From 5c14fd3cb4d5e0744c6471c9733e380dd935270a Mon Sep 17 00:00:00 2001
From: Patrick Poitras <patrick.f.poitras@gmail.com>
Date: Sun, 1 Jun 2025 20:48:14 -0700
Subject: [PATCH 01/64] Add patch that suppresses ctrl-event-signal-change
 messages for wpa_supplicant

---
 pkgs/os-specific/linux/wpa_supplicant/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 75c17d40a0e0..d51c0bb87aed 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -34,6 +34,11 @@ stdenv.mkDerivation rec {
       revert = true;
     })
     ./unsurprising-ext-password.patch
+    (fetchpatch {
+      name = "suppress-ctrl-event-signal-change.patch";
+      url = "https://w1.fi/cgit/hostap/patch/?id=c330b5820eefa8e703dbce7278c2a62d9c69166a";
+      hash = "sha256-5ti5OzgnZUFznjU8YH8Cfktrj4YBzsbbrEbNvec+ppQ=";
+    })
   ];
 
   # TODO: Patch epoll so that the dbus actually responds

From da4672b591c45884f61e0690037b784e643cc391 Mon Sep 17 00:00:00 2001
From: Moritz Heidkamp <moritz@twoticketsplease.de>
Date: Mon, 7 Jul 2025 14:43:43 +0200
Subject: [PATCH 02/64] importNpmLock: fix native dependencies for Darwin

Essentially the same fix as 79459354cb3a003d574db2abe16a21c7dd6377ed for `buildNpmPackage`.
---
 .../build-support/node/import-npm-lock/default.nix | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/node/import-npm-lock/default.nix b/pkgs/build-support/node/import-npm-lock/default.nix
index d80643d60a32..8b8281778bc7 100644
--- a/pkgs/build-support/node/import-npm-lock/default.nix
+++ b/pkgs/build-support/node/import-npm-lock/default.nix
@@ -4,6 +4,7 @@
   stdenv,
   callPackages,
   runCommand,
+  cctools,
 }:
 
 let
@@ -204,11 +205,14 @@ lib.fix (self: {
       }
       // derivationArgs
       // {
-        nativeBuildInputs = [
-          nodejs
-          nodejs.passthru.python
-          hooks.npmConfigHook
-        ] ++ derivationArgs.nativeBuildInputs or [ ];
+        nativeBuildInputs =
+          [
+            nodejs
+            nodejs.passthru.python
+            hooks.npmConfigHook
+          ]
+          ++ lib.optionals stdenv.hostPlatform.isDarwin [ cctools ]
+          ++ derivationArgs.nativeBuildInputs or [ ];
 
         passAsFile = [
           "package"

From a1a86470e399843e4e44f47e11ab3bcfefe5d2f2 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Sat, 14 Jun 2025 02:16:44 +0200
Subject: [PATCH 03/64] nixos/network-interfaces-scripted: disable DAD

Duplicate address detection (DAD) causes newly added IPv6 addresses to
be effectively unusable for an unpredictable amount of time, introducing
race conditions in the network setup.
For example, a "tentative" addresses is not considered a valid source
address, so installing routes can fail unpredictably.

This change disables DAD for static IPv6 addresses, with the assumption
that the user already made sure they are unique when configuring the
network.
---
 nixos/modules/tasks/network-interfaces-scripted.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 7bc059d61ea6..394a43941dfa 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -240,10 +240,10 @@ let
                 ''
                   echo "${cidr}" >> $state
                   echo -n "adding address ${cidr}... "
-                  if out=$(ip addr replace "${cidr}" dev "${i.name}" 2>&1); then
+                  if out=$(ip addr replace "${cidr}" dev "${i.name}" nodad 2>&1); then
                     echo "done"
                   else
-                    echo "'ip addr replace \"${cidr}\" dev \"${i.name}\"' failed: $out"
+                    echo "'ip addr replace \"${cidr}\" dev \"${i.name}\"' nodad failed: $out"
                     exit 1
                   fi
                 ''

From 1a8c90128bb6d58addac981eaaa92d8bc9583bb8 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Sat, 14 Jun 2025 02:37:40 +0200
Subject: [PATCH 04/64] nixos/network-interfaces: add option to set source
 address

---
 .../tasks/network-interfaces-scripted.nix     | 76 +++++++++++--------
 .../tasks/network-interfaces-systemd.nix      |  3 +
 nixos/modules/tasks/network-interfaces.nix    |  8 ++
 .../networking/networkd-and-scripted.nix      | 18 ++++-
 4 files changed, 71 insertions(+), 34 deletions(-)

diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 394a43941dfa..69959e650a14 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -42,6 +42,14 @@ let
     ip link del dev "${i}" 2>/dev/null || true
   '';
 
+  formatIpArgs =
+    args:
+    lib.pipe args [
+      (lib.filterAttrs (n: v: v != null))
+      (lib.mapAttrsToList (n: v: "${n} ${toString v}"))
+      (lib.concatStringsSep " ")
+    ];
+
   # warn that these attributes are deprecated (2017-2-2)
   # Should be removed in the release after next
   bondDeprecation = rec {
@@ -160,39 +168,41 @@ let
               EOF
             ''}
 
-            # Set the default gateway.
-            ${optionalString (cfg.defaultGateway != null && cfg.defaultGateway.address != "") ''
-              ${optionalString (cfg.defaultGateway.interface != null) ''
-                ip route replace ${cfg.defaultGateway.address} dev ${cfg.defaultGateway.interface} ${
-                  optionalString (cfg.defaultGateway.metric != null) "metric ${toString cfg.defaultGateway.metric}"
-                } proto static
-              ''}
-              ip route replace default ${
-                optionalString (cfg.defaultGateway.metric != null) "metric ${toString cfg.defaultGateway.metric}"
-              } via "${cfg.defaultGateway.address}" ${
-                optionalString (
-                  cfg.defaultGatewayWindowSize != null
-                ) "window ${toString cfg.defaultGatewayWindowSize}"
-              } ${
-                optionalString (cfg.defaultGateway.interface != null) "dev ${cfg.defaultGateway.interface}"
-              } proto static
-            ''}
-            ${optionalString (cfg.defaultGateway6 != null && cfg.defaultGateway6.address != "") ''
-              ${optionalString (cfg.defaultGateway6.interface != null) ''
-                ip -6 route replace ${cfg.defaultGateway6.address} dev ${cfg.defaultGateway6.interface} ${
-                  optionalString (cfg.defaultGateway6.metric != null) "metric ${toString cfg.defaultGateway6.metric}"
-                } proto static
-              ''}
-              ip -6 route replace default ${
-                optionalString (cfg.defaultGateway6.metric != null) "metric ${toString cfg.defaultGateway6.metric}"
-              } via "${cfg.defaultGateway6.address}" ${
-                optionalString (
-                  cfg.defaultGatewayWindowSize != null
-                ) "window ${toString cfg.defaultGatewayWindowSize}"
-              } ${
-                optionalString (cfg.defaultGateway6.interface != null) "dev ${cfg.defaultGateway6.interface}"
-              } proto static
-            ''}
+            # Set the default gateway
+            ${flip concatMapStrings
+              [
+                {
+                  version = "-4";
+                  gateway = cfg.defaultGateway;
+                }
+                {
+                  version = "-6";
+                  gateway = cfg.defaultGateway6;
+                }
+              ]
+              (
+                { version, gateway }:
+                optionalString (gateway != null && gateway.address != "") ''
+                  ${optionalString (gateway.interface != null) ''
+                    ip ${version} route replace ${gateway.address} proto static ${
+                      formatIpArgs {
+                        metric = gateway.metric;
+                        dev = gateway.interface;
+                      }
+                    }
+                  ''}
+                  ip ${version} route replace default proto static ${
+                    formatIpArgs {
+                      metric = gateway.metric;
+                      via = gateway.address;
+                      window = cfg.defaultGatewayWindowSize;
+                      dev = gateway.interface;
+                      src = gateway.source;
+                    }
+                  }
+                ''
+              )
+            }
           '';
         };
 
diff --git a/nixos/modules/tasks/network-interfaces-systemd.nix b/nixos/modules/tasks/network-interfaces-systemd.nix
index 391303784969..574c558b8900 100644
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@@ -46,6 +46,9 @@ let
               // optionalAttrs (gateway.metric != null) {
                 Metric = gateway.metric;
               }
+              // optionalAttrs (gateway.source != null) {
+                PreferredSource = gateway.source;
+              }
             )
           ];
         };
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index fb8dab1c33ff..2f10bf2ec8be 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -180,6 +180,12 @@ let
           description = "The default gateway metric/preference.";
         };
 
+        source = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = "The default source address.";
+        };
+
       };
 
     };
@@ -656,6 +662,7 @@ in
       example = {
         address = "131.211.84.1";
         interface = "enp3s0";
+        source = "131.211.84.2";
       };
       type = types.nullOr (types.coercedTo types.str gatewayCoerce (types.submodule gatewayOpts));
       description = ''
@@ -669,6 +676,7 @@ in
       example = {
         address = "2001:4d0:1e04:895::1";
         interface = "enp3s0";
+        source = "2001:4d0:1e04:895::2";
       };
       type = types.nullOr (types.coercedTo types.str gatewayCoerce (types.submodule gatewayOpts));
       description = ''
diff --git a/nixos/tests/networking/networkd-and-scripted.nix b/nixos/tests/networking/networkd-and-scripted.nix
index 312981317735..da86a6e5cae9 100644
--- a/nixos/tests/networking/networkd-and-scripted.nix
+++ b/nixos/tests/networking/networkd-and-scripted.nix
@@ -39,11 +39,23 @@ let
           defaultGateway = {
             address = "192.168.1.1";
             interface = "enp1s0";
+            source = "192.168.1.3";
           };
           defaultGateway6 = {
             address = "fd00:1234:5678:1::1";
             interface = "enp1s0";
+            source = "fd00:1234:5678:1::3";
           };
+          interfaces.enp1s0.ipv6.addresses = [
+            {
+              address = "fd00:1234:5678:1::2";
+              prefixLength = 64;
+            }
+            {
+              address = "fd00:1234:5678:1::3";
+              prefixLength = 128;
+            }
+          ];
           interfaces.enp1s0.ipv4.addresses = [
             {
               address = "192.168.1.2";
@@ -89,7 +101,11 @@ let
 
         with subtest("Test default gateway"):
             client.wait_until_succeeds("ping -c 1 192.168.3.1")
-            client.wait_until_succeeds("ping -c 1 fd00:1234:5678:3::1")
+            client.wait_until_succeeds("ping -c 1 fd00:1234:5678:1::1")
+
+        with subtest("Test default addresses"):
+            client.succeed("ip -4 route show default | grep -q 'src 192.168.1.3'")
+            client.succeed("ip -6 route show default | grep -q 'src fd00:1234:5678:1::3'")
       '';
     };
     routeType = {

From 716634530e39e0423f038b464bc61427db6e4707 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Sun, 15 Jun 2025 16:55:28 +0200
Subject: [PATCH 05/64] nixos/networking-interfaces: clean up networking.sits

This change rework a bit the documentation on networking.sits to explain
what they actually are. In fact, there are three different protocols
being collectively called "SIT", which itself is a nonstandard term.
---
 .../tasks/network-interfaces-scripted.nix     | 25 ++++---
 .../tasks/network-interfaces-systemd.nix      |  2 +-
 nixos/modules/tasks/network-interfaces.nix    | 74 +++++++++++++------
 3 files changed, 65 insertions(+), 36 deletions(-)

diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 69959e650a14..0634f661c12a 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -627,7 +627,7 @@ let
               deps = deviceDependency v.dev;
             in
             {
-              description = "6-to-4 Tunnel Interface ${n}";
+              description = "IPv6 in IPv4 Tunnel Interface ${n}";
               wantedBy = [
                 "network-setup.service"
                 (subsystemDevice n)
@@ -641,18 +641,19 @@ let
               script = ''
                 # Remove Dead Interfaces
                 ip link show dev "${n}" >/dev/null 2>&1 && ip link delete dev "${n}"
-                ip link add name "${n}" type sit \
-                  ${optionalString (v.remote != null) "remote \"${v.remote}\""} \
-                  ${optionalString (v.local != null) "local \"${v.local}\""} \
-                  ${optionalString (v.ttl != null) "ttl ${toString v.ttl}"} \
-                  ${optionalString (v.dev != null) "dev \"${v.dev}\""} \
-                  ${optionalString (v.encapsulation != null)
-                    "encap ${v.encapsulation.type} encap-dport ${toString v.encapsulation.port} ${
-                      optionalString (
-                        v.encapsulation.sourcePort != null
-                      ) "encap-sport ${toString v.encapsulation.sourcePort}"
-                    }"
+                ip link add name "${n}" type sit ${
+                  formatIpArgs {
+                    inherit (v)
+                      remote
+                      local
+                      ttl
+                      dev
+                      ;
+                    encap = if v.encapsulation.type == "6in4" then null else v.encapsulation.type;
+                    encap-dport = v.encapsulation.port;
+                    encap-sport = v.encapsulation.sourcePort;
                   }
+                }
                 ip link set dev "${n}" up
               '';
               postStop = ''
diff --git a/nixos/modules/tasks/network-interfaces-systemd.nix b/nixos/modules/tasks/network-interfaces-systemd.nix
index 574c558b8900..072ed080595e 100644
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@@ -438,7 +438,7 @@ in
                   // (optionalAttrs (sit.ttl != null) {
                     TTL = sit.ttl;
                   })
-                  // (optionalAttrs (sit.encapsulation != null) (
+                  // (optionalAttrs (sit.encapsulation.type != "6in4") (
                     {
                       FooOverUDP = true;
                       Encapsulation = if sit.encapsulation.type == "fou" then "FooOverUDP" else "GenericUDPEncapsulation";
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 2f10bf2ec8be..86b2f42e5075 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -19,7 +19,8 @@ let
   hasSits = cfg.sits != { };
   hasGres = cfg.greTunnels != { };
   hasBonds = cfg.bonds != { };
-  hasFous = cfg.fooOverUDP != { } || filterAttrs (_: s: s.encapsulation != null) cfg.sits != { };
+  hasFous =
+    cfg.fooOverUDP != { } || filterAttrs (_: s: s.encapsulation.type != "6in4") cfg.sits != { };
 
   slaves =
     concatMap (i: i.interfaces) (attrValues cfg.bonds)
@@ -1153,7 +1154,8 @@ in
         }
       '';
       description = ''
-        This option allows you to define 6-to-4 interfaces which should be automatically created.
+        This option allows you to define interfaces encapsulating IPv6
+        packets within IPv4 packets; which should be automatically created.
       '';
       type =
         with types;
@@ -1197,50 +1199,76 @@ in
               '';
             };
 
