From 8c62961f488597bfa99c62475bf6193ddfaffb93 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Wed, 21 Jan 2026 07:29:03 +0000
Subject: [PATCH 01/81] cabextract: fix musl build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fixes `pkgsMusl.cabextract`, which previously failed:

> ./getopt.h:136:12: error: conflicting types for ‘getopt’; have ‘int(void)’
>   136 | extern int getopt ();

getopt.h is shipped by glibc.dev, musl.dev, etc.
cabextract is shipping an ancient polyglot that only gets in the way of
the libc headers provided by our stdenv.
---
 pkgs/by-name/ca/cabextract/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/ca/cabextract/package.nix b/pkgs/by-name/ca/cabextract/package.nix
index 2cc6c90876ae..5bd12cbcbe91 100644
--- a/pkgs/by-name/ca/cabextract/package.nix
+++ b/pkgs/by-name/ca/cabextract/package.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-tVRtsRVeTHGP89SyeFc2BPMN1kw8W/1GV80Im4I6OsY=";
   };
 
+  # Remove vendored getopt.h in favor of stdenv's to fix non-gnu builds.
+  postPatch = ''
+    rm getopt.h
+  '';
+
   # Let's assume that fnmatch works for cross-compilation, otherwise it gives an error:
   # undefined reference to `rpl_fnmatch'.
   configureFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [

From c41db4db49deb95a56fd232b2c92f3ee8f394f6e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 17 Mar 2026 11:50:23 +0000
Subject: [PATCH 02/81] envfs: 1.1.0 -> 1.2.0

---
 pkgs/by-name/en/envfs/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/en/envfs/package.nix b/pkgs/by-name/en/envfs/package.nix
index f1601aa562bc..823c183868e6 100644
--- a/pkgs/by-name/en/envfs/package.nix
+++ b/pkgs/by-name/en/envfs/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "envfs";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "envfs";
     rev = finalAttrs.version;
-    hash = "sha256-bpATdm/lB+zomPYGCxA7omWK/SKPIaqr94J+fjMaXfE=";
+    hash = "sha256-hj/6zS9ebF0IDqgc1Dne59nWx80nk6jn2gj8BzQUFIQ=";
   };
 
-  cargoHash = "sha256-nMUdAFRHJZDwvLASBVykzzkwk3HxslDehqqm1U99qYg=";
+  cargoHash = "sha256-dz3gpE464jnmSDsAsmJHcxUsEKeUURNoUjgGU2214Xg=";
 
   postInstall = ''
     ln -s envfs $out/bin/mount.envfs

From 4bfdcbe06f6e8eb518eb9634dea80e58c07f68b9 Mon Sep 17 00:00:00 2001
From: Jeremy Stucki <dev@jeremystucki.ch>
Date: Mon, 18 May 2026 09:56:47 +0200
Subject: [PATCH 03/81] maintainers: add jeremystucki

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2e12985a6319..e5283f3771ea 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12511,6 +12511,12 @@
     githubId = 5741620;
     name = "Jeremy Schlatter";
   };
+  jeremystucki = {
+    email = "dev@jeremystucki.ch";
+    github = "jeremystucki";
+    githubId = 7629727;
+    name = "Jeremy Stucki";
+  };
   jerith666 = {
     email = "github@matt.mchenryfamily.org";
     github = "jerith666";

From cf4b4a12ad7b5bcd6ae79c417283eb17e5382bb5 Mon Sep 17 00:00:00 2001
From: Jeremy Stucki <dev@jeremystucki.ch>
Date: Mon, 18 May 2026 09:56:53 +0200
Subject: [PATCH 04/81] periphery: init at 3.7.4

---
 pkgs/by-name/pe/periphery/package.nix | 48 +++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 pkgs/by-name/pe/periphery/package.nix

diff --git a/pkgs/by-name/pe/periphery/package.nix b/pkgs/by-name/pe/periphery/package.nix
new file mode 100644
index 000000000000..03a52e404ca1
--- /dev/null
+++ b/pkgs/by-name/pe/periphery/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "periphery";
+  version = "3.7.4";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchzip {
+    url = "https://github.com/peripheryapp/periphery/releases/download/${finalAttrs.version}/periphery-${finalAttrs.version}.zip";
+    hash = "sha256-p40+MvqHczG3iuWU+l0uOS96Zkxv/p88CBhs90b3168=";
+    stripRoot = false;
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 periphery $out/bin/periphery
+    install -Dm755 libIndexStore.dylib $out/bin/libIndexStore.dylib
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Unused code detector for Swift projects";
+    homepage = "https://github.com/peripheryapp/periphery";
+    changelog = "https://github.com/peripheryapp/periphery/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    mainProgram = "periphery";
+    maintainers = with lib.maintainers; [ jeremystucki ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+})

From 52af425964c640d11fbe40bee42c3228d18aed76 Mon Sep 17 00:00:00 2001
From: Myzel394 <myzel394.xyllian@pm.me>
Date: Thu, 2 Apr 2026 13:19:40 +0200
Subject: [PATCH 05/81] deck-app: init at 1.4.5

---
 pkgs/by-name/de/deck-app/package.nix | 50 ++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 pkgs/by-name/de/deck-app/package.nix

diff --git a/pkgs/by-name/de/deck-app/package.nix b/pkgs/by-name/de/deck-app/package.nix
new file mode 100644
index 000000000000..2fd4267197f2
--- /dev/null
+++ b/pkgs/by-name/de/deck-app/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  undmg,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "deck-app";
+  version = "1.4.5";
+
+  src = fetchurl {
+    url = "https://github.com/yuzeguitarist/Deck/releases/download/v${finalAttrs.version}/Deck.dmg";
+    hash = "sha256-U5iMoQZGycwiiehxKUB3iohvzAh42gkC1sk3AJ62Ujs=";
+  };
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+
+    runHook postInstall
+  '';
+
+  dontBuild = true;
+  dontFixup = true;
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Deck is a modern, native, privacy-first clipboard manager for macOS.";
+    homepage = "https://deckclip.app/";
+    changelog = "https://github.com/yuzeguitarist/Deck/releases/tag/v${finalAttrs.version}";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = lib.platforms.darwin;
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ myzel394 ];
+    # Deck provides a CLI tool that can be enabled in the app settings.
+    mainProgram = "deckclip";
+  };
+})

From eee88b63531ffb0caa93dde08f44718ccf6052fc Mon Sep 17 00:00:00 2001
From: Palmer Cox <p@lmercox.com>
Date: Mon, 25 May 2026 21:58:02 -0400
Subject: [PATCH 06/81] cardpeek: Fix on Darwin

---
 pkgs/by-name/ca/cardpeek/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/ca/cardpeek/package.nix b/pkgs/by-name/ca/cardpeek/package.nix
index 895415be4780..15716189d1be 100644
--- a/pkgs/by-name/ca/cardpeek/package.nix
+++ b/pkgs/by-name/ca/cardpeek/package.nix
@@ -52,6 +52,13 @@ stdenv.mkDerivation {
   ]
   ++ lib.optional stdenv.hostPlatform.isLinux pcsclite;
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # macOS iconv implementation is slightly broken since Sonoma
+    # https://github.com/Homebrew/homebrew-core/pull/199639
+    # https://savannah.gnu.org/bugs/index.php?66541
+    am_cv_func_iconv_works = "yes";
+  };
+
   enableParallelBuilding = true;
 
   meta = {

From 8050948fa2c1666aa72c7f5086a43bc00a4eecfb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 5 Jun 2026 23:47:38 +0000
Subject: [PATCH 07/81] brewtarget: 5.1.0 -> 5.1.1

---
 pkgs/by-name/br/brewtarget/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/br/brewtarget/package.nix b/pkgs/by-name/br/brewtarget/package.nix
index af314d2e8e0d..334d8e2ba912 100644
--- a/pkgs/by-name/br/brewtarget/package.nix
+++ b/pkgs/by-name/br/brewtarget/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brewtarget";
-  version = "5.1.0";
+  version = "5.1.1";
 
   src = fetchFromGitHub {
     owner = "Brewtarget";
     repo = "brewtarget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CVFj/tsOOFj/LpkmMy4h9dnCBTOq9WGkXFUr/yJdcK0=";
+    hash = "sha256-1baUFgw3L+q2Ig/xvakP14mzk3Uop+NZy53YHhJLkR8=";
     fetchSubmodules = true;
   };
 

From bf40b8c498802ac4e74e2e90bf1871f3c65f86e3 Mon Sep 17 00:00:00 2001
From: Robert Cambridge <robert@cambridge.me>
Date: Thu, 11 Jun 2026 21:33:36 +0200
Subject: [PATCH 08/81] cypress: codesign darwin binaries

Cypress fails to open on macOS when its bundled binaries are not signed.
Add the Darwin auto-signing hook so Mach-O binaries in the prebuilt app
bundle are ad-hoc signed during fixup.

Assisted-by: GPT-5.5
---
 pkgs/by-name/cy/cypress/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/cy/cypress/package.nix b/pkgs/by-name/cy/cypress/package.nix
index 0bc132727e15..11170463fc34 100644
--- a/pkgs/by-name/cy/cypress/package.nix
+++ b/pkgs/by-name/cy/cypress/package.nix
@@ -1,6 +1,7 @@
 {
   alsa-lib,
   autoPatchelfHook,
+  darwin,
   fetchzip,
   gtk2,
   gtk3,
@@ -55,6 +56,9 @@ stdenv.mkDerivation rec {
     unzip
     makeShellWrapper
   ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.autoSignDarwinBinariesHook
+  ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     autoPatchelfHook
     # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651

From ec544c110d4a9784664af4d6c071d93c5d7b7239 Mon Sep 17 00:00:00 2001
From: betaboon <betaboon@0x80.ninja>
Date: Sun, 14 Jun 2026 08:08:07 +0200
Subject: [PATCH 09/81] python3Packages.niquests: fix build on darwin

---
 pkgs/development/python-modules/niquests/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/niquests/default.nix b/pkgs/development/python-modules/niquests/default.nix
index be93ae9a06c9..6eff8772ab80 100644
--- a/pkgs/development/python-modules/niquests/default.nix
+++ b/pkgs/development/python-modules/niquests/default.nix
@@ -81,6 +81,11 @@ buildPythonPackage rec {
     "tests/test_rate_limiters.py"
     "tests/test_lowlevel.py"
     "tests/test_testserver.py"
+    # ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)
+    "tests/test_crl.py"
+    "tests/test_live.py"
+    "tests/test_ocsp.py"
+    "tests/test_sse.py"
   ];
 
   disabledTests =

From 1908d92d4acacb7ca8773a04145bc160e763dc4d Mon Sep 17 00:00:00 2001
From: isabel <isabel@isabelroses.com>
Date: Mon, 22 Jun 2026 09:54:57 +0100
Subject: [PATCH 10/81] nixosTests.bluesky-pds: migrate to systemd-nspawn

---
 nixos/tests/bluesky-pds.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/bluesky-pds.nix b/nixos/tests/bluesky-pds.nix
index b74c74955f54..aa791a43c27b 100644
--- a/nixos/tests/bluesky-pds.nix
+++ b/nixos/tests/bluesky-pds.nix
@@ -2,7 +2,7 @@
 {
   name = "PDS";
 
-  nodes.machine = {
+  containers.machine = {
     services.bluesky-pds = {
       enable = true;
       settings = {

From 005ae92e4f71bef6f60e906b2098bc8df05ae5d6 Mon Sep 17 00:00:00 2001
From: Leon Hubrich <mail@leon-hubrich.de>
Date: Sun, 5 Jul 2026 23:07:40 +0200
Subject: [PATCH 11/81] technitium-dns-server: 15.2.0 -> 15.3.0

---
 .../services/networking/technitium-dns-server.nix   |  6 +++++-
 .../technitium-dns-server-library/nuget-deps.json   |  2 +-
 .../te/technitium-dns-server-library/package.nix    |  4 ++--
 .../technitium-dns-server/dnssec-do-bit-fix.patch   | 13 -------------
 .../te/technitium-dns-server/nuget-deps.json        |  6 +++---
 pkgs/by-name/te/technitium-dns-server/package.nix   | 10 ++--------
 6 files changed, 13 insertions(+), 28 deletions(-)
 delete mode 100644 pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch

diff --git a/nixos/modules/services/networking/technitium-dns-server.nix b/nixos/modules/services/networking/technitium-dns-server.nix
index 143b0c43cfdc..32aa247989aa 100644
--- a/nixos/modules/services/networking/technitium-dns-server.nix
+++ b/nixos/modules/services/networking/technitium-dns-server.nix
@@ -65,6 +65,7 @@ in
         DynamicUser = true;
 
         StateDirectory = "technitium-dns-server";
+        LogsDirectory = "technitium";
 
         Restart = "always";
         RestartSec = 10;
@@ -102,5 +103,8 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ fabianrig ];
+  meta.maintainers = with lib.maintainers; [
+    fabianrig
+    awildleon
+  ];
 }
diff --git a/pkgs/by-name/te/technitium-dns-server-library/nuget-deps.json b/pkgs/by-name/te/technitium-dns-server-library/nuget-deps.json
index 55abcf33388d..ca48dcf1154e 100644
--- a/pkgs/by-name/te/technitium-dns-server-library/nuget-deps.json
+++ b/pkgs/by-name/te/technitium-dns-server-library/nuget-deps.json
@@ -19,4 +19,4 @@
     "version": "6.0.0",
     "hash": "sha256-/9EaAbEeOjELRSMZaImS1O8FmUe8j4WuFUw1VOrPyAo="
   }
-]
\ No newline at end of file
+]
diff --git a/pkgs/by-name/te/technitium-dns-server-library/package.nix b/pkgs/by-name/te/technitium-dns-server-library/package.nix
index 1a7f086d303c..c5db4bfb27f8 100644
--- a/pkgs/by-name/te/technitium-dns-server-library/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server-library/package.nix
@@ -7,13 +7,13 @@
 }:
 buildDotnetModule rec {
   pname = "technitium-dns-server-library";
-  version = "15.2.0";
+  version = "15.3.0";
 
   src = fetchFromGitHub {
     owner = "TechnitiumSoftware";
     repo = "TechnitiumLibrary";
     tag = "dns-server-v${version}";
-    hash = "sha256-PC8j7JT4JiisGGfHORke63boLC4W1gLoaQQ3jPz5Qtc=";
+    hash = "sha256-BQWDzMEiChY8uX1wUUZNWFDomGqUyDrZ6+UEncC5G5U=";
     name = "${pname}-${version}";
   };
 
diff --git a/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch b/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch
deleted file mode 100644
index aaafec50add1..000000000000
--- a/pkgs/by-name/te/technitium-dns-server/dnssec-do-bit-fix.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs b/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
-index 352ea6c0..41a9a1c7 100644
---- a/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
-+++ b/DnsServerCore/Dns/ZoneManagers/AuthZoneManager.cs
-@@ -3536,7 +3536,7 @@ namespace DnsServerCore.Dns.ZoneManagers
-                     }
-                 }
- 
--                return new DnsDatagram(request.Identifier, true, DnsOpcode.StandardQuery, true, false, request.RecursionDesired, isRecursionAllowed, false, false, rCode, request.Question, answer, authority, additional, udpPayloadSize: _dnsServer.UdpPayloadSize, options: eDnsOptions);
-+                return new DnsDatagram(request.Identifier, true, DnsOpcode.StandardQuery, true, false, request.RecursionDesired, isRecursionAllowed, false, false, rCode, request.Question, answer, authority, additional, _dnsServer.UdpPayloadSize, request.DnssecOk ? EDnsHeaderFlags.DNSSEC_OK : EDnsHeaderFlags.None, eDnsOptions);
-             }
-         }
- 
diff --git a/pkgs/by-name/te/technitium-dns-server/nuget-deps.json b/pkgs/by-name/te/technitium-dns-server/nuget-deps.json
index 3c5b4c6e4f0a..dfb73aa03e2b 100644
--- a/pkgs/by-name/te/technitium-dns-server/nuget-deps.json
+++ b/pkgs/by-name/te/technitium-dns-server/nuget-deps.json
@@ -6,8 +6,8 @@
   },
   {
     "pname": "Microsoft.AspNetCore.Authentication.OpenIdConnect",
-    "version": "10.0.7",
-    "hash": "sha256-hr1QgB9miQO2rXj5heibTX/fa3Tj/Nci8G/pDcrq11c="
+    "version": "10.0.9",
+    "hash": "sha256-+fRq6oetJlK32C2R/nRBThcO+S6HTX6AIcfg12keAxU="
   },
   {
     "pname": "Microsoft.IdentityModel.Abstractions",
@@ -59,4 +59,4 @@
     "version": "8.0.1",
     "hash": "sha256-hW4f9zWs0afxPbcMqCA/FAGvBZbBFSkugIOurswomHg="
   }
-]
\ No newline at end of file
+]
diff --git a/pkgs/by-name/te/technitium-dns-server/package.nix b/pkgs/by-name/te/technitium-dns-server/package.nix
index f143be229523..6ddd88f61f89 100644
--- a/pkgs/by-name/te/technitium-dns-server/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server/package.nix
@@ -10,13 +10,13 @@
 }:
 buildDotnetModule rec {
   pname = "technitium-dns-server";
-  version = "15.2.0";
+  version = "15.3.0";
 
   src = fetchFromGitHub {
     owner = "TechnitiumSoftware";
     repo = "DnsServer";
     tag = "v${version}";
-    hash = "sha256-464jhswTOJnQnxetl9hH5U3aDP0RXzJTicot9nWzpAo=";
+    hash = "sha256-nopmnQpozvN0p/SyUCH3Yej/oAhDvNdfJssUA1JyGsk=";
     name = "${pname}-${version}";
   };
 
@@ -41,12 +41,6 @@ buildDotnetModule rec {
     libmsquic
   ];
 
-  # Confirmed correct by upstream, remove when fixed in a release:
-  # https://github.com/TechnitiumSoftware/DnsServer/issues/1967
-  patches = [
-    ./dnssec-do-bit-fix.patch
-  ];
-
   passthru.tests = {
     inherit (nixosTests) technitium-dns-server;
   };

From 152880535b8809cc3efefab0a354e964f548f320 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 5 Jul 2026 23:22:28 +0000
Subject: [PATCH 12/81] jetbrains.webstorm: 2026.1.3 -> 2026.1.4

---
 .../editors/jetbrains/ides/webstorm.nix       | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/editors/jetbrains/ides/webstorm.nix b/pkgs/applications/editors/jetbrains/ides/webstorm.nix
index 637302db7639..0e35c48c293b 100644
--- a/pkgs/applications/editors/jetbrains/ides/webstorm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/webstorm.nix
@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.tar.gz";
-      hash = "sha256-lryIoVxoytyDyfgjnobQ3e94wIIohmIKL88fwf2I49w=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4.tar.gz";
+      hash = "sha256-BPuMTwZ3Xkk4SBRCdgZ8vCoEYjhTa3d8CFOqrGlcGg0=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.tar.gz";
-      hash = "sha256-oZQaxpVV0O4WlDE6Ia+KzHIF0SfWQBubBFIopSRMbvE=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.tar.gz";
+      hash = "sha256-f9KenMq1gtldzpBraSBwOb/186WQwh1ps5Ypj5JoOU0=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.dmg";
-      hash = "sha256-KUcQRWYUD/+4HHWnkGuqoltqL2an0WQkUEfUcttwjCI=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4.dmg";
+      hash = "sha256-SGdo6WYMCcCBuZUjvURcMTbJUqhZ4MzFlSLg6Zjr84I=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.dmg";
-      hash = "sha256-1N1RtN1QLvuJ1QL8jbN5TdbOHAHSN84W9XEK2PEPijI=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.dmg";
+      hash = "sha256-ZYen6Ew0GYbBAmuGCDACPBsygxZ6sT787o6gqF9DJzw=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "WebStorm";
 
   # update-script-start: version
-  version = "2026.1.3";
-  buildNumber = "261.25134.101";
+  version = "2026.1.4";
+  buildNumber = "261.26222.58";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

From a857c1a343eccc2a02fd048b1bfe193056a8eb4e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Silva?= <andrerfosilva@gmail.com>
Date: Thu, 9 Jul 2026 14:37:25 +0100
Subject: [PATCH 13/81] evdevremapkeys: 1.0.0 -> 1.0.3

