From b8fe0f64255f882f34d2ec115268eb3e35ca3305 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 24 Aug 2025 14:31:56 +0000
Subject: [PATCH 001/129] complgen: 0.4.0 -> 0.5.0

---
 pkgs/by-name/co/complgen/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/complgen/package.nix b/pkgs/by-name/co/complgen/package.nix
index 47bf6e23e9af..a39ece4aa553 100644
--- a/pkgs/by-name/co/complgen/package.nix
+++ b/pkgs/by-name/co/complgen/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "complgen";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "adaszko";
     repo = "complgen";
     rev = "v${version}";
-    hash = "sha256-RSNOpe2VCNw9TJGD7QuuZT9WOdA6AFFcF9AOg4/+94w=";
+    hash = "sha256-GgGFlrAJN9w+bsoXmVJaYUyx/ViH9m4E4EeJlmWRo6o=";
   };
 
-  cargoHash = "sha256-0e3PTetpWjagBuagfkdsNfn1k+rEbzOJJONMXv7G96o=";
+  cargoHash = "sha256-JexvR/djdRGq3BsOWfEhFCbTe3OaP/jqQgiO+RkK1Tg=";
 
   meta = with lib; {
     description = "Generate {bash,fish,zsh} completions from a single EBNF-like grammar";

From 666e126aeba214a1ae3027589b0db5a8d0cfb89c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 Aug 2025 08:23:42 +0000
Subject: [PATCH 002/129] tcpreplay: 4.5.1 -> 4.5.2

---
 pkgs/by-name/tc/tcpreplay/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/tc/tcpreplay/package.nix b/pkgs/by-name/tc/tcpreplay/package.nix
index 00a0f7d429a0..e18bcb914202 100644
--- a/pkgs/by-name/tc/tcpreplay/package.nix
+++ b/pkgs/by-name/tc/tcpreplay/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tcpreplay";
-  version = "4.5.1";
+  version = "4.5.2";
 
   src = fetchurl {
     url = "https://github.com/appneta/tcpreplay/releases/download/v${version}/tcpreplay-${version}.tar.gz";
-    sha256 = "sha256-Leeb/Wfsksqa4v+1BFbdHVP/QPP6cbQixl6AYgE8noU=";
+    sha256 = "sha256-zP87spRpoEzMIO0LUY4+Q8Sntah2M52UNb/Z23/l0PE=";
   };
 
   buildInputs = [ libpcap ];

From 4bd7810cc62e34e387662a38bf0e18945454cabe Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 24 Aug 2025 16:50:22 +0800
Subject: [PATCH 003/129] ytcc: 2.7.2 -> 2.8.0

---
 pkgs/by-name/yt/ytcc/package.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/yt/ytcc/package.nix b/pkgs/by-name/yt/ytcc/package.nix
index 9831cd461c77..34adb6af4991 100644
--- a/pkgs/by-name/yt/ytcc/package.nix
+++ b/pkgs/by-name/yt/ytcc/package.nix
@@ -7,16 +7,19 @@
   versionCheckHook,
 }:
 
-python3Packages.buildPythonApplication rec {
+let
+  version = "2.8.0";
+in
+python3Packages.buildPythonApplication {
   pname = "ytcc";
-  version = "2.7.2";
+  inherit version;
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "woefe";
     repo = "ytcc";
     tag = "v${version}";
-    hash = "sha256-PNSkIp6CJvgirO3k2lB0nOVEC1+znhn3/OyRIJ1EANI=";
+    hash = "sha256-6Z5xoGbOtJnPlPj5GS9ElRkuuNd+ON9RsZyl5VLzLE0=";
   };
 
   build-system = with python3Packages; [ hatchling ];
@@ -33,6 +36,8 @@ python3Packages.buildPythonApplication rec {
     defusedxml
   ];
 
+  pythonRelaxDeps = [ "click" ];
+
   nativeCheckInputs =
     with python3Packages;
     [

From 803bb15881756fe844f4241a87254d661767290d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 28 Aug 2025 06:54:25 +0100
Subject: [PATCH 004/129] rust-analyzer-unwrapped: 2025-08-11 -> 2025-08-25

Changes: https://github.com/rust-lang/rust-analyzer/releases/tag/2025-08-25
---
 pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
index 9ab142b10b53..f1772bc8062c 100644
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2025-08-11";
+  version = "2025-08-25";
 
   cargoHash = "sha256-G1R3IiKbQg1Dl6OFJSto0w4c18OUIrAPRiM/YStfkl0=";
 
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    hash = "sha256-fuHLsvM5z5/5ia3yL0/mr472wXnxSrtXECa+pspQchA=";
+    hash = "sha256-apbJj2tsJkL2l+7Or9tJm1Mt5QPB6w/zIyDkCx8pfvk=";
   };
 
   cargoBuildFlags = [

From d29e6dcda2b3a7c1bffcb8d9a7e37b21c1914845 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 31 Aug 2025 06:37:15 +0100
Subject: [PATCH 005/129] libei: 1.4.1 -> 1.5.0

Changes: https://gitlab.freedesktop.org/libinput/libei/-/releases/1.5.0
---
 pkgs/by-name/li/libei/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libei/package.nix b/pkgs/by-name/li/libei/package.nix
index 9b5bacf2b78f..f19ae95147e7 100644
--- a/pkgs/by-name/li/libei/package.nix
+++ b/pkgs/by-name/li/libei/package.nix
@@ -23,14 +23,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libei";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libinput";
     repo = "libei";
     rev = version;
-    hash = "sha256-DoPQaTry1uzu6sM/wWEl4xeGq3h3BuMDeVYusHge6AI=";
+    hash = "sha256-PqQpJz88tDzjwsBuwxpWcGAWz6Gp6A/oAOS87uxGOGs=";
   };
 
   buildInputs = [

From 39755de0411953f0fc035e4714664440defeee0d Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 14:26:04 +0800
Subject: [PATCH 006/129] unp: 2.0-pre9 -> 2.0

---
 pkgs/by-name/un/unp/package.nix | 46 ++++++++++++++++++++-------------
 1 file changed, 28 insertions(+), 18 deletions(-)

diff --git a/pkgs/by-name/un/unp/package.nix b/pkgs/by-name/un/unp/package.nix
index 66c6fefea165..1a1888b137c8 100644
--- a/pkgs/by-name/un/unp/package.nix
+++ b/pkgs/by-name/un/unp/package.nix
@@ -1,7 +1,8 @@
 {
   stdenv,
   lib,
-  fetchurl,
+  fetchFromGitLab,
+  installShellFiles,
   makeWrapper,
   perl,
   unzip,
@@ -20,31 +21,40 @@ let
   ++ extraBackends;
 
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "unp";
-  version = "2.0-pre9";
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ perl ];
+  version = "2.0";
 
-  src = fetchurl {
-    url = "mirror://debian/pool/main/u/unp/unp_2.0~pre9.tar.xz";
-    sha256 = "1lp5vi9x1qi3b21nzv0yqqacj6p74qkl5zryzwq30rjkyvahjya1";
-    name = "unp_2.0_pre9.tar.xz";
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "blade";
+    repo = "unp";
+    tag = "debian/${finalAttrs.version}";
+    hash = "sha256-6lYyKnNUkz9PKdn++zHe2SMdFsgaajStIdSaenbXIRo=";
   };
 
-  dontConfigure = true;
-  dontBuild = true;
-  installPhase = ''
-    mkdir -p $out/bin
-    mkdir -p $out/share/man/man1
-    install ./unp $out/bin/unp
-    install ./ucat $out/bin/ucat
-    cp debian/unp.1 $out/share/man/man1
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
 
+  buildInputs = [ perl ];
+
+  dontConfigure = true;
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    installBin unp ucat
+    installManPage debian/unp.1
     wrapProgram $out/bin/unp \
       --prefix PATH : ${lib.makeBinPath runtime_bins}
     wrapProgram $out/bin/ucat \
       --prefix PATH : ${lib.makeBinPath runtime_bins}
+
+    runHook postInstall
   '';
 
   meta = with lib; {
@@ -54,4 +64,4 @@ stdenv.mkDerivation {
     maintainers = [ maintainers.timor ];
     platforms = platforms.all;
   };
-}
+})

From c37abc4993c3002a2cf55d99e0d6135b4588a2ce Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 14:26:34 +0800
Subject: [PATCH 007/129] unp: remove with lib

---
 pkgs/by-name/un/unp/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/un/unp/package.nix b/pkgs/by-name/un/unp/package.nix
index 1a1888b137c8..4b084bfb161b 100644
--- a/pkgs/by-name/un/unp/package.nix
+++ b/pkgs/by-name/un/unp/package.nix
@@ -57,11 +57,11 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Command line tool for unpacking archives easily";
     homepage = "https://packages.qa.debian.org/u/unp.html";
-    license = with licenses; [ gpl2Only ];
-    maintainers = [ maintainers.timor ];
-    platforms = platforms.all;
+    license = with lib.licenses; [ gpl2Only ];
+    maintainers = [ lib.maintainers.timor ];
+    platforms = lib.platforms.all;
   };
 })

From 3a77ce578757636bd67a5c8ad275cea3e3e18e7e Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 16:12:59 +0800
Subject: [PATCH 008/129] umurmur: 0.3.0 -> 0.3.1

Diff: https://github.com/umurmur/umurmur/compare/v0.3.0...v0.3.1
---
 pkgs/by-name/um/umurmur/package.nix | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/um/umurmur/package.nix b/pkgs/by-name/um/umurmur/package.nix
index 0c4ee7e9bbba..daf7fee9d33d 100644
--- a/pkgs/by-name/um/umurmur/package.nix
+++ b/pkgs/by-name/um/umurmur/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "umurmur";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "umurmur";
     repo = "umurmur";
-    rev = version;
-    sha256 = "sha256-q5k1Lv+/Kz602QFcdb/FoWWaH9peAQIf7u1NTCWKTBM=";
+    tag = "v${version}";
+    hash = "sha256-pJRGyfG5y5wdB+zoWiJ1+2O1L3TThC6IairVDlE76tA=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
@@ -28,14 +28,6 @@ stdenv.mkDerivation rec {
     libconfig
   ];
 
-  patches = [
-    # https://github.com/umurmur/umurmur/issues/175
-    (fetchpatch {
-      url = "https://github.com/umurmur/umurmur/commit/2c7353eaabb88544affc0b0d32d2611994169159.patch";
-      hash = "sha256-Ws4Eqb6yI5Vnwfeu869hDtisi8NcobEK6dC7RWnWSJA=";
-    })
-  ];
-
   configureFlags = [
     "--with-ssl=openssl"
     "--enable-shmapi"

From 68cf10a9110df0dc20d45464f83f7af7ada36b6c Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 16:13:34 +0800
Subject: [PATCH 009/129] umurmur: use finalAttrs

---
 pkgs/by-name/um/umurmur/package.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/um/umurmur/package.nix b/pkgs/by-name/um/umurmur/package.nix
index daf7fee9d33d..0c0a13dc713a 100644
--- a/pkgs/by-name/um/umurmur/package.nix
+++ b/pkgs/by-name/um/umurmur/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   autoreconfHook,
   openssl,
   protobufc,
@@ -10,14 +9,14 @@
   nixosTests,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "umurmur";
   version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "umurmur";
     repo = "umurmur";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-pJRGyfG5y5wdB+zoWiJ1+2O1L3TThC6IairVDlE76tA=";
   };
 
@@ -49,4 +48,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ _3JlOy-PYCCKUi ];
     mainProgram = "umurmurd";
   };
-}
+})

From 9a007c1f447456e3be2a160b6ea23cf2b5346022 Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 16:14:08 +0800
Subject: [PATCH 010/129] umurmur: remove with lib

---
 pkgs/by-name/um/umurmur/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/um/umurmur/package.nix b/pkgs/by-name/um/umurmur/package.nix
index 0c0a13dc713a..dc5a88d2bfbc 100644
--- a/pkgs/by-name/um/umurmur/package.nix
+++ b/pkgs/by-name/um/umurmur/package.nix
@@ -38,11 +38,11 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Minimalistic Murmur (Mumble server)";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     homepage = "https://github.com/umurmur/umurmur";
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
     # never built on aarch64-darwin since first introduction in nixpkgs
     broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
     maintainers = with lib.maintainers; [ _3JlOy-PYCCKUi ];

From 850dedef8444cc2cc6fb02585617a24e669feef0 Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 16:22:06 +0800
Subject: [PATCH 011/129] ulogd: 2.0.8 -> 2.0.9

---
 pkgs/by-name/ul/ulogd/package.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ul/ulogd/package.nix b/pkgs/by-name/ul/ulogd/package.nix
index f08977a88c09..7f4f0a7835bb 100644
--- a/pkgs/by-name/ul/ulogd/package.nix
+++ b/pkgs/by-name/ul/ulogd/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchurl,
-  gnumake,
   libnetfilter_acct,
   libnetfilter_conntrack,
   libnetfilter_log,
@@ -23,12 +22,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.0.8";
+  version = "2.0.9";
   pname = "ulogd";
 
   src = fetchurl {
-    url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    hash = "sha256-Tq1sOXDD9X+h6J/i18xIO6b+K9GwhwFSHgs6/WZ98pE=";
+    url = "https://www.netfilter.org/pub/ulogd/ulogd-${version}.tar.xz";
+    hash = "sha256-UjplH+Cp8lsM2H1dNfw32Tgufuz89h5I1VBf88+A7aU=";
   };
 
   outputs = [

From da2bcfcb1f3fdd5b9150400518269ef119a58c4c Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 16:25:33 +0800
Subject: [PATCH 012/129] ulogd: use finalAttrs

---
 pkgs/by-name/ul/ulogd/package.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/ul/ulogd/package.nix b/pkgs/by-name/ul/ulogd/package.nix
index 7f4f0a7835bb..66487c556219 100644
--- a/pkgs/by-name/ul/ulogd/package.nix
+++ b/pkgs/by-name/ul/ulogd/package.nix
@@ -21,12 +21,12 @@
   nixosTests,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   version = "2.0.9";
   pname = "ulogd";
 
   src = fetchurl {
-    url = "https://www.netfilter.org/pub/ulogd/ulogd-${version}.tar.xz";
+    url = "https://www.netfilter.org/pub/ulogd/ulogd-${finalAttrs.version}.tar.xz";
     hash = "sha256-UjplH+Cp8lsM2H1dNfw32Tgufuz89h5I1VBf88+A7aU=";
   };
 
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    substituteInPlace ulogd.8 --replace "/usr/share/doc" "$doc/share/doc"
+    substituteInPlace ulogd.8 --replace-fail "/usr/share/doc" "$doc/share/doc"
   '';
 
   postBuild = ''
@@ -48,9 +48,9 @@ stdenv.mkDerivation rec {
   '';
 
   postInstall = ''
-    install -Dm444 -t $out/share/doc/${pname} ulogd.conf doc/ulogd.txt doc/ulogd.html README doc/*table
-    install -Dm444 -t $out/share/doc/${pname}-mysql doc/mysql*.sql
-    install -Dm444 -t $out/share/doc/${pname}-pgsql doc/pgsql*.sql
+    install -Dm444 -t $out/share/doc/ulogd ulogd.conf doc/ulogd.txt doc/ulogd.html README doc/*table
+    install -Dm444 -t $out/share/doc/ulogd-mysql doc/mysql*.sql
+    install -Dm444 -t $out/share/doc/ulogd-pgsql doc/pgsql*.sql
   '';
 
   buildInputs = [
@@ -98,4 +98,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     maintainers = with maintainers; [ p-h ];
   };
-}
+})

From 849f6c5edeb87a46ef229d298fa1010bbbafd32a Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 16:26:25 +0800
Subject: [PATCH 013/129] ulogd: remove with lib

---
 pkgs/by-name/ul/ulogd/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ul/ulogd/package.nix b/pkgs/by-name/ul/ulogd/package.nix
index 66487c556219..8157163b7c87 100644
--- a/pkgs/by-name/ul/ulogd/package.nix
+++ b/pkgs/by-name/ul/ulogd/package.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests = { inherit (nixosTests) ulogd; };
 
-  meta = with lib; {
+  meta = {
     description = "Userspace logging daemon for netfilter/iptables";
     mainProgram = "ulogd";
 
@@ -94,8 +94,8 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
     homepage = "https://www.netfilter.org/projects/ulogd/index.html";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ p-h ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ p-h ];
   };
 })

From 14fb2d2eba7e5d72cc1e850d5924b258faba52bb Mon Sep 17 00:00:00 2001
From: DESPsyched <priyanshu.tripathi@deshaw.com>
Date: Sun, 31 Aug 2025 08:53:05 -0400
Subject: [PATCH 014/129] python3Packages.okonomiyaki: fix build

- Remove redundant patch (upstream fixed in https://github.com/enthought/okonomiyaki/commit/5c7bbde99c9f76d6b9e5e030c7737112ca848bbe)
- Fix split logic on an empty list
---
 pkgs/development/python-modules/okonomiyaki/default.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/okonomiyaki/default.nix b/pkgs/development/python-modules/okonomiyaki/default.nix
index 812379dda907..d5365439945c 100644
--- a/pkgs/development/python-modules/okonomiyaki/default.nix
+++ b/pkgs/development/python-modules/okonomiyaki/default.nix
@@ -30,12 +30,6 @@ buildPythonPackage rec {
     hash = "sha256-xAF9Tdr+IM3lU+mcNcAWATJLZOVvbx0llqznqHLVqDc=";
   };
 
-  postPatch = ''
-    # Fixed for >= 2.0.0
-    substituteInPlace setup.cfg \
-      --replace-fail "long_description_content_type = rst" "long_description_content_type = text/x-rst"
-  '';
-
   build-system = [ setuptools ];
 
   optional-dependencies = {
@@ -68,6 +62,8 @@ buildPythonPackage rec {
   preCheck = ''
     substituteInPlace okonomiyaki/runtimes/tests/test_runtime.py \
       --replace-fail 'runtime_info = PythonRuntime.from_running_python()' 'raise unittest.SkipTest() #'
+    substituteInPlace okonomiyaki/platforms/_platform.py \
+      --replace-fail 'name.split()[0]' '(name.split() or [""])[0]'
   ''
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace okonomiyaki/platforms/tests/test_pep425.py \

From f546332f6d88eea392f3af865c70512d59442935 Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 21:16:43 +0800
Subject: [PATCH 015/129] ugm: 1.7.0 -> 1.8.0

Changelog: https://github.com/ariasmn/ugm/releases/tag/v1.8.0
---
 pkgs/by-name/ug/ugm/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ug/ugm/package.nix b/pkgs/by-name/ug/ugm/package.nix
index c624fc68494d..8bff85ec3ce5 100644
--- a/pkgs/by-name/ug/ugm/package.nix
+++ b/pkgs/by-name/ug/ugm/package.nix
@@ -1,23 +1,23 @@
 {
   lib,
-  buildGoModule,
+  buildGo125Module,
   fetchFromGitHub,
   makeWrapper,
   nix-update-script,
 }:
 
-buildGoModule rec {
+buildGo125Module rec {
   pname = "ugm";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "ariasmn";
     repo = "ugm";
     rev = "v${version}";
-    hash = "sha256-JgdOoMH8TAUc+23AhU3tZe4SH8GKFeyjSeKm8U7qvpo=";
+    hash = "sha256-AkiAF9zLgyzXRC6efjQ+eeAL3mOSQM94B8nr09pcY5M=";
   };
 
-  vendorHash = "sha256-Dgnh+4bUNyqD8/bj+iUITPB/SBtQPYrB5XC6/M6Zs6k=";
+  vendorHash = "sha256-W9v52cxhXdNyW5RGk+SoA1u7Yid+63YYdd9YaGKEWDs=";
 
   nativeBuildInputs = [ makeWrapper ];
 

From e32783053ecc423f35ed1b931918cc9cc90426ff Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 21:18:51 +0800
Subject: [PATCH 016/129] ugm: use finalAttrs and tag and remove with lib

---
 pkgs/by-name/ug/ugm/package.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/ug/ugm/package.nix b/pkgs/by-name/ug/ugm/package.nix
index 8bff85ec3ce5..5d3b24089a44 100644
--- a/pkgs/by-name/ug/ugm/package.nix
+++ b/pkgs/by-name/ug/ugm/package.nix
@@ -6,14 +6,14 @@
   nix-update-script,
 }:
 
-buildGo125Module rec {
+buildGo125Module (finalAttrs: {
   pname = "ugm";
   version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "ariasmn";
     repo = "ugm";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-AkiAF9zLgyzXRC6efjQ+eeAL3mOSQM94B8nr09pcY5M=";
   };
 
@@ -29,13 +29,13 @@ buildGo125Module rec {
 
   passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     description = "Terminal based UNIX user and group browser";
     homepage = "https://github.com/ariasmn/ugm";
-    changelog = "https://github.com/ariasmn/ugm/releases/tag/${src.rev}";
-    license = licenses.mit;
+    changelog = "https://github.com/ariasmn/ugm/releases/tag/${finalAttrs.src.rev}";
+    license = lib.licenses.mit;
     mainProgram = "ugm";
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ ];
   };
-}
+})

From ecb4b982dbde16946f2d87e50f4e5e4a40953f2d Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 22:38:16 +0800
Subject: [PATCH 017/129] kent: add updateScript

---
 pkgs/by-name/ke/kent/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/ke/kent/package.nix b/pkgs/by-name/ke/kent/package.nix
index c716287b77e4..7a8861dd4c2e 100644
--- a/pkgs/by-name/ke/kent/package.nix
+++ b/pkgs/by-name/ke/kent/package.nix
@@ -12,6 +12,9 @@
   bash,
   fetchFromGitHub,
   which,
+  writeShellScript,
+  jq,
+  nix-update,
 }:
 stdenv.mkDerivation rec {
   pname = "kent";
@@ -85,6 +88,11 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = writeShellScript "update-kent" ''
+    latestVersion=$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --fail --silent https://api.github.com/repos/ucscGenomeBrowser/kent/releases/latest | ${lib.getExe jq} --raw-output .tag_name | grep -oP '(?<=v)\d+')
+    ${lib.getExe nix-update} kent --version $latestVersion
+  '';
+
   meta = {
     description = "UCSC Genome Bioinformatics Group's suite of biological analysis tools, i.e. the kent utilities";
     homepage = "http://genome.ucsc.edu";

From 270707595b87aeff54b09e59f93473d4fe0ccad8 Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 22:39:51 +0800
Subject: [PATCH 018/129] kent: 468 -> 486

Changelog: https://github.com/ucscGenomeBrowser/kent/releases/tag/v486_base
---
 pkgs/by-name/ke/kent/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ke/kent/package.nix b/pkgs/by-name/ke/kent/package.nix
index 7a8861dd4c2e..841d87548e18 100644
--- a/pkgs/by-name/ke/kent/package.nix
+++ b/pkgs/by-name/ke/kent/package.nix
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "kent";
-  version = "468";
+  version = "486";
 
   src = fetchFromGitHub {
     owner = "ucscGenomeBrowser";
     repo = "kent";
     rev = "v${version}_base";
-    hash = "sha256-OM/noraW2X8WV5wqWEFiI5/JPOBmsp0fTeDdcZoXxAA=";
+    hash = "sha256-NffQ04+5rMtG/VI7YFK4Ff39DDhdh9Wlc0i1iVbg8Js=";
   };
 
   buildInputs = [

From bf210e0844c309d817a338eab6bbc20e4c03f437 Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sun, 31 Aug 2025 22:52:45 +0800
Subject: [PATCH 019/129] kent: use finalAttrs and tag and
 writableTmpDirAsHomeHook

---
 pkgs/by-name/ke/kent/package.nix | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/ke/kent/package.nix b/pkgs/by-name/ke/kent/package.nix
index 841d87548e18..8c0c9d8bf0f8 100644
--- a/pkgs/by-name/ke/kent/package.nix
+++ b/pkgs/by-name/ke/kent/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  writableTmpDirAsHomeHook,
   libpng,
   libuuid,
   zlib,
@@ -16,17 +17,19 @@
   jq,
   nix-update,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "kent";
   version = "486";
 
   src = fetchFromGitHub {
     owner = "ucscGenomeBrowser";
     repo = "kent";
-    rev = "v${version}_base";
+    tag = "v${finalAttrs.version}_base";
     hash = "sha256-NffQ04+5rMtG/VI7YFK4Ff39DDhdh9Wlc0i1iVbg8Js=";
   };
 
+  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+
   buildInputs = [
     libpng
     libuuid
@@ -40,10 +43,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace ./src/checkUmask.sh \
-      --replace "/bin/bash" "${bash}/bin/bash"
+      --replace-fail "/bin/bash" "${bash}/bin/bash"
 
     substituteInPlace ./src/hg/sqlEnvTest.sh \
-      --replace "which mysql_config" "${which}/bin/which ${libmysqlclient}/bin/mysql_config"
+      --replace-fail "which mysql_config" "${which}/bin/which ${libmysqlclient}/bin/mysql_config"
   '';
 
   buildPhase = ''
@@ -53,7 +56,6 @@ stdenv.mkDerivation rec {
     export CFLAGS="-fPIC"
     export MYSQLINC=$(mysql_config --include | sed -e 's/^-I//g')
     export MYSQLLIBS=$(mysql_config --libs)
-    export HOME=$TMPDIR
     export DESTBINDIR=$HOME/bin
 
     mkdir -p $HOME/lib $HOME/bin/${stdenv.hostPlatform.parsed.cpu.name}
@@ -96,9 +98,9 @@ stdenv.mkDerivation rec {
   meta = {
     description = "UCSC Genome Bioinformatics Group's suite of biological analysis tools, i.e. the kent utilities";
     homepage = "http://genome.ucsc.edu";
-    changelog = "https://github.com/ucscGenomeBrowser/kent/releases/tag/v${version}_base";
+    changelog = "https://github.com/ucscGenomeBrowser/kent/releases/tag/v${finalAttrs.version}_base";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ scalavision ];
     platforms = lib.platforms.linux;
   };
-}
+})

From 8890d3b10bfe37f584436f219fa2310b83203e77 Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Tue, 2 Sep 2025 12:54:56 +0800
Subject: [PATCH 020/129] tp_smapi: 0.44-unstable-2025-05-26 -> 0.45

---
 pkgs/os-specific/linux/tp_smapi/default.nix | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/pkgs/os-specific/linux/tp_smapi/default.nix b/pkgs/os-specific/linux/tp_smapi/default.nix
index 0e27fb45b547..be403267f9aa 100644
--- a/pkgs/os-specific/linux/tp_smapi/default.nix
+++ b/pkgs/os-specific/linux/tp_smapi/default.nix
@@ -5,15 +5,15 @@
   kernel,
 }:
 
-stdenv.mkDerivation rec {
-  name = "tp_smapi-${version}-${kernel.version}";
-  version = "0.44-unstable-2025-05-26";
+stdenv.mkDerivation (finalAttrs: {
+  name = "tp_smapi-${finalAttrs.version}-${kernel.version}";
+  version = "0.45";
 
   src = fetchFromGitHub {
     owner = "linux-thinkpad";
     repo = "tp_smapi";
-    rev = "a6122c0840c36bf232250afd1da30aaedaf24910";
-    hash = "sha256-4bVyhTVj29ni9hduN20+VEl5/N0BAoMNMBw+k4yl8Y0=";
+    tag = "tp-smapi/${finalAttrs.version}";
+    hash = "sha256-rB+DNgWUXd1oQBbDgVEAJVJ16nKCaKDtWGAmpcFsx+A=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -27,9 +27,13 @@ stdenv.mkDerivation rec {
   ];
 
   installPhase = ''
+    runHook preInstall
+
     install -v -D -m 644 thinkpad_ec.ko "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/firmware/thinkpad_ec.ko"
     install -v -D -m 644 tp_smapi.ko "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/firmware/tp_smapi.ko"
     install -v -D -m 644 hdaps.ko "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/firmware/hdapsd.ko"
+
+    runHook postInstall
   '';
 
   dontStrip = true;
@@ -41,10 +45,10 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/linux-thinkpad/tp_smapi";
     license = lib.licenses.gpl2Plus;
     maintainers = [ ];
-    # driver is only meant for linux thinkpads i think  bellow platforms should cover it.
+    # driver is only meant for linux thinkpads, bellow platforms should cover it.
     platforms = [
       "x86_64-linux"
       "i686-linux"
     ];
   };
-}
+})

From fa6fb4be98a43f428c9ee2acb645130f0f051777 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Wed, 3 Sep 2025 13:07:23 +0200
Subject: [PATCH 021/129] signal-desktop-bin: use `systemdLibs`

---
 pkgs/by-name/si/signal-desktop-bin/generic.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/si/signal-desktop-bin/generic.nix b/pkgs/by-name/si/signal-desktop-bin/generic.nix
index 9b0fd4aec65c..4f5e80da95ac 100644
--- a/pkgs/by-name/si/signal-desktop-bin/generic.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/generic.nix
@@ -45,7 +45,7 @@
   libgbm,
   libwebp,
   # Runtime dependencies:
-  systemd,
+  systemdLibs,
   libnotify,
   libdbusmenu,
   libpulseaudio,
@@ -186,13 +186,13 @@ stdenv.mkDerivation rec {
     nspr
     nss
     pango
-    systemd
+    systemdLibs
     xorg.libxcb
     xorg.libxshmfence
   ];
 
   runtimeDependencies = [
-    (lib.getLib systemd)
+    systemdLibs
     libappindicator-gtk3
     libnotify
     libdbusmenu

From 4045f46e20d107a019066d9c0f71fc6ac8e76cdb Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Wed, 3 Sep 2025 13:09:41 +0200
Subject: [PATCH 022/129] vscode: use `systemdLibs`