-            encapsulation =
-              with types;
-              mkOption {
-                type = nullOr (submodule {
+            encapsulation = mkOption {
+              type = types.nullOr (
+                types.submodule {
                   options = {
                     type = mkOption {
-                      type = enum [
+                      type = types.enum [
+                        "6in4"
                         "fou"
                         "gue"
                       ];
+                      default = "6in4";
                       description = ''
-                        Selects encapsulation type. See
-                        {manpage}`ip-link(8)` for details.
+                        Select the encapsulation type:
+
+                        - `6in4`: the IPv6 packets are encapsulated using the
+                          6in4 protocol (formerly known as SIT, RFC 4213);
+
+                        - `gue`: the IPv6 packets are encapsulated in UDP packets
+                           using the Generic UDP Encapsulation (GUE) scheme;
+
+                        - `foo`: the IPv6 packets are encapsulated in UDP packets
+                           using the Foo over UDP (FOU) scheme.
                       '';
                     };
 
                     port = mkOption {
-                      type = port;
+                      type = types.nullOr types.port;
+                      default = null;
                       example = 9001;
                       description = ''
-                        Destination port for encapsulated packets.
+                        Destination port when using UDP encapsulation.
                       '';
                     };
 
                     sourcePort = mkOption {
-                      type = nullOr types.port;
+                      type = types.nullOr types.port;
                       default = null;
                       example = 9002;
                       description = ''
-                        Source port for encapsulated packets. Will be chosen automatically by
-                        the kernel if unset.
+                        Source port when using UDP encapsulation.
+                        Will be chosen automatically by the kernel if unset.
                       '';
                     };
                   };
-                });
-                default = null;
-                example = {
-                  type = "fou";
-                  port = 9001;
-                };
-                description = ''
-                  Configures encapsulation in UDP packets.
-                '';
+                }
+              );
+              apply =
+                x:
+                if x == null then
+                  lib.warn
+                    ''
+                      The option networking.sits.*.encapsulation no longer accepts `null`
+                      as a valid value. To fix this warning simply remove this definition.
+                    ''
+                    {
+                      type = "6in4";
+                      port = null;
+                      sourcePort = null;
+                    }
+                else
+                  x;
+              default = { };
+              example = {
+                type = "fou";
+                port = 9001;
               };
+              description = ''
+                Configures the type of encapsulation.
+              '';
+            };
 
           };
 

From 1c5b9429ea95419a5bfccf99734a89c529b4ac9c Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Sun, 15 Jun 2025 17:02:30 +0200
Subject: [PATCH 06/64] nixos/tests/networking: test both 6in4 and
 UDP-encapsulated tunnels

---
 .../networking/networkd-and-scripted.nix      | 73 ++++++++++++++++++-
 1 file changed, 70 insertions(+), 3 deletions(-)

diff --git a/nixos/tests/networking/networkd-and-scripted.nix b/nixos/tests/networking/networkd-and-scripted.nix
index da86a6e5cae9..d9b32dda44ca 100644
--- a/nixos/tests/networking/networkd-and-scripted.nix
+++ b/nixos/tests/networking/networkd-and-scripted.nix
@@ -497,7 +497,73 @@ let
           } in fous, "fou4 exists"
         '';
     };
-    sit =
+    sit-6in4 =
+      let
+        node =
+          {
+            address4,
+            remote,
+            address6,
+          }:
+          {
+            virtualisation.interfaces.enp1s0.vlan = 1;
+            networking = {
+              useNetworkd = networkd;
+              useDHCP = false;
+              sits.sit = {
+                inherit remote;
+                local = address4;
+                dev = "enp1s0";
+              };
+              nftables.enable = true;
+              firewall.extraInputRules = "meta l4proto 41 accept";
+              interfaces.enp1s0.ipv4.addresses = lib.mkOverride 0 [
+                {
+                  address = address4;
+                  prefixLength = 24;
+                }
+              ];
+              interfaces.sit.ipv6.addresses = lib.mkOverride 0 [
+                {
+                  address = address6;
+                  prefixLength = 64;
+                }
+              ];
+            };
+          };
+      in
+      {
+        name = "Sit-6in4";
+        nodes.client1 = node {
+          address4 = "192.168.1.1";
+          remote = "192.168.1.2";
+          address6 = "fc00::1";
+        };
+        nodes.client2 = node {
+          address4 = "192.168.1.2";
+          remote = "192.168.1.1";
+          address6 = "fc00::2";
+        };
+        testScript = ''
+          start_all()
+
+          with subtest("Wait for networking to be configured"):
+              client1.wait_for_unit("network.target")
+              client2.wait_for_unit("network.target")
+
+              # Print diagnostic information
+              client1.succeed("ip addr >&2")
+              client2.succeed("ip addr >&2")
+
+          with subtest("Test ipv6"):
+              client1.wait_until_succeeds("ping -c 1 fc00::1")
+              client1.wait_until_succeeds("ping -c 1 fc00::2")
+
+              client2.wait_until_succeeds("ping -c 1 fc00::1")
+              client2.wait_until_succeeds("ping -c 1 fc00::2")
+        '';
+      };
+    sit-fou =
       let
         node =
           {
@@ -532,7 +598,7 @@ let
           };
       in
       {
-        name = "Sit";
+        name = "Sit-fou";
         # note on firewalling: the two nodes are explicitly asymmetric.
         # client1 sends SIT packets in UDP, but accepts only proto-41 incoming.
         # client2 does the reverse, sending in proto-41 and accepting only UDP incoming.
@@ -547,7 +613,8 @@ let
             } args)
             {
               networking = {
-                firewall.extraCommands = "iptables -A INPUT -p 41 -j ACCEPT";
+                nftables.enable = true;
+                firewall.extraInputRules = "meta l4proto 41 accept";
                 sits.sit.encapsulation = {
                   type = "fou";
                   port = 9001;

From 4e5205a68ab124b909e16685747c6eeb066c8ee0 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Mon, 16 Jun 2025 02:38:08 +0200
Subject: [PATCH 07/64] nixos/networking-interfaces: add IPIP tunnels

---
 .../tasks/network-interfaces-scripted.nix     |  48 +++++++
 .../tasks/network-interfaces-systemd.nix      |  33 +++++
 nixos/modules/tasks/network-interfaces.nix    |  98 +++++++++++++
 .../networking/networkd-and-scripted.nix      | 134 ++++++++++++++++++
 4 files changed, 313 insertions(+)

diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 0634f661c12a..ce4395a4d2e6 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -107,6 +107,7 @@ let
             || (hasAttr dev cfg.bonds)
             || (hasAttr dev cfg.macvlans)
             || (hasAttr dev cfg.sits)
+            || (hasAttr dev cfg.ipips)
             || (hasAttr dev cfg.vlans)
             || (hasAttr dev cfg.greTunnels)
             || (hasAttr dev cfg.vswitches)
@@ -662,6 +663,52 @@ let
             }
           );
 
+        createIpipDevice =
+          n: v:
+          nameValuePair "${n}-netdev" (
+            let
+              deps = deviceDependency v.dev;
+            in
+            {
+              description = "IP in IP Tunnel Interface ${n}";
+              wantedBy = [
+                "network-setup.service"
+                (subsystemDevice n)
+              ];
+              bindsTo = deps;
+              after = [ "network-pre.target" ] ++ deps;
+              before = [ "network-setup.service" ];
+              serviceConfig.Type = "oneshot";
+              serviceConfig.RemainAfterExit = true;
+              path = [ pkgs.iproute2 ];
+              script = ''
+                # Remove Dead Interfaces
+                ip link show dev "${n}" >/dev/null 2>&1 && ip link delete dev "${n}"
+                ip tunnel add name "${n}" ${
+                  formatIpArgs {
+                    inherit (v)
+                      remote
+                      local
+                      ttl
+                      dev
+                      ;
+                    mode =
+                      {
+                        "4in6" = "ipip6";
+                        "ipip" = "ipip";
+                      }
+                      .${v.encapsulation.type};
+                    encaplimit = if v.encapsulation.type == "ipip" then null else v.encapsulation.limit;
+                  }
+                }
+                ip link set dev "${n}" up
+              '';
+              postStop = ''
+                ip link delete dev "${n}" || true
+              '';
+            }
+          );
+
         createGreDevice =
           n: v:
           nameValuePair "${n}-netdev" (
@@ -743,6 +790,7 @@ let
       // mapAttrs' createMacvlanDevice cfg.macvlans
       // mapAttrs' createFouEncapsulation cfg.fooOverUDP
       // mapAttrs' createSitDevice cfg.sits
+      // mapAttrs' createIpipDevice cfg.ipips
       // mapAttrs' createGreDevice cfg.greTunnels
       // mapAttrs' createVlanDevice cfg.vlans
       // {
diff --git a/nixos/modules/tasks/network-interfaces-systemd.nix b/nixos/modules/tasks/network-interfaces-systemd.nix
index 072ed080595e..64572a05f797 100644
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@@ -24,6 +24,7 @@ let
     concatLists (map (bond: bond.interfaces) (attrValues cfg.bonds))
     ++ concatLists (map (bridge: bridge.interfaces) (attrValues cfg.bridges))
     ++ map (sit: sit.dev) (attrValues cfg.sits)
+    ++ map (ipip: ipip.dev) (attrValues cfg.ipips)
     ++ map (gre: gre.dev) (attrValues cfg.greTunnels)
     ++ map (vlan: vlan.interface) (attrValues cfg.vlans)
     # add dependency to physical or independently created vswitch member interface
@@ -457,6 +458,38 @@ in
             }
           )
         ))
+        (mkMerge (
+          flip mapAttrsToList cfg.ipips (
+            name: ipip: {
+              netdevs."40-${name}" = {
+                netdevConfig = {
+                  Name = name;
+                  Kind = if ipip.encapsulation.type == "ipip" then "ipip" else "ip6tnl";
+                };
+                tunnelConfig =
+                  (optionalAttrs (ipip.remote != null) {
+                    Remote = ipip.remote;
+                  })
+                  // (optionalAttrs (ipip.local != null) {
+                    Local = ipip.local;
+                  })
+                  // (optionalAttrs (ipip.ttl != null) {
+                    TTL = ipip.ttl;
+                  })
+                  // (optionalAttrs (ipip.encapsulation.type != "ipip") {
+                    # IPv6 tunnel options
+                    Mode = if ipip.encapsulation.type == "4in6" then "ipip6" else "ip6ip6";
+                    EncapsulationLimit = ipip.encapsulation.type;
+                  });
+              };
+              networks = mkIf (ipip.dev != null) {
+                "40-${ipip.dev}" = {
+                  tunnel = [ name ];
+                };
+              };
+            }
+          )
+        ))
         (mkMerge (
           flip mapAttrsToList cfg.greTunnels (
             name: gre: {
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 86b2f42e5075..4c472e30068e 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1137,6 +1137,104 @@ in
         });
     };
 
+    networking.ipips = mkOption {
+      default = { };
+      example = literalExpression ''
+        {
+          wan4in6 = {
+            remote = "2001:db8::1";
+            local = "2001:db8::3";
+            dev = "wan6";
+            encapsulation.type = "4in6";
+            encapsulation.limit = 0;
+          };
+        }
+      '';
+      description = ''
+        This option allows you to define interfaces encapsulating IP
+        packets within IP packets; which should be automatically created.
+
+        For example, this allows you to create 4in6 (RFC 2473)
+        or IP within IP (RFC 2003) tunnels.
+      '';
+      type =
+        with types;
+        attrsOf (submodule {
+          options = {
+
+            remote = mkOption {
+              type = types.str;
+              example = "2001:db8::1";
+              description = ''
+                The address of the remote endpoint to forward traffic over.
+              '';
+            };
+
+            local = mkOption {
+              type = types.str;
+              example = "2001:db8::3";
+              description = ''
+                The address of the local endpoint which the remote
+                side should send packets to.
+              '';
+            };
+
+            ttl = mkOption {
+              type = types.nullOr types.int;
+              default = null;
+              example = 255;
+              description = ''
+                The time-to-live of the connection to the remote tunnel endpoint.
+              '';
+            };
+
+            dev = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              example = "wan6";
+              description = ''
+                The underlying network device on which the tunnel resides.
+              '';
+            };
+
+            encapsulation.type = mkOption {
+              type = types.enum [
+                "ipip"
+                "4in6"
+                "ip6ip6"
+              ];
+              default = "ipip";
+              description = ''
+                Select the encapsulation type:
+
+                - `ipip` to create an IPv4 within IPv4 tunnel (RFC 2003).
+
+                - `4in6` to create a 4in6 tunnel (RFC 2473);
+
+                - `ip6ip6` to create an IPv6 within IPv6 tunnel (RFC 2473);
+
+                ::: {.note}
+                For encapsulating IPv6 within IPv4 packets, see
+                the ad-hoc {option}`networking.sits` option.
+                :::
+              '';
+            };
+
+            encapsulation.limit = mkOption {
+              type = types.either (types.enum [ "none" ]) types.ints.unsigned;
+              default = 4;
+              example = "none";
+              description = ''
+                For an IPv6-based tunnel, the maximum number of nested
+                encapsulation to allow. 0 means no nesting, "none" unlimited.
+              '';
+            };
+
+          };
+
+        });
+    };
+
     networking.sits = mkOption {
       default = { };
       example = literalExpression ''
diff --git a/nixos/tests/networking/networkd-and-scripted.nix b/nixos/tests/networking/networkd-and-scripted.nix
index d9b32dda44ca..8678e6b6ee17 100644
--- a/nixos/tests/networking/networkd-and-scripted.nix
+++ b/nixos/tests/networking/networkd-and-scripted.nix
@@ -659,6 +659,140 @@ let
               client2.wait_until_succeeds("ping -c 1 fc00::2")
         '';
       };
+    ipip-4in6 =
+      let
+        node =
+          {
+            address4,
+            remote,
+            address6,
+          }:
+          {
+            virtualisation.interfaces.enp1s0.vlan = 1;
+            networking = {
+              useNetworkd = networkd;
+              useDHCP = false;
+              ipips."4in6" = {
+                inherit remote;
+                local = address6;
+                dev = "enp1s0";
+                encapsulation.type = "4in6";
+              };
+              firewall.enable = false;
+              nftables.enable = true;
+              firewall.extraInputRules = "meta l4proto ipip accept";
+              interfaces.enp1s0.ipv6.addresses = lib.mkOverride 0 [
+                {
+                  address = address6;
+                  prefixLength = 64;
+                }
+              ];
+              interfaces."4in6".ipv4.addresses = lib.mkOverride 0 [
+                {
+                  address = address4;
+                  prefixLength = 24;
+                }
+              ];
+            };
+          };
+      in
+      {
+        name = "ipip-4in6";
+        nodes.client1 = node {
+          address6 = "fc00::1";
+          address4 = "192.168.1.1";
+          remote = "fc00::2";
+        };
+        nodes.client2 = node {
+          address6 = "fc00::2";
+          address4 = "192.168.1.2";
+          remote = "fc00::1";
+        };
+        testScript = ''
+          start_all()
+
+          with subtest("Wait for networking to be configured"):
+              client1.wait_for_unit("network.target")
+              client2.wait_for_unit("network.target")
+
+              # Print diagnostic information
+              client1.succeed("ip addr >&2")
+              client2.succeed("ip addr >&2")
+
+          with subtest("Test ipv6"):
+              client1.wait_until_succeeds("ping -c 1 192.168.1.1")
+              client1.wait_until_succeeds("ping -c 1 192.168.1.2")
+
+              client2.wait_until_succeeds("ping -c 1 192.168.1.1")
+              client2.wait_until_succeeds("ping -c 1 192.168.1.2")
+        '';
+      };
+    ipip =
+      let
+        node =
+          {
+            local,
+            remote,
+            address,
+          }:
+          {
+            virtualisation.interfaces.enp1s0.vlan = 1;
+            networking = {
+              useNetworkd = networkd;
+              useDHCP = false;
+              ipips.ipip = {
+                inherit local remote;
+                dev = "enp1s0";
+                encapsulation.type = "ipip";
+              };
+              nftables.enable = true;
+              firewall.extraInputRules = "meta l4proto 4 accept";
+              interfaces.enp1s0.ipv4.addresses = lib.mkOverride 0 [
+                {
+                  address = local;
+                  prefixLength = 24;
+                }
+              ];
+              interfaces.ipip.ipv4.addresses = lib.mkOverride 0 [
+                {
+                  inherit address;
+                  prefixLength = 24;
+                }
+              ];
+            };
+          };
+      in
+      {
+        name = "ipip";
+        nodes.client1 = node {
+          local = "192.168.1.1";
+          remote = "192.168.1.2";
+          address = "192.168.10.1";
+        };
+        nodes.client2 = node {
+          local = "192.168.1.2";
+          remote = "192.168.1.1";
+          address = "192.168.10.2";
+        };
+        testScript = ''
+          start_all()
+
+          with subtest("Wait for networking to be configured"):
+              client1.wait_for_unit("network.target")
+              client2.wait_for_unit("network.target")
+
+              # Print diagnostic information
+              client1.succeed("ip addr >&2")
+              client2.succeed("ip addr >&2")
+
+          with subtest("Test IPIP tunnel"):
+              client1.wait_until_succeeds("ping -c 1 192.168.10.1")
+              client1.wait_until_succeeds("ping -c 1 192.168.10.2")
+
+              client2.wait_until_succeeds("ping -c 1 192.168.10.1")
+              client2.wait_until_succeeds("ping -c 1 192.168.10.2")
+        '';
+      };
     gre =
       let
         node =

