default.nix
index 3581dfa14354..a1b15105683a 100644
--- a/pkgs/development/python-modules/langchain-aws/default.nix
+++ b/pkgs/development/python-modules/langchain-aws/default.nix
@@ -12,6 +12,10 @@
   numpy,
   pydantic,
 
+  # optional-dependencies
+  langchain-anthropic,
+  anthropic,
+
   # tests
   langchain-tests,
   pytest-asyncio,
@@ -22,16 +26,16 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-aws";
-  version = "1.2.5";
+  version = "1.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-aws";
-    tag = "langchain-aws==${version}";
-    hash = "sha256-mOK7rTDJPU4eS5jCzQ+yUDl2fkY3x4Mpl5bGEF3eLFc=";
+    tag = "langchain-aws==${finalAttrs.version}";
+    hash = "sha256-hKMTzN2NVMSMCVsFroFFUM0embz8KHbDnmunwOb9ofw=";
   };
 
   postPatch = ''
@@ -39,7 +43,7 @@ buildPythonPackage rec {
       --replace-fail "--snapshot-warn-unused" ""
   '';
 
-  sourceRoot = "${src.name}/libs/aws";
+  sourceRoot = "${finalAttrs.src.name}/libs/aws";
 
   build-system = [ hatchling ];
 
@@ -51,19 +55,25 @@ buildPythonPackage rec {
   ];
 
   pythonRelaxDeps = [
-    # Boto @ 1.35 has outstripped the version requirement
+    # Boto3 spec has outstripped the version requirement
     "boto3"
-    # Each component release requests the exact latest core.
-    # That prevents us from updating individual components.
-    "langchain-core"
   ];
 
+  optional-dependencies = {
+    anthropic = [
+      anthropic.optional-dependencies.bedrock
+      langchain-anthropic
+    ];
+  };
+
   nativeCheckInputs = [
+    anthropic
     langchain-tests
     pytest-asyncio
     pytest-cov-stub
     pytestCheckHook
-  ];
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   enabledTestPaths = [ "tests/unit_tests" ];
 
@@ -83,7 +93,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain-aws/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain-aws/releases/tag/${finalAttrs.src.tag}";
     description = "Build LangChain application on AWS";
     homepage = "https://github.com/langchain-ai/langchain-aws/";
     license = lib.licenses.mit;
@@ -92,4 +102,4 @@ buildPythonPackage rec {
       sarahec
     ];
   };
-}
+})

From cc78f717df03d9586a9c3d1f788d98e7f1e19637 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 4 Mar 2026 21:01:55 +0000
Subject: [PATCH 86/95] python3Packages.langchain-tests: 1.1.2 -> 1.1.5

---
 .../python-modules/langchain-tests/default.nix     | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-tests/default.nix b/pkgs/development/python-modules/langchain-tests/default.nix
index bb08244095a2..28add86608d3 100644
--- a/pkgs/development/python-modules/langchain-tests/default.nix
+++ b/pkgs/development/python-modules/langchain-tests/default.nix
@@ -26,19 +26,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-tests";
-  version = "1.1.2";
+  version = "1.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-tests==${version}";
-    hash = "sha256-g5s7zL4l/kIUoIu7/3+Ve3SXW3O9tj8f2N3bZ0gbBts=";
+    tag = "langchain-tests==${finalAttrs.version}";
+    hash = "sha256-HyPJ3binXV3ypksvpyz1t6B1Zdz3NY6z4Ttq7K4yo+g=";
   };
 
-  sourceRoot = "${src.name}/libs/standard-tests";
+  sourceRoot = "${finalAttrs.src.name}/libs/standard-tests";
 
   build-system = [ hatchling ];
 
@@ -84,7 +84,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${finalAttrs.src.tag}";
     description = "Build context-aware reasoning applications";
     homepage = "https://github.com/langchain-ai/langchain";
     license = lib.licenses.mit;
@@ -93,4 +93,4 @@ buildPythonPackage rec {
       sarahec
     ];
   };
-}
+})

From 0e48f6dd12ed2da5ded39d5479533348ba7d1eb0 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 4 Mar 2026 21:02:26 +0000
Subject: [PATCH 87/95] python3Packages.langchain-openai: 1.1.6 -> 1.1.10