---
 pkgs/applications/editors/vscode/generic.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index 44792a49450d..28aba5a67d59 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -15,7 +15,7 @@
   nss,
   nspr,
   xorg,
-  systemd,
+  systemdLibs,
   fontconfig,
   libdbusmenu,
   glib,
@@ -230,12 +230,12 @@ stdenv.mkDerivation (
       libgbm
       nss
       nspr
-      systemd
+      systemdLibs
       xorg.libxkbfile
     ];
 
     runtimeDependencies = lib.optionals stdenv.hostPlatform.isLinux [
-      (lib.getLib systemd)
+      systemdLibs
       fontconfig.lib
       libdbusmenu
       wayland

From 969a5417ebff8a59f4dcd8da20c3104fb5287f31 Mon Sep 17 00:00:00 2001
From: hetraeus <fulmare90@gmail.com>
Date: Wed, 3 Sep 2025 14:14:36 +0200
Subject: [PATCH 023/129] leocad: 23.03 -> 25.09

---
 pkgs/by-name/le/leocad/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/le/leocad/package.nix b/pkgs/by-name/le/leocad/package.nix
index 2e664479513d..1329142325e5 100644
--- a/pkgs/by-name/le/leocad/package.nix
+++ b/pkgs/by-name/le/leocad/package.nix
@@ -19,20 +19,20 @@
 
 let
   parts = fetchurl {
-    url = "https://web.archive.org/web/20241230062818/https://library.ldraw.org/library/updates/complete.zip";
-    hash = "sha256-0RIJYEU+MpE4MSfxk2HK5hQd8IsiPn2xEGUFmItzlk8=";
+    url = "https://web.archive.org/web/20250709230715/https://library.ldraw.org/library/updates/complete.zip";
+    hash = "sha256-Uy7YYE7LdcmgEGbt6DlljS3QCQxjcviLApFuu1p9GZ8=";
   };
 
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "leocad";
-  version = "23.03";
+  version = "25.09";
 
   src = fetchFromGitHub {
     owner = "leozide";
     repo = "leocad";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IY9mr2gSMZL9pxiVTKH/f7rjsOvBDNgwVKpXA57oMGo=";
+    hash = "sha256-Utiy9JBKaPddb2yNv1Ta61KIB1vCsayZlxagn3or5UE=";
   };
 
   nativeBuildInputs = [

From 601039f62095e0ecc2d9582252fe622bcccba7d3 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Wed, 3 Sep 2025 13:17:37 +0200
Subject: [PATCH 024/129] github-desktop: use `systemdLibs`

---
 pkgs/by-name/gi/github-desktop/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index 46be620793f4..7729cc5c11e4 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -15,7 +15,7 @@
   alsa-lib,
   cups,
   libgbm,
-  systemd,
+  systemdLibs,
   openssl,
   libglvnd,
 }:
@@ -92,7 +92,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   '';
 
   runtimeDependencies = [
-    (lib.getLib systemd)
+    systemdLibs
   ];
 
   meta = {

From 2ab0b7c2dd4d08dd1663aaa9e9179d529f81d942 Mon Sep 17 00:00:00 2001
From: Markus Kowalewski <markus.kowalewski@gmail.com>
Date: Wed, 3 Sep 2025 14:52:34 +0200
Subject: [PATCH 025/129] nrsc5: 1.0 -> 3.0.1

---
 pkgs/by-name/nr/nrsc5/package.nix | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/nr/nrsc5/package.nix b/pkgs/by-name/nr/nrsc5/package.nix
index d15f1ca7c413..09dc3fe79498 100644
--- a/pkgs/by-name/nr/nrsc5/package.nix
+++ b/pkgs/by-name/nr/nrsc5/package.nix
@@ -12,24 +12,22 @@
 }:
 let
   src_faad2 = fetchFromGitHub {
-    owner = "dsvensson";
+    owner = "knik0";
     repo = "faad2";
-    rev = "b7aa099fd3220b71180ed2b0bc19dc6209a1b418";
-    sha256 = "0pcw2x9rjgkf5g6irql1j4m5xjb4lxj6468z8v603921bnir71mf";
+    tag = "2.11.2";
+    hash = "sha256-JvmblrmE3doUMUwObBN2b+Ej+CDBWNemBsyYSCXGwo8=";
   };
 
-  version = "1.0";
-
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "nrsc5";
-  inherit version;
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "theori-io";
     repo = "nrsc5";
-    rev = "v${version}";
-    sha256 = "09zzh3h1zzf2lwrbz3i7rif2hw36d9ska8irvxaa9lz6xc1y68pg";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-chLoCXbEQaIrSHLQAm0++NGNYuQNCseSCR37qjXwW04=";
   };
 
   postUnpack = ''
@@ -44,10 +42,6 @@ stdenv.mkDerivation {
     sed -i '/GIT_REPOSITORY/d' CMakeLists.txt
     sed -i '/GIT_TAG/d' CMakeLists.txt
     sed -i "s:set (FAAD2_PREFIX .*):set (FAAD2_PREFIX \"$srcRoot/faad2-prefix\"):" CMakeLists.txt
-    # see https://github.com/dsvensson/faad2/pull/2
-    substituteInPlace $faadSrc/libfaad/pns.c \
-      --replace-fail 'r1_dep = __r1;' 'r1_dep = *__r1;' \
-      --replace-fail 'r2_dep = __r2;' 'r2_dep = *__r2;'
   '';
 
   nativeBuildInputs = [
@@ -75,4 +69,4 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ markuskowa ];
     mainProgram = "nrsc5";
   };
-}
+})

From 5a4671226135b94f86c99126de58f8a45b77d5dc Mon Sep 17 00:00:00 2001
From: Ben Darwin <bcdarwin@gmail.com>
Date: Wed, 3 Sep 2025 17:18:28 -0400
Subject: [PATCH 026/129] python313Packages.torchio: 0.20.21 -> 0.20.22

---
 .../python-modules/torchio/default.nix        | 24 +++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/torchio/default.nix b/pkgs/development/python-modules/torchio/default.nix
index a5c3ad52f795..941bd288dfe0 100644
--- a/pkgs/development/python-modules/torchio/default.nix
+++ b/pkgs/development/python-modules/torchio/default.nix
@@ -10,7 +10,7 @@
   # dependencies
   deprecated,
   einops,
-  matplotlib,
+  humanize,
   nibabel,
   numpy,
   packaging,
@@ -21,22 +21,28 @@
   tqdm,
   typer,
 
+  # optional dependencies
+  colorcet,
+  matplotlib,
+  pandas,
+  ffmpeg-python,
+  scikit-learn,
+
   # tests
-  humanize,
   parameterized,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "torchio";
-  version = "0.20.21";
+  version = "0.20.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TorchIO-project";
     repo = "torchio";
     tag = "v${version}";
-    hash = "sha256-l2KQLZDxsP8Bjk/vPG2YbU+8Z6/lOvNvy9NYKTdW+cY=";
+    hash = "sha256-LP0hlle8BCoZrJWs5aX/xvI+EPHdOGBARoKwQRqswQc=";
   };
 
   build-system = [
@@ -58,6 +64,16 @@ buildPythonPackage rec {
     typer
   ];
 
+  optional-dependencies = {
+    csv = [ pandas ];
+    plot = [
+      colorcet
+      matplotlib
+    ];
+    video = [ ffmpeg-python ];
+    sklearn = [ scikit-learn ];
+  };
+
   nativeCheckInputs = [
     matplotlib
     parameterized

From 39a93b305877e68c8a6dc596591075006864b5bd Mon Sep 17 00:00:00 2001
From: Michael Stapelberg <michael@stapelberg.de>
Date: Sun, 7 Sep 2025 14:10:50 +0200
Subject: [PATCH 027/129] i3lock: enable separateDebugInfo (for symbols/sources
 in gdb)

---
 pkgs/applications/window-managers/i3/lock.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/window-managers/i3/lock.nix b/pkgs/applications/window-managers/i3/lock.nix
index 0713f5ecfbe7..80598af4659b 100644
--- a/pkgs/applications/window-managers/i3/lock.nix
+++ b/pkgs/applications/window-managers/i3/lock.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-OyV6GSLnNV3GUqrfs3OBnIaBvicH2PXgeY4acOk5dR4=";
   };
 
+  separateDebugInfo = true;
   nativeBuildInputs = [
     meson
     ninja

From 91911a34ed7291e0507d62ec0ec7d4ebf45d18a0 Mon Sep 17 00:00:00 2001
From: Michael Stapelberg <michael@stapelberg.de>
Date: Sun, 7 Sep 2025 14:11:38 +0200
Subject: [PATCH 028/129] i3status: enable separateDebugInfo (for
 symbols/sources in gdb)

---
 pkgs/applications/window-managers/i3/status.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/window-managers/i3/status.nix b/pkgs/applications/window-managers/i3/status.nix
index 47eabbd83809..21456d873bfa 100644
--- a/pkgs/applications/window-managers/i3/status.nix
+++ b/pkgs/applications/window-managers/i3/status.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-bGf1LK5PE533ZK0cxzZWK+D5d1B5G8IStT80wG6vIgU=";
   };
 
+  separateDebugInfo = true;
   nativeBuildInputs = [
     meson
     ninja

From a08887f06a5edb865c0ed6fc9bd5c54a539702ec Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 7 Sep 2025 14:38:39 +0000
Subject: [PATCH 029/129] cargo-hack: 0.6.37 -> 0.6.38

---
 pkgs/by-name/ca/cargo-hack/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-hack/package.nix b/pkgs/by-name/ca/cargo-hack/package.nix
index 9edcf25632bb..eb1ba42820ff 100644
--- a/pkgs/by-name/ca/cargo-hack/package.nix
+++ b/pkgs/by-name/ca/cargo-hack/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-hack";
-  version = "0.6.37";
+  version = "0.6.38";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-OlWSyp3et/48x5lRE14pIny8HHQcgOV2f9mI9hcj8K4=";
+    hash = "sha256-gKuc7FTBlWasRb59IvzFT54I7aY3MjNAkl2YCVZzl6Q=";
   };
 
-  cargoHash = "sha256-1FgFHnNCEGoBUbH+Uk67W9ufsGtr9uGdzJz0xZuPQ9U=";
+  cargoHash = "sha256-TRtz6OVYyt/sHVMoR5wDRbAPVvB33d8kSSTlO6JJkdM=";
 
   # some necessary files are absent in the crate version
   doCheck = false;

From bc725b12b2595951a3f4b112d59716d30b41001a Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Fri, 22 Aug 2025 11:28:51 +0200
Subject: [PATCH 030/129] zig: 0.14.1 -> 0.15.1

make zig use the latest release 0.15.1 / zig_0_15 by default
Release Notes: https://ziglang.org/download/0.15.1/release-notes.html
Diff: https://github.com/ziglang/zig/compare/0.14.1...0.15.1

Pinned existing packages that were not already pinned to zig_0_14 i.e. the previous default if they failed to build with zig_0_15

Dropped `backlight-auto` as it requires the already dropped zig_0_12 (see the comment in the meta section)
---
 pkgs/by-name/ba/backlight-auto/package.nix | 37 ----------------------
 pkgs/by-name/fa/fancy-cat/package.nix      |  6 ++--
 pkgs/by-name/nc/ncdu/package.nix           |  6 ++--
 pkgs/by-name/ri/river-bedload/package.nix  |  4 +--
 pkgs/development/compilers/zig/generic.nix |  4 +++
 pkgs/top-level/aliases.nix                 |  1 +
 pkgs/top-level/all-packages.nix            |  2 +-
 7 files changed, 14 insertions(+), 46 deletions(-)
 delete mode 100644 pkgs/by-name/ba/backlight-auto/package.nix

diff --git a/pkgs/by-name/ba/backlight-auto/package.nix b/pkgs/by-name/ba/backlight-auto/package.nix
deleted file mode 100644
index e6f849bf7096..000000000000
--- a/pkgs/by-name/ba/backlight-auto/package.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  lib,
-  stdenv,
-  zig,
-  libyuv,
-  fetchFromGitHub,
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "backlight-auto";
-  version = "0.0.1";
-
-  src = fetchFromGitHub {
-    owner = "lf94";
-    repo = "backlight-auto";
-    rev = finalAttrs.version;
-    hash = "sha256-QPymwlDrgKM/SXDzJdmfzWLSLU2D7egif1OIUE+SHoI=";
-  };
-
-  nativeBuildInputs = [
-    zig.hook
-  ];
-
-  buildInputs = [
-    libyuv
-  ];
-
-  meta = with lib; {
-    # Does not support zig 0.12 or newer, hasn't been updated in 2 years.
-    broken = lib.versionAtLeast zig.version "0.12";
-    description = "Automatically set screen brightness with a webcam";
-    mainProgram = "backlight-auto";
-    homepage = "https://len.falken.directory/backlight-auto.html";
-    license = licenses.mit;
-    maintainers = [ ];
-    platforms = platforms.linux;
-  };
-})
diff --git a/pkgs/by-name/fa/fancy-cat/package.nix b/pkgs/by-name/fa/fancy-cat/package.nix
index f97cbbcb8284..641b50a7d707 100644
--- a/pkgs/by-name/fa/fancy-cat/package.nix
+++ b/pkgs/by-name/fa/fancy-cat/package.nix
@@ -12,7 +12,7 @@
   mupdf,
   openjpeg,
   stdenv,
-  zig,
+  zig_0_14,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fancy-cat";
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [ ./0001-changes.patch ];
 
   nativeBuildInputs = [
-    zig.hook
+    zig_0_14.hook
   ];
 
   zigBuildFlags = [ "--release=fast" ];
@@ -56,6 +56,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.agpl3Plus;
     maintainers = with lib.maintainers; [ ciflire ];
     mainProgram = "fancy-cat";
-    inherit (zig.meta) platforms;
+    inherit (zig_0_14.meta) platforms;
   };
 })
diff --git a/pkgs/by-name/nc/ncdu/package.nix b/pkgs/by-name/nc/ncdu/package.nix
index 630dca3a9331..850f03521303 100644
--- a/pkgs/by-name/nc/ncdu/package.nix
+++ b/pkgs/by-name/nc/ncdu/package.nix
@@ -4,7 +4,7 @@
   fetchurl,
   ncurses,
   pkg-config,
-  zig_0_14,
+  zig_0_15,
   zstd,
   installShellFiles,
   versionCheckHook,
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    zig_0_14.hook
+    zig_0_15.hook
     installShellFiles
     pkg-config
   ];
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
       defelo
       ryan4yin
     ];
-    inherit (zig_0_14.meta) platforms;
+    inherit (zig_0_15.meta) platforms;
     mainProgram = "ncdu";
   };
 })
diff --git a/pkgs/by-name/ri/river-bedload/package.nix b/pkgs/by-name/ri/river-bedload/package.nix
index b0ac4f71acfe..71e4f8bd52d5 100644
--- a/pkgs/by-name/ri/river-bedload/package.nix
+++ b/pkgs/by-name/ri/river-bedload/package.nix
@@ -10,7 +10,7 @@
   wayland,
   wayland-protocols,
   wayland-scanner,
-  zig,
+  zig_0_14,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
-    zig.hook
+    zig_0_14.hook
   ];
 
   buildInputs = [
diff --git a/pkgs/development/compilers/zig/generic.nix b/pkgs/development/compilers/zig/generic.nix
index 8d6af23eae29..b68750a56154 100644
--- a/pkgs/development/compilers/zig/generic.nix
+++ b/pkgs/development/compilers/zig/generic.nix
@@ -145,5 +145,9 @@ stdenv.mkDerivation (finalAttrs: {
     teams = [ lib.teams.zig ];
     mainProgram = "zig";
     platforms = lib.platforms.unix;
+    # Zig 0.15.1 fails some tests on x86_64-darwin thus we mark it broken
+    # see https://github.com/ziglang/zig/issues/24974
+    broken =
+      stdenv.hostPlatform.system == "x86_64-darwin" && lib.versionAtLeast finalAttrs.version "0.15";
   };
 })
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 7155fddfd0d3..01e00806d258 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -495,6 +495,7 @@ mapAliases {
 
   ### B ###
 
+  backlight-auto = throw "'backlight-auto' has been removed as it relies on Zig 0.12 which has been dropped."; # Added 2025-08-22
   badtouch = authoscope; # Project was renamed, added 20210626
   badwolf = throw "'badwolf' has been removed due to being unmaintained"; # Added 2025-04-15
   baget = throw "'baget' has been removed due to being unmaintained";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0907b9121b65..5ea80beb6a3c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9283,7 +9283,7 @@ with pkgs;
     zig_0_15
     ;
 
-  zig = zig_0_14;
+  zig = zig_0_15;
 
   zigStdenv = if stdenv.cc.isZig then stdenv else lowPrio zig.passthru.stdenv;
 

From d1ed980cdf6fd7806ca4a7d8014377a738268f6a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 8 Sep 2025 21:02:01 +0000
Subject: [PATCH 031/129] svix-server: 1.75.0 -> 1.76.1

---
 pkgs/by-name/sv/svix-server/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sv/svix-server/package.nix b/pkgs/by-name/sv/svix-server/package.nix
index 461ce7ecf03a..f1c6934e241e 100644
--- a/pkgs/by-name/sv/svix-server/package.nix
+++ b/pkgs/by-name/sv/svix-server/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svix-server";
-  version = "1.75.0";
+  version = "1.76.1";
 
   src = fetchFromGitHub {
     owner = "svix";
     repo = "svix-webhooks";
     rev = "v${version}";
-    hash = "sha256-rZQWExWPoSQLmL79QGPU6GJ/Z5JEHBRPSGH2A4TsA94=";
+    hash = "sha256-9ClWC/OHdijmQzKig/o6WhJ9mjlE6pLwvrRKzuO0l3g=";
   };
 
   sourceRoot = "${src.name}/server";
 
-  cargoHash = "sha256-aTc4MmwesI8B26lv/1hifSXvrvWeW+UheIl8FN1/mes=";
+  cargoHash = "sha256-fOUPaU/1+FvL9hSzWQVouAXmCjI6ppOjJqtgM4+cXf8=";
 
   nativeBuildInputs = [ pkg-config ];
 

From 5a9917b04548446ea7ccb8314fa911779e937a95 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Sep 2025 05:41:01 +0000
Subject: [PATCH 032/129] python3Packages.databricks-sdk: 0.64.0 -> 0.65.0

---
 pkgs/development/python-modules/databricks-sdk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/databricks-sdk/default.nix b/pkgs/development/python-modules/databricks-sdk/default.nix
index 51fee46e534d..3e4c205684f6 100644
--- a/pkgs/development/python-modules/databricks-sdk/default.nix
+++ b/pkgs/development/python-modules/databricks-sdk/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "databricks-sdk";
-  version = "0.64.0";
+  version = "0.65.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${version}";
-    hash = "sha256-7P0j+yCWDwr6QZGeXE8coeaTg6kzTgxmwmZMDmx+3Zo=";
+    hash = "sha256-57qaTymMOkEJ+DzBDshhMoCJQk1UqJ796mv5uTOkUDw=";
   };
 
   build-system = [

From a3fbd89ad05c1d1bc977990d5b8f0c50c0836016 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 9 Sep 2025 20:03:47 +0200
Subject: [PATCH 033/129] python313Packages.pytransportnswv2: 2.0.0 -> 2.0.1

---
 pkgs/development/python-modules/pytransportnswv2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytransportnswv2/default.nix b/pkgs/development/python-modules/pytransportnswv2/default.nix
index 2ef7b645e3af..b253e14ac833 100644
--- a/pkgs/development/python-modules/pytransportnswv2/default.nix
+++ b/pkgs/development/python-modules/pytransportnswv2/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pytransportnswv2";
-  version = "2.0.0";
+  version = "2.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyTransportNSWv2";
     inherit version;
-    hash = "sha256-+JJ36cUzeK25pWF9eEvgB5G8HGmHmsL7QY3s+AnrjmY=";
+    hash = "sha256-tFQnCGYgekXFrDXDpH8MZNlL1v9xeumMHmQvU6bwVZc=";
   };
 
   build-system = [ setuptools ];

From 4178c866077657a19552a30b219f3638c8568e49 Mon Sep 17 00:00:00 2001
From: Mel Bourgeois <mason.bourgeois@gmail.com>
Date: Tue, 9 Sep 2025 18:01:19 -0600
Subject: [PATCH 034/129] dysk: mark supported on platforms.darwin

---
 pkgs/by-name/dy/dysk/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/dy/dysk/package.nix b/pkgs/by-name/dy/dysk/package.nix
index 0ed880346f7a..b81d6b5e7908 100644
--- a/pkgs/by-name/dy/dysk/package.nix
+++ b/pkgs/by-name/dy/dysk/package.nix
@@ -37,6 +37,6 @@ rustPlatform.buildRustPackage rec {
       koral
     ];
     mainProgram = "dysk";
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }

From bbf7f93696de14095fc1ebcc5210ac9fff0dd4e8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 07:24:09 +0000
Subject: [PATCH 035/129] python3Packages.pywikibot: 10.3.2 -> 10.4.0

---
 pkgs/development/python-modules/pywikibot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pywikibot/default.nix b/pkgs/development/python-modules/pywikibot/default.nix
index 5e64f1aea635..8b5ef98285d9 100644
--- a/pkgs/development/python-modules/pywikibot/default.nix
+++ b/pkgs/development/python-modules/pywikibot/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pywikibot";
-  version = "10.3.2";
+  version = "10.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-3mBcGhUeKggdOdhYUa4bwthIpHBdCRi10T+onHhavtk=";
+    hash = "sha256-ZpD/zTHUDR/owP9S7WTipZoGJuHdsORs+7w23u1Irxc=";
   };
 
   propagatedBuildInputs = [

From a56e6b93f1e72f6ecf2f28e5aae8a1c0f7eb3008 Mon Sep 17 00:00:00 2001
From: Robin Heggelund Hansen <git@heghan.org>
Date: Wed, 10 Sep 2025 09:34:54 +0200
Subject: [PATCH 036/129] gren: 0.6.2 -> 0.6.3

---
 pkgs/by-name/gr/gren/generated-backend-package.nix |  6 +++---
 pkgs/by-name/gr/gren/package.nix                   | 13 +++++--------
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/gr/gren/generated-backend-package.nix b/pkgs/by-name/gr/gren/generated-backend-package.nix
index b3fdc1c49d84..beb2637e5390 100644
--- a/pkgs/by-name/gr/gren/generated-backend-package.nix
+++ b/pkgs/by-name/gr/gren/generated-backend-package.nix
@@ -29,11 +29,11 @@
 }:
 mkDerivation {
   pname = "gren";
-  version = "0.6.2";
+  version = "0.6.3";
   src = fetchgit {
     url = "https://github.com/gren-lang/compiler.git";
-    sha256 = "1c0fcdc87nmm26hk6c1k4djdk7ld9488fldx8mhwayqfsx0v2d3x";
-    rev = "0343e77040f97864e5eb9790dd9ba0bb5fe1d6ee";
+    sha256 = "0p93wamff539pb242lib2wyfr6alqz96rpyh9xb0a61ix0j3miiz";
+    rev = "54277a25d47b5c20816550ff6deab89026797526";
     fetchSubmodules = true;
   };
   isLibrary = false;
diff --git a/pkgs/by-name/gr/gren/package.nix b/pkgs/by-name/gr/gren/package.nix
index bd04a32e701f..d7e41e12eab3 100644
--- a/pkgs/by-name/gr/gren/package.nix
+++ b/pkgs/by-name/gr/gren/package.nix
@@ -11,22 +11,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gren";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "gren-lang";
     repo = "compiler";
     tag = finalAttrs.version;
-    hash = "sha256-fTSxQdcOe8VhRb1RhxBJjZ7ZZCMzMDOhEbXag1hjDrA=";
+    hash = "sha256-P8Y6JOgxGAVWT9DfbNLHVJnsPBcrUkHEumkU56riI10=";
   };
 
-  buildInputs = [
-    nodejs
-  ];
+  buildInputs = [ nodejs ];
 
-  nativeBuildInputs = [
-    makeBinaryWrapper
-  ];
+  nativeBuildInputs = [ makeBinaryWrapper ];
 
   installPhase = ''
     runHook preInstall
@@ -55,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Programming language for simple and correct applications";
     homepage = "https://gren-lang.org";
     license = lib.licenses.bsd3;
+    platforms = lib.intersectLists haskellPackages.ghc.meta.platforms nodejs.meta.platforms;
     mainProgram = "gren";
     maintainers = with lib.maintainers; [
       robinheghan

From 53fd6bab8d0ca474e467fa622ad1afd955533e11 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 10:16:09 +0000
Subject: [PATCH 037/129] certinfo: 1.0.24 -> 1.0.37

---
 pkgs/by-name/ce/certinfo/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ce/certinfo/package.nix b/pkgs/by-name/ce/certinfo/package.nix
index b3609d0be1f5..8a561091cf49 100644
--- a/pkgs/by-name/ce/certinfo/package.nix
+++ b/pkgs/by-name/ce/certinfo/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "certinfo";
-  version = "1.0.24";
+  version = "1.0.37";
 
   src = fetchFromGitHub {
     owner = "pete911";
     repo = "certinfo";
     rev = "v${version}";
-    sha256 = "sha256-BI5gYWKGMU0wLvnArG41bLWj+9ipe/GARKRX0fwz4ag=";
+    sha256 = "sha256-0nJGIEqS3Dz0qmlX2k6POGK8cs05ENMDJsvoIhpPKpM=";
   };
 
   # clipboard functionality not working on Darwin

From b2dae1d594371277ea4ee32561bd02b88e6b2bdb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Wed, 3 Sep 2025 16:30:12 +0700
Subject: [PATCH 038/129] fetchdarcs: builder should use clone now that get is
 an alias to clone

---
 pkgs/build-support/fetchdarcs/builder.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/build-support/fetchdarcs/builder.sh b/pkgs/build-support/fetchdarcs/builder.sh
index f34e98fdcb0f..e1c5d7745d35 100644
--- a/pkgs/build-support/fetchdarcs/builder.sh
+++ b/pkgs/build-support/fetchdarcs/builder.sh
@@ -12,8 +12,8 @@ elif test -n "$context"; then
     tagflags="--context=$context"
 fi
 
-echo "getting $url $partial ${tagtext} into $out"
+echo "Cloning $url $partial ${tagtext} into $out"
 
-darcs get --lazy $tagflags "$url" "$out"
+darcs clone --lazy $tagflags "$url" "$out"
 # remove metadata, because it can change
 rm -rf "$out/_darcs"

From 3cb429833951a2e541ac699195d6fe4e94f7b118 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Wed, 3 Sep 2025 18:19:35 +0700
Subject: [PATCH 039/129] nix-prefetch-darcs: init