From 0bd522a407d34d2d14fb43014f671d11c7212d3d Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Thu, 19 Jun 2025 08:24:20 +0200
Subject: [PATCH 08/64] nixos/release-notes: mention networking.interfaces
 changes

---
 nixos/doc/manual/release-notes/rl-2511.section.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 6aeb5980f97a..6e50be09370a 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -112,6 +112,15 @@
 
 - `services.monero` now includes the `environmentFile` option for adding secrets to the Monero daemon config.
 
+- The new option [networking.ipips](#opt-networking.ipips) has been added to create IP within IP kind of tunnels (including 4in6, ip6ip6 and ipip).
+  With the existing [networking.sits](#opt-networking.sits) option (6in4), it is now possible to create all combinations of IPv4 and IPv6 encapsulation.
+
+- It is now possible to configure the default source address using the new options [networking.defaultGateway.source](#opt-networking.defaultGateway.source),
+  [networking.defaultGateway6.source](#opt-networking.defaultGateway6.source).
+
+- Potential race conditions in the network setup when using `networking.interfaces` have been fixed by disabling duplicate address detection (DAD)
+  for statically configured IPv6 addresses.
+
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
 

From 7536460f2f28d326414c6963127697da2f2d9537 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Fri, 11 Jul 2025 00:13:24 +0200
Subject: [PATCH 09/64] nixos/release-combined: update networking tests names

---
 nixos/release-combined.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 79b2abdc17af..98519bcab4f7 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -144,7 +144,7 @@ rec {
         (onFullSupported "nixos.tests.networking.scripted.macvlan")
         (onFullSupported "nixos.tests.networking.scripted.privacy")
         (onFullSupported "nixos.tests.networking.scripted.routes")
-        (onFullSupported "nixos.tests.networking.scripted.sit")
+        (onFullSupported "nixos.tests.networking.scripted.sit-fou")
         (onFullSupported "nixos.tests.networking.scripted.static")
         (onFullSupported "nixos.tests.networking.scripted.virtual")
         (onFullSupported "nixos.tests.networking.scripted.vlan")
@@ -158,7 +158,7 @@ rec {
         #(onFullSupported "nixos.tests.networking.networkd.macvlan")
         (onFullSupported "nixos.tests.networking.networkd.privacy")
         (onFullSupported "nixos.tests.networking.networkd.routes")
-        (onFullSupported "nixos.tests.networking.networkd.sit")
+        (onFullSupported "nixos.tests.networking.networkd.sit-fou")
         (onFullSupported "nixos.tests.networking.networkd.static")
         (onFullSupported "nixos.tests.networking.networkd.virtual")
         (onFullSupported "nixos.tests.networking.networkd.vlan")

From 602006b0b6924221978833a06e905c8d2b89347d Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Fri, 11 Jul 2025 00:45:04 +0200
Subject: [PATCH 10/64] nixos/networking-interfaces: add rnhmjoj as maintainer

---
 nixos/modules/tasks/network-interfaces-scripted.nix | 3 +++
 nixos/modules/tasks/network-interfaces.nix          | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index ce4395a4d2e6..48d297a45d73 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -807,6 +807,9 @@ let
 in
 
 {
+
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
   config = mkMerge [
     bondWarnings
     (mkIf (!cfg.useNetworkd) normalConfig)
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 4c472e30068e..620529085f60 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1669,6 +1669,8 @@ in
 
   ###### implementation
 
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
   config = {
 
     warnings =

From 632c8f720eb7ed2a4ba341adff303378820f61b7 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Fri, 11 Jul 2025 00:45:19 +0200
Subject: [PATCH 11/64] nixos/tests/networking: add rnhmjoj as maintainer

---
 nixos/tests/networking/networkd-and-scripted.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/tests/networking/networkd-and-scripted.nix b/nixos/tests/networking/networkd-and-scripted.nix
index 8678e6b6ee17..c5b8b213098d 100644
--- a/nixos/tests/networking/networkd-and-scripted.nix
+++ b/nixos/tests/networking/networkd-and-scripted.nix
@@ -1458,6 +1458,7 @@ lib.mapAttrs (lib.const (
     attrs
     // {
       name = "${attrs.name}-Networking-${if networkd then "Networkd" else "Scripted"}";
+      meta.maintainers = with lib.maintainers; [ rnhmjoj ];
     }
   )
 )) testCases

From 9e261013657b63c155c6dd7b0791e9c354ad52e9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Jul 2025 01:41:28 +0000
Subject: [PATCH 12/64] moon: 1.38.3 -> 1.38.5

---
 pkgs/by-name/mo/moon/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mo/moon/package.nix b/pkgs/by-name/mo/moon/package.nix
index 18e780198120..ce7800bd2332 100644
--- a/pkgs/by-name/mo/moon/package.nix
+++ b/pkgs/by-name/mo/moon/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "moon";
-  version = "1.38.3";
+  version = "1.38.5";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = "moon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PDXH+61Awx9sG/xPvvt78xlcHjU1bV3f9FRqx8I262g=";
+    hash = "sha256-jWLyg7K+ucCsrHwFNrpmWAXznSD+3TaYGfbZ2hWlnP0=";
   };
 
-  cargoHash = "sha256-yB0sbS3OXFnDQkq/bHYIsCDxnuzXCxvcGKSOxXpiE8U=";
+  cargoHash = "sha256-2E59P0d3SDZUgbN5V52Rr9liONiKcFUFv3dSrtFJ8NE=";
 
   env = {
     RUSTFLAGS = "-C strip=symbols";

From 3360828adbdc2e5cab74850343eda5637a695f69 Mon Sep 17 00:00:00 2001
From: Ivan Mincik <ivan.mincik@gmail.com>
Date: Fri, 18 Jul 2025 12:27:17 +0200
Subject: [PATCH 13/64] python3Packages.pyqt6: add optional serial port support

Re-add optional serial port support which was present in PyQt5 package.
---
 pkgs/development/python-modules/pyqt/6.x.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pyqt/6.x.nix b/pkgs/development/python-modules/pyqt/6.x.nix
index 39151a7ff25a..be45d1fdff6e 100644
--- a/pkgs/development/python-modules/pyqt/6.x.nix
+++ b/pkgs/development/python-modules/pyqt/6.x.nix
@@ -19,6 +19,7 @@
   # Not currently part of PyQt6
   #, withConnectivity ? true
   withPrintSupport ? true,
+  withSerialPort ? false,
   cups,
 }:
 
@@ -103,7 +104,8 @@ buildPythonPackage rec {
     # ++ lib.optional withConnectivity qtconnectivity
     ++ lib.optional withMultimedia qtmultimedia
     ++ lib.optional withWebSockets qtwebsockets
-    ++ lib.optional withLocation qtlocation;
+    ++ lib.optional withLocation qtlocation
+    ++ lib.optional withSerialPort qtserialport;
 
   buildInputs =
     with qt6Packages;
@@ -117,7 +119,8 @@ buildPythonPackage rec {
     ]
     # ++ lib.optional withConnectivity qtconnectivity
     ++ lib.optional withWebSockets qtwebsockets
-    ++ lib.optional withLocation qtlocation;
+    ++ lib.optional withLocation qtlocation
+    ++ lib.optional withSerialPort qtserialport;
 
   propagatedBuildInputs =
     # ld: library not found for -lcups
@@ -127,6 +130,7 @@ buildPythonPackage rec {
     inherit sip pyqt6-sip;
     multimediaEnabled = withMultimedia;
     WebSocketsEnabled = withWebSockets;
+    serialPortEnabled = withSerialPort;
   };
 
   dontConfigure = true;
@@ -145,7 +149,8 @@ buildPythonPackage rec {
     ++ lib.optional withWebSockets "PyQt6.QtWebSockets"
     ++ lib.optional withMultimedia "PyQt6.QtMultimedia"
     # ++ lib.optional withConnectivity "PyQt6.QtConnectivity"
-    ++ lib.optional withLocation "PyQt6.QtPositioning";
+    ++ lib.optional withLocation "PyQt6.QtPositioning"
+    ++ lib.optional withSerialPort "PyQt6.QtSerialPort";
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-Wno-address-of-temporary";
 

From 55159c3201787464666710d390533afae5092bd4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 19 Jul 2025 09:48:02 +0000
Subject: [PATCH 14/64] python3Packages.langchain-ollama: 0.3.4 -> 0.3.5

---
 pkgs/development/python-modules/langchain-ollama/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-ollama/default.nix b/pkgs/development/python-modules/langchain-ollama/default.nix
index 1de471cdb87c..89feb35abbd3 100644
--- a/pkgs/development/python-modules/langchain-ollama/default.nix
+++ b/pkgs/development/python-modules/langchain-ollama/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-ollama";
-  version = "0.3.4";
+  version = "0.3.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-ollama==${version}";
-    hash = "sha256-biPQAYF9VfF6z0244v1+iXaqX0IAiKCuJ+XyXzxD/Jg=";
+    hash = "sha256-UmfbCctAb0D8mETICl5OJ58vghwhQKWkM1drkPt1aAg=";
   };
 
   sourceRoot = "${src.name}/libs/partners/ollama";

From a2e289514749801b3b26a28e5152813817cb13b0 Mon Sep 17 00:00:00 2001
From: M0ustach3 <37956764+M0ustach3@users.noreply.github.com>
Date: Sat, 19 Jul 2025 16:16:17 +0200
Subject: [PATCH 15/64] memos: 0.24.4 -> 0.25.0

---
 pkgs/by-name/me/memos/package.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/me/memos/package.nix b/pkgs/by-name/me/memos/package.nix
index 517824d22319..3eeadda88be0 100644
--- a/pkgs/by-name/me/memos/package.nix
+++ b/pkgs/by-name/me/memos/package.nix
@@ -14,12 +14,12 @@
   protoc-gen-validate,
 }:
 let
-  version = "0.24.4";
+  version = "0.25.0";
   src = fetchFromGitHub {
     owner = "usememos";
     repo = "memos";
     rev = "v${version}";
-    hash = "sha256-Vimc9Z6X1+UBm2UnNnlsYqXEnOV3JcEPm9SD3obKkLc=";
+    hash = "sha256-M1o7orU4xw/t9PjSFXNj7tiYTarBv7kIIj8X0r3QD8s=";
   };
 
   memos-protobuf-gen = stdenvNoCC.mkDerivation {
@@ -52,7 +52,7 @@ let
 
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash = "sha256-cJK9wT5uj1MYjYZkzgMSL9nShCO2xPJOYZT+ebndwlY=";
+    outputHash = "sha256-lV92s/KLzWs/KSLbsb61FaA9+PEDMLshl/srDcjdRcU=";
   };
 
   memos-web = stdenvNoCC.mkDerivation (finalAttrs: {
@@ -62,7 +62,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/web";
       fetcherVersion = 1;
-      hash = "sha256-AyQYY1vtBB6DTcieC7nw5aOOVuwESJSDs8qU6PGyaTw=";
+      hash = "sha256-TEWaFWFQ0sHdgfFFvolnwoa4hTaFkzqqyFep56Cevp4=";
     };
     pnpmRoot = "web";
     nativeBuildInputs = [
@@ -93,7 +93,7 @@ buildGoModule {
     memos-protobuf-gen
     ;
 
-  vendorHash = "sha256-EzVgQpWJJA7EUKdnnnCIvecaOXg856f/WQyfV/WuWFU=";
+  vendorHash = "sha256-xiBxnrjJsskRCcUBGKnrc5s5tuhMFSqRoELcr5ww/XU=";
 
   preBuild = ''
     rm -rf server/router/frontend/dist
@@ -113,6 +113,7 @@ buildGoModule {
   meta = {
     homepage = "https://usememos.com";
     description = "Lightweight, self-hosted memo hub";
+    changelog = "https://github.com/usememos/memos/releases/tag/${src.rev}";
     maintainers = with lib.maintainers; [
       indexyz
       kuflierl

From 07bc44e7f407bf539044345ce97ee10ce7ab3806 Mon Sep 17 00:00:00 2001
From: Jasi <normalc@posteo.net>
Date: Wed, 16 Jul 2025 23:33:21 -0400
Subject: [PATCH 16/64] haunt: add normalcea as maintainer

---
 pkgs/by-name/ha/haunt/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ha/haunt/package.nix b/pkgs/by-name/ha/haunt/package.nix
index 1e11a1330b16..320c23e67866 100644
--- a/pkgs/by-name/ha/haunt/package.nix
+++ b/pkgs/by-name/ha/haunt/package.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
       to do things that aren't provided out-of-the-box.
     '';
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ normalcea ];
     inherit (guile.meta) platforms;
   };
 })

From 18b0b70f35834370580db1f6b19edd7ac0e0a8c2 Mon Sep 17 00:00:00 2001
From: Jasi <normalc@posteo.net>
Date: Wed, 16 Jul 2025 23:33:45 -0400
Subject: [PATCH 17/64] haunt: enable tests

