From b3953b613373003d9f2cfb907104ff5b6409b9f2 Mon Sep 17 00:00:00 2001
From: ash <x-hv2j5m@keysmash.solutions>
Date: Mon, 9 Feb 2026 14:03:04 +0000
Subject: [PATCH 01/26] firefox: allow customising generated autoconfig.js

---
 pkgs/applications/networking/browsers/firefox/wrapper.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 14f5fbeca252..1cd33e59f20a 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -80,6 +80,7 @@ let
       # https://mozilla.github.io/policy-templates/
       extraPolicies ? { },
       extraPoliciesFiles ? [ ],
+      extraAutoConfig ? "",
       libName ? browser.libName or applicationName, # Important for tor package or the like
       nixExtensions ? null,
       hasMozSystemDirPatch ? (lib.hasPrefix "firefox" pname && !lib.hasSuffix "-bin" pname),
@@ -542,8 +543,11 @@ let
           prefsDir="$out/${prefsDir}"
           mkdir -p "$prefsDir"
 
-          echo 'pref("general.config.filename", "mozilla.cfg");' > "$prefsDir/autoconfig.js"
-          echo 'pref("general.config.obscure_value", 0);' >> "$prefsDir/autoconfig.js"
+          cat > "$prefsDir/autoconfig.js" << EOF
+          pref("general.config.filename", "mozilla.cfg");
+          pref("general.config.obscure_value", 0);
+          ${extraAutoConfig}
+          EOF
 
           cat > "$libDir/mozilla.cfg" << EOF
           ${mozillaCfg}

From bd794a22dddb7187a788f5a3c6d322c24a8326c0 Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Thu, 12 Mar 2026 03:36:01 +0000
Subject: [PATCH 02/26] blazesym-c: init at 0.1.7

---
 pkgs/by-name/bl/blazesym-c/package.nix | 58 ++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 pkgs/by-name/bl/blazesym-c/package.nix

diff --git a/pkgs/by-name/bl/blazesym-c/package.nix b/pkgs/by-name/bl/blazesym-c/package.nix
new file mode 100644
index 000000000000..6fe542c592df
--- /dev/null
+++ b/pkgs/by-name/bl/blazesym-c/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  elfutils,
+  zlib,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "blazesym-c";
+  version = "0.1.7";
+
+  src = fetchFromGitHub {
+    owner = "libbpf";
+    repo = "blazesym";
+    tag = "capi-v${finalAttrs.version}";
+    hash = "sha256-+wpKDxZgFkezvKzL0xA7FFS/sIx++kwSf32Kl4u0rAg=";
+  };
+
+  cargoHash = "sha256-J14dckx/t0BG+l6NOiBY/Kkq42C98dXIzP9e6LtpgVg=";
+
+  cargoBuildFlags = [
+    "--package"
+    "blazesym-c"
+  ];
+
+  nativeCheckInputs = [
+    pkg-config
+    elfutils
+    zlib
+  ];
+
+  cargoTestFlags = [
+    "--no-run"
+    "--package"
+    "blazesym-c"
+  ];
+
+  postInstall = ''
+    install -Dm644 capi/include/blazesym.h "$out/include/blazesym.h"
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^capi-v([0-9.]+)$"
+    ];
+  };
+
+  meta = {
+    description = "C language bindings for the blazesym library";
+    homepage = "https://github.com/libbpf/blazesym";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ aaronjheng ];
+  };
+})

From 86dce66a491b2df0a3888d93894bfd718518a247 Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Mon, 20 Apr 2026 15:46:42 -0700
Subject: [PATCH 03/26] debian-devscripts: Add missing dependencies

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 pkgs/by-name/de/debian-devscripts/package.nix | 42 +++++++++++++++----
 1 file changed, 35 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/de/debian-devscripts/package.nix b/pkgs/by-name/de/debian-devscripts/package.nix
index b33685dd1cd5..7ade868a5b74 100644
--- a/pkgs/by-name/de/debian-devscripts/package.nix
+++ b/pkgs/by-name/de/debian-devscripts/package.nix
@@ -20,6 +20,8 @@
   help2man,
   nix-update-script,
   sendmailPath ? "/run/wrappers/bin/sendmail",
+  coreutils,
+  util-linux,
 }:
 
 let
@@ -49,6 +51,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
+    substituteInPlace scripts/annotate-output.sh \
+      --replace-fail '/usr/bin/printf' '${lib.getExe' coreutils "printf"}'
     substituteInPlace scripts/debrebuild.pl \
       --replace-fail "/usr/bin/perl" "${perlPackages.perl}/bin/perl"
     patchShebangs scripts
@@ -63,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     makeWrapper
     pkg-config
+    python3Packages.wrapPython
   ];
 
   buildInputs = [
@@ -92,8 +97,19 @@ stdenv.mkDerivation (finalAttrs: {
     FileDirList
     FileTouch
     IOString
+    StringShellQuote
+    YAMLLibYAML
   ]);
 
+  pythonPath = with python3Packages; [
+    junit-xml
+    magic
+    python-apt
+    python-debian
+    requests
+    unidiff
+  ];
+
   preConfigure = ''
     export PERL5LIB="$PERL5LIB''${PERL5LIB:+:}${dpkg}";
     tgtpy="$out/${python.sitePackages}"
@@ -123,17 +139,29 @@ stdenv.mkDerivation (finalAttrs: {
     "PERLMOD_DIR=/share/devscripts"
   ];
 
-  postInstall = ''
+  preFixup = ''
+    buildPythonPath "$out ''${pythonPath[*]}"
+    patchPythonScript "$out/bin/deb-check-file-conflicts"
+    patchPythonScript "$out/bin/deb-janitor"
+    patchPythonScript "$out/bin/debbisect"
+    patchPythonScript "$out/bin/debdiff-apply"
+    patchPythonScript "$out/bin/debftbfs"
+    patchPythonScript "$out/bin/debootsnap"
+    patchPythonScript "$out/bin/reproducible-check"
+    patchPythonScript "$out/bin/sadt"
+    patchPythonScript "$out/bin/suspicious-source"
+    patchPythonScript "$out/bin/wrap-and-sort"
     sed -re 's@(^|[ !`"])/bin/bash@\1${stdenv.shell}@g' -i "$out/bin"/*
-    for i in "$out/bin"/*; do
-      wrapProgram "$i" \
+    ln -s debchange $out/bin/dch
+    ln -s deb2apptainer $out/bin/deb2singularity
+    ln -s pts-subscribe $out/bin/pts-unsubscribe
+    mv "$out/bin" "$out/.bin-wrapped"
+    for i in "$out/.bin-wrapped"/*; do
+      makeWrapper "$i" "$out/bin/''${i#$out/.bin-wrapped/}" \
         --prefix PERL5LIB : "$PERL5LIB" \
         --prefix PERL5LIB : "$out/share/devscripts" \
-        --prefix PYTHONPATH : "$out/${python.sitePackages}" \
-        --prefix PATH : "${dpkg}/bin"
+        --prefix PATH : "${curl}/bin:${dpkg}/bin:${gnupg}/bin:${util-linux}/bin"
     done
-    ln -s debchange $out/bin/dch
-    ln -s pts-subscribe $out/bin/pts-unsubscribe
   '';
 