---
 .../fetchdarcs/nix-prefetch-darcs             | 184 ++++++++++++++++++
 .../nix-prefetch-scripts/default.nix          |   7 +
 2 files changed, 191 insertions(+)
 create mode 100755 pkgs/build-support/fetchdarcs/nix-prefetch-darcs

diff --git a/pkgs/build-support/fetchdarcs/nix-prefetch-darcs b/pkgs/build-support/fetchdarcs/nix-prefetch-darcs
new file mode 100755
index 000000000000..85b132210232
--- /dev/null
+++ b/pkgs/build-support/fetchdarcs/nix-prefetch-darcs
@@ -0,0 +1,184 @@
+#!/bin/sh
+set -eu
+
+quiet=
+name="fetchdarcs"
+repository=
+tag=
+context=
+darcs_hash=
+exp_hash=
+
+usage() {
+	echo "Usage: nix-prefetch-darcs [options] [REPOSITORY] [FILENAME [EXPECTED-HASH]]"
+	echo
+	echo "Options:"
+	echo "	--quiet               Suppress most error messages."
+	echo "	--name <NAME>         Symbolic store path name to use for the result."
+	echo "	--repo <REPOSITORY>   URL for the Darcs repository."
+	echo "	--tag <REGEXP>        Clone specified by tag matching a regular expression."
+	echo "	--context <FILENAME>  Clone specified by context file."
+	echo "	--darcs-hash <HASH>   Clone specified by hash. WARN: hash order is fickle by design."
+	echo "	--hash <HASH>         Expected hash."
+	echo "	--help                Show this help message."
+}
+
+# Argument parsing
+while [ $# -gt 0 ]; do
+	case "$1" in
+		--quiet)
+		  quiet=1; shift 1 ;;
+		--name)
+			name="$2"; shift 2 ;;
+		--repository)
+			repository="$2"; shift 2 ;;
+		--tag)
+			tag="$2"; shift 2 ;;
+		--context)
+			context="$2"; shift 2 ;;
+		--darcs-hash)
+			darcs_hash="$2"; shift 2 ;;
+		--hash)
+			exp_hash="$2"; shift 2 ;;
+		--help)
+			usage; exit 0 ;;
+		*)
+			# Positional arguments
+			if [ -z "$repository" ]; then
+				repository="$1"
+				shift
+			elif [ -z "$context" ]; then
+				context="$1"
+				shift
+			elif [ -z "$exp_hash" ]; then
+				exp_hash="$1"
+				shift
+			else
+				echo "Error: Too many arguments" >&2
+				usage
+				exit 1
+			fi
+			;;
+	esac
+done
+
+if [ -z "$repository" ]; then
+	echo "Error: URL for repository is required." >&2
+	echo >&2
+	usage
+	exit 1
+fi
+
+state_flag_count=0
+[ -n "$tag" ] && state_flag_count=$(( state_flag_count + 1 ))
+[ -n "$context" ] && state_flag_count=$(( state_flag_count + 1 ))
+[ -n "$darcs_hash" ] && state_flag_count=$(( state_flag_count + 1 ))
+
+if [ "$state_flag_count" -gt 1 ]; then
+	echo "Error: no more than 1 of --tag, --context, --darcs-hash flags can be set. $state_flag_count were set." >&2
+	echo >&2
+	usage
+	exit 1
+elif [ -n "$context" ]; then
+	if [ ! -s "$context" ]; then
+		echo "Error: context file must be readable & non-empty @ “$context”" >&2
+		echo >&2
+		usage
+		exit 1
+	else
+		context="$(realpath "$context")"
+	fi
+fi
+
+weak_hash=
+hash=
+hash_algo="${NIX_HASH_ALGO:-"sha256"}"
+hash_format="${hashFormat:-"--base32"}"
+final_path=
+final_context=
+
+# If the hash was given, a file with that hash may already be in the
+# store.
+if [ -n "$exp_hash" ]; then
+	final_path=$(nix-store --print-fixed-path --recursive "$hash_algo" "$exp_hash" "$name")
+	if ! nix-store --check-validity "$final_path" 2> /dev/null; then
+		final_path=""
+	fi
+	hash="$exp_hash"
+fi
+
+# If we don’t know the hash or a path with that hash doesn’t exist,
+# download the file and add it to the store.
+if [ -z "$final_path" ]; then
+	tmp_clone="$(realpath ${quiet:+--quiet} "$(mktemp ${quiet:+--quiet} -d --tmpdir darcs-clone-tmp-XXXXXXXX)")"
+	trap "rm -rf \"$tmp_clone\"" EXIT
+
+	clone_args="--lazy"
+	if [ -n "$quiet" ]; then
+		clone_args="$clone_args --quiet"
+	fi
+	if [ -n "$tag" ]; then
+		clone_args="$clone_args --tag=$tag"
+	elif [ -n "$context" ]; then
+		clone_args="$clone_args --context=$context"
+	elif [ -n "$darcs_hash" ]; then
+		clone_args="$clone_args --to-hash=$darcs_hash"
+	fi
+
+	cd "$tmp_clone"
+	# Do not print Darcs progress to stdout (else stdout isn’t parsable JSON)
+	if [ -t 1 ]; then
+		darcs clone $clone_args "$repository" "$name" >/dev/tty
+	else
+		darcs clone $clone_args "$repository" "$name" >/dev/null
+	fi
+	cd "$tmp_clone/$name"
+	# Will put the current Darcs context into the store.
+	new_context="$tmp_clone/${name}-context.txt"
+	darcs log --context > "$new_context"
+	final_context="$(nix-store --add-fixed "$hash_algo" "$new_context")"
+	# Darcs has a weak hash using the XOR of the patch hashes which is useful
+	# for other scripts
+	# https://darcs.net/Internals/Hashes
+	weak_hash="$(darcs show repo | grep '^ *Weak Hash:' | cut -d: -f2- | tr -d "[:space:]")"
+	cd - >/dev/null
+	rm -rf "$tmp_clone/$name/_darcs"
+
+	hash="$(nix-hash --type "$hash_algo" "$hash_format" "$tmp_clone/$name")"
+	final_path=$(nix-store --add-fixed --recursive "$hash_algo" "$tmp_clone/$name")
+
+	if [ -n "$exp_hash" ] && [ "$exp_hash" != "$hash" ]; then
+		echo "Hash mismatch for “$repository”" >&2
+		echo "Expected: $exp_hash" >&2
+		echo "Got:      $hash" >&2
+		exit 1
+	fi
+fi
+
+json_escape() {
+	printf '%s' "$1" | jq -Rs .
+}
+
+cat <<EOF
+{
+	"repository": $(json_escape "$repository"),
+EOF
+if [ -n "$tag" ]; then cat <<EOF
+	"tag": "$(json_escape "$tag")",
+EOF
+elif [ -n "$darcs_hash" ]; then cat <<EOF
+	"darcs-hash": $(json_escape "$darcs_hash"),
+EOF
+fi; if [ -n "$weak_hash" ]; then cat <<EOF
+	"weak-hash": $(json_escape "$weak_hash"),
+EOF
+fi; if [ -s "$final_context" ]; then cat <<EOF
+	"context": $(json_escape "$final_context"),
+EOF
+fi; cat <<EOF
+	"path": "$final_path",
+	$(json_escape "$hash_algo"): $(json_escape "$hash"),
+	"hash": "$(nix-hash --to-sri --type "$hash_algo" "$hash")"
+}
+EOF
+# vim: noet ci pi sts=0
diff --git a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
index 158d18d70cc9..1cdaf57a2fee 100644
--- a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
@@ -8,6 +8,7 @@
   cacert,
   coreutils,
   cvs,
+  darcs,
   findutils,
   gawk,
   git,
@@ -64,6 +65,11 @@ rec {
     breezy
   ];
   nix-prefetch-cvs = mkPrefetchScript "cvs" ../../../build-support/fetchcvs/nix-prefetch-cvs [ cvs ];
+  nix-prefetch-darcs = mkPrefetchScript "darcs" ../../../build-support/fetchdarcs/nix-prefetch-darcs [
+    darcs
+    cacert
+    jq
+  ];
   nix-prefetch-git = mkPrefetchScript "git" ../../../build-support/fetchgit/nix-prefetch-git [
     findutils
     gawk
@@ -88,6 +94,7 @@ rec {
     paths = [
       nix-prefetch-bzr
       nix-prefetch-cvs
+      nix-prefetch-darcs
       nix-prefetch-git
       nix-prefetch-hg
       nix-prefetch-svn

From bd56cefe0df13f8e6f2de64014a125b19f1d506f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 9 Sep 2025 21:35:22 +0200
Subject: [PATCH 040/129] python313Packages.kantoku: init at 0.18.3

A Process & Socket Manager built with zmq

https://github.com/bentoml/kantoku
---
 .../python-modules/kantoku/default.nix        | 58 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 60 insertions(+)
 create mode 100644 pkgs/development/python-modules/kantoku/default.nix

diff --git a/pkgs/development/python-modules/kantoku/default.nix b/pkgs/development/python-modules/kantoku/default.nix
new file mode 100644
index 000000000000..08d5c6c0f626
--- /dev/null
+++ b/pkgs/development/python-modules/kantoku/default.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flit-core,
+  gevent,
+  mock,
+  psutil,
+  pytest-cov-stub,
+  pytestCheckHook,
+  pyyaml,
+  pyzmq,
+  tornado,
+}:
+
+buildPythonPackage rec {
+  pname = "kantoku";
+  version = "0.18.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bentoml";
+    repo = "kantoku";
+    tag = version;
+    hash = "sha256-pI79B7TDZwL4Jz5e7PDPIf8iIGiwCOKFI2jReUt8UNg=";
+  };
+
+  build-system = [ flit-core ];
+
+  dependencies = [
+    psutil
+    pyzmq
+    tornado
+  ];
+
+  nativeCheckInputs = [
+    gevent
+    mock
+    pytest-cov-stub
+    pytestCheckHook
+    pyyaml
+  ];
+
+  pythonImportsCheck = [ "circus" ];
+
+  disabledTests = [
+    # AssertionError
+    "test_streams"
+  ];
+
+  meta = {
+    description = "A Process & Socket Manager built with zmq";
+    homepage = "https://github.com/bentoml/kantoku";
+    changelog = "https://github.com/bentoml/kantoku/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 478a19181288..256b5d70fcaf 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7721,6 +7721,8 @@ self: super: with self; {
 
   kanidm = callPackage ../development/python-modules/kanidm { };
 
+  kantoku = callPackage ../development/python-modules/kantoku { };
+
   kaptan = callPackage ../development/python-modules/kaptan { };
 
   karton-asciimagic = callPackage ../development/python-modules/karton-asciimagic { };

From e43b78c6d12da0f260e2b9b6b5207194ea445743 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 9 Sep 2025 21:55:30 +0200
Subject: [PATCH 041/129] python313Packages.bentoml: 1.4.19 -> 1.4.23

Changelog: https://github.com/bentoml/BentoML/releases/tag/v1.4.23
---
 .../python-modules/bentoml/default.nix        | 46 ++++++++++++-------
 1 file changed, 29 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/python-modules/bentoml/default.nix b/pkgs/development/python-modules/bentoml/default.nix
index 12f5cf61a0c0..962a32b5f0d0 100644
--- a/pkgs/development/python-modules/bentoml/default.nix
+++ b/pkgs/development/python-modules/bentoml/default.nix
@@ -1,40 +1,42 @@
 {
   lib,
   stdenv,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
-  hatchling,
-  hatch-vcs,
+  a2wsgi,
   aiohttp,
   aiosqlite,
   attrs,
+  buildPythonPackage,
   cattrs,
   circus,
-  click,
   click-option-group,
+  click,
   cloudpickle,
   deepmerge,
-  fs,
+  fetchFromGitHub,
   fs-s3fs,
-  grpcio,
+  fs,
+  fsspec,
   grpcio-channelz,
   grpcio-health-checking,
   grpcio-reflection,
-  httpx,
+  grpcio,
+  hatch-vcs,
+  hatchling,
   httpx-ws,
+  httpx,
   inflection,
   inquirerpy,
   jinja2,
+  kantoku,
   numpy,
   nvidia-ml-py,
   opentelemetry-api,
-  opentelemetry-exporter-otlp,
   opentelemetry-exporter-otlp-proto-http,
-  opentelemetry-instrumentation,
+  opentelemetry-exporter-otlp,
   opentelemetry-instrumentation-aiohttp-client,
   opentelemetry-instrumentation-asgi,
   opentelemetry-instrumentation-grpc,
+  opentelemetry-instrumentation,
   opentelemetry-sdk,
   opentelemetry-semantic-conventions,
   opentelemetry-util-http,
@@ -51,13 +53,15 @@
   python-dateutil,
   python-json-logger,
   python-multipart,
+  pythonOlder,
   pyyaml,
+  questionary,
   rich,
   schema,
   simple-di,
   starlette,
-  tomli,
   tomli-w,
+  tomli,
   tritonclient,
   uv,
   uvicorn,
@@ -71,10 +75,11 @@
   orjson,
   pytest-asyncio,
   fastapi,
+  writableTmpDirAsHomeHook,
 }:
 
 let
-  version = "1.4.19";
+  version = "1.4.23";
   aws = [ fs-s3fs ];
   grpc = [
     grpcio
@@ -124,7 +129,7 @@ let
     owner = "bentoml";
     repo = "BentoML";
     tag = "v${version}";
-    hash = "sha256-sRQfjB3K5F6lYeW92O7BV2slQ+DRCuMTVqRG8vT+9wc=";
+    hash = "sha256-p9d8TyN09jJ2VotaAvbC9jxJ5kNC2S7VhkatzrDJ1TY=";
   };
 in
 buildPythonPackage {
@@ -134,6 +139,7 @@ buildPythonPackage {
 
   pythonRelaxDeps = [
     "cattrs"
+    "fsspec"
     "nvidia-ml-py"
     "opentelemetry-api"
     "opentelemetry-instrumentation-aiohttp-client"
@@ -150,6 +156,7 @@ buildPythonPackage {
   ];
 
   dependencies = [
+    a2wsgi
     aiohttp
     aiosqlite
     attrs
@@ -160,11 +167,13 @@ buildPythonPackage {
     cloudpickle
     deepmerge
     fs
+    fsspec
     httpx
     httpx-ws
     inflection
     inquirerpy
     jinja2
+    kantoku
     numpy
     nvidia-ml-py
     opentelemetry-api
@@ -184,6 +193,7 @@ buildPythonPackage {
     python-json-logger
     python-multipart
     pyyaml
+    questionary
     rich
     schema
     simple-di
@@ -208,11 +218,15 @@ buildPythonPackage {
   disabledTestPaths = [
     "tests/e2e"
     "tests/integration"
+    "tests/unit/grpc"
+    "tests/unit/_internal/"
   ];
 
   disabledTests = [
     # flaky test
     "test_store"
+    #
+    "test_log_collection"
   ];
 
   nativeCheckInputs = [
@@ -226,6 +240,7 @@ buildPythonPackage {
     pytest-xdist
     pytestCheckHook
     scikit-learn
+    writableTmpDirAsHomeHook
   ]
   ++ optional-dependencies.grpc;
 
@@ -238,8 +253,5 @@ buildPythonPackage {
       happysalada
       natsukium
     ];
-    # AttributeError: 'dict' object has no attribute 'schemas'
-    # https://github.com/bentoml/BentoML/issues/4290
-    broken = versionAtLeast cattrs.version "23.2";
   };
 }

From e35a21d5750e424e531ddc0c15a113d7b313bb0d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 13:12:27 +0000
Subject: [PATCH 042/129] rmg-wayland: 0.7.9 -> 0.8.0

---
 pkgs/by-name/rm/rmg/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/rm/rmg/package.nix b/pkgs/by-name/rm/rmg/package.nix
index f5def5581181..d1b4b79a0301 100644
--- a/pkgs/by-name/rm/rmg/package.nix
+++ b/pkgs/by-name/rm/rmg/package.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rmg";
-  version = "0.7.9";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "Rosalie241";
     repo = "RMG";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RPjt79kDBgA8hxhDAZUU+xMuDcAMoxDhWt6NpTFHeMI=";
+    hash = "sha256-XMYHzPE5h9gD1fpN8b5YwOpY5zYCsYYQnof2MHDHa3E=";
   };
 
   nativeBuildInputs = [

From 1efdbe8f2f977d94f9770a99a6806531de6c1d81 Mon Sep 17 00:00:00 2001
From: Matt Sturgeon <matt@sturgeon.me.uk>
Date: Wed, 10 Sep 2025 14:34:32 +0100
Subject: [PATCH 043/129] lib/tests/misc: add option visibility test

---
 lib/tests/misc.nix | 89 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 89 insertions(+)

diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 9eb887a7b695..92525b8caa40 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -3210,6 +3210,95 @@ runTests {
     ];
   };
 
+  testDocOptionVisiblity = {
+    expr =
+      let
+        submodule =
+          { lib, ... }:
+          {
+            freeformType = lib.types.attrsOf (
+              lib.types.submodule {
+                options.bar = lib.mkOption { };
+              }
+            );
+            options.foo = lib.mkOption { };
+          };
+
+        module =
+          { lib, ... }:
+          {
+            options = {
+              shallow = lib.mkOption {
+                type = lib.types.submodule submodule;
+                visible = "shallow";
+              };
+              "true" = lib.mkOption {
+                type = lib.types.submodule submodule;
+                visible = true;
+              };
+              "false" = lib.mkOption {
+                type = lib.types.submodule submodule;
+                visible = false;
+              };
+              "internal" = lib.mkOption {
+                type = lib.types.submodule submodule;
+                internal = true;
+              };
+            };
+          };
+
+        options =
+          (evalModules {
+            modules = [ module ];
+          }).options;
+      in
+      pipe options [
+        optionAttrSetToDocList
+        (filter (opt: !(builtins.elem "_module" opt.loc)))
+        (map (
+          opt:
+          nameValuePair opt.name {
+            inherit (opt) visible internal;
+          }
+        ))
+        listToAttrs
+      ];
+    expected = {
+      shallow = {
+        visible = true;
+        internal = false;
+      };
+      "true" = {
+        visible = true;
+        internal = false;
+      };
+      "true.foo" = {
+        visible = true;
+        internal = false;
+      };
+      "true.<name>.bar" = {
+        visible = true;
+        internal = false;
+      };
+      "false" = {
+        visible = false;
+        internal = false;
+      };
+      "internal" = {
+        visible = true;
+        internal = true;
+      };
+      "internal.foo" = {
+        visible = true;
+        internal = false;
+      };
+      "internal.<name>.bar" = {
+        visible = true;
+        internal = false;
+      };
+    };
+  };
+
   testAttrsWithName = {
     expr =
       let

From ba961de6fb0bc63e2bbad5f38f048869911b3493 Mon Sep 17 00:00:00 2001
From: Matt Sturgeon <matt@sturgeon.me.uk>
Date: Wed, 10 Sep 2025 14:39:27 +0100
Subject: [PATCH 044/129] lib.options.mkOption: use one-sentence-per-line for
 `visible` docs

---
 lib/options.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index 637188d24d4f..b05e53e4cd46 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -113,7 +113,10 @@ rec {
       : Optional boolean indicating whether the option is for NixOS developers only.
 
       `visible`
-      : Optional boolean indicating whether the option shows up in the manual. Default: true. Use false to hide the option and any sub-options from submodules. Use "shallow" to hide only sub-options.
+      : Optional boolean indicating whether the option shows up in the manual.
+        Use false to hide the option and any sub-options from submodules.
+        Use "shallow" to hide only sub-options.
+        Default: true.
 
       `readOnly`
       : Optional boolean indicating whether the option can be set only once.

From b666b3a4ca5890fe9249c48130f9f7e886bff4fe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 16:22:46 +0000
Subject: [PATCH 045/129] mesos-dns: 0.9.3 -> 0.9.4

---
 pkgs/by-name/me/mesos-dns/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/me/mesos-dns/package.nix b/pkgs/by-name/me/mesos-dns/package.nix
index ecd23ade69ad..cb9babdb6c16 100644
--- a/pkgs/by-name/me/mesos-dns/package.nix
+++ b/pkgs/by-name/me/mesos-dns/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mesos-dns";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "m3scluster";
     repo = "mesos-dns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/zcjQ2AxZ17rAxrRmfztj5gH1pu2QswJgaCE022FieU=";
+    hash = "sha256-InUuEJjfZTRToCGiC3QYDK7UY8vje0T8RQ2YElIkb2w=";
   };
 
-  vendorHash = "sha256-TSw6ui5nGHRJiT/W+iszKA0rtgUIf73yDJaHkUgqowk=";
+  vendorHash = "sha256-l1y3CaGG1ykJnGit81D+E+jB4RUYneQzRMTvOPCH+jk=";
 
   subPackages = [ "." ];
 

From 26b75c8f52aca8dc35e0f313c3a8392bd358057b Mon Sep 17 00:00:00 2001
From: Robert Rose <robert.rose@mailbox.org>
Date: Wed, 10 Sep 2025 18:39:55 +0200
Subject: [PATCH 046/129] k3s: use substituteInPlace for killall script

---
 pkgs/applications/networking/cluster/k3s/builder.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index 6bc8e1344881..123747a881be 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -201,13 +201,9 @@ let
     sed --quiet '/# --- run the install process --/q;p' ${k3sRepo}/install.sh > install.sh
 
     # Let killall expect "containerd-shim" in the Nix store
-    to_replace="/data/\[\^/\]\*/bin/containerd-shim"
-    replacement="/nix/store/.*k3s-containerd.*/bin/containerd-shim"
-    changes=$(sed -i "s|$to_replace|$replacement| w /dev/stdout" install.sh)
-    if [ -z "$changes" ]; then
-      echo "failed to replace \"$to_replace\" in k3s installer script (install.sh)"
-      exit 1
-    fi
+    substituteInPlace install.sh \
+      --replace-fail '/data/[^/]*/bin/containerd-shim' \
+        '/nix/store/.*k3s-containerd.*/bin/containerd-shim'
 
     remove_matching_line() {
       line_to_delete=$(grep -n "$1" install.sh | cut -d : -f 1 || true)

From a62e7589bb5fc3d28404350dd2622f6f30202c1a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 10 Sep 2025 19:40:02 +0200
Subject: [PATCH 047/129] python313Packages.coinmetrics-api-client:
 2025.8.15.15 -> 2025.9.9.13

---
 .../python-modules/coinmetrics-api-client/default.nix       | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/coinmetrics-api-client/default.nix b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
index ca277f60dc4c..a8f6625f0a97 100644
--- a/pkgs/development/python-modules/coinmetrics-api-client/default.nix
+++ b/pkgs/development/python-modules/coinmetrics-api-client/default.nix
@@ -10,6 +10,7 @@
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
+  pyyaml,
   requests,
   tqdm,
   typer,
@@ -18,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "coinmetrics-api-client";
-  version = "2025.8.15.15";
+  version = "2025.9.9.13";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -28,7 +29,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "coinmetrics_api_client";
-    hash = "sha256-vk+L6PXygyI0UlO5l3xhw7Gcp5qi6sTH3TFdFAkQGZA=";
+    hash = "sha256-f5nMzx4oRHDkGAnexT6uamX2wGeEfrqCVBewq+2NxwA=";
   };
 
   pythonRelaxDeps = [ "typer" ];
@@ -38,6 +39,7 @@ buildPythonPackage rec {
   dependencies = [
     orjson
     python-dateutil
+    pyyaml
     requests
     typer
     tqdm

From 2b499c0a8abffb403a6248f315c96a1dfb0b6e17 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 10 Sep 2025 19:55:36 +0200
Subject: [PATCH 048/129] python313Packages.cyclopts: 3.23.1 -> 3.24.0

Diff: https://github.com/BrianPugh/cyclopts/compare/v3.23.1...v3.24.0

Changelog: https://github.com/BrianPugh/cyclopts/releases/tag/v3.24.0
---
 pkgs/development/python-modules/cyclopts/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cyclopts/default.nix b/pkgs/development/python-modules/cyclopts/default.nix
index ef4e3fdcbda9..f01ac6e888cc 100644
--- a/pkgs/development/python-modules/cyclopts/default.nix
+++ b/pkgs/development/python-modules/cyclopts/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "cyclopts";
-  version = "3.23.1";
+  version = "3.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "BrianPugh";
     repo = "cyclopts";
     tag = "v${version}";
-    hash = "sha256-qKQcx38b/GfFvJHXToLGkszBf5inRLfZTvcCX0MCaYk=";
+    hash = "sha256-gJflZBH3xCGKffKGt7y1xGXQR8C1wK19LnbunZ0kbAc=";
   };
 
   build-system = [

From 9e34dd516849256b5847263606d551aa52ee2e89 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 10 Sep 2025 19:56:51 +0200
Subject: [PATCH 049/129] python313Packages.countryguess: 0.4.5 -> 0.4.7

Diff: https://codeberg.org/plotski/countryguess/compare/v0.4.5...v0.4.7
---
 pkgs/development/python-modules/countryguess/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/countryguess/default.nix b/pkgs/development/python-modules/countryguess/default.nix
index e776ba9f2717..3b9fb18d34d2 100644
--- a/pkgs/development/python-modules/countryguess/default.nix
+++ b/pkgs/development/python-modules/countryguess/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "countryguess";
-  version = "0.4.5";
+  version = "0.4.7";
   pyproject = true;
 
   src = fetchFromGitea {
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "plotski";
     repo = "countryguess";
     tag = "v${version}";
-    hash = "sha256-JzhkXHitleQ2UIxdem8PYR5QhKGmkyfHmxG6VDP7pB0=";
+    hash = "sha256-yZyEOFXwbaYAIDl6LoHkwoqlhVzqShY8ZXPasB6unQ8=";
   };
 
   build-system = [

From 91471f882a267abb0c95fdd60e8d6d16e6161921 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 10 Sep 2025 19:59:20 +0200
Subject: [PATCH 050/129] python313Packages.dash-bootstrap-components: 2.0.3 ->
 2.0.4

Changelog: https://github.com/facultyai/dash-bootstrap-components/releases/tag/2.0.4
---
 .../python-modules/dash-bootstrap-components/default.nix      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dash-bootstrap-components/default.nix b/pkgs/development/python-modules/dash-bootstrap-components/default.nix
index 86f50d6d3480..d72d7d11d11a 100644
--- a/pkgs/development/python-modules/dash-bootstrap-components/default.nix
+++ b/pkgs/development/python-modules/dash-bootstrap-components/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "dash-bootstrap-components";
-  version = "2.0.3";
+  version = "2.0.4";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "dash_bootstrap_components";
-    hash = "sha256-XBYbBKbn7Rmn1U5C8HDCn9bDhdWneX56gpmaovwVsd4=";
+    hash = "sha256-wyBsCSN3S7xqbdqngiuNmqUyaw08HnzXlcyXUCX+JIQ=";
   };
 
   build-system = [ hatchling ];

From 939ce7b8ffa4507cfdd1c67f8b7431e5de049ca4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 19:07:48 +0000
Subject: [PATCH 051/129] 
 python3Packages.llama-index-indices-managed-llama-cloud: 0.9.2 -> 0.9.4

---
 .../llama-index-indices-managed-llama-cloud/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix b/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
index cb0b7dda7b49..50c1efe96390 100644
--- a/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-index-indices-managed-llama-cloud/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-indices-managed-llama-cloud";
-  version = "0.9.2";
+  version = "0.9.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_indices_managed_llama_cloud";
     inherit version;
-    hash = "sha256-Ga9V2o8SGNgDkPy+XN/vYQCsx1WwF3pAd6kkwxovs0U=";
+    hash = "sha256-teAHUqswVkq/GcV1laIQf1aXw7A7CFgXtPyoSjjrvVk=";
   };
 
   pythonRelaxDeps = [ "llama-cloud" ];

From 27a311154f379750f7f1df0a61141bc429ee4d57 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 19:21:04 +0000
Subject: [PATCH 052/129] msmtp: 1.8.30 -> 1.8.31

---
 pkgs/by-name/ms/msmtp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ms/msmtp/package.nix b/pkgs/by-name/ms/msmtp/package.nix
index 1a6a3f061f3e..006826e15b94 100644
--- a/pkgs/by-name/ms/msmtp/package.nix
+++ b/pkgs/by-name/ms/msmtp/package.nix
@@ -31,13 +31,13 @@
 let
   inherit (lib) getBin getExe optionals;
 
-  version = "1.8.30";
+  version = "1.8.31";
 
   src = fetchFromGitHub {
     owner = "marlam";
     repo = "msmtp";
     rev = "msmtp-${version}";
-    hash = "sha256-aM2qId08zvT9LbncCQYHsklbvHVtcZJgr91JTjwpQ/0=";
+    hash = "sha256-5PWwHyNEpF+eDMmvqJIHGdje70fCH5pLXGi5Jkjg2OA=";
   };
 
   meta = with lib; {

From c2387545b569dcc940a0981e8c2cd790f6650eac Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 19:39:40 +0000
Subject: [PATCH 053/129] andcli: 2.3.0 -> 2.4.0

---
 pkgs/by-name/an/andcli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/an/andcli/package.nix b/pkgs/by-name/an/andcli/package.nix
index 66b91e63f9f5..28c5d3f247a8 100644
--- a/pkgs/by-name/an/andcli/package.nix
+++ b/pkgs/by-name/an/andcli/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "andcli";
-  version = "2.3.0";
+  version = "2.4.0";
 
   subPackages = [ "cmd/andcli" ];
 
@@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
     owner = "tjblackheart";
     repo = "andcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-umV0oJ4sySnZzrIpRuTP/fT8a9nhkC1shVEfVVRpEyI=";
+    hash = "sha256-YGtBLx0Wt9Pn3V0+J9zFX9aBGWFJ8V8ordsSG4CSmxc=";
   };
 
-  vendorHash = "sha256-lzmkNxQUqktnl2Rpjgoa2yvAuGiMtVGNhiuF40how4o=";
+  vendorHash = "sha256-652JLCdxDDvhQIz3EbfoI7h+41Er3TiuJXi1cqbA4nI=";
 
   ldflags = [
     "-s"

From 72cf4bd5d929ad688b7f354d9c08b9fd0c9a451e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 19:40:36 +0000
Subject: [PATCH 054/129] baresip: 4.0.0 -> 4.1.0

---
 pkgs/by-name/ba/baresip/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ba/baresip/package.nix b/pkgs/by-name/ba/baresip/package.nix
index 2186b9a4fdd0..77a50d2a1670 100644
--- a/pkgs/by-name/ba/baresip/package.nix
+++ b/pkgs/by-name/ba/baresip/package.nix
@@ -31,14 +31,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "4.0.0";
+  version = "4.1.0";
   pname = "baresip";
 
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${version}";
-    hash = "sha256-Kun6fcDy7JQU0zrHfNxv9cV77Bm/WNrgrrGqCzrgTJ4=";
+    hash = "sha256-KbjdwvXUiNvHb6AXt38M9gkhliiie+8frvuqYJEsnJE=";
   };
 
   patches = [

From 80743f96d91c18e1e2172cb02000684004877b0b Mon Sep 17 00:00:00 2001
From: Amaan Qureshi <contact@amaanq.com>
Date: Wed, 10 Sep 2025 16:23:35 -0400
Subject: [PATCH 055/129] maintainers: add amaanq

---
 maintainers/maintainer-list.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4c763e3d157c..119fba03aef6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1341,6 +1341,13 @@
     githubId = 373;
     name = "Alexandre Girard Davila";
   };
+  amaanq = {
+    email = "contact@amaanq.com";
+    github = "amaanq";
+    githubId = 29718261;
+    matrix = "@amaan:amaanq.com";
+    name = "Amaan Qureshi";
+  };
   amadaluzia = {
     email = "amad@atl.tools";
     github = "amadaluzia";

From a920ea9862916ab99d7beddd385f95b1f4db3e23 Mon Sep 17 00:00:00 2001
From: Amaan Qureshi <contact@amaanq.com>
Date: Wed, 10 Sep 2025 16:25:15 -0400
Subject: [PATCH 056/129] tree-sitter: add amaanq as maintainer

---
 pkgs/development/tools/parsing/tree-sitter/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/tools/parsing/tree-sitter/default.nix b/pkgs/development/tools/parsing/tree-sitter/default.nix
index 499942477a8e..542d0ac8be25 100644
--- a/pkgs/development/tools/parsing/tree-sitter/default.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/default.nix
@@ -270,6 +270,7 @@ rustPlatform.buildRustPackage {
     maintainers = with lib.maintainers; [
       Profpatsch
       uncenter
+      amaanq
     ];
   };
 }

From 9ae0a1e8699031c6a0557f6bb984d4b0070b49bd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 21:36:32 +0000
Subject: [PATCH 057/129] wtfutil: 0.46.0 -> 0.46.1