---
 .../python-modules/langchain-openai/default.nix    | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-openai/default.nix b/pkgs/development/python-modules/langchain-openai/default.nix
index ca02978305cf..9f1f52625f8e 100644
--- a/pkgs/development/python-modules/langchain-openai/default.nix
+++ b/pkgs/development/python-modules/langchain-openai/default.nix
@@ -31,19 +31,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-openai";
-  version = "1.1.6";
+  version = "1.1.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-openai==${version}";
-    hash = "sha256-Y+GV48rlqMfT4TrmoJFGqbHKfc8gxq61NhcUpwSsOwk=";
+    tag = "langchain-openai==${finalAttrs.version}";
+    hash = "sha256-k0JpzgF+2UaYUbtzOB+NFxq7Ge/eRbT8M4PgvDpRG2g=";
   };
 
-  sourceRoot = "${src.name}/libs/partners/openai";
+  sourceRoot = "${finalAttrs.src.name}/libs/partners/openai";
 
   build-system = [ hatchling ];
 
@@ -100,7 +100,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${finalAttrs.src.tag}";
     description = "Integration package connecting OpenAI and LangChain";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/partners/openai";
     license = lib.licenses.mit;
@@ -109,4 +109,4 @@ buildPythonPackage rec {
       sarahec
     ];
   };
-}
+})

From b9d27eb846b2e90a64824ca9382bcb2657114056 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 4 Mar 2026 21:02:08 +0000
Subject: [PATCH 88/95] python3Packages.langchain-xai: 1.2.1 -> 1.2.2

---
 .../python-modules/langchain-xai/default.nix  | 20 +++++++------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-xai/default.nix b/pkgs/development/python-modules/langchain-xai/default.nix
index 2fd340bbc476..ab01b237473e 100644
--- a/pkgs/development/python-modules/langchain-xai/default.nix
+++ b/pkgs/development/python-modules/langchain-xai/default.nix
@@ -23,19 +23,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-xai";
-  version = "1.2.1";
+  version = "1.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-xai==${version}";
-    hash = "sha256-Eryr68TQDN37AwJVEm1jJvwqcxMjl2KO42dy7doJCrA=";
+    tag = "langchain-xai==${finalAttrs.version}";
+    hash = "sha256-RUklm627HiwMcpKkm+0uWZgHp4iDtSsmEpLb9MxumqI=";
   };
 
-  sourceRoot = "${src.name}/libs/partners/xai";
+  sourceRoot = "${finalAttrs.src.name}/libs/partners/xai";
 
   build-system = [ hatchling ];
 
@@ -46,12 +46,6 @@ buildPythonPackage rec {
     requests
   ];
 
-  pythonRelaxDeps = [
-    # Each component release requests the exact latest core.
-    # That prevents us from updating individual components.
-    "langchain-core"
-  ];
-
   nativeCheckInputs = [
     langchain-tests
     pytest-asyncio
@@ -78,7 +72,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain-xai/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain-xai/releases/tag/${finalAttrs.src.tag}";
     description = "Build LangChain applications with X AI";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/partners/xai";
     license = lib.licenses.mit;
@@ -86,4 +80,4 @@ buildPythonPackage rec {
       lib.maintainers.sarahec
     ];
   };
-}
+})

From dfe5acbfb7c94494f8b191afefd3a0215bf696fd Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 7 Mar 2026 13:04:57 -0800
Subject: [PATCH 89/95] python3Packages.langchain-text-splitters: build fixes

---
 .../langchain-text-splitters/default.nix         | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-text-splitters/default.nix b/pkgs/development/python-modules/langchain-text-splitters/default.nix
index 6e51732c08ad..437270e4ba75 100644
--- a/pkgs/development/python-modules/langchain-text-splitters/default.nix
+++ b/pkgs/development/python-modules/langchain-text-splitters/default.nix
@@ -19,7 +19,7 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-text-splitters";
   version = "1.1.1";
   pyproject = true;
@@ -27,20 +27,14 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-text-splitters==${version}";
+    tag = "langchain-text-splitters==${finalAttrs.version}";
     hash = "sha256-I5eMc/E7sCxEQG8+jw3E/M4uB7adKU5IMHRsS6pacsA=";
   };
 
-  sourceRoot = "${src.name}/libs/text-splitters";
+  sourceRoot = "${finalAttrs.src.name}/libs/text-splitters";
 
   build-system = [ hatchling ];
 