   passthru.updateScript = nix-update-script {

From 592a45615414b8db78e1ed1915ccdf8fa999a99f Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Mon, 20 Apr 2026 15:49:15 -0700
Subject: [PATCH 04/26] debian-devscripts: Write to stdout and exit 0 for
 --help, --version

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 pkgs/by-name/de/debian-devscripts/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/de/debian-devscripts/package.nix b/pkgs/by-name/de/debian-devscripts/package.nix
index 7ade868a5b74..fe405b1db02d 100644
--- a/pkgs/by-name/de/debian-devscripts/package.nix
+++ b/pkgs/by-name/de/debian-devscripts/package.nix
@@ -48,6 +48,12 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/Debian/devscripts/pull/2/commits/c6a018e0ef50a1b0cb4962a2f96dae7c6f21f1d4.patch";
       hash = "sha256-UpS239JiAM1IYxNuJLdILq2h0xlR5t0Tzhj47xiMHww=";
     })
+    # Write to stdout and exit 0 for --help, --version
+    # https://salsa.debian.org/debian/devscripts/-/merge_requests/637
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/devscripts/-/commit/dbb258ea17749e2d102d4d181fe2709bda5584e7.patch";
+      hash = "sha256-+/E1UhxKk4PYD1bO1kI0qjfBpcMoFbo3xiY45IQ/FWU=";
+    })
   ];
 
   postPatch = ''

From 789e2a4620962a0f852770719c0e7e165ed3144a Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Mon, 20 Apr 2026 15:47:37 -0700
Subject: [PATCH 05/26] debian-devscripts: Add test for --help, --version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

debian-devscripts has 78 scripts with a variety of dependencies, and
it’s hard to test all of them manually.  This should help a little
bit.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 pkgs/by-name/de/debian-devscripts/package.nix | 100 ++++++++++++++++++
 1 file changed, 100 insertions(+)

diff --git a/pkgs/by-name/de/debian-devscripts/package.nix b/pkgs/by-name/de/debian-devscripts/package.nix
index fe405b1db02d..1489cfbc5725 100644
--- a/pkgs/by-name/de/debian-devscripts/package.nix
+++ b/pkgs/by-name/de/debian-devscripts/package.nix
@@ -20,6 +20,7 @@
   help2man,
   nix-update-script,
   sendmailPath ? "/run/wrappers/bin/sendmail",
+  runCommand,
   coreutils,
   util-linux,
 }:
@@ -177,6 +178,105 @@ stdenv.mkDerivation (finalAttrs: {
     ];
   };
 
+  passthru.tests.helpVersion =
+    runCommand "debian-devscripts-test-help-version"
+      {
+        nativeBuildInputs = [ finalAttrs.finalPackage ];
+      }
+      ''
+        export HOME=/tmp
+
+        for cmd in ${finalAttrs.finalPackage}/bin/*; do
+            echo "Running $cmd"
+
+            case "''${cmd##*/}" in
+
+            # Fails with an error from python-apt
+            debootsnap | \
+            mk-origtargz | \
+            reproducible-check)
+                ! output=$("$cmd" --help 2>&1)
+                case "$output" in
+                *'
+        apt_pkg.Error: E:Unable to determine a suitable packaging system type')
+                    ;;
+                *)
+                    "$cmd" --help
+                    ;;
+                esac
+                ! "$cmd" --version
+                ;;
+
+            # Supports neither -h, --help, nor --version
+            add-patch | \
+            archpath | \
+            debrsign | \
+            dscextract | \
+            edit-patch | \
+            list-unreleased | \
+            namecheck | \
+            salsa | \
+            svnpath)
+                ! "$cmd" -h
+                ! "$cmd" --help
+                ! "$cmd" --version
+                ;;
+
+            # Supports -h but neither --help nor --version
+            deb2apptainer | \
+            deb2docker | \
+            deb2singularity)
+               "$cmd" -h
+               ! "$cmd" --help
+               ! "$cmd" --version
+               ;;
+
+            # Supports --help but not --version
+            annotate-output | \
+            dd-list | \
+            deb-check-file-conflicts | \
+            deb-janitor | \
+            debbisect | \
+            debcheckout | \
+            debdiff-apply | \
+            debftbfs | \
+            debrebuild | \
+            debrepro | \
+            hardening-check | \
+            ltnu | \
+            origtargz | \
+            sadt | \
+            suspicious-source | \
+            who-permits-upload | \
+            wrap-and-sort)
+                "$cmd" --help
+                ! "$cmd" --version
+                ;;
+
+            # Everything else supports --help and --version
+            *)
+                "$cmd" --help
+                output=$("$cmd" --version)
+                case "$output" in
+                *'version ${finalAttrs.version}
+        '* | *'version ${finalAttrs.version}.
+        '* | *'version
+        ${finalAttrs.version} '* | *'v. ${finalAttrs.version}
+        '* | *'devscripts ${finalAttrs.version}.'* | *'(devscripts ${finalAttrs.version})'*)
+                    ;;
+                *)
+                    echo "$cmd --version did not output the expected version ${finalAttrs.version}:" >&2
+                    "$cmd" --version
+                    false
+                esac
+                ;;
+
+            esac
+        done
+
+        : >"$out"
+      '';
+
   meta = {
     description = "Debian package maintenance scripts";
     license = lib.licenses.free; # Mix of public domain, Artistic+GPL, GPL1+, GPL2+, GPL3+, and GPL2-only... TODO

From fc49c93e11d39dbb380c405282f51bf60d8b8b3f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 9 May 2026 04:10:28 +0200
Subject: [PATCH 06/26] python314Packages.pyobjc-framework-Quartz: share source
 with pyobjc-core