---
 pkgs/by-name/wt/wtfutil/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/wt/wtfutil/package.nix b/pkgs/by-name/wt/wtfutil/package.nix
index a5f366205ce2..dd7839a15793 100644
--- a/pkgs/by-name/wt/wtfutil/package.nix
+++ b/pkgs/by-name/wt/wtfutil/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "wtfutil";
-  version = "0.46.0";
+  version = "0.46.1";
 
   src = fetchFromGitHub {
     owner = "wtfutil";
     repo = "wtf";
     rev = "v${version}";
-    sha256 = "sha256-05w5OyXlywt4jN0S0kv1GvbxmqZpEGud8PhV5ODCFu8=";
+    sha256 = "sha256-GLLTI/hxlkt3OvtTWRNdzQ9jzO4xzJV9RruiJUyWD5g=";
   };
 
-  vendorHash = "sha256-Vanus0oD11GxuQwwM8EoOLPsjgkQvQMiaHp6fRQZTrQ=";
+  vendorHash = "sha256-OSoQkBAx0kJKiKq0pRGrkkSowTynw/MJvYSdhd1Jt/k=";
   proxyVendor = true;
 
   doCheck = false;

From 8da4a5e44922ba5349fc5536f65d16c68931691d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 22:10:24 +0000
Subject: [PATCH 058/129] python3Packages.hcloud: 2.5.4 -> 2.6.0

---
 pkgs/development/python-modules/hcloud/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hcloud/default.nix b/pkgs/development/python-modules/hcloud/default.nix
index e9f749ea1b68..b4e89fec24a3 100644
--- a/pkgs/development/python-modules/hcloud/default.nix
+++ b/pkgs/development/python-modules/hcloud/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "hcloud";
-  version = "2.5.4";
+  version = "2.6.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JTLg2LbiD7WpCvX4026wA5oZfCCU0dVvx/zniaMAAl4=";
+    hash = "sha256-RZMzkHY+0IuWecYdebr94ay38Cltm4thN3wqTk4SyaE=";
   };
 
   build-system = [ setuptools ];

From f555a69ee78e16fa57fd563b62ba75793c3779b0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Sep 2025 23:58:31 +0000
Subject: [PATCH 059/129] terraform-providers.auth0: 1.27.0 -> 1.29.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index aa00f5cb9e34..e5e8c7019877 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -99,13 +99,13 @@
     "vendorHash": "sha256-YIn8akPW+DCVF0eYZxsmJxmrJuYhK4QLG/uhmmrXd4c="
   },
   "auth0": {
-    "hash": "sha256-mKpsTSa1peLXvxKaMQPlYhD26wkmjyPBF9D5s1yZO+k=",
+    "hash": "sha256-RnQq6dIaFfcix8uAmC2VJ5CLpaPXZjFYVbyPDEzqFFo=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v1.27.0",
+    "rev": "v1.29.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ERuWKsHV7rxQOaq6cwr9/DN/94L+OvDdPKPIjdbzVyo="
+    "vendorHash": "sha256-tS+LKp4n1SjCmdrJ0kbxrcUYR53NCsODD9Yiq8B8hok="
   },
   "avi": {
     "hash": "sha256-e8yzc3nRP0ktcuuKyBXydS9NhoceYZKzJcqCWOfaPL0=",

From cc36ea33aecdde52acd42de974706bfb8a1f7cf8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 02:40:46 +0000
Subject: [PATCH 060/129] codecrafters-cli: 37 -> 39

---
 pkgs/by-name/co/codecrafters-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/codecrafters-cli/package.nix b/pkgs/by-name/co/codecrafters-cli/package.nix
index a338fd3858cd..1e97259230b2 100644
--- a/pkgs/by-name/co/codecrafters-cli/package.nix
+++ b/pkgs/by-name/co/codecrafters-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "codecrafters-cli";
-  version = "37";
+  version = "39";
 
   src = fetchFromGitHub {
     owner = "codecrafters-io";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-MxeWShst5QZPXImXnCEGYSVzqB4HNygewrQxpwmfafk=";
+    hash = "sha256-yvKPDuORHySSYnsjAW3SrZ9GcrFaGfJYoG7+9IfQEVc=";
     # A shortened git commit hash is part of the version output, and is
     # needed at build time. Use the `.git` directory to retrieve the
     # commit SHA, and remove the directory afterwards since it is not needed

From 58c256775ca306fcd182acb9973934cb67b549b0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 02:57:28 +0000
Subject: [PATCH 061/129] lasuite-meet: 0.1.35 -> 0.1.36

---
 pkgs/by-name/la/lasuite-meet/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index dec773ea68d1..1a98c493ddb8 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -13,14 +13,14 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "lasuite-meet";
-  version = "0.1.35";
+  version = "0.1.36";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-gjvfsxuqVU7KyQxo7l+l0mC1F4fbe7gK+K4T5wAthY8=";
+    hash = "sha256-0GfbB1Kk2AdqQtwIiAdyfDS/V7le6DhmBugp1ukWRLc=";
   };
 
   sourceRoot = "source/src/backend";

From 73efe61058e7f4e72a58f620208f96a86b765d4a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 02:59:39 +0000
Subject: [PATCH 062/129] python3Packages.django-pghistory: 3.8.0 -> 3.8.1

---
 pkgs/development/python-modules/django-pghistory/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django-pghistory/default.nix b/pkgs/development/python-modules/django-pghistory/default.nix
index c62a23a38d4d..67cfa982d2eb 100644
--- a/pkgs/development/python-modules/django-pghistory/default.nix
+++ b/pkgs/development/python-modules/django-pghistory/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "django-pghistory";
-  version = "3.8.0";
+  version = "3.8.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Opus10";
     repo = "django-pghistory";
     tag = version;
-    hash = "sha256-+8Irib0pAxu4rMKhMK3vdY5wIt7w7XlDKerz95XIMnE=";
+    hash = "sha256-z1dpd2JC/IOLE/v0taJiEK8dlZedBS63KeYhv5MG6tk=";
   };
 
   build-system = [

From 68c10d454df2cd9f8d9672f74f9026ccb759714b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 03:17:28 +0000
Subject: [PATCH 063/129] git-statuses: 0.5.1 -> 0.6.1

---
 pkgs/by-name/gi/git-statuses/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gi/git-statuses/package.nix b/pkgs/by-name/gi/git-statuses/package.nix
index c9b95e545902..52d66ddce23b 100644
--- a/pkgs/by-name/gi/git-statuses/package.nix
+++ b/pkgs/by-name/gi/git-statuses/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "git-statuses";
-  version = "0.5.1";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "bircni";
     repo = "git-statuses";
     tag = finalAttrs.version;
-    hash = "sha256-nuWtW1NEECBqQ5uZKRqnvbjMUeYBg04j51zrHi/SDm0=";
+    hash = "sha256-phGEp9wo46owe47H+XjfDD5OlcN8cGr1oaeYMpkWies=";
   };
 
-  cargoHash = "sha256-WAr5AkT4C14HupJHHZi209jtE8a9IUwOCw76cYu8Yjc=";
+  cargoHash = "sha256-yG5oSwnhoFVbwdTteRgW1ljVmTnxoh8l4gG/pGuRmic=";
 
   # Needed to get openssl-sys to use pkg-config.
   env.OPENSSL_NO_VENDOR = 1;

From b3015ed7c2d852444d4e161c7832f236851f01fd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 03:55:09 +0000
Subject: [PATCH 064/129] double-entry-generator: 2.10.1 -> 2.11.0

---
 pkgs/by-name/do/double-entry-generator/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/do/double-entry-generator/package.nix b/pkgs/by-name/do/double-entry-generator/package.nix
index 48aafd7fa5a1..2262a60251f1 100644
--- a/pkgs/by-name/do/double-entry-generator/package.nix
+++ b/pkgs/by-name/do/double-entry-generator/package.nix
@@ -6,15 +6,15 @@
 }:
 buildGoModule rec {
   pname = "double-entry-generator";
-  version = "2.10.1";
+  version = "2.11.0";
   src = fetchFromGitHub {
     owner = "deb-sig";
     repo = "double-entry-generator";
-    hash = "sha256-zAkiTUnuk6o2wFta1hG0RRD8/LIdgNFcSYvQ0Y2zeJY=";
+    hash = "sha256-tHJwn1G/2wySnKpF+P0tyOu3mYk8zD9D301kxrWaWws=";
     rev = "v${version}";
   };
 
-  vendorHash = "sha256-NoWUaawApdTSWGRul9mpOxgRZWTE7LTz3pJgwU2NWVU=";
+  vendorHash = "sha256-CJ+mfH9qJXYhicxrL9+i8H6CVKZua40D1/Sg3vWQs68=";
 
   excludedPackages = [ "hack" ];
 

From 24576b4e371009ab90b8547e2fd05b0f8e408acf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 03:58:28 +0000
Subject: [PATCH 065/129] python3Packages.hatasmota: 0.10.0 -> 0.10.1

---
 pkgs/development/python-modules/hatasmota/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hatasmota/default.nix b/pkgs/development/python-modules/hatasmota/default.nix
index 640030b8eac2..af0d5c4cce88 100644
--- a/pkgs/development/python-modules/hatasmota/default.nix
+++ b/pkgs/development/python-modules/hatasmota/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "hatasmota";
-  version = "0.10.0";
+  version = "0.10.1";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "emontnemery";
     repo = "hatasmota";
     tag = version;
-    hash = "sha256-T4C0lgVKmlHHuVPzrqC3Mm089TfzY2JCZK73be1W5+w=";
+    hash = "sha256-Be6W7+DMpMXezEQDkEN9+ei7cJXP1bGIURuXlMNyR0Y=";
   };
 
   build-system = [ setuptools ];

From 0ad5d68b70986850e673d0870a055ccb5bebeb9d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 04:06:20 +0000
Subject: [PATCH 066/129] python3Packages.pycuda: 2025.1.1 -> 2025.1.2

---
 pkgs/development/python-modules/pycuda/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pycuda/default.nix b/pkgs/development/python-modules/pycuda/default.nix
index 0ffc210d54ae..bec89563e1e3 100644
--- a/pkgs/development/python-modules/pycuda/default.nix
+++ b/pkgs/development/python-modules/pycuda/default.nix
@@ -23,12 +23,12 @@ let
 in
 buildPythonPackage rec {
   pname = "pycuda";
-  version = "2025.1.1";
+  version = "2025.1.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-urBnjUP0achl9f5gJPSBx4HsUf7+Zoas1mxnK/q+o08=";
+    hash = "sha256-DdgpEdctjgPGMSiuROmc+3tGiQlKumzFGT2OlEcXqvo=";
   };
 
   preConfigure = with lib.versions; ''

From 227cf8846f96443488af8be693fa71129fc1f03d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 04:24:22 +0000
Subject: [PATCH 067/129] semantic-release: 24.2.7 -> 24.2.8

---
 pkgs/by-name/se/semantic-release/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/se/semantic-release/package.nix b/pkgs/by-name/se/semantic-release/package.nix
index d769dbf91579..80571b984e54 100644
--- a/pkgs/by-name/se/semantic-release/package.nix
+++ b/pkgs/by-name/se/semantic-release/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "semantic-release";
-  version = "24.2.7";
+  version = "24.2.8";
 
   src = fetchFromGitHub {
     owner = "semantic-release";
     repo = "semantic-release";
     rev = "v${version}";
-    hash = "sha256-7BIEb4gQLppa+CXCR+oYPvb/l8UB6ihNh4veBdDG8ac=";
+    hash = "sha256-blPpIVL1bg8u7vnZo+XRvVPOv8UAmwtt7Rl1h3XC1L8=";
   };
 
-  npmDepsHash = "sha256-ODu8foiTtU7bsaVL/ri4eCwpcyg/7CdSGtyPsA/myxU=";
+  npmDepsHash = "sha256-XvZpyDEUMDj4TvjDsDhWiyJHiy+14mWgTghXeFP+vBM=";
 
   dontNpmBuild = true;
 

From becc4d99528ee1fdbc180b0c2ccfcc8de06a6902 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 05:01:03 +0000
Subject: [PATCH 068/129] python3Packages.dissect-qnxfs: 1.0 -> 1.1

---
 pkgs/development/python-modules/dissect-qnxfs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-qnxfs/default.nix b/pkgs/development/python-modules/dissect-qnxfs/default.nix
index fede97c6eef9..0bf58f3af9b1 100644
--- a/pkgs/development/python-modules/dissect-qnxfs/default.nix
+++ b/pkgs/development/python-modules/dissect-qnxfs/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "dissect-qnxfs";
-  version = "1.0";
+  version = "1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.qnxfs";
     tag = version;
-    hash = "sha256-UnEwBcaBP64qIWVYWcsxxjWuiAM9yOCGWevnNonQn+8=";
+    hash = "sha256-XKiVfJWxrh4rAVXrQMd761cU8t9PhtCXkZOORd2euA8=";
   };
 
   build-system = [

From f6599814ecc685f617f779fa6b8a1663c2bee33b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 05:15:24 +0000
Subject: [PATCH 069/129] overpush: 0.4.6 -> 0.4.7

---
 pkgs/by-name/ov/overpush/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ov/overpush/package.nix b/pkgs/by-name/ov/overpush/package.nix
index 6030c1aa3e52..d7f6cc8a4579 100644
--- a/pkgs/by-name/ov/overpush/package.nix
+++ b/pkgs/by-name/ov/overpush/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "overpush";
-  version = "0.4.6";
+  version = "0.4.7";
 
   src = fetchFromGitHub {
     owner = "mrusme";
     repo = "overpush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2EIOCeW/PuZFDmLShexnPomvx3PtGzZ6jWNvoJSxO7Q=";
+    hash = "sha256-I4i1HhqvliSFiL8rFhKF5qrfPsUuxDTE79V/Q7Js+xs=";
   };
 
-  vendorHash = "sha256-KUfGc4vFfw59mwqR840cbL4ubBH1i+sIniHU0CDCKTg=";
+  vendorHash = "sha256-2KUWWATRwwtA/1Nm2JQrDS8f0ZIca/f190DSNtjemZE=";
 
   env.CGO_ENABLED = "0";
 

From 689e246b9134a5d54c6ae814f2e622cb97da886c Mon Sep 17 00:00:00 2001
From: Robert Rose <robert.rose@mailbox.org>
Date: Wed, 10 Sep 2025 18:40:21 +0200
Subject: [PATCH 070/129] k3s: use inherit for passthru attributes

---
 .../networking/cluster/k3s/builder.nix           | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index 123747a881be..41dcb8722d34 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -449,12 +449,15 @@ buildGoModule (finalAttrs: {
   versionCheckProgramArg = "--version";
 
   passthru = {
-    inherit airgap-images;
-    k3sCNIPlugins = k3sCNIPlugins;
-    k3sContainerd = k3sContainerd;
-    k3sRepo = k3sRepo;
-    k3sRoot = k3sRoot;
-    k3sBundle = k3sBundle;
+    inherit
+      airgap-images
+      k3sCNIPlugins
+      k3sContainerd
+      k3sRepo
+      k3sRoot
+      k3sBundle
+      updateScript
+      ;
     tests =
       let
         mkTests =
@@ -465,7 +468,6 @@ buildGoModule (finalAttrs: {
           lib.mapAttrs (name: value: nixosTests.k3s.${name}.${k3s_version}) nixosTests.k3s;
       in
       mkTests k3sVersion;
-    updateScript = updateScript;
     imagesList = throw "k3s.imagesList was removed";
     airgapImages = throw "k3s.airgapImages was renamed to k3s.airgap-images";
     airgapImagesAmd64 = throw "k3s.airgapImagesAmd64 was renamed to k3s.airgap-images-amd64-tar-zst";

From f5d63b9376fec911244e30a004308a393d978678 Mon Sep 17 00:00:00 2001
From: Robert Rose <robert.rose@mailbox.org>
Date: Thu, 11 Sep 2025 09:51:34 +0200
Subject: [PATCH 071/129] nixos/k3s: use improved error reporting and
 assertions

Additionally, mark testScript as python and remove shutdowns at the end
of tests.
---
 nixos/tests/k3s/auto-deploy-charts.nix |  8 ++--
 nixos/tests/k3s/auto-deploy.nix        | 33 ++++++++-------
 nixos/tests/k3s/containerd-config.nix  | 25 +++++------
 nixos/tests/k3s/etcd.nix               | 57 ++++++++++++--------------
 nixos/tests/k3s/kubelet-config.nix     | 46 ++++++++++-----------
 nixos/tests/k3s/multi-node.nix         |  2 +-
 nixos/tests/k3s/single-node.nix        | 57 +++++++++++++-------------
 7 files changed, 110 insertions(+), 118 deletions(-)

diff --git a/nixos/tests/k3s/auto-deploy-charts.nix b/nixos/tests/k3s/auto-deploy-charts.nix
index fe4c8ca4690d..827640b02fd4 100644
--- a/nixos/tests/k3s/auto-deploy-charts.nix
+++ b/nixos/tests/k3s/auto-deploy-charts.nix
@@ -135,7 +135,7 @@ import ../make-test-python.nix (
         machine.succeed("test -e /var/lib/rancher/k3s/server/manifests/advanced.yaml")
         # check that the timeout is set correctly, select only the first doc in advanced.yaml
         advancedManifest = json.loads(machine.succeed("yq -o json 'select(di == 0)' /var/lib/rancher/k3s/server/manifests/advanced.yaml"))
-        assert advancedManifest["spec"]["timeout"] == "69s", f"unexpected value for spec.timeout: {advancedManifest["spec"]["timeout"]}"
+        t.assertEqual(advancedManifest["spec"]["timeout"], "69s", "unexpected value for spec.timeout")
         # wait for test jobs to complete
         machine.wait_until_succeeds("kubectl wait --for=condition=complete job/hello", timeout=180)
         machine.wait_until_succeeds("kubectl wait --for=condition=complete job/values-file", timeout=180)
@@ -145,9 +145,9 @@ import ../make-test-python.nix (
         values_file_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=values-file")
         advanced_output = machine.succeed("kubectl -n test logs -l batch.kubernetes.io/job-name=advanced")
         # strip the output to remove trailing whitespaces
-        assert hello_output.rstrip() == "Hello, world!", f"unexpected output of hello job: {hello_output}"
-        assert values_file_output.rstrip() == "Hello, file!", f"unexpected output of values file job: {values_file_output}"
-        assert advanced_output.rstrip() == "advanced hello", f"unexpected output of advanced job: {advanced_output}"
+        t.assertEqual(hello_output.rstrip(), "Hello, world!", "unexpected output of hello job")
+        t.assertEqual(values_file_output.rstrip(), "Hello, file!", "unexpected output of values file job")
+        t.assertEqual(advanced_output.rstrip(), "advanced hello", "unexpected output of advanced job")
         # wait for bundled traefik deployment
         machine.wait_until_succeeds("kubectl -n kube-system rollout status deployment traefik", timeout=180)
       '';
diff --git a/nixos/tests/k3s/auto-deploy.nix b/nixos/tests/k3s/auto-deploy.nix
index c25503ac1087..d8ca4822abf0 100644
--- a/nixos/tests/k3s/auto-deploy.nix
+++ b/nixos/tests/k3s/auto-deploy.nix
@@ -99,26 +99,25 @@ import ../make-test-python.nix (
         };
       };
 
-    testScript = ''
-      start_all()
+    testScript = # python
+      ''
+        start_all()
 
-      machine.wait_for_unit("k3s")
-      # check existence of the manifest files
-      machine.fail("ls /var/lib/rancher/k3s/server/manifests/absent.yaml")
-      machine.succeed("ls /var/lib/rancher/k3s/server/manifests/foo-namespace.yaml")
-      machine.succeed("ls /var/lib/rancher/k3s/server/manifests/hello.yaml")
+        machine.wait_for_unit("k3s")
+        # check existence of the manifest files
+        machine.fail("ls /var/lib/rancher/k3s/server/manifests/absent.yaml")
+        machine.succeed("ls /var/lib/rancher/k3s/server/manifests/foo-namespace.yaml")
+        machine.succeed("ls /var/lib/rancher/k3s/server/manifests/hello.yaml")
 
-      # check if container images got imported
-      machine.wait_until_succeeds("crictl img | grep 'test\.local/pause'")
-      machine.wait_until_succeeds("crictl img | grep 'test\.local/hello'")
+        # check if container images got imported
+        machine.wait_until_succeeds("crictl img | grep 'test\.local/pause'")
+        machine.wait_until_succeeds("crictl img | grep 'test\.local/hello'")
 
-      # check if resources of manifests got created
-      machine.wait_until_succeeds("kubectl get ns foo")
-      machine.wait_until_succeeds("kubectl wait --for=condition=complete job/hello")
-      machine.fail("kubectl get ns absent")
-
-      machine.shutdown()
-    '';
+        # check if resources of manifests got created
+        machine.wait_until_succeeds("kubectl get ns foo")
+        machine.wait_until_succeeds("kubectl wait --for=condition=complete job/hello")
+        machine.fail("kubectl get ns absent")
+      '';
 
     meta.maintainers = lib.teams.k3s.members;
   }
diff --git a/nixos/tests/k3s/containerd-config.nix b/nixos/tests/k3s/containerd-config.nix
index ffc449b03aba..0ebfd4dac347 100644
--- a/nixos/tests/k3s/containerd-config.nix
+++ b/nixos/tests/k3s/containerd-config.nix
@@ -40,18 +40,19 @@ import ../make-test-python.nix (
         };
       };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("k3s")
-      # wait until the node is ready
-      machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
-      # test whether the config template file contains the magic comment
-      out=machine.succeed("cat /var/lib/rancher/k3s/agent/etc/containerd/config.toml.tmpl")
-      assert "MAGIC COMMENT" in out, "the containerd config template does not contain the magic comment"
-      # test whether the config file contains the magic comment
-      out=machine.succeed("cat /var/lib/rancher/k3s/agent/etc/containerd/config.toml")
-      assert "MAGIC COMMENT" in out, "the containerd config does not contain the magic comment"
-    '';
+    testScript = # python
+      ''
+        start_all()
+        machine.wait_for_unit("k3s")
+        # wait until the node is ready
+        machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
+        # test whether the config template file contains the magic comment
+        out=machine.succeed("cat /var/lib/rancher/k3s/agent/etc/containerd/config.toml.tmpl")
+        t.assertIn("MAGIC COMMENT", out, "the containerd config template does not contain the magic comment")
+        # test whether the config file contains the magic comment
+        out=machine.succeed("cat /var/lib/rancher/k3s/agent/etc/containerd/config.toml")
+        t.assertIn("MAGIC COMMENT", out, "the containerd config does not contain the magic comment")
+      '';
 
     meta.maintainers = lib.teams.k3s.members;
   }
diff --git a/nixos/tests/k3s/etcd.nix b/nixos/tests/k3s/etcd.nix
index 7d9a7ba2b7d8..c858dd4e0283 100644
--- a/nixos/tests/k3s/etcd.nix
+++ b/nixos/tests/k3s/etcd.nix
@@ -82,46 +82,43 @@ import ../make-test-python.nix (
         };
     };
 
-    testScript = ''
-      with subtest("should start etcd"):
-          etcd.start()
-          etcd.wait_for_unit("etcd.service")
+    testScript = # python
+      ''
+        with subtest("should start etcd"):
+            etcd.start()
+            etcd.wait_for_unit("etcd.service")
 
-      with subtest("should wait for etcdctl endpoint status to succeed"):
-          etcd.wait_until_succeeds("etcdctl endpoint status")
+        with subtest("should wait for etcdctl endpoint status to succeed"):
+            etcd.wait_until_succeeds("etcdctl endpoint status")
 
-      with subtest("should wait for etcdctl endpoint health to succeed"):
-          etcd.wait_until_succeeds("etcdctl endpoint health")
+        with subtest("should wait for etcdctl endpoint health to succeed"):
+            etcd.wait_until_succeeds("etcdctl endpoint health")
 
-      with subtest("should start k3s"):
-          k3s.start()
-          k3s.wait_for_unit("k3s")
+        with subtest("should start k3s"):
+            k3s.start()
+            k3s.wait_for_unit("k3s")
 
-      with subtest("should test if kubectl works"):
-          k3s.wait_until_succeeds("k3s kubectl get node")
+        with subtest("should test if kubectl works"):
+            k3s.wait_until_succeeds("k3s kubectl get node")
 
-      with subtest("should wait for service account to show up; takes a sec"):
-          k3s.wait_until_succeeds("k3s kubectl get serviceaccount default")
+        with subtest("should wait for service account to show up; takes a sec"):
+            k3s.wait_until_succeeds("k3s kubectl get serviceaccount default")
 
-      with subtest("should create a sample secret object"):
-          k3s.succeed("k3s kubectl create secret generic nixossecret --from-literal thesecret=abacadabra")
+        with subtest("should create a sample secret object"):
+            k3s.succeed("k3s kubectl create secret generic nixossecret --from-literal thesecret=abacadabra")
 
-      with subtest("should check if secret is correct"):
-          k3s.wait_until_succeeds("[[ $(kubectl get secrets nixossecret -o json | jq -r .data.thesecret | base64 -d) == abacadabra ]]")
+        with subtest("should check if secret is correct"):
+            k3s.wait_until_succeeds("[[ $(kubectl get secrets nixossecret -o json | jq -r .data.thesecret | base64 -d) == abacadabra ]]")
 
-      with subtest("should have a secret in database"):
-          etcd.wait_until_succeeds("[[ $(etcdctl get /registry/secrets/default/nixossecret | head -c1 | wc -c) -ne 0 ]]")
+        with subtest("should have a secret in database"):
+            etcd.wait_until_succeeds("[[ $(etcdctl get /registry/secrets/default/nixossecret | head -c1 | wc -c) -ne 0 ]]")
 
-      with subtest("should delete the secret"):
-          k3s.succeed("k3s kubectl delete secret nixossecret")
+        with subtest("should delete the secret"):
+            k3s.succeed("k3s kubectl delete secret nixossecret")
 
-      with subtest("should not have a secret in database"):
-          etcd.wait_until_fails("[[ $(etcdctl get /registry/secrets/default/nixossecret | head -c1 | wc -c) -ne 0 ]]")
-
-      with subtest("should shutdown k3s and etcd"):
-          k3s.shutdown()
-          etcd.shutdown()
-    '';
+        with subtest("should not have a secret in database"):
+            etcd.wait_until_fails("[[ $(etcdctl get /registry/secrets/default/nixossecret | head -c1 | wc -c) -ne 0 ]]")
+      '';
 
     meta.maintainers = etcd.meta.maintainers ++ lib.teams.k3s.members;
   }
diff --git a/nixos/tests/k3s/kubelet-config.nix b/nixos/tests/k3s/kubelet-config.nix
index 031c9f823a63..f5aacd22a13f 100644
--- a/nixos/tests/k3s/kubelet-config.nix
+++ b/nixos/tests/k3s/kubelet-config.nix
@@ -47,33 +47,29 @@ import ../make-test-python.nix (
         };
       };
 
-    testScript = ''
-      import json
+    testScript = # python
+      ''
+        import json
 
-      start_all()
-      machine.wait_for_unit("k3s")
-      # wait until the node is ready
-      machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
-      # test whether the kubelet registered an inhibitor lock
-      machine.succeed("systemd-inhibit --list --no-legend | grep \"kubelet.*k3s-server.*shutdown\"")
-      # run kubectl proxy in the background, close stdout through redirection to not wait for the command to finish
-      machine.execute("kubectl proxy --address 127.0.0.1 --port=8001 >&2 &")
-      machine.wait_until_succeeds("nc -z 127.0.0.1 8001")
-      # get the kubeletconfig
-      kubelet_config=json.loads(machine.succeed("curl http://127.0.0.1:8001/api/v1/nodes/${nodeName}/proxy/configz | jq '.kubeletconfig'"))
+        start_all()
+        machine.wait_for_unit("k3s")
+        # wait until the node is ready
+        machine.wait_until_succeeds(r"""kubectl get node ${nodeName} -ojson | jq -e '.status.conditions[] | select(.type == "Ready") | .status == "True"'""")
+        # test whether the kubelet registered an inhibitor lock
+        machine.succeed("systemd-inhibit --list --no-legend | grep \"kubelet.*k3s-server.*shutdown\"")
+        # run kubectl proxy in the background, close stdout through redirection to not wait for the command to finish
+        machine.execute("kubectl proxy --address 127.0.0.1 --port=8001 >&2 &")
+        machine.wait_until_succeeds("nc -z 127.0.0.1 8001")
+        # get the kubeletconfig
+        kubelet_config=json.loads(machine.succeed("curl http://127.0.0.1:8001/api/v1/nodes/${nodeName}/proxy/configz | jq '.kubeletconfig'"))
 
-      with subtest("Kubelet config values are set correctly"):
-        assert kubelet_config["shutdownGracePeriod"] == "${shutdownGracePeriod}", \
-          f"unexpected value for shutdownGracePeriod: {kubelet_config["shutdownGracePeriod"]}"
-        assert kubelet_config["shutdownGracePeriodCriticalPods"] == "${shutdownGracePeriodCriticalPods}", \
-          f"unexpected value for shutdownGracePeriodCriticalPods: {kubelet_config["shutdownGracePeriodCriticalPods"]}"
-        assert kubelet_config["podsPerCore"] == ${toString podsPerCore}, \
-          f"unexpected value for podsPerCore: {kubelet_config["podsPerCore"]}"
-        assert kubelet_config["memoryThrottlingFactor"] == ${toString memoryThrottlingFactor}, \
-          f"unexpected value for memoryThrottlingFactor: {kubelet_config["memoryThrottlingFactor"]}"
-        assert kubelet_config["containerLogMaxSize"] == "${containerLogMaxSize}", \
-          f"unexpected value for containerLogMaxSize: {kubelet_config["containerLogMaxSize"]}"
-    '';
+        with subtest("Kubelet config values are set correctly"):
+          t.assertEqual(kubelet_config["shutdownGracePeriod"], "${shutdownGracePeriod}")
+          t.assertEqual(kubelet_config["shutdownGracePeriodCriticalPods"], "${shutdownGracePeriodCriticalPods}")
+          t.assertEqual(kubelet_config["podsPerCore"], ${toString podsPerCore})
+          t.assertEqual(kubelet_config["memoryThrottlingFactor"], ${toString memoryThrottlingFactor})
+          t.assertEqual(kubelet_config["containerLogMaxSize"],"${containerLogMaxSize}")
+      '';
 
     meta.maintainers = lib.teams.k3s.members;
   }
diff --git a/nixos/tests/k3s/multi-node.nix b/nixos/tests/k3s/multi-node.nix
index 335b8f8e6426..fdf825a3c103 100644
--- a/nixos/tests/k3s/multi-node.nix
+++ b/nixos/tests/k3s/multi-node.nix
@@ -192,7 +192,7 @@ import ../make-test-python.nix (
             # Verify the pods can talk to each other
             for pod in pods:
                 resp = server.succeed(f"k3s kubectl exec {pod} -- socat TCP:{pod_ip}:8000 -")
-                assert resp.strip() == "server"
+                t.assertEqual(resp.strip(), "server")
       '';
 
     meta.maintainers = lib.teams.k3s.members;
diff --git a/nixos/tests/k3s/single-node.nix b/nixos/tests/k3s/single-node.nix
index 55a15324c88f..4ce38f5ceef0 100644
--- a/nixos/tests/k3s/single-node.nix
+++ b/nixos/tests/k3s/single-node.nix
@@ -76,40 +76,39 @@ import ../make-test-python.nix (
         };
       };
 
-    testScript = ''
-      start_all()
+    testScript = # python
+      ''
+        start_all()
 
-      machine.wait_for_unit("k3s")
-      machine.succeed("kubectl cluster-info")
-      machine.fail("sudo -u noprivs kubectl cluster-info")
-      machine.succeed("k3s check-config")
-      machine.succeed(
-          "${pauseImage} | ctr image import -"
-      )
+        machine.wait_for_unit("k3s")
+        machine.succeed("kubectl cluster-info")
+        machine.fail("sudo -u noprivs kubectl cluster-info")
+        machine.succeed("k3s check-config")
+        machine.succeed(
+            "${pauseImage} | ctr image import -"
+        )
 
-      # Also wait for our service account to show up; it takes a sec
-      machine.wait_until_succeeds("kubectl get serviceaccount default")
-      machine.succeed("kubectl apply -f ${testPodYaml}")
-      machine.succeed("kubectl wait --for 'condition=Ready' pod/test")
-      machine.succeed("kubectl delete -f ${testPodYaml}")
+        # Also wait for our service account to show up; it takes a sec
+        machine.wait_until_succeeds("kubectl get serviceaccount default")
+        machine.succeed("kubectl apply -f ${testPodYaml}")
+        machine.succeed("kubectl wait --for 'condition=Ready' pod/test")
+        machine.succeed("kubectl delete -f ${testPodYaml}")
 
-      # regression test for #176445
-      machine.fail("journalctl -o cat -u k3s.service | grep 'ipset utility not found'")
+        # regression test for #176445
+        machine.fail("journalctl -o cat -u k3s.service | grep 'ipset utility not found'")
 
-      with subtest("Run k3s-killall"):
-          # Call the killall script with a clean path to assert that
-          # all required commands are wrapped
-          output = machine.succeed("PATH= ${k3s}/bin/k3s-killall.sh 2>&1 | tee /dev/stderr")
-          assert "command not found" not in output, "killall script contains unknown command"
+        with subtest("Run k3s-killall"):
+            # Call the killall script with a clean path to assert that
+            # all required commands are wrapped
+            output = machine.succeed("PATH= ${k3s}/bin/k3s-killall.sh 2>&1 | tee /dev/stderr")
+            t.assertNotIn("command not found", output, "killall script contains unknown command")
 
-          # Check that killall cleaned up properly
-          machine.fail("systemctl is-active k3s.service")
-          machine.fail("systemctl list-units | grep containerd")
-          machine.fail("ip link show | awk -F': ' '{print $2}' | grep -e flannel -e cni0")
-          machine.fail("ip netns show | grep cni-")
-
-      machine.shutdown()
-    '';
+            # Check that killall cleaned up properly
+            machine.fail("systemctl is-active k3s.service")
+            machine.fail("systemctl list-units | grep containerd")
+            machine.fail("ip link show | awk -F': ' '{print $2}' | grep -e flannel -e cni0")
+            machine.fail("ip netns show | grep cni-")
+      '';
 
     meta.maintainers = lib.teams.k3s.members;
   }

From 394148bf9362c4d05d53ee2e2e133871ee5d6b6d Mon Sep 17 00:00:00 2001
From: isabel <isabel@isabelroses.com>
Date: Thu, 11 Sep 2025 12:31:09 +0100
Subject: [PATCH 072/129] moonlight: 1.3.27 -> 1.3.28

Diff: https://github.com/moonlight-mod/moonlight/compare/v1.3.27...v1.3.28

Changelog: https://raw.githubusercontent.com/moonlight-mod/moonlight/refs/tags/v1.3.28/CHANGELOG.md
---
 pkgs/by-name/mo/moonlight/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index 9f6ff699ccaf..719d405da731 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "1.3.27";
+  version = "1.3.28";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-feWRxpNfnBj110DMlBqipe7wunqDZ8SvUvrtnnlePgk=";
+    hash = "sha256-aLjHKVWkb9XHyoMmDBxLG2Ycg4CJFeieLdEg3CWeIwk=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     buildInputs = [ nodejs_22 ];
 
     fetcherVersion = 2;
-    hash = "sha256-Y+OusNJJUTVxa7D99Y/dJeJO4o0UDXFnY48Z2oGPF0Y=";
+    hash = "sha256-DvSBiUkIQbDkdgfHBw9h1odo3ApZq+emBDkbcQnx6NA=";
   };
 
   env = {

From df1332321c03b79cd7bcd0aecc24c87d7eff41ae Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 11:41:39 +0000
Subject: [PATCH 073/129] cdncheck: 1.1.34 -> 1.1.35

---
 pkgs/by-name/cd/cdncheck/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index ba8c03eb2cdd..1a115db2ebbf 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.1.34";
+  version = "1.1.35";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-I/wmKKrXFjaha2sq9l/zFJkkDf6DNNeSAOBcKmnOZNg=";
+    hash = "sha256-/ZVR4cGqUIjtiESNYFdedlYuQvLpgs1M/yyBveTF6b4=";
   };
 
   vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";

From a4a98b8002775baa85f9a4332709da9686c8a768 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 12:03:30 +0000
Subject: [PATCH 074/129] python3Packages.django-anymail: 13.0.1 -> 13.1

---
 pkgs/development/python-modules/django-anymail/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django-anymail/default.nix b/pkgs/development/python-modules/django-anymail/default.nix
index 69074db017ef..27e35eb170a5 100644
--- a/pkgs/development/python-modules/django-anymail/default.nix
+++ b/pkgs/development/python-modules/django-anymail/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "django-anymail";
-  version = "13.0.1";
+  version = "13.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "anymail";
     repo = "django-anymail";
     tag = "v${version}";
-    hash = "sha256-ozaukE6W2tq+RBVL10GV9epUMb5W6Yn4s2oeB14Skp8=";
+    hash = "sha256-R/PPAar93yMslKnhiiMcv4DIZrIJEQGqMm5yLZ9Mn+8=";
   };
 
   build-system = [ hatchling ];

From 6157f6fd44bcf2cd825913e531f2d4ea02398e5c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 12:35:40 +0000
Subject: [PATCH 075/129] python3Packages.llama-index-embeddings-gemini: 0.4.0
 -> 0.4.1

---
 .../python-modules/llama-index-embeddings-gemini/default.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
index 8d09ffdb7126..03db0458f22b 100644
--- a/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-gemini/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-embeddings-gemini";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_embeddings_gemini";
     inherit version;
-    hash = "sha256-Cyy89LP4B+J4fbMQmyZyH3VrRSnX7A0U6zGIvS0xPqw=";
+    hash = "sha256-XkFXYdaRr1i0Ez5GLkxIGIJZcR/hCS2mB2t5jWRUUs0=";
   };
 
   pythonRelaxDeps = [ "google-generativeai" ];

From 84acad865c1bd1943a45236b23967a1245ffae2a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 13:11:58 +0000
Subject: [PATCH 076/129] svls: 0.2.12 -> 0.2.13

---
 pkgs/by-name/sv/svls/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sv/svls/package.nix b/pkgs/by-name/sv/svls/package.nix
index 625d41b7ff21..7ec20148fd15 100644
--- a/pkgs/by-name/sv/svls/package.nix
+++ b/pkgs/by-name/sv/svls/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svls";
-  version = "0.2.12";
+  version = "0.2.13";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = "svls";
     rev = "v${version}";
-    sha256 = "sha256-DuwH0qie8SctvOGntljOdTRMGKrNFPycdaFG3QZxihA=";
+    sha256 = "sha256-kxsB7il2KKjxSUoA+e6tSNQHwGGVO4UB/mAfnDPjb0c=";
   };
 
-  cargoHash = "sha256-L+MTU92SUohhQ5Oy2ziU/1f4IxFcrW2JGUSx7iPxl/I=";
+  cargoHash = "sha256-2SOCv8xeaRVlpJrBd9po5KgNY7ZSraw4UNsE0gRTbLs=";
 
   meta = with lib; {
     description = "SystemVerilog language server";

From 6174e124c9338c491a28ac53e220c2aa8a28fa61 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Thu, 11 Sep 2025 21:37:16 +0800
Subject: [PATCH 077/129] sing-box: 1.12.4 -> 1.12.5

---
 pkgs/by-name/si/sing-box/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/si/sing-box/package.nix b/pkgs/by-name/si/sing-box/package.nix
index 4c0dfe5828a7..c9774778ddf5 100644
--- a/pkgs/by-name/si/sing-box/package.nix
+++ b/pkgs/by-name/si/sing-box/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sing-box";
-  version = "1.12.4";
+  version = "1.12.5";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = "sing-box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Pc6aszIzu9GZha7I59yGasVVKHUeLPiW34zALFTM8Ec=";
+    hash = "sha256-LTORUt3/Q8eyfMkWjk/ixyRHB8NGvthbIJdcgOR3WaA=";
   };
 
-  vendorHash = "sha256-I/J1ht++GqxVlc83GxmLxzI7S980AbMwvrrVD867ll4=";
+  vendorHash = "sha256-XoHIxsJaFkC/Qz0+9AXWL+LBiTFUYKDtMqNseruAqZY=";
 
   tags = [
     "with_quic"

From 8b33180149dcb368349c653a3a34f422b874c1bd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 14:19:33 +0000
Subject: [PATCH 078/129] terraform-providers.vault: 5.2.1 -> 5.3.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 8b7ec987251f..89e75aa96477 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1445,13 +1445,13 @@
     "vendorHash": "sha256-djz3kNV+13Sz9prRPhWaWi50hvYXq3I3cp4neLexeEs="
   },
   "vault": {
-    "hash": "sha256-nY8NOE3VJCHkDeisWgxIHG6T1fQ8Jt6Nom2ELexuld0=",
+    "hash": "sha256-5jx6a2BfnugD41D6iK7wvOzmMPImxNHCiIix4+puRp4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
     "owner": "hashicorp",
     "repo": "terraform-provider-vault",
-    "rev": "v5.2.1",
+    "rev": "v5.3.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-mfageWMx8YM4eipnf7u3CMgMYcY7l2e69vECD3o91rg="
+    "vendorHash": "sha256-qrztgFJ/WDTxP5565rnx2sAELFKQGOxFuEYqWQQYVVY="
   },
   "vcd": {
     "hash": "sha256-W+ffIT70IaePg3xfOaQgCjPTWTN3iSAYwkf+s+zkB84=",

From e628947a8c6689ef491d0e0f8b0a86f56f1c7d18 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 14:51:31 +0000
Subject: [PATCH 079/129] python3Packages.pytest-playwright: 0.7.0 -> 0.7.1

---
 pkgs/development/python-modules/pytest-playwright/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-playwright/default.nix b/pkgs/development/python-modules/pytest-playwright/default.nix
index abb941166af3..a3e5c0e4035c 100644
--- a/pkgs/development/python-modules/pytest-playwright/default.nix
+++ b/pkgs/development/python-modules/pytest-playwright/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-playwright";
-  version = "0.7.0";
+  version = "0.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "playwright-pytest";
     tag = "v${version}";
-    hash = "sha256-GcvasyCVNUWieIYj7Da5dWdXtxVAhP2lR+ogBzrBu4M=";
+    hash = "sha256-5QkqOTS8+wMMJ3U8oKX9aQ6hwIChCYNojLqWpZVluXw=";
   };
 
   postPatch = ''

From d36f58214d5cbbacc61df117065bccacfafec4e7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 15:08:17 +0000
Subject: [PATCH 080/129] libcomps: 0.1.22 -> 0.1.23

---
 pkgs/by-name/li/libcomps/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libcomps/package.nix b/pkgs/by-name/li/libcomps/package.nix
index babfc9bb4e59..4de5395ff051 100644
--- a/pkgs/by-name/li/libcomps/package.nix
+++ b/pkgs/by-name/li/libcomps/package.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libcomps";
-  version = "0.1.22";
+  version = "0.1.23";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     owner = "rpm-software-management";
     repo = "libcomps";
     rev = version;
-    hash = "sha256-zaUQbMYL9wIzqs3cQwPY1B2UZ7DwkksTxeFugol0FRk=";
+    hash = "sha256-6nX6Oa2ACVALOtXDxjowIGKaziZkGZbtkgZzDfuP4PE=";
   };
 
   patches = [

From 5660967705f15a967a819cb7c45ebe92b68469f1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 15:08:24 +0000
Subject: [PATCH 081/129] libcouchbase: 3.3.17 -> 3.3.18

---
 pkgs/by-name/li/libcouchbase/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libcouchbase/package.nix b/pkgs/by-name/li/libcouchbase/package.nix
index 923a629f6d10..aea366c0c7b2 100644
--- a/pkgs/by-name/li/libcouchbase/package.nix
+++ b/pkgs/by-name/li/libcouchbase/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcouchbase";
-  version = "3.3.17";
+  version = "3.3.18";
 
   src = fetchFromGitHub {
     owner = "couchbase";
     repo = "libcouchbase";
     rev = version;
-    sha256 = "sha256-YHPfdjt8ME9nkgv6wF9IyEQoT4PpanbAbvcqqWOU+GY=";
+    sha256 = "sha256-+6RrApyml/FPv8pRjmwY1yuZIX1YXNKqdeNjP1y4cbU=";
   };
 
   cmakeFlags = [ "-DLCB_NO_MOCK=ON" ];

From e9d2ecdae1711d7d035ed64dca74dbf2ea0d389c Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Thu, 11 Sep 2025 17:45:09 +0200
Subject: [PATCH 082/129] seafile-client: switch from qt5 to qt6

fixes https://github.com/NixOS/nixpkgs/issues/442063
---
 .../networking/seafile-client/default.nix            | 12 ++++++++++++
 pkgs/top-level/all-packages.nix                      |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/seafile-client/default.nix b/pkgs/applications/networking/seafile-client/default.nix
index 605503eeb074..27d346250b17 100644
--- a/pkgs/applications/networking/seafile-client/default.nix
+++ b/pkgs/applications/networking/seafile-client/default.nix
@@ -1,10 +1,12 @@
 {
   lib,
   stdenv,
+  fetchpatch,
   fetchFromGitHub,
   pkg-config,
   cmake,
   qttools,
+  qt5compat,
   libuuid,
   seafile-shared,
   jansson,
@@ -25,6 +27,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-ZMhU0uXAC3tH1e3ktiHhC5YCDwFOnILretPgjYYa9DQ=";
   };
 
+  patches = [
+    # https://github.com/NixOS/nixpkgs/issues/442063
+    (fetchpatch {
+      name = "fix_build_with_QT6.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_QT6.diff?h=seafile-client&id=8bbd6e5017f03dbb368603b4313738b0d783ca2a";
+      hash = "sha256-N1fepqjTm/M17+TgwNTUecP/wGVlBuZEtTezFgJEeVM=";
+    })
+  ];
+
   nativeBuildInputs = [
     libuuid
     pkg-config
@@ -34,6 +45,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    qt5compat
     seafile-shared
     jansson
     libsearpc
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0b0531700509..9edec921c714 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12874,7 +12874,7 @@ with pkgs;
 
   scantailor-universal = callPackage ../applications/graphics/scantailor/universal.nix { };
 
-  seafile-client = libsForQt5.callPackage ../applications/networking/seafile-client { };
+  seafile-client = qt6Packages.callPackage ../applications/networking/seafile-client { };
 
   seq66 = qt5.callPackage ../applications/audio/seq66 { };
 

From d6a72800ce35ade27238edf99ece67e4aa053546 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 15:51:56 +0000
Subject: [PATCH 083/129] fanbox-dl: 0.27.4 -> 0.28.0

---
 pkgs/by-name/fa/fanbox-dl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fa/fanbox-dl/package.nix b/pkgs/by-name/fa/fanbox-dl/package.nix
index 4b2e9b82c4b3..47276257c1fd 100644
--- a/pkgs/by-name/fa/fanbox-dl/package.nix
+++ b/pkgs/by-name/fa/fanbox-dl/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "fanbox-dl";
-  version = "0.27.4";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "hareku";
     repo = "fanbox-dl";
     rev = "v${version}";
-    hash = "sha256-zccTxLEbKAErgVVaL+CPYD9GCPCAjGYnOiyGBGDmSzg=";
+    hash = "sha256-yrSA9CavQgu89hl+x578geC35KvamfAPOSg33woVI8w=";
   };
 
-  vendorHash = "sha256-BZebo50HEKIk1z0LJg8kE1adovyAk67L6jsiaNcpeDY=";
+  vendorHash = "sha256-uhNitrJeFuFG2XyQrc1JBbExoU6Ln6AFRO2Bgb1+N5M=";
 
   # pings websites during testing
   doCheck = false;

From 7f9a9794ffcc20db1782de609ab9f8577449c659 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 15:56:32 +0000
Subject: [PATCH 084/129] doctl: 1.141.0 -> 1.142.0

---
 pkgs/by-name/do/doctl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/do/doctl/package.nix b/pkgs/by-name/do/doctl/package.nix
index 47b34e4467a9..5c3014750cb3 100644
--- a/pkgs/by-name/do/doctl/package.nix
+++ b/pkgs/by-name/do/doctl/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.141.0";
+  version = "1.142.0";
 
   vendorHash = null;
 
@@ -42,7 +42,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     tag = "v${version}";
-    hash = "sha256-IZ/CP9xdupwkiOihZuf/MXEP2cnoJ/lqYUEsFDf/ITk=";
+    hash = "sha256-wbOO9jdGfy39GeGEwLURLpxhXt17sk6gQRUbz6ysSXc=";
   };
 
   meta = {

From 48ddbb29a121b01d304c31009a89f391630f8967 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 11 Sep 2025 16:59:08 +0100
Subject: [PATCH 085/129] lib.options.mkOption: clean up `visible` docs

---
 lib/options.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/options.nix b/lib/options.nix
index b05e53e4cd46..95802fa5c2c5 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -113,7 +113,7 @@ rec {
       : Optional boolean indicating whether the option is for NixOS developers only.
 
       `visible`
-      : Optional boolean indicating whether the option shows up in the manual.
+      : Optional, whether the option and/or sub-options show up in the manual.
         Use false to hide the option and any sub-options from submodules.
         Use "shallow" to hide only sub-options.
         Default: true.

From 6c2044247912f9531ed1529623f8dd110d9b929f Mon Sep 17 00:00:00 2001
From: Matt Sturgeon <matt@sturgeon.me.uk>
Date: Wed, 10 Sep 2025 14:35:28 +0100
Subject: [PATCH 086/129] lib.options.optionAttrSetToDocList: add `visible =
 "transparent"`

Allows marking an option as invisible, without excluding its sub-options.

In practice, this is similar to `visible = true; internal = true;`,
however it is more explicit and less reliant on implementation details.
---
 lib/options.nix    |  6 ++++--
 lib/tests/misc.nix | 16 ++++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/lib/options.nix b/lib/options.nix
index 95802fa5c2c5..40fcca647385 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -116,6 +116,7 @@ rec {
       : Optional, whether the option and/or sub-options show up in the manual.
         Use false to hide the option and any sub-options from submodules.
         Use "shallow" to hide only sub-options.
+        Use "transparent" to hide this option, but not its sub-options.
         Default: true.
 
       `readOnly`
@@ -575,13 +576,14 @@ rec {
       opt:
       let
         name = showOption opt.loc;
+        visible = opt.visible or true;
         docOption = {
           loc = opt.loc;
           inherit name;
           description = opt.description or null;
           declarations = filter (x: x != unknownModule) opt.declarations;
           internal = opt.internal or false;
-          visible = if (opt ? visible && opt.visible == "shallow") then true else opt.visible or true;
+          visible = if isBool visible then visible else visible == "shallow";
           readOnly = opt.readOnly or false;
           type = opt.type.description or "unspecified";
         }
@@ -604,7 +606,7 @@ rec {
             ss = opt.type.getSubOptions opt.loc;
           in
           if ss != { } then optionAttrSetToDocList' opt.loc ss else [ ];
-        subOptionsVisible = docOption.visible && opt.visible or null != "shallow";
+        subOptionsVisible = if isBool visible then visible else visible == "transparent";
       in
       # To find infinite recursion in NixOS option docs:
       # builtins.trace opt.loc
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 92525b8caa40..a9c78defdffb 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -3232,6 +3232,10 @@ runTests {
                 type = lib.types.submodule submodule;
                 visible = "shallow";
               };
+              transparent = lib.mkOption {
+                type = lib.types.submodule submodule;
+                visible = "transparent";
+              };
               "true" = lib.mkOption {
                 type = lib.types.submodule submodule;
                 visible = true;
@@ -3268,6 +3272,18 @@ runTests {
         visible = true;
         internal = false;
       };
+      transparent = {
+        visible = false;
+        internal = false;
+      };
+      "transparent.foo" = {
+        visible = true;
+        internal = false;
+      };
+      "transparent.<name>.bar" = {
+        visible = true;
+        internal = false;
+      };
       "true" = {
         visible = true;
         internal = false;

From 79c3e2cc9259cd89ff9aa61955e596b9e57eb638 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 16:18:10 +0000
Subject: [PATCH 087/129] algolia-cli: 1.7.0 -> 1.7.1

---
 pkgs/by-name/al/algolia-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/al/algolia-cli/package.nix b/pkgs/by-name/al/algolia-cli/package.nix
index 1d6a7d6ebc0e..0b4ed1ee5dc7 100644
--- a/pkgs/by-name/al/algolia-cli/package.nix
+++ b/pkgs/by-name/al/algolia-cli/package.nix
@@ -5,7 +5,7 @@
   installShellFiles,
 }:
 let
-  version = "1.7.0";
+  version = "1.7.1";
 in
 buildGoModule {
   pname = "algolia-cli";
@@ -15,10 +15,10 @@ buildGoModule {
     owner = "algolia";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-j8OCN+iV5sMjgYTMGCc72JPImuFFvehKw4S99l+YWhs=";
+    hash = "sha256-XaPod/8MwucNXzTfMkF2Sr8i8U5RKJs/RfBxDjJK4vU=";
   };
 
-  vendorHash = "sha256-qzgkcmRuXHM9aMQGBObUHYH9qpWnDfTvwdx1A4it8aQ=";
+  vendorHash = "sha256-zDhsJ9iUKm0RzALVlvZDIPYaTqfIDIuUWAU+h5gp4Es=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 5ee81fc09eca3f1ae0863c083e67ce24b82a86ba Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 11 Sep 2025 18:25:00 +0200
Subject: [PATCH 088/129] python3Packages.pepit: 0.3.2 -> 0.4.0

---
 pkgs/development/python-modules/pepit/default.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pepit/default.nix b/pkgs/development/python-modules/pepit/default.nix
index 37017f445e9e..2a8579500a07 100644
--- a/pkgs/development/python-modules/pepit/default.nix
+++ b/pkgs/development/python-modules/pepit/default.nix
@@ -13,16 +13,21 @@
 
 buildPythonPackage rec {
   pname = "pepit";
-  version = "0.3.2";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PerformanceEstimation";
     repo = "PEPit";
-    rev = version;
-    hash = "sha256-Gdymdfi0Iv9KXBNSbAEWGYIQ4k5EONnbyWs+99L5D/A=";
+    tag = version;
+    hash = "sha256-6HF/BkDFUvui7CaVfOeJUQhl3QLLyE7aabDWcZ4tgXc=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "{{VERSION_PLACEHOLDER}}" "${version}"
+  '';
+
   build-system = [
     setuptools
   ];

From 1163928354502d923099efd6b4e982f779bd7fe9 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Thu, 11 Sep 2025 09:26:03 -0700
Subject: [PATCH 089/129] abduco: fix version, use hash and configureFlags

---
 pkgs/by-name/ab/abduco/package.nix | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ab/abduco/package.nix b/pkgs/by-name/ab/abduco/package.nix
index 6526d8d6e806..6410c8d10919 100644
--- a/pkgs/by-name/ab/abduco/package.nix
+++ b/pkgs/by-name/ab/abduco/package.nix
@@ -9,10 +9,11 @@
 
 let
   rev = "8c32909a159aaa9484c82b71f05b7a73321eb491";
+  defaultUserConfig = writeText "config.def.h" conf;
 in
 stdenv.mkDerivation {
   pname = "abduco";
-  version = "unstable-2020-04-30";
+  version = "0.6.0-unstable-2020-04-30";
 
   src = fetchzip {
     urls = [
@@ -22,17 +23,18 @@ stdenv.mkDerivation {
     hash = "sha256-o7SPK/G31cW/rrLwV3UJOTq6EBHl6AEE/GdeKGlHdyg=";
   };
 
-  preBuild = lib.optionalString (conf != null) "cp ${writeText "config.def.h" conf} config.def.h";
+  configureFlags = lib.optionals stdenv.hostPlatform.isDarwin [ "-D_DARWIN_C_SOURCE" ];
+
+  preBuild = lib.optionalString (conf != null) "cp ${defaultUserConfig} config.def.h";
 
   installFlags = [ "install-completion" ];
-  CFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-D_DARWIN_C_SOURCE";
 
   patches = [
     # https://github.com/martanne/abduco/pull/22
     (fetchpatch {
       name = "use-XDG-directory-scheme-by-default";
       url = "https://github.com/martanne/abduco/commit/0e9a00312ac9777edcb169122144762e3611287b.patch";
-      sha256 = "sha256-4NkIflbRkUpS5XTM/fxBaELpvlZ4S5lecRa8jk0XC9g=";
+      hash = "sha256-4NkIflbRkUpS5XTM/fxBaELpvlZ4S5lecRa8jk0XC9g=";
     })
 
     # “fix bug where attaching to dead session won't give underlying exit code”
@@ -40,7 +42,7 @@ stdenv.mkDerivation {
     (fetchpatch {
       name = "exit-code-when-attaching-to-dead-session";
       url = "https://github.com/martanne/abduco/commit/972ca8ab949ee342569dbd66b47cc4a17b28247b.patch";
-      sha256 = "sha256-8hios0iKYDOmt6Bi5NNM9elTflGudnG2xgPF1pSkHI0=";
+      hash = "sha256-8hios0iKYDOmt6Bi5NNM9elTflGudnG2xgPF1pSkHI0=";
     })
 
     # “report pixel sizes to child processes that use ioctl(0, TIOCGWINSZ, ...)”
@@ -49,7 +51,7 @@ stdenv.mkDerivation {
     (fetchpatch {
       name = "report-pixel-sizes-to-child-processes";
       url = "https://github.com/martanne/abduco/commit/a1e222308119b3251f00b42e1ddff74a385d4249.patch";
-      sha256 = "sha256-eiF0A4IqJrrvXxjBYtltuVNpxQDv/iQPO+K7Y8hWBGg=";
+      hash = "sha256-eiF0A4IqJrrvXxjBYtltuVNpxQDv/iQPO+K7Y8hWBGg=";
     })
   ];
 

From 98f8e1954fbe496b17f7ed2526171282349dbcaa Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Tue, 9 Sep 2025 10:20:53 +0100
Subject: [PATCH 090/129] p2pool: 4.9.1 -> 4.10.1

---
 pkgs/by-name/p2/p2pool/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/p2/p2pool/package.nix b/pkgs/by-name/p2/p2pool/package.nix
index 234466f9006b..216a7532bbdb 100644
--- a/pkgs/by-name/p2/p2pool/package.nix
+++ b/pkgs/by-name/p2/p2pool/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "p2pool";
-  version = "4.9.1";
+  version = "4.10.1";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jjY/+ZS7UYecHTQT93WAUZYYc+CZpG4Vbotmsq65un0=";
+    hash = "sha256-oxUxgooIiesSyew8t/0asa/sEV4I8C+Firp5cLi0fnU=";
     fetchSubmodules = true;
   };
 

From 7b10b7951c1a7621289a9bae2e2a09368d7b99e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Fri, 12 Sep 2025 00:01:00 +0700
Subject: [PATCH 091/129] aseprite: fix build by adding libxcb

---
 pkgs/by-name/as/aseprite/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/as/aseprite/package.nix b/pkgs/by-name/as/aseprite/package.nix
index c1282aaebe32..31350703b25e 100644
--- a/pkgs/by-name/as/aseprite/package.nix
+++ b/pkgs/by-name/as/aseprite/package.nix
@@ -22,6 +22,7 @@
   libXext,
   libXi,
   libXxf86vm,
+  libxcb,
   ninja,
   pcre2,
   pixman,
@@ -87,6 +88,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     libXext
     libXi
     libXxf86vm
+    libxcb
     pcre2
     pixman
     skia-aseprite

From eb1adf3b59756adbd62d7e7c912ac564f443bfce Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 11 Sep 2025 19:01:06 +0200
Subject: [PATCH 092/129] python313Packages.cwl-utils: 0.39 -> 0.40

Diff: https://github.com/common-workflow-language/cwl-utils/compare/v0.39...v0.40

Changelog: https://github.com/common-workflow-language/cwl-utils/releases/tag/v0.40
---
 pkgs/development/python-modules/cwl-utils/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cwl-utils/default.nix b/pkgs/development/python-modules/cwl-utils/default.nix
index 26bfd8d38f5f..2ef7846cd46b 100644
--- a/pkgs/development/python-modules/cwl-utils/default.nix
+++ b/pkgs/development/python-modules/cwl-utils/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "cwl-utils";
-  version = "0.39";
+  version = "0.40";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "common-workflow-language";
     repo = "cwl-utils";
     tag = "v${version}";
-    hash = "sha256-qmvFr+zUZxwFqC4mfdktcS4hrNhJnxvWmdSJSswJ874=";
+    hash = "sha256-A9+JvtSTPfXK/FGJ8pplT06kkuatZu1fgjjmg74oTvE=";
   };
 
   build-system = [ setuptools ];

From 74d5b2a5f8c0d7b9217c0368d44479282c0d7060 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 17:28:52 +0000
Subject: [PATCH 093/129] vscode-extensions.ionide.ionide-fsharp: 7.26.6 ->
 7.27.0

---
 pkgs/applications/editors/vscode/extensions/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 227c59f526f9..0672df8d87bf 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2372,8 +2372,8 @@ let
         mktplcRef = {
           name = "Ionide-fsharp";
           publisher = "Ionide";
-          version = "7.26.6";
-          hash = "sha256-oLzOkb0C93HlUcBKOKMa3u/jsRY6n8fnapRg5Jiyass=";
+          version = "7.27.0";
+          hash = "sha256-NGl5uiR4taamA8lhH/qJT1nCfUhxCQ/XQ/oEZ9N9Q5Y=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Ionide.Ionide-fsharp/changelog";

From 2ebfb630e187ee600c9eb917100684ae3d9693ab Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 11 Sep 2025 19:30:35 +0200
Subject: [PATCH 094/129] python313Packages.specfile: 0.36.0 -> 0.37.0

Diff: https://github.com/packit/specfile/compare/0.36.0...0.37.0

Changelog: https://github.com/packit/specfile/blob/0.37.0/CHANGELOG.md
---
 pkgs/development/python-modules/specfile/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/specfile/default.nix b/pkgs/development/python-modules/specfile/default.nix
index 9db42b6e7315..22092c5fa54d 100644
--- a/pkgs/development/python-modules/specfile/default.nix
+++ b/pkgs/development/python-modules/specfile/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "specfile";
-  version = "0.36.0";
+  version = "0.37.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "packit";
     repo = "specfile";
     tag = version;
-    hash = "sha256-P15ilAK/LaSmDRviftTdj1bzoNqL3B0ESCHb6/avT2A=";
+    hash = "sha256-gYbnbs2mkQghQ0Zvenal5bEYObLpDB3Xu4kO9oqi0Ms=";
   };
 
   build-system = [

From 43a8f20d581f1395f2947810b5bfcb270754b9c1 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Thu, 11 Sep 2025 18:29:05 +0200
Subject: [PATCH 095/129] workflows/{merge_group,pr}: fail status check
 explicitly

When the merge queue fails, the workflow currently does not post a
negative result - and GitHub Actions waits for the status check to time
out, which takes 60 minutes.