---
 pkgs/by-name/ha/haunt/package.nix             |  7 +------
 .../ha/haunt/tests/001-test-version.nix       | 21 -------------------
 2 files changed, 1 insertion(+), 27 deletions(-)
 delete mode 100644 pkgs/by-name/ha/haunt/tests/001-test-version.nix

diff --git a/pkgs/by-name/ha/haunt/package.nix b/pkgs/by-name/ha/haunt/package.nix
index 320c23e67866..810755dd5ef0 100644
--- a/pkgs/by-name/ha/haunt/package.nix
+++ b/pkgs/by-name/ha/haunt/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchurl,
   autoreconfHook,
-  callPackage,
   guile,
   guile-commonmark,
   guile-reader,
@@ -32,8 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     guile-reader
   ];
 
-  # Test suite is non-deterministic in later versions
-  doCheck = false;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   postInstall = ''
     wrapProgram $out/bin/haunt \
@@ -42,9 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    tests = {
-      expectVersion = callPackage ./tests/001-test-version.nix { };
-    };
   };
 
   meta = {
diff --git a/pkgs/by-name/ha/haunt/tests/001-test-version.nix b/pkgs/by-name/ha/haunt/tests/001-test-version.nix
deleted file mode 100644
index 09ef5b32947d..000000000000
--- a/pkgs/by-name/ha/haunt/tests/001-test-version.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  stdenv,
-  haunt,
-}:
-
-stdenv.mkDerivation {
-  pname = "haunt-test-version";
-  inherit (haunt) version;
-
-  nativeBuildInputs = [ haunt ];
-
-  dontInstall = true;
-
-  buildCommand = ''
-    haunt --version
-
-    touch $out
-  '';
-
-  meta.timeout = 10;
-}

From 358adde48f211f4d1d57ddbc3890e4784477fa09 Mon Sep 17 00:00:00 2001
From: Jasi <normalc@posteo.net>
Date: Wed, 16 Jul 2025 23:42:22 -0400
Subject: [PATCH 18/64] haunt: use `makeBinaryWrapper` instead of `makeWrapper`

---
 pkgs/by-name/ha/haunt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ha/haunt/package.nix b/pkgs/by-name/ha/haunt/package.nix
index 810755dd5ef0..15ef93f31ec7 100644
--- a/pkgs/by-name/ha/haunt/package.nix
+++ b/pkgs/by-name/ha/haunt/package.nix
@@ -6,7 +6,7 @@
   guile,
   guile-commonmark,
   guile-reader,
-  makeWrapper,
+  makeBinaryWrapper,
   pkg-config,
 }:
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     autoreconfHook
-    makeWrapper
+    makeBinaryWrapper
     pkg-config
   ];
 

From 2607788438eb47e20303dce4b85916ad0a1c4655 Mon Sep 17 00:00:00 2001
From: Jasi <normalc@posteo.net>
Date: Wed, 16 Jul 2025 23:37:51 -0400
Subject: [PATCH 19/64] haunt: fetch git source instead of tarball

Introduces the `texinfo` dependency for building documentation and
replaces `fetchurl` with `fetchgit` for tagged releases.
---
 pkgs/by-name/ha/haunt/package.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ha/haunt/package.nix b/pkgs/by-name/ha/haunt/package.nix
index 15ef93f31ec7..921e7ed49fdf 100644
--- a/pkgs/by-name/ha/haunt/package.nix
+++ b/pkgs/by-name/ha/haunt/package.nix
@@ -1,8 +1,9 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchgit,
   autoreconfHook,
+  texinfo,
   guile,
   guile-commonmark,
   guile-reader,
@@ -14,15 +15,17 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "haunt";
   version = "0.3.0";
 
-  src = fetchurl {
-    url = "https://files.dthompson.us/haunt/haunt-${finalAttrs.version}.tar.gz";
-    hash = "sha256-mLq+0GvlSgZsPryUQQqR63zEg2fpTVKBMdO6JxSZmSs=";
+  src = fetchgit {
+    url = "https://git.dthompson.us/haunt.git";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-i6MI0eaRiA/JNgkIBJGLAsqMnyJz47aavyD6kOL7sqU=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     makeBinaryWrapper
     pkg-config
+    texinfo
   ];
 
   buildInputs = [

From 0238ce441a5b22007b7f60a6f185f4af2b9591a3 Mon Sep 17 00:00:00 2001
From: Jasi <normalc@posteo.net>
Date: Wed, 16 Jul 2025 23:39:56 -0400
Subject: [PATCH 20/64] haunt: add `passthru.updateScript` via `gitUpdater`

---
 pkgs/by-name/ha/haunt/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ha/haunt/package.nix b/pkgs/by-name/ha/haunt/package.nix
index 921e7ed49fdf..01a956b279c1 100644
--- a/pkgs/by-name/ha/haunt/package.nix
+++ b/pkgs/by-name/ha/haunt/package.nix
@@ -9,6 +9,7 @@
   guile-reader,
   makeBinaryWrapper,
   pkg-config,
+  gitUpdater,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -43,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
+    updateScript = gitUpdater { rev-prefix = "v"; };
   };
 
   meta = {

From f66adc76c1ad6cd711af7267eea214e09e9515ee Mon Sep 17 00:00:00 2001
From: Lan Tian <xuyh0120@outlook.com>
Date: Sun, 20 Jul 2025 00:50:10 -0700
Subject: [PATCH 21/64] open5gs: 2.7.2 -> 2.7.6

---
 pkgs/by-name/op/open5gs/package.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/op/open5gs/package.nix b/pkgs/by-name/op/open5gs/package.nix
index a7ea2bf68f40..a632a445d2f0 100644
--- a/pkgs/by-name/op/open5gs/package.nix
+++ b/pkgs/by-name/op/open5gs/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "open5gs";
-  version = "2.7.2";
+  version = "2.7.6";
 
   diameter = fetchFromGitHub {
     owner = "open5gs";
     repo = "freeDiameter";
-    rev = "20196a265aecb7b1573ceb526bb619e092c1fd3f"; # r1.5.0
-    hash = "sha256-0sxzQtKBx313+x3TRsmeswAq90Vk5jNA//rOJcEZJTQ=";
+    rev = "13f5a5996b5fa1a46ed780635c7fc6fcd09b4290"; # r1.5.0
+    hash = "sha256-S8jL+9rW9RDwQc7NU8MOzMe9/iRbshWa2QLqXoiV85Q=";
   };
 
   libtins = fetchFromGitHub {
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "open5gs";
     repo = "open5gs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XSDjVW+5l2trrilKMcSfX6QIfh/ijWxjoJg33Bn1DBU=";
+    hash = "sha256-2k+S+OXfdskJPtDUFSxb/+2UZcUiOZzRSSGgsEJWolc=";
   };
 
   webui = buildNpmPackage {
@@ -129,7 +129,10 @@ stdenv.mkDerivation (finalAttrs: {
     description = "4G/5G core network components";
     license = lib.licenses.agpl3Only;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    maintainers = with lib.maintainers; [
+      bot-wxt1221
+      xddxdd
+    ];
     changelog = "https://github.com/open5gs/open5gs/releases/tag/v${finalAttrs.version}";
   };
 })

From 1f6f9b0d21b6dd1826de7041508b6594c8cf42fd Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 17 Jul 2025 14:25:00 +0200
Subject: [PATCH 22/64] cargo: unset HOST_PKG_CONFIG_PATH

This is no longer required for the original use case since
83aaf6183611 ("cargo,clippy,rustc,rustfmt: 1.78.0 -> 1.79.0").
---
 pkgs/development/compilers/rust/cargo.nix | 160 ++++++++++------------
 1 file changed, 76 insertions(+), 84 deletions(-)

diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index d025d47be128..475d61d06d0a 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -15,99 +15,91 @@
   rustc,
   auditable ? !cargo-auditable.meta.broken,
   cargo-auditable,
-  pkgsBuildBuild,
 }:
 
 rustPlatform.buildRustPackage.override
   {
     cargo-auditable = cargo-auditable.bootstrap;
   }
-  (
-    {
-      pname = "cargo";
-      inherit (rustc.unwrapped) version src;
+  {
+    pname = "cargo";
+    inherit (rustc.unwrapped) version src;
 
-      # the rust source tarball already has all the dependencies vendored, no need to fetch them again
-      cargoVendorDir = "vendor";
-      buildAndTestSubdir = "src/tools/cargo";
+    # the rust source tarball already has all the dependencies vendored, no need to fetch them again
+    cargoVendorDir = "vendor";
+    buildAndTestSubdir = "src/tools/cargo";
 
-      inherit auditable;
+    inherit auditable;
 
-      passthru = {
-        rustc = rustc;
-        inherit (rustc.unwrapped) tests;
-      };
+    passthru = {
+      rustc = rustc;
+      inherit (rustc.unwrapped) tests;
+    };
 
-      # changes hash of vendor directory otherwise
-      dontUpdateAutotoolsGnuConfigScripts = true;
+    # changes hash of vendor directory otherwise
+    dontUpdateAutotoolsGnuConfigScripts = true;
 
-      nativeBuildInputs = [
-        pkg-config
-        cmake
-        installShellFiles
-        makeWrapper
-        (lib.getDev pkgsHostHost.curl)
-        zlib
+    nativeBuildInputs = [
+      pkg-config
+      cmake
+      installShellFiles
+      makeWrapper
+      (lib.getDev pkgsHostHost.curl)
+      zlib
+    ];
+    buildInputs = [
+      file
+      curl
+      python3
+      openssl
+      zlib
+    ];
+
+    # cargo uses git-rs which is made for a version of libgit2 from recent master that
+    # is not compatible with the current version in nixpkgs.
+    #LIBGIT2_SYS_USE_PKG_CONFIG = 1;
+
+    # fixes: the cargo feature `edition` requires a nightly version of Cargo, but this is the `stable` channel
+    RUSTC_BOOTSTRAP = 1;
+
+    postInstall = ''
+      wrapProgram "$out/bin/cargo" --suffix PATH : "${rustc}/bin"
+
+      installManPage src/tools/cargo/src/etc/man/*
+
+      installShellCompletion --bash --name cargo \
+        src/tools/cargo/src/etc/cargo.bashcomp.sh
+
+      installShellCompletion --zsh src/tools/cargo/src/etc/_cargo
+    '';
+
+    checkPhase = ''
+      # Disable cross compilation tests
+      export CFG_DISABLE_CROSS_TESTS=1
+      cargo test
+    '';
+
+    # Disable check phase as there are failures (4 tests fail)
+    doCheck = false;
+
+    doInstallCheck = !stdenv.hostPlatform.isStatic && stdenv.hostPlatform.isElf;
+    installCheckPhase = ''
+      runHook preInstallCheck
+      ${stdenv.cc.targetPrefix}readelf -a $out/bin/.cargo-wrapped | grep -F 'Shared library: [libcurl.so'
+      runHook postInstallCheck
+    '';
+
+    meta = with lib; {
+      homepage = "https://crates.io";
+      description = "Downloads your Rust project's dependencies and builds your project";
+      mainProgram = "cargo";
+      teams = [ teams.rust ];
+      license = [
+        licenses.mit
+        licenses.asl20
       ];
-      buildInputs = [
-        file
-        curl
-        python3
-        openssl
-        zlib
-      ];
-
-      # cargo uses git-rs which is made for a version of libgit2 from recent master that
-      # is not compatible with the current version in nixpkgs.
-      #LIBGIT2_SYS_USE_PKG_CONFIG = 1;
-
-      # fixes: the cargo feature `edition` requires a nightly version of Cargo, but this is the `stable` channel
-      RUSTC_BOOTSTRAP = 1;
-
-      postInstall = ''
-        wrapProgram "$out/bin/cargo" --suffix PATH : "${rustc}/bin"
-
-        installManPage src/tools/cargo/src/etc/man/*
-
-        installShellCompletion --bash --name cargo \
-          src/tools/cargo/src/etc/cargo.bashcomp.sh
-
-        installShellCompletion --zsh src/tools/cargo/src/etc/_cargo
-      '';
-
-      checkPhase = ''
-        # Disable cross compilation tests
-        export CFG_DISABLE_CROSS_TESTS=1
-        cargo test
-      '';
-
-      # Disable check phase as there are failures (4 tests fail)
-      doCheck = false;
-
-      doInstallCheck = !stdenv.hostPlatform.isStatic && stdenv.hostPlatform.isElf;
-      installCheckPhase = ''
-        runHook preInstallCheck
-        ${stdenv.cc.targetPrefix}readelf -a $out/bin/.cargo-wrapped | grep -F 'Shared library: [libcurl.so'
-        runHook postInstallCheck
-      '';
-
-      meta = with lib; {
-        homepage = "https://crates.io";
-        description = "Downloads your Rust project's dependencies and builds your project";
-        mainProgram = "cargo";
-        teams = [ teams.rust ];
-        license = [
-          licenses.mit
-          licenses.asl20
-        ];
-        platforms = platforms.unix;
-        # https://github.com/alexcrichton/nghttp2-rs/issues/2
-        broken = stdenv.hostPlatform.isx86 && stdenv.buildPlatform != stdenv.hostPlatform;
-      };
-    }
-    //
-      lib.optionalAttrs (stdenv.buildPlatform.rust.rustcTarget != stdenv.hostPlatform.rust.rustcTarget)
-        {
-          HOST_PKG_CONFIG_PATH = "${pkgsBuildBuild.pkg-config}/bin/pkg-config";
-        }
-  )
+      platforms = platforms.unix;
+      # https://github.com/alexcrichton/nghttp2-rs/issues/2
+      broken = stdenv.hostPlatform.isx86 && stdenv.buildPlatform != stdenv.hostPlatform;
+    };
+  }

From d66e41d50fb495134955b4a227a9f209c032ffcb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Oliv=C3=A9r=20Falvai?= <ofalvai@gmail.com>
Date: Sun, 20 Jul 2025 20:36:56 +0200
Subject: [PATCH 23/64] poetry: skip sandbox-violating test on darwin

---
 pkgs/by-name/po/poetry/unwrapped.nix | 42 ++++++++++++++++------------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/pkgs/by-name/po/poetry/unwrapped.nix b/pkgs/by-name/po/poetry/unwrapped.nix
index 6c70694ff3f6..7dd662686313 100644
--- a/pkgs/by-name/po/poetry/unwrapped.nix
+++ b/pkgs/by-name/po/poetry/unwrapped.nix
@@ -128,24 +128,30 @@ buildPythonPackage rec {
     unset no_proxy
   '';
 