---
 .../python-modules/pyobjc-framework-Quartz/default.nix   | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/pyobjc-framework-Quartz/default.nix b/pkgs/development/python-modules/pyobjc-framework-Quartz/default.nix
index 0c238cbb69d0..b3333494c09d 100644
--- a/pkgs/development/python-modules/pyobjc-framework-Quartz/default.nix
+++ b/pkgs/development/python-modules/pyobjc-framework-Quartz/default.nix
@@ -1,6 +1,5 @@
 {
   buildPythonPackage,
-  fetchFromGitHub,
   setuptools,
   darwin,
   pyobjc-core,
@@ -10,15 +9,9 @@
 
 buildPythonPackage rec {
   pname = "pyobjc-framework-Quartz";
-  version = "11.1";
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "ronaldoussoren";
-    repo = "pyobjc";
-    tag = "v${version}";
-    hash = "sha256-2qPGJ/1hXf3k8AqVLr02fVIM9ziVG9NMrm3hN1de1Us=";
-  };
+  inherit (pyobjc-core) version src;
 
   sourceRoot = "${src.name}/pyobjc-framework-Quartz";
 

From 0a378efb05545294cff237d6ca509530a7f3dec8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 9 May 2026 04:10:40 +0200
Subject: [PATCH 07/26] python314Packages.pyobjc-framework-Security: share
 source with pyobjc-core

---
 .../python-modules/pyobjc-framework-Security/default.nix | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/pyobjc-framework-Security/default.nix b/pkgs/development/python-modules/pyobjc-framework-Security/default.nix
index 8209ff78bd8d..15012555150d 100644
--- a/pkgs/development/python-modules/pyobjc-framework-Security/default.nix
+++ b/pkgs/development/python-modules/pyobjc-framework-Security/default.nix
@@ -1,6 +1,5 @@
 {
   buildPythonPackage,
-  fetchFromGitHub,
   setuptools,
   darwin,
   pyobjc-core,
@@ -10,15 +9,9 @@
 
 buildPythonPackage rec {
   pname = "pyobjc-framework-Security";
-  version = "11.1";
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "ronaldoussoren";
-    repo = "pyobjc";
-    tag = "v${version}";
-    hash = "sha256-2qPGJ/1hXf3k8AqVLr02fVIM9ziVG9NMrm3hN1de1Us=";
-  };
+  inherit (pyobjc-core) version src;
 
   sourceRoot = "${src.name}/pyobjc-framework-Security";
 

From 7f6ba77d871c022f97cfdaf234309127fdf07775 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 9 May 2026 04:10:45 +0200
Subject: [PATCH 08/26] python314Packages.pyobjc-framework-WebKit: share source
 with pyobjc-core

---
 .../python-modules/pyobjc-framework-WebKit/default.nix   | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/pyobjc-framework-WebKit/default.nix b/pkgs/development/python-modules/pyobjc-framework-WebKit/default.nix
index 9e466395e469..4f76fab4ca81 100644
--- a/pkgs/development/python-modules/pyobjc-framework-WebKit/default.nix
+++ b/pkgs/development/python-modules/pyobjc-framework-WebKit/default.nix
@@ -1,6 +1,5 @@
 {
   buildPythonPackage,
-  fetchFromGitHub,
   setuptools,
   darwin,
   pyobjc-core,
@@ -10,15 +9,9 @@
 
 buildPythonPackage rec {
   pname = "pyobjc-framework-WebKit";
-  version = "11.1";
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "ronaldoussoren";
-    repo = "pyobjc";
-    tag = "v${version}";
-    hash = "sha256-2qPGJ/1hXf3k8AqVLr02fVIM9ziVG9NMrm3hN1de1Us=";
-  };
+  inherit (pyobjc-core) version src;
 
   sourceRoot = "${src.name}/pyobjc-framework-WebKit";
 

From b26a3c9069d47a5d2a8ecbde5ba9b4e62b6529e4 Mon Sep 17 00:00:00 2001
From: Vinicius Deolindo <git@vini.cat>
Date: Sat, 16 May 2026 17:31:02 -0300
Subject: [PATCH 09/26] maintainers: add iniw

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3cde304a5cbc..fefe708296de 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11643,6 +11643,12 @@
     name = "Silvan Mosberger";
     keys = [ { fingerprint = "6C2B 55D4 4E04 8266 6B7D  DA1A 422E 9EDA E015 7170"; } ];
   };
+  iniw = {
+    email = "git@vini.cat";
+    github = "iniw";
+    githubId = 30220881;
+    name = "Vinicius Deolindo";
+  };
   insipx = {
     email = "github@andrewplaza.dev";
     github = "insipx";

From 69b0df04a0a1c4f7c025a066a997d432f4df3b8f Mon Sep 17 00:00:00 2001
From: Vinicius Deolindo <git@vini.cat>
Date: Sat, 16 May 2026 17:52:30 -0300
Subject: [PATCH 10/26] linear: init at 1.30.2

---
 pkgs/by-name/li/linear/package.nix | 48 ++++++++++++++++++++++++++++++
 pkgs/by-name/li/linear/update.sh   | 18 +++++++++++
 2 files changed, 66 insertions(+)
 create mode 100644 pkgs/by-name/li/linear/package.nix
 create mode 100755 pkgs/by-name/li/linear/update.sh

diff --git a/pkgs/by-name/li/linear/package.nix b/pkgs/by-name/li/linear/package.nix
new file mode 100644
index 000000000000..a0c8816a50bd
--- /dev/null
+++ b/pkgs/by-name/li/linear/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  _7zz,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "linear";
+  version = "1.30.2";
+
+  src = fetchurl {
+    url = "https://releases.linear.app/Linear-${finalAttrs.version}-universal.dmg";
+    hash = "sha256-udtN7sOnbT1B684q/JhPFGq8mYvhc5CbTxuJi6NYFac=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [ _7zz ];
+
+  sourceRoot = "Linear";
+
+  # -snld prevents "ERROR: Dangerous symbolic link path was ignored".
+  # -xr'!*:com.apple.*' prevents macOS extended attributes from being
+  # extracted as regular files, which corrupts the .app bundle.
+  unpackCmd = "7zz x -snld -xr'!*:com.apple.*' $curSrc";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications"
+    cp -R Linear.app "$out/Applications"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "App to manage software development and track bugs";
+    homepage = "https://linear.app/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ iniw ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/li/linear/update.sh b/pkgs/by-name/li/linear/update.sh
new file mode 100755
index 000000000000..c6ee30c2ac3a
--- /dev/null
+++ b/pkgs/by-name/li/linear/update.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl gnugrep common-updater-scripts
+#shellcheck shell=bash
+
+set -eu -o pipefail
+
+source_url="https://releases.linear.app/mac"
+
+version="$(curl -L -I "$source_url" | grep -ioE 'filename="Linear-[0-9]+(\.[0-9]+)*-universal\.dmg"' | grep -oE '[0-9]+(\.[0-9]+)*')"
+
+if [[ -z $version ]]; then
+  echo "Could not find the latest Linear version in release headers" >&2
+  exit 1
+fi
+
+hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url --type sha256 "https://releases.linear.app/Linear-${version}-universal.dmg")")
+
+update-source-version linear "$version" "$hash" --ignore-same-version