This, of course, is a waste of time and resources. By explicitly failing
the status check, we boot the PR out of the merge queue immediately.
---
 .github/workflows/merge-group.yml | 6 ++++--
 .github/workflows/pr.yml          | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/merge-group.yml b/.github/workflows/merge-group.yml
index d95c1e5ea22a..0d21b768f6e0 100644
--- a/.github/workflows/merge-group.yml
+++ b/.github/workflows/merge-group.yml
@@ -29,7 +29,7 @@ jobs:
   # This job's only purpose is to create the target for the "Required Status Checks" branch ruleset.
   # It "needs" all the jobs that should block the Merge Queue.
   unlock:
-    if: github.event_name != 'pull_request'
+    if: github.event_name != 'pull_request' && always()
     # Modify this list to add or remove jobs from required status checks.
     needs:
       - lint
@@ -38,6 +38,8 @@ jobs:
       statuses: write
     steps:
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          RESULTS: ${{ toJSON(needs.*.result) }}
         with:
           script: |
             const { serverUrl, repo, runId, payload } = context
@@ -50,6 +52,6 @@ jobs:
               // Do NOT change the name of this, otherwise the rule will not catch it anymore.
               // This would prevent all PRs from merging.
               context: 'no PR failures',
-              state: 'success',
+              state: JSON.parse(process.env.RESULTS).every(result => result == 'success') ? 'success' : 'error',
               target_url,
             })
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 785ebbf9d168..2ff431225502 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -127,7 +127,7 @@ jobs:
   # This job's only purpose is to create the target for the "Required Status Checks" branch ruleset.
   # It "needs" all the jobs that should block merging a PR.
   unlock:
-    if: github.event_name != 'pull_request'
+    if: github.event_name != 'pull_request' && always()
     # Modify this list to add or remove jobs from required status checks.
     needs:
       - check
@@ -139,6 +139,8 @@ jobs:
       statuses: write
     steps:
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          RESULTS: ${{ toJSON(needs.*.result) }}
         with:
           script: |
             const { serverUrl, repo, runId, payload } = context
@@ -151,6 +153,6 @@ jobs:
               // Do NOT change the name of this, otherwise the rule will not catch it anymore.
               // This would prevent all PRs from merging.
               context: 'no PR failures',
-              state: 'success',
+              state: JSON.parse(process.env.RESULTS).every(status => status == 'success') ? 'success' : 'error',
               target_url,
             })

From 28a03afd2e513b7fc146fbdaa04f541ae83fed4a Mon Sep 17 00:00:00 2001
From: John Titor <50095635+JohnRTitor@users.noreply.github.com>
Date: Thu, 11 Sep 2025 17:54:46 +0000
Subject: [PATCH 096/129] google-chrome: 140.0.7339.80 -> 140.0.7339.127

---
 pkgs/by-name/go/google-chrome/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 8fe9addc7736..0ebc2e9a0c37 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -170,11 +170,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "140.0.7339.80";
+    version = "140.0.7339.127";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-9hNwMWUbtWsDvKc9hvfbI7PNVYm1L1mBLuXPlDzIG40=";
+      hash = "sha256-ZA23AsqHHznRoegQlDvPRvUfgA7bPQp2HMETFuAsqA8=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -275,11 +275,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "140.0.7339.81";
+    version = "140.0.7339.133";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/ockuail56dwhuxixexwh6zhrhm_140.0.7339.81/GoogleChrome-140.0.7339.81.dmg";
-      hash = "sha256-81TTdxKGHzLgSXSY2TVxY8JEjFZ6FZOhq3UuGvC0XAE=";
+      url = "http://dl.google.com/release2/chrome/fzn7lmun4oavjxo5gnqutqwcny_140.0.7339.133/GoogleChrome-140.0.7339.133.dmg";
+      hash = "sha256-nnmQOzN0U8ZMl9/3iF6eTfC8LjkfCfYa8B5kQs36rmA=";
     };
 
     dontPatch = true;

From d0a565c182d42f0eecb1b88f83b2a5516ed88989 Mon Sep 17 00:00:00 2001
From: Michal Sojka <michal.sojka@cvut.cz>
Date: Thu, 11 Sep 2025 16:05:57 +0200
Subject: [PATCH 097/129] tcpreplay: Fix build after splitting libpcap to
 multiple outputs

Configure file of tcpreplay expects that libpcap header files and
libraries share the same prefix. Since [1] this is no longer true so
we have to patch the configure script.

[1]: https://github.com/NixOS/nixpkgs/pull/429972/commits/da89a2d075f2279a09585c1b217b8f7382817339
---
 pkgs/by-name/tc/tcpreplay/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tc/tcpreplay/package.nix b/pkgs/by-name/tc/tcpreplay/package.nix
index 00a0f7d429a0..333293121a57 100644
--- a/pkgs/by-name/tc/tcpreplay/package.nix
+++ b/pkgs/by-name/tc/tcpreplay/package.nix
@@ -17,6 +17,13 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libpcap ];
 
+  # Allow having different prefix for header files (default output
+  # "out") and libraries ("lib" output)
+  postPatch = ''
+    substituteInPlace configure \
+      --replace-fail 'ls ''${testdir}/$dir/libpcap' 'ls ${lib.getLib libpcap}/$dir/libpcap'
+  '';
+
   configureFlags = [
     "--disable-local-libopts"
     "--disable-libopts-install"

From 83d4ed3d92e02b2f34d37a67ca69754cae427529 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 11 Sep 2025 20:06:15 +0200
Subject: [PATCH 098/129] python313Packages.types-s3transfer: 0.13.0 -> 0.13.1

---
 pkgs/development/python-modules/types-s3transfer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/types-s3transfer/default.nix b/pkgs/development/python-modules/types-s3transfer/default.nix
index 33ed774c42f6..63c845a74e55 100644
--- a/pkgs/development/python-modules/types-s3transfer/default.nix
+++ b/pkgs/development/python-modules/types-s3transfer/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "types-s3transfer";
-  version = "0.13.0";
+  version = "0.13.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "types_s3transfer";
     inherit version;
-    hash = "sha256-ID2ty5hlwvaPtEvARA4dwFt5GXukpkHAl2wmya9171I=";
+    hash = "sha256-zkiNef3X07nTkHGTkSHsqBTsZd46o2vc4fkYnAphzIA=";
   };
 
   build-system = [ setuptools ];

From 0b14bcb36298f3f5a700843dede751a695ba122f Mon Sep 17 00:00:00 2001
From: John Titor <50095635+JohnRTitor@users.noreply.github.com>
Date: Thu, 11 Sep 2025 23:37:09 +0530
Subject: [PATCH 099/129] scx.cscheds: patch build_bpftool meson script
 explicitly

Turns out ./patchShebangs wasn't doing its job properly.
This was verified after running `patchShebangs ./meson-scripts`
and then `cat ./meson-scripts/build_bpftool`
---
 pkgs/os-specific/linux/scx/scx_cscheds.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/scx/scx_cscheds.nix b/pkgs/os-specific/linux/scx/scx_cscheds.nix
index 8497ddac1d15..a487493bad5b 100644
--- a/pkgs/os-specific/linux/scx/scx_cscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_cscheds.nix
@@ -56,8 +56,8 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     patchShebangs ./meson-scripts
     cp ${finalAttrs.fetchBpftool} meson-scripts/fetch_bpftool
     cp ${finalAttrs.fetchLibbpf} meson-scripts/fetch_libbpf
-    substituteInPlace meson.build \
-      --replace-fail '[build_bpftool' "['${lib.getExe bash}', build_bpftool"
+    substituteInPlace ./meson-scripts/build_bpftool \
+      --replace-fail '/bin/bash' '${lib.getExe bash}'
   '';
 
   nativeBuildInputs = [

From b9d4098221f2321bc4a0af93d515848ed40cce4b Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Thu, 11 Sep 2025 15:24:44 +0200
Subject: [PATCH 100/129] ci/eval: fix local full eval

The change to use `builtins.storePath` was good - for when the store
path *is* already part of the nix store. In all my tests so far, that
was already the case, because I was iterating on the solution and the
Eval results stayed the same.

But when this is run on a entirely new commit, these the values for
`afterDir` and `combinedDir` are *not* in the store, yet. As part of
running `eval.full` on a new commit they will be created. `eval.full` is
linked up, so that the values passed around there will actually be
derivations, which might not be realized, yet.

Checking whether the input is a path or not fixes this for both cases.
---
 ci/eval/compare/default.nix | 7 ++++++-
 ci/eval/diff.nix            | 9 +++++++--
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index 293877036e2f..1c83ea891630 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -13,7 +13,12 @@
   byName ? false,
 }:
 let
-  combined = builtins.storePath combinedDir;
+  # Usually we expect a derivation, but when evaluating in multiple separate steps, we pass
+  # nix store paths around. These need to be turned into (fake) derivations again to track
+  # dependencies properly.
+  # We use two steps for evaluation, because we compare results from two different checkouts.
+  # CI additionalls spreads evaluation across multiple workers.
+  combined = if lib.isDerivation combinedDir then combinedDir else lib.toDerivation combinedDir;
 
   /*
     Derivation that computes which packages are affected (added, changed or removed) between two revisions of nixpkgs.
diff --git a/ci/eval/diff.nix b/ci/eval/diff.nix
index d22090601d30..692e2ec60194 100644
--- a/ci/eval/diff.nix
+++ b/ci/eval/diff.nix
@@ -11,8 +11,13 @@
 }:
 
 let
-  before = builtins.storePath beforeDir;
-  after = builtins.storePath afterDir;
+  # Usually we expect a derivation, but when evaluating in multiple separate steps, we pass
+  # nix store paths around. These need to be turned into (fake) derivations again to track
+  # dependencies properly.
+  # We use two steps for evaluation, because we compare results from two different checkouts.
+  # CI additionalls spreads evaluation across multiple workers.
+  before = if lib.isDerivation beforeDir then beforeDir else lib.toDerivation beforeDir;
+  after = if lib.isDerivation afterDir then afterDir else lib.toDerivation afterDir;
 
   /*
     Computes the key difference between two attrs

From 0e65cb7d4eb4b42fccab37c75ebb60322597114e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 11 Sep 2025 20:19:55 +0200
Subject: [PATCH 101/129] python313Packages.hatasmota: modernize

---
 pkgs/development/python-modules/hatasmota/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hatasmota/default.nix b/pkgs/development/python-modules/hatasmota/default.nix
index af0d5c4cce88..6d8f582e0419 100644
--- a/pkgs/development/python-modules/hatasmota/default.nix
+++ b/pkgs/development/python-modules/hatasmota/default.nix
@@ -14,7 +14,7 @@ buildPythonPackage rec {
   version = "0.10.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.13";
 
   src = fetchFromGitHub {
     owner = "emontnemery";
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to help parse and construct Tasmota MQTT messages";
     homepage = "https://github.com/emontnemery/hatasmota";
-    changelog = "https://github.com/emontnemery/hatasmota/releases/tag/${version}";
+    changelog = "https://github.com/emontnemery/hatasmota/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

From 02727928ecf79a3fefaf93de6a126d9069e30654 Mon Sep 17 00:00:00 2001
From: Marek Fajkus <marek.faj@gmail.com>
Date: Thu, 11 Sep 2025 20:39:07 +0200
Subject: [PATCH 102/129] elmPackages.elm: Drop TLS patch

---
 .../compilers/elm/packages/ghc9_6/default.nix |  6 --
 .../packages/ghc9_6/tls-compatibility.patch   | 81 -------------------
 2 files changed, 87 deletions(-)
 delete mode 100644 pkgs/development/compilers/elm/packages/ghc9_6/tls-compatibility.patch

diff --git a/pkgs/development/compilers/elm/packages/ghc9_6/default.nix b/pkgs/development/compilers/elm/packages/ghc9_6/default.nix
index 589dc26ad349..14e6af7a25fb 100644
--- a/pkgs/development/compilers/elm/packages/ghc9_6/default.nix
+++ b/pkgs/development/compilers/elm/packages/ghc9_6/default.nix
@@ -27,12 +27,6 @@ pkgs.haskell.packages.ghc96.override {
               --prefix PATH ':' ${lib.makeBinPath [ nodejs ]}
           '';
 
-          patches = [
-            # Fix TLS compatibility issues with package.elm-lang.org
-            # see: https://github.com/elm/compiler/pull/2325
-            ./tls-compatibility.patch
-          ];
-
           description = "Delightful language for reliable webapps";
           homepage = "https://elm-lang.org/";
           license = lib.licenses.bsd3;
diff --git a/pkgs/development/compilers/elm/packages/ghc9_6/tls-compatibility.patch b/pkgs/development/compilers/elm/packages/ghc9_6/tls-compatibility.patch
deleted file mode 100644
index ae8b3281a1ea..000000000000
--- a/pkgs/development/compilers/elm/packages/ghc9_6/tls-compatibility.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From c8ca5e14650a77446a6577eb356ddd09c3928bac Mon Sep 17 00:00:00 2001
-From: Ben Millwood <thebenmachine+git@gmail.com>
-Date: Tue, 17 Jun 2025 16:39:07 +0100
-Subject: [PATCH] Fix TLS connection to package.elm-lang.org
-
-It seems like the server hosting https://package.elm-lang.org has an old
-enough SSL library that it doesn't support EMS. Reconfigure the https
-client so that it will still connect in this case.
----
- builder/src/Http.hs | 21 +++++++++++++++++++--
- elm.cabal           |  3 +++
- 2 files changed, 22 insertions(+), 2 deletions(-)
-
-diff --git a/builder/src/Http.hs b/builder/src/Http.hs
-index 6105263fa..fd8b87bba 100644
---- a/builder/src/Http.hs
-+++ b/builder/src/Http.hs
-@@ -29,15 +29,19 @@ import qualified Data.Binary as Binary
- import qualified Data.Binary.Get as Binary
- import qualified Data.ByteString.Builder as B
- import qualified Data.ByteString.Char8 as BS
-+import Data.Default (def)
- import qualified Data.Digest.Pure.SHA as SHA
- import qualified Data.String as String
-+import qualified Network.Connection as NC
- import Network.HTTP (urlEncodeVars)
- import Network.HTTP.Client
--import Network.HTTP.Client.TLS (tlsManagerSettings)
-+import Network.HTTP.Client.TLS (mkManagerSettings)
- import Network.HTTP.Types.Header (Header, hAccept, hAcceptEncoding, hUserAgent)
- import Network.HTTP.Types.Method (Method, methodGet, methodPost)
- import qualified Network.HTTP.Client as Multi (RequestBody(RequestBodyLBS))
- import qualified Network.HTTP.Client.MultipartFormData as Multi
-+import qualified Network.TLS as TLS
-+import Network.TLS.Extra.Cipher (ciphersuite_default)
- 
- import qualified Json.Encode as Encode
- import qualified Elm.Version as V
-@@ -49,7 +53,20 @@ import qualified Elm.Version as V
- 
- getManager :: IO Manager
- getManager =
--  newManager tlsManagerSettings
-+  newManager (mkManagerSettings dontRequireEMS Nothing)
-+  where
-+    -- See https://github.com/NixOS/nixpkgs/pull/414495
-+    dontRequireEMS =
-+      NC.TLSSettingsSimple
-+        { NC.settingDisableCertificateValidation = False
-+        , NC.settingDisableSession = False
-+        , NC.settingUseServerName = False
-+        , NC.settingClientSupported =
-+            def
-+              { TLS.supportedCiphers = ciphersuite_default
-+              , TLS.supportedExtendedMainSecret = TLS.AllowEMS
-+              }
-+        }
- 
- 
- 
-diff --git a/elm.cabal b/elm.cabal
-index 144fada90..0bd1eb5dc 100644
---- a/elm.cabal
-+++ b/elm.cabal
-@@ -206,6 +206,8 @@ Executable elm
-         binary,
-         bytestring,
-         containers,
-+        crypton-connection,
-+        data-default,
-         directory,
-         edit-distance,
-         file-embed,
-@@ -229,6 +231,7 @@ Executable elm
-         snap-server,
-         template-haskell,
-         time,
-+        tls,
-         unordered-containers,
-         utf8-string,
-         vector,

From d09360b23f4a31aa27dc882b1f21d7fa90bbd950 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 18:46:54 +0000
Subject: [PATCH 103/129] vacuum-go: 0.17.11 -> 0.17.12

---
 pkgs/by-name/va/vacuum-go/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index a34daec2c69e..5cc6e7f0c31f 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,14 +7,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.17.11";
+  version = "0.17.12";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9cdix5HuhLOd/XnK1uU4pRXcfYi2nqTScP/+QV7Ps4k=";
+    hash = "sha256-1129ovv85oh2eFgGm2U2pQ8mglWzjyueScshwNlXe8s=";
   };
 
   vendorHash = "sha256-sdm3RKtHB9uWZy9N+bEz0gRKBU0EuYvX9J15Wj7GmAU=";

From 911c2be33227ea919906e32793da9b428ecdedcf Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 11 Sep 2025 20:47:03 +0200
Subject: [PATCH 104/129] python313Packages.whirlpool-sixth-sense: 0.21.1 ->
 0.21.3

Diff: https://github.com/abmantis/whirlpool-sixth-sense/compare/0.21.1...0.21.3
---
 .../python-modules/whirlpool-sixth-sense/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix b/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
index 8969eef524c2..08630cb90c67 100644
--- a/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
+++ b/pkgs/development/python-modules/whirlpool-sixth-sense/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "whirlpool-sixth-sense";
-  version = "0.21.1";
+  version = "0.21.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "abmantis";
     repo = "whirlpool-sixth-sense";
     tag = version;
-    hash = "sha256-uhqDm6BOUX6Ov4580EmBOD4si9BsMvnsvEmA/DbKE7M=";
+    hash = "sha256-ZZrLqHn/O+Z2XtiCIco5PMEprbi9XeJOBXcEdjTDPDc=";
   };
 
   build-system = [ setuptools ];

From c4cd60da526c4f883ffba96fdb8d29585af0b0f8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 18:48:42 +0000
Subject: [PATCH 105/129] amneziawg-go: 0.2.13 -> 0.2.15

---
 pkgs/by-name/am/amneziawg-go/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/am/amneziawg-go/package.nix b/pkgs/by-name/am/amneziawg-go/package.nix
index b9f3a84cd4c9..5a867c83cceb 100644
--- a/pkgs/by-name/am/amneziawg-go/package.nix
+++ b/pkgs/by-name/am/amneziawg-go/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "amneziawg-go";
-  version = "0.2.13";
+  version = "0.2.15";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amneziawg-go";
     tag = "v${version}";
-    hash = "sha256-vXSPUGBMP37kXJ4Zn5TDLAzG8N+yO/IIj9nSKrZ+sFA=";
+    hash = "sha256-xz807BLNoh1sMfyDXMAXPU9mHSxfxI3k5ayEVQM+HH0=";
   };
 
   postPatch = ''
@@ -21,7 +21,7 @@ buildGoModule rec {
     rm -f format_test.go
   '';
 
-  vendorHash = "sha256-9OtIb3UQXpAA0OzPhDIdb9lXZQHHiYCcmjHAU+vCtpk=";
+  vendorHash = "sha256-VYDc6oI0CqW1T3tVX0CWQLfLIOvqHCawVA8BWASWLLY=";
 
   subPackages = [ "." ];
 

From 127a2afc5d7e2b9d40127bb618fc44110dc48e10 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 11 Sep 2025 20:57:59 +0200
Subject: [PATCH 106/129] python313Packages.aioshelly: 13.8.0 -> 13.9.0

Diff: https://github.com/home-assistant-libs/aioshelly/compare/13.8.0...13.9.0

Changelog: https://github.com/home-assistant-libs/aioshelly/releases/tag/13.9.0
---
 pkgs/development/python-modules/aioshelly/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aioshelly/default.nix b/pkgs/development/python-modules/aioshelly/default.nix
index a9b16bae0e88..d7c62e7c3143 100644
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "13.8.0";
+  version = "13.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = "aioshelly";
     tag = version;
-    hash = "sha256-SzEoLOjHlXVEB8V1Qc2IcA46YVIQ3w+FGADB5EaIb4k=";
+    hash = "sha256-G8iZmgrTR+hqrRLoEdnJnqzU8GFQUrOrGenL6hkjtps=";
   };
 
   build-system = [ setuptools ];

From c75ab0edf1259339a4e9aa2ca8bd9be4db4c9d3a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 11 Sep 2025 21:04:35 +0200
Subject: [PATCH 107/129] python313Packages.asusrouter: 1.20.1 -> 1.21.0

Diff: https://github.com/Vaskivskyi/asusrouter/compare/1.20.1...1.21.0

Changelog: https://github.com/Vaskivskyi/asusrouter/releases/tag/1.21.0
---
 pkgs/development/python-modules/asusrouter/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/asusrouter/default.nix b/pkgs/development/python-modules/asusrouter/default.nix
index 37f86cc98454..82a4eb4548b7 100644
--- a/pkgs/development/python-modules/asusrouter/default.nix
+++ b/pkgs/development/python-modules/asusrouter/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "asusrouter";
-  version = "1.20.1";
+  version = "1.21.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Vaskivskyi";
     repo = "asusrouter";
     tag = version;
-    hash = "sha256-RZdSwLR/7uJICc56lLO0YyFs1ZDzpk/8Ebm3juG+gss=";
+    hash = "sha256-SMQ1jEEMRngl0idWXi7R7KinxR9NnH39vB/itVi7A4A=";
   };
 
   postPatch = ''

From 1f3345c4f2bb669af0aab1e450f6faa0b96f5fb0 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 11 Sep 2025 21:10:58 +0200
Subject: [PATCH 108/129] python313Packages.cloudpathlib: 0.21.1 -> 0.22.0

Diff: https://github.com/drivendataorg/cloudpathlib/compare/v0.21.1...v0.22.0
---
 pkgs/development/python-modules/cloudpathlib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cloudpathlib/default.nix b/pkgs/development/python-modules/cloudpathlib/default.nix
index f5c0a8ecd4d4..f8f00d04695f 100644
--- a/pkgs/development/python-modules/cloudpathlib/default.nix
+++ b/pkgs/development/python-modules/cloudpathlib/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "cloudpathlib";
-  version = "0.21.1";
+  version = "0.22.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "drivendataorg";
     repo = "cloudpathlib";
     tag = "v${version}";
-    hash = "sha256-Bhr92xMK/WV3u0SG8q9SvO0kGnwSVXHzq6lK/RD2ssk=";
+    hash = "sha256-IeNYfYDvCALvK0CV4J6434E3lSz+/JvolQzQXZ8NizQ=";
   };
 
   postPatch = ''

From ef5a5f7f243a3d95402d9a56aec01cf822814a99 Mon Sep 17 00:00:00 2001
From: Shawn8901 <shawn8901@googlemail.com>
Date: Wed, 10 Sep 2025 22:17:17 +0200
Subject: [PATCH 109/129] victorialogs: 1.32.0 -> 1.33.1

---
 pkgs/by-name/vi/victorialogs/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vi/victorialogs/package.nix b/pkgs/by-name/vi/victorialogs/package.nix
index d905c190fd59..743afcac175f 100644
--- a/pkgs/by-name/vi/victorialogs/package.nix
+++ b/pkgs/by-name/vi/victorialogs/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaLogs";
-  version = "1.32.0";
+  version = "1.33.1";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaLogs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VcFgPxsxPjvo92/TiVec6sSPprRQ4sbQwe4teGC60/o=";
+    hash = "sha256-CLrXkyLHPA4t0srIME2Td9/6QQ5fsJyq+kuKfzawwFs=";
   };
 
   vendorHash = null;

From 766148e3ef2cd9c14ed2ba3e498df24cadb047b3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 19:40:21 +0000
Subject: [PATCH 110/129] python3Packages.dissect-volume: 3.15 -> 3.16

---
 pkgs/development/python-modules/dissect-volume/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-volume/default.nix b/pkgs/development/python-modules/dissect-volume/default.nix
index 0ec6bc843f4a..53c5f462058d 100644
--- a/pkgs/development/python-modules/dissect-volume/default.nix
+++ b/pkgs/development/python-modules/dissect-volume/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "dissect-volume";
-  version = "3.15";
+  version = "3.16";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "fox-it";
     repo = "dissect.volume";
     tag = version;
-    hash = "sha256-QxIZg0svKBHp7uVsK4S40oDBOxFudSHBzi6I2iloiok=";
+    hash = "sha256-xJioreloRqxIoM5h1Uh0gLkIel5XScjvMvNWtSu1dqY=";
   };
 
   build-system = [

From aedfacd1bba3ddea9508ea60c7e8c25204601167 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 11 Sep 2025 21:50:14 +0200
Subject: [PATCH 111/129] python3Packages.orbax-checkpoint: 0.11.24 -> 0.11.25

Diff: https://github.com/google/orbax/compare/v0.11.24...v0.11.25

Changelog: https://github.com/google/orbax/blob/v0.11.25/checkpoint/CHANGELOG.md
---
 pkgs/development/python-modules/orbax-checkpoint/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/orbax-checkpoint/default.nix b/pkgs/development/python-modules/orbax-checkpoint/default.nix
index 39ab30636369..1e4b06e2d871 100644
--- a/pkgs/development/python-modules/orbax-checkpoint/default.nix
+++ b/pkgs/development/python-modules/orbax-checkpoint/default.nix
@@ -36,14 +36,14 @@
 
 buildPythonPackage rec {
   pname = "orbax-checkpoint";
-  version = "0.11.24";
+  version = "0.11.25";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "orbax";
     tag = "v${version}";
-    hash = "sha256-B01m7jnmkxe2/VHhi+U0XDCwPornTi34v8cY/BBpftg=";
+    hash = "sha256-myhPWKP2uI9NQKZki1Rr+B6Kusn0qNWREKHkiDrSheA=";
   };
 
   sourceRoot = "${src.name}/checkpoint";

From e1eb26db51c51ff7dcf329338be2a80f87ad6642 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 11 Sep 2025 21:55:50 +0200
Subject: [PATCH 112/129] python313Packages.nicegui: 2.24.0 -> 2.24.1