---
 pkgs/by-name/ev/evdevremapkeys/package.nix | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/ev/evdevremapkeys/package.nix b/pkgs/by-name/ev/evdevremapkeys/package.nix
index 7986b373996b..e1c04f0c7c29 100644
--- a/pkgs/by-name/ev/evdevremapkeys/package.nix
+++ b/pkgs/by-name/ev/evdevremapkeys/package.nix
@@ -4,32 +4,35 @@
   python3Packages,
 }:
 
-python3Packages.buildPythonPackage {
+python3Packages.buildPythonPackage (finalAttrs: {
   pname = "evdevremapkeys";
-  version = "1.0.0";
+  version = "1.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "philipl";
     repo = "evdevremapkeys";
-    rev = "9b6f372a9bdf8b27d39f7e655b74f6b9d1a8467f";
-    sha256 = "sha256-FwRbo0RTiiV2AB7z6XOalMnwMbj15jM4Dxs41TsIOQI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Gtml52tHNtg/3Fy+QO9eIh90nim0p0Fs+oEyqJvsZKs=";
   };
 
   build-system = with python3Packages; [
-    setuptools
+    hatchling
+    hatch-vcs
   ];
 
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
+
   dependencies = with python3Packages; [
     pyyaml
     pyxdg
-    python-daemon
     evdev
     pyudev
   ];
 
-  # hase no tests
-  doCheck = false;
+  nativeCheckInputs = with python3Packages; [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "evdevremapkeys" ];
 
@@ -41,4 +44,4 @@ python3Packages.buildPythonPackage {
     maintainers = [ lib.maintainers.q3k ];
     platforms = lib.platforms.linux;
   };
-}
+})

From a804fe6f41f036822e23166c4609e7fab406f892 Mon Sep 17 00:00:00 2001
From: ern775 <eren.demir2479090@gmail.com>
Date: Fri, 10 Jul 2026 09:27:59 +0300
Subject: [PATCH 14/81] dopamine: 3.0.6 -> 3.0.7

---
 pkgs/by-name/do/dopamine/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/do/dopamine/package.nix b/pkgs/by-name/do/dopamine/package.nix
index a4eed321c8de..9a1eecaf52e4 100644
--- a/pkgs/by-name/do/dopamine/package.nix
+++ b/pkgs/by-name/do/dopamine/package.nix
@@ -10,7 +10,7 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "dopamine";
-  version = "3.0.6";
+  version = "3.0.7";
 
   # needed to upgrade better-sqlite3 in npmConfigHook
   src = applyPatches {
@@ -18,7 +18,7 @@ buildNpmPackage (finalAttrs: {
       owner = "digimezzo";
       repo = "dopamine";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-HTPWejm5Wi6yGJyS/f1RhjIluTz01ue8lAsnAcQY3IY=";
+      hash = "sha256-zYuf5BIQaxTqHBXWX1PLghGR5WmwtnSxTYrNosVFebc=";
     };
     patches = [
       # register-scheme contains install scripts, but has no lockfile
@@ -32,7 +32,7 @@ buildNpmPackage (finalAttrs: {
     ];
   };
 
-  npmDepsHash = "sha256-9dQUqoLfzYXOgmE9j2lkew9b/1m4XOghT7roD82y+qg=";
+  npmDepsHash = "sha256-m5y8TmOUAUf2IE87b73hFe2vj/uRAqFGgfuy3vkUX/s=";
 
   nativeBuildInputs = [
     (python3.withPackages (ps: with ps; [ distutils ]))

From 29dc9bdb1d3dfee25aef72451f968f9b172e4573 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 10 Jul 2026 13:17:16 +0200
Subject: [PATCH 15/81] immich: bump geodata

---
 pkgs/by-name/im/immich/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index b39e88a2eab5..b3b001bbfe91 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -77,14 +77,14 @@ let
   # The geodata website is not versioned, so we use the internet archive
   geodata =
     let
-      timestamp = "20260408011516";
+      timestamp = "20260710111330";
       date =
         "${lib.substring 0 4 timestamp}-${lib.substring 4 2 timestamp}-${lib.substring 6 2 timestamp}T"
         + "${lib.substring 8 2 timestamp}:${lib.substring 10 2 timestamp}:${lib.substring 12 2 timestamp}Z";
     in
     runCommand "immich-geodata"
       {
-        outputHash = "sha256-WSKaTn54+8ckXPsk3jsOJ4yCsO0jLKf3y+apqwNlHc4=";
+        outputHash = "sha256-Pf5u+bqzF2x1PECxKwZ6dfGiEj1YMlRejTcTI1amMvU=";
         outputHashMode = "recursive";
         nativeBuildInputs = [
           cacert

From 06177fed6ffde239dff17f6e244111b1ae586b93 Mon Sep 17 00:00:00 2001
From: Alexander Sieg <alex@xanderio.de>
Date: Tue, 7 Jul 2026 12:21:59 +0200
Subject: [PATCH 16/81] dependency-track: 4.14.1 -> 4.14.2; include patch for
 node 22 support

---
 pkgs/by-name/de/dependency-track/package.nix | 28 +++++++++++---------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/de/dependency-track/package.nix b/pkgs/by-name/de/dependency-track/package.nix
index e15bbc02d63e..9c30cb651b6b 100644
--- a/pkgs/by-name/de/dependency-track/package.nix
+++ b/pkgs/by-name/de/dependency-track/package.nix
@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  nodejs_20,
+  fetchpatch2,
   jre_headless,
   protobuf_30,
   xmlstarlet,
@@ -13,20 +13,17 @@
   nixosTests,
 }:
 let
-  version = "4.14.1";
+  version = "4.14.2";
 
   frontend = buildNpmPackage {
     pname = "dependency-track-frontend";
     inherit version;
 
-    # TODO: pinned due to build error on node 22
-    nodejs = nodejs_20;
-
     src = fetchFromGitHub {
       owner = "DependencyTrack";
       repo = "frontend";
-      rev = version;
-      hash = "sha256-xjIRkffmXYMAfZ8wJehnPRfTThJjTgNL8ONl9N9ZJ+M=";
+      tag = version;
+      hash = "sha256-/MH1YjEJdRjYjenkzOcp7oytudsJcinPbc9OAGFnI/Q=";
     };
 
     installPhase = ''
@@ -34,7 +31,14 @@ let
       cp -R ./dist $out/
     '';
 
-    npmDepsHash = "sha256-CW9LOur8N3obrOeHgYFH2OO/vg8XihUspuXS5Zrix8I=";
+    patches = [
+      (fetchpatch2 {
+        url = "https://github.com/DependencyTrack/frontend/pull/1575.patch?full_index=1";
+        hash = "sha256-Wo+6yXa/8jB/pph0DTNsFz6lK3sedvro+7yvLSKes9c=";
+      })
+    ];
+
+    npmDepsHash = "sha256-md+PGEC1/Kl2MQhhYldSErcsDSefbPvwVDsw0Yklq1E=";
     forceGitDeps = true;
     makeCacheWritable = true;
 
@@ -50,8 +54,8 @@ maven.buildMavenPackage rec {
   src = fetchFromGitHub {
     owner = "DependencyTrack";
     repo = "dependency-track";
-    rev = version;
-    hash = "sha256-pIZM8FQ0IFqRbTQT5VIlCmS+fCCXULJJ6bdEv6xfjbc=";
+    tag = version;
+    hash = "sha256-9EPjIm2VOmt1FEiPoJtwNHoKZcewO0kJgBSc9fnUXeI=";
   };
 
   postPatch = ''
@@ -84,7 +88,7 @@ maven.buildMavenPackage rec {
   '';
 
   mvnJdk = jre_headless;
-  mvnHash = "sha256-eZuwBt+emThf4mxVaphFgBWNqP64Cs9WIKW+GPvHll4=";
+  mvnHash = "sha256-pshUDIPPGGGzxg5WJXC3mjnqGXn8HVowFCb2l5f6zjA=";
   manualMvnArtifacts = [
     "com.coderplus.maven.plugins:copy-rename-maven-plugin:1.0.1"
     # added to saticfy protobuf compiler plugin dependency resolving
@@ -92,7 +96,7 @@ maven.buildMavenPackage rec {
     "com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:2.19.1"
     "com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.21.0"
     "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.3"
-    "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.0"
+    "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.2"
     "io.micrometer:micrometer-core:1.16.0"
     "io.micrometer:micrometer-observation:1.16.0"
   ];

From 0235b9517ea76be81eb471bd5cdb1718a6300547 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Zimmermann?= <theo.zimmermann@telecom-paris.fr>
Date: Thu, 2 Jul 2026 14:53:10 +0200
Subject: [PATCH 17/81] mkCoqDerivation: make a wrapper on top of
 mkRocqDerivation

---
 .../science/logic/coq/default.nix             |   2 +-
 .../science/logic/rocq-core/default.nix       |   2 +-
 pkgs/build-support/coq/default.nix            | 246 ------------------
 pkgs/build-support/rocq/default.nix           |  16 +-
 .../{coq => rocq}/meta-fetch/default.nix      |   0
 .../coq-modules/coq-elpi/default.nix          |   6 +-
 .../coq-modules/stalmarck/default.nix         |   6 +-
 .../vscoq-language-server/default.nix         |   2 +-
 pkgs/top-level/coq-packages.nix               |  19 +-
 pkgs/top-level/rocq-packages.nix              |   2 +-
 10 files changed, 38 insertions(+), 263 deletions(-)
 delete mode 100644 pkgs/build-support/coq/default.nix
 rename pkgs/build-support/{coq => rocq}/meta-fetch/default.nix (100%)

diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index cee47f70a062..aedee50cefef 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -79,7 +79,7 @@ let
   };
   releaseRev = v: "V${v}";
   fetched =
-    import ../../../../build-support/coq/meta-fetch/default.nix
+    import ../../../../build-support/rocq/meta-fetch/default.nix
       {
         inherit
           lib
diff --git a/pkgs/applications/science/logic/rocq-core/default.nix b/pkgs/applications/science/logic/rocq-core/default.nix
index 6f1c384d005f..a6501daaaa3f 100644
--- a/pkgs/applications/science/logic/rocq-core/default.nix
+++ b/pkgs/applications/science/logic/rocq-core/default.nix
@@ -32,7 +32,7 @@ let
   };
   releaseRev = v: "V${v}";
   fetched =
-    import ../../../../build-support/coq/meta-fetch/default.nix
+    import ../../../../build-support/rocq/meta-fetch/default.nix
       {
         inherit
           lib
diff --git a/pkgs/build-support/coq/default.nix b/pkgs/build-support/coq/default.nix
deleted file mode 100644
index 3c9670f4f65e..000000000000
--- a/pkgs/build-support/coq/default.nix
+++ /dev/null
@@ -1,246 +0,0 @@
-{
-  lib,
-  stdenv,
-  coqPackages,
-  coq,
-  which,
-  fetchzip,
-  fetchurl,
-  dune,
-}@args:
-
-let
-  lib = import ./extra-lib.nix {
-    inherit (args) lib;
-  };
-
-  inherit (lib)
-    concatStringsSep
-    flip
-    foldl
-    isFunction
-    isString
-    optional
-    optionalAttrs
-    optionals
-    optionalString
-    pred
-    remove
-    switch
-    versions
-    ;
-
-  inherit (lib.attrsets) removeAttrs;
-  inherit (lib.strings) match;
-
-  isGitHubDomain = d: match "^github.*" d != null;
-  isGitLabDomain = d: match "^gitlab.*" d != null;
-in
-
-{
-  pname,
-  version ? null,
-  fetcher ? null,
-  owner ? "rocq-community",
-  domain ? "github.com",
-  repo ? pname,
-  defaultVersion ? null,
-  releaseRev ? (v: v),
-  displayVersion ? { },
-  release ? { },
-  buildInputs ? [ ],
-  nativeBuildInputs ? [ ],
-  extraBuildInputs ? [ ],
-  extraNativeBuildInputs ? [ ],
-  overrideBuildInputs ? [ ],
-  overrideNativeBuildInputs ? [ ],
-  namePrefix ? [ "coq" ],
-  enableParallelBuilding ? true,
-  extraInstallFlags ? [ ],
-  setCOQBIN ? true,
-  mlPlugin ? false,
-  useMelquiondRemake ? null,
-  dropAttrs ? [ ],
-  keepAttrs ? [ ],
-  dropDerivationAttrs ? [ ],
-  useDuneifVersion ? (x: false),
-  useDune ? false,
-  opam-name ? (concatStringsSep "-" (namePrefix ++ [ pname ])),
-  ...
-}@args:
-let
-  args-to-remove = foldl (flip remove) (
-    [
-      "version"
-      "fetcher"
-      "repo"
-      "owner"
-      "domain"
-      "releaseRev"
-      "displayVersion"
-      "defaultVersion"
-      "useMelquiondRemake"
-      "release"
-      "buildInputs"
-      "nativeBuildInputs"
-      "extraBuildInputs"
-      "extraNativeBuildInputs"
-      "overrideBuildInputs"
-      "overrideNativeBuildInputs"
-      "namePrefix"
-      "meta"
-      "useDuneifVersion"
-      "useDune"
-      "opam-name"
-      "extraInstallFlags"
-      "setCOQBIN"
-      "mlPlugin"
-      "dropAttrs"
-      "dropDerivationAttrs"
-      "keepAttrs"
-      "env"
-    ]
-    ++ dropAttrs
-  ) keepAttrs;
-  fetch =
-    import ../coq/meta-fetch/default.nix
-      {
-        inherit
-          lib
-          stdenv
-          fetchzip
-          fetchurl
-          ;
-      }
-      (
-        {
-          inherit release releaseRev;
-          location = { inherit domain owner repo; };
-        }
-        // optionalAttrs (args ? fetcher) { inherit fetcher; }
-      );
-  fetched = fetch (if version != null then version else defaultVersion);
-  display-pkg =
-    n: sep: v:
-    let
-      d = displayVersion.${n} or (if sep == "" then ".." else true);
-    in
-    n
-    + optionalString (v != "" && v != null) (
-      switch d [
-        {
-          case = true;
-          out = sep + v;
-        }
-        {
-          case = ".";
-          out = sep + versions.major v;
-        }
-        {
-          case = "..";
-          out = sep + versions.majorMinor v;
-        }
-        {
-          case = "...";
-          out = sep + versions.majorMinorPatch v;
-        }
-        {
-          case = isFunction;
-          out = optionalString (d v != "") (sep + d v);
-        }
-        {
-          case = isString;
-          out = optionalString (d != "") (sep + d);
-        }
-      ] ""
-    )
-    + optionalString (v == null) "-broken";
-  append-version = p: n: p + display-pkg n "" coqPackages.${n}.version + "-";
-  prefix-name = foldl append-version "" namePrefix;
-  useDune = args.useDune or (useDuneifVersion fetched.version);
-  coqlib-flags = [
-    "COQLIBINSTALL=$(out)/lib/coq/${coq.coq-version}/user-contrib"
-    "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)"
-  ];
-  docdir-flags = [ "COQDOCINSTALL=$(out)/share/coq/${coq.coq-version}/user-contrib" ];
-  COQUSERCONTRIB = "$out/lib/coq/${coq.coq-version}/user-contrib";
-in
-stdenv.mkDerivation (
-  removeAttrs (
-    {
-
-      name = prefix-name + (display-pkg pname "-" fetched.version);
-
-      inherit (fetched) version src;
-
-      nativeBuildInputs =
-        args.overrideNativeBuildInputs or (
-          [ which ]
-          ++ optional useDune dune
-          ++ optionals (useDune || mlPlugin) [
-            coq.ocamlPackages.ocaml
-            coq.ocamlPackages.findlib
-          ]
-          ++ (args.nativeBuildInputs or [ ])
-          ++ extraNativeBuildInputs
-        );
-      buildInputs =
-        args.overrideBuildInputs or ([ coq ] ++ (args.buildInputs or [ ]) ++ extraBuildInputs);
-      inherit enableParallelBuilding;
-
-      env =
-        optionalAttrs setCOQBIN {
-          COQBIN = "${coq}/bin/";
-        }
-        // optionalAttrs (args ? useMelquiondRemake) {
-          inherit COQUSERCONTRIB;
-        }
-        // (args.env or { });
-
-      meta =
-        (
-          {
-            platforms = coq.meta.platforms;
-          }
-          // (switch domain [
-            {
-              case = pred.union isGitHubDomain isGitLabDomain;
-              out = {
-                homepage = "https://${domain}/${owner}/${repo}";
-              };
-            }
-          ] { })
-          // optionalAttrs (fetched.broken or false) {
-            coqFilter = true;
-            broken = true;
-          }
-        )
-        // (args.meta or { });
-
-    }
-    // (optionalAttrs (!args ? installPhase && !args ? useMelquiondRemake) {
-      installFlags = coqlib-flags ++ docdir-flags ++ extraInstallFlags;
-    })
-    // (optionalAttrs useDune {
-      buildPhase = ''
-        runHook preBuild
-        dune build -p ${opam-name} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
-        runHook postBuild
-      '';
-      installPhase = ''
-        runHook preInstall
-        dune install --prefix=$out --libdir $OCAMLFIND_DESTDIR ${opam-name}
-        mkdir $out/lib/coq/
-        mv $OCAMLFIND_DESTDIR/coq $out/lib/coq/${coq.coq-version}
-        runHook postInstall
-      '';
-    })
-    // (optionalAttrs (args ? useMelquiondRemake) {
-      preConfigurePhases = [ "autoconf" ];
-      configureFlags = [ "--libdir=${COQUSERCONTRIB}/${useMelquiondRemake.logpath or ""}" ];
-      buildPhase = "./remake -j$NIX_BUILD_CORES";
-      installPhase = "./remake install";
-    })
-    // (removeAttrs args args-to-remove)
-  ) dropDerivationAttrs
-)
diff --git a/pkgs/build-support/rocq/default.nix b/pkgs/build-support/rocq/default.nix
index 7a7c5fba7b25..68181efcfb44 100644
--- a/pkgs/build-support/rocq/default.nix
+++ b/pkgs/build-support/rocq/default.nix
@@ -3,15 +3,16 @@
   stdenv,
   rocqPackages,
   rocq-core,
+  coq,
   which,
   fetchzip,
   fetchurl,
   dune,
-}@args:
+}@args0:
 
 let
   lib = import ./extra-lib.nix {
-    inherit (args) lib;
+    inherit (args0) lib;
   };
 
   inherit (lib)
@@ -66,6 +67,8 @@ in
   useDuneifVersion ? (x: false),
   useDune ? false,
   opam-name ? (concatStringsSep "-" (namePrefix ++ [ pname ])),
+  useCoq ? false,
+  useCoqifVersion ? (x: false),
   ...
 }@args:
 let
@@ -99,11 +102,13 @@ let
       "dropDerivationAttrs"
       "keepAttrs"
       "env"
+      "useCoq"
+      "useCoqifVersion"
     ]
     ++ dropAttrs
   ) keepAttrs;
   fetch =
-    import ../coq/meta-fetch/default.nix
+    import ../rocq/meta-fetch/default.nix
       {
         inherit
           lib
@@ -158,6 +163,8 @@ let
   append-version = p: n: p + display-pkg n "" rocqPackages.${n}.version + "-";
   prefix-name = foldl append-version "" namePrefix;
   useDune = args.useDune or (useDuneifVersion fetched.version);
+  useCoq = args.useCoq or (useCoqifVersion fetched.version);
+  rocq-core = if useCoq then coq // { rocq-version = coq.coq-version; } else args0.rocq-core;
   rocqlib-flags = [
     "COQLIBINSTALL=$(out)/lib/coq/${rocq-core.rocq-version}/user-contrib"
     "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)"
@@ -190,9 +197,10 @@ stdenv.mkDerivation (
       inherit enableParallelBuilding;
 
       env =
-        optionalAttrs setROCQBIN {
+        optionalAttrs (setROCQBIN && !useCoq) {
           ROCQBIN = "${rocq-core}/bin/";
         }
+        // optionalAttrs (setROCQBIN && useCoq) { COQBIN = "${rocq-core}/bin/"; }
         // optionalAttrs (args ? useMelquiondRemake) {
           inherit COQUSERCONTRIB;
         }
diff --git a/pkgs/build-support/coq/meta-fetch/default.nix b/pkgs/build-support/rocq/meta-fetch/default.nix
similarity index 100%
rename from pkgs/build-support/coq/meta-fetch/default.nix
rename to pkgs/build-support/rocq/meta-fetch/default.nix
diff --git a/pkgs/development/coq-modules/coq-elpi/default.nix b/pkgs/development/coq-modules/coq-elpi/default.nix
index 76bf3682c5bc..bd751ed9d7fd 100644
--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  mkCoqDerivation,
+  mkRocqDerivation,
   which,
   dune,
   coq,
@@ -34,7 +34,9 @@ let
   propagatedBuildInputs_wo_elpi = [
     coq.ocamlPackages.findlib
   ];
-  derivation = mkCoqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
+  derivation = mkRocqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
+    useCoq = true;
+    namePrefix = [ "coq" ];
     pname = "elpi";
     repo = "coq-elpi";
     owner = "LPCIC";
diff --git a/pkgs/development/coq-modules/stalmarck/default.nix b/pkgs/development/coq-modules/stalmarck/default.nix
index 5bcdffbfa9c8..50eea900a422 100644
--- a/pkgs/development/coq-modules/stalmarck/default.nix
+++ b/pkgs/development/coq-modules/stalmarck/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  mkCoqDerivation,
+  mkRocqDerivation,
   dune,
   coq,
   stdlib,
@@ -39,7 +39,9 @@ let
         else
           "A two-level approach to prove tautologies using Stålmarck's algorithm in Coq.";
     in
-    mkCoqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
+    mkRocqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
+      useCoq = true;
+      namePrefix = [ "coq" ];
       inherit
         version
         pname
diff --git a/pkgs/development/coq-modules/vscoq-language-server/default.nix b/pkgs/development/coq-modules/vscoq-language-server/default.nix
index b20d6961eb7a..af1106de9f03 100644
--- a/pkgs/development/coq-modules/vscoq-language-server/default.nix
+++ b/pkgs/development/coq-modules/vscoq-language-server/default.nix
@@ -82,7 +82,7 @@ ocamlPackages.buildDunePackage {
     license = lib.licenses.mit;
   }
   // lib.optionalAttrs (fetched.broken or false) {
-    coqFilter = true;
+    rocqFilter = true;
     broken = true;
   };
 }
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index a93fb26666c9..ebe42498e38a 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -27,14 +27,14 @@ let
     self: coq:
     let
       callPackage = self.callPackage;
-      coqPackages = self // {
+      rocqPackages = self // {
         recurseForDerivations = false;
       };
     in
     {
-      inherit coqPackages lib;
+      inherit rocqPackages lib;
 
