Merge master into staging-next

2026-07-13 12:49:51 +00:00
parent 36b0eb0dca e85df26e31
commit a4b4576c67
97 changed files with 1148 additions and 526 deletions
@@ -74,6 +74,8 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `enableParallelBuilding` (optional, defaults to `true`), since it is activated by default, we provide a way to disable it.
 * `extraInstallFlags` (optional), allows to extend `installFlags` which initializes the variables `COQLIBINSTALL` and `COQPLUGININSTALL` so as to install in the proper subdirectory. Indeed Rocq libraries should be installed in `$(out)/lib/coq/${rocq-core.rocq-version}/user-contrib/`. Such directories are automatically added to the `$ROCQPATH` environment variable by the hook defined in the Rocq derivation.
 * `setROCQBIN` (optional, defaults to `true`), by default, the environment variable `$ROCQBIN` is set to the current Rocq's binary, but one can disable this behavior by setting it to `false`,
+* `useCoq` (optional, defaults to `false`), adds the Coq compatibility binaries to the build environment, which is necessary for some packages that still depend on them and sets `COQBIN` to the path of the `coqc` binary (if `setROCQBIN` is also set to `true`). A wrapper `mkCoqDerivation` is provided that sets this option to `true`.
+* `useCoqifVersion` (optional, defaults to `(x: false)`), adds the Coq compatibility binaries to the build environment if the provided predicate evaluates to true on the version. This can be useful for supporting old package versions that need the Coq compatibility binaries, while newer versions do not.
 * `useMelquiondRemake` (optional, default to `null`) is an attribute set, which, if given, overloads the `preConfigurePhases`, `configureFlags`, `buildPhase`, and `installPhase` attributes of the derivation for a specific use in libraries using `remake` as set up by Guillaume Melquiond for `flocq`, `gappalib`, `interval`, and `coquelicot` (see the corresponding derivation for concrete examples of use of this option). For backward compatibility, the attribute `useMelquiondRemake.logpath` must be set to the logical root of the library (otherwise, one can pass `useMelquiondRemake = {}` to activate this without backward compatibility).
 * `dropAttrs`, `keepAttrs`, `dropDerivationAttrs` are all optional and allow to tune which attribute is added or removed from the final call to `mkDerivation`.

@@ -142,10 +142,11 @@

 ### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}

- Create the first release note entry in this section!
+- Setting `config.allowBrokenPredicate` is deprecated in favor of
+  using `config.problems.handlers.PackageName.broken = "warn"` (or `=
+  "ignore"`). For more information see [](#sec-allow-broken).


 ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}

 - Create the first release note entry in this section!
-
@@ -9026,6 +9026,11 @@
    githubId = 5198058;
    name = "Udo Sauer";
  };
+  fernvenue = {
+    github = "fernvenue";
+    githubId = 84565547;
+    name = "fernvenue";
+  };
  feyorsh = {
    email = "george@feyor.sh";
    github = "Feyorsh";
@@ -65,6 +65,7 @@ in
        DynamicUser = true;

        StateDirectory = "technitium-dns-server";
+        LogsDirectory = "technitium";

        Restart = "always";
        RestartSec = 10;
@@ -102,5 +103,8 @@ in
    };
  };

-  meta.maintainers = with lib.maintainers; [ fabianrig ];
+  meta.maintainers = with lib.maintainers; [
+    fabianrig
+    awildleon
+  ];
 }
@@ -2,7 +2,7 @@
 {
  name = "PDS";

-  nodes.machine = {
+  containers.machine = {
    services.bluesky-pds = {
      enable = true;
      settings = {
@@ -12,20 +12,20 @@ let
  # update-script-start: urls
  urls = {
    x86_64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.tar.gz";
-      hash = "sha256-lryIoVxoytyDyfgjnobQ3e94wIIohmIKL88fwf2I49w=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4.tar.gz";
+      hash = "sha256-BPuMTwZ3Xkk4SBRCdgZ8vCoEYjhTa3d8CFOqrGlcGg0=";
    };
    aarch64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.tar.gz";
-      hash = "sha256-oZQaxpVV0O4WlDE6Ia+KzHIF0SfWQBubBFIopSRMbvE=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.tar.gz";
+      hash = "sha256-f9KenMq1gtldzpBraSBwOb/186WQwh1ps5Ypj5JoOU0=";
    };
    x86_64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.dmg";
-      hash = "sha256-KUcQRWYUD/+4HHWnkGuqoltqL2an0WQkUEfUcttwjCI=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4.dmg";
+      hash = "sha256-SGdo6WYMCcCBuZUjvURcMTbJUqhZ4MzFlSLg6Zjr84I=";
    };
    aarch64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.dmg";
-      hash = "sha256-1N1RtN1QLvuJ1QL8jbN5TdbOHAHSN84W9XEK2PEPijI=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.dmg";
+      hash = "sha256-ZYen6Ew0GYbBAmuGCDACPBsygxZ6sT787o6gqF9DJzw=";
    };
  };
  # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
  product = "WebStorm";

  # update-script-start: version
-  version = "2026.1.3";
-  buildNumber = "261.25134.101";
+  version = "2026.1.4";
+  buildNumber = "261.26222.58";
  # update-script-end: version

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
@@ -706,11 +706,11 @@
    "vendorHash": "sha256-47xWjlzpQ/EYzjbuuMKQiu5cfYAXdYkXRl+AOEP+sA4="
  },
  "heroku_heroku": {
-    "hash": "sha256-hR4DvSneqG/5P4tYljcuFxQ34AnDIjIt+JMn1BhloeU=",
+    "hash": "sha256-AmHgAlz4J3l9OCjUMVxLMWtKZB1LpNOyX1exUI6fWHA=",
    "homepage": "https://registry.terraform.io/providers/heroku/heroku",
    "owner": "heroku",
    "repo": "terraform-provider-heroku",
-    "rev": "v5.3.2",
+    "rev": "v5.4.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1427,13 +1427,13 @@
    "vendorHash": null
  },
  "vancluever_acme": {
-    "hash": "sha256-AlT7Qe4YGdPUhM1N4OiMyjbmupgqXcQ/6SLz/v+W8lI=",
+    "hash": "sha256-CziwRMh53FPGhXw/TFWJUuI3KtMlwobCVNOgfRyjRLA=",
    "homepage": "https://registry.terraform.io/providers/vancluever/acme",
    "owner": "vancluever",
    "repo": "terraform-provider-acme",
-    "rev": "v2.48.1",
+    "rev": "v2.48.3",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-lWBMihP6oX7qPpTuPQQwQS3IDwdyb/rEYqtBsTozb7Q="
+    "vendorHash": "sha256-I6u4huFtk7dXmSyPRX4NxvcUJ4Q2iKuw8qzCdNzYjoQ="
  },
  "venafi_venafi": {
    "hash": "sha256-tCjeApdanKPNEy7snb6QJoCvwjpNa2fdDryoD+7wn8Y=",
@@ -79,7 +79,7 @@ let
  };
  releaseRev = v: "V${v}";
  fetched =
-    import ../../../../build-support/coq/meta-fetch/default.nix
+    import ../../../../build-support/rocq/meta-fetch/default.nix
      {
        inherit
          lib
@@ -32,7 +32,7 @@ let
  };
  releaseRev = v: "V${v}";
  fetched =
-    import ../../../../build-support/coq/meta-fetch/default.nix
+    import ../../../../build-support/rocq/meta-fetch/default.nix
      {
        inherit
          lib
@@ -1,246 +0,0 @@
-{
-  lib,
-  stdenv,
-  coqPackages,
-  coq,
-  which,
-  fetchzip,
-  fetchurl,
-  dune,
-}@args:
-
-let
-  lib = import ./extra-lib.nix {
-    inherit (args) lib;
-  };
-
-  inherit (lib)
-    concatStringsSep
-    flip
-    foldl
-    isFunction
-    isString
-    optional
-    optionalAttrs
-    optionals
-    optionalString
-    pred
-    remove
-    switch
-    versions
-    ;
-
-  inherit (lib.attrsets) removeAttrs;
-  inherit (lib.strings) match;
-
-  isGitHubDomain = d: match "^github.*" d != null;
-  isGitLabDomain = d: match "^gitlab.*" d != null;
-in
-
-{
-  pname,
-  version ? null,
-  fetcher ? null,
-  owner ? "rocq-community",
-  domain ? "github.com",
-  repo ? pname,
-  defaultVersion ? null,
-  releaseRev ? (v: v),
-  displayVersion ? { },
-  release ? { },
-  buildInputs ? [ ],
-  nativeBuildInputs ? [ ],
-  extraBuildInputs ? [ ],
-  extraNativeBuildInputs ? [ ],
-  overrideBuildInputs ? [ ],
-  overrideNativeBuildInputs ? [ ],
-  namePrefix ? [ "coq" ],
-  enableParallelBuilding ? true,
-  extraInstallFlags ? [ ],
-  setCOQBIN ? true,
-  mlPlugin ? false,
-  useMelquiondRemake ? null,
-  dropAttrs ? [ ],
-  keepAttrs ? [ ],
-  dropDerivationAttrs ? [ ],
-  useDuneifVersion ? (x: false),
-  useDune ? false,
-  opam-name ? (concatStringsSep "-" (namePrefix ++ [ pname ])),
-  ...
-}@args:
-let
-  args-to-remove = foldl (flip remove) (
-    [
-      "version"
-      "fetcher"
-      "repo"
-      "owner"
-      "domain"
-      "releaseRev"
-      "displayVersion"
-      "defaultVersion"
-      "useMelquiondRemake"
-      "release"
-      "buildInputs"
-      "nativeBuildInputs"
-      "extraBuildInputs"
-      "extraNativeBuildInputs"
-      "overrideBuildInputs"
-      "overrideNativeBuildInputs"
-      "namePrefix"
-      "meta"
-      "useDuneifVersion"
-      "useDune"
-      "opam-name"
-      "extraInstallFlags"
-      "setCOQBIN"
-      "mlPlugin"
-      "dropAttrs"
-      "dropDerivationAttrs"
-      "keepAttrs"
-      "env"
-    ]
-    ++ dropAttrs
-  ) keepAttrs;
-  fetch =
-    import ../coq/meta-fetch/default.nix
-      {
-        inherit
-          lib
-          stdenv
-          fetchzip
-          fetchurl
-          ;
-      }
-      (
-        {
-          inherit release releaseRev;
-          location = { inherit domain owner repo; };
-        }
-        // optionalAttrs (args ? fetcher) { inherit fetcher; }
-      );
-  fetched = fetch (if version != null then version else defaultVersion);
-  display-pkg =
-    n: sep: v:
-    let
-      d = displayVersion.${n} or (if sep == "" then ".." else true);
-    in
-    n
-    + optionalString (v != "" && v != null) (
-      switch d [
-        {
-          case = true;
-          out = sep + v;
-        }
-        {
-          case = ".";
-          out = sep + versions.major v;
-        }
-        {
-          case = "..";
-          out = sep + versions.majorMinor v;
-        }
-        {
-          case = "...";
-          out = sep + versions.majorMinorPatch v;
-        }
-        {
-          case = isFunction;
-          out = optionalString (d v != "") (sep + d v);
-        }
-        {
-          case = isString;
-          out = optionalString (d != "") (sep + d);
-        }
-      ] ""
-    )
-    + optionalString (v == null) "-broken";
-  append-version = p: n: p + display-pkg n "" coqPackages.${n}.version + "-";
-  prefix-name = foldl append-version "" namePrefix;
-  useDune = args.useDune or (useDuneifVersion fetched.version);
-  coqlib-flags = [
-    "COQLIBINSTALL=$(out)/lib/coq/${coq.coq-version}/user-contrib"
-    "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)"
-  ];
-  docdir-flags = [ "COQDOCINSTALL=$(out)/share/coq/${coq.coq-version}/user-contrib" ];
-  COQUSERCONTRIB = "$out/lib/coq/${coq.coq-version}/user-contrib";
-in
-stdenv.mkDerivation (
-  removeAttrs (
-    {
-
-      name = prefix-name + (display-pkg pname "-" fetched.version);
-
-      inherit (fetched) version src;
-
-      nativeBuildInputs =
-        args.overrideNativeBuildInputs or (
-          [ which ]
-          ++ optional useDune dune
-          ++ optionals (useDune || mlPlugin) [
-            coq.ocamlPackages.ocaml
-            coq.ocamlPackages.findlib
-          ]
-          ++ (args.nativeBuildInputs or [ ])
-          ++ extraNativeBuildInputs
-        );
-      buildInputs =
-        args.overrideBuildInputs or ([ coq ] ++ (args.buildInputs or [ ]) ++ extraBuildInputs);
-      inherit enableParallelBuilding;
-
-      env =
-        optionalAttrs setCOQBIN {
-          COQBIN = "${coq}/bin/";
-        }
-        // optionalAttrs (args ? useMelquiondRemake) {
-          inherit COQUSERCONTRIB;
-        }
-        // (args.env or { });
-
-      meta =
-        (
-          {
-            platforms = coq.meta.platforms;
-          }
-          // (switch domain [
-            {
-              case = pred.union isGitHubDomain isGitLabDomain;
-              out = {
-                homepage = "https://${domain}/${owner}/${repo}";
-              };
-            }
-          ] { })
-          // optionalAttrs (fetched.broken or false) {
-            coqFilter = true;
-            broken = true;
-          }
-        )
-        // (args.meta or { });
-
-    }
-    // (optionalAttrs (!args ? installPhase && !args ? useMelquiondRemake) {
-      installFlags = coqlib-flags ++ docdir-flags ++ extraInstallFlags;
-    })
-    // (optionalAttrs useDune {
-      buildPhase = ''
-        runHook preBuild
-        dune build -p ${opam-name} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
-        runHook postBuild
-      '';
-      installPhase = ''
-        runHook preInstall
-        dune install --prefix=$out --libdir $OCAMLFIND_DESTDIR ${opam-name}
-        mkdir $out/lib/coq/
-        mv $OCAMLFIND_DESTDIR/coq $out/lib/coq/${coq.coq-version}
-        runHook postInstall
-      '';
-    })
-    // (optionalAttrs (args ? useMelquiondRemake) {
-      preConfigurePhases = [ "autoconf" ];
-      configureFlags = [ "--libdir=${COQUSERCONTRIB}/${useMelquiondRemake.logpath or ""}" ];
-      buildPhase = "./remake -j$NIX_BUILD_CORES";
-      installPhase = "./remake install";
-    })
-    // (removeAttrs args args-to-remove)
-  ) dropDerivationAttrs
-)
@@ -3,15 +3,16 @@
  stdenv,
  rocqPackages,
  rocq-core,
+  coq,
  which,
  fetchzip,
  fetchurl,
  dune,
-}@args:
+}@args0:

 let
  lib = import ./extra-lib.nix {
-    inherit (args) lib;
+    inherit (args0) lib;
  };

  inherit (lib)
@@ -66,6 +67,8 @@ in
  useDuneifVersion ? (x: false),
  useDune ? false,
  opam-name ? (concatStringsSep "-" (namePrefix ++ [ pname ])),
+  useCoq ? false,
+  useCoqifVersion ? (x: false),
  ...
 }@args:
 let
@@ -99,11 +102,13 @@ let
      "dropDerivationAttrs"
      "keepAttrs"
      "env"
+      "useCoq"
+      "useCoqifVersion"
    ]
    ++ dropAttrs
  ) keepAttrs;
  fetch =
-    import ../coq/meta-fetch/default.nix
+    import ../rocq/meta-fetch/default.nix
      {
        inherit
          lib
@@ -158,6 +163,8 @@ let
  append-version = p: n: p + display-pkg n "" rocqPackages.${n}.version + "-";
  prefix-name = foldl append-version "" namePrefix;
  useDune = args.useDune or (useDuneifVersion fetched.version);
+  useCoq = args.useCoq or (useCoqifVersion fetched.version);
+  rocq-core = if useCoq then coq // { rocq-version = coq.coq-version; } else args0.rocq-core;
  rocqlib-flags = [
    "COQLIBINSTALL=$(out)/lib/coq/${rocq-core.rocq-version}/user-contrib"
    "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)"
@@ -190,9 +197,10 @@ stdenv.mkDerivation (
      inherit enableParallelBuilding;

      env =
-        optionalAttrs setROCQBIN {
+        optionalAttrs (setROCQBIN && !useCoq) {
          ROCQBIN = "${rocq-core}/bin/";
        }
+        // optionalAttrs (setROCQBIN && useCoq) { COQBIN = "${rocq-core}/bin/"; }
        // optionalAttrs (args ? useMelquiondRemake) {
          inherit COQUSERCONTRIB;
        }
@@ -10,13 +10,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "ani-skip";
-  version = "1.0.1";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "synacktraa";
    repo = "ani-skip";
    tag = finalAttrs.version;
-    hash = "sha256-VEEG3d6rwTAS7/+gBKHFKIg9zFfBu5eBOu6Z23621gM=";
+    hash = "sha256-8EXJIY/YqTe2H0JDX/feMISCnHl2zs1LnvBkEk7Sss0=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -30,7 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    install -D skip.lua $out/share/mpv/scripts/skip.lua
+    install -D integrations/mpv.lua $out/share/mpv/scripts/skip.lua
    install -Dm 755 ani-skip $out/bin/ani-skip

    runHook postInstall
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "brewtarget";
-  version = "5.1.0";
+  version = "5.1.1";

  src = fetchFromGitHub {
    owner = "Brewtarget";
    repo = "brewtarget";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CVFj/tsOOFj/LpkmMy4h9dnCBTOq9WGkXFUr/yJdcK0=";
+    hash = "sha256-1baUFgw3L+q2Ig/xvakP14mzk3Uop+NZy53YHhJLkR8=";
    fetchSubmodules = true;
  };

@@ -13,6 +13,11 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "sha256-tVRtsRVeTHGP89SyeFc2BPMN1kw8W/1GV80Im4I6OsY=";
  };

+  # Remove vendored getopt.h in favor of stdenv's to fix non-gnu builds.
+  postPatch = ''
+    rm getopt.h
+  '';
+
  # Let's assume that fnmatch works for cross-compilation, otherwise it gives an error:
  # undefined reference to `rpl_fnmatch'.
  configureFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
@@ -52,6 +52,13 @@ stdenv.mkDerivation {
  ]
  ++ lib.optional stdenv.hostPlatform.isLinux pcsclite;

+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # macOS iconv implementation is slightly broken since Sonoma
+    # https://github.com/Homebrew/homebrew-core/pull/199639
+    # https://savannah.gnu.org/bugs/index.php?66541
+    am_cv_func_iconv_works = "yes";
+  };
+
  enableParallelBuilding = true;

  meta = {
@@ -24,7 +24,14 @@ let
 in
 (buildVscode rec {
  inherit commandLineArgs useVSCodeRipgrep;
-  inherit (sourcesJson) version vscodeVersion;
+  inherit (sourcesJson) version;
+  # Cursor reports vscode >= 1.122 but still ships @vscode/ripgrep.
+  # Capping the build-time vscodeVersion avoids modifying the notarized app bundle on Darwin.
+  vscodeVersion =
+    if lib.versionAtLeast sourcesJson.vscodeVersion "1.122.0" then
+      "1.121.0"
+    else
+      sourcesJson.vscodeVersion;

  pname = "cursor";

@@ -1,22 +1,22 @@
 {
-  "version": "3.9.16",
-  "vscodeVersion": "1.105.1",
+  "version": "3.11.13",
+  "vscodeVersion": "1.125.0",
  "sources": {
    "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/linux/x64/Cursor-3.9.16-x86_64.AppImage",
-      "hash": "sha256-dG61VYGMHPip57ldzNICEi1yPc4s1dON+MlDGiKadKc="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/linux/x64/Cursor-3.11.13-x86_64.AppImage",
+      "hash": "sha256-MXBXgGe7HXiL3kAMKxBSRTZxWMbh15D5dfXw6iemG9g="
    },
    "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/linux/arm64/Cursor-3.9.16-aarch64.AppImage",
-      "hash": "sha256-7tkupyy8EFeOpzQqoHQsYxWQlFoW6VBpXkuCJsRIhRw="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/linux/arm64/Cursor-3.11.13-aarch64.AppImage",
+      "hash": "sha256-UCjZFxXjzeovYrZWp6xrZGp+eH4uGo41Tl9Uj9q16W4="
    },
    "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-5sAj/FiPAs1facGmNKgXiNzs1Kc1ht9eXYU1aZ1VoUA="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-FbSBuRaWKjTD7vdg0GvFsizmbpNvnNyzB6yAljMAtSs="
    },
    "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-pnSsOvyFiBKJsPUPkfnSY1l+LEzz3g5kbepIco7dDIM="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-j1k40mFZDWnNTl/IwCB39JZ+Zc4/JwEthNh8SPCXAZE="
    }
  }
 }
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "comrak";
-  version = "0.53.0";
+  version = "0.54.0";

  src = fetchFromGitHub {
    owner = "kivikakk";
    repo = "comrak";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-neiDYC1wvCCYKlSX5R1PupZiH5vP3W5bWw17+8wv6uM=";
+    sha256 = "sha256-nLyGIN5AsWJsi+RPsQqPb2DLeSVF30ZrJAcDTsBV1V8=";
  };

-  cargoHash = "sha256-ErZ0yD9G0i0EEafrFGP2MQoVQR/plIkJjBrfbNTeEy8=";
+  cargoHash = "sha256-CXdjr6ScUN1JehyFDlk1Fji93X5tCF5/fs4obRTBzOU=";

  meta = {
    description = "CommonMark-compatible GitHub Flavored Markdown parser and formatter";
@@ -12,11 +12,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "container";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchurl {
    url = "https://github.com/apple/container/releases/download/${finalAttrs.version}/container-${finalAttrs.version}-installer-signed.pkg";
-    hash = "sha256-E/RfJtqUw1Sty+/h6PdjHn8SbpPF1N1qWlOKpmtPR50=";
+    hash = "sha256-DKHEKiJpwlV++x2CsbOKxVPmo6PaGxF5xDm87h59ZxQ=";
  };

  nativeBuildInputs = [
@@ -69,6 +69,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    mainProgram = "container";
    maintainers = with lib.maintainers; [
      xiaoxiangmoe
+      Br1ght0ne
    ];
    platforms = [ "aarch64-darwin" ];
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
@@ -12,13 +12,13 @@

 buildGoModule (finalAttrs: {
  pname = "copacetic";
-  version = "0.14.1";
+  version = "0.14.2";

  src = fetchFromGitHub {
    owner = "project-copacetic";
    repo = "copacetic";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pD6AdJ9GfTPVgI/e4zRW4oJjOzpEk9uY4kdEm5yLDrw=";
+    hash = "sha256-MH3HSbJ+/5vjUrjFZQVf4Qv2+qAezOShxfkAoCJMnFU=";
  };

  vendorHash = "sha256-RKqaIwGDZj91lfbEJHcnG8RhIrixtR0VtieCfZD/rns=";
@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ctx7";
-  version = "0.5.3";
+  version = "0.5.4";

  __structuredAttrs = true;
  strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "upstash";
    repo = "context7";
    tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-J3FS0HPpkuriuxEyY1dluwdMovdvgWUTFgBxVUlf+GA=";
+    hash = "sha256-yyz4UraRm1JR/C7J2ib0nBU6zsNpKCWIWduTu7OlebM=";
  };

  nativeBuildInputs = [
@@ -16,7 +16,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "cyberstrike";
-  version = "1.1.14";
+  version = "1.1.15";

  __structuredAttrs = true;
  strictDeps = true;
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "CyberStrikeus";
    repo = "CyberStrike";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MlFEGP/MiuDtLl7Ms6j11u1MdLV6w8T/7TYo7eeE/rc=";
+    hash = "sha256-U1yYTFZCjF3z+161CL4xyxYwcWJh5zCbGAOm/ctACSs=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@@ -75,7 +75,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    # Required so fixed-output derivation does not retain store references
    dontFixup = true;

-    outputHash = "sha256-IxIdzd9MJJRpc0nB5eEASSW0LIckU+SvcUgkKoL+mog=";
+    outputHash = "sha256-O5p/2+14dFt/gbONLVSvqPdNmLgQ8L+cUTGp81Rm0js=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
@@ -1,6 +1,7 @@
 {
  alsa-lib,
  autoPatchelfHook,
+  darwin,
  fetchzip,
  gtk2,
  gtk3,
@@ -55,6 +56,9 @@ stdenv.mkDerivation rec {
    unzip
    makeShellWrapper
  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.autoSignDarwinBinariesHook
+  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    autoPatchelfHook
    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  undmg,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "deck-app";
+  version = "1.4.5";
+
+  src = fetchurl {
+    url = "https://github.com/yuzeguitarist/Deck/releases/download/v${finalAttrs.version}/Deck.dmg";
+    hash = "sha256-U5iMoQZGycwiiehxKUB3iohvzAh42gkC1sk3AJ62Ujs=";
+  };
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+
+    runHook postInstall
+  '';
+
+  dontBuild = true;
+  dontFixup = true;
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Deck is a modern, native, privacy-first clipboard manager for macOS.";
+    homepage = "https://deckclip.app/";
+    changelog = "https://github.com/yuzeguitarist/Deck/releases/tag/v${finalAttrs.version}";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = lib.platforms.darwin;
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ myzel394 ];
+    # Deck provides a CLI tool that can be enabled in the app settings.
+    mainProgram = "deckclip";
+  };
+})
@@ -2,7 +2,7 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
-  nodejs_20,
+  fetchpatch2,
  jre_headless,
  protobuf_30,
  xmlstarlet,
@@ -13,20 +13,17 @@
  nixosTests,
 }:
 let
-  version = "4.14.1";
+  version = "4.14.2";

  frontend = buildNpmPackage {
    pname = "dependency-track-frontend";
    inherit version;

-    # TODO: pinned due to build error on node 22
-    nodejs = nodejs_20;
-
    src = fetchFromGitHub {
      owner = "DependencyTrack";
      repo = "frontend";
-      rev = version;
-      hash = "sha256-xjIRkffmXYMAfZ8wJehnPRfTThJjTgNL8ONl9N9ZJ+M=";
+      tag = version;
+      hash = "sha256-/MH1YjEJdRjYjenkzOcp7oytudsJcinPbc9OAGFnI/Q=";
    };

    installPhase = ''
@@ -34,7 +31,14 @@ let
      cp -R ./dist $out/
    '';

-    npmDepsHash = "sha256-CW9LOur8N3obrOeHgYFH2OO/vg8XihUspuXS5Zrix8I=";
+    patches = [
+      (fetchpatch2 {
+        url = "https://github.com/DependencyTrack/frontend/pull/1575.patch?full_index=1";
+        hash = "sha256-Wo+6yXa/8jB/pph0DTNsFz6lK3sedvro+7yvLSKes9c=";
+      })
+    ];
+
+    npmDepsHash = "sha256-md+PGEC1/Kl2MQhhYldSErcsDSefbPvwVDsw0Yklq1E=";
    forceGitDeps = true;
    makeCacheWritable = true;