-  disabledTests = [
-    "test_builder_should_execute_build_scripts"
-    "test_env_system_packages_are_relative_to_lib"
-    "test_install_warning_corrupt_root"
-    "test_no_additional_output_in_verbose_mode"
-    "test_project_plugins_are_installed_in_project_folder"
-    "test_application_command_not_found_messages"
-    # PermissionError: [Errno 13] Permission denied: '/build/pytest-of-nixbld/pytest-0/popen-gw3/test_find_poetry_managed_pytho1/.local/share/pypoetry/python/pypy@3.10.8/bin/python'
-    "test_list_poetry_managed"
-    "test_list_poetry_managed"
-    "test_find_all_with_poetry_managed"
-    "test_find_poetry_managed_pythons"
-    # Flaky
-    "test_threading_property_types"
-    "test_threading_single_thread_safe"
-    "test_threading_property_caching"
-    "test_threading_atomic_cached_property_different_instances"
-  ];
+  disabledTests =
+    [
+      "test_builder_should_execute_build_scripts"
+      "test_env_system_packages_are_relative_to_lib"
+      "test_install_warning_corrupt_root"
+      "test_no_additional_output_in_verbose_mode"
+      "test_project_plugins_are_installed_in_project_folder"
+      "test_application_command_not_found_messages"
+      # PermissionError: [Errno 13] Permission denied: '/build/pytest-of-nixbld/pytest-0/popen-gw3/test_find_poetry_managed_pytho1/.local/share/pypoetry/python/pypy@3.10.8/bin/python'
+      "test_list_poetry_managed"
+      "test_list_poetry_managed"
+      "test_find_all_with_poetry_managed"
+      "test_find_poetry_managed_pythons"
+      # Flaky
+      "test_threading_property_types"
+      "test_threading_single_thread_safe"
+      "test_threading_property_caching"
+      "test_threading_atomic_cached_property_different_instances"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Sandbox violation:
+      # PermissionError: [Errno 1] Operation not permitted: '/Library/Frameworks/Python.framework/Versions'
+      "test_find_all"
+    ];
 
   pytestFlagsArray = [
     "-m 'not network'"

From ec75587c6caeb683045e663b10f174e5d2a4fc30 Mon Sep 17 00:00:00 2001
From: Adrien Lemaire <lemaire.adrien@gmail.com>
Date: Mon, 14 Jul 2025 15:59:47 +0200
Subject: [PATCH 24/64] maintainers: add AdrienLemaire

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2ca9edb79453..4bab1e3e96a1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -679,6 +679,12 @@
     githubId = 25004152;
     name = "Adrian Gunnar Lauterer";
   };
+  AdrienLemaire = {
+    email = "lemaire.adrien@gmail.com";
+    github = "AdrienLemaire";
+    githubId = 260983;
+    name = "Adrien Lemaire";
+  };
   AdsonCicilioti = {
     name = "Adson Cicilioti";
     email = "adson.cicilioti@live.com";

From bfdd4173e414837939a7ad888dd11f8c2266af84 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sun, 20 Jul 2025 23:33:39 +0300
Subject: [PATCH 25/64] nixosOptionsDoc: Fix cross

Test with `pkgsCross.aarch64-multiplatform.tests.nixosOptionsDoc.commonMark`
---
 pkgs/top-level/all-packages.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c6122627d8f5..3375030596ec 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16095,7 +16095,15 @@ with pkgs;
           };
     };
 
-  nixosOptionsDoc = attrs: (import ../../nixos/lib/make-options-doc) ({ inherit pkgs lib; } // attrs);
+  nixosOptionsDoc =
+    attrs:
+    (import ../../nixos/lib/make-options-doc) (
+      {
+        pkgs = pkgs.__splicedPackages;
+        inherit lib;
+      }
+      // attrs
+    );
 
   nix-eval-jobs = callPackage ../tools/package-management/nix-eval-jobs {
     nix = nixVersions.nix_2_29;

From 56262f8461e1f077ec462f08ad43c60ab59932eb Mon Sep 17 00:00:00 2001
From: Adrien Lemaire <lemaire.adrien@gmail.com>
Date: Sun, 20 Jul 2025 22:38:38 +0200
Subject: [PATCH 26/64] n8n: 1.100.1 -> 1.103.0

---
 pkgs/by-name/n8/n8n/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 046afbd33c40..9cb19efe74db 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -17,19 +17,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "1.100.1";
+  version = "1.103.0";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-S5GGJRLTpr1HfXnXRXO6hcVjgjRWvbknABEsGkTq428=";
+    hash = "sha256-3Dob4GLTyM6QbdWQBIfC/5rSlM1olYsAFwHS3zwxCj0=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-HzJej2Mt110n+1KX0wzuAn6j69zQOzI42EGxQB6PYbc=";
+    hash = "sha256-LierbGPkVIy5/2vtBl94TQcSpmNX9OUDMntDdo5BeiU=";
   };
 
   nativeBuildInputs =
@@ -113,6 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${finalAttrs.version}";
     maintainers = with lib.maintainers; [
       gepbird
+      AdrienLemaire
     ];
     license = lib.licenses.sustainableUse;
     mainProgram = "n8n";

From 9cc821a682a77a01e6b5dcd500e0135e22c6226b Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Mon, 21 Jul 2025 05:40:07 +0200
Subject: [PATCH 27/64] freedv: 2.0.0 -> 2.0.1

---
 pkgs/by-name/fr/freedv/package.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fr/freedv/package.nix b/pkgs/by-name/fr/freedv/package.nix
index bdff43aaef2f..57ba6b6b930e 100644
--- a/pkgs/by-name/fr/freedv/package.nix
+++ b/pkgs/by-name/fr/freedv/package.nix
@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "freedv";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "drowe67";
     repo = "freedv-gui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3vwFB+3LloumEAGlSJZc2+/I8uI6KLP/KuDGeDOj87k=";
+    hash = "sha256-+hVh5GgSz8MWib10dVV6gx9EvocvLAJm2Eid/4y//2E=";
   };
 
   patches = [
@@ -58,6 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
         --replace-fail "GIT_REPOSITORY https://github.com/drowe67/radae.git" "URL $(realpath radae)" \
         --replace-fail "GIT_TAG main" ""
       patchShebangs test/test_*.sh
+      substituteInPlace cmake/CheckGit.cmake \
+        --replace-fail "git describe --abbrev=4 --always HEAD" "echo v${finalAttrs.version}"
     ''
     + lib.optionalString stdenv.hostPlatform.isDarwin ''
       substituteInPlace CMakeLists.txt \
@@ -74,7 +76,13 @@ stdenv.mkDerivation (finalAttrs: {
       python3
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      macdylibbundler
+      (macdylibbundler.overrideAttrs {
+        # incompatible with darwin.sigtool in Nixpkgs
+        postPatch = ''
+          substituteInPlace src/Utils.cpp \
+            --replace-fail "--deep --preserve-metadata=entitlements,requirements,flags,runtime" ""
+        '';
+      })
       makeWrapper
       darwin.autoSignDarwinBinariesHook
       darwin.sigtool

From e8cc12ea1ad69c462d94fbc2c4c277ef1f286246 Mon Sep 17 00:00:00 2001
From: Tom van Dijk <18gatenmaker6@gmail.com>
Date: Sun, 20 Jul 2025 02:58:35 +0200
Subject: [PATCH 28/64] figma-linux: package from source, remove with lib

See: https://github.com/NixOS/nixpkgs/issues/296939
---
 pkgs/by-name/fi/figma-linux/package.nix | 129 +++++++++++-------------
 1 file changed, 61 insertions(+), 68 deletions(-)

diff --git a/pkgs/by-name/fi/figma-linux/package.nix b/pkgs/by-name/fi/figma-linux/package.nix
index 927163c5dc86..8696d43cf162 100644
--- a/pkgs/by-name/fi/figma-linux/package.nix
+++ b/pkgs/by-name/fi/figma-linux/package.nix
@@ -1,96 +1,89 @@
 {
-  pkgs,
   lib,
-  stdenv,
-  fetchurl,
-  autoPatchelfHook,
-  dpkg,
-  makeWrapper,
-  wrapGAppsHook3,
-  ...
+  buildNpmPackage,
+  fetchFromGitHub,
+
+  electron,
+  p7zip,
+  # there's a setting "use zenity for dialogs"
+  zenity,
+
+  copyDesktopItems,
+  makeBinaryWrapper,
+  makeDesktopItem,
 }:
-stdenv.mkDerivation (finalAttrs: {
+buildNpmPackage (finalAttrs: {
   pname = "figma-linux";
   version = "0.11.5";
 
-  src = fetchurl {
-    url = "https://github.com/Figma-Linux/figma-linux/releases/download/v${finalAttrs.version}/figma-linux_${finalAttrs.version}_linux_amd64.deb";
-    hash = "sha256-6lFeiecliyuTdnUCCbLpoQWiu5k3OPHxb+VF17GtERo=";
+  src = fetchFromGitHub {
+    owner = "Figma-Linux";
+    repo = "figma-linux";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pa0GgAmi9Os4EtZpbo0hSgr4s+WX95zLUrZR8a33TeI=";
   };
 
   nativeBuildInputs = [
-    autoPatchelfHook
-    dpkg
-    makeWrapper
-    wrapGAppsHook3
+    copyDesktopItems
+    makeBinaryWrapper
   ];
 
-  buildInputs =
-    with pkgs;
-    [
-      alsa-lib
-      at-spi2-atk
-      cairo
-      cups.lib
-      dbus.lib
-      expat
-      gdk-pixbuf
-      glib
-      gtk3
-      libdrm
-      libxkbcommon
-      libgbm
-      nspr
-      nss
-      pango
-    ]
-    ++ (with pkgs.xorg; [
-      libX11
-      libXcomposite
-      libXdamage
-      libXext
-      libXfixes
-      libXrandr
-      libxcb
-      libxshmfence
-    ]);
+  npmDepsHash = "sha256-FqgcG52Nkj0wlwsHwIWTXNuIeAs7b+TPkHcg7m5D2og=";
 
-  runtimeDependencies = with pkgs; [ eudev ];
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+  };
 
-  unpackCmd = "dpkg -x $src .";
-
-  sourceRoot = ".";
-
-  # Instead of double wrapping the binary, simply pass the `gappsWrapperArgs`
-  # to `makeWrapper` directly
-  dontWrapGApps = true;
+  desktopItems = [
+    (makeDesktopItem {
+      name = "figma-linux";
+      desktopName = "Figma Linux";
+      comment = "Unofficial Figma desktop application for Linux";
+      exec = "figma-linux %U";
+      icon = "figma-linux";
+      terminal = false;
+    })
+  ];
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/lib && cp -r opt/figma-linux/* $_
-    mkdir -p $out/bin && ln -s $out/lib/figma-linux $_/figma-linux
+    mkdir -p $out/share/figma-linux/resources
 
-    cp -r usr/* $out
+    rm -rf node_modules/7zip-bin
 
-    wrapProgramShell $out/bin/figma-linux \
-      "''${gappsWrapperArgs[@]}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland --enable-wayland-ime=true}}"
+    cp -r node_modules $out/share/figma-linux/resources
+
+    # transpose [name][size] into [size][name]
+    for icon in resources/icons/*.png; do
+      basename="$(basename "$icon")"
+      size="''${basename%.png}"
+
+      install -Dm444 "$icon" -T "$out/share/icons/hicolor/$size/figma-linux.png"
+    done
+
+    cp -r dist $out/share/figma-linux/resources/app
+
+    makeWrapper ${lib.getExe electron} $out/bin/figma-linux \
+      --add-flag $out/share/figma-linux/resources/app \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland --enable-wayland-ime=true}}" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          p7zip
+          zenity
+        ]
+      }" \
+      --inherit-argv0
 
     runHook postInstall
   '';
 
-  postFixup = ''
-    substituteInPlace $out/share/applications/figma-linux.desktop \
-          --replace "Exec=/opt/figma-linux/figma-linux" "Exec=$out/bin/figma-linux"
-  '';
-
-  meta = with lib; {
+  meta = {
     description = "Unofficial Electron-based Figma desktop app for Linux";
     homepage = "https://github.com/Figma-Linux/figma-linux";
-    platforms = [ "x86_64-linux" ];
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
       ercao
       kashw2
     ];

From 72cc5aa6f238ab300ee10fd8ab48a108c32e97c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexandru=20Scvor=C8=9Bov?= <code@scvalex.net>
Date: Sat, 12 Jul 2025 13:59:00 +0100
Subject: [PATCH 29/64] kubernetes: enable hairpinning in flannel config

---
 nixos/modules/services/cluster/kubernetes/flannel.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/cluster/kubernetes/flannel.nix b/nixos/modules/services/cluster/kubernetes/flannel.nix
index 7bbb55ba0724..cc1cc0b9574a 100644
--- a/nixos/modules/services/cluster/kubernetes/flannel.nix
+++ b/nixos/modules/services/cluster/kubernetes/flannel.nix
@@ -41,6 +41,7 @@ in
           cniVersion = "0.3.1";
           delegate = {
             isDefaultGateway = true;
+            hairpinMode = true;
             bridge = "mynet";
           };
         }

From dafc39e986e9bcf03ac72bf97dc3aeb3790c08c6 Mon Sep 17 00:00:00 2001
From: Jon Hermansen <jon@jh86.org>
Date: Mon, 21 Jul 2025 13:32:33 -0400
Subject: [PATCH 30/64] vmware-workstation: 17.6.3 -> 17.6.4

---
 pkgs/by-name/vm/vmware-workstation/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vm/vmware-workstation/package.nix b/pkgs/by-name/vm/vmware-workstation/package.nix
index 71ee44c92531..7150351ba562 100644
--- a/pkgs/by-name/vm/vmware-workstation/package.nix
+++ b/pkgs/by-name/vm/vmware-workstation/package.nix
@@ -35,13 +35,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vmware-workstation";
-  version = "17.6.3";
-  build = "24583834";
+  version = "17.6.4";
+  build = "24832109";
 
   src = requireFile {
     name = "VMware-Workstation-Full-${finalAttrs.version}-${finalAttrs.build}.x86_64.bundle";
     url = "https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware%20Workstation%20Pro&freeDownloads=true";
-    hash = "sha256-eVdZF3KN7UxtC4n0q2qBvpp3PADuto0dEqwNsSVHjuA=";
+    hash = "sha256-ZPv7rqzEiGVGgRQ2Kiu6rekRDMnoe8O9k4OWun8Zqb0=";
   };
 
   vmware-unpack-env = buildFHSEnv {

From feeaf5918bae56a8543df33dbcb9ef5be1ecf1a8 Mon Sep 17 00:00:00 2001
From: Sumner Evans <me@sumnerevans.com>
Date: Mon, 21 Jul 2025 20:34:45 -0600
Subject: [PATCH 31/64] harper: 0.51.0 -> 0.52.0

Signed-off-by: Sumner Evans <me@sumnerevans.com>
---
 pkgs/by-name/ha/harper/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index cb438c5056c9..22998e461649 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.51.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-jMifo0vhcCFY8DTuqRYzz483R2NGOWeWr1SR7xkTM/s=";
+    hash = "sha256-Mwgdombfc01Ss8Sy/pMwHNWeI1lxC1riFql9FtqaBmY=";
   };
 
   buildAndTestSubdir = "harper-ls";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-PSyJ9EDmxevU/b3xWZS3eqQPfcQ7Us/Bi6SA7WB70J4=";
+  cargoHash = "sha256-aOajrh2NZShP1vXSUEDzY1ULTeMs8dY+BDIspCi1BfY=";
 
   passthru.updateScript = nix-update-script { };
 

From bb9184fef5c97c3948c0a97fe06e119398a8b421 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 22 Jul 2025 05:28:59 +0000
Subject: [PATCH 32/64] python3Packages.amaranth: 0.5.6 -> 0.5.7