-      metaFetch = import ../build-support/coq/meta-fetch/default.nix {
+      metaFetch = import ../build-support/rocq/meta-fetch/default.nix {
         inherit
           lib
           stdenv
@@ -42,7 +42,16 @@ let
           fetchurl
           ;
       };
-      mkCoqDerivation = lib.makeOverridable (callPackage ../build-support/coq { });
+      mkRocqDerivation = lib.makeOverridable (callPackage ../build-support/rocq { });
+      mkCoqDerivation =
+        args:
+        self.mkRocqDerivation (
+          {
+            useCoq = true;
+            namePrefix = [ "coq" ];
+          }
+          // args
+        );
 
       coq = coq.overrideAttrs (oldAttrs: {
         passthru = (oldAttrs.passthru or { }) // {
@@ -286,7 +295,7 @@ let
         let
           v = set.${name} or null;
         in
-        lib.optional (!v.meta.coqFilter or false) (
+        lib.optional (!v.meta.rocqFilter or false) (
           lib.nameValuePair name (
             if lib.isAttrs v && v.recurseForDerivations or false then filterCoqPackages v else v
           )
diff --git a/pkgs/top-level/rocq-packages.nix b/pkgs/top-level/rocq-packages.nix
index 28b980f6dbfc..7b48e4d73079 100644
--- a/pkgs/top-level/rocq-packages.nix
+++ b/pkgs/top-level/rocq-packages.nix
@@ -26,7 +26,7 @@ let
         recurseForDerivations = false;
       };
 
-      metaFetch = import ../build-support/coq/meta-fetch/default.nix {
+      metaFetch = import ../build-support/rocq/meta-fetch/default.nix {
         inherit
           lib
           stdenv

From 962d8fb3ed9d715fcefc7b831056ca18b08e1896 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Zimmermann?= <theo.zimmermann@telecom-paris.fr>
Date: Mon, 6 Jul 2026 13:23:13 +0200
Subject: [PATCH 18/81] mkRocqDerivation: document new parameters useCoq and
 useCoqifVersion

---
 doc/languages-frameworks/rocq.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/languages-frameworks/rocq.section.md b/doc/languages-frameworks/rocq.section.md
index f2ba50312807..056394056797 100644
--- a/doc/languages-frameworks/rocq.section.md
+++ b/doc/languages-frameworks/rocq.section.md
@@ -74,6 +74,8 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `enableParallelBuilding` (optional, defaults to `true`), since it is activated by default, we provide a way to disable it.
 * `extraInstallFlags` (optional), allows to extend `installFlags` which initializes the variables `COQLIBINSTALL` and `COQPLUGININSTALL` so as to install in the proper subdirectory. Indeed Rocq libraries should be installed in `$(out)/lib/coq/${rocq-core.rocq-version}/user-contrib/`. Such directories are automatically added to the `$ROCQPATH` environment variable by the hook defined in the Rocq derivation.
 * `setROCQBIN` (optional, defaults to `true`), by default, the environment variable `$ROCQBIN` is set to the current Rocq's binary, but one can disable this behavior by setting it to `false`,
+* `useCoq` (optional, defaults to `false`), adds the Coq compatibility binaries to the build environment, which is necessary for some packages that still depend on them and sets `COQBIN` to the path of the `coqc` binary (if `setROCQBIN` is also set to `true`). A wrapper `mkCoqDerivation` is provided that sets this option to `true`.
+* `useCoqifVersion` (optional, defaults to `(x: false)`), adds the Coq compatibility binaries to the build environment if the provided predicate evaluates to true on the version. This can be useful for supporting old package versions that need the Coq compatibility binaries, while newer versions do not.
 * `useMelquiondRemake` (optional, default to `null`) is an attribute set, which, if given, overloads the `preConfigurePhases`, `configureFlags`, `buildPhase`, and `installPhase` attributes of the derivation for a specific use in libraries using `remake` as set up by Guillaume Melquiond for `flocq`, `gappalib`, `interval`, and `coquelicot` (see the corresponding derivation for concrete examples of use of this option). For backward compatibility, the attribute `useMelquiondRemake.logpath` must be set to the logical root of the library (otherwise, one can pass `useMelquiondRemake = {}` to activate this without backward compatibility).
 * `dropAttrs`, `keepAttrs`, `dropDerivationAttrs` are all optional and allow to tune which attribute is added or removed from the final call to `mkDerivation`.
 

From a8fae3743bcd5420bdabd99ede2372caa0b9f00f Mon Sep 17 00:00:00 2001
From: augustinSorel <sorelaugustin@gmail.com>
Date: Sat, 11 Jul 2026 02:11:48 +0200
Subject: [PATCH 19/81] sqruff: 0.38.0 -> 0.39.0

---
 pkgs/by-name/sq/sqruff/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sq/sqruff/package.nix b/pkgs/by-name/sq/sqruff/package.nix
index ec57b60a3b6f..a6bdd732a3cd 100644
--- a/pkgs/by-name/sq/sqruff/package.nix
+++ b/pkgs/by-name/sq/sqruff/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sqruff";
-  version = "0.38.0";
+  version = "0.39.0";
 
   src = fetchFromGitHub {
     owner = "quarylabs";
     repo = "sqruff";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-khIP3CtrWcMWIuLcKwDOhwfnJ2FfpffQNqphNpWtzOs=";
+    hash = "sha256-1ynG6A5sGHnCfAfw6MjSTghLPmicRvWPFWnL2Gtns7Y=";
   };
 
-  cargoHash = "sha256-9u8U7rWm6jOlxky8+y4ptPRnBBEBWWcg4QO0jbLAk5E=";
+  cargoHash = "sha256-HAeF831rPODaT5nzzq+Li8xEmT78IJiRppaKUSlPXXg=";
 
   # Disable the `python` feature which doesn't work on Nix yet
   buildNoDefaultFeatures = true;
@@ -32,6 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       crates/cli/tests/fix_parse_errors.rs \
       crates/cli/tests/fix_return_code.rs \
       crates/cli/tests/ignore_data_directory.rs \
+      crates/cli/tests/none_format.rs \
       crates/cli/tests/verbose_logging_ignore.rs \
       crates/cli/tests/ui_github.rs \
       crates/cli/tests/ui_json.rs \

From ab974121fdd70a93bb54b0e341b014923f98717a Mon Sep 17 00:00:00 2001
From: 4evy <git@evy.pink>
Date: Sat, 11 Jul 2026 10:00:00 +0300
Subject: [PATCH 20/81] itsycal: build from source

---
 ...001-Allow-running-from-the-Nix-store.patch |  29 +++
 ...-self-update-controls-for-Nix-builds.patch | 124 ++++++++++
 ...modern-ServiceManagement-login-items.patch | 116 +++++++++
 ...ilable-on-the-Nixpkgs-macOS-baseline.patch |  90 +++++++
 pkgs/by-name/it/itsycal/package.nix           | 224 +++++++++++++++++-
 pkgs/by-name/it/itsycal/update.sh             |  20 --
 6 files changed, 570 insertions(+), 33 deletions(-)
 create mode 100644 pkgs/by-name/it/itsycal/0001-Allow-running-from-the-Nix-store.patch
 create mode 100644 pkgs/by-name/it/itsycal/0002-Remove-self-update-controls-for-Nix-builds.patch
 create mode 100644 pkgs/by-name/it/itsycal/0003-Use-modern-ServiceManagement-login-items.patch
 create mode 100644 pkgs/by-name/it/itsycal/0004-Use-APIs-available-on-the-Nixpkgs-macOS-baseline.patch
 delete mode 100755 pkgs/by-name/it/itsycal/update.sh