Diff: https://github.com/zauberzeug/nicegui/compare/v2.24.0...v2.24.1

Changelog: https://github.com/zauberzeug/nicegui/releases/tag/v2.24.1
---
 pkgs/development/python-modules/nicegui/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/nicegui/default.nix b/pkgs/development/python-modules/nicegui/default.nix
index 88cad8e856c3..35817d325479 100644
--- a/pkgs/development/python-modules/nicegui/default.nix
+++ b/pkgs/development/python-modules/nicegui/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "nicegui";
-  version = "2.24.0";
+  version = "2.24.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zauberzeug";
     repo = "nicegui";
     tag = "v${version}";
-    hash = "sha256-1PRoaNj2c3z76IgN3NvL9BFtfeFJ2mUfQ6KGN85H7ps=";
+    hash = "sha256-Qwgs7e44h+i0YBLhmSReXVJEBSiShUT0M4QaU/X8uhI=";
   };
 
   pythonRelaxDeps = [ "requests" ];

From 3797716c0a082a001b7609eb5de71434eab1d703 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 11 Sep 2025 22:33:49 +0200
Subject: [PATCH 113/129] python3Packages.sagemaker-mlflow: 0.1.0 -> 0.1.1

Diff: https://github.com/aws/sagemaker-mlflow/compare/v0.1.0...v0.1.1

Changelog: https://github.com/aws/sagemaker-mlflow/releases/tag/v0.1.1
---
 pkgs/development/python-modules/sagemaker-mlflow/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sagemaker-mlflow/default.nix b/pkgs/development/python-modules/sagemaker-mlflow/default.nix
index dd9cb7efebcd..d626f55d6709 100644
--- a/pkgs/development/python-modules/sagemaker-mlflow/default.nix
+++ b/pkgs/development/python-modules/sagemaker-mlflow/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "sagemaker-mlflow";
-  version = "0.1.0";
+  version = "0.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "sagemaker-mlflow";
     tag = "v${version}";
-    hash = "sha256-1bonIqZ+cFxCOxoFWn1MLBOIiB1wUX69/lUTPPupJaw=";
+    hash = "sha256-mHwlP1bVkUiT6RbVf8YLHG+tzkw5+UVrPzcExgcEoJM=";
   };
 
   postPatch = ''

From da709db7c9d4a119b78be0b12a193f44f1dd6da8 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Sat, 19 Jul 2025 17:49:12 +0200
Subject: [PATCH 114/129] miniaudio: 0.11.22 -> 0.11.23

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 pkgs/by-name/mi/miniaudio/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mi/miniaudio/package.nix b/pkgs/by-name/mi/miniaudio/package.nix
index adece2e438ce..deaae50371e1 100644
--- a/pkgs/by-name/mi/miniaudio/package.nix
+++ b/pkgs/by-name/mi/miniaudio/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "miniaudio";
-  version = "0.11.22";
+  version = "0.11.23";
 
   src = fetchFromGitHub {
     owner = "mackron";
     repo = "miniaudio";
-    rev = finalAttrs.version;
-    hash = "sha256-o/7sfBcrhyXEakccOAogQqm8dO4Szj1QSpaIHg6OSt4=";
+    tag = finalAttrs.version;
+    hash = "sha256-ZrfKw5a3AtIER2btCKWhuvygasNaHNf9EURf1Kv96Vc=";
   };
 
   postInstall = ''

From f654ed160720d842a80243398b87291f20a94e68 Mon Sep 17 00:00:00 2001
From: fmbearmf <77757734+fmbearmf@users.noreply.github.com>
Date: Thu, 11 Sep 2025 13:53:52 -0700
Subject: [PATCH 115/129] opencpn: fix build

---
 pkgs/applications/misc/opencpn/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/misc/opencpn/default.nix b/pkgs/applications/misc/opencpn/default.nix
index d9c0ebe64cad..954c34040d5b 100644
--- a/pkgs/applications/misc/opencpn/default.nix
+++ b/pkgs/applications/misc/opencpn/default.nix
@@ -43,6 +43,7 @@
   util-linux,
   wxGTK32,
   xorg,
+  xz,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -104,6 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
     sqlite
     tinyxml
     wxGTK32
+    xz
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-utils

From 86bcff43e5aed4034e01968c120a4ce0c9b285b9 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Wed, 16 Jul 2025 09:15:07 -0400
Subject: [PATCH 116/129] strongswan: 5.9.14 -> 6.0.2

---
 pkgs/by-name/st/strongswan/package.nix | 319 ++++++++++++-------------
 1 file changed, 155 insertions(+), 164 deletions(-)

diff --git a/pkgs/by-name/st/strongswan/package.nix b/pkgs/by-name/st/strongswan/package.nix
index 12a07f974d19..d8f46ac8f746 100644
--- a/pkgs/by-name/st/strongswan/package.nix
+++ b/pkgs/by-name/st/strongswan/package.nix
@@ -2,209 +2,200 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
-  pkg-config,
   autoreconfHook,
-  perl,
-  gperf,
+  pkg-config,
   bison,
   flex,
-  gmp,
-  python3,
-  iptables,
-  ldns,
-  unbound,
+  curl,
+  perl,
+  gperf,
   openssl,
   pcsclite,
-  glib,
+  networkmanager,
   openresolv,
+  glib,
   systemd,
+  tpm2-tss,
+  libxml2,
   pam,
-  curl,
-  enableTNC ? false,
+  iptables,
   trousers,
   sqlite,
-  libxml2,
-  enableTPM2 ? false,
-  tpm2-tss,
-  enableNetworkManager ? false,
-  networkmanager,
+  unbound,
+  ldns,
+  gmp,
   nixosTests,
+  enableNetworkManager ? false,
+  enableTNC ? false,
+  enableTPM2 ? false,
 }:
+let
+  features = rec {
+    nm = enableNetworkManager;
+    cmd = true;
+    stroke = true;
+    swanctl = true;
+    systemd = stdenv.hostPlatform.isLinux;
 
-# Note on curl support: If curl is built with gnutls as its backend, the
-# strongswan curl plugin may break.
-# See https://wiki.strongswan.org/projects/strongswan/wiki/Curl for more info.
+    openssl = true;
 
+    farp = stdenv.hostPlatform.isLinux;
+    dhcp = stdenv.hostPlatform.isLinux;
+    af-alg = stdenv.hostPlatform.isLinux;
+    resolve = stdenv.hostPlatform.isLinux;
+    scripts = stdenv.hostPlatform.isLinux;
+    connmark = stdenv.hostPlatform.isLinux;
+    forecast = stdenv.hostPlatform.isLinux;
+    kernel-netlink = stdenv.hostPlatform.isLinux;
+
+    aesni = stdenv.hostPlatform.isx86_64;
+    rdrand = stdenv.hostPlatform.isx86_64;
+    padlock = stdenv.hostPlatform.system == "i686-linux";
+
+    kernel-pfkey = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD;
+    kernel-pfroute = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD;
+    kernel-libipsec = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD;
+
+    keychain = false; # breaks build
+    osx-attr = stdenv.hostPlatform.isDarwin;
+
+    ml = true;
+    # Note on curl support: If curl is built with gnutls as its backend, the
+    # strongswan curl plugin may break.
+    # See https://wiki.strongswan.org/projects/strongswan/wiki/Curl for more info.
+    curl = true;
+    acert = true;
+    pkcs11 = true;
+    dnscert = true;
+    unbound = true;
+    chapoly = true;
+    ext-auth = true;
+    socket-dynamic = stdenv.hostPlatform.isLinux;
+
+    eap-sim = true;
+    eap-sim-file = true;
+    eap-sim-pcsc = true;
+    eap-simaka-pseudonym = true;
+    eap-simaka-reauth = true;
+    eap-identity = true;
+    eap-md5 = true;
+    eap-gtc = true;
+    eap-aka = true;
+    eap-aka-3gpp = true;
+    eap-aka-3gpp2 = true;
+    eap-mschapv2 = true;
+    eap-tls = true;
+    eap-peap = true;
+    eap-radius = true;
+
+    xauth-eap = true;
+    xauth-pam = stdenv.hostPlatform.isLinux;
+    xauth-noauth = true;
+
+    gmp = eap-aka-3gpp2;
+  }
+  // lib.optionalAttrs enableTNC {
+    eap-tnc = true;
+    eap-ttls = true;
+    eap-dynamic = true;
+
+    tnccs-20 = true;
+
+    tnc-imc = true;
+    tnc-imv = true;
+    tnc-ifmap = true;
+
+    imc-os = true;
+    imv-os = true;
+    imc-attestation = true;
+    imv-attestation = true;
+
+    aikgen = true;
+    tss-trousers = true;
+
+    sqlite = true;
+  }
+  // lib.optionalAttrs enableTPM2 {
+    tpm = true;
+    tss-tss2 = true;
+  };
+in
 stdenv.mkDerivation rec {
   pname = "strongswan";
-  version = "5.9.14"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
+  version = "6.0.2"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
 
   src = fetchFromGitHub {
     owner = "strongswan";
     repo = "strongswan";
-    rev = version;
-    hash = "sha256-qFM7ErfqiDlUsZdGXJQVW3nJoh+I6tEdKRwzrKteRVY=";
+    tag = version;
+    hash = "sha256-wjz41gt+Xu4XJkEXRRVl3b3ryEoEtijeqmfVFoRjnA4=";
   };
 
-  dontPatchELF = true;
-
-  nativeBuildInputs = [
-    pkg-config
-    autoreconfHook
-    perl
-    gperf
-    bison
-    flex
-  ];
-  buildInputs = [
-    curl
-    gmp
-    python3
-    ldns
-    unbound
-    openssl
-    pcsclite
-  ]
-  ++ lib.optionals enableTNC [
-    trousers
-    sqlite
-    libxml2
-  ]
-  ++ lib.optional enableTPM2 tpm2-tss
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    systemd.dev
-    pam
-    iptables
-  ]
-  ++ lib.optionals enableNetworkManager [
-    networkmanager
-    glib
-  ];
-
   patches = [
     ./ext_auth-path.patch
     ./firewall_defaults.patch
     ./updown-path.patch
-    # Fixes for gettext 0.25
-    (fetchpatch2 {
-      url = "https://github.com/strongswan/strongswan/commit/7ec0101250bf2ac3da7a576cbb4204fceb2ef10c.patch?full_index=1";
-      excludes = [ "scripts/test.sh" ];
-      hash = "sha256-ATd/oj6/1vrtZdwMs45rA2MGtH2viumyucVj0LZ8Nnc=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/strongswan/strongswan/commit/e8e5e2d4419a686c5a2c064648618ec281089b2e.patch?full_index=1";
-      hash = "sha256-p98LSX8jjsDK/GZTovj/salmQ8T+txEV3vKD+wTUvsM=";
-    })
-    (fetchpatch2 {
-      url = "https://github.com/strongswan/strongswan/commit/2b3a5172d89c513ed28d21bb406c1b4ef0ac787a.patch?full_index=1";
-      hash = "sha256-xqp2Lq4pp3Uu0nVC/fl4E5mpJqCNgyZXP2g/Y2wShhI=";
-    })
   ];
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
-    # glibc-2.26 reorganized internal includes
-    sed '1i#include <stdint.h>' -i src/libstrongswan/utils/utils/memory.h
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    bison
+    flex
+    perl
+    gperf
+  ];
 
-    substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c --replace "/sbin/resolvconf" "${openresolv}/sbin/resolvconf"
-  '';
+  buildInputs =
+    lib.optional (features.gmp or false) gmp
+    ++ lib.optional (features.eap-sim-pcsc or false) pcsclite
+    ++ lib.optional (features.openssl or false) openssl
+    ++ lib.optional (features.curl or false) curl
+    ++ lib.optional (features.systemd or false) systemd
+    ++ lib.optional (features.tnc-ifmap or false) libxml2
+    ++ lib.optional (features.xauth-pam or false) pam
+    ++ lib.optional (features.forecast or false || features.connmark or false) iptables
+    ++ lib.optional (features.tss-trousers or false) trousers
+    ++ lib.optional (features.tss-tss2 or false) tpm2-tss
+    ++ lib.optional (features.sqlite or false) sqlite
+    ++ lib.optionals (features.unbound or false) [
+      unbound
+      ldns
+    ]
+    ++ lib.optionals (features.nm or false) [
+      networkmanager
+      glib
+    ];
 
-  configureFlags = [
+  configureFlags = (lib.mapAttrsToList (lib.flip lib.enableFeature)) features ++ [
     "--sysconfdir=/etc"
-    "--enable-swanctl"
-    "--enable-cmd"
-    "--enable-openssl"
-    "--enable-eap-sim"
-    "--enable-eap-sim-file"
-    "--enable-eap-simaka-pseudonym"
-    "--enable-eap-simaka-reauth"
-    "--enable-eap-identity"
-    "--enable-eap-md5"
-    "--enable-eap-gtc"
-    "--enable-eap-aka"
-    "--enable-eap-aka-3gpp2"
-    "--enable-eap-mschapv2"
-    "--enable-eap-radius"
-    "--enable-xauth-eap"
-    "--enable-ext-auth"
-    "--enable-acert"
-    "--enable-pkcs11"
-    "--enable-eap-sim-pcsc"
-    "--enable-dnscert"
-    "--enable-unbound"
-    "--enable-chapoly"
-    "--enable-curl"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    "--enable-farp"
-    "--enable-dhcp"
-    "--enable-systemd"
-    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
-    "--enable-xauth-pam"
-    "--enable-forecast"
-    "--enable-connmark"
-    "--enable-af-alg"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isx86_64 [
-    "--enable-aesni"
-    "--enable-rdrand"
-  ]
-  ++ lib.optional (stdenv.hostPlatform.system == "i686-linux") "--enable-padlock"
-  ++ lib.optionals enableTNC [
-    "--disable-gmp"
-    "--disable-aes"
-    "--disable-md5"
-    "--disable-sha1"
-    "--disable-sha2"
-    "--disable-fips-prf"
-    "--enable-eap-tnc"
-    "--enable-eap-ttls"
-    "--enable-eap-dynamic"
-    "--enable-tnccs-20"
-    "--enable-tnc-imc"
-    "--enable-imc-os"
-    "--enable-imc-attestation"
-    "--enable-tnc-imv"
-    "--enable-imv-attestation"
-    "--enable-tnc-ifmap"
-    "--enable-tnc-imc"
-    "--enable-tnc-imv"
-    "--with-tss=trousers"
-    "--enable-aikgen"
-    "--enable-sqlite"
-  ]
-  ++ lib.optionals enableTPM2 [
-    "--enable-tpm"
-    "--enable-tss-tss2"
-  ]
-  ++ lib.optionals enableNetworkManager [
-    "--enable-nm"
-    "--with-nm-ca-dir=/etc/ssl/certs"
-  ]
-  # Taken from: https://wiki.strongswan.org/projects/strongswan/wiki/MacOSX
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    "--disable-systemd"
-    "--disable-xauth-pam"
-    "--disable-kernel-netlink"
-    "--enable-kernel-pfkey"
-    "--enable-kernel-pfroute"
-    "--enable-kernel-libipsec"
-    "--enable-osx-attr"
-    "--disable-scripts"
+    (lib.withFeatureAs (features.nm or false) "nm-ca-dir" "/etc/ssl/certs")
+    (lib.withFeatureAs (features.systemd or false
+    ) "systemdsystemunitdir" "${placeholder "out"}/etc/systemd/system")
   ];
 
   installFlags = [
     "sysconfdir=${placeholder "out"}/etc"
   ];
 
-  NIX_LDFLAGS = lib.optionalString stdenv.cc.isGNU "-lgcc_s";
+  enableParallelBuilding = true;
+
+  dontPatchELF = true;
 
   passthru.tests = { inherit (nixosTests) strongswan-swanctl; };
 
-  meta = with lib; {
-    description = "OpenSource IPsec-based VPN Solution";
-    homepage = "https://www.strongswan.org";
-    license = licenses.gpl2Plus;
-    platforms = platforms.all;
+  postPatch = lib.optionalString features.resolve ''
+    substituteInPlace src/libcharon/plugins/resolve/resolve_handler.c \
+      --replace-fail "/sbin/resolvconf" "${openresolv}/sbin/resolvconf"
+  '';
+
+  meta = {
+    description = "OpenSource IPsec-based VPN solution";
+    homepage = "https://www.strongswan.org/";
+    changelog = "https://github.com/strongswan/strongswan/blob/${src.rev}/ChangeLog";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ nickcao ];
+    mainProgram = "swanctl";
+    platforms = lib.platforms.unix;
   };
 }

From 6a15f972d12829634db0b5e8d5e82ecbe6f98f54 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Mon, 10 Mar 2025 17:16:41 -0400
Subject: [PATCH 117/129] nixos/strongswan-swanctl: update option descriptions

---
 .../strongswan-swanctl/swanctl-params.nix     | 248 ++++++++++--------
 1 file changed, 144 insertions(+), 104 deletions(-)

diff --git a/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix b/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
index 197b8debaf83..bcdcfec9fc06 100644
--- a/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
+++ b/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix
@@ -131,21 +131,24 @@ in
         '';
 
         proposals = mkCommaSepListParam [ "default" ] ''
-          A proposal is a set of algorithms. For non-AEAD algorithms, this includes
-          for IKE an encryption algorithm, an integrity algorithm, a pseudo random
-          function and a Diffie-Hellman group. For AEAD algorithms, instead of
-          encryption and integrity algorithms, a combined algorithm is used.
+          A proposal is a set of algorithms. For non-AEAD IKE proposals, this includes
+          an encryption algorithm, an integrity algorithm, a pseudo-random function
+          and a key exchange method. For AEAD proposals, instead of encryption and
+          integrity algorithms, a combined mode algorithm is used.
 
-          In IKEv2, multiple algorithms of the same kind can be specified in a
-          single proposal, from which one gets selected. In IKEv1, only one
-          algorithm per kind is allowed per proposal, more algorithms get implicitly
-          stripped. Use multiple proposals to offer different algorithms
-          combinations in IKEv1.
+          With peers that support multiple IKEv2 key exchanges (RFC 9370), up to seven
+          additional key exchanges may be negotiated. They can be configured by
+          prefixing the algorithm keyword with **keX_** (where X is a number between
+          1 and 7).
 
-          Algorithm keywords get separated using dashes. Multiple proposals may be
-          specified in a list. The special value `default` forms a
-          default proposal of supported algorithms considered safe, and is usually a
-          good choice for interoperability.
+          For IKEv2, multiple algorithms of the same kind can be specified in a single
+          proposal, from which one gets selected. For IKEv1, only one algorithm per
+          kind is allowed per proposal, more algorithms get implicitly stripped. Use
+          multiple proposals to offer different algorithm combinations with IKEv1.
+
+          Algorithm keywords get separated using dashes. The special value _default_
+          forms a default proposal of supported algorithms considered safe, and is
+          usually a good choice for interoperability.
         '';
 
         vips = mkCommaSepListParam [ ] ''
@@ -240,16 +243,16 @@ in
 
           Use childless IKE_SA initiation (RFC 6023) for IKEv2, with the first
           CHILD_SA created with a separate CREATE_CHILD_SA exchange (e.g. to use an
-          independent DH exchange for all CHILD_SAs).  Acceptable values are `allow`
-          (the default), `prefer`, `force` and `never`. If set to `allow`, responders
+          independent key exchange for all CHILD_SAs).  Acceptable values are _allow_
+          (the default), _prefer_, _force_ and _never_. If set to _allow_, responders
           will accept childless IKE_SAs (as indicated via notify in the IKE_SA_INIT
           response) while initiators continue to create regular IKE_SAs with the first
           CHILD_SA created during IKE_AUTH, unless the IKE_SA is initiated explicitly
           without any children (which will fail if the responder does not support or
-          has disabled this extension). The effect of `prefer` is the same as `allow`
+          has disabled this extension). The effect of _prefer_ is the same as _allow_
           on responders, but as initiator a childless IKE_SA is initiated if the
-          responder supports it. If set to `force`, only childless initiation is
-          accepted in either role.  Finally, setting the option to `never` disables
+          responder supports it. If set to _force_, only childless initiation is
+          accepted in either role.  Finally, setting the option to _never_ disables
           support for childless IKE_SAs as responder.
         '';
 
@@ -321,9 +324,10 @@ in
           reauthentication lifetime negotiation can instruct the client to perform
           reauthentication.
 
-          Reauthentication is disabled by default. Enabling it usually may lead to
-          small connection interruptions, as strongSwan uses a break-before-make
-          policy with IKEv2 to avoid any conflicts with associated tunnel resources.
+          Reauthentication is disabled by default. Enabling it can usually result in
+          short connection interruptions, even when using make-before-break
+          reauthentication, which is now the default. However, they are significantly
+          shorter than when using the legacy break-before-make approach.
         '';
 
         rekey_time = mkDurationParam "4h" ''
@@ -657,59 +661,63 @@ in
           mkAttrsOfParams
             {
               ah_proposals = mkCommaSepListParam [ ] ''
-                AH proposals to offer for the CHILD_SA. A proposal is a set of
-                algorithms. For AH, this includes an integrity algorithm and an optional
-                Diffie-Hellman group. If a DH group is specified, CHILD_SA/Quick Mode
-                rekeying and initial negotiation uses a separate Diffie-Hellman exchange
-                using the specified group (refer to esp_proposals for details).
+                AH proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
+                For AH, this includes an integrity algorithm and an optional key exchange
+                method. If a KE method is specified, CHILD_SA/Quick Mode rekeying and
+                initial negotiation uses a separate key exchange using the negotiated method
+                (refer to _esp_proposals_ for details).
 
-                In IKEv2, multiple algorithms of the same kind can be specified in a
-                single proposal, from which one gets selected. In IKEv1, only one
-                algorithm per kind is allowed per proposal, more algorithms get
-                implicitly stripped. Use multiple proposals to offer different algorithms
-                combinations in IKEv1.
+                With peers that support multiple IKEv2 key exchanges (RFC 9370), up to seven
+                additional key exchanges may be negotiated. They can be configured by
+                prefixing the algorithm keyword with **keX_** (where X is a number between
+                1 and 7).
 
-                Algorithm keywords get separated using dashes. Multiple proposals may be
-                specified in a list. The special value `default` forms
-                a default proposal of supported algorithms considered safe, and is
+                For IKEv2, multiple algorithms of the same kind can be specified in a single
+                proposal, from which one gets selected. For IKEv1, only one algorithm per
+                kind is allowed per proposal, more algorithms get implicitly stripped. Use
+                multiple proposals to offer different algorithm combinations with IKEv1.
+
+                Algorithm keywords get separated using dashes. The special value _default_
+                forms a default proposal of supported algorithms considered safe, and is
                 usually a good choice for interoperability. By default no AH proposals
                 are included, instead ESP is proposed.
               '';
 
               esp_proposals = mkCommaSepListParam [ "default" ] ''
-                ESP proposals to offer for the CHILD_SA. A proposal is a set of
-                algorithms. For ESP non-AEAD proposals, this includes an integrity
-                algorithm, an encryption algorithm, an optional Diffie-Hellman group and
-                an optional Extended Sequence Number Mode indicator. For AEAD proposals,
-                a combined mode algorithm is used instead of the separate
-                encryption/integrity algorithms.
+                ESP proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
+                For non-AEAD ESP proposals, this includes an integrity algorithm, an
+                encryption algorithm, an optional key exchange method and an optional
+                Extended Sequence Number Mode indicator. For AEAD proposals, a combined
+                mode algorithm is used instead of the separate encryption/integrity
+                algorithms.
 
-                If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial
-                negotiation use a separate Diffie-Hellman exchange using the specified
-                group. However, for IKEv2, the keys of the CHILD_SA created implicitly
-                with the IKE_SA will always be derived from the IKE_SA's key material. So
-                any DH group specified here will only apply when the CHILD_SA is later
-                rekeyed or is created with a separate CREATE_CHILD_SA exchange. A
-                proposal mismatch might, therefore, not immediately be noticed when the
-                SA is established, but may later cause rekeying to fail.
+                If a key exchange method is specified, CHILD_SA/Quick Mode rekeying and
+                initial negotiation use a separate key exchange using the specified method.
+                However, for IKEv2, the keys of the CHILD_SA created implicitly with the
+                IKE_SA will always be derived from the IKE_SA's key material. So any key
+                exchange method specified here will only apply when the CHILD_SA is later
+                rekeyed or is created with a separate CREATE_CHILD_SA exchange. A proposal
+                mismatch might, therefore, not immediately be noticed when the SA is
+                established, but may later cause rekeying to fail.
 
-                Extended Sequence Number support may be indicated with the
-                `esn` and `noesn` values, both may be
-                included to indicate support for both modes. If omitted,
-                `noesn` is assumed.
+                With peers that support multiple IKEv2 key exchanges (RFC 9370), up to seven
+                additional key exchanges may be negotiated. They can be configured by
+                prefixing the algorithm keyword with **keX_** (where X is a number between
+                1 and 7).
 
-                In IKEv2, multiple algorithms of the same kind can be specified in a
-                single proposal, from which one gets selected. In IKEv1, only one
-                algorithm per kind is allowed per proposal, more algorithms get
-                implicitly stripped. Use multiple proposals to offer different algorithms
-                combinations in IKEv1.
+                Extended Sequence Number support may be indicated with the _esn_ and _noesn_
+                values, both may be included to indicate support for both modes. If omitted,
+                _noesn_ is assumed.
 
-                Algorithm keywords get separated using dashes. Multiple proposals may be
-                specified as a list. The special value `default` forms
-                a default proposal of supported algorithms considered safe, and is
-                usually a good choice for interoperability. If no algorithms are
-                specified for AH nor ESP, the default set of algorithms for ESP is
-                included.
+                For IKEv2, multiple algorithms of the same kind can be specified in a single
+                proposal, from which one gets selected. For IKEv1, only one algorithm per
+                kind is allowed per proposal, more algorithms get implicitly stripped. Use
+                multiple proposals to offer different algorithm combinations with IKEv1.
+
+                Algorithm keywords get separated using dashes. The special value _default_
+                forms a default proposal of supported algorithms considered safe, and is
+                usually a good choice for interoperability. If no algorithms are specified
+                for AH nor ESP, the _default_ set of algorithms for ESP is included.
               '';
 
               sha256_96 = mkYesNoParam no ''
@@ -721,30 +729,34 @@ in
               '';
 
               local_ts = mkCommaSepListParam [ "dynamic" ] ''
-                List of local traffic selectors to include in CHILD_SA. Each selector is
-                a CIDR subnet definition, followed by an optional proto/port
-                selector. The special value `dynamic` may be used
-                instead of a subnet definition, which gets replaced by the tunnel outer
-                address or the virtual IP, if negotiated. This is the default.
+                List of local traffic selectors to include in CHILD_SA.
+                Each selector is a CIDR subnet definition, followed by an optional
+                proto/port selector. The special value _dynamic_ may be used instead of a
+                subnet definition, which gets replaced by the tunnel outer address or the
+                virtual IP, if negotiated. This is the default.
 
                 A protocol/port selector is surrounded by opening and closing square
-                brackets. Between these brackets, a numeric or getservent(3) protocol
-                name may be specified. After the optional protocol restriction, an
-                optional port restriction may be specified, separated by a slash. The
-                port restriction may be numeric, a getservent(3) service name, or the
-                special value `opaque` for RFC 4301 OPAQUE
-                selectors. Port ranges may be specified as well, none of the kernel
-                backends currently support port ranges, though.
+                brackets. Between these brackets, a numeric or **getservent**(3) protocol
+                name may be specified. After the optional protocol restriction, an optional
+                port restriction may be specified, separated by a slash. The port
+                restriction may be numeric, a **getservent**(3) service name, or the special
+                value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified
+                as well, none of the kernel backends currently support port ranges, though.
+                If the protocol is _icmp_ or _ipv6-icmp_, the port is interpreted as ICMP
+                message type if it is less than 256 or as type and code if it is greater or
+                equal to 256, with the type in the most significant 8 bits and the code in
+                the least significant 8 bits.
 
-                When IKEv1 is used only the first selector is interpreted, except if the
-                Cisco Unity extension plugin is used. This is due to a limitation of the
-                IKEv1 protocol, which only allows a single pair of selectors per
-                CHILD_SA. So to tunnel traffic matched by several pairs of selectors when
-                using IKEv1 several children (CHILD_SAs) have to be defined that cover
-                the selectors.  The IKE daemon uses traffic selector narrowing for IKEv1,
-                the same way it is standardized and implemented for IKEv2. However, this
-                may lead to problems with other implementations. To avoid that, configure
-                identical selectors in such scenarios.
+                When IKEv1 is used only the first selector is interpreted, except if
+                the Cisco Unity extension plugin is used. This is due to a limitation of the
+                IKEv1 protocol, which only allows a single pair of selectors per CHILD_SA.
+                So to tunnel traffic matched by several pairs of selectors when using IKEv1
+                several children (CHILD_SAs) have to be defined that cover the selectors.
+
+                The IKE daemon uses traffic selector narrowing for IKEv1, the same way it is
+                standardized and implemented for IKEv2. However, this may lead to problems
+                with other implementations. To avoid that, configure identical selectors in
+                such scenarios.
               '';
 
               remote_ts = mkCommaSepListParam [ "dynamic" ] ''
@@ -752,14 +764,17 @@ in
                 {option}`local_ts` for a description of the selector syntax.
               '';
 
-              rekey_time = mkDurationParam "1h" ''
+              rekey_time = mkOptionalDurationParam ''
                 Time to schedule CHILD_SA rekeying. CHILD_SA rekeying refreshes key
                 material, optionally using a Diffie-Hellman exchange if a group is
-                specified in the proposal.  To avoid rekey collisions initiated by both
-                ends simultaneously, a value in the range of {option}`rand_time`
-                gets subtracted to form the effective soft lifetime.
+                specified in the proposal.
 