---
 pkgs/development/python-modules/amaranth/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/amaranth/default.nix b/pkgs/development/python-modules/amaranth/default.nix
index 22c22102815d..25d210083ec6 100644
--- a/pkgs/development/python-modules/amaranth/default.nix
+++ b/pkgs/development/python-modules/amaranth/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "amaranth";
-  version = "0.5.6";
+  version = "0.5.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "amaranth-lang";
     repo = "amaranth";
     tag = "v${version}";
-    hash = "sha256-fc9mCq7AgxjlR/+KKebV1GGlF5NXN/1Vee5ZLwkNjow=";
+    hash = "sha256-E/PJrvBmlS39KgzDz9sArq4BXwk/JmIMtdxL7MdrWlc=";
   };
 
   postPatch = ''

From e811c41fa825118cb5ff2dda31f664ce5f77ae66 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Mon, 21 Jul 2025 23:23:55 +0800
Subject: [PATCH 33/64] mint-y-icons: 1.8.3 -> 1.8.4

https://github.com/linuxmint/mint-y-icons/compare/1.8.3...1.8.4
---
 pkgs/by-name/mi/mint-y-icons/package.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/mint-y-icons/package.nix b/pkgs/by-name/mi/mint-y-icons/package.nix
index a11b03fa8c28..4a49fc1acb75 100644
--- a/pkgs/by-name/mi/mint-y-icons/package.nix
+++ b/pkgs/by-name/mi/mint-y-icons/package.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-y-icons";
-  version = "1.8.3";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-y-icons";
     rev = version;
-    hash = "sha256-xGPihqXUraJy9lDCSVjQlNxrhETEcjBTYhyFsZGJRGo=";
+    hash = "sha256-ftiV9l7hTmWdtw36Z2GKpJZuRwQQ3MQWYIgb62VBde0=";
   };
 
   propagatedBuildInputs = [
@@ -31,6 +31,12 @@ stdenvNoCC.mkDerivation rec {
 
   dontDropIconThemeCache = true;
 
+  postPatch = ''
+    # Breaks gtk-update-icon-cache
+    # https://github.com/linuxmint/mint-y-icons/issues/494
+    find usr/share/icons/Mint-Y/apps/ -type l -name "1AC2_Battle.net Launcher.0.png" -delete
+  '';
+
   installPhase = ''
     runHook preInstall
 

From a29d9b0637ddc0022d30f7fcfe8cf1b3cddc5288 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Mon, 21 Jul 2025 23:27:59 +0800
Subject: [PATCH 34/64] mint-l-icons: 1.7.4 -> 1.7.5

https://github.com/linuxmint/mint-l-icons/compare/b442277c822c92f7bb68282cb82c7d1a98e3fd37...64ee205dc270b13f3816030330eed108eaa30360
---
 pkgs/by-name/mi/mint-l-icons/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mi/mint-l-icons/package.nix b/pkgs/by-name/mi/mint-l-icons/package.nix
index 1641646ffdfc..cda137268dc8 100644
--- a/pkgs/by-name/mi/mint-l-icons/package.nix
+++ b/pkgs/by-name/mi/mint-l-icons/package.nix
@@ -10,14 +10,14 @@
 
 stdenvNoCC.mkDerivation {
   pname = "mint-l-icons";
-  version = "1.7.4";
+  version = "1.7.5";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-l-icons";
     # They don't really do tags, this is just a named commit.
-    rev = "b442277c822c92f7bb68282cb82c7d1a98e3fd37";
-    hash = "sha256-vPDEribE/CZwoAK1C9fjbWQEO/NWMWCKCUO/Xw/SxZ0=";
+    rev = "64ee205dc270b13f3816030330eed108eaa30360";
+    hash = "sha256-4tavRQ1bWzVYcAAJtZ4avRHcBB+oTDhdXp6dlSGO4C8=";
   };
 
   propagatedBuildInputs = [

From 8496c3e4336296bb486d0fa8bbf58c01b90025fc Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Tue, 22 Jul 2025 22:19:14 +0800
Subject: [PATCH 35/64] xreader: 4.2.6 -> 4.2.7

https://github.com/linuxmint/xreader/compare/4.2.6...4.2.7
---
 pkgs/by-name/xr/xreader/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xr/xreader/package.nix b/pkgs/by-name/xr/xreader/package.nix
index b0061d28a50c..e41c7789af8a 100644
--- a/pkgs/by-name/xr/xreader/package.nix
+++ b/pkgs/by-name/xr/xreader/package.nix
@@ -36,13 +36,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xreader";
-  version = "4.2.6";
+  version = "4.2.7";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xreader";
     rev = version;
-    hash = "sha256-ELqO8pYMWgU6DUS5vg+F+xFp3w3H6u0Jzms3xaNlTqE=";
+    hash = "sha256-APBVrrvLS5CFtfi0UlIDtYyg4pfCS8qLc2a4KDOU1Zk=";
   };
 
   nativeBuildInputs = [

From 77020dbd19b24408e52af691535d4bd37ea41ef5 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Tue, 22 Jul 2025 22:19:56 +0800
Subject: [PATCH 36/64] xviewer: 3.4.8 -> 3.4.9

https://github.com/linuxmint/xviewer/compare/3.4.8...3.4.9
---
 pkgs/by-name/xv/xviewer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xv/xviewer/package.nix b/pkgs/by-name/xv/xviewer/package.nix
index a32350065a4b..5817fca0f464 100644
--- a/pkgs/by-name/xv/xviewer/package.nix
+++ b/pkgs/by-name/xv/xviewer/package.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xviewer";
-  version = "3.4.8";
+  version = "3.4.9";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xviewer";
     rev = version;
-    hash = "sha256-Wn1a/tGNIJNGbgDKoMMMo/oCXrqCXDM1nTUgCZt0O/U=";
+    hash = "sha256-WYGX57PUX+WUVVZ1F+oE3QNwKB7ii5FlJdQ/3j5heUA=";
   };
 
   nativeBuildInputs = [

From 0f7524accda9647242b540c67bea99d9c39c5d16 Mon Sep 17 00:00:00 2001
From: Amadej Kastelic <amadejkastelic7@gmail.com>
Date: Tue, 22 Jul 2025 19:32:33 +0200
Subject: [PATCH 37/64] linuxKernel.packages.zenpower: fix build for 6.16

---
 pkgs/os-specific/linux/zenpower/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/os-specific/linux/zenpower/default.nix b/pkgs/os-specific/linux/zenpower/default.nix
index 10a61bfafa53..9a4af7542324 100644
--- a/pkgs/os-specific/linux/zenpower/default.nix
+++ b/pkgs/os-specific/linux/zenpower/default.nix
@@ -2,18 +2,18 @@
   lib,
   stdenv,
   kernel,
-  fetchFromGitLab,
+  fetchFromGitHub,
 }:
 
 stdenv.mkDerivation rec {
   pname = "zenpower";
-  version = "unstable-2025-02-28";
+  version = "unstable-2025-06-17";
 
-  src = fetchFromGitLab {
-    owner = "shdwchn10";
+  src = fetchFromGitHub {
+    owner = "AliEmreSenel";
     repo = "zenpower3";
-    rev = "138fa0637b46a0b0a087f2ba4e9146d2f9ba2475";
-    sha256 = "sha256-kLtkG97Lje+Fd5FoYf+UlSaEyxFaETtXrSjYzFnHkjY=";
+    rev = "41e042935ee9840c0b9dd55d61b6ddd58bc4fde6";
+    hash = "sha256-0U/JmEd6OJJeUm1ZLFYxpKH15n7+QTWYOgtKIFAuf/4=";
   };
 
   hardeningDisable = [ "pic" ];

From 8bda549f22e9d3072f13c84f0390c8a6153a9060 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Tue, 22 Jul 2025 21:50:08 +0200
Subject: [PATCH 38/64] gnome2.gtksourceview: unpin autotools

---
 pkgs/desktops/gnome-2/default.nix             |  4 +---
 .../gnome-2/desktop/gtksourceview/default.nix | 19 +++++++++++--------
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/pkgs/desktops/gnome-2/default.nix b/pkgs/desktops/gnome-2/default.nix
index 14d8ac23b6b5..dd61bbed6828 100644
--- a/pkgs/desktops/gnome-2/default.nix
+++ b/pkgs/desktops/gnome-2/default.nix
@@ -33,9 +33,7 @@ lib.makeScope pkgs.newScope (
 
     #### DESKTOP
 
-    gtksourceview = callPackage ./desktop/gtksourceview {
-      autoreconfHook = pkgs.autoreconfHook269;
-    };
+    gtksourceview = callPackage ./desktop/gtksourceview { };
 
   }
 )
diff --git a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
index 30a33349e5a2..77ced255f1da 100644
--- a/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/gtksourceview/default.nix
@@ -4,6 +4,7 @@
   fetchpatch,
   fetchurl,
   autoreconfHook,
+  gtk-doc,
   pkg-config,
   atk,
   cairo,
@@ -48,10 +49,16 @@ stdenv.mkDerivation (finalAttrs: {
   # Fix build with gcc 14
   env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
 
-  nativeBuildInputs = [
-    pkg-config
-    intltool
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ autoreconfHook ];
+  nativeBuildInputs =
+    [
+      pkg-config
+      intltool
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      autoreconfHook
+      gtk-doc
+    ];
+
   buildInputs =
     [
       atk
@@ -68,10 +75,6 @@ stdenv.mkDerivation (finalAttrs: {
       gtk-mac-integration-gtk2
     ];
 
-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    intltoolize --force
-  '';
-
   doCheck = false; # requires X11 daemon
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;

From 822dba5c872171fb60fdb99c95faed45009c3071 Mon Sep 17 00:00:00 2001
From: Thibaut Smith <thibaut.smith@mailbox.org>
Date: Mon, 21 Jul 2025 16:51:29 +0200
Subject: [PATCH 39/64] cortex-tools: init at 0.11.3

---
 pkgs/by-name/co/cortex-tools/package.nix | 79 ++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 pkgs/by-name/co/cortex-tools/package.nix

diff --git a/pkgs/by-name/co/cortex-tools/package.nix b/pkgs/by-name/co/cortex-tools/package.nix
new file mode 100644
index 000000000000..3578775f00cd
--- /dev/null
+++ b/pkgs/by-name/co/cortex-tools/package.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitUpdater,
+  versionCheckHook,
+  installShellFiles,
+  stdenv,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "cortex-tools";
+  version = "0.11.3";
+
+  src = fetchFromGitHub {
+    owner = "grafana";
+    repo = "cortex-tools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+GWUC+lnCn5Nw2WytSvW/UsIMmMelCCsnKdBCHuue24=";
+  };
+
+  vendorHash = null;
+
+  subPackages = [
+    "cmd/benchtool"
+    "cmd/cortextool"
+    "cmd/e2ealerting"
+    "cmd/logtool"
+  ];
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-X github.com/grafana/cortex-tools/pkg/version.Version=${finalAttrs.src.tag}"
+    "-s"
+    "-w"
+  ];
+
+  doCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd cortextool \
+      --bash <($out/bin/cortextool --completion-script-bash) \
+      --zsh <($out/bin/cortextool --completion-script-zsh)
+
+    $out/bin/cortextool --help-man > cortextool.1
+    installManPage cortextool.1
+  '';
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = "version";
+
+  meta = {
+    changelog = "https://github.com/grafana/cortex-tools/releases/tag/${finalAttrs.src.tag}";
+    description = "Tools used for interacting with Cortex, a Prometheus-compatible server";
+    longDescription = ''
+      Tools used for interacting with Cortex, a horizontally scalable, highly available, multi-tenant, long term Prometheus server:
+
+      - benchtool: A powerful YAML driven tool for benchmarking Cortex write and query API.
+      - cortextool: Interacts with user-facing Cortex APIs and backend storage components.
+      - logtool: Tool which parses Cortex query-frontend logs and formats them for easy analysis.
+      - e2ealerting: Tool that helps measure how long an alert takes from scrape of sample to Alertmanager notification delivery.
+    '';
+    homepage = "https://github.com/grafana/cortex-tools";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux ++ lib.platforms.windows ++ lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ videl ];
+    mainProgram = "cortextool";
+  };
+})

From ec28f43a92c2004cd4e7417a52de495096809811 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 16 Jul 2025 22:07:21 -0700
Subject: [PATCH 40/64] fixDarwinDylibNames: use callPackage; use
 targetPackages.stdenv.cc for targetPrefix

This was the only place in the codebase which used `darwin.binutils.targetPrefix`.
Others use `stdenv.cc.targetPrefix`; on static builds, that produces an empty `targetPrefix` where previously it was including the platform name.
Still others use this one (`targetPackages.stdenv.cc.targetPrefix`) and that produces no rebuilds.
---
 pkgs/top-level/all-packages.nix | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4eeae5c1dece..90aec23b0d9e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -892,11 +892,18 @@ with pkgs;
     name = "set-java-classpath-hook";
   } ../build-support/setup-hooks/set-java-classpath.sh;
 
-  fixDarwinDylibNames = makeSetupHook {
-    name = "fix-darwin-dylib-names-hook";
-    substitutions = { inherit (darwin.binutils) targetPrefix; };
-    meta.platforms = lib.platforms.darwin;
-  } ../build-support/setup-hooks/fix-darwin-dylib-names.sh;
+  fixDarwinDylibNames = callPackage (
+    {
+      lib,
+      targetPackages,
+      makeSetupHook,
+    }:
+    makeSetupHook {
+      name = "fix-darwin-dylib-names-hook";
+      substitutions = { inherit (targetPackages.stdenv.cc) targetPrefix; };
+      meta.platforms = lib.platforms.darwin;
+    } ../build-support/setup-hooks/fix-darwin-dylib-names.sh
+  ) { };
 
   writeDarwinBundle = callPackage ../build-support/make-darwin-bundle/write-darwin-bundle.nix { };
 

From 8a6390ee115dd911612f49cdaa28d2f316cb1604 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 17 Jun 2025 15:21:42 +0200
Subject: [PATCH 41/64] bash: Add a comment to a patch

With this, all (non-upstream) patches are commented
---
 pkgs/shells/bash/5.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 66172bddd125..12cb7ee42bc7 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -74,6 +74,11 @@ lib.warnIf (withDocs != null)
     patchFlags = [ "-p0" ];
 
     patches = upstreamPatches ++ [
+      # Enable PGRP_PIPE independently of the kernel of the build machine.
+      # This doesn't seem to be upstreamed despite such a mention of in https://github.com/NixOS/nixpkgs/pull/77196,
+      # which originally introduced the patch
+      # Some related discussion can be found in
+      # https://lists.gnu.org/archive/html/bug-bash/2015-05/msg00071.html
       ./pgrp-pipe-5.patch
       # Apply parallel build fix pending upstream inclusion:
       #   https://savannah.gnu.org/patch/index.php?10373

From 1b2369a80e38cb5bc79d286c5e921893048dfb78 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 17 Jun 2025 15:22:35 +0200
Subject: [PATCH 42/64] bash: Improve patch signing key fetching and
 verification