diff --git a/pkgs/by-name/it/itsycal/0001-Allow-running-from-the-Nix-store.patch b/pkgs/by-name/it/itsycal/0001-Allow-running-from-the-Nix-store.patch
new file mode 100644
index 000000000000..dc11f42f160d
--- /dev/null
+++ b/pkgs/by-name/it/itsycal/0001-Allow-running-from-the-Nix-store.patch
@@ -0,0 +1,29 @@
+From 9ce5e368c00ed887f6d2628d4e8eff664bff5522 Mon Sep 17 00:00:00 2001
+From: 4evy <git@evy.pink>
+Date: Sat, 11 Jul 2026 01:12:36 +0300
+Subject: [PATCH 1/4] Allow running from the Nix store
+
+Upstream normally requires the bundle to live in /Applications because its
+Sparkle updater needs a stable, writable installation path. Nix applications
+instead live in the immutable Nix store and are updated by Nix.
+
+Use upstream's existing kAllowOutsideApplicationsFolder escape hatch as the
+registered default. This preserves upstream's check and keeps the downstream
+change to one explicit policy setting.
+---
+ Itsycal/AppDelegate.m | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/Itsycal/AppDelegate.m b/Itsycal/AppDelegate.m
+index 5cc187a..ee256d9 100644
+--- a/Itsycal/AppDelegate.m
++++ b/Itsycal/AppDelegate.m
+@@ -42,6 +42,8 @@
+         kThemePreference:      @0, // System=0, Light=1, Dark=2
+         kHideIcon:             @(NO),
+         kShowLocation:         @(NO),
++        // Nix installs the app in the immutable Nix store, not /Applications.
++        kAllowOutsideApplicationsFolder: @(YES),
+         kEnableTahoeMenuIcons: @(NO),
+         kDoNotDrawOutlineAroundCurrentMonth: @(NO)
+     }];
diff --git a/pkgs/by-name/it/itsycal/0002-Remove-self-update-controls-for-Nix-builds.patch b/pkgs/by-name/it/itsycal/0002-Remove-self-update-controls-for-Nix-builds.patch
new file mode 100644
index 000000000000..de244f092ff6
--- /dev/null
+++ b/pkgs/by-name/it/itsycal/0002-Remove-self-update-controls-for-Nix-builds.patch
@@ -0,0 +1,124 @@
+From f1474c9b296a3fbef30ca577dbd9a92224290b97 Mon Sep 17 00:00:00 2001
+From: 4evy <git@evy.pink>
+Date: Sat, 11 Jul 2026 01:12:47 +0300
+Subject: [PATCH 2/4] Remove self-update controls for Nix builds
+
+Sparkle cannot replace an application inside the immutable Nix store. Leaving
+its menu item and preference checkbox backed by a no-op stub is misleading.
+
+Remove the updater object, imports, controls, action, and matching Tahoe menu
+symbol so the Nix build has no Sparkle runtime dependency or non-functional
+update UI.
+---
+ Itsycal/Base.lproj/MainMenu.xib |  1 -
+ Itsycal/PrefsGeneralVC.m        | 11 ++---------
+ Itsycal/ViewController.m        |  9 ---------
+ 3 files changed, 2 insertions(+), 19 deletions(-)
+
+diff --git a/Itsycal/Base.lproj/MainMenu.xib b/Itsycal/Base.lproj/MainMenu.xib
+index aa2067e..1a25048 100644
+--- a/Itsycal/Base.lproj/MainMenu.xib
++++ b/Itsycal/Base.lproj/MainMenu.xib
+@@ -89,6 +89,5 @@
+                 </menuItem>
+             </items>
+         </menu>
+-        <customObject id="9Zs-J5-87v" customClass="SUUpdater"/>
+     </objects>
+ </document>
+diff --git a/Itsycal/PrefsGeneralVC.m b/Itsycal/PrefsGeneralVC.m
+index 7c19942..86f6be0 100644
+--- a/Itsycal/PrefsGeneralVC.m
++++ b/Itsycal/PrefsGeneralVC.m
+@@ -9,7 +9,6 @@
+ #import "MoVFLHelper.h"
+ #import "EventCenter.h"
+ #import "MASShortcut/Shortcut.h"
+-#import "Sparkle/SUUpdater.h"
+ 
+ static NSString * const kSourceCellId = @"SourceCell";
+ static NSString * const kCalendarCellId = @"CalendarCell";
+@@ -33,7 +32,6 @@ static NSString * const kCalendarCellId = @"CalendarCell";
+ {
+     NSTextField *_title;
+     NSButton *_login;
+-    NSButton *_checkUpdates;
+     NSButton *_beepBeep;
+     NSPopUpButton *_firstDayPopup;
+     NSTableView *_calendarsTV;
+@@ -66,7 +64,6 @@ static NSString * const kCalendarCellId = @"CalendarCell";
+     // Checkboxes
+     _login = chkbx(NSLocalizedString(@"Launch at login", @""));
+     _login.action = @selector(launchAtLogin:);
+-    _checkUpdates = chkbx(NSLocalizedString(@"Automatically check for updates", @""));
+     _beepBeep = chkbx(NSLocalizedString(@"Beep beep on the hour", @""));
+ 
+     // First day of week label
+@@ -130,10 +127,9 @@ static NSString * const kCalendarCellId = @"CalendarCell";
+                                      NSLocalizedString(@"31 days", @"")]];
+     [v addSubview:_agendaDaysPopup];
+ 
+-    MoVFLHelper *vfl = [[MoVFLHelper alloc] initWithSuperview:v metrics:@{@"m": @20} views:NSDictionaryOfVariableBindings(_login, _checkUpdates, _beepBeep, firstDayLabel, _firstDayPopup, shortcutLabel, shortcutView, tvContainer, agendaDaysLabel, _agendaDaysPopup)];
+-    [vfl :@"V:|-m-[_login]-[_checkUpdates]-[_beepBeep]-20-[_firstDayPopup]-20-[shortcutLabel]-3-[shortcutView(25)]-20-[tvContainer(170)]-[_agendaDaysPopup]-m-|"];
++    MoVFLHelper *vfl = [[MoVFLHelper alloc] initWithSuperview:v metrics:@{@"m": @20} views:NSDictionaryOfVariableBindings(_login, _beepBeep, firstDayLabel, _firstDayPopup, shortcutLabel, shortcutView, tvContainer, agendaDaysLabel, _agendaDaysPopup)];
++    [vfl :@"V:|-m-[_login]-[_beepBeep]-20-[_firstDayPopup]-20-[shortcutLabel]-3-[shortcutView(25)]-20-[tvContainer(170)]-[_agendaDaysPopup]-m-|"];
+     [vfl :@"H:|-m-[_login]-(>=m)-|"];
+-    [vfl :@"H:|-m-[_checkUpdates]-(>=m)-|"];
+     [vfl :@"H:|-m-[_beepBeep]-(>=m)-|"];
+     [vfl :@"H:|-m-[firstDayLabel]-[_firstDayPopup]-(>=m)-|" :NSLayoutFormatAlignAllFirstBaseline];
+     [vfl :@"H:|-(>=m)-[shortcutLabel]-(>=m)-|"];
+@@ -144,9 +140,6 @@ static NSString * const kCalendarCellId = @"CalendarCell";
+     // Center shortcutLabel
+     [v addConstraint:[NSLayoutConstraint constraintWithItem:shortcutLabel attribute:NSLayoutAttributeCenterX relatedBy:NSLayoutRelationEqual toItem:v attribute:NSLayoutAttributeCenterX multiplier:1 constant:0]];
+ 
+-    // Binding for Sparkle automatic update checks
+-    [_checkUpdates bind:@"value" toObject:[SUUpdater sharedUpdater] withKeyPath:@"automaticallyChecksForUpdates" options:@{NSContinuouslyUpdatesValueBindingOption: @(YES)}];
+-    
+     // Binding for hourly beep
+     [_beepBeep bind:@"value" toObject:[NSUserDefaultsController sharedUserDefaultsController] withKeyPath:[@"values." stringByAppendingString:kBeepBeepOnTheHour] options:@{NSContinuouslyUpdatesValueBindingOption: @(YES)}];
+     
+diff --git a/Itsycal/ViewController.m b/Itsycal/ViewController.m
+index 1d55c4f..0bd303b 100644
+--- a/Itsycal/ViewController.m
++++ b/Itsycal/ViewController.m
+@@ -21,7 +21,6 @@
+ #import "MoButton.h"
+ #import "MoVFLHelper.h"
+ #import "MoUtils.h"
+-#import "Sparkle/SUUpdater.h"
+ 
+ @implementation ViewController
+ {
+@@ -378,7 +377,6 @@
+     NSInteger i = 0;
+ 
+     [optMenu insertItemWithTitle:NSLocalizedString(@"About Itsycal", @"") action:@selector(showAbout:) keyEquivalent:@"" atIndex:i++];
+-    [optMenu insertItemWithTitle:NSLocalizedString(@"Check for Updates…", @"") action:@selector(checkForUpdates:) keyEquivalent:@"" atIndex:i++];
+     [optMenu insertItem:[NSMenuItem separatorItem] atIndex:i++];
+     [optMenu insertItemWithTitle:NSLocalizedString(@"Go to Date…", @"") action:@selector(showDatePickerPopover:) keyEquivalent:@"T" atIndex:i++];
+     [optMenu insertItem:[NSMenuItem separatorItem] atIndex:i++];
+@@ -394,7 +392,6 @@
+         NSInteger index = 0;
+         NSArray *symbolNames = @[
+             @"info.circle",
+-            @"arrow.trianglehead.2.clockwise",
+             @"21.calendar",
+             @"gear",
+             @"calendar.badge.clock",
+@@ -462,11 +459,6 @@
+     [self.prefsWC showWindow:self];
+ }
+ 
+-- (void)checkForUpdates:(id)sender
+-{
+-    [[SUUpdater sharedUpdater] checkForUpdates:self];
+-}
+-
+ - (void)openDateAndTimePrefs:(id)sender
+ {
+     NSURL *url = nil;
+@@ -1514,4 +1506,3 @@
+ }
+ 
+ @end
+-
diff --git a/pkgs/by-name/it/itsycal/0003-Use-modern-ServiceManagement-login-items.patch b/pkgs/by-name/it/itsycal/0003-Use-modern-ServiceManagement-login-items.patch
new file mode 100644
index 000000000000..44a67ce1d791
--- /dev/null
+++ b/pkgs/by-name/it/itsycal/0003-Use-modern-ServiceManagement-login-items.patch
@@ -0,0 +1,116 @@
+From d3d2dd9ce8b566496503c38158199432a5ae87bb Mon Sep 17 00:00:00 2001
+From: 4evy <git@evy.pink>
+Date: Sat, 11 Jul 2026 01:12:47 +0300
+Subject: [PATCH 3/4] Use modern ServiceManagement login items
+
+LSSharedFileList was deprecated in macOS 10.11 and its status lookup can fail
+when disconnected network volumes are present. Nixpkgs now targets macOS 14,
+so no legacy fallback is needed.
+
+Use SMAppService.mainAppService, available since macOS 13. Treat
+RequiresApproval as registered so users can still turn the pending login item
+off. The package signs the complete app bundle after fixup, as required by
+ServiceManagement.
+---
+ Itsycal/MoLoginItem.m    | 58 +++++++---------------------------------
+ Itsycal/PrefsGeneralVC.m | 12 +--------
+ 2 files changed, 11 insertions(+), 59 deletions(-)
+
+diff --git a/Itsycal/MoLoginItem.m b/Itsycal/MoLoginItem.m
+index 7efa602..0dc4960 100644
+--- a/Itsycal/MoLoginItem.m
++++ b/Itsycal/MoLoginItem.m
+@@ -4,60 +4,22 @@
+ //
+ 
+ #import "MoLoginItem.h"
+-
+-// LSSharedFileList API was deprecated in macOS 10.11
+-#pragma clang diagnostic push
+-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
++#import <ServiceManagement/ServiceManagement.h>
+ 
+ BOOL MOIsLoginItemEnabled(void)
+ {
+-    BOOL isEnabled = NO;
+-    NSString *appPath = [[NSBundle mainBundle] bundlePath];
+-    LSSharedFileListRef loginItemsRef = LSSharedFileListCreate(NULL, kLSSharedFileListSessionLoginItems, NULL);
+-
+-    if (loginItemsRef) {
+-        UInt32 seedValue;
+-        NSArray *loginItems = CFBridgingRelease(LSSharedFileListCopySnapshot(loginItemsRef, &seedValue));
+-        for (id item in loginItems) {
+-            LSSharedFileListItemRef itemRef = (__bridge LSSharedFileListItemRef)item;
+-            NSURL *pathURL = CFBridgingRelease(LSSharedFileListItemCopyResolvedURL(itemRef, 0, NULL));
+-            if (pathURL && [pathURL.path hasPrefix:appPath]) {
+-                isEnabled = YES;
+-                break;
+-            }
+-        }
+-        CFRelease(loginItemsRef);
+-    }
+-    return isEnabled;
++    SMAppServiceStatus status = SMAppService.mainAppService.status;
++    return status == SMAppServiceStatusEnabled || status == SMAppServiceStatusRequiresApproval;
+ }
+ 
+ void MOEnableLoginItem(BOOL enable)
+ {
+-    NSString *appPath = [[NSBundle mainBundle] bundlePath];
+-    LSSharedFileListRef loginItemsRef = LSSharedFileListCreate(NULL, kLSSharedFileListSessionLoginItems, NULL);
+-
+-    if (loginItemsRef) {
+-        if (enable) {
+-            // We call LSSharedFileListInsertItemURL to insert the item at the bottom of Login Items list.
+-            CFURLRef url = (__bridge CFURLRef)[NSURL fileURLWithPath:appPath];
+-            LSSharedFileListItemRef item = LSSharedFileListInsertItemURL(loginItemsRef, kLSSharedFileListItemLast, NULL, NULL, url, NULL, NULL);
+-            if (item != NULL) CFRelease(item);
+-        }
+-        else {
+-            // Grab the contents of the shared file list (LSSharedFileListItemRef objects)
+-            // and pop it in an array so we can iterate through it to find our item.
+-            UInt32 seedValue;
+-            NSArray *loginItems = CFBridgingRelease(LSSharedFileListCopySnapshot(loginItemsRef, &seedValue));
+-            for (id item in loginItems) {
+-                LSSharedFileListItemRef itemRef = (__bridge LSSharedFileListItemRef)item;
+-                NSURL *pathURL = CFBridgingRelease(LSSharedFileListItemCopyResolvedURL(itemRef, 0, NULL));
+-                if (pathURL && [pathURL.path hasPrefix:appPath]) {
+-                    LSSharedFileListItemRemove(loginItemsRef, itemRef); // Deleting the item
+-                }
+-            }
+-        }
+-        CFRelease(loginItemsRef);
++    SMAppService *service = SMAppService.mainAppService;
++    NSError *error = nil;
++    BOOL succeeded = enable
++        ? [service registerAndReturnError:&error]
++        : [service unregisterAndReturnError:&error];
++    if (!succeeded) {
++        NSLog(@"Unable to %@ launch at login: %@", enable ? @"enable" : @"disable", error);
+     }
+ }
+-
+-#pragma clang diagnostic pop
+diff --git a/Itsycal/PrefsGeneralVC.m b/Itsycal/PrefsGeneralVC.m
+index 86f6be0..ecfd30d 100644
+--- a/Itsycal/PrefsGeneralVC.m
++++ b/Itsycal/PrefsGeneralVC.m
+@@ -158,17 +158,7 @@ static NSString * const kCalendarCellId = @"CalendarCell";
+     
+     _sourcesAndCalendars = [self.ec sourcesAndCalendars];
+     
+-    // The API used to check the login item's state (LSSharedFileList) causes
+-    // errors for users who have network drives but are not connected to their
+-    // network (github.com/sfsam/Itsycal/issues/15). Give them an option to
+-    // disable this check.
+-    if ([[NSUserDefaults standardUserDefaults] boolForKey:@"DoNotCheckLoginItemStatus"] == NO) {
+-        _login.hidden = NO;
+-        _login.state = MOIsLoginItemEnabled() ? NSControlStateValueOn : NSControlStateValueOff;
+-    }
+-    else {
+-        _login.hidden = YES;
+-    }
++    _login.state = MOIsLoginItemEnabled() ? NSControlStateValueOn : NSControlStateValueOff;
+     
+     _calendarsTV.enabled = self.ec.calendarAccessGranted;
+     _agendaDaysPopup.enabled = self.ec.calendarAccessGranted;
diff --git a/pkgs/by-name/it/itsycal/0004-Use-APIs-available-on-the-Nixpkgs-macOS-baseline.patch b/pkgs/by-name/it/itsycal/0004-Use-APIs-available-on-the-Nixpkgs-macOS-baseline.patch
new file mode 100644
index 000000000000..21cd84f9f0e2
--- /dev/null
+++ b/pkgs/by-name/it/itsycal/0004-Use-APIs-available-on-the-Nixpkgs-macOS-baseline.patch
@@ -0,0 +1,90 @@
+From 6fb6ac13a8deee492449442e1ab3d7429aa9fff8 Mon Sep 17 00:00:00 2001
+From: 4evy <git@evy.pink>
+Date: Sat, 11 Jul 2026 01:12:55 +0300
+Subject: [PATCH 4/4] Use APIs available on the Nixpkgs macOS baseline
+
+The package metadata and Mach-O deployment target are both macOS 14. Remove
+compatibility branches for older systems and use the corresponding current
+APIs:
+
+* request EventKit full access directly;
+* discover the calendar handler through NSWorkspace and
+  UniformTypeIdentifiers;
+* use the renamed CoreAudio main-element constant.
+---
+ Itsycal/EventCenter.m    | 20 ++------------------
+ Itsycal/ViewController.m |  9 ++++-----
+ 2 files changed, 6 insertions(+), 23 deletions(-)
+
+diff --git a/Itsycal/EventCenter.m b/Itsycal/EventCenter.m
+index 148c631..3862630 100644
+--- a/Itsycal/EventCenter.m
++++ b/Itsycal/EventCenter.m
+@@ -59,15 +59,7 @@ static NSString *kSelectedCalendars = @"SelectedCalendars";
+         _queueIsol = dispatch_queue_create("com.mowglii.Itsycal.queueIsol", DISPATCH_QUEUE_SERIAL);
+         _queueIsol2 = dispatch_queue_create("com.mowglii.Itsycal.queueIsol2", DISPATCH_QUEUE_SERIAL);
+         _store = [EKEventStore new];
+-#if MAC_OS_X_VERSION_MAX_ALLOWED >= 140000
+-        if (@available(macOS 14.0, *)) {
+-            [_store requestFullAccessToEventsWithCompletion:requestCompletionHandler];
+-        } else {
+-            [_store requestAccessToEntityType:EKEntityTypeEvent completion:requestCompletionHandler];
+-        }
+-#else
+-        [_store requestAccessToEntityType:EKEntityTypeEvent completion:requestCompletionHandler];
+-#endif
++        [_store requestFullAccessToEventsWithCompletion:requestCompletionHandler];
+ 
+         // Refetch everything when the event store has changed.
+         __weak __typeof(self) weakSelf = self;
+@@ -85,15 +77,7 @@ static NSString *kSelectedCalendars = @"SelectedCalendars";
+ #pragma mark - Public (main thread)
+ 
+ - (BOOL)calendarAccessGranted {
+-#if MAC_OS_X_VERSION_MAX_ALLOWED >= 140000
+-    if (@available(macOS 14.0, *)) {
+-        return [EKEventStore authorizationStatusForEntityType:EKEntityTypeEvent] == EKAuthorizationStatusFullAccess;
+-    } else {
+-        return [EKEventStore authorizationStatusForEntityType:EKEntityTypeEvent] == EKAuthorizationStatusAuthorized;
+-    }
+-#else
+-    return [EKEventStore authorizationStatusForEntityType:EKEntityTypeEvent] == EKAuthorizationStatusAuthorized;
+-#endif
++    return [EKEventStore authorizationStatusForEntityType:EKEntityTypeEvent] == EKAuthorizationStatusFullAccess;
+ }
+ 
+ - (NSString *)defaultCalendarIdentifier {
+diff --git a/Itsycal/ViewController.m b/Itsycal/ViewController.m
+index 0bd303b..a887682 100644
+--- a/Itsycal/ViewController.m
++++ b/Itsycal/ViewController.m
+@@ -21,6 +21,7 @@
+ #import "MoButton.h"
+ #import "MoVFLHelper.h"
+ #import "MoUtils.h"
++#import <UniformTypeIdentifiers/UniformTypeIdentifiers.h>
+ 
+ @implementation ViewController
+ {
+@@ -319,10 +320,8 @@
+     // Determine the default calendar app.
+     // See: support.busymac.com/help/21535-busycal-url-handler
+     
+-    CFStringRef strRef = UTTypeCreatePreferredIdentifierForTag(kUTTagClassFilenameExtension, CFSTR("ics"), kUTTypeData);
+-    CFStringRef bundleID = LSCopyDefaultRoleHandlerForContentType(strRef, kLSRolesEditor);
+-    CFRelease(strRef);
+-    NSString *defaultCalendarAppBundleID = CFBridgingRelease(bundleID);
++    NSURL *defaultCalendarAppURL = [NSWorkspace.sharedWorkspace URLForApplicationToOpenContentType:UTTypeCalendarEvent];
++    NSString *defaultCalendarAppBundleID = [NSBundle bundleWithURL:defaultCalendarAppURL].bundleIdentifier;
+     
+     // Use URL scheme to open BusyCal or Fantastical2 on the
+     // date selected in our calendar.
+@@ -1263,7 +1262,7 @@
+     AudioObjectPropertyAddress propertyAddress;
+     propertyAddress.mSelector = kAudioHardwarePropertyDefaultOutputDevice;
+     propertyAddress.mScope    = kAudioObjectPropertyScopeGlobal;
+-    propertyAddress.mElement  = kAudioObjectPropertyElementMaster;
++    propertyAddress.mElement  = kAudioObjectPropertyElementMain;
+ 
+     OSStatus result = AudioObjectGetPropertyData(kAudioObjectSystemObject, &propertyAddress, 0, NULL, &dataSize, &deviceID);
+ 
diff --git a/pkgs/by-name/it/itsycal/package.nix b/pkgs/by-name/it/itsycal/package.nix
index 18542c37f049..78b7fcb4bd51 100644
--- a/pkgs/by-name/it/itsycal/package.nix
+++ b/pkgs/by-name/it/itsycal/package.nix
@@ -1,42 +1,240 @@
 {
   lib,
-  fetchzip,
-  stdenvNoCC,
+  stdenv,
+  fetchFromGitHub,
+  actool,
+  ibtool,
+  lld,
+  makeWrapper,
+  rcodesign,
+  re-plistbuddy,
+  nix-update-script,
 }:
 
-stdenvNoCC.mkDerivation (finalAttrs: {
+let
+  # Upstream ships MASShortcut only as a prebuilt framework. Build the
+  # maintained Rectangle fork instead; it adds F20 and macOS Tahoe fixes while
+  # retaining the API and bundle identity used by Itsycal.
+  masShortcutSrc = fetchFromGitHub {
+    owner = "rxhanson";
+    repo = "MASShortcut";
+    rev = "2f9fbb3f959b7a683c6faaf9638d22afad37a235";
+    hash = "sha256-EZLt7ph24L1wwFEMlltuPutId09RBug/y9OtDhixIig=";
+  };
+
+  masShortcutSources = [
+    "Model/MASShortcut.m"
+    "Model/MASShortcutValidator.m"
+    "Monitoring/MASHotKey.m"
+    "Monitoring/MASShortcutMonitor.m"
+    "UI/MASLocalization.m"
+    "UI/MASShortcutView.m"
+    "UI/MASShortcutView+Bindings.m"
+    "UI/MASShortcutViewButtonCell.m"
+    "User Defaults Storage/MASDictionaryTransformer.m"
+    "User Defaults Storage/MASShortcutBinder.m"
+  ];
+
+  masShortcutInfoPlist = lib.generators.toPlist { escape = true; } {
+    CFBundleDevelopmentRegion = "English";
+    CFBundleExecutable = "MASShortcut";
+    CFBundleIdentifier = "com.github.shpakovski.MASShortcut";
+    CFBundleInfoDictionaryVersion = "6.0";
+    CFBundleName = "MASShortcut";
+    CFBundlePackageType = "FMWK";
+    CFBundleShortVersionString = "2.4.0";
+    CFBundleVersion = "2.4.0";
+    NSHumanReadableCopyright = "Copyright © Vadim Shpakovski. All rights reserved.";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "itsycal";
   version = "0.15.12";
 
-  src = fetchzip {
-    url = "https://itsycal.s3.amazonaws.com/Itsycal-${finalAttrs.version}.zip";
-    hash = "sha256-2Xu1ZQnNl0o2/AYOIjxZPDnc0TxMXrqKej7CCZEVV9I=";
-    stripRoot = false;
+  src = fetchFromGitHub {
+    owner = "sfsam";
+    repo = "Itsycal";
+    tag = finalAttrs.version;
+    hash = "sha256-K25oG8d+OauNHLkatLLskfcWCqOmM2WEw2Ygd3v1uqE=";
   };
 
+  patches = [
+    # Use upstream's hidden escape hatch for installations outside /Applications.
+    ./0001-Allow-running-from-the-Nix-store.patch
+    # Nix owns updates, so remove the otherwise non-functional Sparkle UI.
+    ./0002-Remove-self-update-controls-for-Nix-builds.patch
+    # Replace the deprecated LSSharedFileList implementation with SMAppService.
+    ./0003-Use-modern-ServiceManagement-login-items.patch
+    # The Nixpkgs Darwin baseline is macOS 14; use its non-deprecated APIs.
+    ./0004-Use-APIs-available-on-the-Nixpkgs-macOS-baseline.patch
+  ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    actool
+    ibtool
+    lld
+    makeWrapper
+    rcodesign
+    re-plistbuddy
+  ];
+
+  # The classic open-source ld64 crashes while linking MASShortcut on arm64.
+  # Keep lld until the cctools linker can link this framework reliably.
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
+  dontConfigure = true;
+
+  postPatch = ''
+    # Both upstream frameworks contain native code. MASShortcut is rebuilt
+    # below and Sparkle is removed by patch 0002, so make accidental reuse fail.
+    rm -rf Itsycal/_frameworks
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    buildDir="$PWD/build"
+    mkdir -p "$buildDir/module-cache"
+
+    # actool accepts one catalog, while upstream keeps images and colors in
+    # separate catalogs. Merge them without changing their contents.
+    cp -R Itsycal/Images.xcassets "$buildDir/Assets.xcassets"
+    cp -R Itsycal/Colors.xcassets/*.colorset "$buildDir/Assets.xcassets/"
+
+    # Compile .m -> .o; flags before --, sources after. Sets _objects array
+    compile_objc() {
+      local prefix="$1"; shift
+      local -a flags=()
+      while [[ "$1" != "--" ]]; do flags+=("$1"); shift; done; shift
+      _objects=()
+      for src in "$@"; do
+        local obj="$buildDir/''${prefix}_$(basename "$src" .m).o"
+        clang -fobjc-arc "''${flags[@]}" -c "$src" -o "$obj"
+        _objects+=("$obj")
+      done
+    }
+
+    link_dylib() {
+      local name="$1"; shift
+      clang -dynamiclib -fobjc-arc \
+        -install_name "@rpath/$name.framework/$name" "$@"
+    }
+
+    # Build MASShortcut as a real framework. The explicit source list avoids
+    # pulling its demo or test targets into the application.
+    masHeaders="$buildDir/MAS_headers/MASShortcut"
+    mkdir -p "$masHeaders"
+    cp ${masShortcutSrc}/Framework/include/*.h "$masHeaders/"
+
+    masSources=( ${
+      lib.escapeShellArgs (map (src: "${masShortcutSrc}/Framework/${src}") masShortcutSources)
+    } )
+    compile_objc mas -fmodules -fmodules-cache-path="$buildDir/module-cache" \
+      -I"$masHeaders" -include AppKit/AppKit.h -- "''${masSources[@]}"
+    link_dylib MASShortcut -framework AppKit -framework Carbon \
+      -compatibility_version 1 -current_version 2.4.0 \
+      -o "$buildDir/MASShortcut.dylib" "''${_objects[@]}"
+
+    # Itsycal
+    compile_objc app -fmodules -fmodules-cache-path="$buildDir/module-cache" \
+      -I"$buildDir/MAS_headers" -IItsycal -- Itsycal/*.m
+    clang -fobjc-arc \
+      -framework AppKit -framework EventKit -framework ScriptingBridge \
+      -framework Carbon -framework ServiceManagement -framework UniformTypeIdentifiers \
+      -Wl,-rpath,@executable_path/../Frameworks \
+      "$buildDir/MASShortcut.dylib" \
+      -o "$buildDir/Itsycal" "''${_objects[@]}"
+
+    runHook postBuild
+  '';
+
   installPhase = ''
     runHook preInstall
 