From ffa1abed73395395fe26a57b023f73060d91e85e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 17 May 2026 07:37:17 +0000
Subject: [PATCH 11/26] igir: 5.0.1 -> 5.0.2

---
 pkgs/by-name/ig/igir/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ig/igir/package.nix b/pkgs/by-name/ig/igir/package.nix
index d676eebee49d..16fcb1d7a14e 100644
--- a/pkgs/by-name/ig/igir/package.nix
+++ b/pkgs/by-name/ig/igir/package.nix
@@ -18,16 +18,16 @@
 
 buildNpmPackage rec {
   pname = "igir";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchFromGitHub {
     owner = "emmercm";
     repo = "igir";
     rev = "v${version}";
-    hash = "sha256-EKi1m2p4/7E/godxEPnaGaqkRX6PlSbqQYQXw+Eg5hA=";
+    hash = "sha256-vMas5QGpk3bwn4VkdRtYga8cgf6G+dVr3jJCGeyb5mQ=";
   };
 
-  npmDepsHash = "sha256-98+DFC7j3lmr9GGnDbrzChzGJG1uU1TTr429JAx7310=";
+  npmDepsHash = "sha256-QhvGc8HLY61LptHdPZbOTjr5jDvUZ4dML+MV7KrqU/0=";
 
   # I have no clue why I have to do this
   postPatch = ''

From 9d5c51b459eea3490ff77c741da9c21b8b9ab24b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 17 May 2026 10:52:19 +0000
Subject: [PATCH 12/26] ckan: 1.36.2 -> 1.36.4

---
 pkgs/by-name/ck/ckan/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ck/ckan/package.nix b/pkgs/by-name/ck/ckan/package.nix
index 01d4d82258ec..3b54608150a7 100644
--- a/pkgs/by-name/ck/ckan/package.nix
+++ b/pkgs/by-name/ck/ckan/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ckan";
-  version = "1.36.2";
+  version = "1.36.4";
 
   src = fetchurl {
     url = "https://github.com/KSP-CKAN/CKAN/releases/download/v${version}/ckan.exe";
-    hash = "sha256-EZSf+n6QUEZW2Bjl2ac/6e+Jo+PlxWd1Z1PKHvgC/Ko=";
+    hash = "sha256-d0gILN/PLbtfUCJhsYr8hQAxk4lMYEJ9BLCseo3+994=";
   };
 
   icon = fetchurl {

From ae7b0497e991dc250aafb43ce6327a17684666f6 Mon Sep 17 00:00:00 2001
From: Markus Hauck <markus1189@gmail.com>
Date: Mon, 18 May 2026 08:41:47 +0200
Subject: [PATCH 13/26] claude-code: 2.1.141 -> 2.1.143

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
---
 pkgs/by-name/cl/claude-code/manifest.json | 38 +++++++++++------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/pkgs/by-name/cl/claude-code/manifest.json b/pkgs/by-name/cl/claude-code/manifest.json
index a64dd406a5e1..e9444eb564d4 100644
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.141",
-  "commit": "4f4623ddd339e1c1b87d659b7c9eb3b66397e7a3",
-  "buildDate": "2026-05-13T21:34:55Z",
+  "version": "2.1.143",
+  "commit": "cfb8132e4c3551e2773f41a1900efd1cc93637db",
+  "buildDate": "2026-05-15T17:47:13Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "31ac95bb19a33b1d0cddd3f3ff594bf8bfd2be5051cd2af7867109641cab705e",
-      "size": 207076896
+      "checksum": "2701c6cfd68483f8faf0316a1ba6481a1455a90645ada179f0c48d8c36d722ef",
+      "size": 207605280
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "fa9000fdf4a522fcaf30ea283555aca2ba5d0e76cdb8842154b7735b558c7c25",
-      "size": 209591056
+      "checksum": "bc8ff4ce02b765a033808fb596f9522306cbe5c50d21344ed8752c08966f362c",
+      "size": 210119440
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "dc931e24f62afbadc8dc68115278b08493825a3ed1ea753d587077181a6cc63b",
-      "size": 232437384
+      "checksum": "32e8edc4a5c3c41d18607c75d1b8e7bec643330c03e266be46ac3b41a446c4eb",
+      "size": 232961672
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "832be26e8f15b2ae99e520a22b034fc4bfad1cb5b84de6b706487072c56bb42e",
-      "size": 232572624
+      "checksum": "f75fdc3ff9d9cd494b86192f9e349b5c5c6d3970ed4d5cd5c7b330c5a2b1dcc4",
+      "size": 233088720
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "e6e6a481c0aab084198b3529c6d96774e14d18da999aba7d22e207952ed8faf0",
-      "size": 225292120
+      "checksum": "e68903ec56ddd5560bb0820c96c8f7a4193e7eab6236ede56cb2e05f450ce44f",
+      "size": 225816408
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "8af1f6e19d3786cac74dcf369ff58f79df08be429813b29ae076247cc8d1ddae",
-      "size": 226966576
+      "checksum": "e4cb8588ed6e38f9920bdaa2611263d4a0b0d11300f1d23945df234fdf5e278a",
+      "size": 227482672
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "3ab326c39d195dbe394c173f31126d880a80270f98ade74ef555429e2dadb19f",
-      "size": 228410016
+      "checksum": "e480244f2a4660fe76ed32442c1e3e2edda8fb5433417e73faba39f0e7f69eb6",
+      "size": 228902560
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "f622af48157bce7a24905fa6121191f5a472800ed9f77fa41c59bd5ecd161285",
-      "size": 224374432
+      "checksum": "5cbad78d2f316fedd0d621289aae558aaf259b404d0a46e0e49662ef3b397986",
+      "size": 224866976
     }
   }
 }