-  pythonRelaxDeps = [
-    # Each component release requests the exact latest core.
-    # That prevents us from updating individual components.
-    "langchain-core"
-  ];
-
   dependencies = [ langchain-core ];
 
   pythonImportsCheck = [ "langchain_text_splitters" ];
@@ -63,7 +57,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${finalAttrs.src.tag}";
     description = "LangChain utilities for splitting into chunks a wide variety of text documents";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/text-splitters";
     license = lib.licenses.mit;
@@ -72,4 +66,4 @@ buildPythonPackage rec {
       sarahec
     ];
   };
-}
+})

From 1871f85bdfa7974da5bd7fcca1034841266d3ccc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 21:20:50 +0000
Subject: [PATCH 90/95] terraform-providers.pagerduty_pagerduty: 3.31.2 ->
 3.31.3

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 86af5c7b5f06..bc91e25c6e32 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1076,11 +1076,11 @@
     "vendorHash": "sha256-F1AuO/dkldEDRvkwrbq2EjByxjg3K2rohZAM4DzKPUw="
   },
   "pagerduty_pagerduty": {
-    "hash": "sha256-UJ5XTAECoZMAcQayespmVFKyv8lJ/9CJIS0bJxn9+S4=",
+    "hash": "sha256-xuy7bc+YRDsEenMRfaCpV6uBAopjYbrCmOFzdowTqYM=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.31.2",
+    "rev": "v3.31.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

From bfdb4e398ce6891a2a297290f67c7fcbef8e64a6 Mon Sep 17 00:00:00 2001
From: ehrenschwan <luca@ehrenschwan.dev>
Date: Thu, 25 Dec 2025 12:10:37 +0100
Subject: [PATCH 91/95] argonaut: init at 2.14.1

argonaut: init at 2.12.0
---
 pkgs/by-name/ar/argonaut/package.nix | 53 ++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 pkgs/by-name/ar/argonaut/package.nix

diff --git a/pkgs/by-name/ar/argonaut/package.nix b/pkgs/by-name/ar/argonaut/package.nix
new file mode 100644
index 000000000000..4625009caec2
--- /dev/null
+++ b/pkgs/by-name/ar/argonaut/package.nix
@@ -0,0 +1,53 @@
+{
+  buildGoModule,
+  lib,
+  fetchFromGitHub,
+  testers,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "argonaut";
+  version = "2.14.1";
+
+  src = fetchFromGitHub {
+    owner = "darksworm";
+    repo = "argonaut";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vD7XDgENQWexNNMq41W0eC0snUA+JUZeXIBTCH1lbks=";
+  };
+
+  vendorHash = "sha256-xln/WmZbi0+rHqMMHRgt0ar/EaBDNscCsd/NckJZnMw=";
+  proxyVendor = true;
+  subPackages = [ "cmd/app" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.appVersion=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.version}"
+    "-X main.buildDate=1970-01-01T00:00:00Z"
+  ];
+
+  doCheck = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  postInstall = ''
+    mv $out/bin/app $out/bin/argonaut
+  '';
+
+  meta = {
+    description = "Keyboard-first terminal UI for Argo CD";
+    homepage = "https://github.com/darksworm/argonaut";
+    changelog = "https://github.com/darksworm/argonaut/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "argonaut";
+    maintainers = with lib.maintainers; [
+      ehrenschwan-gh
+    ];
+  };
+})

From 055bb318b1fef88fdaaf057ac0a31bbf1aa64678 Mon Sep 17 00:00:00 2001
From: org-agenda-api <org-agenda-api@localhost>
Date: Wed, 4 Mar 2026 23:37:22 -0800
Subject: [PATCH 92/95] gws: init at 0.6.3

---
 pkgs/by-name/gw/gws/package.nix | 44 +++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 pkgs/by-name/gw/gws/package.nix

diff --git a/pkgs/by-name/gw/gws/package.nix b/pkgs/by-name/gw/gws/package.nix
new file mode 100644
index 000000000000..1e6d45cc66b8
--- /dev/null
+++ b/pkgs/by-name/gw/gws/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  dbus,
+  apple-sdk_14,
+  darwinMinVersionHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "gws";
+  version = "0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "googleworkspace";
+    repo = "cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8vRBW7RUwHHAvAiF8WahkRh0pH205UiuJloY0DgFwLM=";
+  };
+
+  cargoHash = "sha256-tIJikoRFbUYYlkOjfWoPogoB+yhY80TTtSzEXgSEP8A=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs =
+    lib.optionals stdenv.hostPlatform.isLinux [ dbus ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_14
+      (darwinMinVersionHook "10.15")
+    ];
+
+  doCheck = false;
+
+  meta = {
+    description = "One CLI for all of Google Workspace";
+    homepage = "https://github.com/googleworkspace/cli";
+    changelog = "https://github.com/googleworkspace/cli/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    mainProgram = "gws";
+    maintainers = with lib.maintainers; [ imalison ];
+  };
+})