-    mkdir -p "$out/Applications"
-    cp -R Itsycal.app "$out/Applications/"
+    appDir="$out/Applications/Itsycal.app/Contents"
+    mkdir -p "$appDir"/{MacOS,Frameworks,Resources}
+
+    cp "$buildDir/Itsycal" "$appDir/MacOS/Itsycal"
+
+    # Assemble the framework bundle metadata normally generated by Xcode.
+    mkdir -p "$appDir/Frameworks/MASShortcut.framework/Resources"
+    cp "$buildDir/MASShortcut.dylib" "$appDir/Frameworks/MASShortcut.framework/MASShortcut"
+    cp -r ${masShortcutSrc}/Framework/Resources/*.lproj "$appDir/Frameworks/MASShortcut.framework/Resources/"
+    printf '%s' ${lib.escapeShellArg masShortcutInfoPlist} \
+      > "$appDir/Frameworks/MASShortcut.framework/Resources/Info.plist"
+
+    # Resources
+    ibtool --compile "$appDir/Resources/MainMenu.nib" Itsycal/Base.lproj/MainMenu.xib
+    actool --compile "$appDir/Resources" \
+      --platform macosx \
+      --minimum-deployment-target ${stdenv.hostPlatform.darwinMinVersion} \
+      --app-icon AppIcon \
+      --output-partial-info-plist "$buildDir/asset-info.plist" \
+      "$buildDir/Assets.xcassets"
+    cp Itsycal/beep.mp3 "$appDir/Resources/"
+    mkdir -p "$appDir/Resources/Fonts"
+    cp Itsycal/_fonts/Mow.otf "$appDir/Resources/Fonts/"
+    for lproj in Itsycal/*.lproj; do
+      mkdir -p "$appDir/Resources/$(basename "$lproj")"
+      cp "$lproj"/*.strings "$appDir/Resources/$(basename "$lproj")/" 2>/dev/null || true
+    done
+
+    # Resolve the Xcode variables in upstream's plist. Keeping that plist as
+    # the source of truth means new privacy and bundle metadata is preserved.
+    bundleVersion=$(sed -n 's/.*CURRENT_PROJECT_VERSION = \([0-9]*\);/\1/p' \
+      Itsycal.xcodeproj/project.pbxproj | head -1)
+    cp Itsycal/Info.plist "$appDir/Info.plist"
+    substituteInPlace "$appDir/Info.plist" \
+      --replace-fail '$(EXECUTABLE_NAME)' 'Itsycal' \
+      --replace-fail '$(PRODUCT_BUNDLE_IDENTIFIER)' 'com.mowglii.ItsycalApp' \
+      --replace-fail '$(PRODUCT_NAME)' 'Itsycal' \
+      --replace-fail '$(MARKETING_VERSION)' '${finalAttrs.version}' \
+      --replace-fail '$(CURRENT_PROJECT_VERSION)' "$bundleVersion" \
+      --replace-fail '$(MACOSX_DEPLOYMENT_TARGET)' '${stdenv.hostPlatform.darwinMinVersion}'
+
+    # Merge actool's icon metadata and remove the Sparkle configuration that
+    # no longer has a consumer in this immutable Nix build.
+    PlistBuddy -c 'Set :CFBundleIconFile AppIcon' \
+      -c 'Add :CFBundleIconName string AppIcon' \
+      -c 'Delete :SUAllowsAutomaticUpdates' \
+      -c 'Delete :SUEnableAutomaticChecks' \
+      -c 'Delete :SUFeedURL' \
+      -c 'Delete :SUPublicEDKey' \
+      -c 'Delete :SUScheduledCheckInterval' \
+      "$appDir/Info.plist"
+
+    makeWrapper "$out/Applications/Itsycal.app/Contents/MacOS/Itsycal" "$out/bin/itsycal"
 
     runHook postInstall
   '';
 
-  passthru = {
-    updateScript = ./update.sh;
+  # Signing only Mach-O files leaves app resources unsealed. Sign the complete
+  # bundle after fixup so ServiceManagement accepts it and nested code verifies.
+  postFixup = ''
+    rcodesign sign "$out/Applications/Itsycal.app"
+  '';
+
+  passthru.updateScript = nix-update-script {
+    # Ignore upstream's non-version "help" tag.
+    extraArgs = [ "--version-regex=^([0-9]+\\.[0-9]+\\.[0-9]+)$" ];
   };
 
   meta = {
     changelog = "https://www.mowglii.com/itsycal/versionhistory.html";
     description = "Tiny menu bar calendar";
     homepage = "https://www.mowglii.com/itsycal/";
-    license = lib.licenses.mit;
+    license = with lib.licenses; [
+      bsd2
+      mit
+    ];
+    mainProgram = "itsycal";
     maintainers = with lib.maintainers; [
       eclairevoyant
       _4evy
     ];
     platforms = lib.platforms.darwin;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
   };
 })
diff --git a/pkgs/by-name/it/itsycal/update.sh b/pkgs/by-name/it/itsycal/update.sh
deleted file mode 100755
index cd176cc46860..000000000000
--- a/pkgs/by-name/it/itsycal/update.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl xq-xml common-updater-scripts
-
-set -eu
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/package.nix"
-if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find package.nix in $ROOT"
-  exit 1
-fi
-
-LATEST_VERSION="$(curl -Ls https://www.mowglii.com/itsycal/versionhistory.html | xq -m -q 'h4' -a 'id' | head -n1)"
-
-if [ -z "$LATEST_VERSION" ]; then
-    echo "ERROR: Failed to scrape the latest version."
-    exit 1
-fi
-
-update-source-version itsycal "$LATEST_VERSION" --file="$NIX_DRV"

From 9062f8508bbb24f9346e921d68caee006b636f24 Mon Sep 17 00:00:00 2001
From: fernvenue <git@fernvenue.com>
Date: Sat, 11 Jul 2026 16:07:29 +0800
Subject: [PATCH 21/81] maintainers: add fernvenue

---
 maintainers/maintainer-list.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 30952dd7302a..a09379f2efd2 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9021,6 +9021,11 @@
     githubId = 5198058;
     name = "Udo Sauer";
   };
+  fernvenue = {
+    github = "fernvenue";
+    githubId = 84565547;
+    name = "fernvenue";
+  };
   feyorsh = {
     email = "george@feyor.sh";
     github = "Feyorsh";

From 70c02714a576de21c0d53223ecec7bc740dac765 Mon Sep 17 00:00:00 2001
From: fernvenue <git@fernvenue.com>
Date: Sat, 11 Jul 2026 16:08:36 +0800
Subject: [PATCH 22/81] wg-ddns: 1.3 -> 1.4

---
 pkgs/by-name/wg/wg-ddns/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/wg/wg-ddns/package.nix b/pkgs/by-name/wg/wg-ddns/package.nix
index 16cef33ce71a..5c34fdf41eae 100644
--- a/pkgs/by-name/wg/wg-ddns/package.nix
+++ b/pkgs/by-name/wg/wg-ddns/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "wg-ddns";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "fernvenue";
     repo = "wg-ddns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BV57jidn6bPWU/IhhQvIeMF4xHtTm2WZKm4MQRSMM5Y=";
+    hash = "sha256-Djh/H/PlpwVeJ3T2V/xG8AAJNznYmStCQEMd5uh38us=";
   };
 
-  vendorHash = "sha256-VfSLrWuvJF4XwAW2BQGxh+3v9RiWmPdysw/nIdt2A9M=";
+  vendorHash = "sha256-oJOpf7PPQvb5z7nqpW0YjOhsF0UiWt/nlwBvF2SdzsY=";
 
   meta = {
     description = "Lightweight tool that provides DDNS dynamic DNS support for WireGuard";

From 33b55146e83a21dc5a0a4f75fd6569eec6c084ce Mon Sep 17 00:00:00 2001
From: fernvenue <git@fernvenue.com>
Date: Sat, 11 Jul 2026 16:19:30 +0800
Subject: [PATCH 23/81] wg-ddns: add fernvenue as maintainer

---
 pkgs/by-name/wg/wg-ddns/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/wg/wg-ddns/package.nix b/pkgs/by-name/wg/wg-ddns/package.nix
index 5c34fdf41eae..28c72055b8f5 100644
--- a/pkgs/by-name/wg/wg-ddns/package.nix
+++ b/pkgs/by-name/wg/wg-ddns/package.nix
@@ -21,7 +21,10 @@ buildGoModule (finalAttrs: {
     description = "Lightweight tool that provides DDNS dynamic DNS support for WireGuard";
     homepage = "https://github.com/fernvenue/wg-ddns";
     license = lib.licenses.gpl3Only;
-    maintainers = [ lib.maintainers.bdim404 ];
+    maintainers = [
+      lib.maintainers.fernvenue
+      lib.maintainers.bdim404
+    ];
     platforms = lib.platforms.unix;
     mainProgram = "wg-ddns";
   };

From dbb79fa1d5e419c8f994699a3f6b89ac95fe9969 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 09:07:31 +0000
Subject: [PATCH 24/81] hcli: 0.18.3 -> 0.18.5

---
 pkgs/development/python-modules/ida-hcli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ida-hcli/default.nix b/pkgs/development/python-modules/ida-hcli/default.nix
index aa8e33bf764b..a8ffdb60c9ec 100644
--- a/pkgs/development/python-modules/ida-hcli/default.nix
+++ b/pkgs/development/python-modules/ida-hcli/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ida-hcli";
-  version = "0.18.3";
+  version = "0.18.5";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
     owner = "HexRaysSA";
     repo = "ida-hcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5ymjKms3qtprIwd81PpmXgewDi4jSLlblgD/9b8Kzt8=";
+    hash = "sha256-n8hLgVgxqaU7Au6HVgOEUKOm1LV3Wx/v42gi2gOD3Jk=";
   };
 
   build-system = [ setuptools ];

From 33af6228446171965a3b4be64489a47442c74f48 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 09:17:35 +0000
Subject: [PATCH 25/81] python3Packages.llama-index-vector-stores-qdrant:
 0.10.1 -> 0.10.2

---
 .../llama-index-vector-stores-qdrant/default.nix              | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
index ee42db423b63..ba2671c93115 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-qdrant";
-  version = "0.10.1";
+  version = "0.10.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_vector_stores_qdrant";
     inherit version;
-    hash = "sha256-/vTKhBHD4zY2qrz4g5Qf3nqdbeqkUlTugGJ/LQ/79VE=";
+    hash = "sha256-MSK2RJAce1jmFv2eftT9HsJgTGPxuFxdatRIIK8ym+I=";
   };
 
   build-system = [ hatchling ];

From a16dfad27cb7a488ad93949ad398479dee92adf7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 11 Jul 2026 11:41:47 +0200
Subject: [PATCH 26/81] python3Packages.llama-index-vector-stores-qdrant:
 migrate to finalAttrs

---
 .../llama-index-vector-stores-qdrant/default.nix            | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
index ba2671c93115..ff9abeaf063a 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
@@ -8,14 +8,14 @@
   qdrant-client,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "llama-index-vector-stores-qdrant";
   version = "0.10.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_vector_stores_qdrant";
-    inherit version;
+    inherit (finalAttrs) version;
     hash = "sha256-MSK2RJAce1jmFv2eftT9HsJgTGPxuFxdatRIIK8ym+I=";
   };
 
@@ -35,4 +35,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From 9809dd6533b961fb57841cc326fb78cf1311cf6b Mon Sep 17 00:00:00 2001
From: Holiu <165534185+Holiu618@users.noreply.github.com>
Date: Sat, 11 Jul 2026 17:42:51 +0800
Subject: [PATCH 27/81] gcx: 0.4.3 -> 0.4.4

---
 pkgs/by-name/gc/gcx/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gc/gcx/package.nix b/pkgs/by-name/gc/gcx/package.nix
index 67fd9803b791..644851da09d0 100644
--- a/pkgs/by-name/gc/gcx/package.nix
+++ b/pkgs/by-name/gc/gcx/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gcx";
-  version = "0.4.3";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "gcx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nSopsew5QMOs/QyJg7TzALokZagIGCjxMCNsairB5PA=";
+    hash = "sha256-yPxSRg9PLfHwfv4bCTaxgvRD6UHD4A5qh68c2Dxcpn0=";
   };
 
-  vendorHash = "sha256-JioNpEqGFxD6Gg84ZZ/9OrETxTGn2V+HMlGGiiZfeIo=";
+  vendorHash = "sha256-PevzovryzpNap8dzruYWdk07M5g9jlA8QPQcrXnO7xk=";
 
   subPackages = [ "cmd/gcx" ];
 

From f202e643821235bbc2dc3a5de2d1bae3f28aa63c Mon Sep 17 00:00:00 2001
From: vomba <hani.harzallah@elastisys.com>
Date: Sat, 11 Jul 2026 15:18:46 +0200
Subject: [PATCH 28/81] code-cursor: 3.9.16 -> 3.11.13

https://cursor.com/changelog

Cap build-time vscodeVersion for ripgrep path selection so the
notarized macOS app bundle is not modified during the build.

Assisted-by: Cursor (Composer)
---
 pkgs/by-name/co/code-cursor/package.nix  |  9 ++++++++-
 pkgs/by-name/co/code-cursor/sources.json | 20 ++++++++++----------
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/co/code-cursor/package.nix b/pkgs/by-name/co/code-cursor/package.nix
index 3cfeb5cbdad4..419426e61a34 100644
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@@ -24,7 +24,14 @@ let
 in
 (buildVscode rec {
   inherit commandLineArgs useVSCodeRipgrep;
-  inherit (sourcesJson) version vscodeVersion;
+  inherit (sourcesJson) version;
+  # Cursor reports vscode >= 1.122 but still ships @vscode/ripgrep.
+  # Capping the build-time vscodeVersion avoids modifying the notarized app bundle on Darwin.
+  vscodeVersion =
+    if lib.versionAtLeast sourcesJson.vscodeVersion "1.122.0" then
+      "1.121.0"
+    else
+      sourcesJson.vscodeVersion;
 
   pname = "cursor";
 
diff --git a/pkgs/by-name/co/code-cursor/sources.json b/pkgs/by-name/co/code-cursor/sources.json
index 29774683e1bb..31ac9cbdd27f 100644
--- a/pkgs/by-name/co/code-cursor/sources.json
+++ b/pkgs/by-name/co/code-cursor/sources.json
@@ -1,22 +1,22 @@
 {
-  "version": "3.9.16",
-  "vscodeVersion": "1.105.1",
+  "version": "3.11.13",
+  "vscodeVersion": "1.125.0",
   "sources": {
     "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/linux/x64/Cursor-3.9.16-x86_64.AppImage",
-      "hash": "sha256-dG61VYGMHPip57ldzNICEi1yPc4s1dON+MlDGiKadKc="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/linux/x64/Cursor-3.11.13-x86_64.AppImage",
+      "hash": "sha256-MXBXgGe7HXiL3kAMKxBSRTZxWMbh15D5dfXw6iemG9g="
     },
     "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/linux/arm64/Cursor-3.9.16-aarch64.AppImage",
-      "hash": "sha256-7tkupyy8EFeOpzQqoHQsYxWQlFoW6VBpXkuCJsRIhRw="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/linux/arm64/Cursor-3.11.13-aarch64.AppImage",
+      "hash": "sha256-UCjZFxXjzeovYrZWp6xrZGp+eH4uGo41Tl9Uj9q16W4="
     },
     "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-5sAj/FiPAs1facGmNKgXiNzs1Kc1ht9eXYU1aZ1VoUA="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-FbSBuRaWKjTD7vdg0GvFsizmbpNvnNyzB6yAljMAtSs="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-pnSsOvyFiBKJsPUPkfnSY1l+LEzz3g5kbepIco7dDIM="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-j1k40mFZDWnNTl/IwCB39JZ+Zc4/JwEthNh8SPCXAZE="
     }
   }
 }

From fe103807efad953959c5aa994dd9c4de14a7423e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 15:11:04 +0000
Subject: [PATCH 29/81] python3Packages.gguf: 9775 -> 9967

---
 pkgs/development/python-modules/gguf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gguf/default.nix b/pkgs/development/python-modules/gguf/default.nix
index 9b216bc0cf79..de939ee1ad7c 100644
--- a/pkgs/development/python-modules/gguf/default.nix
+++ b/pkgs/development/python-modules/gguf/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gguf";
-  version = "9775";
+  version = "9967";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-y//hC8lpHjyFA3UK6hmcwkzb99xCZyZRMRILo+Y7Ap4=";
+    hash = "sha256-HgptebnnT3xOU26/UJCqQ6FSrhcoybju7SKUy4pLOKA=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/gguf-py";

From cfe0fbd57e38ad39f7fadf9468514aeff19e015f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 16:30:08 +0000
Subject: [PATCH 30/81] python3Packages.tesla-fleet-api: 1.5.1 -> 1.6.4

---
 pkgs/development/python-modules/tesla-fleet-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tesla-fleet-api/default.nix b/pkgs/development/python-modules/tesla-fleet-api/default.nix
index beef86aafa30..4fe8846e4a5e 100644
--- a/pkgs/development/python-modules/tesla-fleet-api/default.nix
+++ b/pkgs/development/python-modules/tesla-fleet-api/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "tesla-fleet-api";
-  version = "1.5.1";
+  version = "1.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Teslemetry";
     repo = "python-tesla-fleet-api";
     tag = "v${version}";
-    hash = "sha256-QQSm856y4/bL61noJ2ebPsZSAAKW3Md6/zQ+FFydri4=";
+    hash = "sha256-Z27HPmlat0GfVmTeRYmqp9HlUsuZ+5A9FStqGGFMfiw=";
   };
 
   build-system = [ setuptools ];

From 800c1a11c1b761ef50acd77653b43fc6ea226348 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 17:32:36 +0000
Subject: [PATCH 31/81] slint-tr-extractor: 1.17.0 -> 1.17.1

---
 pkgs/by-name/sl/slint-tr-extractor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sl/slint-tr-extractor/package.nix b/pkgs/by-name/sl/slint-tr-extractor/package.nix
index a09d2dff3c93..3955135e2b11 100644
--- a/pkgs/by-name/sl/slint-tr-extractor/package.nix
+++ b/pkgs/by-name/sl/slint-tr-extractor/package.nix
@@ -7,13 +7,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "slint-tr-extractor";
-  version = "1.17.0";
+  version = "1.17.1";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-sFqSO+sg9meKynCKx1hWHB691cEqF7ifUd/Q4q37vIA=";
+    hash = "sha256-ytJLH7CcfLjpzRXljTUZS1rzueBljGXwpDOpKKdBJ+k=";
   };
-  cargoHash = "sha256-+eGziYcF8+wlIw3N4n55GZ5UcI+EyqOuJ9kyz+C7nkw=";
+  cargoHash = "sha256-D+wHG+e2gVt7I7h0KobY4bLkphZJXWaTCoSp2gpNctE=";
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
 

From 7578a0a0536bcdb24c6278425d5c27d325f8a080 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 18:44:16 +0000
Subject: [PATCH 32/81] python3Packages.pyhanko: 0.35.1 -> 0.35.2

---
 pkgs/development/python-modules/pyhanko/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyhanko/default.nix b/pkgs/development/python-modules/pyhanko/default.nix
index 575cd470b4da..3cbc9a1422b0 100644
--- a/pkgs/development/python-modules/pyhanko/default.nix
+++ b/pkgs/development/python-modules/pyhanko/default.nix
@@ -39,14 +39,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyhanko";
-  version = "0.35.1";
+  version = "0.35.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MatthiasValvekens";
     repo = "pyHanko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mZ9u3mQ8JZIq+G1iwNQST8r7/rCWi/UW0j1xfeV9zFM=";
+    hash = "sha256-CY+YgUu8za5c0t2OKStKvCN9X8hVXT2sN42KSDiyMX8=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pkgs/pyhanko";

From 98c73868f6ea0dc980ad0c33841da28050b54e36 Mon Sep 17 00:00:00 2001
From: Kaleb Debre <kaleb.debre@web.de>
Date: Sat, 11 Jul 2026 23:20:50 +0200
Subject: [PATCH 33/81] shoko-webui: 2.4.1 -> 2.5.9; shoko: 5.3.1 -> 5.3.3

---
 pkgs/by-name/sh/shoko-webui/package.nix | 6 +++---
 pkgs/by-name/sh/shoko/package.nix       | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/sh/shoko-webui/package.nix b/pkgs/by-name/sh/shoko-webui/package.nix
index 5e25f5c5bf22..59a8bd7e3f95 100644
--- a/pkgs/by-name/sh/shoko-webui/package.nix
+++ b/pkgs/by-name/sh/shoko-webui/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "shoko-webui";
-  version = "2.4.1";
+  version = "2.5.9";
 
   src = fetchFromGitHub {
     owner = "ShokoAnime";
     repo = "Shoko-WebUI";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/frP6qI5xAmogb5a5AA83IJxgOhVUi6X0E4h3Qg5u6w=";
+    hash = "sha256-mHBflHehCnwCkh4K271vo30rfoQa+3xLos0d7P/kKvE=";
   };
 
   # Avoid requiring git as a build time dependency. It's used for version
@@ -32,7 +32,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-rTlem83dFptgvKUKUaHK8vi5B0FBehPFtkCUhOnUKd0=";
+    hash = "sha256-0ZXXfP6iHyd5zlUQruS3MZADkuucygXrUPRKNCNYA7k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sh/shoko/package.nix b/pkgs/by-name/sh/shoko/package.nix
index b59646aa000a..58ea54a1a5f8 100644
--- a/pkgs/by-name/sh/shoko/package.nix
+++ b/pkgs/by-name/sh/shoko/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "shoko";
-  version = "5.3.1";
+  version = "5.3.3";
 
   src = fetchFromGitHub {
     owner = "ShokoAnime";
     repo = "ShokoServer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gZK0NUwPKhrrIjdnfwNI0s618qnTf1cYBgPkwajSTEw=";
+    hash = "sha256-PJtjG4YJBgUrjBt/S2uWyKrCj1pW4N9wrLqoh2gHKcg=";
     fetchSubmodules = true;
   };
 