Get it from a more directly trusted source and update md5 -> sha256

Running the script still works with all signature verifications
succeeding
---
 pkgs/shells/bash/update-patch-set.sh | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/shells/bash/update-patch-set.sh b/pkgs/shells/bash/update-patch-set.sh
index ee785cc83123..721b867c3bf8 100755
--- a/pkgs/shells/bash/update-patch-set.sh
+++ b/pkgs/shells/bash/update-patch-set.sh
@@ -22,11 +22,13 @@ set -e
 
 rm -vf "$PATCH_LIST"
 
-wget "https://tiswww.case.edu/php/chet/gpgkey.asc"
-echo "4ef5051ce7200241e65d29c11eb57df8  gpgkey.asc" > gpgkey.asc.md5
-md5sum -c gpgkey.asc.md5
+# https://savannah.gnu.org/projects/bash/: Group Admins: Chet Ramey
+# https://savannah.gnu.org/users/chet: Download GPG Key
+wget "https://savannah.gnu.org/people/viewgpg.php?user_id=2590" -O gpgkey.asc
+echo "db4041b4d3896b9f21250e6c29861958bd5d4781f521f06beda849a9ed79fae8  gpgkey.asc" > gpgkey.asc.sha256
+sha256sum -c gpgkey.asc.sha256
 gpg --import ./gpgkey.asc
-rm gpgkey.asc{,.md5}
+rm gpgkey.asc{,.sha256}
 
 ( echo "# Automatically generated by \`$(basename "$0")'; do not edit." ;	\
   echo "" ;								\

From 0caffc0c071d3cfa41d03bc4d96ffbf4b55a7ed2 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 17 Jun 2025 15:24:14 +0200
Subject: [PATCH 43/64] bash: Generate patch list to conform to the Nix format

---
 pkgs/shells/bash/update-patch-set.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/shells/bash/update-patch-set.sh b/pkgs/shells/bash/update-patch-set.sh
index 721b867c3bf8..0467a2aae4d6 100755
--- a/pkgs/shells/bash/update-patch-set.sh
+++ b/pkgs/shells/bash/update-patch-set.sh
@@ -41,7 +41,7 @@ do
     wget -P "$DIR" "ftp.gnu.org/gnu/$PROJECT/$PROJECT-$VERSION-patches/$PROJECT$VERSION_CONDENSED-$i.sig"
     gpg --verify "$DIR/$PROJECT$VERSION_CONDENSED-$i.sig"
     hash=$(nix-hash --flat --type sha256 --base32 "$DIR/$PROJECT$VERSION_CONDENSED-$i")
-    echo "(patch \"$i\" \"$hash\")"	\
+    echo "  (patch \"$i\" \"$hash\")"	\
     >> "$PATCH_LIST"
 
     rm -f "$DIR/$PROJECT$VERSION_CONDENSED-$i"{,.sig}

From a2a6a14b1c18d6bd93a2acdc54637e77649bbb9c Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Wed, 23 Jul 2025 02:24:58 +0200
Subject: [PATCH 44/64] mysql-workbench: 8.0.42 -> 8.0.43, enable strictDeps

---
 pkgs/by-name/my/mysql-workbench/package.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/my/mysql-workbench/package.nix b/pkgs/by-name/my/mysql-workbench/package.nix
index 1ef123b5b74b..967f2ad1dd8e 100644
--- a/pkgs/by-name/my/mysql-workbench/package.nix
+++ b/pkgs/by-name/my/mysql-workbench/package.nix
@@ -51,11 +51,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-workbench";
-  version = "8.0.42";
+  version = "8.0.43";
 
   src = fetchurl {
     url = "https://cdn.mysql.com/Downloads/MySQLGUITools/mysql-workbench-community-${finalAttrs.version}-src.tar.gz";
-    hash = "sha256-d4SnNALK76AXWEu0WHX0dZv4co6Q+oCMTYAVV3pd9gU=";
+    hash = "sha256-E9fn72r35WrGzIOoDouIvJFZdpfw9sgDNHwEe/0DdUI=";
   };
 
   patches = [
@@ -90,6 +90,8 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs tools/get_wb_version.sh
   '';
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
     ninja
@@ -115,6 +117,8 @@ stdenv.mkDerivation (finalAttrs: {
     libsecret
     libiodbc
 
+    bash # for shebangs
+
     # python dependencies:
     paramiko
     pycairo

From 239d29301f1b2347711894c77d5780b504578ae2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Jul 2025 05:50:47 +0000
Subject: [PATCH 45/64] ts_query_ls: 3.3.0 -> 3.8.0

---
 pkgs/by-name/ts/ts_query_ls/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ts/ts_query_ls/package.nix b/pkgs/by-name/ts/ts_query_ls/package.nix
index 7963eea57575..038bac3fd08b 100644
--- a/pkgs/by-name/ts/ts_query_ls/package.nix
+++ b/pkgs/by-name/ts/ts_query_ls/package.nix
@@ -6,7 +6,7 @@
 }:
 let
   pname = "ts_query_ls";
-  version = "3.3.0";
+  version = "3.8.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -15,13 +15,13 @@ rustPlatform.buildRustPackage {
     owner = "ribru17";
     repo = "ts_query_ls";
     rev = "v${version}";
-    hash = "sha256-CtR5NDvpE8d5KlmATEwk9LVtVHB6NfGMEtT50s1HsWI=";
+    hash = "sha256-CBsiHK+mt3acyR0HGfx0kIzmTO5FLFjkL2wFK+yILx4=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-I47MCmRumJW50dPOaL8rGB7hRvxvF2gx+XmwzKL67Ok=";
+  cargoHash = "sha256-b2lfuWX2c489Sw76TBbFj/krnNS27QL0u7lVWhx1WwM=";
 
   meta = {
     description = "LSP implementation for Tree-sitter's query files";

From 5838245cfd90a32721ed5f1c9c63e9705431aef6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Jul 2025 07:11:13 +0000
Subject: [PATCH 46/64] python3Packages.llm-groq: 0.8 -> 0.9

---
 pkgs/development/python-modules/llm-groq/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/llm-groq/default.nix b/pkgs/development/python-modules/llm-groq/default.nix
index 55364db0921b..e829f14b84fb 100644
--- a/pkgs/development/python-modules/llm-groq/default.nix
+++ b/pkgs/development/python-modules/llm-groq/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "llm-groq";
-  version = "0.8";
+  version = "0.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "angerman";
     repo = "llm-groq";
     tag = "v${version}";
-    hash = "sha256-sZ5d9w43NvypaPrebwZ5BLgRaCHAhd7gBU6uHEdUaF4=";
+    hash = "sha256-9obDB5xz/YFKdnqM/70SC4Ud1t62AsGzAkbGsZTL5Nc=";
   };
 
   build-system = [

From b565a9abe09bf4be17499f225b33f60b4a8aa0f6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Jul 2025 07:12:51 +0000
Subject: [PATCH 47/64] python3Packages.llm-mistral: 0.14 -> 0.15

---
 pkgs/development/python-modules/llm-mistral/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/llm-mistral/default.nix b/pkgs/development/python-modules/llm-mistral/default.nix
index 773868d5a875..b0b5cd1649de 100644
--- a/pkgs/development/python-modules/llm-mistral/default.nix
+++ b/pkgs/development/python-modules/llm-mistral/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "llm-mistral";
-  version = "0.14";
+  version = "0.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = "llm-mistral";
     tag = version;
-    hash = "sha256-NuiqRA/SCjGq0hJsnHJ/vgdncIKu3oE9WqWGht7QRMc=";
+    hash = "sha256-4ajvsq0sm3/vdiHUuNxHsHKdX58VNNpHIwhWI0ws+08=";
   };
 
   build-system = [
@@ -49,7 +49,7 @@ buildPythonPackage rec {
   meta = {
     description = "LLM plugin providing access to Mistral models using the Mistral API";
     homepage = "https://github.com/simonw/llm-mistral";
-    changelog = "https://github.com/simonw/llm-mistral/releases/tag/${version}/CHANGELOG.md";
+    changelog = "https://github.com/simonw/llm-mistral/releases/tag/${src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ philiptaron ];
   };

From d4776e7fc79911e9a2e71b4e2caf0277ec4a0ca0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Jul 2025 07:15:46 +0000
Subject: [PATCH 48/64] python3Packages.llm-grok: 1.1.1 -> 1.2.0

---
 pkgs/development/python-modules/llm-grok/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/llm-grok/default.nix b/pkgs/development/python-modules/llm-grok/default.nix
index 1e834b795deb..592a957d3768 100644
--- a/pkgs/development/python-modules/llm-grok/default.nix
+++ b/pkgs/development/python-modules/llm-grok/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "llm-grok";
-  version = "1.1.1";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Hiepler";
     repo = "llm-grok";
     tag = "v${version}";
-    hash = "sha256-Zwvf33XSoULJxJMBHftysY3RzGEQ+L46UJ0V8b/+UXQ=";
+    hash = "sha256-YSpo7dsQ0/s+sS2DXeLq7zHBdktxCr0P96vr6PtEu9o=";
   };
 
   build-system = [ setuptools ];

From 08755e6ae19576c75ad0cd10fdbc6a4f83a71864 Mon Sep 17 00:00:00 2001
From: jakobkukla <jakob.kukla@gmail.com>
Date: Tue, 22 Jul 2025 23:15:59 +0000
Subject: [PATCH 49/64] soapyuhd: 0.4.1 -> 0.4.1-unstable-2025-02-13

Upstream hasn't tagged a release since 0.4.1 (2020-09-21), and the request for a new tag (pothosware/SoapyUHD#63) has remained unanswered.
To unblock UHD 4.8 support (#427479), switch SoapyUHD versioning to "unstable" scheme based on git revisions.
---
 pkgs/by-name/so/soapyuhd/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/so/soapyuhd/package.nix b/pkgs/by-name/so/soapyuhd/package.nix
index 722d41bb37cc..c3f57dc02081 100644
--- a/pkgs/by-name/so/soapyuhd/package.nix
+++ b/pkgs/by-name/so/soapyuhd/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "soapyuhd";
-  version = "0.4.1";
+  version = "0.4.1-unstable-2025-02-13";
 
   src = fetchFromGitHub {
     owner = "pothosware";
     repo = "SoapyUHD";
-    rev = "soapy-uhd-${version}";
-    sha256 = "14rk9ap9ayks2ma6mygca08yfds9bgfmip8cvwl87l06hwhnlwhj";
+    rev = "6b521393cc45c66770f3d4bc69eac7dda982174c";
+    sha256 = "qg0mbw3S973cnok6tVx7Y38ijOQcJdHtPLi889uo7tI=";
   };
 
   nativeBuildInputs = [

From a4a1ce2c24b01d624a3874b8c7575ecdf63ecfee Mon Sep 17 00:00:00 2001
From: isabel <isabel@isabelroses.com>
Date: Wed, 23 Jul 2025 12:11:02 +0100
Subject: [PATCH 50/64] catppuccinifier-gui: fix source url

---
 pkgs/by-name/ca/catppuccinifier-gui/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/catppuccinifier-gui/package.nix b/pkgs/by-name/ca/catppuccinifier-gui/package.nix
index 875a74173a2c..4388c11c6662 100644
--- a/pkgs/by-name/ca/catppuccinifier-gui/package.nix
+++ b/pkgs/by-name/ca/catppuccinifier-gui/package.nix
@@ -26,8 +26,8 @@ stdenv.mkDerivation {
   inherit version;
 
   src = fetchzip {
-    url = "https://github.com/lighttigerXIV/catppuccinifier/releases/download/${version}/Catppuccinifer-Linux-${version}.tar.xz";
-    hash = "sha256-FtsO+3C5Ll1aYYCuohrPI2IQZsLyvBseXPzfK1sQgNc=";
+    url = "https://github.com/lighttigerXIV/catppuccinifier/releases/download/${version}/Catppuccinifier-Linux-${version}.tar.xz";
+    hash = "sha256-wGj0mWxmGqG/z/jmQ5pw1LdxYKzHaf+eOUXhpMT3kgs=";
   };
 
   nativeBuildInputs = [

From e98d150c0f12cd60f72f6ab1a15c44b7e3a2b886 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Wed, 23 Jul 2025 15:09:33 +0200
Subject: [PATCH 51/64] top-level/aliases: abort evaluation on check error

The `aliases.nix` file is full of "expected errors", which the CI check
for "does nixpkgs with aliases eval?" *must* ignore. However, this also
hides an unexpected error, the check which prevents shadowing of
existing attributes in all-packages.nix.

By elevating this check to use `abort`, this will break the CI check for
sure.
---
 pkgs/top-level/aliases.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c5b09e0da473..0f4efec3312e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -208,7 +208,7 @@ let
   # Make sure that we are not shadowing something from all-packages.nix.
   checkInPkgs =
     n: alias:
-    if builtins.hasAttr n super then throw "Alias ${n} is still in all-packages.nix" else alias;
+    if builtins.hasAttr n super then abort "Alias ${n} is still in all-packages.nix" else alias;
 
   mapAliases =
     aliases: lib.mapAttrs (n: alias: removeRecurseForDerivations (checkInPkgs n alias)) aliases;

From 52e7ef8d620830b7a6a53ef1b0dbfac0812f4b55 Mon Sep 17 00:00:00 2001
From: Hendrik Sokolowski <hensoko@gssws.de>
Date: Wed, 23 Jul 2025 15:12:56 +0200
Subject: [PATCH 52/64] nextcloud-spreed-signaling: init at 2.0.3 (#392811)

---
 .../ne/nextcloud-spreed-signaling/package.nix | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix

diff --git a/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix b/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix
new file mode 100644
index 000000000000..4f47573bf675
--- /dev/null
+++ b/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "nextcloud-spreed-signaling";
+  version = "2.0.3";
+
+  src = fetchFromGitHub {
+    owner = "strukturag";
+    repo = "nextcloud-spreed-signaling";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JBYhmIXDpovkXM8oYO3B9n2bs+H0GjmuT4Dl3gEQjPo=";
+  };
+
+  vendorHash = "sha256-MGz0tj6QwDXYDtamgN6d5yfIFHToE+XF3HYVsFRxHhM=";
+
+  strictDeps = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Dedicated signaling backend for nextcloud talk";
+    homepage = "https://github.com/strukturag/nextcloud-spreed-signaling";
+    downloadPage = "https://github.com/strukturag/nextcloud-spreed-signaling/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/strukturag/nextcloud-spreed-signaling/releases/tag/v${finalAttrs.version}";
+    mainProgram = "server";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [
+      hensoko
+    ];
+    platforms = [ "x86_64-linux" ];
+  };
+})

From 13486fc8d2b2de4cf100b7b6dd189ac6e57154fd Mon Sep 17 00:00:00 2001
From: Jaco Malan <jacomalan.12@gmail.com>
Date: Tue, 22 Jul 2025 10:10:31 +0200
Subject: [PATCH 53/64] p2pool: 4.8.1 -> 4.9