From 82f035f07779e1f80f1b45954d451b9d5267115e Mon Sep 17 00:00:00 2001
From: Shaun Ren <shaun@sren.org>
Date: Sat, 7 Mar 2026 14:11:01 -0500
Subject: [PATCH 93/95] tinyauth: init at 5.0.1

---
 .../manual/release-notes/rl-2605.section.md   |   2 +
 nixos/modules/module-list.nix                 |   1 +
 nixos/modules/services/security/tinyauth.nix  | 246 ++++++++++++++++++
 nixos/tests/all-tests.nix                     |   1 +
 nixos/tests/tinyauth.nix                      |  31 +++
 pkgs/by-name/ti/tinyauth/package.nix          | 112 ++++++++
 6 files changed, 393 insertions(+)
 create mode 100644 nixos/modules/services/security/tinyauth.nix
 create mode 100644 nixos/tests/tinyauth.nix
 create mode 100644 pkgs/by-name/ti/tinyauth/package.nix

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 9363f4580653..425eb918392e 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -58,6 +58,8 @@
 
 - [Ente Auth](https://ente.io/auth/), an open source 2FA authenticator, with end-to-end encrypted backups. Available as [programs.ente-auth](#opt-programs.ente-auth.enable).
 
+- [Tinyauth](https://tinyauth.app/), a simple authentication middleware for web apps, with OAuth and LDAP support. Available as [services.tinyauth](#opt-services.tinyauth.enable).
+
 - [Dawarich](https://dawarich.app/), a self-hostable location history tracker. Available as [services.dawarich](#opt-services.dawarich.enable).
 