From ee2215499caea6ab9ab4da19fac0678864737b51 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 05:06:33 +0000
Subject: [PATCH 34/81] python3Packages.pylutron: 0.4.1 -> 0.4.2

---
 pkgs/development/python-modules/pylutron/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pylutron/default.nix b/pkgs/development/python-modules/pylutron/default.nix
index 40eaee6be67c..3c2a2c42309d 100644
--- a/pkgs/development/python-modules/pylutron/default.nix
+++ b/pkgs/development/python-modules/pylutron/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pylutron";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thecynic";
     repo = "pylutron";
     tag = finalAttrs.version;
-    hash = "sha256-bfr0Guu4rbb50arFB6fIWPSqh1hLZY0WO9mALsf8dj0=";
+    hash = "sha256-W0QiOiaUh2/kNNxdPlQLyc4HorDAxZLc+zsftNC0Ah4=";
   };
 
   postPatch = ''

From 504c64f809b591a3ff03726055008855f202855c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 06:01:11 +0000
Subject: [PATCH 35/81] cyberstrike: 1.1.14 -> 1.1.15

---
 pkgs/by-name/cy/cyberstrike/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cy/cyberstrike/package.nix b/pkgs/by-name/cy/cyberstrike/package.nix
index 8ce2972eb26e..777d5301dea2 100644
--- a/pkgs/by-name/cy/cyberstrike/package.nix
+++ b/pkgs/by-name/cy/cyberstrike/package.nix
@@ -16,7 +16,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cyberstrike";
-  version = "1.1.14";
+  version = "1.1.15";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "CyberStrikeus";
     repo = "CyberStrike";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MlFEGP/MiuDtLl7Ms6j11u1MdLV6w8T/7TYo7eeE/rc=";
+    hash = "sha256-U1yYTFZCjF3z+161CL4xyxYwcWJh5zCbGAOm/ctACSs=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -75,7 +75,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # Required so fixed-output derivation does not retain store references
     dontFixup = true;
 
-    outputHash = "sha256-IxIdzd9MJJRpc0nB5eEASSW0LIckU+SvcUgkKoL+mog=";
+    outputHash = "sha256-O5p/2+14dFt/gbONLVSvqPdNmLgQ8L+cUTGp81Rm0js=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };

From af8b2d37620ed25fd44a197e68659a7b743d9dd5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 06:27:28 +0000
Subject: [PATCH 36/81] inngest: 1.34.0 -> 1.36.0

---
 pkgs/by-name/in/inngest/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/inngest/package.nix b/pkgs/by-name/in/inngest/package.nix
index f71572ad50b6..29db5cfa0bf7 100644
--- a/pkgs/by-name/in/inngest/package.nix
+++ b/pkgs/by-name/in/inngest/package.nix
@@ -10,14 +10,14 @@
   testers,
 }:
 let
-  version = "1.34.0";
+  version = "1.36.0";
   websiteRev = "159c0ac611e85ec85ffe0a8c8bf2c4a0330bdb38";
 
   src = fetchFromGitHub {
     owner = "inngest";
     repo = "inngest";
     tag = "v${version}";
-    hash = "sha256-DMJEhgKj2glNtJmsLc3oyDZr5H/COFLrcogcgaYiLjU=";
+    hash = "sha256-KyH9Bj3n7RwARDcb3l5nerYGIIk2mgXPZWLhyNMm+f0=";
   };
 
   website = fetchFromGitHub {

From 541571a1a07ace8585ae8bcd70839c0f4a71532e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 06:37:57 +0000
Subject: [PATCH 37/81] comrak: 0.53.0 -> 0.54.0

---
 pkgs/by-name/co/comrak/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/comrak/package.nix b/pkgs/by-name/co/comrak/package.nix
index 79a1304b8aeb..efb36ff4bd01 100644
--- a/pkgs/by-name/co/comrak/package.nix
+++ b/pkgs/by-name/co/comrak/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "comrak";
-  version = "0.53.0";
+  version = "0.54.0";
 
   src = fetchFromGitHub {
     owner = "kivikakk";
     repo = "comrak";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-neiDYC1wvCCYKlSX5R1PupZiH5vP3W5bWw17+8wv6uM=";
+    sha256 = "sha256-nLyGIN5AsWJsi+RPsQqPb2DLeSVF30ZrJAcDTsBV1V8=";
   };
 
-  cargoHash = "sha256-ErZ0yD9G0i0EEafrFGP2MQoVQR/plIkJjBrfbNTeEy8=";
+  cargoHash = "sha256-CXdjr6ScUN1JehyFDlk1Fji93X5tCF5/fs4obRTBzOU=";
 
   meta = {
     description = "CommonMark-compatible GitHub Flavored Markdown parser and formatter";

From cb8b2d7ff4ceda0154df18c6c9511fba3d9fcf78 Mon Sep 17 00:00:00 2001
From: jaredmontoya <49511278+jaredmontoya@users.noreply.github.com>
Date: Sun, 12 Jul 2026 16:24:17 +0200
Subject: [PATCH 38/81] llama-cpp: remove unnecessary argument

---
 pkgs/by-name/ll/llama-cpp/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index fccffd6d249f..106822ba02d0 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -38,7 +38,6 @@
   vulkanSupport ? false,
   rpcSupport ? false,
   openssl,
-  llama-cpp,
   shaderc,
   vulkan-headers,
   vulkan-loader,

From 92b2793f8b3aafe0f2f157095828ba33c668b07f Mon Sep 17 00:00:00 2001
From: jaredmontoya <49511278+jaredmontoya@users.noreply.github.com>
Date: Sun, 12 Jul 2026 16:25:43 +0200
Subject: [PATCH 39/81] llama-cpp: do not overwrite the actual llama cli

---
 pkgs/by-name/ll/llama-cpp/package.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 106822ba02d0..65c77a6ce7ed 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -189,9 +189,6 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   # upstream plans on adding targets at the cmakelevel, remove those
   # additional steps after that
   postInstall = ''
-    # Match previous binary name for this package
-    ln -sf $out/bin/llama-cli $out/bin/llama
-
     mkdir -p $out/include
     cp $src/include/llama.h $out/include/
 

From 52d46d77f7d0cb0bc5d5a9dcb04144f228e91a73 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 15:29:56 +0000
Subject: [PATCH 40/81] search-vulns: 1.1.0 -> 1.2.1

---
 pkgs/by-name/se/search-vulns/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/se/search-vulns/package.nix b/pkgs/by-name/se/search-vulns/package.nix
index d57d17b8e414..5e4919ee1ce8 100644
--- a/pkgs/by-name/se/search-vulns/package.nix
+++ b/pkgs/by-name/se/search-vulns/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "search-vulns";
-  version = "1.1.0";
+  version = "1.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ra1nb0rn";
     repo = "search_vulns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b5WFIDxjqe4iEueOm8DyC6Z1KwChSQalppqY2CB4UW8=";
+    hash = "sha256-w4kK0/bAbWPHK6Nllhb8vCReJwiBUL6EpX/Cnt3aplg=";
     fetchSubmodules = true;
   };
 

From 5636f9347d939c2eeb98fa5f99c03d54bc969561 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 15:54:08 +0000
Subject: [PATCH 41/81] python3Packages.timezonefinder: 8.2.4 -> 8.2.5

---
 pkgs/development/python-modules/timezonefinder/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/timezonefinder/default.nix b/pkgs/development/python-modules/timezonefinder/default.nix
index 10452676e90e..5b08b95dfd11 100644
--- a/pkgs/development/python-modules/timezonefinder/default.nix
+++ b/pkgs/development/python-modules/timezonefinder/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "timezonefinder";
-  version = "8.2.4";
+  version = "8.2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jannikmi";
     repo = "timezonefinder";
     tag = finalAttrs.version;
-    hash = "sha256-f0JEnXQHhROe6jQ377xQlM21Afp1Lqs2fHfme1ah4QM=";
+    hash = "sha256-NDxGYiBYFqYU3tK/RwlHYARcncAB1GJk+qHxRNrT1oU=";
   };
 
   build-system = [ setuptools ];

From 47cff4e38cbd9d3debbc40ff3d5c0497d437bb6f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 16:23:49 +0000
Subject: [PATCH 42/81] python3Packages.caido-schema-proxy: 0.57.0 -> 0.57.1

---
 .../development/python-modules/caido-schema-proxy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/caido-schema-proxy/default.nix b/pkgs/development/python-modules/caido-schema-proxy/default.nix
index 5a0d647b5adf..9c82d272be34 100644
--- a/pkgs/development/python-modules/caido-schema-proxy/default.nix
+++ b/pkgs/development/python-modules/caido-schema-proxy/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "caido-schema-proxy";
-  version = "0.57.0";
+  version = "0.57.1";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "caido_schema_proxy";
     inherit (finalAttrs) version;
-    hash = "sha256-5hholzMKrNuJZUZIvg+phProD8OZ/YB0ZSGReGa2IqU=";
+    hash = "sha256-gIElEhHnMDfz6hu0UTOtTiYaB/ZnfeBCskEWTM9419M=";
   };
 
   build-system = [ hatchling ];

From f6cfa2ca77b39de8b9ad25c08ff36214daf9267b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 17:05:19 +0000
Subject: [PATCH 43/81] python3Packages.functions-framework: 3.10.1 -> 3.10.2

---
 .../python-modules/functions-framework/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/functions-framework/default.nix b/pkgs/development/python-modules/functions-framework/default.nix
index fa7b692b6a71..57ebbfffc618 100644
--- a/pkgs/development/python-modules/functions-framework/default.nix
+++ b/pkgs/development/python-modules/functions-framework/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "functions-framework";
-  version = "3.10.1";
+  version = "3.10.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "functions-framework-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CEH0PokH3lhyJl7OPIpJkaKZxAUp1fYVia89DtGoJ7k=";
+    hash = "sha256-JiDerfEXlamZWzHxZaTJN/QFMXSph5YDtRsZM4hb4hs=";
   };
 
   build-system = [ setuptools ];

From 627c7cc75e92a372a329991c328f853a34796f55 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sun, 12 Jul 2026 19:13:59 +0200
Subject: [PATCH 44/81] zabbix74: 7.4.11 -> 7.4.12

https://www.zabbix.com/rn/rn7.4.12

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
---
 pkgs/servers/monitoring/zabbix/versions.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/monitoring/zabbix/versions.nix b/pkgs/servers/monitoring/zabbix/versions.nix
index d2404b18e61d..7640142f5349 100644
--- a/pkgs/servers/monitoring/zabbix/versions.nix
+++ b/pkgs/servers/monitoring/zabbix/versions.nix
@@ -1,7 +1,7 @@
 generic: {
   v74 = generic {
-    version = "7.4.11";
-    hash = "sha256-uouF3zlrg76SFpxk7EAn1+HsedZzGG/0gcKqqOUka+w=";
+    version = "7.4.12";
+    hash = "sha256-LGBinl3OYfUDAmyZ2KksL2at4y7v2Ji6XZAA/enrndA=";
   };
   v70 = generic {
     version = "7.0.28";

From 141e1fceda64625892f47857d69d554f22b3c6cc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 18:01:33 +0000
Subject: [PATCH 45/81] ctx7: 0.5.3 -> 0.5.4

---
 pkgs/by-name/ct/ctx7/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ct/ctx7/package.nix b/pkgs/by-name/ct/ctx7/package.nix
index 67cca59a1728..a98087d61091 100644
--- a/pkgs/by-name/ct/ctx7/package.nix
+++ b/pkgs/by-name/ct/ctx7/package.nix
@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctx7";
-  version = "0.5.3";
+  version = "0.5.4";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upstash";
     repo = "context7";
     tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-J3FS0HPpkuriuxEyY1dluwdMovdvgWUTFgBxVUlf+GA=";
+    hash = "sha256-yyz4UraRm1JR/C7J2ib0nBU6zsNpKCWIWduTu7OlebM=";
   };
 
   nativeBuildInputs = [

From ccfaa326e0bcf5d80f15bfc43d50cb98727adc0b Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Fri, 10 Jul 2026 02:31:00 +0200
Subject: [PATCH 46/81] jenkins: 2.555.3 -> 2.568.1

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 pkgs/by-name/je/jenkins/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/je/jenkins/package.nix b/pkgs/by-name/je/jenkins/package.nix
index b6f35b371667..46338c62722f 100644
--- a/pkgs/by-name/je/jenkins/package.nix
+++ b/pkgs/by-name/je/jenkins/package.nix
@@ -18,11 +18,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "jenkins";
-  version = "2.555.3";
+  version = "2.568.1";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${finalAttrs.version}/jenkins.war";
-    hash = "sha256-XRmQXmwPI6/4n/AH3lVkuW4KBcE/TRqS0P3LabAzu5o=";
+    hash = "sha256-WPJPOWX773cIYp++FY1RvxOP/Vd8rbyGtGNn6K0L64M=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 1953bbb33657a668a4a7744517400af661a462a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 12 Jul 2026 20:59:01 +0200
Subject: [PATCH 47/81] home-assistant-custom-components.local_openai: 1.8.0 ->
 1.8.1

Diff: https://github.com/skye-harris/hass_local_openai_llm/compare/1.8.0...1.8.1

Changelog: https://github.com/skye-harris/hass_local_openai_llm/releases/tag/1.8.1
---
 .../home-assistant/custom-components/local_openai/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/local_openai/package.nix b/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
index 76abfc48cf6c..86fe23a34e6b 100644
--- a/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "skye-harris";
   domain = "local_openai";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     inherit (finalAttrs) owner;
     repo = "hass_local_openai_llm";
     tag = finalAttrs.version;
-    hash = "sha256-L5gcjKTT9KvTHCuUxg+r0mBJ+jRZqLvF9o+X+6tSH6g=";
+    hash = "sha256-42hfVQGFHWn+QBIdK9vVPM6nV+vaO8w8mo4FCsQur4I=";
   };
 
   dependencies = [

From 90c9bbb890c0e1b780ede2cfccb710f4c6b763ff Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 19:41:53 +0000
Subject: [PATCH 48/81] mympd: 25.2.2 -> 25.3.0

---
 pkgs/by-name/my/mympd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/my/mympd/package.nix b/pkgs/by-name/my/mympd/package.nix
index d5a48d238ffe..fe7cacc865d3 100644
--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "25.2.2";
+  version = "25.3.0";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-WJU0bnjC78GlrTXBixz9/pLLxvJGTvwJfIcGuF329io=";
+    sha256 = "sha256-Mx+UURIJUpIZlLq0FFuvOoUzMHhHryfNxRpNWgrpHTM=";
   };
 
   nativeBuildInputs = [

From cbbbe1d201904f91021640c105cdc6e33d37d633 Mon Sep 17 00:00:00 2001
From: Thomas Butter <tbutter@gmail.com>
Date: Sun, 12 Jul 2026 20:34:53 +0000
Subject: [PATCH 49/81] mermaid-cli: 11.12.0 -> 11.16.0

---
 pkgs/by-name/me/mermaid-cli/package.nix       |  6 +++---
 .../remove-puppeteer-from-dev-deps.patch      | 19 +++++++------------
 2 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/pkgs/by-name/me/mermaid-cli/package.nix b/pkgs/by-name/me/mermaid-cli/package.nix
index b1f24fc59e28..a8300fcdf519 100644
--- a/pkgs/by-name/me/mermaid-cli/package.nix
+++ b/pkgs/by-name/me/mermaid-cli/package.nix
@@ -7,7 +7,7 @@
   nix-update-script,
 }:
 let
-  version = "11.12.0";
+  version = "11.16.0";
 in
 buildNpmPackage {
   pname = "mermaid-cli";
@@ -17,14 +17,14 @@ buildNpmPackage {
     owner = "mermaid-js";
     repo = "mermaid-cli";
     rev = version;
-    hash = "sha256-OpYq0nOYCGTorzDxybsEjJmhL646wMBbQw3eHVxTuqU=";
+    hash = "sha256-jK87Ffsv9qeh0UPJaLTuIJYbnR9HVqjm7hWrwUaP5zA=";
   };
 
   patches = [
     ./remove-puppeteer-from-dev-deps.patch # https://github.com/mermaid-js/mermaid-cli/issues/830
   ];
 
-  npmDepsHash = "sha256-Ex+tEm13feR/Vru0CHlvM3xS5wgGlYyqANeIquvRHwM=";
+  npmDepsHash = "sha256-sOEDz8ZT2zF+TH+ZJhb+LSyyUF1HWVVLzCqtYtg7A0E=";
 
   env = {
     PUPPETEER_SKIP_DOWNLOAD = true;
diff --git a/pkgs/by-name/me/mermaid-cli/remove-puppeteer-from-dev-deps.patch b/pkgs/by-name/me/mermaid-cli/remove-puppeteer-from-dev-deps.patch
index 7c58948b97f6..1f9bbba9ba85 100644
--- a/pkgs/by-name/me/mermaid-cli/remove-puppeteer-from-dev-deps.patch
+++ b/pkgs/by-name/me/mermaid-cli/remove-puppeteer-from-dev-deps.patch
@@ -1,16 +1,11 @@
-Subject: [PATCH] remove pupperteer from dev dependencies
+Subject: [PATCH] remove puppeteer from dev dependencies
 ---
 Index: package.json
-<+>UTF-8
 ===================================================================
 diff --git a/package.json b/package.json
---- a/package.json	(revision fa593dc39619f44b57a922927a66346248f31d7d)
-+++ b/package.json	(date 1736721981718)
-@@ -45,7 +45,6 @@
-     "@tsconfig/node18": "^18.2.4",
-     "@types/node": "~18.19.31",
-     "jest": "^30.0.5",
--    "puppeteer": "^23.1.1",
-     "standard": "^17.0.0",
-     "typescript": "^5.0.1-rc",
-     "vite": "^6.0.2",
+--- a/package.json
++++ b/package.json
+@@ -47,3 +47,2 @@
+     "prettier": "^3.8.3",
+-    "puppeteer": "^25.0.0",
+     "typescript": "^6.0.3",

From dfc8eaa1321362e2e13b91a8efde20b7335e4cbe Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sun, 12 Jul 2026 13:40:06 -0700
Subject: [PATCH 50/81] python3Packages.svgdigitizer: relax deps on astropy to
 allow building

https://github.com/echemdb/svgdigitizer/issues/298
---
 pkgs/development/python-modules/svgdigitizer/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/svgdigitizer/default.nix b/pkgs/development/python-modules/svgdigitizer/default.nix
index 704a6bdb784d..7c004c5eb310 100644
--- a/pkgs/development/python-modules/svgdigitizer/default.nix
+++ b/pkgs/development/python-modules/svgdigitizer/default.nix
@@ -42,6 +42,11 @@ buildPythonPackage rec {
     setuptools
   ];
 
+  # https://github.com/echemdb/svgdigitizer/issues/298
+  pythonRelaxDeps = [
+    "astropy"
+  ];
+
   dependencies = [
     astropy
     click

From 121c8c223a6741c2fb5ce635eaa5077c0b3a626b Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sun, 12 Jul 2026 14:15:09 -0700
Subject: [PATCH 51/81] python3Packages.svgdigitizer: modernize

---
 pkgs/development/python-modules/svgdigitizer/default.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/svgdigitizer/default.nix b/pkgs/development/python-modules/svgdigitizer/default.nix
index 7c004c5eb310..e328ca34bc3a 100644
--- a/pkgs/development/python-modules/svgdigitizer/default.nix
+++ b/pkgs/development/python-modules/svgdigitizer/default.nix
@@ -26,15 +26,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "svgdigitizer";
   version = "0.14.4";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "echemdb";
     repo = "svgdigitizer";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-sDMSzoXa8RnygFjveh1SrF+bFit7OMQh2kbiZ478cM4=";
   };
 
@@ -86,8 +87,8 @@ buildPythonPackage rec {
   meta = {
     description = "Extract numerical data points from SVG files";
     homepage = "https://github.com/echemdb/svgdigitizer";
-    changelog = "https://github.com/echemdb/svgdigitizer/blob/${src.tag}/ChangeLog";
+    changelog = "https://github.com/echemdb/svgdigitizer/blob/${finalAttrs.src.tag}/ChangeLog";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ doronbehar ];
   };
-}
+})