From 06a68a96bbc0f0c558d91ce2d2a334af3896a913 Mon Sep 17 00:00:00 2001
From: Markus Hauck <markus1189@gmail.com>
Date: Mon, 18 May 2026 08:41:48 +0200
Subject: [PATCH 14/26] vscode-extensions.anthropic.claude-code: 2.1.141 ->
 2.1.143

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
---
 .../extensions/anthropic.claude-code/default.nix       | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 389a05555bf8..c288d54edfb7 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-pGJ1coic0kdjXUI6HCEkQsyQC5YU0jnA1hmN6MaPfwg=";
+          hash = "sha256-VTbeOLAGmaVy9PL5/Y+ebbCNa6ki4cx0VGXhzLuz1ow=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-NppbZ/gCZYGZna8bs/nUASxyqd6Bv0AOYTEbfaqJWyI=";
+          hash = "sha256-j8cDVoxT38/dmorTlPQjrd2GQS+BkoatIbQQzB1c7GA=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-oM2H7CJBS0G8ieiI6twqpA257QWWytdbpkV2Q2D7R6o=";
+          hash = "sha256-Kl23fdHFlh9cvfMtXNr6GI+AWknPFMM1lGFCuJY5kXw=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-lRChL8hGIc4zJ/CBwPkLYY1U5YhfM0DrW//C1dNi//A=";
+          hash = "sha256-M1dfKzjfHeH4xmvnuRmBsnhaQryL6c84nPrl2NGQT5k=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.141";
+      version = "2.1.143";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

From 50313ffaabe53bc9964f37a5656f2f01896008da Mon Sep 17 00:00:00 2001
From: connordennyomalley <connordennyomalley@gmail.com>
Date: Mon, 27 Apr 2026 13:30:11 +0100
Subject: [PATCH 15/26] ginac: build using gcc

On Darwin the stdenv uses clang, which builds binaries that crash with
example inputs, "SIGSEGV (Address boundary error)". Ginac documentation
says "We used GCC for development so if you have a different compiler
you are on your own." Switching to always using gcc aligns the
derivation with the build instructions.
---
 pkgs/by-name/gi/ginac/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/gi/ginac/package.nix b/pkgs/by-name/gi/ginac/package.nix
index 87406bb062c0..046ff433ed28 100644
--- a/pkgs/by-name/gi/ginac/package.nix
+++ b/pkgs/by-name/gi/ginac/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  gccStdenv,
   fetchurl,
   cln,
   pkg-config,
@@ -9,7 +10,7 @@
   python3,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+gccStdenv.mkDerivation (finalAttrs: {
   pname = "ginac";
   version = "1.8.10";
 

From eb64f95d201badf76e4d4745747ad5346ed4d472 Mon Sep 17 00:00:00 2001
From: connordennyomalley <connordennyomalley@gmail.com>
Date: Tue, 28 Apr 2026 12:44:30 +0100
Subject: [PATCH 16/26] ginac: Test using example

Build and run an example program from the ginac documentation.
---
 pkgs/by-name/gi/ginac/ginac-example-test.nix | 36 ++++++++++++++++++++
 pkgs/by-name/gi/ginac/package.nix            |  3 ++
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/by-name/gi/ginac/ginac-example-test.nix

diff --git a/pkgs/by-name/gi/ginac/ginac-example-test.nix b/pkgs/by-name/gi/ginac/ginac-example-test.nix
new file mode 100644
index 000000000000..501beb499683
--- /dev/null
+++ b/pkgs/by-name/gi/ginac/ginac-example-test.nix
@@ -0,0 +1,36 @@
+{
+  runCommand,
+  gccStdenv,
+  cln,
+  ginac,
+}:
+runCommand "ginac-example-test"
+  {
+    nativeBuildInputs = [
+      gccStdenv.cc
+      ginac
+      cln
+    ];
+  }
+  ''
+    echo "
+      #include <iostream>
+      #include <ginac/ginac.h>
+      using namespace std;
+      using namespace GiNaC;
+
+      int main() {
+        symbol x(\"x\"), y(\"y\");
+        ex poly;
+
+        for (int i=0; i<3; ++i) {
+          poly += factorial(i+16)*pow(x,i)*pow(y,2-i);
+        }
+
+        cout << poly << endl;
+        return 0;
+      }" > hello.cc
+    c++ -lginac -lcln hello.cc -o hello
+    ./hello
+    mkdir $out
+  ''
diff --git a/pkgs/by-name/gi/ginac/package.nix b/pkgs/by-name/gi/ginac/package.nix
index 046ff433ed28..1937b6577fa4 100644
--- a/pkgs/by-name/gi/ginac/package.nix
+++ b/pkgs/by-name/gi/ginac/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   gccStdenv,
+  callPackage,
   fetchurl,
   cln,
   pkg-config,
@@ -36,6 +37,8 @@ gccStdenv.mkDerivation (finalAttrs: {
 
   configureFlags = [ "--disable-rpath" ];
 
+  passthru.tests.example = callPackage ./ginac-example-test.nix { ginac = finalAttrs.finalPackage; };
+
   meta = {
     description = "GiNaC C++ library for symbolic manipulations";
     homepage = "https://www.ginac.de/";

From 3f09f048f14d2141b5167970a0ce95991cf9f017 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 14 May 2026 16:48:33 +0200
Subject: [PATCH 17/26] macaulay2: fix darwin build

Co-authored-by: coolcuber <rpgeorg@clemson.edu>
---
 pkgs/by-name/ma/macaulay2/package.nix | 29 ++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/macaulay2/package.nix b/pkgs/by-name/ma/macaulay2/package.nix
index 861e814322ba..d2fc7de8fc46 100644
--- a/pkgs/by-name/ma/macaulay2/package.nix
+++ b/pkgs/by-name/ma/macaulay2/package.nix
@@ -23,6 +23,7 @@
   flint,
   frobby,
   gdbm,
+  getconf,
   gfortran,
   gfan,
   givaro,
@@ -53,10 +54,11 @@
   readline,
   singular,
   texinfo,
-  time,
+  runtimeShell,
   topcom,
   which,
   xz,
+  llvmPackages,
 
   downloadDocs ? true,
 }:
@@ -87,6 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
     flint
     frobby
     gdbm
+    getconf
     givaro
     glpk
     gtest
@@ -111,6 +114,9 @@ stdenv.mkDerivation (finalAttrs: {
     readline
     singular
     xz
+  ]
+  ++ lib.optionals stdenv.cc.isClang [
+    llvmPackages.openmp
   ];
 