 - [Howdy](https://github.com/boltgolt/howdy), a Windows Hello™ style facial authentication program for Linux.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 75c6a35e5115..532ce6340f05 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1525,6 +1525,7 @@
   ./services/security/step-ca.nix
   ./services/security/tang.nix
   ./services/security/timekpr.nix
+  ./services/security/tinyauth.nix
   ./services/security/tor.nix
   ./services/security/torify.nix
   ./services/security/torsocks.nix
diff --git a/nixos/modules/services/security/tinyauth.nix b/nixos/modules/services/security/tinyauth.nix
new file mode 100644
index 000000000000..3cceabecfb64
--- /dev/null
+++ b/nixos/modules/services/security/tinyauth.nix
@@ -0,0 +1,246 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  inherit (lib)
+    getExe
+    maintainers
+    mapAttrs'
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    nameValuePair
+    optionalAttrs
+    types
+    ;
+
+  cfg = config.services.tinyauth;
+
+  format = pkgs.formats.keyValue { };
+  settingsFile = format.generate "tinyauth-env-vars" (
+    mapAttrs' (name: value: nameValuePair "TINYAUTH_${name}" value) cfg.settings
+  );
+in
+{
+  options.services.tinyauth = {
+    enable = mkEnableOption "Tinyauth server";
+
+    package = mkPackageOption pkgs "tinyauth" { };
+
+    environmentFile = mkOption {
+      type = types.path;
+      description = ''
+        Path to an environment file loaded for Tinyauth.
+
+        This can be used to securely store tokens and secrets outside of the world-readable Nix store.
+
+        Example contents of the file:
+        ```
+        TINYAUTH_AUTH_USERS=user-hash
+        TINYAUTH_OAUTH_PROVIDERS_GOOGLE_CLIENTSECRET=client-secret
+        ```
+      '';
+      default = "/dev/null";
+      example = "/var/lib/secrets/tinyauth";
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = format.type;
+
+        options = {
+          SERVER_ADDRESS = mkOption {
+            type = types.str;
+            description = ''
+              Address to bind the server to.
+            '';
+            default = "0.0.0.0";
+          };
+
+          SERVER_PORT = mkOption {
+            type = types.port;
+            description = ''
+              The port to run the server on.
+            '';
+            default = 3000;
+          };
+
+          APPURL = mkOption {
+            type = types.str;
+            description = ''
+              URL of the app.
+            '';
+            example = "https://auth.example.com";
+          };
+
+          ANALYTICS_ENABLED = mkOption {
+            type = types.bool;
+            description = ''
+              Whether to enable anonymous version collection.
+            '';
+            default = false;
+          };
+
+          RESOURCES_ENABLED = mkOption {
+            type = types.bool;
+            description = ''
+              Whether to enable the resources server.
+            '';
+            default = true;
+          };
+
+          AUTH_LOGINMAXRETRIES = mkOption {
+            type = types.ints.unsigned;
+            description = ''
+              Maximum login attempts before timeout (0 to disable).
+            '';
+            default = 3;
+          };
+
+          AUTH_LOGINTIMEOUT = mkOption {
+            type = types.ints.unsigned;
+            description = ''
+              Login timeout in seconds after max retries reached (0 to disable).
+            '';
+            default = 300;
+          };
+
+          AUTH_TRUSTEDPROXIES = mkOption {
+            type = types.str;
+            description = ''
+              Comma-separated list of trusted proxy addresses.
+            '';
+            default = "";
+          };
+        };
+      };
+
+      default = { };
+
+      description = ''
+        Environment variables that will be passed to Tinyauth.
+        The "TINYAUTH_" prefix will be prepended to the setting names.
+        See [configuration options](https://tinyauth.app/docs/reference/configuration)
+        for supported values.
+      '';
+    };
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/tinyauth";
+      description = ''
+        The directory where Tinyauth will store its data.
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "tinyauth";
+      description = "User account under which Tinyauth runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "tinyauth";
+      description = "Group account under which Tinyauth runs.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.tmpfiles.settings.tinyauth = {
+      "${cfg.dataDir}".d = {
+        mode = "0750";
+        user = cfg.user;
+        group = cfg.group;
+      };
+    };
+
+    systemd.services.tinyauth = {
+      description = "Tinyauth";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [
+        cfg.package
+        cfg.environmentFile
+        settingsFile
+      ];
+
+      environment = {
+        GIN_MODE = "release";
+        TINYAUTH_DATABASE_PATH = "${cfg.dataDir}/tinyauth.db";
+        TINYAUTH_RESOURCES_PATH = "${cfg.dataDir}/resources";
+      };
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        WorkingDirectory = cfg.dataDir;
+        ExecStart = getExe cfg.package;
+        Restart = "always";
+
+        EnvironmentFile = [
+          cfg.environmentFile
+          settingsFile
+        ];
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = "disconnected";
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ReadWritePaths = [ cfg.dataDir ];
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+
+    users.users = optionalAttrs (cfg.user == "tinyauth") {
+      tinyauth = {
+        isSystemUser = true;
+        group = cfg.group;
+        description = "Tinyauth user";
+        home = cfg.dataDir;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == "tinyauth") {
+      tinyauth = { };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ shaunren ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index d9feaf85da01..d89792777cca 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1643,6 +1643,7 @@ in
   timezone = runTest ./timezone.nix;
   timidity = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./timidity { };
   tinc = handleTest ./tinc { };
+  tinyauth = runTest ./tinyauth.nix;
   tinydns = runTest ./tinydns.nix;
   tinyproxy = runTest ./tinyproxy.nix;
   tinywl = runTest ./tinywl.nix;
diff --git a/nixos/tests/tinyauth.nix b/nixos/tests/tinyauth.nix
new file mode 100644
index 000000000000..c5abb3592429
--- /dev/null
+++ b/nixos/tests/tinyauth.nix
@@ -0,0 +1,31 @@
+{ lib, pkgs, ... }:
+
+let
+  port = 3001;
+in
+{
+  name = "tinyauth";
+  meta.maintainers = with lib.maintainers; [ shaunren ];
+
+  nodes.machine = {
+    services.tinyauth = {
+      enable = true;
+      settings = {
+        APPURL = "http://auth.example.com";
+        SERVER_PORT = port;
+        ANALYTICS_ENABLED = false;
+      };
+
+      environmentFile = pkgs.writeText "tinyauth-env" ''
+        TINYAUTH_AUTH_USERS=test:$$2a$$10$$NP5wKRFw5GuVVI.g07zvAucRYk0cyL83WDPVQ81Zai.Xi5tkNvxL6
+      '';
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("tinyauth.service")
+    machine.wait_for_open_port(${toString port})
+
+    machine.succeed("curl -sSf -H Host:auth.example.com http://localhost:${toString port}")
+  '';
+}
diff --git a/pkgs/by-name/ti/tinyauth/package.nix b/pkgs/by-name/ti/tinyauth/package.nix
new file mode 100644
index 000000000000..1dc47be0a486
--- /dev/null
+++ b/pkgs/by-name/ti/tinyauth/package.nix
@@ -0,0 +1,112 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  git,
+  stdenvNoCC,
+  bun,
+  nixosTests,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "tinyauth";
+  version = "5.0.1";
+
+  src = fetchFromGitHub {
+    owner = "steveiliop56";
+    repo = "tinyauth";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-ypM56yrUWF1OzCj5RBGyEhZzjyDcko7SPQ+eVhHEzmA=";
+  };
+
+  vendorHash = "sha256-qELLarAR78WkDoJKtqaqzIZaTBCuHP41JCyjLZ4aMtM=";
+
+  subPackages = [ "cmd/tinyauth" ];
+
+  env.CGO_ENABLED = 0;
+  ldflags = [
+    "-s"
+    "-w"
+    "-X tinyauth/internal/config.Version=v${finalAttrs.version}"
+    "-X tinyauth/internal/config.CommitHash=${finalAttrs.src.rev}"
+  ];
+
+  preBuild = ''
+    cp -r ${finalAttrs.frontend}/dist internal/assets/dist
+  '';
+
+  postPatch = ''
+    ${lib.getExe git} apply --directory paerser/ patches/nested_maps.diff
+  '';
+
+  frontend = stdenvNoCC.mkDerivation {
+    pname = "tinyauth-frontend";
+    inherit (finalAttrs) version src;
+    sourceRoot = "${finalAttrs.src.name}/frontend";
+
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND"
+      "SOCKS_SERVER"
+    ];
+
+    nativeBuildInputs = [
+      bun
+    ];
+
+    configurePhase = ''
+      runHook preConfigure
+
+      bun install --no-progress --frozen-lockfile
+      substituteInPlace node_modules/.bin/{tsc,vite} \
+        --replace-fail "/usr/bin/env node" "${lib.getExe bun}"
+
+      runHook postConfigure
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+
+      bun run build
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/dist
+      cp -r dist $out
+
+      runHook postInstall
+    '';
+
+    outputHashMode = "recursive";
+    outputHash = "sha256-pB94TUwjm5GmEmgjqkr7QH9BoRhKCSbxQVOc+2fCz2c=";
+  };
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) tinyauth;
+    };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "frontend"
+      ];
+    };
+  };
+
+  meta = {
+    description = "Simple authentication middleware for web apps";
+    homepage = "https://tinyauth.app";
+    changelog = "https://github.com/steveiliop56/tinyauth/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "tinyauth";
+    maintainers = with lib.maintainers; [
+      shaunren
+    ];
+    platforms = lib.platforms.unix;
+  };
+})