@@ -50,8 +54,8 @@ maven.buildMavenPackage rec {
  src = fetchFromGitHub {
    owner = "DependencyTrack";
    repo = "dependency-track";
-    rev = version;
-    hash = "sha256-pIZM8FQ0IFqRbTQT5VIlCmS+fCCXULJJ6bdEv6xfjbc=";
+    tag = version;
+    hash = "sha256-9EPjIm2VOmt1FEiPoJtwNHoKZcewO0kJgBSc9fnUXeI=";
  };

  postPatch = ''
@@ -84,7 +88,7 @@ maven.buildMavenPackage rec {
  '';

  mvnJdk = jre_headless;
-  mvnHash = "sha256-eZuwBt+emThf4mxVaphFgBWNqP64Cs9WIKW+GPvHll4=";
+  mvnHash = "sha256-pshUDIPPGGGzxg5WJXC3mjnqGXn8HVowFCb2l5f6zjA=";
  manualMvnArtifacts = [
    "com.coderplus.maven.plugins:copy-rename-maven-plugin:1.0.1"
    # added to saticfy protobuf compiler plugin dependency resolving
@@ -92,7 +96,7 @@ maven.buildMavenPackage rec {
    "com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:2.19.1"
    "com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.21.0"
    "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.3"
-    "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.0"
+    "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.2"
    "io.micrometer:micrometer-core:1.16.0"
    "io.micrometer:micrometer-observation:1.16.0"
  ];
@@ -10,7 +10,7 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "dopamine";
-  version = "3.0.6";
+  version = "3.0.7";

  # needed to upgrade better-sqlite3 in npmConfigHook
  src = applyPatches {
@@ -18,7 +18,7 @@ buildNpmPackage (finalAttrs: {
      owner = "digimezzo";
      repo = "dopamine";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-HTPWejm5Wi6yGJyS/f1RhjIluTz01ue8lAsnAcQY3IY=";
+      hash = "sha256-zYuf5BIQaxTqHBXWX1PLghGR5WmwtnSxTYrNosVFebc=";
    };
    patches = [
      # register-scheme contains install scripts, but has no lockfile
@@ -32,7 +32,7 @@ buildNpmPackage (finalAttrs: {
    ];
  };

-  npmDepsHash = "sha256-9dQUqoLfzYXOgmE9j2lkew9b/1m4XOghT7roD82y+qg=";
+  npmDepsHash = "sha256-m5y8TmOUAUf2IE87b73hFe2vj/uRAqFGgfuy3vkUX/s=";

  nativeBuildInputs = [
    (python3.withPackages (ps: with ps; [ distutils ]))
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "envfs";
-  version = "1.1.0";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "Mic92";
    repo = "envfs";
    rev = finalAttrs.version;
-    hash = "sha256-bpATdm/lB+zomPYGCxA7omWK/SKPIaqr94J+fjMaXfE=";
+    hash = "sha256-hj/6zS9ebF0IDqgc1Dne59nWx80nk6jn2gj8BzQUFIQ=";
  };

-  cargoHash = "sha256-nMUdAFRHJZDwvLASBVykzzkwk3HxslDehqqm1U99qYg=";
+  cargoHash = "sha256-dz3gpE464jnmSDsAsmJHcxUsEKeUURNoUjgGU2214Xg=";

  postInstall = ''
    ln -s envfs $out/bin/mount.envfs
@@ -4,32 +4,35 @@
  python3Packages,
 }:

-python3Packages.buildPythonPackage {
+python3Packages.buildPythonPackage (finalAttrs: {
  pname = "evdevremapkeys";
-  version = "1.0.0";
+  version = "1.0.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "philipl";
    repo = "evdevremapkeys";
-    rev = "9b6f372a9bdf8b27d39f7e655b74f6b9d1a8467f";
-    sha256 = "sha256-FwRbo0RTiiV2AB7z6XOalMnwMbj15jM4Dxs41TsIOQI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Gtml52tHNtg/3Fy+QO9eIh90nim0p0Fs+oEyqJvsZKs=";
  };

  build-system = with python3Packages; [
-    setuptools
+    hatchling
+    hatch-vcs
  ];

+  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
+
  dependencies = with python3Packages; [
    pyyaml
    pyxdg
-    python-daemon
    evdev
    pyudev
  ];

-  # hase no tests
-  doCheck = false;
+  nativeCheckInputs = with python3Packages; [
+    pytestCheckHook
+  ];

  pythonImportsCheck = [ "evdevremapkeys" ];

@@ -41,4 +44,4 @@ python3Packages.buildPythonPackage {
    maintainers = [ lib.maintainers.q3k ];
    platforms = lib.platforms.linux;
  };
-}
+})
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "gcx";
-  version = "0.4.3";
+  version = "0.4.4";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "gcx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nSopsew5QMOs/QyJg7TzALokZagIGCjxMCNsairB5PA=";
+    hash = "sha256-yPxSRg9PLfHwfv4bCTaxgvRD6UHD4A5qh68c2Dxcpn0=";
  };

-  vendorHash = "sha256-JioNpEqGFxD6Gg84ZZ/9OrETxTGn2V+HMlGGiiZfeIo=";
+  vendorHash = "sha256-PevzovryzpNap8dzruYWdk07M5g9jlA8QPQcrXnO7xk=";

  subPackages = [ "cmd/gcx" ];

@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "hmcl";
-  version = "3.15.2";
+  version = "3.15.3";

  src = fetchurl {
    # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
    # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
    url = "https://github.com/HMCL-dev/HMCL/releases/download/v${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-rT+RruLMz/DTlYSOMv4D6ZCOVt36iqyx42v8ea4XSdM=";
+    hash = "sha256-/7RLhSHCnxtKxmusjnrfUEweYXzOoKcQO3G9+loBofk=";
  };

  # - HMCL prompts users to download prebuilt Terracotta binary for
@@ -77,14 +77,14 @@ let
  # The geodata website is not versioned, so we use the internet archive
  geodata =
    let
-      timestamp = "20260408011516";
+      timestamp = "20260710111330";
      date =
        "${lib.substring 0 4 timestamp}-${lib.substring 4 2 timestamp}-${lib.substring 6 2 timestamp}T"
        + "${lib.substring 8 2 timestamp}:${lib.substring 10 2 timestamp}:${lib.substring 12 2 timestamp}Z";
    in
    runCommand "immich-geodata"
      {
-        outputHash = "sha256-WSKaTn54+8ckXPsk3jsOJ4yCsO0jLKf3y+apqwNlHc4=";
+        outputHash = "sha256-Pf5u+bqzF2x1PECxKwZ6dfGiEj1YMlRejTcTI1amMvU=";
        outputHashMode = "recursive";
        nativeBuildInputs = [
          cacert
@@ -10,14 +10,14 @@
  testers,
 }:
 let
-  version = "1.34.0";
+  version = "1.36.0";
  websiteRev = "159c0ac611e85ec85ffe0a8c8bf2c4a0330bdb38";

  src = fetchFromGitHub {
    owner = "inngest";
    repo = "inngest";
    tag = "v${version}";
-    hash = "sha256-DMJEhgKj2glNtJmsLc3oyDZr5H/COFLrcogcgaYiLjU=";
+    hash = "sha256-KyH9Bj3n7RwARDcb3l5nerYGIIk2mgXPZWLhyNMm+f0=";
  };