   nativeBuildInputs = [
@@ -119,6 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
     emacs-nox
     flex
     gdbm
+    getconf
     gfortran
     makeWrapper
     pkg-config
@@ -147,6 +154,13 @@ stdenv.mkDerivation (finalAttrs: {
     sed -i 's/AC_SUBST(REL,.*uname -r.*)/AC_SUBST(REL,"")/' configure.ac
     substituteInPlace Macaulay2/packages/DeterminantalRepresentations.m2 \
       --replace-fail "eps = 1e-15" "eps = 1e-14"
+  ''
+  # ForeignFunctions.m2 uses `brew --prefix` to discover potential library paths,
+  # which fails when Homebrew is not installed.
+  # We patch it to return an empty path instead, which should be harmless
+  + ''
+    substituteInPlace Macaulay2/packages/ForeignFunctions.m2 \
+      --replace-fail 'get "!brew --prefix"' 'try get "!brew --prefix" else ""'
   '';
 
   preConfigure = ''
@@ -181,8 +195,17 @@ stdenv.mkDerivation (finalAttrs: {
     "MakeDocumentation=false"
   ];
 
+  env.LDFLAGS = lib.concatStringsSep " " (
+    lib.optionals stdenv.hostPlatform.isDarwin [
+      "-lblas"
+    ]
+  );
+
   postInstall = ''
-    wrapProgram "$out/bin/M2" \
+    substituteInPlace "$out/bin/M2" \
+      --replace-fail "/bin/sh" "${runtimeShell}"
+
+    wrapProgram "$out/bin/M2-binary" \
       --prefix PATH : ${
         lib.makeBinPath [
           _4ti2
@@ -198,7 +221,7 @@ stdenv.mkDerivation (finalAttrs: {
           topcom
         ]
       } \
-      --prefix LD_LIBRARY_PATH : ${
+      --prefix ${if stdenv.hostPlatform.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH"} : ${
         lib.makeLibraryPath [
           cddlib
           flint

From c7089ae00b13b11347c307a69e4df9c0ecba4af1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 20:33:56 +0000
Subject: [PATCH 18/26] limine-full: 12.2.0 -> 12.3.0

---
 pkgs/by-name/li/limine/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index d3182147cddc..ab4921dcd5ca 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "12.2.0";
+  version = "12.3.0";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/Limine-Bootloader/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-24oRmHjP7q1jwKeCNsV3xAU5xXWUlpUOoO0yps9WeGU=";
+    hash = "sha256-3lMqcsCC0jP/UMkXscsQPQjlL6rkuJ6WRJFpXZ+sJDw=";
   };
 
   enableParallelBuilding = true;

From 14b79b79616e1fa7141a9b1ab75667c2fe27b4cb Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Mon, 18 May 2026 13:33:37 -0700
Subject: [PATCH 19/26] debian-devscripts: Remove tests that expect failure

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 pkgs/by-name/de/debian-devscripts/package.nix | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/pkgs/by-name/de/debian-devscripts/package.nix b/pkgs/by-name/de/debian-devscripts/package.nix
index 1489cfbc5725..10c6e93c7f47 100644
--- a/pkgs/by-name/de/debian-devscripts/package.nix
+++ b/pkgs/by-name/de/debian-devscripts/package.nix
@@ -195,16 +195,6 @@ stdenv.mkDerivation (finalAttrs: {
             debootsnap | \
             mk-origtargz | \
             reproducible-check)
-                ! output=$("$cmd" --help 2>&1)
-                case "$output" in
-                *'
-        apt_pkg.Error: E:Unable to determine a suitable packaging system type')
-                    ;;
-                *)
-                    "$cmd" --help
-                    ;;
-                esac
-                ! "$cmd" --version
                 ;;
 
             # Supports neither -h, --help, nor --version
@@ -217,9 +207,6 @@ stdenv.mkDerivation (finalAttrs: {
             namecheck | \
             salsa | \
             svnpath)
-                ! "$cmd" -h
-                ! "$cmd" --help
-                ! "$cmd" --version
                 ;;
 
             # Supports -h but neither --help nor --version
@@ -227,8 +214,6 @@ stdenv.mkDerivation (finalAttrs: {
             deb2docker | \
             deb2singularity)
                "$cmd" -h
-               ! "$cmd" --help
-               ! "$cmd" --version
                ;;
 
             # Supports --help but not --version
@@ -250,7 +235,6 @@ stdenv.mkDerivation (finalAttrs: {
             who-permits-upload | \
             wrap-and-sort)
                 "$cmd" --help
-                ! "$cmd" --version
                 ;;
 
             # Everything else supports --help and --version

From 829b43abc9c2f64c76901bff6c7e5c83851d8ed9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 22:46:53 +0000
Subject: [PATCH 20/26] python3Packages.llama-cpp-python: 0.3.22 -> 0.3.23

---
 pkgs/development/python-modules/llama-cpp-python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/llama-cpp-python/default.nix b/pkgs/development/python-modules/llama-cpp-python/default.nix
index 72a1bdccf7f8..8f52191ff681 100644
--- a/pkgs/development/python-modules/llama-cpp-python/default.nix
+++ b/pkgs/development/python-modules/llama-cpp-python/default.nix
@@ -40,14 +40,14 @@ let
 in
 buildPythonPackage.override { stdenv = stdenvTarget; } rec {
   pname = "llama-cpp-python";
-  version = "0.3.22";
+  version = "0.3.23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "abetlen";
     repo = "llama-cpp-python";
     tag = "v${version}";
-    hash = "sha256-Mdz8aTBo3bwoqtjarXnQuNYjcaU+p4HKdMQfSoYwq60=";
+    hash = "sha256-LqSgohfTv02RNZGMjKG0Pq2vHuIX+446uI2Q3KRmnzI=";
     fetchSubmodules = true;
   };
 

From 7db688e18f61212c94c4f79c50019406eb59f75d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 22:57:59 +0000
Subject: [PATCH 21/26] tideways-cli: 1.2.16 -> 1.2.18