-                By default CHILD_SA rekeying is scheduled every hour, minus
+                To avoid rekey collisions initiated by both ends simultaneously, a value
+                in the range of {option}`rand_time` gets subtracted to form the effective soft
+                lifetime.
+
+                If {option}`life_time` is explicitly configured, {option}`rekey_time` defaults to 10%
+                less than that, otherwise, CHILD_SA rekeying is scheduled every hour, minus
                 {option}`rand_time`.
               '';
 
@@ -776,16 +791,19 @@ in
                 {option}`life_time` and {option}`rekey_time`.
               '';
 
-              rekey_bytes = mkIntParam 0 ''
+              rekey_bytes = mkOptionalIntParam ''
+                Number of bytes processed before initiating CHILD_SA rekeying.
+
                 Number of bytes processed before initiating CHILD_SA rekeying. CHILD_SA
-                rekeying refreshes key material, optionally using a Diffie-Hellman
-                exchange if a group is specified in the proposal.
+                rekeying refreshes key material, optionally using a Diffie-Hellman exchange
+                if a group is specified in the proposal.
 
                 To avoid rekey collisions initiated by both ends simultaneously, a value
-                in the range of {option}`rand_bytes` gets subtracted to form the
-                effective soft volume limit.
+                in the range of {option}`rand_bytes` gets subtracted to form the effective soft
+                volume limit.
 
-                Volume based CHILD_SA rekeying is disabled by default.
+                Volume based CHILD_SA rekeying is disabled by default. If {option}`life_bytes`
+                is explicitly configured, {option}`rekey_bytes` defaults to 10% less than that.
               '';
 
               life_bytes = mkOptionalIntParam ''
@@ -801,16 +819,20 @@ in
                 {option}`life_bytes` and {option}`rekey_bytes`.
               '';
 
-              rekey_packets = mkIntParam 0 ''
+              rekey_packets = mkOptionalIntParam ''
+                Number of packets processed before initiating CHILD_SA rekeying.
+
                 Number of packets processed before initiating CHILD_SA rekeying. CHILD_SA
-                rekeying refreshes key material, optionally using a Diffie-Hellman
-                exchange if a group is specified in the proposal.
+                rekeying refreshes key material, optionally using a Diffie-Hellman exchange
+                if a group is specified in the proposal.
 
                 To avoid rekey collisions initiated by both ends simultaneously, a value
-                in the range of {option}`rand_packets` gets subtracted to form
-                the effective soft packet count limit.
+                in the range of {option}`rand_packets` gets subtracted to form the effective soft
+                packet count limit.
 
-                Packet count based CHILD_SA rekeying is disabled by default.
+                Packet count based CHILD_SA rekeying is disabled by default. If
+                {option}`life_packets` is explicitly configured, {option}`rekey_packets` defaults to
+                10% less than that.
               '';
 
               life_packets = mkOptionalIntParam ''
@@ -1021,6 +1043,19 @@ in
                 protection.
               '';
 
+              per_cpu_sas = mkEnumParam [ "yes" "no" "encap" ] "no" ''
+                Enable per-CPU CHILD_SAs. Requires `trap` in `start_action`.
+                The value `encap` enables a special type of UDP encapsulation
+                (requires enabling `encap` for the connection if there is no NAT),
+                where a random source port is used for each outbound per-CPU SA
+                (the destination port for all of them remains 4500). This allows
+                using the port for RSS if the SPI can’t be used. Note that this type
+                of behavior is not standardized and not negotiated. So regardless
+                of whether the option is enabled, inbound per-CPU SAs
+                with UDP-encapsulation always have the source port set to 0
+                as the peer’s random port is unknown if it has this option enabled.
+              '';
+
               hw_offload = mkEnumParam [ "yes" "no" "auto" "crypto" "packet" ] "no" ''
                 Enable hardware offload for this CHILD_SA, if supported by the IPsec
                 implementation. The values `crypto` or `packet` enforce crypto or full
@@ -1302,9 +1337,14 @@ in
     mkAttrsOfParams
       {
         addrs = mkOptionalStrParam ''
-          Subnet or range defining addresses allocated in pool. Accepts a single
-          CIDR subnet defining the pool to allocate addresses from or an address
-          range (\<from\>-\<to\>). Pools must be unique and non-overlapping.
+          Addresses allocated in pool.
+
+          Subnet or range defining addresses allocated in pool. Accepts a single CIDR
+          subnet defining the pool to allocate addresses from or an address range
+          (<from>-<to>). If the address in CIDR notation is not the network ID of the
+          subnet (e.g. 10.1.0.5/24 instead of 10.1.0.0/24), addresses below it won't
+          be allocated to clients (they could e.g. be assigned manually to internal
+          hosts like the VPN server itself). Pools must be unique and non-overlapping
         '';
 
         dns = mkCommaSepListParam [ ] "Address or CIDR subnets";

From dead5643318d848bad58eba1c889b19adfbcdff3 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Wed, 4 Jun 2025 20:08:48 -0400
Subject: [PATCH 118/129] nixos/release-notes: strongswan updated to 6.0

---
 nixos/doc/manual/release-notes/rl-2511.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index c3f0c8de7e54..671e1e586cee 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -296,6 +296,8 @@
 - Potential race conditions in the network setup when using `networking.interfaces` have been fixed by disabling duplicate address detection (DAD)
   for statically configured IPv6 addresses.
 
+- `strongSwan` has been updated to 6.0. See [strongSwan 6.0.0 release notes](https://github.com/strongswan/strongswan/releases/tag/6.0.0) for a complete list of changes.
+
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
 

From 84143c424b06b7caedcadc0bf20d02f15f60c5aa Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Sat, 19 Jul 2025 17:49:12 +0200
Subject: [PATCH 119/129] python3Packages.miniaudio: use vendorded miniaudio

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 .../python-modules/miniaudio/default.nix      | 21 +------------------
 pkgs/top-level/python-packages.nix            |  4 +---
 2 files changed, 2 insertions(+), 23 deletions(-)

diff --git a/pkgs/development/python-modules/miniaudio/default.nix b/pkgs/development/python-modules/miniaudio/default.nix
index c8bf9d91a1a7..6d857d248e76 100644
--- a/pkgs/development/python-modules/miniaudio/default.nix
+++ b/pkgs/development/python-modules/miniaudio/default.nix
@@ -3,22 +3,10 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
-  miniaudio,
   cffi,
   pytestCheckHook,
 }:
 
-let
-  # TODO: recheck after 1.59
-  miniaudio' = miniaudio.overrideAttrs (oldAttrs: rec {
-    version = "0.11.16"; # cffi breakage with 0.11.17
-    src = fetchFromGitHub {
-      inherit (oldAttrs.src) owner repo;
-      rev = "refs/tags/${version}";
-      hash = "sha256-POe/dYPJ25RKNGIhaLoqxm9JJ08MrTyHVN4NmaGOdwM=";
-    };
-  });
-in
 buildPythonPackage rec {
   pname = "miniaudio";
   version = "1.61";
@@ -31,14 +19,7 @@ buildPythonPackage rec {
     hash = "sha256-H3o2IWGuMqLrJTzQ7w636Ito6f57WBtMXpXXzrZ7UD8=";
   };
 
-  postPatch = ''
-    rm -r miniaudio
-    ln -s ${miniaudio'} miniaudio
-    substituteInPlace build_ffi_module.py \
-      --replace-fail "miniaudio/stb_vorbis.c" "miniaudio/extras/stb_vorbis.c";
-    substituteInPlace miniaudio.c \
-      --replace-fail "miniaudio/stb_vorbis.c" "miniaudio/extras/stb_vorbis.c";
-  '';
+  # TODO: Properly unvendor miniaudio c library
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9e7bfc8df7f1..9ca3f3ce7f75 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9329,9 +9329,7 @@ self: super: with self; {
 
   minexr = callPackage ../development/python-modules/minexr { };
 
-  miniaudio = callPackage ../development/python-modules/miniaudio {
-    inherit (pkgs) miniaudio;
-  };
+  miniaudio = callPackage ../development/python-modules/miniaudio { };
 
   minichain = callPackage ../development/python-modules/minichain { };
 

From 48ac9598d5ebc64c10b4488a561ef298da51dfcb Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Sat, 19 Jul 2025 17:49:12 +0200
Subject: [PATCH 120/129] miniaudio: switch to cmake

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 pkgs/by-name/mi/miniaudio/package.nix | 62 +++++++++++++++++++--------
 1 file changed, 45 insertions(+), 17 deletions(-)

diff --git a/pkgs/by-name/mi/miniaudio/package.nix b/pkgs/by-name/mi/miniaudio/package.nix
index deaae50371e1..852418e7aeca 100644
--- a/pkgs/by-name/mi/miniaudio/package.nix
+++ b/pkgs/by-name/mi/miniaudio/package.nix
@@ -3,6 +3,21 @@
   stdenv,
   fetchFromGitHub,
   testers,
+
+  cmake,
+  ninja,
+
+  alsa-lib,
+  libjack2,
+  libpulseaudio,
+  libvorbis,
+  opusfile,
+  sndio,
+
+  alsaSupport ? true,
+  pulseSupport ? true,
+  jackSupport ? true,
+  sndioSupport ? true,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "miniaudio";
@@ -15,26 +30,39 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ZrfKw5a3AtIER2btCKWhuvygasNaHNf9EURf1Kv96Vc=";
   };
 
-  postInstall = ''
-    mkdir -p $out/include
-    mkdir -p $out/lib/pkgconfig
+  outputs = [
+    "out"
+    "dev"
+  ];
 
-    cp $src/miniaudio.h $out/include
-    ln -s $out/include/miniaudio.h $out
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ];
 
-    cp -r $src/extras $out/
+  buildInputs = [
+    libvorbis
+    opusfile
+  ]
+  ++ lib.optional pulseSupport libpulseaudio
+  ++ lib.optional jackSupport libjack2
+  ++ lib.optional alsaSupport alsa-lib
+  ++ lib.optional sndioSupport sndio;
 
-    cat <<EOF >$out/lib/pkgconfig/miniaudio.pc
-    prefix=$out
-    includedir=$out/include
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "MINIAUDIO_NO_RUNTIME_LINKING" true)
+    (lib.cmakeBool "MINIAUDIO_BUILD_TESTS" true)
+    (lib.cmakeBool "MINIAUDIO_BUILD_EXAMPLES" true)
 
-    Name: miniaudio
-    Description: An audio playback and capture library in a single source file.
-    Version: $version
-    Cflags: -I$out/include
-    Libs: -lm -lpthread -latomic
-    EOF
-  '';
+    (lib.cmakeBool "MINIAUDIO_ENABLE_ONLY_SPECIFIC_BACKENDS" true)
+    (lib.cmakeBool "MINIAUDIO_ENABLE_PULSEAUDIO" pulseSupport)
+    (lib.cmakeBool "MINIAUDIO_ENABLE_JACK" jackSupport)
+    (lib.cmakeBool "MINIAUDIO_ENABLE_SNDIO" alsaSupport)
+    (lib.cmakeBool "MINIAUDIO_ENABLE_ALSA" sndioSupport)
+  ];
+
+  doCheck = true;
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
@@ -48,6 +76,6 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     maintainers = [ maintainers.jansol ];
     pkgConfigModules = [ "miniaudio" ];
-    platforms = platforms.all;
+    platforms = platforms.linux;
   };
 })

From d06691a01ea0ae4cb9099ab8a72d0826ac9de3f5 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Sat, 19 Jul 2025 17:49:12 +0200
Subject: [PATCH 121/129] sfml: unvendor miniaudio

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 pkgs/by-name/sf/sfml/package.nix              | 30 ++++++----------
 pkgs/by-name/sf/sfml/unvendor-miniaudio.patch | 35 +++++++++++++++++++
 2 files changed, 45 insertions(+), 20 deletions(-)
 create mode 100644 pkgs/by-name/sf/sfml/unvendor-miniaudio.patch

diff --git a/pkgs/by-name/sf/sfml/package.nix b/pkgs/by-name/sf/sfml/package.nix
index 235f31e50475..f91240cb85b1 100644
--- a/pkgs/by-name/sf/sfml/package.nix
+++ b/pkgs/by-name/sf/sfml/package.nix
@@ -6,6 +6,7 @@
 
   # nativeBuildInputs
   cmake,
+  pkg-config,
 
   # buildInputs
   flac,
@@ -13,6 +14,7 @@
   glew,
   libjpeg,
   libvorbis,
+  miniaudio,
   udev,
   libXi,
   libX11,
@@ -20,12 +22,6 @@
   libXrandr,
   libXrender,
   xcbutilimage,
-
-  # miniaudio
-  alsa-lib,
-  libjack2,
-  libpulseaudio,
-  sndio,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -45,15 +41,22 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/SFML/SFML/commit/a87763becbc4672b38f1021418ed94caa0f6540a.patch?full_index=1";
       hash = "sha256-tJmXTdhwtWq6XfUPBzw47yTrc6EzwmSiVj9n6jQwHig=";
     })
+
+    # Not upstreamble in the near future, see https://github.com/SFML/SFML/pull/3555
+    ./unvendor-miniaudio.patch
   ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
   buildInputs = [
     flac
     freetype
     glew
     libjpeg
     libvorbis
+    miniaudio
   ]
   ++ lib.optional stdenv.hostPlatform.isLinux udev
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
@@ -65,25 +68,12 @@ stdenv.mkDerivation (finalAttrs: {
     xcbutilimage
   ];
 
-  # We rely on RUNPATH
-  dontPatchELF = true;
-
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
     (lib.cmakeBool "SFML_INSTALL_PKGCONFIG_FILES" true)
     (lib.cmakeFeature "SFML_MISC_INSTALL_PREFIX" "share/SFML")
     (lib.cmakeBool "SFML_BUILD_FRAMEWORKS" false)
     (lib.cmakeBool "SFML_USE_SYSTEM_DEPS" true)
-
-    # FIXME: Unvendor miniaudio and move these deps there
-    (lib.cmakeFeature "CMAKE_INSTALL_RPATH" (
-      lib.makeLibraryPath [
-        alsa-lib
-        libjack2
-        libpulseaudio
-        sndio
-      ]
-    ))
   ];
 
   meta = {
diff --git a/pkgs/by-name/sf/sfml/unvendor-miniaudio.patch b/pkgs/by-name/sf/sfml/unvendor-miniaudio.patch
new file mode 100644
index 000000000000..6053118e05fe
--- /dev/null
+++ b/pkgs/by-name/sf/sfml/unvendor-miniaudio.patch
@@ -0,0 +1,35 @@
+diff --git a/src/SFML/Audio/CMakeLists.txt b/src/SFML/Audio/CMakeLists.txt
+index 7567205c..ecbb4ea1 100644
+--- a/src/SFML/Audio/CMakeLists.txt
++++ b/src/SFML/Audio/CMakeLists.txt
+@@ -10,7 +10,6 @@ set(SRC
+     ${INCROOT}/Export.hpp
+     ${SRCROOT}/Listener.cpp
+     ${INCROOT}/Listener.hpp
+-    ${SRCROOT}/Miniaudio.cpp
+     ${SRCROOT}/MiniaudioUtils.hpp
+     ${SRCROOT}/MiniaudioUtils.cpp
+     ${SRCROOT}/Music.cpp
+@@ -169,8 +168,10 @@ sfml_add_library(Audio
+ # avoids warnings in vorbisfile.h
+ target_compile_definitions(sfml-audio PRIVATE OV_EXCLUDE_STATIC_CALLBACKS FLAC__NO_DLL)
+ 
+-# disable miniaudio features we do not use
+-target_compile_definitions(sfml-audio PRIVATE MA_NO_MP3 MA_NO_FLAC MA_NO_ENCODING MA_NO_RESOURCE_MANAGER MA_NO_GENERATION)
++find_package(PkgConfig REQUIRED)
++pkg_check_modules(miniaudio REQUIRED IMPORTED_TARGET miniaudio)
++target_link_libraries(sfml-audio PRIVATE PkgConfig::miniaudio)
++target_include_directories(sfml-audio SYSTEM PRIVATE "${miniaudio_INCLUDE_DIRS}/miniaudio")
+ 
+ # use standard fixed-width integer types
+ target_compile_definitions(sfml-audio PRIVATE MA_USE_STDINT)
+@@ -186,9 +187,6 @@ if(SFML_OS_IOS)
+     target_link_libraries(sfml-audio PRIVATE "-framework Foundation" "-framework CoreFoundation" "-framework CoreAudio" "-framework AudioToolbox" "-framework AVFoundation")
+ endif()
+ 
+-# miniaudio sources
+-target_include_directories(sfml-audio SYSTEM PRIVATE "${PROJECT_SOURCE_DIR}/extlibs/headers/miniaudio")
+-
+ # minimp3 sources
+ target_include_directories(sfml-audio SYSTEM PRIVATE "${PROJECT_SOURCE_DIR}/extlibs/headers/minimp3")
+ 

From e749fe7cdf5c726e2b392b5d17bc9d1ec3c746eb Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Thu, 11 Sep 2025 23:37:52 +0200
Subject: [PATCH 122/129] ungoogled-chromium: 140.0.7339.80-1 ->
 140.0.7339.127-1

https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_9.html

This update includes 2 security fixes.

CVEs:
CVE-2025-10200 CVE-2025-10201
---
 .../networking/browsers/chromium/info.json    | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 0f7385f6b061..27a8294f4e46 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -798,7 +798,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "140.0.7339.80",
+    "version": "140.0.7339.127",
     "deps": {
       "depot_tools": {
         "rev": "7d1e2bdb9168718566caba63a170a67cdab2356b",
@@ -810,16 +810,16 @@
         "hash": "sha256-Z7bTto8BHnJzjvmKmcVAZ0/BrXimcAETV6YGKNTorQw="
       },
       "ungoogled-patches": {
-        "rev": "140.0.7339.80-1",
-        "hash": "sha256-jBRBph+rhSK6tmrSpCDN39VbSmvHnTquy1HBUQ6QFFY="
+        "rev": "140.0.7339.127-1",
+        "hash": "sha256-mhMudxJU2arMcmECS9+3ne9X66zyKq5WGc8PSx9RfLc="
       },
       "npmHash": "sha256-R2gOpfPOUAmnsnUTIvzDPHuHNzL/b2fwlyyfTrywEcI="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "670b6f192f4668d2ac2c06bd77ec3e4eeda7d648",
-        "hash": "sha256-tAiE11g/zymsOOjb64ZIA0GCGDV+6X5qlXUiU9vED/c=",
+        "rev": "9412745860d8c3dfed9cf38f5daa943b163f8c69",
+        "hash": "sha256-rAyS5AhWHL9+6N4+2PFYKPJjzErj8LfIm5ptcsTTV8E=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -889,8 +889,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "cbc4153da8d5796b0fbb3cf288e97bee19436191",
-        "hash": "sha256-lexJRf3EZexLgSuk8ziA+OUW+jTYlkXUPKHU/E6aUcY="
+        "rev": "a8c8a6febe630c6239a5e207530e9fac651ae373",
+        "hash": "sha256-GxWTdzSf7/9WIqrECdAEkibXve/ZpKpxJcNS+KnfNc0="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -1049,8 +1049,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "ab96665ae2cfcc054e0243461cfcb56bb016f71a",
-        "hash": "sha256-8G9OCH5xapLf83bXrKwygCrzwF8C9H2NfnIrDbL+uCc="
+        "rev": "5dbb6f71a9bd613c0403242c7c021652fbf155fd",
+        "hash": "sha256-tA+6iKBfJVrlT+1UH55vqa5JCONweZeD/zWfNHHD+Kw="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1559,8 +1559,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "847fe7905954f3ae883de2936415ff567aa9039b",
-        "hash": "sha256-kcK1kJdPCkXbEFuS+b6wKUBaKLXmkAEwVKp4/YWDv8s="
+        "rev": "36ea4535a500ac137dbf1f577ce40dc1aaa774ef",
+        "hash": "sha256-/3V/V0IrhOKcMAgs/C1qraqq+1pfopW8HKvGRmqLE0Q="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",

From d8b62ae92f60a8c53574893acecbf34f5b613c6b Mon Sep 17 00:00:00 2001
From: sshine <simon@simonshine.dk>
Date: Fri, 12 Sep 2025 00:07:55 +0200
Subject: [PATCH 123/129] terranix: add sshine as maintainer

This follows becoming a maintainer:
- terranix/terranix#122

in order to make future releases.
---
 pkgs/by-name/te/terranix/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/te/terranix/package.nix b/pkgs/by-name/te/terranix/package.nix
index 65f1d715154c..bdac8d56c672 100644
--- a/pkgs/by-name/te/terranix/package.nix
+++ b/pkgs/by-name/te/terranix/package.nix
@@ -38,6 +38,9 @@ stdenv.mkDerivation rec {
     homepage = "https://terranix.org";
     license = licenses.gpl3;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ mrVanDalo ];
+    maintainers = with maintainers; [
+      mrVanDalo
+      sshine
+    ];
   };
 }

From 070eb31c8c899bcceacc2c45fe66a526ebc39551 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 11 Sep 2025 18:22:29 -0400
Subject: [PATCH 124/129] llama-cpp: require newer apple sdk for Metal

Latest update [1] pulled code that relies on MTLBuffer `gpuaddress`
property that was added in macOS 13.0+ [2]. Build failed with:

error: property 'gpuAddress' not found on object of type 'id<MTLBuffer>'

[1] https://github.com/NixOS/nixpkgs/pull/438529
[2] https://developer.apple.com/documentation/metal/mtlbuffer/gpuaddress
---
 pkgs/by-name/ll/llama-cpp/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 9f9af59cc7de..376ec300c826 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -30,6 +30,7 @@
   metalSupport ? stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 && !openclSupport,
   vulkanSupport ? false,
   rpcSupport ? false,
+  apple-sdk_14,
   curl,
   shaderc,
   vulkan-headers,
@@ -119,6 +120,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     ++ optionals rocmSupport rocmBuildInputs
     ++ optionals blasSupport [ blas ]
     ++ optionals vulkanSupport vulkanBuildInputs
+    ++ optionals metalSupport [ apple-sdk_14 ]
     ++ [ curl ];
 
   preConfigure = ''

From 94f2a818e8650546d71f56149091546f3efecb65 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 11 Sep 2025 18:29:17 -0400
Subject: [PATCH 125/129] llama-cpp: remove with lib;

---
 pkgs/by-name/ll/llama-cpp/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 376ec300c826..07d7ad0e71b4 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -183,17 +183,17 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     ];
   };
 
-  meta = with lib; {
+  meta = {
     description = "Inference of Meta's LLaMA model (and others) in pure C/C++";
     homepage = "https://github.com/ggml-org/llama.cpp";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     mainProgram = "llama";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       dit7ya
       philiptaron
       xddxdd
     ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
     badPlatforms = optionals (cudaSupport || openclSupport) lib.platforms.darwin;
     broken = metalSupport && !effectiveStdenv.hostPlatform.isDarwin;
   };

From 2eb6522e21c8795e31bd00fbf86d69496763979e Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 11 Sep 2025 18:32:18 -0400
Subject: [PATCH 126/129] llama-cpp: add metal test case

---
 pkgs/by-name/ll/llama-cpp/package.nix | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 07d7ad0e71b4..4b259bf9dad2 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -32,6 +32,7 @@
   rpcSupport ? false,
   apple-sdk_14,
   curl,
+  llama-cpp,
   shaderc,
   vulkan-headers,
   vulkan-loader,
@@ -175,12 +176,17 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   # the tests are failing as of 2025-08
   doCheck = false;
 
-  passthru.updateScript = nix-update-script {
-    attrPath = "llama-cpp";
-    extraArgs = [
-      "--version-regex"
-      "b(.*)"
-    ];
+  passthru = {
+    tests = {
+      metal = llama-cpp.override { metalSupport = true; };
+    };
+    updateScript = nix-update-script {
+      attrPath = "llama-cpp";
+      extraArgs = [
+        "--version-regex"
+        "b(.*)"
+      ];
+    };
   };
 
   meta = {

From 8e99f421475e3c189a5ef35e5f5f3021a3d4d017 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 11 Sep 2025 18:32:52 -0400
Subject: [PATCH 127/129] llama-cpp: add booxter as maintainer

I already maintain llama-cpp-python and I have some awareness of
llama-cpp build system, as well as contributed some patches for Metal
supportto ggml. I'd like to be notified about updates to confirm Darwin
is not broken.
---
 pkgs/by-name/ll/llama-cpp/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 4b259bf9dad2..c3ae8e1dc0c7 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -195,6 +195,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     mainProgram = "llama";
     maintainers = with lib.maintainers; [
+      booxter
       dit7ya
       philiptaron
       xddxdd

From 0b3c762f7091df5499df3d0f55acd57ae2683d9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 12 Sep 2025 00:45:13 +0200
Subject: [PATCH 128/129] chkrootkit: drop

---
 pkgs/by-name/ch/chkrootkit/package.nix | 42 --------------------------
 pkgs/top-level/aliases.nix             |  1 +
 2 files changed, 1 insertion(+), 42 deletions(-)
 delete mode 100644 pkgs/by-name/ch/chkrootkit/package.nix

diff --git a/pkgs/by-name/ch/chkrootkit/package.nix b/pkgs/by-name/ch/chkrootkit/package.nix
deleted file mode 100644
index c4f7a017803e..000000000000
--- a/pkgs/by-name/ch/chkrootkit/package.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  makeWrapper,
-  binutils-unwrapped,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "chkrootkit";
-  version = "0.58b";
-
-  src = fetchurl {
-    url = "ftp://ftp.chkrootkit.org/pub/seg/pac/${pname}-${version}.tar.gz";
-    sha256 = "sha256-de0qzoHw+j6cP7ZNqw6IV+1ZJH6nVfWJhBb+ssZoB7k=";
-  };
-
-  # TODO: a lazy work-around for linux build failure ...
-  makeFlags = [ "STATIC=" ];
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  postPatch = ''
-    substituteInPlace chkrootkit \
-      --replace " ./" " $out/bin/"
-  '';
-
-  installPhase = ''
-    mkdir -p $out/sbin
-    cp check_wtmpx chkdirs chklastlog chkproc chkrootkit chkutmp chkwtmp ifpromisc strings-static $out/sbin
-
-    wrapProgram $out/sbin/chkrootkit \
-      --prefix PATH : "${lib.makeBinPath [ binutils-unwrapped ]}"
-  '';
-
-  meta = with lib; {
-    description = "Locally checks for signs of a rootkit";
-    homepage = "https://www.chkrootkit.org/";
-    license = licenses.bsd2;
-    platforms = with platforms; linux;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5fb8852dd0eb..60696df6976f 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -614,6 +614,7 @@ mapAliases {
   ChowPhaser = chow-phaser; # Added 2024-06-12
   ChowKick = chow-kick; # Added 2024-06-12
   CHOWTapeModel = chow-tape-model; # Added 2024-06-12
+  chkrootkit = throw "chkrootkit has been removed as it is unmaintained and archived upstream and didn't even work on NixOS"; # Added 2025-09-12
   chromatic = throw "chromatic has been removed due to being unmaintained and failing to build"; # Added 2025-04-18
   chrome-gnome-shell = gnome-browser-connector; # Added 2022-07-27
   cinnamon-common = cinnamon; # Added 2025-08-06

From 078e0d1eaf0522291778f1acc375cab2e6d53f67 Mon Sep 17 00:00:00 2001
From: Haylin Moore <me@haylinmoore.com>
Date: Thu, 11 Sep 2025 16:05:55 -0700
Subject: [PATCH 129/129] gftp: 2.9.1b-> 2.9.1b-unstable-2025-05-12

Fix build by bumping to unstable release
---
 pkgs/by-name/gf/gftp/package.nix | 34 ++++++++------------------------
 1 file changed, 8 insertions(+), 26 deletions(-)

diff --git a/pkgs/by-name/gf/gftp/package.nix b/pkgs/by-name/gf/gftp/package.nix
index e52d6236085c..68cf2bf9510e 100644
--- a/pkgs/by-name/gf/gftp/package.nix
+++ b/pkgs/by-name/gf/gftp/package.nix
@@ -2,12 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  autoconf,
-  automake,
+  meson,
+  ninja,
   gettext,
   gtk2,
-  intltool,
-  libtool,
   ncurses,
   openssl,
   pkg-config,
@@ -18,21 +16,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gftp";
-  version = "2.9.1b";
+  version = "2.9.1b-unstable-2025-05-12";
 
   src = fetchFromGitHub {
     owner = "masneyb";
     repo = "gftp";
-    tag = finalAttrs.version;
-    hash = "sha256-0zdv2oYl24BXh61IGCWby/2CCkzNjLpDrAFc0J89Pw4=";
+    rev = "48114635f7b7b1f9a5eda985021ea53b10a7a030";
+    hash = "sha256-unTsd2xX8Y71ItE3gYHoxUPgViK/xhZdx0IQYvDPaEc=";
   };
 
   nativeBuildInputs = [
-    autoconf
-    automake
+    meson
+    ninja
     gettext
-    intltool
-    libtool
     pkg-config
   ];
 
@@ -43,28 +39,14 @@ stdenv.mkDerivation (finalAttrs: {
     readline
   ];
 
-  # https://github.com/masneyb/gftp/issues/178
-  postPatch = ''
-    substituteInPlace lib/gftp.h \
-      --replace-fail "size_t remote_addr_len" "socklen_t remote_addr_len"
-  '';
-
-  preConfigure = ''
-    ./autogen.sh
-  '';
-
   hardeningDisable = [ "format" ];
 
-  doInstallCheck = true;
-  nativeInstallCheckInputs = [ versionCheckHook ];
-
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     homepage = "https://github.com/masneyb/gftp";
     description = "GTK-based multithreaded FTP client for *nix-based machines";
     license = lib.licenses.gpl2Plus;
     maintainers = [ lib.maintainers.haylin ];
     platforms = lib.platforms.unix;
+    mainProgram = "gftp";
   };
 })