---
 pkgs/by-name/p2/p2pool/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/p2/p2pool/package.nix b/pkgs/by-name/p2/p2pool/package.nix
index f2220f8801d5..05101533cef1 100644
--- a/pkgs/by-name/p2/p2pool/package.nix
+++ b/pkgs/by-name/p2/p2pool/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "p2pool";
-  version = "4.8.1";
+  version = "4.9";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${version}";
-    hash = "sha256-UnvMR4s6o8n7K+9hig3iSFtbN/BmR6yqjc64X443ctk=";
+    hash = "sha256-nFoR5n6vm6Q1UBxX+3U6O6NExcrM1Mab+WjEOgRSKCE=";
     fetchSubmodules = true;
   };
 
@@ -64,5 +64,6 @@ stdenv.mkDerivation rec {
     ];
     mainProgram = "p2pool";
     platforms = platforms.all;
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }

From d32cb062340e2708757b12a11bbe929c8553908d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Jul 2025 13:52:03 +0000
Subject: [PATCH 54/64] mediawriter: 5.2.7 -> 5.2.8

---
 pkgs/by-name/me/mediawriter/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/me/mediawriter/package.nix b/pkgs/by-name/me/mediawriter/package.nix
index c7735a8786ba..90827c58682f 100644
--- a/pkgs/by-name/me/mediawriter/package.nix
+++ b/pkgs/by-name/me/mediawriter/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mediawriter";
-  version = "5.2.7";
+  version = "5.2.8";
 
   src = fetchFromGitHub {
     owner = "FedoraQt";
     repo = "MediaWriter";
     tag = version;
-    hash = "sha256-wowhV8h8vUw1eehcoXS0DFZtPfLmPfQUTcNDiZjWL3A=";
+    hash = "sha256-8nTWwBf8I4IENh0wColzPg3xjsXg3bubg6ZqNpfLE3c=";
   };
 
   nativeBuildInputs = [

From 7c0a44dc68ddb23f8d3d50a6c6027d0c30ede240 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Jul 2025 14:04:56 +0000
Subject: [PATCH 55/64] balena-cli: 22.1.2 -> 22.1.4

---
 pkgs/by-name/ba/balena-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ba/balena-cli/package.nix b/pkgs/by-name/ba/balena-cli/package.nix
index a5fa301abcf0..5818f54b71c2 100644
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -22,16 +22,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "22.1.2";
+  version = "22.1.4";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-akrZca9bRKqEVgmTKS0n1XliVhDq2eeH1Bo5ubjpYnc=";
+    hash = "sha256-tf9VQN2eI+YXTeQBwIXlxCL3mRi1JcYS+n5wA/L1mQY=";
   };
 
-  npmDepsHash = "sha256-Xq5pp1NNOXyCXnq1mNDaxktbjSzz3T0vOYsYZ7drUNQ=";
+  npmDepsHash = "sha256-Nqpj04OdTynAtDLcXHJLa+eFzC/juwws6a67Ds/eIZQ=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json

From 25b0c1008e2fc22598a13b24f00f63c564511c66 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Jul 2025 14:39:29 +0000
Subject: [PATCH 56/64] vpl-gpu-rt: 25.2.6 -> 25.3.0

---
 pkgs/by-name/vp/vpl-gpu-rt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vp/vpl-gpu-rt/package.nix b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
index 49ee23999cab..bc64a4308723 100644
--- a/pkgs/by-name/vp/vpl-gpu-rt/package.nix
+++ b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vpl-gpu-rt";
-  version = "25.2.6";
+  version = "25.3.0";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "vpl-gpu-rt";
     rev = "intel-onevpl-${version}";
-    hash = "sha256-Le21JODzWgJNLWojGyoYeyJUfi8zk2JNC4C27PC3RlA=";
+    hash = "sha256-S4HjNZrrHxTiHao102fODrUE4isqd2QR7dFfqxEQRx8=";
   };
 
   nativeBuildInputs = [

From 6d50ed837c93d5869a11b6399f3c43795d7ac83f Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Wed, 23 Jul 2025 14:20:43 +0200
Subject: [PATCH 57/64] gitlab: 18.2.0 -> 18.2.1

https://about.gitlab.com/releases/2025/07/23/patch-release-gitlab-18-2-1-released/
---
 pkgs/by-name/gi/gitaly/package.nix                  |  4 ++--
 pkgs/by-name/gi/gitlab-pages/package.nix            |  4 ++--
 pkgs/by-name/gi/gitlab/data.json                    | 12 ++++++------
 pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix |  4 ++--
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 4d844474cb7d..664edf9b73df 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.2.0";
+  version = "18.2.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-e78kokFzVqFGgurlqThxHhfrGiRuZ+XG2g5hRrCuF3Y=";
+      hash = "sha256-h4JklXImKwudJT3pb/UhHwQHKd87c5aSH1xYC0lRWKo=";
     };
 
     vendorHash = "sha256-RjDV4NGmmdT9STQBHiYf3UUYwPmuSg6970/W/ekxin0=";
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index b0e6e6dad31e..452d624d23e2 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.2.0";
+  version = "18.2.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-TcDk816n4483SzTuz5bc8e2efrd2eJdM8jWXpM3DMvY=";
+    hash = "sha256-z1Pl3xeaoqeF/9qOVcuCpuciu1r6NQ4UhlLe9gy9+nE=";
   };
 
   vendorHash = "sha256-OubXCpvGtGqegQmdb6R1zw/0DfQ4FdbJGt7qYYRnWnA=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index aa76ef74a44a..c170a0a5d80b 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "18.2.0",
-  "repo_hash": "0wkxnhrxq3x2ahbb1hffd2c321mz3y1wi7qh89drg8rn4qgz09cd",
+  "version": "18.2.1",
+  "repo_hash": "1i0y46w18476gn98fmkixdjiyrwajz2347p57dg2ijch4ivzpmlv",
   "yarn_hash": "04mqinnbhr6zgab2p1bq6y6b20bf4c4cynkgfc67mzm9xhybr3fk",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.2.0-ee",
+  "rev": "v18.2.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.2.0",
-    "GITLAB_PAGES_VERSION": "18.2.0",
+    "GITALY_SERVER_VERSION": "18.2.1",
+    "GITLAB_PAGES_VERSION": "18.2.1",
     "GITLAB_SHELL_VERSION": "14.43.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.7.0",
-    "GITLAB_WORKHORSE_VERSION": "18.2.0"
+    "GITLAB_WORKHORSE_VERSION": "18.2.1"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index c8f129daff95..739a24476dec 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.2.0";
+  version = "18.2.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   sourceRoot = "${src.name}/workhorse";
 
-  vendorHash = "sha256-fJ1QqVn2t591ZQv9ilwgk+sPwNZNy6bHvpdCPs7S0+s=";
+  vendorHash = "sha256-A+hCyi4P0JkBY2NYGWSpMsHjEgD43g9ZlPrxWL9Vx7Q=";
   buildInputs = [ git ];
   ldflags = [ "-X main.Version=${version}" ];
   doCheck = false;

From 375458eb17697c4d332311f0af61e519675f0c92 Mon Sep 17 00:00:00 2001
From: zi3m5f <113244000+zi3m5f@users.noreply.github.com>
Date: Thu, 24 Oct 2024 14:46:20 +0200
Subject: [PATCH 58/64] appimage-run: add xdg-user-dirs for flutter apps

Many flutter apps indirectly depend on `xdg-user-dir` being in PATH by using `path_provider` which in turn uses `xdg_directories`. See the flutter packages for more:

https://github.com/flutter/packages/blob/a87eddf0c281d5d017093125c1a8d9161257741f/packages/xdg_directories/lib/xdg_directories.dart#L188
---
 pkgs/build-support/appimage/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/build-support/appimage/default.nix b/pkgs/build-support/appimage/default.nix
index 2faf818d24ea..935387f670f6 100644
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@@ -121,6 +121,7 @@ rec {
         xorg.xrandr
         which
         perl
+        xdg-user-dirs # flutter desktop apps
         xdg-utils
         iana-etc
         krb5

From ae380640c5f8d4ca46a64d40f821ef9eb4659df1 Mon Sep 17 00:00:00 2001
From: transcaffeine <transcaffeine@finally.coffee>
Date: Wed, 23 Jul 2025 17:35:15 +0200
Subject: [PATCH 59/64] snipe-it: 8.1.18 -> 8.2.0

Release notes: https://github.com/grokability/snipe-it/releases/tag/v8.2.0
Full changelog: https://github.com/grokability/snipe-it/compare/v8.1.18...v8.2.0
---
 pkgs/by-name/sn/snipe-it/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sn/snipe-it/package.nix b/pkgs/by-name/sn/snipe-it/package.nix
index e5a26d0cc847..a40a53373de5 100644
--- a/pkgs/by-name/sn/snipe-it/package.nix
+++ b/pkgs/by-name/sn/snipe-it/package.nix
@@ -9,16 +9,16 @@
 
 php84.buildComposerProject2 (finalAttrs: {
   pname = "snipe-it";
-  version = "8.1.18";
+  version = "8.2.0";
 
   src = fetchFromGitHub {
     owner = "grokability";
     repo = "snipe-it";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S11RUvblLQNS+LX66zBlVATJTvOMNBxf//zpo+b4AB0=";
+    hash = "sha256-mXcc6wSDoO7z2xYUjwn6hU39OBmsZOw4JeZTpwZMMbI=";
   };
 
-  vendorHash = "sha256-wWm7bB+TUzeRDRPYCL53c9/KspAdsHSEKK759ntiLWo=";
+  vendorHash = "sha256-84kllssopKRAC/Dws+5s6e61/O56B+Uy19jjIV8yLUo=";
 
   postInstall = ''
     snipe_it_out="$out/share/php/snipe-it"

From d377423cccc53c066140438aa975659b38d20228 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Wed, 23 Jul 2025 17:58:52 +0200
Subject: [PATCH 60/64] tests.trivial-builders.writeShellApplication: fix
 assert

This broke in a recent treewide.
---
 .../trivial-builders/test/writeShellApplication.nix             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/trivial-builders/test/writeShellApplication.nix b/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
index 2289dfc2425e..aec15f00aafc 100644
--- a/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
+++ b/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
@@ -42,7 +42,7 @@ linkFarm "writeShellApplication-tests" {
       };
     in
     assert script.meta.mainProgram == "test-meta";
-    assert script.meta.description == "A test for the `writeShellApplication` `meta` argument.";
+    assert script.meta.description == "A test for the `writeShellApplication` `meta` argument";
     script;
 
   test-runtime-inputs = checkShellApplication {

From 0bb15142074125886ed416d61efad15068bb1a94 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 20 Jul 2025 16:29:24 +0200
Subject: [PATCH 61/64] nixos/alertmanager-ntfy: improve documentation about
 topic option

This cannot be left unset, otherwise the evaluation would fail. However,
it should be treated as secret. Update description to reflect that.
---
 .../services/monitoring/prometheus/alertmanager-ntfy.nix     | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager-ntfy.nix b/nixos/modules/services/monitoring/prometheus/alertmanager-ntfy.nix
index 5237a24406b1..4df6a6010d78 100644
--- a/nixos/modules/services/monitoring/prometheus/alertmanager-ntfy.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager-ntfy.nix
@@ -53,6 +53,11 @@ in
               topic = lib.mkOption {
                 type = lib.types.str;
                 description = ''
+                  __Note:__ when using ntfy.sh and other public instances
+                  it is recommended to set this option to an empty string and set the actual topic via
+                  [](#opt-services.prometheus.alertmanager-ntfy.extraConfigFiles) since
+                  the `topic` in `ntfy.sh` is essentially a password.
+
                   The topic to which alerts should be published.
                   Can either be a hardcoded string or a gval expression that evaluates to a string.
                 '';

From 1744f3daf87f5bb4b2b08f6298a55b6a88ea8308 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Jul 2025 16:03:58 +0000
Subject: [PATCH 62/64] linuxKernel.kernels.linux_zen: 6.15.6 -> 6.15.7

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 3bafacbb61bc..0dbca4c2b634 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,9 +16,9 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.15.6"; # zen
+      version = "6.15.7"; # zen
       suffix = "zen1"; # zen
-      sha256 = "11nfmnyyqph9d0hihss9dg96z7dgiqk3p16c2i2li6q52walbj6g"; # zen
+      sha256 = "1q68jvcghn5bw1hfnk06kh1b89mq13b84g2f0nal9i5wzrx4qxbr"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx

From d89aefe54487f49783dbaca670277e2200015b82 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 01:38:03 +0000
Subject: [PATCH 63/64] helmfile: 1.1.2 -> 1.1.3

---
 pkgs/applications/networking/cluster/helmfile/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/helmfile/default.nix b/pkgs/applications/networking/cluster/helmfile/default.nix
index 5a3f688447be..e1091a8043e4 100644
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "helmfile";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "helmfile";
     repo = "helmfile";
     rev = "v${version}";
-    hash = "sha256-mnY8cUaE5NS+Ty3tqxg6DATitZQNLFgxEf8ITufI0g4=";
+    hash = "sha256-Nsfqd54QNRkeqUxUA05+0gtcoopz090/wW+zdFsEii8=";
   };
 
-  vendorHash = "sha256-P9ubNA0eiriAA90UPrhU+x76i8667vPvAWLH7rduYLo=";
+  vendorHash = "sha256-fiwxmF91UCTNi3jgrJnWgPswWXQFLg70d+h3frnu7kU=";
 
   proxyVendor = true; # darwin/linux hash mismatch
 

From 8c833e2a2d309acbfd13f1fbce9dfdfbf1fd2fa9 Mon Sep 17 00:00:00 2001
From: Markus Hauck <markus1189@gmail.com>
Date: Wed, 23 Jul 2025 10:09:38 +0200
Subject: [PATCH 64/64] claude-code: 1.0.57 -> 1.0.58

Updates claude-code to the latest version.
---
 pkgs/by-name/cl/claude-code/package-lock.json | 8 ++++----
 pkgs/by-name/cl/claude-code/package.nix       | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index fd8b9d861d87..77556a1bbf20 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -6,13 +6,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.57"
+        "@anthropic-ai/claude-code": "^1.0.58"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.57",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.57.tgz",
-      "integrity": "sha512-zMymGZzjG+JO9iKC5N5pAy8AxyHIMPCL6U3HYCR3vCj5M+Y0s3GAMma6GkvCXWFixRN6KSZItKw3HbQiaIBYlw==",
+      "version": "1.0.58",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.58.tgz",
+      "integrity": "sha512-XcfqklHSCuBRpVV9vZaAGvdJFAyVKb/UHz2VG9osvn1pRqY7e+HhIOU9X7LeI+c116QhmjglGwe+qz4jOC83CQ==",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 92619dda4202..36fddb8be4ec 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.57";
+  version = "1.0.58";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-BNaBl4NGS1x1emJux610HXwUg1QC1wauRZ6UXn3gcR0=";
+    hash = "sha256-Mp3S269iifNGSEz83IF6bqbgdy6Im1bQjR8oaaL3W8c=";
   };
 
-  npmDepsHash = "sha256-TxKqpiPpxEfYowQswMrcWIotAdmLvHJyQ56vK39asNs=";
+  npmDepsHash = "sha256-iAckljEIJFVtlySHjS414HUFg6XVSlPr8azYqTo1py8=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json