---
 pkgs/by-name/ti/tideways-cli/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ti/tideways-cli/package.nix b/pkgs/by-name/ti/tideways-cli/package.nix
index f85fa46b8650..68e553eb4c28 100644
--- a/pkgs/by-name/ti/tideways-cli/package.nix
+++ b/pkgs/by-name/ti/tideways-cli/package.nix
@@ -11,7 +11,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-cli";
-  version = "1.2.16";
+  version = "1.2.18";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -38,19 +38,19 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/cli/${finalAttrs.version}/tideways-cli_linux_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-dyCK64IxHbuW7Ciwpv4dz6pksSXp4rJlx76isUCm3tY=";
+        hash = "sha256-+TXQWaZ6+ahXcy8Kibh7VuqaclLglI3FJnW5qMjmuAg=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/cli/${finalAttrs.version}/tideways-cli_linux_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-C6A+FE+M1T8FNNvA7qzwUWuNxnHwFaS5vUp9avQoFQ0=";
+        hash = "sha256-9/WBa6qzIc+yulPFVC6tpfdrhxCda23iLmu+Vy99HvQ=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/cli/${finalAttrs.version}/tideways-cli_macos_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-dFscQSdRBiT6giSGx+ASPKS+6/WcqtrlvEuqhblCFTE=";
+        hash = "sha256-5s9FTA3lI6mrt34di80nrP/5oTH2lqz1BwFo2Pd8ErY=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/cli/${finalAttrs.version}/tideways-cli_macos_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-v3h2IdET0SACeTzXZyuq0SFqBDU+oDNMn7im8hBqWaU=";
+        hash = "sha256-3dwFFYk2WIqQf6sFVc4Jq1Zhgb4Tvvlj0IhQlnyJ6KA=";
       };
     };
 

From f2c799c9dfff8d8386ec4503a9297052fb01c2d2 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Thu, 2 Sep 2021 23:19:25 -0700
Subject: [PATCH 22/26] pkgsStatic: make pkgsMusl a no-op

When pkgsStatic is already musl, we can let pkgsMusl simply be a no-op.
As the interaction of pkgsStatic and pkgsMusl machinery is currently
broken, this fixes pkgsStatic.pkgsMusl.stdenv.
---
 pkgs/top-level/stage.nix | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 048ab88854ed..8aa46192660f 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -290,9 +290,15 @@ let
     # Currently uses Musl on Linux (couldn’t get static glibc to work).
     pkgsStatic = nixpkgsFun {
       overlays = [
-        (self': super': {
-          pkgsStatic = super';
-        })
+        (
+          self': super':
+          {
+            pkgsStatic = super';
+          }
+          // lib.optionalAttrs super'.stdenv.hostPlatform.isMusl {
+            pkgsMusl = super';
+          }
+        )
       ]
       ++ overlays;
       crossSystem = {

From bf49b3336792dc353ad9b2acb04c5847f18c1e1c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 19 May 2026 03:11:17 +0200
Subject: [PATCH 23/26] discourse: 2026.1.3 -> 2026.1.4

https://releases.discourse.org/changelog/v2026.1.4/

Fixes:

- CVE-2026-44779
  Bot debug endpoints disclose whisper translation audit logs
- CVE-2026-44782
  GroupPostSerializer leaks hidden full names through reaction post association
- CVE-2026-44783
  Replying to a whisper lets non-whisperers create staff-only whisper posts
- CVE-2026-44786
  Public chat MessageBus broadcasts are not restricted to chat-eligible users
- CVE-2026-45085
  Chat misauthorization and information disclosure
- CVE-2026-44784
  Non-staff group owners can see email password in plaintext through group history
- CVE-2026-44785
  Hidden reply-to post raw can be disclosed through AI explain prompts
- CVE-2026-45775
  Cross-site backup access via path traversal in multisite local backups
- (CVE Pending)
  Don't leak restricted tag group names via tag info
- CVE-2026-34154
  Subscription access bypass in discourse-subscriptions plugin
- CVE-2026-33514
  Information Disclosure in Form Template API Due to Missing Authorization
- CVE-2026-44780
  Category queue reviewers can read raw incoming emails from queued posts
- (CVE Pending)
  Prevent webhook payload disclosure on event redelivery
- CVE-2026-32244
  Cached outdated summaries can leak removed content
---
 pkgs/servers/web-apps/discourse/default.nix          | 4 ++--
 pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock | 4 ++--
 pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix   | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index 96aba467b7be..64d7f371ec5b 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -53,13 +53,13 @@
 }:
 
 let
-  version = "2026.1.3";
+  version = "2026.1.4";
 
   src = fetchFromGitHub {
     owner = "discourse";
     repo = "discourse";
     rev = "v${version}";
-    sha256 = "sha256-0jbO1rJQ0AISo7h+SZfovubReCjR2zT6KWX9LxBeFtE=";
+    sha256 = "sha256-kQYDKZIMsWByuCZQfUlwhoIew5QykVylRMh6xvrHIBY=";
   };
 
   pnpm = pnpm_10;
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
index 01df10a128c3..2183789763f8 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
@@ -304,7 +304,7 @@ GEM
     mini_sql (1.6.0)
     mini_suffix (0.3.3)
       ffi (~> 1.9)
-    minio_runner (1.0.0)
+    minio_runner (1.0.1)
     minitest (5.26.2)
     mocha (2.8.2)
       ruby2_keywords (>= 0.0.5)
@@ -1082,7 +1082,7 @@ CHECKSUMS
   mini_scheduler (0.18.0) sha256=d2f084f38da8d76c5844a92f0d6bd01fc9982a8b5e6c7679b6cf44c82da33503
   mini_sql (1.6.0) sha256=5296637f6a4af5bb43e06788037e9a2968ff9c8eb65928befcba8cb41f42d6ee
   mini_suffix (0.3.3) sha256=8d1d33f92f69a2247c9b7d27173235da90479d955cdb863b63a7f53843b722e7
-  minio_runner (1.0.0) sha256=ca0fc56a90c63b65a26cda632938c9075046835d41f4b9d1e165b0550eae0538
+  minio_runner (1.0.1) sha256=3675ad7abd79177b3fdd9f37e20fe46f7d4dcbb41f3f30a53db2207277241795
   minitest (5.26.2) sha256=f021118a6185b9ba9f5af71f2ba103ad770c75afde9f2ab8da512677c550cde3
   mocha (2.8.2) sha256=1f77e729db47e72b4ef776461ce20caeec2572ffdf23365b0a03608fee8f4eee
   msgpack (1.8.0) sha256=e64ce0212000d016809f5048b48eb3a65ffb169db22238fb4b72472fecb2d732
diff --git a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
index 2d77c94cb35b..ab25c69fbcb2 100644
--- a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
@@ -1781,10 +1781,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0f05mq75bc35w78vkx21bn1lcl07r4w2jqysdji6afy6j1mca3ya";
+      sha256 = "158p4ivp485j7njk0gqznk5lszbgwh7y4dwzvlzpn5vrpmxasx9n";
       type = "gem";
     };
-    version = "1.0.0";
+    version = "1.0.1";
   };
   minitest = {
     groups = [