  website = fetchFromGitHub {
@@ -2,13 +2,12 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  meson,
  ninja,
  pkg-config,
  yaml-cpp,
  systemd,
-  python3Packages,
+  python313Packages,
  asciidoc,
  libxslt,
  docbook_xml_dtd_45,
@@ -39,8 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
    docbook_xsl
    libxml2.bin
    docbook5
-    python3Packages.pytest
-    python3Packages.pytest-timeout
+    python313Packages.pytest
+    python313Packages.pytest-timeout
    systemd
  ]
  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];
@@ -0,0 +1,29 @@
+From 9ce5e368c00ed887f6d2628d4e8eff664bff5522 Mon Sep 17 00:00:00 2001
+From: 4evy <git@evy.pink>
+Date: Sat, 11 Jul 2026 01:12:36 +0300
+Subject: [PATCH 1/4] Allow running from the Nix store
+
+Upstream normally requires the bundle to live in /Applications because its
+Sparkle updater needs a stable, writable installation path. Nix applications
+instead live in the immutable Nix store and are updated by Nix.
+
+Use upstream's existing kAllowOutsideApplicationsFolder escape hatch as the
+registered default. This preserves upstream's check and keeps the downstream
+change to one explicit policy setting.
+---
+ Itsycal/AppDelegate.m | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/Itsycal/AppDelegate.m b/Itsycal/AppDelegate.m
+index 5cc187a..ee256d9 100644
+--- a/Itsycal/AppDelegate.m
+++ b/Itsycal/AppDelegate.m
+@@ -42,6 +42,8 @@
+         kThemePreference:      @0, // System=0, Light=1, Dark=2
+         kHideIcon:             @(NO),
+         kShowLocation:         @(NO),
+        // Nix installs the app in the immutable Nix store, not /Applications.
+        kAllowOutsideApplicationsFolder: @(YES),
+         kEnableTahoeMenuIcons: @(NO),
+         kDoNotDrawOutlineAroundCurrentMonth: @(NO)
+     }];
@@ -0,0 +1,124 @@
+From f1474c9b296a3fbef30ca577dbd9a92224290b97 Mon Sep 17 00:00:00 2001
+From: 4evy <git@evy.pink>
+Date: Sat, 11 Jul 2026 01:12:47 +0300
+Subject: [PATCH 2/4] Remove self-update controls for Nix builds
+
+Sparkle cannot replace an application inside the immutable Nix store. Leaving
+its menu item and preference checkbox backed by a no-op stub is misleading.
+
+Remove the updater object, imports, controls, action, and matching Tahoe menu
+symbol so the Nix build has no Sparkle runtime dependency or non-functional
+update UI.
+---
+ Itsycal/Base.lproj/MainMenu.xib |  1 -
+ Itsycal/PrefsGeneralVC.m        | 11 ++---------
+ Itsycal/ViewController.m        |  9 ---------
+ 3 files changed, 2 insertions(+), 19 deletions(-)
+
+diff --git a/Itsycal/Base.lproj/MainMenu.xib b/Itsycal/Base.lproj/MainMenu.xib
+index aa2067e..1a25048 100644
+--- a/Itsycal/Base.lproj/MainMenu.xib
+++ b/Itsycal/Base.lproj/MainMenu.xib
+@@ -89,6 +89,5 @@
+                 </menuItem>
+             </items>
+         </menu>
+-        <customObject id="9Zs-J5-87v" customClass="SUUpdater"/>
+     </objects>
+ </document>
+diff --git a/Itsycal/PrefsGeneralVC.m b/Itsycal/PrefsGeneralVC.m
+index 7c19942..86f6be0 100644
+--- a/Itsycal/PrefsGeneralVC.m
+++ b/Itsycal/PrefsGeneralVC.m
+@@ -9,7 +9,6 @@
+ #import "MoVFLHelper.h"
+ #import "EventCenter.h"
+ #import "MASShortcut/Shortcut.h"
+-#import "Sparkle/SUUpdater.h"
+ 
+ static NSString * const kSourceCellId = @"SourceCell";
+ static NSString * const kCalendarCellId = @"CalendarCell";
+@@ -33,7 +32,6 @@ static NSString * const kCalendarCellId = @"CalendarCell";
+ {
+     NSTextField *_title;
+     NSButton *_login;
+-    NSButton *_checkUpdates;
+     NSButton *_beepBeep;
+     NSPopUpButton *_firstDayPopup;
+     NSTableView *_calendarsTV;
+@@ -66,7 +64,6 @@ static NSString * const kCalendarCellId = @"CalendarCell";
+     // Checkboxes
+     _login = chkbx(NSLocalizedString(@"Launch at login", @""));
+     _login.action = @selector(launchAtLogin:);
+-    _checkUpdates = chkbx(NSLocalizedString(@"Automatically check for updates", @""));
+     _beepBeep = chkbx(NSLocalizedString(@"Beep beep on the hour", @""));
+ 
+     // First day of week label
+@@ -130,10 +127,9 @@ static NSString * const kCalendarCellId = @"CalendarCell";
+                                      NSLocalizedString(@"31 days", @"")]];
+     [v addSubview:_agendaDaysPopup];
+ 
+-    MoVFLHelper *vfl = [[MoVFLHelper alloc] initWithSuperview:v metrics:@{@"m": @20} views:NSDictionaryOfVariableBindings(_login, _checkUpdates, _beepBeep, firstDayLabel, _firstDayPopup, shortcutLabel, shortcutView, tvContainer, agendaDaysLabel, _agendaDaysPopup)];
+-    [vfl :@"V:|-m-[_login]-[_checkUpdates]-[_beepBeep]-20-[_firstDayPopup]-20-[shortcutLabel]-3-[shortcutView(25)]-20-[tvContainer(170)]-[_agendaDaysPopup]-m-|"];
+    MoVFLHelper *vfl = [[MoVFLHelper alloc] initWithSuperview:v metrics:@{@"m": @20} views:NSDictionaryOfVariableBindings(_login, _beepBeep, firstDayLabel, _firstDayPopup, shortcutLabel, shortcutView, tvContainer, agendaDaysLabel, _agendaDaysPopup)];
+    [vfl :@"V:|-m-[_login]-[_beepBeep]-20-[_firstDayPopup]-20-[shortcutLabel]-3-[shortcutView(25)]-20-[tvContainer(170)]-[_agendaDaysPopup]-m-|"];
+     [vfl :@"H:|-m-[_login]-(>=m)-|"];
+-    [vfl :@"H:|-m-[_checkUpdates]-(>=m)-|"];
+     [vfl :@"H:|-m-[_beepBeep]-(>=m)-|"];
+     [vfl :@"H:|-m-[firstDayLabel]-[_firstDayPopup]-(>=m)-|" :NSLayoutFormatAlignAllFirstBaseline];
+     [vfl :@"H:|-(>=m)-[shortcutLabel]-(>=m)-|"];
+@@ -144,9 +140,6 @@ static NSString * const kCalendarCellId = @"CalendarCell";
+     // Center shortcutLabel
+     [v addConstraint:[NSLayoutConstraint constraintWithItem:shortcutLabel attribute:NSLayoutAttributeCenterX relatedBy:NSLayoutRelationEqual toItem:v attribute:NSLayoutAttributeCenterX multiplier:1 constant:0]];
+ 
+-    // Binding for Sparkle automatic update checks
+-    [_checkUpdates bind:@"value" toObject:[SUUpdater sharedUpdater] withKeyPath:@"automaticallyChecksForUpdates" options:@{NSContinuouslyUpdatesValueBindingOption: @(YES)}];
+-    
+     // Binding for hourly beep
+     [_beepBeep bind:@"value" toObject:[NSUserDefaultsController sharedUserDefaultsController] withKeyPath:[@"values." stringByAppendingString:kBeepBeepOnTheHour] options:@{NSContinuouslyUpdatesValueBindingOption: @(YES)}];
+     
+diff --git a/Itsycal/ViewController.m b/Itsycal/ViewController.m
+index 1d55c4f..0bd303b 100644
+--- a/Itsycal/ViewController.m
+++ b/Itsycal/ViewController.m
+@@ -21,7 +21,6 @@
+ #import "MoButton.h"
+ #import "MoVFLHelper.h"
+ #import "MoUtils.h"
+-#import "Sparkle/SUUpdater.h"
+ 
+ @implementation ViewController
+ {
+@@ -378,7 +377,6 @@
+     NSInteger i = 0;
+ 
+     [optMenu insertItemWithTitle:NSLocalizedString(@"About Itsycal", @"") action:@selector(showAbout:) keyEquivalent:@"" atIndex:i++];
+-    [optMenu insertItemWithTitle:NSLocalizedString(@"Check for Updates…", @"") action:@selector(checkForUpdates:) keyEquivalent:@"" atIndex:i++];
+     [optMenu insertItem:[NSMenuItem separatorItem] atIndex:i++];
+     [optMenu insertItemWithTitle:NSLocalizedString(@"Go to Date…", @"") action:@selector(showDatePickerPopover:) keyEquivalent:@"T" atIndex:i++];
+     [optMenu insertItem:[NSMenuItem separatorItem] atIndex:i++];
+@@ -394,7 +392,6 @@
+         NSInteger index = 0;
+         NSArray *symbolNames = @[
+             @"info.circle",
+-            @"arrow.trianglehead.2.clockwise",
+             @"21.calendar",
+             @"gear",
+             @"calendar.badge.clock",
+@@ -462,11 +459,6 @@
+     [self.prefsWC showWindow:self];
+ }
+ 
+-- (void)checkForUpdates:(id)sender
+-{
+-    [[SUUpdater sharedUpdater] checkForUpdates:self];
+-}
+-
+ - (void)openDateAndTimePrefs:(id)sender
+ {
+     NSURL *url = nil;
+@@ -1514,4 +1506,3 @@
+ }
+ 
+ @end
+-
@@ -0,0 +1,116 @@
+From d3d2dd9ce8b566496503c38158199432a5ae87bb Mon Sep 17 00:00:00 2001
+From: 4evy <git@evy.pink>
+Date: Sat, 11 Jul 2026 01:12:47 +0300
+Subject: [PATCH 3/4] Use modern ServiceManagement login items
+
+LSSharedFileList was deprecated in macOS 10.11 and its status lookup can fail
+when disconnected network volumes are present. Nixpkgs now targets macOS 14,
+so no legacy fallback is needed.
+
+Use SMAppService.mainAppService, available since macOS 13. Treat
+RequiresApproval as registered so users can still turn the pending login item
+off. The package signs the complete app bundle after fixup, as required by
+ServiceManagement.
+---
+ Itsycal/MoLoginItem.m    | 58 +++++++---------------------------------
+ Itsycal/PrefsGeneralVC.m | 12 +--------
+ 2 files changed, 11 insertions(+), 59 deletions(-)
+
+diff --git a/Itsycal/MoLoginItem.m b/Itsycal/MoLoginItem.m
+index 7efa602..0dc4960 100644
+--- a/Itsycal/MoLoginItem.m
+++ b/Itsycal/MoLoginItem.m
+@@ -4,60 +4,22 @@
+ //
+ 
+ #import "MoLoginItem.h"
+-
+-// LSSharedFileList API was deprecated in macOS 10.11
+-#pragma clang diagnostic push
+-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
+#import <ServiceManagement/ServiceManagement.h>
+ 
+ BOOL MOIsLoginItemEnabled(void)
+ {
+-    BOOL isEnabled = NO;
+-    NSString *appPath = [[NSBundle mainBundle] bundlePath];
+-    LSSharedFileListRef loginItemsRef = LSSharedFileListCreate(NULL, kLSSharedFileListSessionLoginItems, NULL);
+-
+-    if (loginItemsRef) {
+-        UInt32 seedValue;
+-        NSArray *loginItems = CFBridgingRelease(LSSharedFileListCopySnapshot(loginItemsRef, &seedValue));
+-        for (id item in loginItems) {
+-            LSSharedFileListItemRef itemRef = (__bridge LSSharedFileListItemRef)item;
+-            NSURL *pathURL = CFBridgingRelease(LSSharedFileListItemCopyResolvedURL(itemRef, 0, NULL));
+-            if (pathURL && [pathURL.path hasPrefix:appPath]) {
+-                isEnabled = YES;
+-                break;
+-            }
+-        }
+-        CFRelease(loginItemsRef);
+-    }
+-    return isEnabled;
+    SMAppServiceStatus status = SMAppService.mainAppService.status;
+    return status == SMAppServiceStatusEnabled || status == SMAppServiceStatusRequiresApproval;
+ }
+ 
+ void MOEnableLoginItem(BOOL enable)
+ {
+-    NSString *appPath = [[NSBundle mainBundle] bundlePath];
+-    LSSharedFileListRef loginItemsRef = LSSharedFileListCreate(NULL, kLSSharedFileListSessionLoginItems, NULL);
+-
+-    if (loginItemsRef) {
+-        if (enable) {
+-            // We call LSSharedFileListInsertItemURL to insert the item at the bottom of Login Items list.
+-            CFURLRef url = (__bridge CFURLRef)[NSURL fileURLWithPath:appPath];
+-            LSSharedFileListItemRef item = LSSharedFileListInsertItemURL(loginItemsRef, kLSSharedFileListItemLast, NULL, NULL, url, NULL, NULL);
+-            if (item != NULL) CFRelease(item);
+-        }
+-        else {
+-            // Grab the contents of the shared file list (LSSharedFileListItemRef objects)
+-            // and pop it in an array so we can iterate through it to find our item.
+-            UInt32 seedValue;
+-            NSArray *loginItems = CFBridgingRelease(LSSharedFileListCopySnapshot(loginItemsRef, &seedValue));
+-            for (id item in loginItems) {
+-                LSSharedFileListItemRef itemRef = (__bridge LSSharedFileListItemRef)item;
+-                NSURL *pathURL = CFBridgingRelease(LSSharedFileListItemCopyResolvedURL(itemRef, 0, NULL));
+-                if (pathURL && [pathURL.path hasPrefix:appPath]) {
+-                    LSSharedFileListItemRemove(loginItemsRef, itemRef); // Deleting the item
+-                }
+-            }
+-        }
+-        CFRelease(loginItemsRef);
+    SMAppService *service = SMAppService.mainAppService;
+    NSError *error = nil;
+    BOOL succeeded = enable
+        ? [service registerAndReturnError:&error]
+        : [service unregisterAndReturnError:&error];
+    if (!succeeded) {
+        NSLog(@"Unable to %@ launch at login: %@", enable ? @"enable" : @"disable", error);
+     }
+ }
+-
+-#pragma clang diagnostic pop
+diff --git a/Itsycal/PrefsGeneralVC.m b/Itsycal/PrefsGeneralVC.m
+index 86f6be0..ecfd30d 100644
+--- a/Itsycal/PrefsGeneralVC.m
+++ b/Itsycal/PrefsGeneralVC.m
+@@ -158,17 +158,7 @@ static NSString * const kCalendarCellId = @"CalendarCell";
+     
+     _sourcesAndCalendars = [self.ec sourcesAndCalendars];
+     
+-    // The API used to check the login item's state (LSSharedFileList) causes
+-    // errors for users who have network drives but are not connected to their
+-    // network (github.com/sfsam/Itsycal/issues/15). Give them an option to
+-    // disable this check.
+-    if ([[NSUserDefaults standardUserDefaults] boolForKey:@"DoNotCheckLoginItemStatus"] == NO) {
+-        _login.hidden = NO;
+-        _login.state = MOIsLoginItemEnabled() ? NSControlStateValueOn : NSControlStateValueOff;
+-    }
+-    else {
+-        _login.hidden = YES;
+-    }
+    _login.state = MOIsLoginItemEnabled() ? NSControlStateValueOn : NSControlStateValueOff;
+     
+     _calendarsTV.enabled = self.ec.calendarAccessGranted;
+     _agendaDaysPopup.enabled = self.ec.calendarAccessGranted;
@@ -0,0 +1,90 @@
+From 6fb6ac13a8deee492449442e1ab3d7429aa9fff8 Mon Sep 17 00:00:00 2001
+From: 4evy <git@evy.pink>
+Date: Sat, 11 Jul 2026 01:12:55 +0300
+Subject: [PATCH 4/4] Use APIs available on the Nixpkgs macOS baseline
+
+The package metadata and Mach-O deployment target are both macOS 14. Remove
+compatibility branches for older systems and use the corresponding current
+APIs:
+
+* request EventKit full access directly;
+* discover the calendar handler through NSWorkspace and
+  UniformTypeIdentifiers;
+* use the renamed CoreAudio main-element constant.
+---
+ Itsycal/EventCenter.m    | 20 ++------------------
+ Itsycal/ViewController.m |  9 ++++-----
+ 2 files changed, 6 insertions(+), 23 deletions(-)
+
+diff --git a/Itsycal/EventCenter.m b/Itsycal/EventCenter.m
+index 148c631..3862630 100644
+--- a/Itsycal/EventCenter.m
+++ b/Itsycal/EventCenter.m
+@@ -59,15 +59,7 @@ static NSString *kSelectedCalendars = @"SelectedCalendars";
+         _queueIsol = dispatch_queue_create("com.mowglii.Itsycal.queueIsol", DISPATCH_QUEUE_SERIAL);
+         _queueIsol2 = dispatch_queue_create("com.mowglii.Itsycal.queueIsol2", DISPATCH_QUEUE_SERIAL);
+         _store = [EKEventStore new];
+-#if MAC_OS_X_VERSION_MAX_ALLOWED >= 140000
+-        if (@available(macOS 14.0, *)) {
+-            [_store requestFullAccessToEventsWithCompletion:requestCompletionHandler];
+-        } else {
+-            [_store requestAccessToEntityType:EKEntityTypeEvent completion:requestCompletionHandler];
+-        }
+-#else
+-        [_store requestAccessToEntityType:EKEntityTypeEvent completion:requestCompletionHandler];
+-#endif
+        [_store requestFullAccessToEventsWithCompletion:requestCompletionHandler];
+ 
+         // Refetch everything when the event store has changed.
+         __weak __typeof(self) weakSelf = self;
+@@ -85,15 +77,7 @@ static NSString *kSelectedCalendars = @"SelectedCalendars";
+ #pragma mark - Public (main thread)
+ 
+ - (BOOL)calendarAccessGranted {
+-#if MAC_OS_X_VERSION_MAX_ALLOWED >= 140000
+-    if (@available(macOS 14.0, *)) {
+-        return [EKEventStore authorizationStatusForEntityType:EKEntityTypeEvent] == EKAuthorizationStatusFullAccess;
+-    } else {
+-        return [EKEventStore authorizationStatusForEntityType:EKEntityTypeEvent] == EKAuthorizationStatusAuthorized;
+-    }
+-#else
+-    return [EKEventStore authorizationStatusForEntityType:EKEntityTypeEvent] == EKAuthorizationStatusAuthorized;
+-#endif
+    return [EKEventStore authorizationStatusForEntityType:EKEntityTypeEvent] == EKAuthorizationStatusFullAccess;
+ }
+ 
+ - (NSString *)defaultCalendarIdentifier {
+diff --git a/Itsycal/ViewController.m b/Itsycal/ViewController.m
+index 0bd303b..a887682 100644
+--- a/Itsycal/ViewController.m
+++ b/Itsycal/ViewController.m
+@@ -21,6 +21,7 @@
+ #import "MoButton.h"
+ #import "MoVFLHelper.h"
+ #import "MoUtils.h"
+#import <UniformTypeIdentifiers/UniformTypeIdentifiers.h>
+ 
+ @implementation ViewController
+ {
+@@ -319,10 +320,8 @@
+     // Determine the default calendar app.
+     // See: support.busymac.com/help/21535-busycal-url-handler
+     
+-    CFStringRef strRef = UTTypeCreatePreferredIdentifierForTag(kUTTagClassFilenameExtension, CFSTR("ics"), kUTTypeData);
+-    CFStringRef bundleID = LSCopyDefaultRoleHandlerForContentType(strRef, kLSRolesEditor);
+-    CFRelease(strRef);
+-    NSString *defaultCalendarAppBundleID = CFBridgingRelease(bundleID);
+    NSURL *defaultCalendarAppURL = [NSWorkspace.sharedWorkspace URLForApplicationToOpenContentType:UTTypeCalendarEvent];
+    NSString *defaultCalendarAppBundleID = [NSBundle bundleWithURL:defaultCalendarAppURL].bundleIdentifier;
+     
+     // Use URL scheme to open BusyCal or Fantastical2 on the
+     // date selected in our calendar.
+@@ -1263,7 +1262,7 @@
+     AudioObjectPropertyAddress propertyAddress;
+     propertyAddress.mSelector = kAudioHardwarePropertyDefaultOutputDevice;
+     propertyAddress.mScope    = kAudioObjectPropertyScopeGlobal;
+-    propertyAddress.mElement  = kAudioObjectPropertyElementMaster;
+    propertyAddress.mElement  = kAudioObjectPropertyElementMain;
+ 
+     OSStatus result = AudioObjectGetPropertyData(kAudioObjectSystemObject, &propertyAddress, 0, NULL, &dataSize, &deviceID);
+ 
@@ -1,42 +1,240 @@
 {
  lib,
-  fetchzip,
-  stdenvNoCC,
+  stdenv,
+  fetchFromGitHub,
+  actool,
+  ibtool,
+  lld,
+  makeWrapper,
+  rcodesign,
+  re-plistbuddy,
+  nix-update-script,
 }:

-stdenvNoCC.mkDerivation (finalAttrs: {
+let
+  # Upstream ships MASShortcut only as a prebuilt framework. Build the
+  # maintained Rectangle fork instead; it adds F20 and macOS Tahoe fixes while
+  # retaining the API and bundle identity used by Itsycal.
+  masShortcutSrc = fetchFromGitHub {
+    owner = "rxhanson";
+    repo = "MASShortcut";
+    rev = "2f9fbb3f959b7a683c6faaf9638d22afad37a235";
+    hash = "sha256-EZLt7ph24L1wwFEMlltuPutId09RBug/y9OtDhixIig=";
+  };
+
+  masShortcutSources = [
+    "Model/MASShortcut.m"
+    "Model/MASShortcutValidator.m"
+    "Monitoring/MASHotKey.m"
+    "Monitoring/MASShortcutMonitor.m"
+    "UI/MASLocalization.m"
+    "UI/MASShortcutView.m"
+    "UI/MASShortcutView+Bindings.m"
+    "UI/MASShortcutViewButtonCell.m"
+    "User Defaults Storage/MASDictionaryTransformer.m"
+    "User Defaults Storage/MASShortcutBinder.m"
+  ];
+
+  masShortcutInfoPlist = lib.generators.toPlist { escape = true; } {
+    CFBundleDevelopmentRegion = "English";
+    CFBundleExecutable = "MASShortcut";
+    CFBundleIdentifier = "com.github.shpakovski.MASShortcut";
+    CFBundleInfoDictionaryVersion = "6.0";
+    CFBundleName = "MASShortcut";
+    CFBundlePackageType = "FMWK";
+    CFBundleShortVersionString = "2.4.0";
+    CFBundleVersion = "2.4.0";
+    NSHumanReadableCopyright = "Copyright © Vadim Shpakovski. All rights reserved.";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
  pname = "itsycal";
  version = "0.15.12";

-  src = fetchzip {
-    url = "https://itsycal.s3.amazonaws.com/Itsycal-${finalAttrs.version}.zip";
-    hash = "sha256-2Xu1ZQnNl0o2/AYOIjxZPDnc0TxMXrqKej7CCZEVV9I=";
-    stripRoot = false;
+  src = fetchFromGitHub {
+    owner = "sfsam";
+    repo = "Itsycal";
+    tag = finalAttrs.version;
+    hash = "sha256-K25oG8d+OauNHLkatLLskfcWCqOmM2WEw2Ygd3v1uqE=";
  };

+  patches = [
+    # Use upstream's hidden escape hatch for installations outside /Applications.
+    ./0001-Allow-running-from-the-Nix-store.patch
+    # Nix owns updates, so remove the otherwise non-functional Sparkle UI.
+    ./0002-Remove-self-update-controls-for-Nix-builds.patch
+    # Replace the deprecated LSSharedFileList implementation with SMAppService.
+    ./0003-Use-modern-ServiceManagement-login-items.patch
+    # The Nixpkgs Darwin baseline is macOS 14; use its non-deprecated APIs.
+    ./0004-Use-APIs-available-on-the-Nixpkgs-macOS-baseline.patch
+  ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    actool
+    ibtool
+    lld
+    makeWrapper
+    rcodesign
+    re-plistbuddy
+  ];
+
+  # The classic open-source ld64 crashes while linking MASShortcut on arm64.
+  # Keep lld until the cctools linker can link this framework reliably.
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
+  dontConfigure = true;
+
+  postPatch = ''
+    # Both upstream frameworks contain native code. MASShortcut is rebuilt
+    # below and Sparkle is removed by patch 0002, so make accidental reuse fail.
+    rm -rf Itsycal/_frameworks
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    buildDir="$PWD/build"
+    mkdir -p "$buildDir/module-cache"
+
+    # actool accepts one catalog, while upstream keeps images and colors in
+    # separate catalogs. Merge them without changing their contents.
+    cp -R Itsycal/Images.xcassets "$buildDir/Assets.xcassets"
+    cp -R Itsycal/Colors.xcassets/*.colorset "$buildDir/Assets.xcassets/"
+
+    # Compile .m -> .o; flags before --, sources after. Sets _objects array
+    compile_objc() {
+      local prefix="$1"; shift
+      local -a flags=()
+      while [[ "$1" != "--" ]]; do flags+=("$1"); shift; done; shift
+      _objects=()
+      for src in "$@"; do
+        local obj="$buildDir/''${prefix}_$(basename "$src" .m).o"
+        clang -fobjc-arc "''${flags[@]}" -c "$src" -o "$obj"
+        _objects+=("$obj")
+      done
+    }
+
+    link_dylib() {
+      local name="$1"; shift
+      clang -dynamiclib -fobjc-arc \
+        -install_name "@rpath/$name.framework/$name" "$@"
+    }
+
+    # Build MASShortcut as a real framework. The explicit source list avoids
+    # pulling its demo or test targets into the application.
+    masHeaders="$buildDir/MAS_headers/MASShortcut"
+    mkdir -p "$masHeaders"
+    cp ${masShortcutSrc}/Framework/include/*.h "$masHeaders/"
+
+    masSources=( ${
+      lib.escapeShellArgs (map (src: "${masShortcutSrc}/Framework/${src}") masShortcutSources)
+    } )
+    compile_objc mas -fmodules -fmodules-cache-path="$buildDir/module-cache" \
+      -I"$masHeaders" -include AppKit/AppKit.h -- "''${masSources[@]}"
+    link_dylib MASShortcut -framework AppKit -framework Carbon \
+      -compatibility_version 1 -current_version 2.4.0 \
+      -o "$buildDir/MASShortcut.dylib" "''${_objects[@]}"
+
+    # Itsycal
+    compile_objc app -fmodules -fmodules-cache-path="$buildDir/module-cache" \
+      -I"$buildDir/MAS_headers" -IItsycal -- Itsycal/*.m
+    clang -fobjc-arc \
+      -framework AppKit -framework EventKit -framework ScriptingBridge \
+      -framework Carbon -framework ServiceManagement -framework UniformTypeIdentifiers \
+      -Wl,-rpath,@executable_path/../Frameworks \
+      "$buildDir/MASShortcut.dylib" \
+      -o "$buildDir/Itsycal" "''${_objects[@]}"
+
+    runHook postBuild
+  '';
+
  installPhase = ''
    runHook preInstall

-    mkdir -p "$out/Applications"
-    cp -R Itsycal.app "$out/Applications/"
+    appDir="$out/Applications/Itsycal.app/Contents"
+    mkdir -p "$appDir"/{MacOS,Frameworks,Resources}
+
+    cp "$buildDir/Itsycal" "$appDir/MacOS/Itsycal"
+
+    # Assemble the framework bundle metadata normally generated by Xcode.
+    mkdir -p "$appDir/Frameworks/MASShortcut.framework/Resources"
+    cp "$buildDir/MASShortcut.dylib" "$appDir/Frameworks/MASShortcut.framework/MASShortcut"
+    cp -r ${masShortcutSrc}/Framework/Resources/*.lproj "$appDir/Frameworks/MASShortcut.framework/Resources/"
+    printf '%s' ${lib.escapeShellArg masShortcutInfoPlist} \
+      > "$appDir/Frameworks/MASShortcut.framework/Resources/Info.plist"
+
+    # Resources
+    ibtool --compile "$appDir/Resources/MainMenu.nib" Itsycal/Base.lproj/MainMenu.xib
+    actool --compile "$appDir/Resources" \
+      --platform macosx \
+      --minimum-deployment-target ${stdenv.hostPlatform.darwinMinVersion} \
+      --app-icon AppIcon \
+      --output-partial-info-plist "$buildDir/asset-info.plist" \
+      "$buildDir/Assets.xcassets"
+    cp Itsycal/beep.mp3 "$appDir/Resources/"
+    mkdir -p "$appDir/Resources/Fonts"
+    cp Itsycal/_fonts/Mow.otf "$appDir/Resources/Fonts/"
+    for lproj in Itsycal/*.lproj; do
+      mkdir -p "$appDir/Resources/$(basename "$lproj")"
+      cp "$lproj"/*.strings "$appDir/Resources/$(basename "$lproj")/" 2>/dev/null || true
+    done
+
+    # Resolve the Xcode variables in upstream's plist. Keeping that plist as
+    # the source of truth means new privacy and bundle metadata is preserved.
+    bundleVersion=$(sed -n 's/.*CURRENT_PROJECT_VERSION = \([0-9]*\);/\1/p' \
+      Itsycal.xcodeproj/project.pbxproj | head -1)
+    cp Itsycal/Info.plist "$appDir/Info.plist"
+    substituteInPlace "$appDir/Info.plist" \
+      --replace-fail '$(EXECUTABLE_NAME)' 'Itsycal' \
+      --replace-fail '$(PRODUCT_BUNDLE_IDENTIFIER)' 'com.mowglii.ItsycalApp' \
+      --replace-fail '$(PRODUCT_NAME)' 'Itsycal' \
+      --replace-fail '$(MARKETING_VERSION)' '${finalAttrs.version}' \
+      --replace-fail '$(CURRENT_PROJECT_VERSION)' "$bundleVersion" \
+      --replace-fail '$(MACOSX_DEPLOYMENT_TARGET)' '${stdenv.hostPlatform.darwinMinVersion}'
+
+    # Merge actool's icon metadata and remove the Sparkle configuration that
+    # no longer has a consumer in this immutable Nix build.
+    PlistBuddy -c 'Set :CFBundleIconFile AppIcon' \
+      -c 'Add :CFBundleIconName string AppIcon' \
+      -c 'Delete :SUAllowsAutomaticUpdates' \
+      -c 'Delete :SUEnableAutomaticChecks' \
+      -c 'Delete :SUFeedURL' \
+      -c 'Delete :SUPublicEDKey' \
+      -c 'Delete :SUScheduledCheckInterval' \
+      "$appDir/Info.plist"
+
+    makeWrapper "$out/Applications/Itsycal.app/Contents/MacOS/Itsycal" "$out/bin/itsycal"

    runHook postInstall
  '';

-  passthru = {
-    updateScript = ./update.sh;
+  # Signing only Mach-O files leaves app resources unsealed. Sign the complete
+  # bundle after fixup so ServiceManagement accepts it and nested code verifies.
+  postFixup = ''
+    rcodesign sign "$out/Applications/Itsycal.app"
+  '';
+
+  passthru.updateScript = nix-update-script {
+    # Ignore upstream's non-version "help" tag.
+    extraArgs = [ "--version-regex=^([0-9]+\\.[0-9]+\\.[0-9]+)$" ];
  };

  meta = {
    changelog = "https://www.mowglii.com/itsycal/versionhistory.html";
    description = "Tiny menu bar calendar";
    homepage = "https://www.mowglii.com/itsycal/";
-    license = lib.licenses.mit;
+    license = with lib.licenses; [
+      bsd2
+      mit
+    ];
+    mainProgram = "itsycal";
    maintainers = with lib.maintainers; [
      eclairevoyant
      _4evy
    ];
    platforms = lib.platforms.darwin;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
  };
 })
@@ -1,20 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl xq-xml common-updater-scripts
-
-set -eu
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/package.nix"
-if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find package.nix in $ROOT"
-  exit 1
-fi
-
-LATEST_VERSION="$(curl -Ls https://www.mowglii.com/itsycal/versionhistory.html | xq -m -q 'h4' -a 'id' | head -n1)"
-
-if [ -z "$LATEST_VERSION" ]; then
-    echo "ERROR: Failed to scrape the latest version."
-    exit 1
-fi
-
-update-source-version itsycal "$LATEST_VERSION" --file="$NIX_DRV"
@@ -18,11 +18,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "jenkins";
-  version = "2.555.3";
+  version = "2.568.1";

  src = fetchurl {
    url = "https://get.jenkins.io/war-stable/${finalAttrs.version}/jenkins.war";
-    hash = "sha256-XRmQXmwPI6/4n/AH3lVkuW4KBcE/TRqS0P3LabAzu5o=";
+    hash = "sha256-WPJPOWX773cIYp++FY1RvxOP/Vd8rbyGtGNn6K0L64M=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  _7zz,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "kitty-bin";
+  version = "0.47.4";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchurl {
+    url = "https://github.com/kovidgoyal/kitty/releases/download/v${finalAttrs.version}/kitty-${finalAttrs.version}.dmg";
+    hash = "sha256-tTubGKJ9U61Eol3Wd2/ejEdIe04QOsUNaCrx7o57d+0=";
+  };
+
+  # undmg can't read the APFS dmg; -snld keeps the .app's symlinks intact.
+  nativeBuildInputs = [ _7zz ];
+  sourceRoot = ".";
+  unpackCmd = "7zz x -snld $curSrc";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications" "$out/bin"
+    cp -R kitty.app "$out/Applications/kitty.app"
+    ln -s "$out/Applications/kitty.app/Contents/MacOS/kitty" "$out/bin/kitty"
+    ln -s "$out/Applications/kitty.app/Contents/MacOS/kitten" "$out/bin/kitten"
+
+    runHook postInstall
+  '';
+
+  # leave the signed bundle untouched so its signature stays valid.
+  dontFixup = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/kovidgoyal/kitty";
+    description = "Fast, feature-rich, GPU based terminal emulator (prebuilt signed macOS app)";
+    changelog = "https://github.com/kovidgoyal/kitty/blob/v${finalAttrs.version}/docs/changelog.rst";
+    license = lib.licenses.gpl3Only;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = lib.platforms.darwin;
+    mainProgram = "kitty";
+    maintainers = with lib.maintainers; [ carlossless ];
+  };
+})
@@ -38,7 +38,6 @@
  vulkanSupport ? false,
  rpcSupport ? false,
  openssl,
-  llama-cpp,
  shaderc,
  vulkan-headers,
  vulkan-loader,
@@ -190,9 +189,6 @@ effectiveStdenv.mkDerivation (finalAttrs: {
  # upstream plans on adding targets at the cmakelevel, remove those
  # additional steps after that
  postInstall = ''
-    # Match previous binary name for this package
-    ln -sf $out/bin/llama-cli $out/bin/llama
-
    mkdir -p $out/include
    cp $src/include/llama.h $out/include/