From 02a237adfc0a9a216e3d4e128a74922409f0be3d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 7 Mar 2026 22:44:22 +0000
Subject: [PATCH 94/95] terraform-providers.cloudflare_cloudflare: 5.17.0 ->
 5.18.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 86af5c7b5f06..93154a24ef3f 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -200,13 +200,13 @@
     "vendorHash": "sha256-w21DXJoylvysubXItM+wvuwD2RdqzoUKNC9zElTedEo="
   },
   "cloudflare_cloudflare": {
-    "hash": "sha256-RuHAVcDK3KPO4I4FG/DodhNiWe63AexTo9IcyTZ360Q=",
+    "hash": "sha256-D5Kk6xCz3CQWbGHjLKU/+SPBzCYFQlphCTMG6+LvFek=",
     "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
     "owner": "cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v5.17.0",
+    "rev": "v5.18.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-Z3qSDIkzD4hs2WREuV06q4GC+qwMvfHvsnze/8c7f20="
+    "vendorHash": "sha256-8d6cnbdPhfc/9B8JUq1HbReOYBauY6SQf3xKqgK1PeQ="
   },
   "cloudfoundry-community_cloudfoundry": {
     "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",

From 57f916ce2813ffb47fec698ef548beb986b119aa Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Sat, 7 Mar 2026 23:52:45 +0100
Subject: [PATCH 95/95] apko: remove emilylange from maintainers

---
 pkgs/by-name/ap/apko/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/ap/apko/package.nix b/pkgs/by-name/ap/apko/package.nix
index 8f825e95c3b8..43da427faabd 100644
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -96,7 +96,6 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       jk
       developer-guy
-      emilylange
     ];
   };
 })