From 732ff646a56cea173987f5bf087170c8b8f1a211 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 19 May 2026 03:13:44 +0200
Subject: [PATCH 24/26] discourse-mail-receiver: replace `replace` with `sd`

The license for replace is fuzzy and it was therefore marked unfree.
---
 pkgs/by-name/di/discourse-mail-receiver/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/di/discourse-mail-receiver/package.nix b/pkgs/by-name/di/discourse-mail-receiver/package.nix
index 794d74da2fa8..77e8a95bdadb 100644
--- a/pkgs/by-name/di/discourse-mail-receiver/package.nix
+++ b/pkgs/by-name/di/discourse-mail-receiver/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   ruby,
   makeWrapper,
-  replace,
+  sd,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -19,8 +19,8 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    replace
     makeWrapper
+    sd
   ];
   buildInputs = [ ruby ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     mkdir -p $out/bin
 
-    replace-literal -f -r -e /etc/postfix /run/discourse-mail-receiver .
+    find . -type f -exec sd '/etc/postfix' '/run/discourse-mail-receiver' {} +
 
     cp -r receive-mail discourse-smtp-fast-rejection $out/bin/
     cp -r lib $out/

From 3d96bf34f9705950877a9d9e74e4c2814f9e56e2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 19 May 2026 03:29:19 +0200
Subject: [PATCH 25/26] nixosTests.discourse: make imap polling quieter

---
 nixos/tests/discourse.nix | 78 +++++++++++++++++++++------------------
 1 file changed, 43 insertions(+), 35 deletions(-)

diff --git a/nixos/tests/discourse.nix b/nixos/tests/discourse.nix
index 89a139e254f7..1dd40801dfaa 100644
--- a/nixos/tests/discourse.nix
+++ b/nixos/tests/discourse.nix
@@ -124,47 +124,55 @@ in
 
       environment.systemPackages =
         let
-          replyToEmail = pkgs.writeScriptBin "reply-to-email" ''
-            #!${pkgs.python3.interpreter}
-            import imaplib
-            import smtplib
-            import ssl
-            import email.header
-            from email import message_from_bytes
-            from email.message import EmailMessage
+          replyToEmail =
+            pkgs.writeScriptBin "reply-to-email"
+              # python
+              ''
+                #!${pkgs.python3.interpreter}
+                import imaplib
+                import smtplib
+                import ssl
+                import email.header
+                import sys
+                from email import message_from_bytes
+                from email.message import EmailMessage
 
-            with imaplib.IMAP4('localhost') as imap:
-                imap.login('alice', 'foobar')
-                imap.select()
-                status, data = imap.search(None, 'ALL')
-                assert status == 'OK'
+                with imaplib.IMAP4('localhost') as imap:
+                    imap.login('alice', 'foobar')
+                    imap.select()
+                    status, data = imap.search(None, 'ALL')
+                    assert status == 'OK'
 
-                nums = data[0].split()
-                assert len(nums) == 1
+                    nums = data[0].split()
+                    try:
+                      assert len(nums) == 1
+                    except AssertionError:
+                      print("No mail in IMAP mailbox yet...", file=sys.stderr)
+                      sys.exit(1)
 
-                status, msg_data = imap.fetch(nums[0], '(RFC822)')
-                assert status == 'OK'
+                    status, msg_data = imap.fetch(nums[0], '(RFC822)')
+                    assert status == 'OK'
 
-            msg = email.message_from_bytes(msg_data[0][1])
-            subject = str(email.header.make_header(email.header.decode_header(msg['Subject'])))
-            reply_to = email.header.decode_header(msg['Reply-To'])[0][0]
-            message_id = email.header.decode_header(msg['Message-ID'])[0][0]
-            date = email.header.decode_header(msg['Date'])[0][0]
+                msg = email.message_from_bytes(msg_data[0][1])
+                subject = str(email.header.make_header(email.header.decode_header(msg['Subject'])))
+                reply_to = email.header.decode_header(msg['Reply-To'])[0][0]
+                message_id = email.header.decode_header(msg['Message-ID'])[0][0]
+                date = email.header.decode_header(msg['Date'])[0][0]
 
-            ctx = ssl.create_default_context()
-            with smtplib.SMTP_SSL(host='${discourseDomain}', context=ctx) as smtp:
-                reply = EmailMessage()
-                reply['Subject'] = 'Re: ' + subject
-                reply['To'] = reply_to
-                reply['From'] = 'alice@${clientDomain}'
-                reply['In-Reply-To'] = message_id
-                reply['References'] = message_id
-                reply['Date'] = date
-                reply.set_content("Test reply.")
+                ctx = ssl.create_default_context()
+                with smtplib.SMTP_SSL(host='${discourseDomain}', context=ctx) as smtp:
+                    reply = EmailMessage()
+                    reply['Subject'] = 'Re: ' + subject
+                    reply['To'] = reply_to
+                    reply['From'] = 'alice@${clientDomain}'
+                    reply['In-Reply-To'] = message_id
+                    reply['References'] = message_id
+                    reply['Date'] = date
+                    reply.set_content("Test reply.")
 
-                smtp.send_message(reply)
-                smtp.quit()
-          '';
+                    smtp.send_message(reply)
+                    smtp.quit()
+              '';
         in
         [ replyToEmail ];
 

From 2c08fc07589048ab57f4f671c385235109c8c227 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 19 May 2026 03:33:20 +0000
Subject: [PATCH 26/26] moor: 2.13.0 -> 2.13.2

---
 pkgs/by-name/mo/moor/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mo/moor/package.nix b/pkgs/by-name/mo/moor/package.nix
index c15ad31eb41a..8bf165d0c899 100644
--- a/pkgs/by-name/mo/moor/package.nix
+++ b/pkgs/by-name/mo/moor/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "moor";
-  version = "2.13.0";
+  version = "2.13.2";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aEwazj3RXOrPPOxZDfvyHqetO5tvhnzQ19rE+NQf8wQ=";
+    hash = "sha256-5VfldFEPcYva6yKDolgs1ZzGSAkn3Caxk29sedniw58=";
   };
 
   vendorHash = "sha256-fHOatNwedbDNGp7V8ynW1NiTkqSJmo8vrv6S64gUQqM=";