@@ -88,16 +88,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-tuwunel";
-  version = "1.8.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "matrix-construct";
    repo = "tuwunel";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+VoJrUvjZOS3y59HbjHX0kwCT1AUvJo1jJQEC/OLYec=";
+    hash = "sha256-3qMVu+IQMzI4Jtfb8mJsuDAcd7Jb7XSU07RlvnH7vfc=";
  };

-  cargoHash = "sha256-906VroeI1ZjUokOWKNBcfgZLZhca87p7sQuYDwQmPDI=";
+  cargoHash = "sha256-VzmaQAsNORH8VxYSUgKeQSIgcCPnI9cAzu3K9ks7ODA=";

  nativeBuildInputs = [
    pkg-config
@@ -7,7 +7,7 @@
  nix-update-script,
 }:
 let
-  version = "11.12.0";
+  version = "11.16.0";
 in
 buildNpmPackage {
  pname = "mermaid-cli";
@@ -17,14 +17,14 @@ buildNpmPackage {
    owner = "mermaid-js";
    repo = "mermaid-cli";
    rev = version;
-    hash = "sha256-OpYq0nOYCGTorzDxybsEjJmhL646wMBbQw3eHVxTuqU=";
+    hash = "sha256-jK87Ffsv9qeh0UPJaLTuIJYbnR9HVqjm7hWrwUaP5zA=";
  };

  patches = [
    ./remove-puppeteer-from-dev-deps.patch # https://github.com/mermaid-js/mermaid-cli/issues/830
  ];

-  npmDepsHash = "sha256-Ex+tEm13feR/Vru0CHlvM3xS5wgGlYyqANeIquvRHwM=";
+  npmDepsHash = "sha256-sOEDz8ZT2zF+TH+ZJhb+LSyyUF1HWVVLzCqtYtg7A0E=";

  env = {
    PUPPETEER_SKIP_DOWNLOAD = true;
@@ -1,16 +1,11 @@
-Subject: [PATCH] remove pupperteer from dev dependencies
+Subject: [PATCH] remove puppeteer from dev dependencies
 ---
 Index: package.json
-<+>UTF-8
 ===================================================================
 diff --git a/package.json b/package.json
--- a/package.json	(revision fa593dc39619f44b57a922927a66346248f31d7d)
-+++ b/package.json	(date 1736721981718)
-@@ -45,7 +45,6 @@
-     "@tsconfig/node18": "^18.2.4",
-     "@types/node": "~18.19.31",
-     "jest": "^30.0.5",
-    "puppeteer": "^23.1.1",
-     "standard": "^17.0.0",
-     "typescript": "^5.0.1-rc",
-     "vite": "^6.0.2",
+--- a/package.json
+++ b/package.json
+@@ -47,3 +47,2 @@
+     "prettier": "^3.8.3",
+-    "puppeteer": "^25.0.0",
+     "typescript": "^6.0.3",
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mympd";
-  version = "25.2.2";
+  version = "25.3.0";

  src = fetchFromGitHub {
    owner = "jcorporation";
    repo = "myMPD";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-WJU0bnjC78GlrTXBixz9/pLLxvJGTvwJfIcGuF329io=";
+    sha256 = "sha256-Mx+UURIJUpIZlLq0FFuvOoUzMHhHryfNxRpNWgrpHTM=";
  };

  nativeBuildInputs = [
@@ -1,12 +1,12 @@
 {
  "x86_64-darwin": {
-    "version": "7.24.0",
-    "url": "https://desktop-release.notion-static.com/Notion-7.24.0.zip",
-    "hash": "sha512-3X7E6ZSEJMrArof7p/OgqUk4i3cewF0zMTPVhkhSgNVzOqHt9kvthGIpKUN6M/u0xdYAkRQgSWHkJ/RoA5Q6Hw=="
+    "version": "7.25.1",
+    "url": "https://desktop-release.notion-static.com/Notion-7.25.1.zip",
+    "hash": "sha512-HBhe2onWY44JbMVIfiLglyNDk1tqepwCerqbgUuI56mstBlg+B0KuepTl+plJODoTVtRasmrg/WRBw+ESWpEeg=="
  },
  "aarch64-darwin": {
-    "version": "7.24.0",
-    "url": "https://desktop-release.notion-static.com/Notion-arm64-7.24.0.zip",
-    "hash": "sha512-tQVL3z0SOMOeGaqYr4Gq1tULj/kKy4qmmsJN3uwCwDXkmenzLGCWiEmWmkK52T2xW8mMrbSBAAZGNDi0qQw5yA=="
+    "version": "7.25.1",
+    "url": "https://desktop-release.notion-static.com/Notion-arm64-7.25.1.zip",
+    "hash": "sha512-1t+hNS33R3CX+inR8ArKvm4LDn0Wu7JiCU91ucnaAgQm85XUcWFdxk/f421M9XqG1Wte+webFX45LXDlixKa2A=="
  }
 }
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  makeWrapper,
+  unzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "orion-browser";
+  version = "149";
+
+  src = fetchurl {
+    url = "https://cdn.kagi.com/updates/26_0/${finalAttrs.version}.zip";
+    hash = "sha256-C0mtGNE9Or0alFe2Gu4LkRcHMvk1RLXZ/mUo/XtWB2g=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  unpackCmd = "unzip -q $curSrc -x '__MACOSX/*'";
+
+  nativeBuildInputs = [
+    makeWrapper
+    unzip
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications" "$out/bin"
+    cp -R Orion.app "$out/Applications"
+    makeWrapper "$out/Applications/Orion.app/Contents/MacOS/Orion" "$out/bin/orion"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "WebKit-based web browser by Kagi";
+    homepage = "https://orionbrowser.com/";
+    changelog = "https://orionbrowser.com/updates/orion-release-notes";
+    license = lib.licenses.unfree;
+    mainProgram = "orion";
+    maintainers = with lib.maintainers; [ pradyuman ];
+    platforms = [ "aarch64-darwin" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
@@ -0,0 +1,28 @@
+#!/usr/bin/env nix
+#!nix shell -f ``<nixpkgs>`` curl jq libplist _7zz common-updater-scripts -c bash
+
+set -euo pipefail
+
+macos_version="26_0"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+dmg="$tmpdir/Orion.dmg"
+curl -fsSL -o "$dmg" "https://cdn.kagi.com/downloads/$macos_version/Orion.dmg"
+version="$(
+  7zz e -so "$dmg" "Orion/Orion.app/Contents/Info.plist" \
+    | plistutil -i - -f json -o - \
+    | jq -r '.CFBundleVersion'
+)"
+
+if [[ -z "$version" ]]; then
+  echo "[update] Failed to read Orion version from Info.plist" >&2
+  exit 1
+fi
+
+zip="$tmpdir/Orion.zip"
+curl -fsSL -o "$zip" "https://cdn.kagi.com/updates/$macos_version/$version.zip"
+hash="$(nix hash file --type sha256 --sri "$zip")"
+
+update-source-version orion-browser "$version" "$hash"
@@ -10,7 +10,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "passless";
-  version = "0.12.0";
+  version = "0.13.0";

  __structuredAttrs = true;

@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "pando85";
    repo = "passless";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tPlCiXokONUswwEDB2e23gR/NU6G+VYHgqfE+RyRsxw=";
+    hash = "sha256-ZfIScs+ougawn/tXK8PBme13CEdvxeL8/D38b3F/bcg=";
  };

-  cargoHash = "sha256-cNVmzK/W1jER6eK33JgFVnAN/6vGY4gw3GHB/H5DbIQ=";
+  cargoHash = "sha256-RpfegA8nH8chbHXHbuWMRH9drSrnBRQwYJtnw2Sqymw=";

  nativeBuildInputs = [
    pkg-config
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "periphery";
+  version = "3.7.4";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchzip {
+    url = "https://github.com/peripheryapp/periphery/releases/download/${finalAttrs.version}/periphery-${finalAttrs.version}.zip";
+    hash = "sha256-p40+MvqHczG3iuWU+l0uOS96Zkxv/p88CBhs90b3168=";
+    stripRoot = false;
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 periphery $out/bin/periphery
+    install -Dm755 libIndexStore.dylib $out/bin/libIndexStore.dylib
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Unused code detector for Swift projects";
+    homepage = "https://github.com/peripheryapp/periphery";
+    changelog = "https://github.com/peripheryapp/periphery/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    mainProgram = "periphery";
+    maintainers = with lib.maintainers; [ jeremystucki ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+})
@@ -5,6 +5,8 @@
  darwin,
  actool,
  ibtool,
+  # TODO: Clean up on `staging`
+  llvmPackages,
  makeWrapper,
  nix-update-script,
 }:
@@ -149,6 +151,8 @@ stdenv.mkDerivation (finalAttrs: {
    ibtool
    darwin.autoSignDarwinBinariesHook
    makeWrapper
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
  ];

  dontConfigure = true;
@@ -161,6 +165,8 @@ stdenv.mkDerivation (finalAttrs: {
    commonSwiftFlags=(
      -O -disable-bridging-pch
      -Xlinker -platform_version -Xlinker macos -Xlinker 14.0 -Xlinker 26.0
+      # TODO: Clean up on `staging`
+      -use-ld=lld
    )

    nixLog "building Sparkle stub framework"
@@ -196,6 +202,8 @@ stdenv.mkDerivation (finalAttrs: {
    clang -dynamiclib "''${masObjFiles[@]}" \
      -framework AppKit -framework Carbon -framework Foundation \
      -install_name "@rpath/MASShortcut.framework/MASShortcut" \
+      # TODO: Clean up on `staging`
+      -fuse-ld=lld \
      -o "$buildDir/libMASShortcut.dylib"

    rectSwiftFiles=()
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "search-vulns";
-  version = "1.1.0";
+  version = "1.2.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ra1nb0rn";
    repo = "search_vulns";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-b5WFIDxjqe4iEueOm8DyC6Z1KwChSQalppqY2CB4UW8=";
+    hash = "sha256-w4kK0/bAbWPHK6Nllhb8vCReJwiBUL6EpX/Cnt3aplg=";
    fetchSubmodules = true;
  };

@@ -14,13 +14,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "shoko-webui";
-  version = "2.4.1";
+  version = "2.5.9";

  src = fetchFromGitHub {
    owner = "ShokoAnime";
    repo = "Shoko-WebUI";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/frP6qI5xAmogb5a5AA83IJxgOhVUi6X0E4h3Qg5u6w=";
+    hash = "sha256-mHBflHehCnwCkh4K271vo30rfoQa+3xLos0d7P/kKvE=";
  };

  # Avoid requiring git as a build time dependency. It's used for version
@@ -32,7 +32,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-rTlem83dFptgvKUKUaHK8vi5B0FBehPFtkCUhOnUKd0=";
+    hash = "sha256-0ZXXfP6iHyd5zlUQruS3MZADkuucygXrUPRKNCNYA7k=";
  };

  nativeBuildInputs = [
@@ -12,13 +12,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "shoko";
-  version = "5.3.1";
+  version = "5.3.3";

  src = fetchFromGitHub {
    owner = "ShokoAnime";
    repo = "ShokoServer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gZK0NUwPKhrrIjdnfwNI0s618qnTf1cYBgPkwajSTEw=";
+    hash = "sha256-PJtjG4YJBgUrjBt/S2uWyKrCj1pW4N9wrLqoh2gHKcg=";
    fetchSubmodules = true;
  };

@@ -11,7 +11,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "skim";
-  version = "5.0.0";
+  version = "5.1.0";
  __structuredAttrs = true;

  outputs = [
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "skim-rs";
    repo = "skim";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fnpTEp2SXAgiK8stHR2AmRnefBDuXAS+gPoWbUDPirI=";
+    hash = "sha256-AB/73sU02/DHV/bnQXpBqmzmGy+roXyIWd4BnN6GWGw=";
  };

  postPatch = ''
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail "expand('<sfile>:h:h')" "'$out'"
  '';

-  cargoHash = "sha256-o02x09q3s4qyHJcAwhgjC0/fN6xTN392D2vlkAgTReI=";
+  cargoHash = "sha256-tPNAwaefZrwhH7AoQnAkQYQUfKOKWMehHHeoUf7i4yE=";

  nativeBuildInputs = [ installShellFiles ];
  nativeCheckInputs = [
@@ -7,13 +7,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "slint-tr-extractor";
-  version = "1.17.0";
+  version = "1.17.1";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-sFqSO+sg9meKynCKx1hWHB691cEqF7ifUd/Q4q37vIA=";
+    hash = "sha256-ytJLH7CcfLjpzRXljTUZS1rzueBljGXwpDOpKKdBJ+k=";
  };
-  cargoHash = "sha256-+eGziYcF8+wlIw3N4n55GZ5UcI+EyqOuJ9kyz+C7nkw=";
+  cargoHash = "sha256-D+wHG+e2gVt7I7h0KobY4bLkphZJXWaTCoSp2gpNctE=";
  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];

@@ -15,13 +15,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "snx-rs";
-  version = "6.1.2";
+  version = "6.2.0";

  src = fetchFromGitHub {
    owner = "ancwrd1";
    repo = "snx-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JhknaTqvd7Dsox38FH6mphbi+DPzVoyLlyAX6ZsqPkI=";
+    hash = "sha256-GA6YlsX2AgyorWSTPwZI84ViOG1RH9/CDSGOKzbUhHo=";
  };

  passthru.updateScript = nix-update-script { };
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    versionCheckHook
  ];

-  cargoHash = "sha256-lclSkg+WDRl3LQuzF4Q1+5zRT7UcnrasVvbcgd7wbxQ=";
+  cargoHash = "sha256-o01QwkDtbRLOjeAJhajqbWOB/rm7+/dK7t0Nzc1h/gc=";

  doInstallCheck = true;
  versionCheckProgram = "${placeholder "out"}/bin/snx-rs";
@@ -9,7 +9,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "sprite";
-  version = "0.0.1-rc44";
+  version = "0.0.1-rc45";

  src = fetchurl {
    url = "https://sprites-binaries.t3.storage.dev/client/v${finalAttrs.version}/sprite-${
@@ -17,10 +17,10 @@ stdenv.mkDerivation (finalAttrs: {
    }-${if stdenv.hostPlatform.isx86_64 then "amd64" else "arm64"}.tar.gz";
    hash =
      {
-        aarch64-darwin = "sha256-XMr3JZxaFFpJh+CDxZYmbfOLrIhjgYj/mqOAA6qgyoo=";
-        x86_64-darwin = "sha256-KrBmA2auCp+gJ19Cmd7Kc6fDBkgxLIYV50/wWNhz4X0=";
-        aarch64-linux = "sha256-uiTQgChPRjo/OvvcQso52YxhaKjYJ5aU9nZRPUl5hgw=";
-        x86_64-linux = "sha256-cmffpuWg9XqFH2BcSC+gJG00kqHvV532XEDOs/u0dHs=";
+        aarch64-darwin = "sha256-0EbsXuNdSC9lfTR9lQFgGk9nYg200f+tZY8xcXmqTzc=";
+        x86_64-darwin = "sha256-IA3C42wheIATCBlAFVJbq0omjPZv+rQstthCwXDUm5w=";
+        aarch64-linux = "sha256-4a7LrFWgxe5wUcPLMDvo2/HmpCnELkJSyr2nAA9RBwk=";
+        x86_64-linux = "sha256-FfWZ9PFhorfbf8/YsdcFAnpA2QtA1LqAfQiGrc8sesQ=";
      }
      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sqruff";
-  version = "0.38.0";
+  version = "0.39.0";

  src = fetchFromGitHub {
    owner = "quarylabs";
    repo = "sqruff";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-khIP3CtrWcMWIuLcKwDOhwfnJ2FfpffQNqphNpWtzOs=";
+    hash = "sha256-1ynG6A5sGHnCfAfw6MjSTghLPmicRvWPFWnL2Gtns7Y=";
  };

-  cargoHash = "sha256-9u8U7rWm6jOlxky8+y4ptPRnBBEBWWcg4QO0jbLAk5E=";
+  cargoHash = "sha256-HAeF831rPODaT5nzzq+Li8xEmT78IJiRppaKUSlPXXg=";

  # Disable the `python` feature which doesn't work on Nix yet
  buildNoDefaultFeatures = true;
@@ -32,6 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      crates/cli/tests/fix_parse_errors.rs \
      crates/cli/tests/fix_return_code.rs \
      crates/cli/tests/ignore_data_directory.rs \
+      crates/cli/tests/none_format.rs \
      crates/cli/tests/verbose_logging_ignore.rs \
      crates/cli/tests/ui_github.rs \
      crates/cli/tests/ui_json.rs \
@@ -19,4 +19,4 @@
    "version": "6.0.0",
    "hash": "sha256-/9EaAbEeOjELRSMZaImS1O8FmUe8j4WuFUw1VOrPyAo="
  }
-]
+]
@@ -7,13 +7,13 @@
 }:
 buildDotnetModule rec {
  pname = "technitium-dns-server-library";
-  version = "15.2.0";
+  version = "15.3.0";

  src = fetchFromGitHub {
    owner = "TechnitiumSoftware";
    repo = "TechnitiumLibrary";
    tag = "dns-server-v${version}";
-    hash = "sha256-PC8j7JT4JiisGGfHORke63boLC4W1gLoaQQ3jPz5Qtc=";
+    hash = "sha256-BQWDzMEiChY8uX1wUUZNWFDomGqUyDrZ6+UEncC5G5U=";
    name = "${pname}-${version}";
  };

@@ -1,13 +0,0 @@
-diff --git a/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs b/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
-index 352ea6c0..41a9a1c7 100644
--- a/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
-+++ b/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
-@@ -3536,7 +3536,7 @@ namespace DnsServerCore.Dns.ZoneManagers
-                     }
-                 }
- 
-                return new DnsDatagram(request.Identifier, true, DnsOpcode.StandardQuery, true, false, request.RecursionDesired, isRecursionAllowed, false, false, rCode, request.Question, answer, authority, additional, udpPayloadSize: _dnsServer.UdpPayloadSize, options: eDnsOptions);
-+                return new DnsDatagram(request.Identifier, true, DnsOpcode.StandardQuery, true, false, request.RecursionDesired, isRecursionAllowed, false, false, rCode, request.Question, answer, authority, additional, _dnsServer.UdpPayloadSize, request.DnssecOk ? EDnsHeaderFlags.DNSSEC_OK : EDnsHeaderFlags.None, eDnsOptions);
-             }
-         }
- 
@@ -6,8 +6,8 @@
  },
  {
    "pname": "Microsoft.AspNetCore.Authentication.OpenIdConnect",
-    "version": "10.0.7",
-    "hash": "sha256-hr1QgB9miQO2rXj5heibTX/fa3Tj/Nci8G/pDcrq11c="
+    "version": "10.0.9",
+    "hash": "sha256-+fRq6oetJlK32C2R/nRBThcO+S6HTX6AIcfg12keAxU="
  },
  {
    "pname": "Microsoft.IdentityModel.Abstractions",
@@ -59,4 +59,4 @@
    "version": "8.0.1",
    "hash": "sha256-hW4f9zWs0afxPbcMqCA/FAGvBZbBFSkugIOurswomHg="
  }
-]
+]
@@ -10,13 +10,13 @@
 }:
 buildDotnetModule rec {
  pname = "technitium-dns-server";
-  version = "15.2.0";
+  version = "15.3.0";

  src = fetchFromGitHub {
    owner = "TechnitiumSoftware";
    repo = "DnsServer";
    tag = "v${version}";
-    hash = "sha256-464jhswTOJnQnxetl9hH5U3aDP0RXzJTicot9nWzpAo=";
+    hash = "sha256-nopmnQpozvN0p/SyUCH3Yej/oAhDvNdfJssUA1JyGsk=";
    name = "${pname}-${version}";
  };

@@ -41,12 +41,6 @@ buildDotnetModule rec {
    libmsquic
  ];

-  # Confirmed correct by upstream, remove when fixed in a release:
-  # https://github.com/TechnitiumSoftware/DnsServer/issues/1967
-  patches = [
-    ./dnssec-do-bit-fix.patch
-  ];
-
  passthru.tests = {
    inherit (nixosTests) technitium-dns-server;
  };
@@ -3,6 +3,7 @@
  fetchFromGitHub,
  ibtool,
  lib,
+  llvmPackages,
  makeBinaryWrapper,
  stdenv,
  xcbuildHook,
@@ -23,6 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
    ibtool
    makeBinaryWrapper
    xcbuildHook
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
  ];

  buildInputs = [
@@ -36,6 +39,9 @@ stdenv.mkDerivation (finalAttrs: {
    "Release"
  ];

+  # TODO: Clean up on `staging`
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
  installPhase = ''
    runHook preInstall

@@ -1,11 +1,11 @@
 {
  stdenv,
  lib,
-  buildGo125Module,
+  buildGo126Module,
  fetchFromGitHub,
  makeWrapper,
  llvmPackages_20,
-  go_1_25,
+  go_1_26,
  xar,
  binaryen,
  avrdude,
@@ -18,8 +18,8 @@
 let
  # nixpkgs typically updates default llvm and go versions faster than tinygo releases
  # which ends up breaking this build. Use fixed versions for each release.
-  buildGoModule = buildGo125Module;
-  go = go_1_25;
+  buildGoModule = buildGo126Module;
+  go = go_1_26;
  llvmMajor = lib.versions.major llvm.version;
  inherit (llvmPackages_20)
    llvm
@@ -0,0 +1,36 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "txm";
+  version = "0.1.4";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "thatmagicalcat";
+    repo = "txm";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-TV2vDQRH4KV+id7pPtG3Wjbfz/V60RS3wfIvKTP90iE=";
+  };
+
+  cargoHash = "sha256-ZGoIIPuDZUata7YmKOMCYcwc8Dlxo0s8W6eogK8qWsE=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terminal math rendering engine with LaTeX support";
+    homepage = "https://github.com/thatmagicalcat/txm";
+    changelog = "https://github.com/thatmagicalcat/txm/releases/tag/v${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ DuskyElf ];
+    mainProgram = "txm";
+    platforms = lib.platforms.all;
+  };
+})
@@ -6,22 +6,25 @@

 buildGoModule (finalAttrs: {
  pname = "wg-ddns";
-  version = "1.3";
+  version = "1.4";

  src = fetchFromGitHub {
    owner = "fernvenue";
    repo = "wg-ddns";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BV57jidn6bPWU/IhhQvIeMF4xHtTm2WZKm4MQRSMM5Y=";
+    hash = "sha256-Djh/H/PlpwVeJ3T2V/xG8AAJNznYmStCQEMd5uh38us=";
  };

-  vendorHash = "sha256-VfSLrWuvJF4XwAW2BQGxh+3v9RiWmPdysw/nIdt2A9M=";
+  vendorHash = "sha256-oJOpf7PPQvb5z7nqpW0YjOhsF0UiWt/nlwBvF2SdzsY=";

  meta = {
    description = "Lightweight tool that provides DDNS dynamic DNS support for WireGuard";
    homepage = "https://github.com/fernvenue/wg-ddns";
    license = lib.licenses.gpl3Only;
-    maintainers = [ lib.maintainers.bdim404 ];
+    maintainers = [
+      lib.maintainers.fernvenue
+      lib.maintainers.bdim404
+    ];
    platforms = lib.platforms.unix;
    mainProgram = "wg-ddns";
  };
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "yffi";
-  version = "0.24.0";
+  version = "0.27.3";

  src = fetchFromGitHub {
    owner = "y-crdt";
    repo = "y-crdt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RFdLEsKQxt8BGqbf5FFM7mZD64glW7bTKRJaAQOe+vo=";
+    hash = "sha256-OYqBxhpNw4LAfCLN/xBxSFuwjUV/PZvbg7Kk4AQpvvs=";
  };

-  cargoHash = "sha256-RL9lBc7lSmc6jOavE5lZupmaNGZgQhJBedNhjfHVajg=";
+  cargoHash = "sha256-eMGhHDcVeySESsgrP5Pj9BwsAgEe8rZHz+0FeFFp7IY=";

  buildAndTestSubdir = "yffi";

@@ -28,9 +28,9 @@ let
    "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
    "22.1.8".officialRelease.sha256 = "sha256-SF7wFuh4kXZTytpdgX7vUZItKtRobnVICm+ixze4iG0=";
    "23.0.0-git".gitRelease = {
-      rev = "319c1f1c1132e54a2135ffe1d7c58ed7e47b5e51";
-      rev-version = "23.0.0-unstable-2026-07-05";
-      sha256 = "sha256-FM2a7MGnxE+gj4nz6sKOu+107jt9hVMUhCFVgqNyXCs=";
+      rev = "7d24dfa5f29e1794e452aadaa27f994f15568763";
+      rev-version = "23.0.0-unstable-2026-07-12";
+      sha256 = "sha256-mHiwOqEvqXyG6OoiVLRrhzb2MK7FqjQm9ez329ngbYw=";
    };
  }
  // llvmVersions;
@@ -1,6 +1,6 @@
 {
  lib,
-  mkCoqDerivation,
+  mkRocqDerivation,
  which,
  dune,
  coq,
@@ -34,7 +34,9 @@ let
  propagatedBuildInputs_wo_elpi = [
    coq.ocamlPackages.findlib
  ];
-  derivation = mkCoqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
+  derivation = mkRocqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
+    useCoq = true;
+    namePrefix = [ "coq" ];
    pname = "elpi";
    repo = "coq-elpi";
    owner = "LPCIC";
@@ -1,6 +1,6 @@
 {
  lib,
-  mkCoqDerivation,
+  mkRocqDerivation,
  dune,
  coq,
  stdlib,
@@ -39,7 +39,9 @@ let
        else
          "A two-level approach to prove tautologies using Stålmarck's algorithm in Coq.";
    in
-    mkCoqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
+    mkRocqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
+      useCoq = true;
+      namePrefix = [ "coq" ];
      inherit
        version
        pname
@@ -82,7 +82,7 @@ ocamlPackages.buildDunePackage {
    license = lib.licenses.mit;
  }
  // lib.optionalAttrs (fetched.broken or false) {
-    coqFilter = true;
+    rocqFilter = true;
    broken = true;
  };
 }
@@ -8,7 +8,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "caido-schema-proxy";
-  version = "0.57.0";
+  version = "0.57.1";
  pyproject = true;

  __structuredAttrs = true;
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
  src = fetchPypi {
    pname = "caido_schema_proxy";
    inherit (finalAttrs) version;
-    hash = "sha256-5hholzMKrNuJZUZIvg+phProD8OZ/YB0ZSGReGa2IqU=";
+    hash = "sha256-gIElEhHnMDfz6hu0UTOtTiYaB/ZnfeBCskEWTM9419M=";
  };

  build-system = [ hatchling ];
@@ -30,14 +30,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "functions-framework";
-  version = "3.10.1";
+  version = "3.10.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "GoogleCloudPlatform";
    repo = "functions-framework-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CEH0PokH3lhyJl7OPIpJkaKZxAUp1fYVia89DtGoJ7k=";
+    hash = "sha256-JiDerfEXlamZWzHxZaTJN/QFMXSph5YDtRsZM4hb4hs=";
  };

  build-system = [ setuptools ];
@@ -20,14 +20,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "gguf";
-  version = "9775";
+  version = "9967";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ggml-org";
    repo = "llama.cpp";
    tag = "b${finalAttrs.version}";
-    hash = "sha256-y//hC8lpHjyFA3UK6hmcwkzb99xCZyZRMRILo+Y7Ap4=";
+    hash = "sha256-HgptebnnT3xOU26/UJCqQ6FSrhcoybju7SKUy4pLOKA=";
  };

  sourceRoot = "${finalAttrs.src.name}/gguf-py";
@@ -27,7 +27,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "ida-hcli";
-  version = "0.18.3";
+  version = "0.18.5";
  pyproject = true;

  __structuredAttrs = true;
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
    owner = "HexRaysSA";
    repo = "ida-hcli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5ymjKms3qtprIwd81PpmXgewDi4jSLlblgD/9b8Kzt8=";
+    hash = "sha256-n8hLgVgxqaU7Au6HVgOEUKOm1LV3Wx/v42gi2gOD3Jk=";
  };

  build-system = [ setuptools ];
@@ -8,15 +8,15 @@
  qdrant-client,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "llama-index-vector-stores-qdrant";
-  version = "0.10.1";
+  version = "0.10.2";
  pyproject = true;

  src = fetchPypi {
    pname = "llama_index_vector_stores_qdrant";
-    inherit version;
-    hash = "sha256-/vTKhBHD4zY2qrz4g5Qf3nqdbeqkUlTugGJ/LQ/79VE=";
+    inherit (finalAttrs) version;
+    hash = "sha256-MSK2RJAce1jmFv2eftT9HsJgTGPxuFxdatRIIK8ym+I=";
  };

  build-system = [ hatchling ];
@@ -35,4 +35,4 @@ buildPythonPackage rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
@@ -81,6 +81,11 @@ buildPythonPackage rec {
    "tests/test_rate_limiters.py"
    "tests/test_lowlevel.py"
    "tests/test_testserver.py"
+    # ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)
+    "tests/test_crl.py"
+    "tests/test_live.py"
+    "tests/test_ocsp.py"
+    "tests/test_sse.py"
  ];

  disabledTests =
@@ -22,13 +22,13 @@

 buildPythonPackage rec {
  pname = "oslo-db";
-  version = "18.0.0";
+  version = "18.1.0";
  pyproject = true;

  src = fetchPypi {
    pname = "oslo_db";
    inherit version;
-    hash = "sha256-lL/zJBrTie9YZsFpGd4AWuDlud8YFO65TUAnxXUnCSM=";
+    hash = "sha256-B16GziPAwh2x01CR8dyyGwVEnInDpDJtpPLT+4MwIj8=";
  };

  build-system = [
@@ -44,7 +44,8 @@ buildPythonPackage rec {
    oslo-utils
    sqlalchemy
    stevedore
-  ];
+  ]
+  ++ sqlalchemy.optional-dependencies.asyncio;

  nativeCheckInputs = [
    aiosqlite
@@ -39,14 +39,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyhanko";
-  version = "0.35.1";
+  version = "0.35.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "MatthiasValvekens";
    repo = "pyHanko";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mZ9u3mQ8JZIq+G1iwNQST8r7/rCWi/UW0j1xfeV9zFM=";
+    hash = "sha256-CY+YgUu8za5c0t2OKStKvCN9X8hVXT2sN42KSDiyMX8=";
  };

  sourceRoot = "${finalAttrs.src.name}/pkgs/pyhanko";
@@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pylutron";
-  version = "0.4.1";
+  version = "0.4.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "thecynic";
    repo = "pylutron";
    tag = finalAttrs.version;
-    hash = "sha256-bfr0Guu4rbb50arFB6fIWPSqh1hLZY0WO9mALsf8dj0=";
+    hash = "sha256-W0QiOiaUh2/kNNxdPlQLyc4HorDAxZLc+zsftNC0Ah4=";
  };

  postPatch = ''
@@ -26,15 +26,16 @@
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "svgdigitizer";
  version = "0.14.4";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "echemdb";
    repo = "svgdigitizer";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-sDMSzoXa8RnygFjveh1SrF+bFit7OMQh2kbiZ478cM4=";
  };

@@ -42,6 +43,11 @@ buildPythonPackage rec {
    setuptools
  ];

+  # https://github.com/echemdb/svgdigitizer/issues/298
+  pythonRelaxDeps = [
+    "astropy"
+  ];
+
  dependencies = [
    astropy
    click
@@ -81,8 +87,8 @@ buildPythonPackage rec {
  meta = {
    description = "Extract numerical data points from SVG files";
    homepage = "https://github.com/echemdb/svgdigitizer";
-    changelog = "https://github.com/echemdb/svgdigitizer/blob/${src.tag}/ChangeLog";
+    changelog = "https://github.com/echemdb/svgdigitizer/blob/${finalAttrs.src.tag}/ChangeLog";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ doronbehar ];
  };
-}
+})
@@ -15,14 +15,14 @@

 buildPythonPackage rec {
  pname = "tesla-fleet-api";
-  version = "1.5.1";
+  version = "1.6.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Teslemetry";
    repo = "python-tesla-fleet-api";
    tag = "v${version}";
-    hash = "sha256-QQSm856y4/bL61noJ2ebPsZSAAKW3Md6/zQ+FFydri4=";
+    hash = "sha256-Z27HPmlat0GfVmTeRYmqp9HlUsuZ+5A9FStqGGFMfiw=";
  };

  build-system = [ setuptools ];
@@ -15,14 +15,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "timezonefinder";
-  version = "8.2.4";
+  version = "8.2.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jannikmi";
    repo = "timezonefinder";
    tag = finalAttrs.version;
-    hash = "sha256-f0JEnXQHhROe6jQ377xQlM21Afp1Lqs2fHfme1ah4QM=";
+    hash = "sha256-NDxGYiBYFqYU3tK/RwlHYARcncAB1GJk+qHxRNrT1oU=";
  };

  build-system = [ setuptools ];
@@ -1,7 +1,7 @@
 {
    "testing": {
-        "version": "7.2-rc2",
-        "hash": "sha256:0fmmgckfjcld0ljwdz3jzc1bpkyfsj0i8q90mzzy92j07s28nffh",
+        "version": "7.2-rc3",
+        "hash": "sha256:1nf6znpalqikblq6g0yb3hp7i689frhlhb4j1yxj6nn8fvma4rwd",
        "lts": false
    },
    "6.1": {
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent (finalAttrs: {
  owner = "charludo";
  domain = "closest_intent";
-  version = "0.2.0";
+  version = "0.2.1";

  src = fetchFromGitHub {
    inherit (finalAttrs) owner;
    repo = "hass-closest-intent";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AvI9vX2RnN3ALQY4Q2mF3E9mkEV9VBOvk9HOH6i7RbQ=";
+    hash = "sha256-rfmQso2UJsyyCA5F+0B/7gszxy6+RUpTJtil0CxdtyY=";
  };

  dependencies = [
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
  owner = "jwillemsen";
  domain = "daikin_onecta";
-  version = "4.6.10";
+  version = "4.6.12";

  src = fetchFromGitHub {
    owner = "jwillemsen";
    repo = "daikin_onecta";
    tag = "v${version}";
-    hash = "sha256-kUwtgjwDPuQ2Kce7Oi2IMXSpNuW9tBqQLKro9W0bDlU=";
+    hash = "sha256-IMYrgSB4Fyc+BEhY4+FGE9Dca7llAQgvkAiOssut04c=";
  };

  meta = {
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
  owner = "skye-harris";
  domain = "local_openai";
-  version = "1.8.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    inherit (finalAttrs) owner;
    repo = "hass_local_openai_llm";
    tag = finalAttrs.version;
-    hash = "sha256-L5gcjKTT9KvTHCuUxg+r0mBJ+jRZqLvF9o+X+6tSH6g=";
+    hash = "sha256-42hfVQGFHWn+QBIdK9vVPM6nV+vaO8w8mo4FCsQur4I=";
  };

  dependencies = [
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "horizon-card";
-  version = "1.4.0";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "rejuvenate";
    repo = "lovelace-horizon-card";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-z2cJ6BIhNnzUo9nIFxVyrPBVWSKf35fyLXK72pE8TJw=";
+    hash = "sha256-Ja4r8x9sNH6W7LoH//zfXDlQb9W7KYFz4Y9UBoqt19s=";
  };

  patches = [
@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  offlineCache = yarn-berry.fetchYarnBerryDeps {
    inherit (finalAttrs) src patches;
-    hash = "sha256-KWbXvivHxoV4xQuY2m/wpajjIZcypeh6nuvRVnrtFM0=";
+    hash = "sha256-Ztb69kAGYteVevzzFOx+62LI2i4iQakI4Fwqb6G2vuM=";
  };

  buildPhase = ''
@@ -1,7 +1,7 @@
 generic: {
  v74 = generic {
-    version = "7.4.11";
-    hash = "sha256-uouF3zlrg76SFpxk7EAn1+HsedZzGG/0gcKqqOUka+w=";
+    version = "7.4.12";
+    hash = "sha256-LGBinl3OYfUDAmyZ2KksL2at4y7v2Ji6XZAA/enrndA=";
  };
  v70 = generic {
    version = "7.0.28";
@@ -5,7 +5,7 @@ let
    system = "x86_64-linux";
    overlays = [ ];
    config = {
-      allowBrokenPredicate = attrs: lib.getName attrs == "a";
+      problems.handlers.a.broken = "ignore";
    };
  };
 in
@@ -1,4 +1,4 @@
 (stack trace truncated; use '--show-trace' to show the full, detailed trace)

 error: Refusing to evaluate package 'a-0' in /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-default.nix:11 because it has an invalid meta attrset:
-  - a.meta.problems.invalid: Problem kind invalid, inferred from the problem name, is invalid; expected enum<broken,deprecated,removal>. You can specify an explicit problem kind with `a.meta.problems.invalid.kind`
+  - a.meta.problems.invalid: Problem kind invalid, inferred from the problem name, is invalid; expected enum<broken,deprecated,maintainerless,removal>. You can specify an explicit problem kind with `a.meta.problems.invalid.kind`
@@ -27,14 +27,14 @@ let
    self: coq:
    let
      callPackage = self.callPackage;
-      coqPackages = self // {
+      rocqPackages = self // {
        recurseForDerivations = false;
      };
    in
    {
-      inherit coqPackages lib;
+      inherit rocqPackages lib;

-      metaFetch = import ../build-support/coq/meta-fetch/default.nix {
+      metaFetch = import ../build-support/rocq/meta-fetch/default.nix {
        inherit
          lib
          stdenv
@@ -42,7 +42,16 @@ let
          fetchurl
          ;
      };
-      mkCoqDerivation = lib.makeOverridable (callPackage ../build-support/coq { });
+      mkRocqDerivation = lib.makeOverridable (callPackage ../build-support/rocq { });
+      mkCoqDerivation =
+        args:
+        self.mkRocqDerivation (
+          {
+            useCoq = true;
+            namePrefix = [ "coq" ];
+          }
+          // args
+        );

      coq = coq.overrideAttrs (oldAttrs: {
        passthru = (oldAttrs.passthru or { }) // {
@@ -286,7 +295,7 @@ let
        let
          v = set.${name} or null;
        in
-        lib.optional (!v.meta.coqFilter or false) (
+        lib.optional (!v.meta.rocqFilter or false) (
          lib.nameValuePair name (
            if lib.isAttrs v && v.recurseForDerivations or false then filterCoqPackages v else v
          )
@@ -26,7 +26,7 @@ let
        recurseForDerivations = false;
      };

-      metaFetch = import ../build-support/coq/meta-fetch/default.nix {
+      metaFetch = import ../build-support/rocq/meta-fetch/default.nix {
        inherit
          lib
          stdenv