From f23a9fa420a995a967cb2108f3c04f22c307b59b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 23:22:23 +0000
Subject: [PATCH 52/81] skim: 5.0.0 -> 5.1.0

---
 pkgs/by-name/sk/skim/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sk/skim/package.nix b/pkgs/by-name/sk/skim/package.nix
index d2a373310254..313cba00a493 100644
--- a/pkgs/by-name/sk/skim/package.nix
+++ b/pkgs/by-name/sk/skim/package.nix
@@ -11,7 +11,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "skim";
-  version = "5.0.0";
+  version = "5.1.0";
   __structuredAttrs = true;
 
   outputs = [
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "skim-rs";
     repo = "skim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fnpTEp2SXAgiK8stHR2AmRnefBDuXAS+gPoWbUDPirI=";
+    hash = "sha256-AB/73sU02/DHV/bnQXpBqmzmGy+roXyIWd4BnN6GWGw=";
   };
 
   postPatch = ''
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "expand('<sfile>:h:h')" "'$out'"
   '';
 
-  cargoHash = "sha256-o02x09q3s4qyHJcAwhgjC0/fN6xTN392D2vlkAgTReI=";
+  cargoHash = "sha256-tPNAwaefZrwhH7AoQnAkQYQUfKOKWMehHHeoUf7i4yE=";
 
   nativeBuildInputs = [ installShellFiles ];
   nativeCheckInputs = [

From 4f76c2931f80f023a695c87946cdbe262b1a0a8d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 23:34:56 +0000
Subject: [PATCH 53/81] snx-rs: 6.1.2 -> 6.2.0

---
 pkgs/by-name/sn/snx-rs/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sn/snx-rs/package.nix b/pkgs/by-name/sn/snx-rs/package.nix
index a2cc8276e9b8..52db924d889d 100644
--- a/pkgs/by-name/sn/snx-rs/package.nix
+++ b/pkgs/by-name/sn/snx-rs/package.nix
@@ -15,13 +15,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "snx-rs";
-  version = "6.1.2";
+  version = "6.2.0";
 
   src = fetchFromGitHub {
     owner = "ancwrd1";
     repo = "snx-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JhknaTqvd7Dsox38FH6mphbi+DPzVoyLlyAX6ZsqPkI=";
+    hash = "sha256-GA6YlsX2AgyorWSTPwZI84ViOG1RH9/CDSGOKzbUhHo=";
   };
 
   passthru.updateScript = nix-update-script { };
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     versionCheckHook
   ];
 
-  cargoHash = "sha256-lclSkg+WDRl3LQuzF4Q1+5zRT7UcnrasVvbcgd7wbxQ=";
+  cargoHash = "sha256-o01QwkDtbRLOjeAJhajqbWOB/rm7+/dK7t0Nzc1h/gc=";
 
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/snx-rs";

From 2fe6984e45cc9b10328169263d94723af7104f10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 13 Jul 2026 01:46:36 +0200
Subject: [PATCH 54/81] home-assistant-custom-lovelace-modules.horizon-card:
 1.4.0 -> 1.4.2

Diff: https://github.com/rejuvenate/lovelace-horizon-card/compare/v1.4.0...v1.4.2

Changelog: https://github.com/rejuvenate/lovelace-horizon-card/releases/tag/v1.4.2
---
 .../custom-lovelace-modules/horizon-card/package.nix        | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/horizon-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/horizon-card/package.nix
index 1c4aed328a8d..31f42e9f4f6f 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/horizon-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/horizon-card/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "horizon-card";
-  version = "1.4.0";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "rejuvenate";
     repo = "lovelace-horizon-card";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z2cJ6BIhNnzUo9nIFxVyrPBVWSKf35fyLXK72pE8TJw=";
+    hash = "sha256-Ja4r8x9sNH6W7LoH//zfXDlQb9W7KYFz4Y9UBoqt19s=";
   };
 
   patches = [
@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src patches;
-    hash = "sha256-KWbXvivHxoV4xQuY2m/wpajjIZcypeh6nuvRVnrtFM0=";
+    hash = "sha256-Ztb69kAGYteVevzzFOx+62LI2i4iQakI4Fwqb6G2vuM=";
   };
 
   buildPhase = ''

From dc8ffab5042f0432a6f03c845ac7177774d9a7ef Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Mon, 13 Jul 2026 00:12:45 +0000
Subject: [PATCH 55/81] linux_testing: 7.2-rc2 -> 7.2-rc3

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 81fac05ef276..c76095e59333 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "7.2-rc2",
-        "hash": "sha256:0fmmgckfjcld0ljwdz3jzc1bpkyfsj0i8q90mzzy92j07s28nffh",
+        "version": "7.2-rc3",
+        "hash": "sha256:1nf6znpalqikblq6g0yb3hp7i689frhlhb4j1yxj6nn8fvma4rwd",
         "lts": false
     },
     "6.1": {

From 94ed25df38e7cd7ba51a518476ea42b019b302d5 Mon Sep 17 00:00:00 2001
From: Tristan Ross <tristan.ross@determinate.systems>
Date: Sun, 12 Jul 2026 19:06:20 -0700
Subject: [PATCH 56/81] llvmPackages_git: 23.0.0-unstable-2026-07-05 ->
 23.0.0-unstable-2026-07-12

---
 pkgs/development/compilers/llvm/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 763afa072f32..7e0eb2cb2c21 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -28,9 +28,9 @@ let
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
     "22.1.8".officialRelease.sha256 = "sha256-SF7wFuh4kXZTytpdgX7vUZItKtRobnVICm+ixze4iG0=";
     "23.0.0-git".gitRelease = {
-      rev = "319c1f1c1132e54a2135ffe1d7c58ed7e47b5e51";
-      rev-version = "23.0.0-unstable-2026-07-05";
-      sha256 = "sha256-FM2a7MGnxE+gj4nz6sKOu+107jt9hVMUhCFVgqNyXCs=";
+      rev = "7d24dfa5f29e1794e452aadaa27f994f15568763";
+      rev-version = "23.0.0-unstable-2026-07-12";
+      sha256 = "sha256-mHiwOqEvqXyG6OoiVLRrhzb2MK7FqjQm9ez329ngbYw=";
     };
   }
   // llvmVersions;

From 3861a8ec329427dc5581357d030ba6e8106b3527 Mon Sep 17 00:00:00 2001
From: Oleksii Filonenko <github@brightone.cloud>
Date: Sun, 12 Jul 2026 18:58:55 +0100
Subject: [PATCH 57/81] container: 1.0.0 -> 1.1.0

---
 pkgs/by-name/co/container/package.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/co/container/package.nix b/pkgs/by-name/co/container/package.nix
index 19c20f2f0a07..5248cf8b0da2 100644
--- a/pkgs/by-name/co/container/package.nix
+++ b/pkgs/by-name/co/container/package.nix
@@ -12,11 +12,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "container";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchurl {
     url = "https://github.com/apple/container/releases/download/${finalAttrs.version}/container-${finalAttrs.version}-installer-signed.pkg";
-    hash = "sha256-E/RfJtqUw1Sty+/h6PdjHn8SbpPF1N1qWlOKpmtPR50=";
+    hash = "sha256-DKHEKiJpwlV++x2CsbOKxVPmo6PaGxF5xDm87h59ZxQ=";
   };
 
   nativeBuildInputs = [
@@ -67,9 +67,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     changelog = "https://github.com/apple/container/releases/tag/${finalAttrs.version}";
     license = lib.licenses.asl20;
     mainProgram = "container";
-    maintainers = with lib.maintainers; [
-      xiaoxiangmoe
-    ];
+    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
     platforms = [ "aarch64-darwin" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };

From e5e2256d453f928a112562d9a3bff3be3988a188 Mon Sep 17 00:00:00 2001
From: Oleksii Filonenko <github@brightone.cloud>
Date: Mon, 13 Jul 2026 03:15:26 +0100
Subject: [PATCH 58/81] container: add Br1ght0ne to maintainers

---
 pkgs/by-name/co/container/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/co/container/package.nix b/pkgs/by-name/co/container/package.nix
index 5248cf8b0da2..e084654d9ce8 100644
--- a/pkgs/by-name/co/container/package.nix
+++ b/pkgs/by-name/co/container/package.nix
@@ -67,7 +67,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     changelog = "https://github.com/apple/container/releases/tag/${finalAttrs.version}";
     license = lib.licenses.asl20;
     mainProgram = "container";
-    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
+    maintainers = with lib.maintainers; [
+      xiaoxiangmoe
+      Br1ght0ne
+    ];
     platforms = [ "aarch64-darwin" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };

From 72992f8463e49cf800959e6ad3422862a17d07bc Mon Sep 17 00:00:00 2001
From: Oleksii Filonenko <github@brightone.cloud>
Date: Mon, 13 Jul 2026 02:25:03 +0000
Subject: [PATCH 59/81] notion-app: 7.24.0 -> 7.25.1

---
 pkgs/by-name/no/notion-app/sources.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/no/notion-app/sources.json b/pkgs/by-name/no/notion-app/sources.json
index 9269ee50a86b..61b33e14609e 100644
--- a/pkgs/by-name/no/notion-app/sources.json
+++ b/pkgs/by-name/no/notion-app/sources.json
@@ -1,12 +1,12 @@
 {
   "x86_64-darwin": {
-    "version": "7.24.0",
-    "url": "https://desktop-release.notion-static.com/Notion-7.24.0.zip",
-    "hash": "sha512-3X7E6ZSEJMrArof7p/OgqUk4i3cewF0zMTPVhkhSgNVzOqHt9kvthGIpKUN6M/u0xdYAkRQgSWHkJ/RoA5Q6Hw=="
+    "version": "7.25.1",
+    "url": "https://desktop-release.notion-static.com/Notion-7.25.1.zip",
+    "hash": "sha512-HBhe2onWY44JbMVIfiLglyNDk1tqepwCerqbgUuI56mstBlg+B0KuepTl+plJODoTVtRasmrg/WRBw+ESWpEeg=="
   },
   "aarch64-darwin": {
-    "version": "7.24.0",
-    "url": "https://desktop-release.notion-static.com/Notion-arm64-7.24.0.zip",
-    "hash": "sha512-tQVL3z0SOMOeGaqYr4Gq1tULj/kKy4qmmsJN3uwCwDXkmenzLGCWiEmWmkK52T2xW8mMrbSBAAZGNDi0qQw5yA=="
+    "version": "7.25.1",
+    "url": "https://desktop-release.notion-static.com/Notion-arm64-7.25.1.zip",
+    "hash": "sha512-1t+hNS33R3CX+inR8ArKvm4LDn0Wu7JiCU91ucnaAgQm85XUcWFdxk/f421M9XqG1Wte+webFX45LXDlixKa2A=="
   }
 }

From 46245eb385310f844d6c366014a289018ee6e47f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 02:32:34 +0000
Subject: [PATCH 60/81] passless: 0.12.0 -> 0.13.0

---
 pkgs/by-name/pa/passless/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pa/passless/package.nix b/pkgs/by-name/pa/passless/package.nix
index 844a9ba6652d..cc28b1bbd917 100644
--- a/pkgs/by-name/pa/passless/package.nix
+++ b/pkgs/by-name/pa/passless/package.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "passless";
-  version = "0.12.0";
+  version = "0.13.0";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "pando85";
     repo = "passless";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tPlCiXokONUswwEDB2e23gR/NU6G+VYHgqfE+RyRsxw=";
+    hash = "sha256-ZfIScs+ougawn/tXK8PBme13CEdvxeL8/D38b3F/bcg=";
   };
 
-  cargoHash = "sha256-cNVmzK/W1jER6eK33JgFVnAN/6vGY4gw3GHB/H5DbIQ=";
+  cargoHash = "sha256-RpfegA8nH8chbHXHbuWMRH9drSrnBRQwYJtnw2Sqymw=";
 
   nativeBuildInputs = [
     pkg-config

From bb01c8c8fdd2ad82261964bf3aeb6bb3e6dcc12e Mon Sep 17 00:00:00 2001
From: Pradyuman Vig <me@pmn.co>
Date: Sun, 12 Jul 2026 21:55:12 -0500
Subject: [PATCH 61/81] orion-browser: init at 149

---
 pkgs/by-name/or/orion-browser/package.nix | 52 +++++++++++++++++++++++
 pkgs/by-name/or/orion-browser/update.sh   | 28 ++++++++++++
 2 files changed, 80 insertions(+)
 create mode 100644 pkgs/by-name/or/orion-browser/package.nix
 create mode 100755 pkgs/by-name/or/orion-browser/update.sh

diff --git a/pkgs/by-name/or/orion-browser/package.nix b/pkgs/by-name/or/orion-browser/package.nix
new file mode 100644
index 000000000000..280e11396949
--- /dev/null
+++ b/pkgs/by-name/or/orion-browser/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  makeWrapper,
+  unzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "orion-browser";
+  version = "149";
+
+  src = fetchurl {
+    url = "https://cdn.kagi.com/updates/26_0/${finalAttrs.version}.zip";
+    hash = "sha256-C0mtGNE9Or0alFe2Gu4LkRcHMvk1RLXZ/mUo/XtWB2g=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  unpackCmd = "unzip -q $curSrc -x '__MACOSX/*'";
+
+  nativeBuildInputs = [
+    makeWrapper
+    unzip
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications" "$out/bin"
+    cp -R Orion.app "$out/Applications"
+    makeWrapper "$out/Applications/Orion.app/Contents/MacOS/Orion" "$out/bin/orion"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "WebKit-based web browser by Kagi";
+    homepage = "https://orionbrowser.com/";
+    changelog = "https://orionbrowser.com/updates/orion-release-notes";
+    license = lib.licenses.unfree;
+    mainProgram = "orion";
+    maintainers = with lib.maintainers; [ pradyuman ];
+    platforms = [ "aarch64-darwin" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/or/orion-browser/update.sh b/pkgs/by-name/or/orion-browser/update.sh
new file mode 100755
index 000000000000..d362428fd5c5
--- /dev/null
+++ b/pkgs/by-name/or/orion-browser/update.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env nix
+#!nix shell -f ``<nixpkgs>`` curl jq libplist _7zz common-updater-scripts -c bash
+
+set -euo pipefail
+
+macos_version="26_0"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+dmg="$tmpdir/Orion.dmg"
+curl -fsSL -o "$dmg" "https://cdn.kagi.com/downloads/$macos_version/Orion.dmg"
+version="$(
+  7zz e -so "$dmg" "Orion/Orion.app/Contents/Info.plist" \
+    | plistutil -i - -f json -o - \
+    | jq -r '.CFBundleVersion'
+)"
+
+if [[ -z "$version" ]]; then
+  echo "[update] Failed to read Orion version from Info.plist" >&2
+  exit 1
+fi
+
+zip="$tmpdir/Orion.zip"
+curl -fsSL -o "$zip" "https://cdn.kagi.com/updates/$macos_version/$version.zip"
+hash="$(nix hash file --type sha256 --sri "$zip")"
+
+update-source-version orion-browser "$version" "$hash"

From 66cafe6c0f4a27f16564ebcd6934b1ac9cc48137 Mon Sep 17 00:00:00 2001
From: DuskyElf <91879372+DuskyElf@users.noreply.github.com>
Date: Sun, 12 Jul 2026 16:55:37 +0530
Subject: [PATCH 62/81] txm: init at 0.1.4

Assisted-by: pi-coding-agent/opencode-zen-big-pickle-2026-07-12
---
 pkgs/by-name/tx/txm/package.nix | 36 +++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 pkgs/by-name/tx/txm/package.nix

diff --git a/pkgs/by-name/tx/txm/package.nix b/pkgs/by-name/tx/txm/package.nix
new file mode 100644
index 000000000000..300cdec3a808
--- /dev/null
+++ b/pkgs/by-name/tx/txm/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "txm";
+  version = "0.1.4";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "thatmagicalcat";
+    repo = "txm";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-TV2vDQRH4KV+id7pPtG3Wjbfz/V60RS3wfIvKTP90iE=";
+  };
+
+  cargoHash = "sha256-ZGoIIPuDZUata7YmKOMCYcwc8Dlxo0s8W6eogK8qWsE=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terminal math rendering engine with LaTeX support";
+    homepage = "https://github.com/thatmagicalcat/txm";
+    changelog = "https://github.com/thatmagicalcat/txm/releases/tag/v${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ DuskyElf ];
+    mainProgram = "txm";
+    platforms = lib.platforms.all;
+  };
+})

From 684605e11c8d13f6f7087bf1b3c98bb2d66bd97b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 03:41:31 +0000
Subject: [PATCH 63/81] hmcl: 3.15.2 -> 3.15.3

---
 pkgs/by-name/hm/hmcl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix
index 0d4a96882331..9068be750cf3 100644
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.15.2";
+  version = "3.15.3";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/v${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-rT+RruLMz/DTlYSOMv4D6ZCOVt36iqyx42v8ea4XSdM=";
+    hash = "sha256-/7RLhSHCnxtKxmusjnrfUEweYXzOoKcQO3G9+loBofk=";
   };
 
   # - HMCL prompts users to download prebuilt Terracotta binary for

From 542f97ad56b88d6675d39f9de2158d48e0b4134f Mon Sep 17 00:00:00 2001
From: Karolis Stasaitis <contact@carlossless.io>
Date: Wed, 8 Jul 2026 19:46:58 +0200
Subject: [PATCH 64/81] kitty-bin: init at 0.47.4

---
 pkgs/by-name/ki/kitty-bin/package.nix | 52 +++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 pkgs/by-name/ki/kitty-bin/package.nix

diff --git a/pkgs/by-name/ki/kitty-bin/package.nix b/pkgs/by-name/ki/kitty-bin/package.nix
new file mode 100644
index 000000000000..f197b6819f5f
--- /dev/null
+++ b/pkgs/by-name/ki/kitty-bin/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  _7zz,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "kitty-bin";
+  version = "0.47.4";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchurl {
+    url = "https://github.com/kovidgoyal/kitty/releases/download/v${finalAttrs.version}/kitty-${finalAttrs.version}.dmg";
+    hash = "sha256-tTubGKJ9U61Eol3Wd2/ejEdIe04QOsUNaCrx7o57d+0=";
+  };
+
+  # undmg can't read the APFS dmg; -snld keeps the .app's symlinks intact.
+  nativeBuildInputs = [ _7zz ];
+  sourceRoot = ".";
+  unpackCmd = "7zz x -snld $curSrc";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications" "$out/bin"
+    cp -R kitty.app "$out/Applications/kitty.app"
+    ln -s "$out/Applications/kitty.app/Contents/MacOS/kitty" "$out/bin/kitty"
+    ln -s "$out/Applications/kitty.app/Contents/MacOS/kitten" "$out/bin/kitten"
+
+    runHook postInstall
+  '';
+
+  # leave the signed bundle untouched so its signature stays valid.
+  dontFixup = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/kovidgoyal/kitty";
+    description = "Fast, feature-rich, GPU based terminal emulator (prebuilt signed macOS app)";
+    changelog = "https://github.com/kovidgoyal/kitty/blob/v${finalAttrs.version}/docs/changelog.rst";
+    license = lib.licenses.gpl3Only;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = lib.platforms.darwin;
+    mainProgram = "kitty";
+    maintainers = with lib.maintainers; [ carlossless ];
+  };
+})

From 1f1964ac3df2ff2966c91942898204e39cc449ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Oliv=C3=A9r=20Falvai?= <ofalvai@gmail.com>
Date: Mon, 13 Jul 2026 08:17:31 +0200
Subject: [PATCH 65/81] terminal-notifier: fix darwin build

---
 pkgs/by-name/te/terminal-notifier/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/te/terminal-notifier/package.nix b/pkgs/by-name/te/terminal-notifier/package.nix
index ecfea7c2fb1d..59cd6469b99d 100644
--- a/pkgs/by-name/te/terminal-notifier/package.nix
+++ b/pkgs/by-name/te/terminal-notifier/package.nix
@@ -3,6 +3,7 @@
   fetchFromGitHub,
   ibtool,
   lib,
+  llvmPackages,
   makeBinaryWrapper,
   stdenv,
   xcbuildHook,
@@ -23,6 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
     ibtool
     makeBinaryWrapper
     xcbuildHook
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -36,6 +39,9 @@ stdenv.mkDerivation (finalAttrs: {
     "Release"
   ];
 
+  # TODO: Clean up on `staging`
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
   installPhase = ''
     runHook preInstall
 

From 08e2d92d786eb15eb97f9bb9a4c3d3136195c2f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Oliv=C3=A9r=20Falvai?= <ofalvai@gmail.com>
Date: Mon, 13 Jul 2026 08:17:31 +0200
Subject: [PATCH 66/81] rectangle: fix darwin build

---
 pkgs/by-name/re/rectangle/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/re/rectangle/package.nix b/pkgs/by-name/re/rectangle/package.nix
index 19438c2cba8d..2726452ff546 100644
--- a/pkgs/by-name/re/rectangle/package.nix
+++ b/pkgs/by-name/re/rectangle/package.nix
@@ -5,6 +5,8 @@
   darwin,
   actool,
   ibtool,
+  # TODO: Clean up on `staging`
+  llvmPackages,
   makeWrapper,
   nix-update-script,
 }:
@@ -149,6 +151,8 @@ stdenv.mkDerivation (finalAttrs: {
     ibtool
     darwin.autoSignDarwinBinariesHook
     makeWrapper
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
   ];
 
   dontConfigure = true;
@@ -161,6 +165,8 @@ stdenv.mkDerivation (finalAttrs: {
     commonSwiftFlags=(
       -O -disable-bridging-pch
       -Xlinker -platform_version -Xlinker macos -Xlinker 14.0 -Xlinker 26.0
+      # TODO: Clean up on `staging`
+      -use-ld=lld
     )
 
     nixLog "building Sparkle stub framework"
@@ -196,6 +202,8 @@ stdenv.mkDerivation (finalAttrs: {
     clang -dynamiclib "''${masObjFiles[@]}" \
       -framework AppKit -framework Carbon -framework Foundation \
       -install_name "@rpath/MASShortcut.framework/MASShortcut" \
+      # TODO: Clean up on `staging`
+      -fuse-ld=lld \
       -o "$buildDir/libMASShortcut.dylib"
 
     rectSwiftFiles=()

From 65a1f97ad77dc1c5abd38356d4288c08a0541c80 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 06:34:05 +0000
Subject: [PATCH 67/81] terraform-providers.vancluever_acme: 2.48.1 -> 2.48.3

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index ecd3d377729e..444b41041399 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1427,13 +1427,13 @@
     "vendorHash": null
   },
   "vancluever_acme": {
-    "hash": "sha256-AlT7Qe4YGdPUhM1N4OiMyjbmupgqXcQ/6SLz/v+W8lI=",
+    "hash": "sha256-CziwRMh53FPGhXw/TFWJUuI3KtMlwobCVNOgfRyjRLA=",
     "homepage": "https://registry.terraform.io/providers/vancluever/acme",
     "owner": "vancluever",
     "repo": "terraform-provider-acme",
-    "rev": "v2.48.1",
+    "rev": "v2.48.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-lWBMihP6oX7qPpTuPQQwQS3IDwdyb/rEYqtBsTozb7Q="
+    "vendorHash": "sha256-I6u4huFtk7dXmSyPRX4NxvcUJ4Q2iKuw8qzCdNzYjoQ="
   },
   "venafi_venafi": {
     "hash": "sha256-tCjeApdanKPNEy7snb6QJoCvwjpNa2fdDryoD+7wn8Y=",

From 976e3b7eb30401c2123aa485a46b2642e8d213b1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 06:46:53 +0000
Subject: [PATCH 68/81] home-assistant-custom-components.daikin_onecta: 4.6.10
 -> 4.6.12

---
 .../custom-components/daikin_onecta/package.nix               | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix b/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix
index 35fe4b9cabae..a443bc552a0b 100644
--- a/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "jwillemsen";
   domain = "daikin_onecta";
-  version = "4.6.10";
+  version = "4.6.12";
 
   src = fetchFromGitHub {
     owner = "jwillemsen";
     repo = "daikin_onecta";
     tag = "v${version}";
-    hash = "sha256-kUwtgjwDPuQ2Kce7Oi2IMXSpNuW9tBqQLKro9W0bDlU=";
+    hash = "sha256-IMYrgSB4Fyc+BEhY4+FGE9Dca7llAQgvkAiOssut04c=";
   };
 
   meta = {

From 58a0a5effc260914f00812f7987feae234c5f15f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 06:57:16 +0000
Subject: [PATCH 69/81] yffi: 0.24.0 -> 0.27.3

---
 pkgs/by-name/yf/yffi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/yf/yffi/package.nix b/pkgs/by-name/yf/yffi/package.nix
index 6bebf3fe9c20..86d102979c9e 100644
--- a/pkgs/by-name/yf/yffi/package.nix
+++ b/pkgs/by-name/yf/yffi/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yffi";
-  version = "0.24.0";
+  version = "0.27.3";
 
   src = fetchFromGitHub {
     owner = "y-crdt";
     repo = "y-crdt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RFdLEsKQxt8BGqbf5FFM7mZD64glW7bTKRJaAQOe+vo=";
+    hash = "sha256-OYqBxhpNw4LAfCLN/xBxSFuwjUV/PZvbg7Kk4AQpvvs=";
   };
 
-  cargoHash = "sha256-RL9lBc7lSmc6jOavE5lZupmaNGZgQhJBedNhjfHVajg=";
+  cargoHash = "sha256-eMGhHDcVeySESsgrP5Pj9BwsAgEe8rZHz+0FeFFp7IY=";
 
   buildAndTestSubdir = "yffi";
 

From 382fce7223a2f364d4203fe93fef4afeed02ee4f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 07:29:25 +0000
Subject: [PATCH 70/81] matrix-tuwunel: 1.8.0 -> 1.8.1

---
 pkgs/by-name/ma/matrix-tuwunel/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/matrix-tuwunel/package.nix b/pkgs/by-name/ma/matrix-tuwunel/package.nix
index d041184d9ac9..17ff9947dc4a 100644
--- a/pkgs/by-name/ma/matrix-tuwunel/package.nix
+++ b/pkgs/by-name/ma/matrix-tuwunel/package.nix
@@ -88,16 +88,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-tuwunel";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "matrix-construct";
     repo = "tuwunel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+VoJrUvjZOS3y59HbjHX0kwCT1AUvJo1jJQEC/OLYec=";
+    hash = "sha256-3qMVu+IQMzI4Jtfb8mJsuDAcd7Jb7XSU07RlvnH7vfc=";
   };
 
-  cargoHash = "sha256-906VroeI1ZjUokOWKNBcfgZLZhca87p7sQuYDwQmPDI=";
+  cargoHash = "sha256-VzmaQAsNORH8VxYSUgKeQSIgcCPnI9cAzu3K9ks7ODA=";
 
   nativeBuildInputs = [
     pkg-config

From 0afcfbb73e0c31cd07124a85e280b812f3b32275 Mon Sep 17 00:00:00 2001
From: Charlotte Hartmann Paludo <git@charlotteharludo.com>
Date: Mon, 13 Jul 2026 09:41:17 +0200
Subject: [PATCH 71/81] home-assistant-custom-components.closest_intent: 0.2.0
 -> 0.2.1

---
 .../custom-components/closest_intent/package.nix              | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/closest_intent/package.nix b/pkgs/servers/home-assistant/custom-components/closest_intent/package.nix
index 9f76fec4c9bd..4f851dfe9697 100644
--- a/pkgs/servers/home-assistant/custom-components/closest_intent/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/closest_intent/package.nix
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "charludo";
   domain = "closest_intent";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     inherit (finalAttrs) owner;
     repo = "hass-closest-intent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AvI9vX2RnN3ALQY4Q2mF3E9mkEV9VBOvk9HOH6i7RbQ=";
+    hash = "sha256-rfmQso2UJsyyCA5F+0B/7gszxy6+RUpTJtil0CxdtyY=";
   };
 
   dependencies = [

From e664c0e5dde7cb80470ab0642fe9c6d5b8423ca1 Mon Sep 17 00:00:00 2001
From: Peter Kaukov <peter@kaukov.dev>
Date: Mon, 13 Jul 2026 12:01:36 +0300
Subject: [PATCH 72/81] ani-skip: 1.0.1 -> 1.2.1

---
 pkgs/by-name/an/ani-skip/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/an/ani-skip/package.nix b/pkgs/by-name/an/ani-skip/package.nix
index 2cb08aba8adb..aee0d02e5436 100644
--- a/pkgs/by-name/an/ani-skip/package.nix
+++ b/pkgs/by-name/an/ani-skip/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "ani-skip";
-  version = "1.0.1";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "synacktraa";
     repo = "ani-skip";
     tag = finalAttrs.version;
-    hash = "sha256-VEEG3d6rwTAS7/+gBKHFKIg9zFfBu5eBOu6Z23621gM=";
+    hash = "sha256-8EXJIY/YqTe2H0JDX/feMISCnHl2zs1LnvBkEk7Sss0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -30,7 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    install -D skip.lua $out/share/mpv/scripts/skip.lua
+    install -D integrations/mpv.lua $out/share/mpv/scripts/skip.lua
     install -Dm 755 ani-skip $out/bin/ani-skip
 
     runHook postInstall

From 080b6cb2cdde1a58ff2701dfb422f467ac6e2bb2 Mon Sep 17 00:00:00 2001
From: gamma3591 <thomas.houdin@protonmail.com>
Date: Mon, 13 Jul 2026 11:59:19 +0200
Subject: [PATCH 73/81] tinygo: Change Go version in tinygo build from 1.25 to
 1.26

---
 pkgs/by-name/ti/tinygo/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ti/tinygo/package.nix b/pkgs/by-name/ti/tinygo/package.nix
index e62935a3fc6b..817d6ce5e72d 100644
--- a/pkgs/by-name/ti/tinygo/package.nix
+++ b/pkgs/by-name/ti/tinygo/package.nix
@@ -1,11 +1,11 @@
 {
   stdenv,
   lib,
-  buildGo125Module,
+  buildGo126Module,
   fetchFromGitHub,
   makeWrapper,
   llvmPackages_20,
-  go_1_25,
+  go_1_26,
   xar,
   binaryen,
   avrdude,
@@ -18,8 +18,8 @@
 let
   # nixpkgs typically updates default llvm and go versions faster than tinygo releases
   # which ends up breaking this build. Use fixed versions for each release.
-  buildGoModule = buildGo125Module;
-  go = go_1_25;
+  buildGoModule = buildGo126Module;
+  go = go_1_26;
   llvmMajor = lib.versions.major llvm.version;
   inherit (llvmPackages_20)
     llvm

From 9c796c685f620eadfdca2a51fd5584a9c82da1fe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 10:49:38 +0000
Subject: [PATCH 74/81] copacetic: 0.14.1 -> 0.14.2

---
 pkgs/by-name/co/copacetic/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/copacetic/package.nix b/pkgs/by-name/co/copacetic/package.nix
index a689b45517b6..f1462d0ad0f8 100644
--- a/pkgs/by-name/co/copacetic/package.nix
+++ b/pkgs/by-name/co/copacetic/package.nix
@@ -12,13 +12,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "copacetic";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "project-copacetic";
     repo = "copacetic";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pD6AdJ9GfTPVgI/e4zRW4oJjOzpEk9uY4kdEm5yLDrw=";
+    hash = "sha256-MH3HSbJ+/5vjUrjFZQVf4Qv2+qAezOShxfkAoCJMnFU=";
   };
 
   vendorHash = "sha256-RKqaIwGDZj91lfbEJHcnG8RhIrixtR0VtieCfZD/rns=";

From e7a70984b1fe48c391e97a3dd69330df3da991f9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 10:54:20 +0000
Subject: [PATCH 75/81] terraform-providers.heroku_heroku: 5.3.2 -> 5.4.0

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index ecd3d377729e..02167197aa33 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -706,11 +706,11 @@
     "vendorHash": "sha256-47xWjlzpQ/EYzjbuuMKQiu5cfYAXdYkXRl+AOEP+sA4="
   },
   "heroku_heroku": {
-    "hash": "sha256-hR4DvSneqG/5P4tYljcuFxQ34AnDIjIt+JMn1BhloeU=",
+    "hash": "sha256-AmHgAlz4J3l9OCjUMVxLMWtKZB1LpNOyX1exUI6fWHA=",
     "homepage": "https://registry.terraform.io/providers/heroku/heroku",
     "owner": "heroku",
     "repo": "terraform-provider-heroku",
-    "rev": "v5.3.2",
+    "rev": "v5.4.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

From 79a589006c97368f29b0f43b61744ef5b1964307 Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Mon, 13 Jul 2026 16:37:07 +0530
Subject: [PATCH 76/81] ip2unix: fix build by using python313Packages

Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
---
 pkgs/by-name/ip/ip2unix/package.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ip/ip2unix/package.nix b/pkgs/by-name/ip/ip2unix/package.nix
index 78f9d591a9eb..5476d8ad43e7 100644
--- a/pkgs/by-name/ip/ip2unix/package.nix
+++ b/pkgs/by-name/ip/ip2unix/package.nix
@@ -2,13 +2,12 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   meson,
   ninja,
   pkg-config,
   yaml-cpp,
   systemd,
-  python3Packages,
+  python313Packages,
   asciidoc,
   libxslt,
   docbook_xml_dtd_45,
@@ -39,8 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
     docbook_xsl
     libxml2.bin
     docbook5
-    python3Packages.pytest
-    python3Packages.pytest-timeout
+    python313Packages.pytest
+    python313Packages.pytest-timeout
     systemd
   ]
   ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];

From 4aef6f76d4f610367b57d7fb9f389ca035c291df Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Fri, 10 Jul 2026 13:19:56 +0200
Subject: [PATCH 77/81] tests.problems: adjust test code for
 oldestSupportedRelease=26.05

In 53cd6f263c9a90ae02fdcabceb7db10c60e3d3cd the oldestSupportedRelease
version was bumped to 26.05 which caused the meta/problems tests to
fail because the `config.allowBrokenPredicate` is now deprecated and
the code is warning about it.
---
 .../problems/cases/allow-broken-predicate-match/default.nix     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/test/problems/cases/allow-broken-predicate-match/default.nix b/pkgs/test/problems/cases/allow-broken-predicate-match/default.nix
index 7869bc996809..df18d357e1e8 100644
--- a/pkgs/test/problems/cases/allow-broken-predicate-match/default.nix
+++ b/pkgs/test/problems/cases/allow-broken-predicate-match/default.nix
@@ -5,7 +5,7 @@ let
     system = "x86_64-linux";
     overlays = [ ];
     config = {
-      allowBrokenPredicate = attrs: lib.getName attrs == "a";
+      problems.handlers.a.broken = "ignore";
     };
   };
 in

From 00ec5f0eaf00877df594b64b379ec7ea4ba942a8 Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Fri, 10 Jul 2026 13:32:34 +0200
Subject: [PATCH 78/81] doc/release-notes: Add changelog entry for the now
 deprecated allowBrokenPredicate setting

Since 48422decc45a428cab7b4a8fbdc3b07755fd088a the old behaviour is
emitting a warning based on the latest supported release version. This
documents it.
---
 doc/release-notes/rl-2611.section.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index ce3330d0b967..c16ca66b1fca 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -142,10 +142,11 @@
 
 ### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}
 
-- Create the first release note entry in this section!
+- Setting `config.allowBrokenPredicate` is deprecated in favor of
+  using `config.problems.handlers.PackageName.broken = "warn"` (or `=
+  "ignore"`). For more information see [](#sec-allow-broken).
 
 
 ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
 
 - Create the first release note entry in this section!
-

From 1f248f342be91912eca40f657c5eabe12645d565 Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Fri, 10 Jul 2026 15:20:12 +0200
Subject: [PATCH 79/81] tests.problems: Fix `invalid-kind-error` failure

With 8fcbb3592984e1f364ec561f491790d854704264 all problem kinds are
being used in the error messages. The expected messages were still
missing the `maintainerless` kind.
---
 pkgs/test/problems/cases/invalid-kind-error/expected-stderr | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/test/problems/cases/invalid-kind-error/expected-stderr b/pkgs/test/problems/cases/invalid-kind-error/expected-stderr
index 6fdf2b1d04b1..0d7cb8f874b6 100644
--- a/pkgs/test/problems/cases/invalid-kind-error/expected-stderr
+++ b/pkgs/test/problems/cases/invalid-kind-error/expected-stderr
@@ -1,4 +1,4 @@
 (stack trace truncated; use '--show-trace' to show the full, detailed trace)
 
 error: Refusing to evaluate package 'a-0' in /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-default.nix:11 because it has an invalid meta attrset:
-  - a.meta.problems.invalid: Problem kind invalid, inferred from the problem name, is invalid; expected enum<broken,deprecated,removal>. You can specify an explicit problem kind with `a.meta.problems.invalid.kind`
+  - a.meta.problems.invalid: Problem kind invalid, inferred from the problem name, is invalid; expected enum<broken,deprecated,maintainerless,removal>. You can specify an explicit problem kind with `a.meta.problems.invalid.kind`

From 76f41a213baa367eaac012acce93eff247fd6b3c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 21:24:14 +0000
Subject: [PATCH 80/81] python3Packages.oslo-db: 18.0.0 -> 18.1.0

---
 pkgs/development/python-modules/oslo-db/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/oslo-db/default.nix b/pkgs/development/python-modules/oslo-db/default.nix
index b09352d3cf3b..3f6f9053f759 100644
--- a/pkgs/development/python-modules/oslo-db/default.nix
+++ b/pkgs/development/python-modules/oslo-db/default.nix
@@ -22,13 +22,13 @@
 
 buildPythonPackage rec {
   pname = "oslo-db";
-  version = "18.0.0";
+  version = "18.1.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "oslo_db";
     inherit version;
-    hash = "sha256-lL/zJBrTie9YZsFpGd4AWuDlud8YFO65TUAnxXUnCSM=";
+    hash = "sha256-B16GziPAwh2x01CR8dyyGwVEnInDpDJtpPLT+4MwIj8=";
   };
 
   build-system = [
@@ -44,7 +44,8 @@ buildPythonPackage rec {
     oslo-utils
     sqlalchemy
     stevedore
-  ];
+  ]
+  ++ sqlalchemy.optional-dependencies.asyncio;
 
   nativeCheckInputs = [
     aiosqlite

From 0ebc1fef63b67bb73bad00137660a6639cafd4c3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Jul 2026 12:07:59 +0000
Subject: [PATCH 81/81] sprite: 0.0.1-rc44 -> 0.0.1-rc45

---
 pkgs/by-name/sp/sprite/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/sp/sprite/package.nix b/pkgs/by-name/sp/sprite/package.nix
index 4532980a4c1c..6379d4ef9b81 100644
--- a/pkgs/by-name/sp/sprite/package.nix
+++ b/pkgs/by-name/sp/sprite/package.nix
@@ -9,7 +9,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sprite";
-  version = "0.0.1-rc44";
+  version = "0.0.1-rc45";
 
   src = fetchurl {
     url = "https://sprites-binaries.t3.storage.dev/client/v${finalAttrs.version}/sprite-${
@@ -17,10 +17,10 @@ stdenv.mkDerivation (finalAttrs: {
     }-${if stdenv.hostPlatform.isx86_64 then "amd64" else "arm64"}.tar.gz";
     hash =
       {
-        aarch64-darwin = "sha256-XMr3JZxaFFpJh+CDxZYmbfOLrIhjgYj/mqOAA6qgyoo=";
-        x86_64-darwin = "sha256-KrBmA2auCp+gJ19Cmd7Kc6fDBkgxLIYV50/wWNhz4X0=";
-        aarch64-linux = "sha256-uiTQgChPRjo/OvvcQso52YxhaKjYJ5aU9nZRPUl5hgw=";
-        x86_64-linux = "sha256-cmffpuWg9XqFH2BcSC+gJG00kqHvV532XEDOs/u0dHs=";
+        aarch64-darwin = "sha256-0EbsXuNdSC9lfTR9lQFgGk9nYg200f+tZY8xcXmqTzc=";
+        x86_64-darwin = "sha256-IA3C42wheIATCBlAFVJbq0omjPZv+rQstthCwXDUm5w=";
+        aarch64-linux = "sha256-4a7LrFWgxe5wUcPLMDvo2/HmpCnELkJSyr2nAA9RBwk=";
+        x86_64-linux = "sha256-FfWZ9PFhorfbf8/YsdcFAnpA2QtA1LqAfQiGrc8sesQ=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };