From f25d8cd3288c2aa807284e6d8f5eb6f4b22ae76c Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Wed, 27 Aug 2025 23:31:26 +0300
Subject: [PATCH 01/47] nginx: Apply patch to fix endianess detection

Fixes corrupted date and a corrupte HTTP header field `/nn1R7cu0=3l`

```
date: 52anAoe1x3Wt3H4l1u0sc3.632 GMT
curl: (92) Invalid HTTP header field was received: frame type: 1, stream: 1, name: [/nn1R7cu0=3l], value: [bytes]
```

The patch is 4+ years old yet no one has had this problem?

Fixes https://www.github.com/NixOS/nixpkgs/issues/437626
---
 pkgs/servers/http/nginx/generic.nix | 64 +++++++++++++++++------------
 1 file changed, 38 insertions(+), 26 deletions(-)

diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 34356f77fab4..ac58212aed82 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -175,32 +175,37 @@ stdenv.mkDerivation {
   ++ configureFlags
   ++ map (mod: "--add-module=${mod.src}") modules;
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    [
-      "-I${libxml2.dev}/include/libxml2"
-      "-Wno-error=implicit-fallthrough"
-      (
-        # zlig-ng patch needs this
-        if stdenv.cc.isGNU then
-          "-Wno-error=discarded-qualifiers"
-        else
-          "-Wno-error=incompatible-pointer-types-discards-qualifiers"
-      )
-    ]
-    ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") [
-      # fix build vts module on gcc11
-      "-Wno-error=stringop-overread"
-    ]
-    ++ lib.optionals stdenv.cc.isClang [
-      "-Wno-error=deprecated-declarations"
-      "-Wno-error=gnu-folding-constant"
-      "-Wno-error=unused-but-set-variable"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isMusl [
-      # fix sys/cdefs.h is deprecated
-      "-Wno-error=cpp"
-    ]
-  );
+  env = {
+    NIX_CFLAGS_COMPILE = toString (
+      [
+        "-I${libxml2.dev}/include/libxml2"
+        "-Wno-error=implicit-fallthrough"
+        (
+          # zlig-ng patch needs this
+          if stdenv.cc.isGNU then
+            "-Wno-error=discarded-qualifiers"
+          else
+            "-Wno-error=incompatible-pointer-types-discards-qualifiers"
+        )
+      ]
+      ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") [
+        # fix build vts module on gcc11
+        "-Wno-error=stringop-overread"
+      ]
+      ++ lib.optionals stdenv.cc.isClang [
+        "-Wno-error=deprecated-declarations"
+        "-Wno-error=gnu-folding-constant"
+        "-Wno-error=unused-but-set-variable"
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isMusl [
+        # fix sys/cdefs.h is deprecated
+        "-Wno-error=cpp"
+      ]
+    );
+  }
+  // lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) {
+    CONFIG_BIG_ENDIAN = if stdenv.hostPlatform.isBigEndian then "y" else "n";
+  };
 
   configurePlatforms = [ ];
 
@@ -218,6 +223,9 @@ stdenv.mkDerivation {
         ./nix-etag-1.15.4.patch
         ./nix-skip-check-logs-path.patch
       ]
+      # Upstream may be against cross-compilation patches.
+      # https://trac.nginx.org/nginx/ticket/2240 https://trac.nginx.org/nginx/ticket/1928#comment:6
+      # That dev quit the project in 2024 so the stance could be different now.
       ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
         (fetchpatch {
           url = "https://raw.githubusercontent.com/openwrt/packages/c057dfb09c7027287c7862afab965a4cd95293a3/net/nginx/patches/102-sizeof_test_fix.patch";
@@ -231,6 +239,10 @@ stdenv.mkDerivation {
           url = "https://raw.githubusercontent.com/openwrt/packages/c057dfb09c7027287c7862afab965a4cd95293a3/net/nginx/patches/103-sys_nerr.patch";
           sha256 = "0s497x6mkz947aw29wdy073k8dyjq8j99lax1a1mzpikzr4rxlmd";
         })
+        (fetchpatch {
+          url = "https://raw.githubusercontent.com/openwrt/packages/c057dfb09c7027287c7862afab965a4cd95293a3/net/nginx/patches/104-endianness_fix.patch";
+          sha256 = "sha256-M7V3ZJfKImur2OoqXcoL+CbgFj/huWnfZ4xMCmvkqfc=";
+        })
       ]
       ++ mapModules "patches"
     )

From b01a8eb4fdad9ec3037044474fefbd6a66161f0c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 7 Sep 2025 16:19:18 +0200
Subject: [PATCH 02/47] perlPackages.JSONXS: Patch for CVE-2025-40928

---
 .../perl-modules/JSON-XS-CVE-2025-40928.patch | 31 +++++++++++++++++++
 pkgs/top-level/perl-packages.nix              |  1 +
 2 files changed, 32 insertions(+)
 create mode 100644 pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch

diff --git a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch b/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
new file mode 100644
index 000000000000..f1d258c12a3d
--- /dev/null
+++ b/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
@@ -0,0 +1,31 @@
+--- a/XS.xs	2025-09-06 08:34:51.376455632 -0300
++++ b/XS.xs	2025-09-06 08:35:30.725873619 -0300
+@@ -253,16 +253,16 @@
+   // if we recurse too deep, skip all remaining digits
+   // to avoid a stack overflow attack
+   if (expect_false (--maxdepth <= 0))
+-    while (((U8)*s - '0') < 10)
++    while ((U8)(*s - '0') < 10)
+       ++s;
+ 
+   for (;;)
+     {
+-      U8 dig = (U8)*s - '0';
++      U8 dig = *s - '0';
+ 
+       if (expect_false (dig >= 10))
+         {
+-          if (dig == (U8)((U8)'.' - (U8)'0'))
++          if (dig == (U8)('.' - '0'))
+             {
+               ++s;
+               json_atof_scan1 (s, accum, expo, 1, maxdepth);
+@@ -282,7 +282,7 @@
+               else if (*s == '+')
+                 ++s;
+ 
+-              while ((dig = (U8)*s - '0') < 10)
++              while ((dig = (U8)(*s - '0')) < 10)
+                 exp2 = exp2 * 10 + *s++ - '0';
+ 
+               *expo += neg ? -exp2 : exp2;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 24933b3dd7f8..3f2e725b25e3 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -18304,6 +18304,7 @@ with self;
       url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.03.tar.gz";
       hash = "sha256-UVU29F8voafojIgkUzdY0BIdJnq5y0U6G1iHyKVrkGg=";
     };
+    patches = [ ../development/perl-modules/JSON-XS-CVE-2025-40928.patch ];
     propagatedBuildInputs = [ TypesSerialiser ];
     buildInputs = [ CanaryStability ];
     meta = {

From cb88a6fe753fd90146abc2ea5bd6e7b3b4b56466 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 7 Sep 2025 16:20:08 +0200
Subject: [PATCH 03/47] perlPackages.CpanelJSONXS: Patch for CVE-2025-40929

Note that the .patch comments reference the related CVE-2025-40928
affecting `JSON::XS`, that this module was originally forked from.
---
 .../Cpanel-JSON-XS-CVE-2025-40929.patch       | 47 +++++++++++++++++++
 pkgs/top-level/perl-packages.nix              |  1 +
 2 files changed, 48 insertions(+)
 create mode 100644 pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch

diff --git a/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch b/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch
new file mode 100644
index 000000000000..0f76f7313fde
--- /dev/null
+++ b/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch
@@ -0,0 +1,47 @@
+From 5592bfb58eb8d1c8a644e67c9bba795d1384a995 Mon Sep 17 00:00:00 2001
+From: Marc Lehmann <schmorp@schmorp.de>
+Date: Sat, 6 Sep 2025 11:31:36 +0200
+Subject: [PATCH 1/2] fix json_atof_scan1 overflows
+
+with fuzzed overlong numbers. CVE-2025-40928
+Really the comparisons were wrong.
+---
+ XS.xs | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/XS.xs b/XS.xs
+index 9b1ce2b..94ab0d6 100755
+--- a/XS.xs
++++ b/XS.xs
+@@ -710,16 +710,16 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
+   /* if we recurse too deep, skip all remaining digits */
+   /* to avoid a stack overflow attack */
+   if (UNLIKELY(--maxdepth <= 0))
+-    while (((U8)*s - '0') < 10)
++    while ((U8)(*s - '0') < 10)
+       ++s;
+ 
+   for (;;)
+     {
+-      U8 dig = (U8)*s - '0';
++      U8 dig = (U8)(*s - '0');
+ 
+       if (UNLIKELY(dig >= 10))
+         {
+-          if (dig == (U8)((U8)'.' - (U8)'0'))
++          if (dig == (U8)('.' - '0'))
+             {
+               ++s;
+               json_atof_scan1 (s, accum, expo, 1, maxdepth);
+@@ -739,7 +739,7 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
+               else if (*s == '+')
+                 ++s;
+ 
+-              while ((dig = (U8)*s - '0') < 10)
++              while ((dig = (U8)(*s - '0')) < 10)
+                 exp2 = exp2 * 10 + *s++ - '0';
+ 
+               *expo += neg ? -exp2 : exp2;
+-- 
+2.50.1
+
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3f2e725b25e3..7886597fa730 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6641,6 +6641,7 @@ with self;
       url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.37.tar.gz";
       hash = "sha256-wkFhWg4X/3Raqoa79Gam4pzSQFFeZfBqegUBe2GebUs=";
     };
+    patches = [ ../development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch ];
     meta = {
       description = "CPanel fork of JSON::XS, fast and correct serializing";
       license = with lib.licenses; [

From 43eaa20bf84538361a96977c3d856931cb7d485e Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Wed, 10 Sep 2025 08:55:33 +0800
Subject: [PATCH 04/47] notation: remove aaronjheng from maintainers

---
 pkgs/by-name/no/notation/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/no/notation/package.nix b/pkgs/by-name/no/notation/package.nix
index 93127ccb8def..48ec6c69596c 100644
--- a/pkgs/by-name/no/notation/package.nix
+++ b/pkgs/by-name/no/notation/package.nix
@@ -49,7 +49,7 @@ buildGoModule (finalAttrs: {
     description = "CLI tool to sign and verify OCI artifacts and container images";
     homepage = "https://notaryproject.dev/";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ aaronjheng ];
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "notation";
   };
 })

From ed0efe5907389aab8540fe1204ec311aad465233 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Wed, 10 Sep 2025 16:07:21 +0200
Subject: [PATCH 05/47] pkgsStatic.libpq: fix build

This has worked before - but only accidentally so. It worked once we
enabled `structuredAttrs`, but there was a bug in the stdenv adapter for
`pkgsStatic`, which made it ineffective when using `structuredAttrs`.

With the bug fixed, libpq was broken again. This time, we fix it by
entirely disabling the build of shared libraries in PG's Makefiles for
the static case. No shared libraries - no problem.
---
 pkgs/servers/sql/postgresql/libpq.nix | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index c64bb58d7e2b..f71d254ae7b6 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -118,6 +118,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     cat ${./pg_config.env.mk} >> src/common/Makefile
+  ''
+  # Explicitly disable building the shared libs, because that would fail with pkgsStatic.
+  + lib.optionalString stdenv.hostPlatform.isStatic ''
+    substituteInPlace src/interfaces/libpq/Makefile \
+      --replace-fail "all: all-lib libpq-refs-stamp" "all: all-lib"
+    substituteInPlace src/Makefile.shlib \
+      --replace-fail "all-lib: all-shared-lib" "all-lib: all-static-lib" \
+      --replace-fail "install-lib: install-lib-shared" "install-lib: install-lib-static"
   '';
 
   installPhase = ''
@@ -141,14 +149,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # PostgreSQL always builds both shared and static libs, so we delete those we don't want.
-  postInstall =
-    if stdenv.hostPlatform.isStatic then
-      ''
-        rm -rfv $out/lib/*.so*
-        touch $out/empty
-      ''
-    else
-      "rm -rfv $dev/lib/*.a";
+  postInstall = if stdenv.hostPlatform.isStatic then "touch $out/empty" else "rm -rfv $dev/lib/*.a";
 
   doCheck = false;
 

From 70ca90dc004ca2a3c8e56bd5ede4ca95f39627bb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 01:35:56 +0000
Subject: [PATCH 06/47] jbrowse: 3.6.4 -> 3.6.5

---
 pkgs/by-name/jb/jbrowse/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/jb/jbrowse/package.nix b/pkgs/by-name/jb/jbrowse/package.nix
index c91d08bed669..daef63642506 100644
--- a/pkgs/by-name/jb/jbrowse/package.nix
+++ b/pkgs/by-name/jb/jbrowse/package.nix
@@ -6,11 +6,11 @@
 
 let
   pname = "jbrowse";
-  version = "3.6.4";
+  version = "3.6.5";
 
   src = fetchurl {
     url = "https://github.com/GMOD/jbrowse-components/releases/download/v${version}/jbrowse-desktop-v${version}-linux.AppImage";
-    sha256 = "sha256-oSxSW6kZ68iQBdR4Uxd9yiU2S/8bLamXje9FDgahuv4=";
+    sha256 = "sha256-aCmNpZX8TBZm7nbS13GBUG4a/X4kvwWRHvwWWykoLwU=";
   };
 
   appimageContents = appimageTools.extractType2 {

From a55d367d6917211dcb14a4235e298407a314c8f4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 04:11:06 +0000
Subject: [PATCH 07/47] python3Packages.bc-detect-secrets: 1.5.44 -> 1.5.45

---
 pkgs/development/python-modules/bc-detect-secrets/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/bc-detect-secrets/default.nix b/pkgs/development/python-modules/bc-detect-secrets/default.nix
index 3a56e0e0e143..bf6a2f864b5f 100644
--- a/pkgs/development/python-modules/bc-detect-secrets/default.nix
+++ b/pkgs/development/python-modules/bc-detect-secrets/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "bc-detect-secrets";
-  version = "1.5.44";
+  version = "1.5.45";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "bridgecrewio";
     repo = "detect-secrets";
     tag = version;
-    hash = "sha256-cEhZo/HfCp6Cpx2zEX7THQQJH264NJvoCRrM+ci3RrE=";
+    hash = "sha256-/0VHhKcYcXYXosInjsgBf6eR7kcfLiLSyxFuaIqTbiQ=";
   };
 
   build-system = [ setuptools ];

From 5494b66ab9236eea9a62540e7ec38b6e24792d98 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 06:16:30 +0000
Subject: [PATCH 08/47] python3Packages.python-gvm: 26.5.0 -> 26.6.0

---
 pkgs/development/python-modules/python-gvm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-gvm/default.nix b/pkgs/development/python-modules/python-gvm/default.nix
index 43c241e1abbc..303176669a29 100644
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "python-gvm";
-  version = "26.5.0";
+  version = "26.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = "python-gvm";
     tag = "v${version}";
-    hash = "sha256-9OSL7Li95p79P1+8yViI/pV/nLwuk580/6Be99+DTWU=";
+    hash = "sha256-n/FYPCJ0Fw2WBLA6dAYUzgwDlol1DRgbCywsvMARTWE=";
   };
 
   build-system = [ poetry-core ];

From 334684272efec17cbd3e6e711643a5d11076535a Mon Sep 17 00:00:00 2001
From: Pascal Dietrich <pascal.1.dietrich@hotmail.com>
Date: Thu, 11 Sep 2025 09:04:48 +0200
Subject: [PATCH 09/47] jocalsend: 1.6.18033 -> 1.61803398

---
 pkgs/by-name/jo/jocalsend/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/jo/jocalsend/package.nix b/pkgs/by-name/jo/jocalsend/package.nix
index 629995b2484a..3e48a267aa71 100644
--- a/pkgs/by-name/jo/jocalsend/package.nix
+++ b/pkgs/by-name/jo/jocalsend/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jocalsend";
-  version = "1.6.18033";
+  version = "1.61803398";
 
   src = fetchFromGitea {
     domain = "git.kittencollective.com";
     owner = "nebkor";
     repo = "joecalsend";
     tag = finalAttrs.version;
-    hash = "sha256-q2fzi0NKfkjCwV7FD0PqXSHtJWQtvdvKx4WmhnZpKvg=";
+    hash = "sha256-7Gl+G4BN3CgF0c/AEhI1OvRhveqGeFNmGRI3XRf6rAo=";
   };
 
-  cargoHash = "sha256-u9Ev/Qr/WN6OOaMXPesA3nmV3efKJA3/2YWm8S60PjU=";
+  cargoHash = "sha256-prT1wO3ctnTfMHfICFcihB739lN/QXPH3AamIR6dM9A=";
 
   nativeBuildInputs = [
     pkg-config

From 12a59d29b4133a8c7563ab5bffde0fa65baa4fd3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 07:22:23 +0000
Subject: [PATCH 10/47] htmlhint: 1.6.3 -> 1.7.0

---
 pkgs/by-name/ht/htmlhint/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ht/htmlhint/package.nix b/pkgs/by-name/ht/htmlhint/package.nix
index 28021fb075dd..77a4c8f9eb7d 100644
--- a/pkgs/by-name/ht/htmlhint/package.nix
+++ b/pkgs/by-name/ht/htmlhint/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "htmlhint";
-  version = "1.6.3";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "htmlhint";
     repo = "HTMLHint";
     rev = "v${version}";
-    hash = "sha256-OId1uuNWry9tXWkewVhOJlWIRlfDPIN18gmYQ43TYdQ=";
+    hash = "sha256-aFydnJiRqGzBKZGX/AvRlxjf3sw+fBwKdGmydFjD/xk=";
   };
 
-  npmDepsHash = "sha256-H9zw04Y9yD044qc3pylQge16QojaUCndHO1haw6FJ5s=";
+  npmDepsHash = "sha256-h37yWpXWh9+cMlI36zucq2ZbYsQUaGuRQGJySKIeda0=";
 
   meta = {
     changelog = "https://github.com/htmlhint/HTMLHint/blob/${src.rev}/CHANGELOG.md";

From ec72be733279d8f18e8f6aa6167a83e1573fb548 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 08:52:39 +0000
Subject: [PATCH 11/47] svlint: 0.9.3 -> 0.9.4

---
 pkgs/by-name/sv/svlint/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sv/svlint/package.nix b/pkgs/by-name/sv/svlint/package.nix
index b58ef72be582..10f0c8c68cde 100644
--- a/pkgs/by-name/sv/svlint/package.nix
+++ b/pkgs/by-name/sv/svlint/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svlint";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-u61gmkO7eij7r1A1RPk0ro+pml7ZmMsg0ukJLCFNaD0=";
+    hash = "sha256-YtBI2AnwSyeirHAXRavRKayfAmgXyyCMNhfEbUMXPgk=";
   };
 
-  cargoHash = "sha256-0vL9fdZqxGleEPTXq+/R+1GzqD91ZTgwt2C8sx0kUbM=";
+  cargoHash = "sha256-78v28MEW06AIMZa2lNmql3/3t6bI+HCW48vKzRTDjFQ=";
 
   cargoBuildFlags = [
     "--bin"

From 2de841ac2fc255e2721afb49a4ec8e43be4a73ca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 11:52:46 +0000
Subject: [PATCH 12/47] monophony: 3.4.1 -> 3.4.2

---
 pkgs/by-name/mo/monophony/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mo/monophony/package.nix b/pkgs/by-name/mo/monophony/package.nix
index 9b63ad9e6900..d18fa37612ce 100644
--- a/pkgs/by-name/mo/monophony/package.nix
+++ b/pkgs/by-name/mo/monophony/package.nix
@@ -12,14 +12,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "monophony";
-  version = "3.4.1";
+  version = "3.4.2";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "zehkira";
     repo = "monophony";
     rev = "v${version}";
-    hash = "sha256-84H6JOqKcFSApNnm/C4ftuxqkQrO064OORQSQXIiHps=";
+    hash = "sha256-D/3yJ1KIXF1rv8iH4+HvfD6N94LzkZGRippZj8nk1nQ=";
   };
 
   sourceRoot = "${src.name}/source";

From c160394049bfd8a147ee6fcc17f2269374cc5128 Mon Sep 17 00:00:00 2001
From: andre4ik3 <andre4ik3@fastmail.com>
Date: Sun, 10 Aug 2025 06:30:28 +0000
Subject: [PATCH 13/47] fex: update to qt6, make qt optional

Closes #376837
---
 pkgs/by-name/fe/fex/package.nix | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/fe/fex/package.nix b/pkgs/by-name/fe/fex/package.nix
index 726502a66264..440e7fc8ade9 100644
--- a/pkgs/by-name/fe/fex/package.nix
+++ b/pkgs/by-name/fe/fex/package.nix
@@ -5,12 +5,14 @@
   cmake,
   ninja,
   pkg-config,
-  qt5,
   python3,
   nix-update-script,
   xxHash,
   fmt,
+  libxml2,
+  openssl,
   range-v3,
+  catch2,
   nasm,
   buildEnv,
   writeText,
@@ -22,6 +24,8 @@
   libGL,
   wayland,
   xorg,
+  withQt ? true,
+  qt6,
 }:
 
 let
@@ -160,7 +164,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     pkg-config
-    qt5.wrapQtAppsHook
     llvmPackages.bintools
 
     (python3.withPackages (
@@ -169,13 +172,16 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
         libclang
       ]
     ))
-  ];
+  ]
+  ++ lib.optional withQt qt6.wrapQtAppsHook;
 
   nativeCheckInputs = [ nasm ];
 
   buildInputs = [
     xxHash
     fmt
+    libxml2
+    openssl
     range-v3
     pkgsCross64.buildPackages.clang
     pkgsCross32.buildPackages.clang
@@ -183,12 +189,10 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     libllvm
   ]
   ++ libForwardingInputs
-  ++ (with qt5; [
-    qtbase
-    qtdeclarative
-    qtquickcontrols
-    qtquickcontrols2
-  ]);
+  ++ lib.optionals withQt [
+    qt6.qtbase
+    qt6.qtdeclarative
+  ];
 
   cmakeFlags = [
     (lib.cmakeFeature "USE_LINKER" "lld")
@@ -197,6 +201,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "OVERRIDE_VERSION" finalAttrs.version)
     (lib.cmakeBool "BUILD_TESTS" finalAttrs.finalPackage.doCheck)
     (lib.cmakeBool "BUILD_THUNKS" true)
+    (lib.cmakeBool "BUILD_FEXCONFIG" withQt)
     (lib.cmakeFeature "X86_32_TOOLCHAIN_FILE" "${toolchain32}")
     (lib.cmakeFeature "X86_64_TOOLCHAIN_FILE" "${toolchain}")
     (lib.cmakeFeature "X86_DEV_ROOTFS" "${devRootFS}")
@@ -219,7 +224,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
   # Avoid wrapping anything other than FEXConfig, since the wrapped executables
   # don't seem to work when registered as binfmts.
   dontWrapQtApps = true;
-  preFixup = ''
+  preFixup = lib.optionalString withQt ''
     wrapQtApp $out/bin/FEXConfig
   '';
 

From 01227a902cb5625623728c92a35e211fdd9678b1 Mon Sep 17 00:00:00 2001
From: andre4ik3 <andre4ik3@fastmail.com>
Date: Sun, 10 Aug 2025 06:31:19 +0000
Subject: [PATCH 14/47] fex: unvendor catch2, remove unneeded flags

---
 pkgs/by-name/fe/fex/package.nix | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/fe/fex/package.nix b/pkgs/by-name/fe/fex/package.nix
index 440e7fc8ade9..9683735feafd 100644
--- a/pkgs/by-name/fe/fex/package.nix
+++ b/pkgs/by-name/fe/fex/package.nix
@@ -101,7 +101,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     owner = "FEX-Emu";
     repo = "FEX";
     tag = "FEX-${finalAttrs.version}";
-
     hash = "sha256-Dq87cx7tv+HJvpy57L8dcApE+3E8VEyyTYKhDyoUfVU=";
 
     leaveDotGit = true;
@@ -117,8 +116,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
         External/jemalloc_glibc \
         External/robin-map \
         External/vixl \
-        Source/Common/cpp-optparse \
-        External/Catch2
+        Source/Common/cpp-optparse
 
       find . -name .git -print0 | xargs -0 rm -rf
 
@@ -165,7 +163,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     llvmPackages.bintools
-
     (python3.withPackages (
       pythonPackages: with pythonPackages; [
         setuptools
@@ -175,8 +172,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional withQt qt6.wrapQtAppsHook;
 
-  nativeCheckInputs = [ nasm ];
-
   buildInputs = [
     xxHash
     fmt
@@ -196,8 +191,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     (lib.cmakeFeature "USE_LINKER" "lld")
-    (lib.cmakeBool "ENABLE_LTO" true)
-    (lib.cmakeBool "ENABLE_ASSERTIONS" false)
     (lib.cmakeFeature "OVERRIDE_VERSION" finalAttrs.version)
     (lib.cmakeBool "BUILD_TESTS" finalAttrs.finalPackage.doCheck)
     (lib.cmakeBool "BUILD_THUNKS" true)
@@ -212,6 +205,9 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
   # Unsupported on non-4K page size kernels (e.g. Apple Silicon)
   doCheck = true;
 
+  nativeCheckInputs = [ nasm ];
+  checkInputs = [ catch2 ];
+
   # List not exhaustive, e.g. because they depend on an x86 compiler or some
   # other difficult-to-build test binaries.
   checkTarget = lib.concatStringsSep " " [

From f800055e411adc0b139d8d5ee26552f08ca367f0 Mon Sep 17 00:00:00 2001
From: andre4ik3 <andre4ik3@fastmail.com>
Date: Wed, 10 Sep 2025 21:27:35 +0000
Subject: [PATCH 15/47] fex-headless: init package

---
 pkgs/by-name/fe/fex-headless/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 pkgs/by-name/fe/fex-headless/package.nix

diff --git a/pkgs/by-name/fe/fex-headless/package.nix b/pkgs/by-name/fe/fex-headless/package.nix
new file mode 100644
index 000000000000..b9d5eb3ebfe3
--- /dev/null
+++ b/pkgs/by-name/fe/fex-headless/package.nix
@@ -0,0 +1,7 @@
+{
+  fex,
+}:
+
+fex.override {
+  withQt = false;
+}

From 6c0e8f1c056ab2bf1952319f539e06d0f9bfe94e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 13:18:39 +0000
Subject: [PATCH 16/47] intel-gmmlib: 22.8.1 -> 22.8.2

---
 pkgs/by-name/in/intel-gmmlib/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/intel-gmmlib/package.nix b/pkgs/by-name/in/intel-gmmlib/package.nix
index 62006fbb8687..5b15a495256c 100644
--- a/pkgs/by-name/in/intel-gmmlib/package.nix
+++ b/pkgs/by-name/in/intel-gmmlib/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-gmmlib";
-  version = "22.8.1";
+  version = "22.8.2";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "gmmlib";
     tag = "intel-gmmlib-${version}";
-    hash = "sha256-TFa8EfrL14w8ameIinRhmeNnfOJ18hoXWEpTgxTeBBE=";
+    hash = "sha256-dn8I3cuApy+RUWeKDVzU0sr3fUjHoDFHdGasFTAufec=";
   };
 
   nativeBuildInputs = [ cmake ];

From f62ab79f6edd679f9095682ec3437960d9f8393f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 16:50:36 +0000
Subject: [PATCH 17/47] jawiki-all-titles-in-ns0: 0-unstable-2025-08-01 ->
 0-unstable-2025-09-01

---
 pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
index 8c115e07abcb..87214369a26e 100644
--- a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
+++ b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jawiki-all-titles-in-ns0";
-  version = "0-unstable-2025-08-01";
+  version = "0-unstable-2025-09-01";
 
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jawiki-archive";
-    rev = "25c2523e2845552101cc8815917619170238d197";
-    hash = "sha256-94qqYqh5KdWQZTVXl8GOXRUI6C0IG8THP9j2t4/8M8Y=";
+    rev = "bcb0ee245aee3ba7769ceec6caf9696c8bae1624";
+    hash = "sha256-Vb+8XE9FFEJfp6++WWr5fT6oWkF8eUtvYLz9ouRHWHA=";
   };
 
   installPhase = ''

From 031b856e4bff7ca414a00bd2d2208ed731852de7 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Thu, 11 Sep 2025 19:20:28 +0200
Subject: [PATCH 18/47] signal-desktop: 7.68.0 -> 7.70.0

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 pkgs/by-name/si/signal-desktop/package.nix          | 10 +++++-----
 pkgs/by-name/si/signal-desktop/ringrtc.nix          |  6 +++---
 pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix |  6 +++---
 pkgs/by-name/si/signal-desktop/webrtc-sources.json  |  4 ++--
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index 0df70c12eafb..792f226f3ef5 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -52,13 +52,13 @@ let
     '';
   });
 
-  version = "7.68.0";
+  version = "7.70.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "Signal-Desktop";
     tag = "v${version}";
-    hash = "sha256-jsNSRNgIS0ZroM2vwPSFpCVfC81slQ4mUoRq5jDYi8Y=";
+    hash = "sha256-y9i9YQPsLt3SLqROyEZsyIkVy/os3hy+1UMUSFMZJTY=";
   };
 
   sticker-creator = stdenv.mkDerivation (finalAttrs: {
@@ -134,15 +134,15 @@ stdenv.mkDerivation (finalAttrs: {
     fetcherVersion = 1;
     hash =
       if withAppleEmojis then
-        "sha256-iu/ZjIn5c4X0rxWUFqiNLLAjCGKFYihsYxfgWtfmqk4="
+        "sha256-uVVUHvYhBCplKPyuS2+PKCxox8uWU2E/2EXLCG1ot54="
       else
-        "sha256-gMtBdlcuiAZRV5eeh2NoyOusFheCmn0/NIQwVPrUH/U=";
+        "sha256-tbfk/tIgqpjDtDiULbTVUOJf5i9eLX9xY7vUPrrjmu0=";
   };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1756327041;
+    SOURCE_DATE_EPOCH = 1757542492;
   };
 
   preBuild = ''
diff --git a/pkgs/by-name/si/signal-desktop/ringrtc.nix b/pkgs/by-name/si/signal-desktop/ringrtc.nix
index f7a6bcb33347..0f5f892ecc77 100644
--- a/pkgs/by-name/si/signal-desktop/ringrtc.nix
+++ b/pkgs/by-name/si/signal-desktop/ringrtc.nix
@@ -19,16 +19,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ringrtc";
-  version = "2.56.0";
+  version = "2.57.0";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "ringrtc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KEwN6x24hXmK9lqU2M9/5qbBk7zDxeTRbB0vJ1K9d3U=";
+    hash = "sha256-m73SXjTES1sHGbQRtn9CjurFd/Xby5Yyn6uLVLigfiU=";
   };
 
-  cargoHash = "sha256-ghuF1wxAf5psZoWNYOCAubGo0KDwJlqcBXgUbPMD9ac=";
+  cargoHash = "sha256-LRCgK/w+GcYBCWUKjytErQCxDtS15EnsVOr5Uq6F8ww=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
index 99a8b79b90a1..f8c91cb06377 100644
--- a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "node-sqlcipher";
-  version = "2.2.2";
+  version = "2.4.4";
 
   src = fetchFromGitHub {
     owner = "signalapp";
     repo = "node-sqlcipher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vrY2cu8yfwMX7O6h2GgLhdvQvYOgl916E2z1Pf77ZI0=";
+    hash = "sha256-70kObW6jYzaquMrj20VMTQg/rDWqIu8o2/m7S3mUZB8=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.fetchCargoVendor {
     name = "sqlcipher-signal-exentsion";
     inherit (finalAttrs) src cargoRoot;
-    hash = "sha256-qT4HM/FRL8qugKKNlMYM/0zgUsC6cDOa9fgd1d4VIrc=";
+    hash = "sha256-NtJPwRvjU1WsOxgb2vpokes9eL4DkEcbDaEmML7zsqQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/si/signal-desktop/webrtc-sources.json b/pkgs/by-name/si/signal-desktop/webrtc-sources.json
index 05a4da47fa00..d9b28f488ad7 100644
--- a/pkgs/by-name/si/signal-desktop/webrtc-sources.json
+++ b/pkgs/by-name/si/signal-desktop/webrtc-sources.json
@@ -1,10 +1,10 @@
 {
     "src": {
         "args": {
-            "hash": "sha256-3hgBFFu2m+s9qzqNgbJSAmHH4ouHaQCL9nz2sFMy7hc=",
+            "hash": "sha256-Qj0UFRWfZrBG9WUX4zkyiatIekNSYXsneP5aLvufNh4=",
             "owner": "signalapp",
             "repo": "webrtc",
-            "tag": "7204a"
+            "tag": "7204c"
         },
         "fetcher": "fetchFromGitHub"
     },

From c1ad4464c6db838afbb02a431705cea4ac2f7757 Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Sun, 1 Jun 2025 22:57:22 +0200
Subject: [PATCH 19/47] lib/trivial: add boolToYesNo

---
 lib/default.nix |  1 +
 lib/trivial.nix | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/lib/default.nix b/lib/default.nix
index d45e6de0c33f..51705c6aa571 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -127,6 +127,7 @@ let
         bitXor
         bitNot
         boolToString
+        boolToYesNo
         mergeAttrs
         flip
         defaultTo
diff --git a/lib/trivial.nix b/lib/trivial.nix
index 2364002668a9..abdff8fbb9fa 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -240,6 +240,26 @@ in
   */
   boolToString = b: if b then "true" else "false";
 
+  /**
+    Converts a boolean to a string.
+
+    This function uses the strings "yes" and "no" to represent
+    boolean values.
+
+    # Inputs
+
+    `b`
+
+    : The boolean to convert
+
+    # Type
+
+    ```
+    boolToYesNo :: bool -> string
+    ```
+  */
+  boolToYesNo = b: if b then "yes" else "no";
+
   /**
     Merge two attribute sets shallowly, right side trumps left
 

From 50d9ac6547eb4451ae34169ad978c0cd26175ce5 Mon Sep 17 00:00:00 2001
From: Marcus Sand <15278940+HeroGamers@users.noreply.github.com>
Date: Thu, 11 Sep 2025 23:35:31 +0200
Subject: [PATCH 20/47] ida-free: 9.1 -> 9.2

https://docs.hex-rays.com/release-notes/9_2
---
 pkgs/by-name/id/ida-free/package.nix | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/id/ida-free/package.nix b/pkgs/by-name/id/ida-free/package.nix
index c741c6b5337a..1641cf4228ba 100644
--- a/pkgs/by-name/id/ida-free/package.nix
+++ b/pkgs/by-name/id/ida-free/package.nix
@@ -12,7 +12,6 @@
   libGL,
   libkrb5,
   libsecret,
-  libsForQt5,
   libunwind,
   libxkbcommon,
   makeWrapper,
@@ -21,21 +20,19 @@
   xorg,
   zlib,
 }:
-
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "ida-free";
-  version = "9.1";
+  version = "9.2";
 
   src = requireFile {
     name = "ida-free-pc_${lib.replaceStrings [ "." ] [ "" ] version}_x64linux.run";
-    url = "https://my.hex-rays.com/dashboard/download-center/${version}/ida-free";
-    hash = "sha256-DIkxr9yD6yvziO8XHi0jt80189bXueRxmSFyq2LM0cg=";
+    url = "https://my.hex-rays.com/dashboard/download-center/installers/release/${version}/ida-free";
+    hash = "sha256-CQm9phkqLXhht4UQxooKmhmiGuW3lV8RIJuDrm52aNw=";
   };
 
   nativeBuildInputs = [
     makeWrapper
     autoPatchelfHook
-    libsForQt5.wrapQtAppsHook
   ];
 
   # We just get a runfile in $src, so no need to unpack it.
@@ -53,7 +50,6 @@ stdenv.mkDerivation (finalAttrs: rec {
     libGL
     libkrb5
     libsecret
-    libsForQt5.qtbase
     libunwind
     libxkbcommon
     openssl
@@ -70,11 +66,18 @@ stdenv.mkDerivation (finalAttrs: rec {
     xorg.xcbutilkeysyms
     xorg.xcbutilrenderutil
     xorg.xcbutilwm
+    xorg.xcbutilcursor
     zlib
   ];
   buildInputs = runtimeDependencies;
 
-  dontWrapQtApps = true;
+  # IDA comes with its own Qt6, some dependencies are missing in the installer.
+  autoPatchelfIgnoreMissingDeps = [
+    "libQt6Network.so.6"
+    "libQt6EglFSDeviceIntegration.so.6"
+    "libQt6WaylandEglClientHwIntegration.so.6"
+    "libQt6WlShellIntegration.so.6"
+  ];
 
   installPhase = ''
     runHook preInstall
@@ -101,11 +104,9 @@ stdenv.mkDerivation (finalAttrs: rec {
     # Some libraries come with the installer.
     addAutoPatchelfSearchPath $IDADIR
 
-    for bb in ida assistant; do
-      wrapProgram $IDADIR/$bb \
-        --prefix QT_PLUGIN_PATH : $IDADIR/plugins/platforms
-      ln -s $IDADIR/$bb $out/bin/$bb
-    done
+    # Wrap the ida executable to set QT_PLUGIN_PATH
+    wrapProgram $IDADIR/ida --prefix QT_PLUGIN_PATH : $IDADIR/plugins/platforms
+    ln -s $IDADIR/ida $out/bin/ida
 
     # runtimeDependencies don't get added to non-executables, and openssl is needed
     #  for cloud decompilation

From 0786e3a26798463e131896f68ce9b3dd74889dd1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 22:53:17 +0000
Subject: [PATCH 21/47] gpu-screen-recorder: 5.6.5 -> 5.6.8

---
 pkgs/by-name/gp/gpu-screen-recorder/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gp/gpu-screen-recorder/package.nix b/pkgs/by-name/gp/gpu-screen-recorder/package.nix
index cbce7cc28246..d92598f170a6 100644
--- a/pkgs/by-name/gp/gpu-screen-recorder/package.nix
+++ b/pkgs/by-name/gp/gpu-screen-recorder/package.nix
@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation rec {
   pname = "gpu-screen-recorder";
-  version = "5.6.5";
+  version = "5.6.8";
 
   src = fetchgit {
     url = "https://repo.dec05eba.com/${pname}";
     tag = version;
-    hash = "sha256-2tlhuJ2Ro2ExIXVO8dUiR749el/R3l9nl6ezShF19Fg=";
+    hash = "sha256-uASmN6RoLoOrPfHhMssaGABBAMxrQcBEO3Czqsgrrlc=";
   };
 
   nativeBuildInputs = [

From 819202321c132ed7b2d1a230e90ac3d6ddf65f64 Mon Sep 17 00:00:00 2001
From: Jasi <normalc@posteo.net>
Date: Thu, 11 Sep 2025 19:28:35 -0400
Subject: [PATCH 22/47] virglrenderer: 1.1.1 -> 1.2.0; enable asahi
 native-context

---
 pkgs/by-name/vi/virglrenderer/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vi/virglrenderer/package.nix b/pkgs/by-name/vi/virglrenderer/package.nix
index 046c23c10acc..6b63b76552e8 100644
--- a/pkgs/by-name/vi/virglrenderer/package.nix
+++ b/pkgs/by-name/vi/virglrenderer/package.nix
@@ -22,14 +22,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "virglrenderer";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "virgl";
     repo = "virglrenderer";
     tag = finalAttrs.version;
-    hash = "sha256-ah6+AAf7B15rPMb4uO873wieT3+gf/5iGH+ZFoZKAAI=";
+    hash = "sha256-5Ok5ctJ3kcBH05URctvZ0hCZA/o59r2KsAOJYoiWMHs=";
   };
 
   separateDebugInfo = true;
@@ -67,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
       lib.optionalString nativeContextSupport (
         lib.concatStringsSep "," [
           "amdgpu-experimental"
+          "asahi"
           "msm"
         ]
       )

From 022139ba9621d3a6b64c4a85e6c8a8397e02203d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Sep 2025 23:30:14 +0000
Subject: [PATCH 23/47] matrix-alertmanager-receiver: 2025.9.3 -> 2025.9.10

---
 pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
index f774c1a0e6f0..ef2959bba858 100644
--- a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
+++ b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "matrix-alertmanager-receiver";
-  version = "2025.9.3";
+  version = "2025.9.10";
 
   src = fetchFromGitHub {
     owner = "metio";
     repo = "matrix-alertmanager-receiver";
     tag = finalAttrs.version;
-    hash = "sha256-RCWQNUZ8ZsGzsjTyqyr2O814qqV6eTumvLU6tvwi7vU=";
+    hash = "sha256-8oi/CeoIiv+yIkYqHXIivrd9iC3PfXbB+cELlKABafQ=";
   };
 
-  vendorHash = "sha256-xkRL0Cq7vXG3dQeyw0IK74xwRiyC89hvB/2BEGQHCN0=";
+  vendorHash = "sha256-zYcc2Gtdrh0xgHc/Bj+XQovlazlHpv7Rm+3lbw1ry1g=";
 
   env.CGO_ENABLED = "0";
 

From d49a9b70140cf401d09161f64ae8bd24e204f642 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Sep 2025 01:21:23 +0000
Subject: [PATCH 24/47] arashi: 25.08.3 -> 25.09

---
 pkgs/by-name/ar/arashi/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ar/arashi/package.nix b/pkgs/by-name/ar/arashi/package.nix
index 2b0cb388db49..cfa941014bdd 100644
--- a/pkgs/by-name/ar/arashi/package.nix
+++ b/pkgs/by-name/ar/arashi/package.nix
@@ -5,13 +5,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arashi";
-  version = "25.08.3";
+  version = "25.09";
 
   src = fetchFromGitHub {
     owner = "0hStormy";
     repo = "Arashi";
     tag = finalAttrs.version;
-    hash = "sha256-wmYsAfgdwn6ZLF70avNmjoU5VZNBZdV7dPSe8ycNdHE=";
+    hash = "sha256-qSr6wj+O6ieWxgKQxmUz7I3De9MOF5cq0I5DpD8+tug=";
   };
 
   installPhase = ''

From 45c7079f74afb0275fa5cd838efe86a8e6345be7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Sep 2025 03:35:49 +0000
Subject: [PATCH 25/47] rebels-in-the-sky: 1.0.30 -> 1.0.31

---
 pkgs/by-name/re/rebels-in-the-sky/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/re/rebels-in-the-sky/package.nix b/pkgs/by-name/re/rebels-in-the-sky/package.nix
index de27aea2fe6d..00a025c65c10 100644
--- a/pkgs/by-name/re/rebels-in-the-sky/package.nix
+++ b/pkgs/by-name/re/rebels-in-the-sky/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rebels-in-the-sky";
-  version = "1.0.30";
+  version = "1.0.31";
 
   src = fetchFromGitHub {
     owner = "ricott1";
     repo = "rebels-in-the-sky";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eC8n9g2kFErTRWWNo6jwAMGBX3+xGjtzq23+r3w0n0I=";
+    hash = "sha256-0/Vsb6GMl0XH7uxyFSUO18kKoz49MXbOEQChhZZJL24=";
   };
 
-  cargoHash = "sha256-dGD0RpelENEWe9W/3CXUS2GhOXRaWhCoD8AI2n4mUfs=";
+  cargoHash = "sha256-DI6BAfbIEGCq3GaBoQz/nn9AZYWUDWBD2osgm1K44+w=";
 
   patches = lib.optionals (!withRadio) [
     ./disable-radio.patch

From 264cee1319e566edad07b780742e3c56f53064ee Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Sep 2025 08:46:37 +0000
Subject: [PATCH 26/47] holos: 0.104.2 -> 0.104.3

---
 pkgs/by-name/ho/holos/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ho/holos/package.nix b/pkgs/by-name/ho/holos/package.nix
index ccecde4c412e..981dd7b06d45 100644
--- a/pkgs/by-name/ho/holos/package.nix
+++ b/pkgs/by-name/ho/holos/package.nix
@@ -10,13 +10,13 @@
 }:
 buildGoModule rec {
   pname = "holos";
-  version = "0.104.2";
+  version = "0.104.3";
 
   src = fetchFromGitHub {
     owner = "holos-run";
     repo = "holos";
     rev = "v${version}";
-    hash = "sha256-FzePCxBnKyEEnJZaKjiignahkGlerdw/j2RfDunQnbc=";
+    hash = "sha256-qcHROEjBEhbqjV7KHSLoCyO/B/DjBA+7nhykt2d78K8=";
   };
 
   vendorHash = "sha256-HbYFQG+iZMP/bcqz0UYduxeFNAAo+e3UUTubblhiNxk=";

From 7446d71b910349aef702048a37fb6cf5e9389497 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Sep 2025 09:23:02 +0000
Subject: [PATCH 27/47] phpExtensions.zstd: 0.15.1 -> 0.15.2

---
 pkgs/development/php-packages/zstd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/php-packages/zstd/default.nix b/pkgs/development/php-packages/zstd/default.nix
index 20ae6a2b83d4..6668969eebe5 100644
--- a/pkgs/development/php-packages/zstd/default.nix
+++ b/pkgs/development/php-packages/zstd/default.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "0.15.1";
+  version = "0.15.2";
 in
 buildPecl {
   inherit version;
@@ -17,7 +17,7 @@ buildPecl {
     owner = "kjdev";
     repo = "php-ext-zstd";
     rev = version;
-    hash = "sha256-Gf9/A4SmeiPGtUcTXoIU1sOzVRqIIpLAbD1QdTmBaHQ=";
+    hash = "sha256-NGbrbvW2kNhgj3nqqjGLqowcp9EKqYffR1DOBIzdXeA=";
   };
 
   nativeBuildInputs = [ pkg-config ];

From 007050c28f141cd46ea9ab9765c473e75065e063 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Sep 2025 09:36:46 +0000
Subject: [PATCH 28/47] prometheus-redis-exporter: 1.76.0 -> 1.77.0

---
 pkgs/servers/monitoring/prometheus/redis-exporter.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index f911579097e8..53c21ffc27a6 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.76.0";
+  version = "1.77.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-LT0YnyvXz1zQBP8NICws6vhW7qqVSFRzlxfdpB8wOr8=";
+    sha256 = "sha256-EqB76iUUIajId4peGW4WEM6esJGPJZlw3QlvLYXeoEQ=";
   };
 
-  vendorHash = "sha256-y1j7s8R8pd3sp9yOlG2aopQ+GNO2Z7OCO1a9i9L6KM4=";
+  vendorHash = "sha256-7/7O61tOEUsRVkFVkmOiHqgxmFDmwaw8s97aOQr89Mg=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"

From 225d88914e9688d86d4b61f086ed039f04532040 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Sep 2025 10:01:01 +0000
Subject: [PATCH 29/47] ts_query_ls: 3.11.0 -> 3.11.1

---
 pkgs/by-name/ts/ts_query_ls/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ts/ts_query_ls/package.nix b/pkgs/by-name/ts/ts_query_ls/package.nix
index 144edc46cf62..557ef8368678 100644
--- a/pkgs/by-name/ts/ts_query_ls/package.nix
+++ b/pkgs/by-name/ts/ts_query_ls/package.nix
@@ -6,7 +6,7 @@
 }:
 let
   pname = "ts_query_ls";
-  version = "3.11.0";
+  version = "3.11.1";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -15,12 +15,12 @@ rustPlatform.buildRustPackage {
     owner = "ribru17";
     repo = "ts_query_ls";
     rev = "v${version}";
-    hash = "sha256-zRUZ+ohZa5pUNJiqNLY1VKEmeRsJyNRyjhzpECsYfZg=";
+    hash = "sha256-SQyy/7M9karkLI2smx6KnJWWuP3qWA4gKh1F/gIGRjQ=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  cargoHash = "sha256-gjgoj5EKDPcyPkOnuG8ThhjxF3GiQ8FzhOrqXneqA+E=";
+  cargoHash = "sha256-9I/SiZTG/QAy1iBjWvleTqkile2K0h9TtW90+lILWQ0=";
 
   meta = {
     description = "LSP implementation for Tree-sitter's query files";

From bc1c33af192361eee777fc8ffc23f9bea5a105c7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Sep 2025 11:53:09 +0000
Subject: [PATCH 30/47] parca-agent: 0.41.0 -> 0.41.1

---
 pkgs/by-name/pa/parca-agent/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pa/parca-agent/package.nix b/pkgs/by-name/pa/parca-agent/package.nix
index 8e2850edfd69..22a391a6ad54 100644
--- a/pkgs/by-name/pa/parca-agent/package.nix
+++ b/pkgs/by-name/pa/parca-agent/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "parca-agent";
-  version = "0.41.0";
+  version = "0.41.1";
 
   src = fetchFromGitHub {
     owner = "parca-dev";
     repo = "parca-agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lWAdi6bgXZ5w68fZpAEUmWvbKmAdz9n92q80gzj21s8=";
+    hash = "sha256-qs4n3gUqbscf5la+OOxgcdc/f3YJ6yn4D4hMTa2IJgE=";
     fetchSubmodules = true;
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-//a6hjQ+pqhNsuj76gqsJ7QKkbyktfY780i5Rmax7Ls=";
+  vendorHash = "sha256-yt2nKrBhcYWxsoEfvKzjml2jsFMAQwlUrYlrsCPkmM4=";
 
   buildInputs = [
     stdenv.cc.libc.static

From 8c13f3d7ff8b6cc473e8ed27313b013651f6d56b Mon Sep 17 00:00:00 2001
From: fredrikr79 <fredrikrobertsen7@gmail.com>
Date: Sat, 29 Mar 2025 22:32:53 +0100
Subject: [PATCH 31/47] nixos/php-fpm: enable systemd watchdog

---
 nixos/modules/services/web-servers/phpfpm/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/web-servers/phpfpm/default.nix b/nixos/modules/services/web-servers/phpfpm/default.nix
index 6bfc010bb463..34845589fabe 100644
--- a/nixos/modules/services/web-servers/phpfpm/default.nix
+++ b/nixos/modules/services/web-servers/phpfpm/default.nix
@@ -302,6 +302,7 @@ in
             RuntimeDirectory = "phpfpm";
             RuntimeDirectoryPreserve = true; # Relevant when multiple processes are running
             Restart = "always";
+            WatchdogSec = 15;
           };
       }
     ) cfg.pools;

From b7e125c1f69aaee0c1e59b30aefb09596662defe Mon Sep 17 00:00:00 2001
From: Rafael Ieda <git@ieda.me>
Date: Fri, 12 Sep 2025 10:24:55 -0300
Subject: [PATCH 32/47] microsoft-edge: 139.0.3405.125 -> 140.0.3485.66

---
 pkgs/by-name/mi/microsoft-edge/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index ff626a5f2357..d20627a81d70 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -162,11 +162,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "139.0.3405.125";
+  version = "140.0.3485.66";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-MqJPlFoPiTIReXRhLJGR+nbOVwWcpiHTMr5s+M6KXqE=";
+    hash = "sha256-/ITJFChnQa5XK4nQe3biGw6vvV+pLbbZNb989XecUGY=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly

From 23027e3b77735fb999b6aa0ae40bfb45ed1079b5 Mon Sep 17 00:00:00 2001
From: Rafael Ieda <git@ieda.me>
Date: Fri, 12 Sep 2025 10:25:55 -0300
Subject: [PATCH 33/47] microsoft-edge: add maintainer iedame

---
 pkgs/by-name/mi/microsoft-edge/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index d20627a81d70..360ddbba288f 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -277,6 +277,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       leleuvilela
       bricklou
       jonhermansen
+      iedame
     ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

From e5223cdab019287017c67f1fd219dff024c7d2f5 Mon Sep 17 00:00:00 2001
From: "Alexander V. Nikolaev" <avn@avnik.info>
Date: Fri, 12 Sep 2025 16:27:39 +0300
Subject: [PATCH 34/47] runc: fix cross-compilation

Signed-off-by: Alexander V. Nikolaev <avn@avnik.info>
---
 pkgs/by-name/ru/runc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ru/runc/package.nix b/pkgs/by-name/ru/runc/package.nix
index 70de30901194..f28035107c10 100644
--- a/pkgs/by-name/ru/runc/package.nix
+++ b/pkgs/by-name/ru/runc/package.nix
@@ -9,7 +9,7 @@
   libapparmor,
   libseccomp,
   libselinux,
-  runtimeShell,
+  stdenv,
   makeWrapper,
   nixosTests,
 }:
@@ -47,7 +47,7 @@ buildGoModule rec {
 
   makeFlags = [
     "BUILDTAGS+=seccomp"
-    "SHELL=${runtimeShell}"
+    "SHELL=${stdenv.shell}"
   ];
 
   buildPhase = ''

From 3c3caa5059c8c53e4df0d1cf13c9f7478763f0d5 Mon Sep 17 00:00:00 2001
From: "Alexander V. Nikolaev" <avn@avnik.info>
Date: Fri, 12 Sep 2025 17:33:52 +0300
Subject: [PATCH 35/47] runc: switch to finalAttrs pattern

Signed-off-by: Alexander V. Nikolaev <avn@avnik.info>
---
 pkgs/by-name/ru/runc/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ru/runc/package.nix b/pkgs/by-name/ru/runc/package.nix
index f28035107c10..236e85d728fb 100644
--- a/pkgs/by-name/ru/runc/package.nix
+++ b/pkgs/by-name/ru/runc/package.nix
@@ -14,14 +14,14 @@
   nixosTests,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "runc";
   version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-B7x1J2ijM+/RWzPTldBNhvrGa/8de6Unl47lOS/KxXs=";
   };
 
@@ -53,7 +53,7 @@ buildGoModule rec {
   buildPhase = ''
     runHook preBuild
     patchShebangs .
-    make ${toString makeFlags} runc man
+    make ${toString finalAttrs.makeFlags} runc man
     runHook postBuild
   '';
 
@@ -77,4 +77,4 @@ buildGoModule rec {
     platforms = platforms.linux;
     mainProgram = "runc";
   };
-}
+})

From f63cfe57afdf7b6e614fade573fbcbc69941938e Mon Sep 17 00:00:00 2001
From: "Alexander V. Nikolaev" <avn@avnik.info>
Date: Fri, 12 Sep 2025 17:50:10 +0300
Subject: [PATCH 36/47] runc: switch to makeBinaryWrapper

Signed-off-by: Alexander V. Nikolaev <avn@avnik.info>
---
 pkgs/by-name/ru/runc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ru/runc/package.nix b/pkgs/by-name/ru/runc/package.nix
index 236e85d728fb..684c7963509b 100644
--- a/pkgs/by-name/ru/runc/package.nix
+++ b/pkgs/by-name/ru/runc/package.nix
@@ -10,7 +10,7 @@
   libseccomp,
   libselinux,
   stdenv,
-  makeWrapper,
+  makeBinaryWrapper,
   nixosTests,
 }:
 
@@ -34,7 +34,7 @@ buildGoModule (finalAttrs: {
   nativeBuildInputs = [
     go-md2man
     installShellFiles
-    makeWrapper
+    makeBinaryWrapper
     pkg-config
     which
   ];

From 75fd01eda91b860f7d73dd76c7ee5505023d57da Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Sep 2025 15:58:00 +0000
Subject: [PATCH 37/47] paretosecurity: 0.3.3 -> 0.3.4

---
 pkgs/by-name/pa/paretosecurity/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pa/paretosecurity/package.nix b/pkgs/by-name/pa/paretosecurity/package.nix
index 81f28a4dbade..c33b14a3532f 100644
--- a/pkgs/by-name/pa/paretosecurity/package.nix
+++ b/pkgs/by-name/pa/paretosecurity/package.nix
@@ -17,16 +17,16 @@ buildGoModule (finalAttrs: {
     webkitgtk_4_1
   ];
   pname = "paretosecurity";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "ParetoSecurity";
     repo = "agent";
     rev = finalAttrs.version;
-    hash = "sha256-IZrpGwm+j1jcKtcM23lcycOlLUuGerF41fWanWBgr40=";
+    hash = "sha256-jRaCcONfFch4cQ4clS/TaN0KxSnohSzBinIVr0ePymA=";
   };
 
-  vendorHash = "sha256-DlCGCheJHa4HPM7kfX/UbOfLukAiaoP7QZnabkZVASM=";
+  vendorHash = "sha256-y9x5RplVOr4mIOPTg86VvFWXkvZ1FTc9Ulc/yXb9/WU=";
   proxyVendor = true;
 
   # Skip building the Windows installer

From 574148ae04f6c0f6a56cc0a7ae13289eda42b97a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Sep 2025 16:13:35 +0000
Subject: [PATCH 38/47] dprint-plugins.dprint-plugin-biome: 0.10.1 -> 0.10.3

---
 pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
index bf2758609cd4..a6d386fdd5ae 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Biome (JS/TS) wrapper plugin";
-  hash = "sha256-6iDlZ1e69TM1z0cfGONWyd5vGTYtyDoaw357PgBVyD4=";
+  hash = "sha256-hQL9lzyqXGe2HKED21eGepwNUyYaVVoVnxeONoQFyqE=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "biome";
@@ -16,6 +16,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-biome";
   updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
-  url = "https://plugins.dprint.dev/biome-0.10.1.wasm";
-  version = "0.10.1";
+  url = "https://plugins.dprint.dev/biome-0.10.3.wasm";
+  version = "0.10.3";
 }

From 9c4d1466bf715121fcdc0f740bb82867506475b2 Mon Sep 17 00:00:00 2001
From: Nova Hahn <mail@novahahn.eu>
Date: Fri, 12 Sep 2025 08:19:05 +0200
Subject: [PATCH 39/47] emacsPackages.pdf-meta-edit: replace pdftk program

---
 .../editors/emacs/elisp-packages/melpa-packages.nix    | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 3fe5a34c27bb..1f38b7b84064 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -1603,6 +1603,16 @@ let
 
           pastery = ignoreCompilationError super.pastery; # elisp error
 
+          pdf-meta-edit = super.pdf-meta-edit.overrideAttrs (attrs: {
+            postPatch =
+              attrs.postPatch or ""
+              + "\n"
+              + ''
+                substituteInPlace pdf-meta-edit.el \
+                    --replace-fail '(executable-find "pdftk")' '"${lib.getExe pkgs.pdftk}"'
+              '';
+          });
+
           pgdevenv = ignoreCompilationError super.pgdevenv; # elisp error
 
           pinot = ignoreCompilationError super.pinot; # elisp error

From 5bb80d52070101aa0f3fe6ebc336a19999ce33d2 Mon Sep 17 00:00:00 2001
From: Daniel Schaefer <dhs@frame.work>
Date: Fri, 12 Sep 2025 17:30:29 +0800
Subject: [PATCH 40/47] fwupd: 2.0.15 -> 2.0.16

Signed-off-by: Daniel Schaefer <dhs@frame.work>
Co-authored-by: r-vdp <ramses@well-founded.dev>
---
 ...d-option-for-installation-sysconfdir.patch | 142 +++++++++---------
 pkgs/by-name/fw/fwupd/efi-app-path.patch      |  10 +-
 .../fw/fwupd/install-fwupdplugin-to-out.patch |  20 +--
 .../fw/fwupd/installed-tests-path.patch       |  16 +-
 pkgs/by-name/fw/fwupd/package.nix             |   4 +-
 5 files changed, 97 insertions(+), 95 deletions(-)

diff --git a/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch b/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch
index 17adf9687a47..2779308ebca1 100644
--- a/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/pkgs/by-name/fw/fwupd/add-option-for-installation-sysconfdir.patch
@@ -1,72 +1,69 @@
-commit 448e265ad3fef9a5ef0ff57593dd5a9164118852
+commit 56507892ff7a03ed283d7fd2d7ff2000fc9c17d7
 Author: r-vdp <ramses@well-founded.dev>
 Date:   Tue Oct 15 11:46:38 2024 +0200
 
     Add option for installation sysconfdir
 
 diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
-index 3f1cb3574..acbdccb61 100644
+index 2a2a07016..99df55afb 100644
 --- a/data/bios-settings.d/meson.build
 +++ b/data/bios-settings.d/meson.build
-@@ -1,6 +1,6 @@
- if build_standalone and host_machine.system() == 'linux'
- install_data('README.md',
-   install_tag: 'doc',
--  install_dir: join_paths(sysconfdir, 'fwupd', 'bios-settings.d')
-+  install_dir: join_paths(datadir, 'fwupd', 'bios-settings.d')
- )
+@@ -2,6 +2,6 @@ if build_standalone and host_machine.system() == 'linux'
+   install_data(
+     'README.md',
+     install_tag: 'doc',
+-    install_dir: join_paths(sysconfdir, 'fwupd', 'bios-settings.d'),
++    install_dir: join_paths(datadir, 'fwupd', 'bios-settings.d'),
+   )
  endif
 diff --git a/data/meson.build b/data/meson.build
-index 78f54bd83..aae01ed56 100644
+index 5716669f0..78e754f40 100644
 --- a/data/meson.build
 +++ b/data/meson.build
-@@ -28,7 +28,7 @@ endif
- if build_standalone
-   install_data(['fwupd.conf'],
+@@ -29,7 +29,7 @@ if build_standalone
+   install_data(
+     ['fwupd.conf'],
      install_tag: 'runtime',
 -    install_dir: join_paths(sysconfdir, 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'fwupd'),
      install_mode: 'rw-r-----',
    )
-   plugin_quirks += files([
+   plugin_quirks += files('cfi.quirk', 'ds20.quirk', 'power.quirk', 'vendors.quirk')
 diff --git a/data/pki/meson.build b/data/pki/meson.build
-index 9b1e6b372..5c80ba564 100644
+index 5b962adf1..b6575f7e4 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
-@@ -8,14 +8,14 @@ install_data([
-     'GPG-KEY-Linux-Vendor-Firmware-Service',
-   ],
-   install_tag: 'runtime',
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd')
- )
- install_data([
-     'GPG-KEY-Linux-Foundation-Metadata',
-     'GPG-KEY-Linux-Vendor-Firmware-Service',
-   ],
-   install_tag: 'runtime',
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
- )
+@@ -12,12 +12,12 @@ if supported_gpg
+   install_data(
+     ['GPG-KEY-Linux-Foundation-Firmware', 'GPG-KEY-Linux-Vendor-Firmware-Service'],
+     install_tag: 'runtime',
+-    install_dir: join_paths(sysconfdir, 'pki', 'fwupd'),
++    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd'),
+   )
+   install_data(
+     ['GPG-KEY-Linux-Foundation-Metadata', 'GPG-KEY-Linux-Vendor-Firmware-Service'],
+     install_tag: 'runtime',
+-    install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata'),
++    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata'),
+   )
  endif
  
-@@ -24,12 +24,12 @@ install_data([
-     'LVFS-CA.pem',
-   ],
-   install_tag: 'runtime',
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd')
- )
- install_data([
-     'LVFS-CA.pem',
-   ],
-   install_tag: 'runtime',
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
- )
+@@ -25,11 +25,11 @@ if supported_pkcs7
+   install_data(
+     ['LVFS-CA.pem'],
+     install_tag: 'runtime',
+-    install_dir: join_paths(sysconfdir, 'pki', 'fwupd'),
++    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd'),
+   )
+   install_data(
+     ['LVFS-CA.pem'],
+     install_tag: 'runtime',
+-    install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata'),
++    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata'),
+   )
  endif
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index 77285cafa..7d2cb8f58 100644
+index b8d24c267..0dd4ad32a 100644
 --- a/data/remotes.d/meson.build
 +++ b/data/remotes.d/meson.build
 @@ -12,7 +12,7 @@ if build_standalone and get_option('lvfs') != 'false'
@@ -87,7 +84,7 @@ index 77285cafa..7d2cb8f58 100644
    )
    i18n.merge_file(
      input: 'lvfs.metainfo.xml',
-@@ -58,7 +58,7 @@ configure_file(
+@@ -59,7 +59,7 @@ configure_file(
    configuration: con2,
    install: get_option('vendor_metadata'),
    install_tag: 'runtime',
@@ -96,7 +93,7 @@ index 77285cafa..7d2cb8f58 100644
  )
  configure_file(
    input: 'vendor-directory.conf',
-@@ -66,5 +66,5 @@ configure_file(
+@@ -67,5 +67,5 @@ configure_file(
    configuration: con2,
    install: true,
    install_tag: 'runtime',
@@ -104,10 +101,10 @@ index 77285cafa..7d2cb8f58 100644
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/docs/meson.build b/docs/meson.build
-index c1e483f4f..684ec3fbe 100644
+index 787b4387c..b3144757f 100644
 --- a/docs/meson.build
 +++ b/docs/meson.build
-@@ -127,7 +127,7 @@ if build_docs
+@@ -196,7 +196,7 @@ if build_docs
      build_by_default: true,
      install: true,
      install_tag: 'doc',
@@ -116,7 +113,7 @@ index c1e483f4f..684ec3fbe 100644
    )
  
    subdir('hsi-tests.d')
-@@ -186,7 +186,7 @@ if build_docs
+@@ -247,7 +247,7 @@ if build_docs
      build_by_default: true,
      install: true,
      install_tag: 'doc',
@@ -124,39 +121,44 @@ index c1e483f4f..684ec3fbe 100644
 +    install_dir: join_paths(sysconfdir_install, 'doc'),
    )
    man_cmd = []
-   foreach man: man_md
-@@ -201,31 +201,31 @@ if build_docs
-     ],
+   foreach man : man_md
+@@ -260,36 +260,36 @@ if build_docs
+     command: [generate_index, '@INPUT@', '-o', '@OUTPUT@', man_cmd],
      install: true,
      install_tag: 'doc',
--    install_dir: join_paths(datadir, 'doc', 'fwupd')
-+    install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd')
+-    install_dir: join_paths(datadir, 'doc', 'fwupd'),
++    install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd'),
    )
    if hsi
-     install_data(['hsi.html'],
+     install_data(
+       ['hsi.html'],
        install_tag: 'doc',
--      install_dir : join_paths(datadir, 'doc', 'fwupd')
-+      install_dir : join_paths(sysconfdir_install, 'doc', 'fwupd')
+-      install_dir: join_paths(datadir, 'doc', 'fwupd'),
++      install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd'),
      )
    endif
-   install_data(['urlmap_fwupd.js'],
+   install_data(
+     ['urlmap_fwupd.js'],
      install_tag: 'doc',
--    install_dir: join_paths(datadir, 'doc', 'libfwupd')
-+    install_dir: join_paths(sysconfdir_install, 'doc', 'libfwupd')
+-    install_dir: join_paths(datadir, 'doc', 'libfwupd'),
++    install_dir: join_paths(sysconfdir_install, 'doc', 'libfwupd'),
    )
-   install_data(['urlmap_fwupdplugin.js'],
+   install_data(
+     ['urlmap_fwupdplugin.js'],
      install_tag: 'doc',
--    install_dir: join_paths(datadir, 'doc', 'libfwupdplugin')
-+    install_dir: join_paths(sysconfdir_install, 'doc', 'libfwupdplugin')
+-    install_dir: join_paths(datadir, 'doc', 'libfwupdplugin'),
++    install_dir: join_paths(sysconfdir_install, 'doc', 'libfwupdplugin'),
    )
    #make devhelp work
-   install_symlink('libfwupd',
+   install_symlink(
+     'libfwupd',
      install_tag: 'doc',
 -    install_dir: join_paths(datadir, 'doc', 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd'),
      pointing_to: join_paths('..', 'libfwupd'),
    )
-   install_symlink('libfwupdplugin',
+   install_symlink(
+     'libfwupdplugin',
      install_tag: 'doc',
 -    install_dir: join_paths(datadir, 'doc', 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'doc', 'fwupd'),
@@ -164,10 +166,10 @@ index c1e483f4f..684ec3fbe 100644
    )
  endif
 diff --git a/meson.build b/meson.build
-index 4faedcc0b..980f9bb0c 100644
+index ca431980b..d9bab5264 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -212,6 +212,12 @@ endif
+@@ -246,6 +246,12 @@ endif
  mandir = join_paths(prefix, get_option('mandir'))
  localedir = join_paths(prefix, get_option('localedir'))
  
@@ -178,8 +180,8 @@ index 4faedcc0b..980f9bb0c 100644
 +endif
 +
  diffcmd = find_program('diff')
- gio = dependency('gio-2.0', version: '>= 2.68.0') # limited by RHEL-9, which has v2.68.4
- giounix = dependency('gio-unix-2.0', version: '>= 2.68.0', required: false)
+ gio = dependency(
+   'gio-2.0',
 diff --git a/meson_options.txt b/meson_options.txt
 index 63c8d288d..04f6651e6 100644
 --- a/meson_options.txt
diff --git a/pkgs/by-name/fw/fwupd/efi-app-path.patch b/pkgs/by-name/fw/fwupd/efi-app-path.patch
index 2411a86c62ed..5014c6c65600 100644
--- a/pkgs/by-name/fw/fwupd/efi-app-path.patch
+++ b/pkgs/by-name/fw/fwupd/efi-app-path.patch
@@ -1,19 +1,19 @@
-commit 1770b1871a567dfa78ae1e32094b6007bb7639e9
+commit f60f2bf6dd4961bdda742f590bf2d7871db6cdab
 Author: r-vdp <ramses@well-founded.dev>
 Date:   Mon Oct 28 12:08:49 2024 +0100
 
     Get the efi app from fwupd-efi
 
 diff --git a/meson.build b/meson.build
-index e4e764b97..8acaa3d2d 100644
+index d9bab5264..ee91d34b0 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -482,7 +482,7 @@ endif
+@@ -650,7 +650,7 @@ endif
  
  # EFI
  if build_standalone
 -  efi_app_location = join_paths(libexecdir, 'fwupd', 'efi')
 +  efi_app_location = join_paths(dependency('fwupd-efi').get_variable(pkgconfig: 'prefix'), 'libexec', 'fwupd', 'efi')
    conf.set_quoted('EFI_APP_LOCATION', efi_app_location)
-   if host_cpu == 'x86'
-     EFI_MACHINE_TYPE_NAME = 'ia32'
+ endif
+ 
diff --git a/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch b/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch
index 57726af3bc69..09f562ad28e5 100644
--- a/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch
+++ b/pkgs/by-name/fw/fwupd/install-fwupdplugin-to-out.patch
@@ -1,19 +1,19 @@
-commit 1b7f8b3ad7df9a5911fbc45608d9b40e0787baca
+commit 3ffe2d7842b62986e2267e6542068e6356b06fdf
 Author: r-vdp <ramses@well-founded.dev>
 Date:   Mon Oct 28 12:07:51 2024 +0100
 
     Install fwupdplugin to out
 
 diff --git a/meson.build b/meson.build
-index 747d1b385..312513d75 100644
+index 3a163331e..cb66be0cc 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -548,7 +548,7 @@ if build_standalone
- if host_machine.system() == 'windows'
-   libdir_pkg = bindir
- else
--  libdir_pkg = join_paths(libdir, 'fwupd-@0@'.format(fwupd_version))
-+  libdir_pkg = join_paths(prefix, 'lib', 'fwupd-@0@'.format(fwupd_version))
- endif
- conf.set_quoted('FWUPD_LIBDIR_PKG', libdir_pkg)
+@@ -733,7 +733,7 @@ if build_standalone
+   if host_machine.system() == 'windows'
+     libdir_pkg = bindir
+   else
+-    libdir_pkg = join_paths(libdir, 'fwupd-@0@'.format(fwupd_version))
++    libdir_pkg = join_paths(prefix, 'lib', 'fwupd-@0@'.format(fwupd_version))
+   endif
+   conf.set_quoted('FWUPD_LIBDIR_PKG', libdir_pkg)
  endif
diff --git a/pkgs/by-name/fw/fwupd/installed-tests-path.patch b/pkgs/by-name/fw/fwupd/installed-tests-path.patch
index afcd9f4905c6..f5786fe79e92 100644
--- a/pkgs/by-name/fw/fwupd/installed-tests-path.patch
+++ b/pkgs/by-name/fw/fwupd/installed-tests-path.patch
@@ -1,14 +1,14 @@
-commit abaf36af96c7dfc966110c5342d5a8814c0df492
+commit 954e41500e1b409a24fca43ae3bdc1c6a890db48
 Author: r-vdp <ramses@well-founded.dev>
 Date:   Tue Oct 15 14:49:53 2024 +0200
 
     Add output for installed tests
 
 diff --git a/data/tests/meson.build b/data/tests/meson.build
-index da9524677..505d7a80e 100644
+index 3eba65eea..cf3931bb7 100644
 --- a/data/tests/meson.build
 +++ b/data/tests/meson.build
-@@ -131,7 +131,7 @@ configure_file(
+@@ -122,7 +122,7 @@ configure_file(
    configuration: con2,
    install: true,
    install_tag: 'tests',
@@ -18,10 +18,10 @@ index da9524677..505d7a80e 100644
  
  if umockdev_integration_tests.allowed()
 diff --git a/meson.build b/meson.build
-index 312513d75..4faedcc0b 100644
+index cb66be0cc..ca431980b 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -205,8 +205,8 @@ else
+@@ -239,8 +239,8 @@ else
    datadir = join_paths(prefix, get_option('datadir'))
    sysconfdir = join_paths(prefix, get_option('sysconfdir'))
    localstatedir = join_paths(prefix, get_option('localstatedir'))
@@ -32,7 +32,7 @@ index 312513d75..4faedcc0b 100644
    daemon_dir = join_paths(libexecdir, 'fwupd')
  endif
  mandir = join_paths(prefix, get_option('mandir'))
-@@ -536,6 +536,7 @@ gnome = import('gnome')
+@@ -721,6 +721,7 @@ gnome = import('gnome')
  i18n = import('i18n')
  
  conf.set_quoted('FWUPD_PREFIX', prefix)
@@ -56,10 +56,10 @@ index 40103c03e..63c8d288d 100644
    type: 'boolean',
    value: true,
 diff --git a/src/tests/host-emulate/meson.build b/src/tests/host-emulate/meson.build
-index 0a67d70e8..7e07c0a49 100644
+index c36da65cd..f0b70d4d6 100644
 --- a/src/tests/host-emulate/meson.build
 +++ b/src/tests/host-emulate/meson.build
-@@ -10,7 +10,7 @@ if build_standalone
+@@ -9,7 +9,7 @@ if build_standalone
        command: [gzip, '-k', '--stdout', '@INPUT@'],
        install: true,
        install_tag: 'tests',
diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index b90d3f399dd1..d474c0963601 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -134,7 +134,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "2.0.15";
+  version = "2.0.16";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -152,7 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     tag = finalAttrs.version;
-    hash = "sha256-p0ZpbthjUaEKAn1UwzoW2gxqiBTsC4GMoXTmV3zKN2o=";
+    hash = "sha256-fsjW3Idaqg4pNGaRP0bm2R94FcW2MVfPQwPFWrN+Qy8=";
   };
 
   patches = [

From ebe923b94ecc8280d53bfac217572754462e9327 Mon Sep 17 00:00:00 2001
From: Daniel Schaefer <dhs@frame.work>
Date: Fri, 12 Sep 2025 19:04:09 +0800
Subject: [PATCH 41/47] fwupd: add johnazoidberg as maintainer

I'm an active upstream contributor.

Signed-off-by: Daniel Schaefer <dhs@frame.work>
---
 pkgs/by-name/fw/fwupd/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/fw/fwupd/package.nix b/pkgs/by-name/fw/fwupd/package.nix
index d474c0963601..92e6b11f9a22 100644
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -400,7 +400,10 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://fwupd.org/";
     changelog = "https://github.com/fwupd/fwupd/releases/tag/${finalAttrs.version}";
-    maintainers = with lib.maintainers; [ rvdp ];
+    maintainers = with lib.maintainers; [
+      rvdp
+      johnazoidberg
+    ];
     license = lib.licenses.lgpl21Plus;
     platforms = lib.platforms.linux;
   };

From b7db6d1f1f369017452405ee1c1cb4bad374d17b Mon Sep 17 00:00:00 2001
From: jasonxue <jason@xuechunxi.com>
Date: Mon, 8 Sep 2025 23:35:54 +0800
Subject: [PATCH 42/47] mdsf: remove cargoCheck to fix build failure

---
 pkgs/by-name/md/mdsf/package.nix | 40 ++------------------------------
 1 file changed, 2 insertions(+), 38 deletions(-)

diff --git a/pkgs/by-name/md/mdsf/package.nix b/pkgs/by-name/md/mdsf/package.nix
index 44cc1a1f2a62..be07588b2ae9 100644
--- a/pkgs/by-name/md/mdsf/package.nix
+++ b/pkgs/by-name/md/mdsf/package.nix
@@ -21,44 +21,8 @@ rustPlatform.buildRustPackage {
 
   cargoHash = "sha256-AMo2LPC6RviYu2qx202o0gFIIJdjNJxS/zY06TEcpKw=";
 
-  checkFlags = [
-    # Failing due to the method under test trying to create a directory & write to the filesystem
-    "--skip=caching::test_cache_entry::it_should_work"
-    # Permissions denied due to the test trying to remove a directory
-    "--skip=commands::prune_cache::test_run::it_should_remove_cache_directory"
-    # Permissions denied due to the test trying to write to a file
-    "--skip=config::test_config::it_should_error_on_broken_config"
-    # The following tests try to create tmp files
-    "--skip=format::accepts_multiple_file_paths"
-    "--skip=format::accepts_multiple_file_paths_with_thread_argument"
-    "--skip=format::accepts_multiple_file_paths_with_thread_argument_zero"
-    "--skip=format::format_with_cache_arg"
-    "--skip=format::formats_broken_input"
-    "--skip=format::formats_broken_input_stdin"
-    "--skip=format::formats_broken_input_with_debug_arg"
-    "--skip=format::on_missing_tool_binary_fail_cli"
-    "--skip=format::on_missing_tool_binary_fail_config"
-    "--skip=format::on_missing_tool_binary_fail_fast_cli"
-    "--skip=format::on_missing_tool_binary_fail_fast_config"
-    "--skip=format::on_missing_tool_binary_ignore_cli"
-    "--skip=format::on_missing_tool_binary_ignore_config"
-    "--skip=format::on_missing_tool_binary_prioritize_cli"
-    "--skip=format::supports_config_path_argument"
-    # Depends on one of gofumpt, gofmt, or crlfmt being available
-    "--skip=test_lib::it_should_add_go_package_if_missing"
-    # The following tests depend on rustfmt being available
-    "--skip=test_lib::it_should_format_the_code"
-    "--skip=test_lib::it_should_format_the_codeblocks_that_start_with_whitespace"
-    "--skip=test_lib::it_should_not_care_if_go_package_is_set"
-    "--skip=test_lib::it_should_not_modify_outside_blocks"
-    # The following tests try to interact with the file system
-    "--skip=verify::accepts_multiple_file_paths_broken"
-    "--skip=verify::accepts_multiple_file_paths_mixed"
-    "--skip=verify::fails_with_broken_input"
-    # The following tests try to interact with stdin
-    "--skip=verify::success_with_formatted_input_stdin"
-    "--skip=verify::supports_log_level_argument"
-  ];
+  # many tests fail for various reasons of which most depend on the build sandbox
+  doCheck = false;
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

From 8568f9ab19f682f9a061ea0f5616efa107f2d81f Mon Sep 17 00:00:00 2001
From: jasonxue <jason@xuechunxi.com>
Date: Tue, 9 Sep 2025 00:55:28 +0800
Subject: [PATCH 43/47] mdsf: 0.10.5 -> 0.10.6

---
 pkgs/by-name/md/mdsf/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/md/mdsf/package.nix b/pkgs/by-name/md/mdsf/package.nix
index be07588b2ae9..5fef3f28c8cf 100644
--- a/pkgs/by-name/md/mdsf/package.nix
+++ b/pkgs/by-name/md/mdsf/package.nix
@@ -7,7 +7,7 @@
 }:
 let
   pname = "mdsf";
-  version = "0.10.5";
+  version = "0.10.6";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage {
     owner = "hougesen";
     repo = "mdsf";
     tag = "v${version}";
-    hash = "sha256-m7VoGozJShEw6qVXScxgX7CCyIh62unVvzjq/W7Ynu8=";
+    hash = "sha256-fWJSCYWbt1P9Y2mZQ3n36SOnW7s3Cu7nmDS9dOv9hII=";
   };
 
-  cargoHash = "sha256-AMo2LPC6RviYu2qx202o0gFIIJdjNJxS/zY06TEcpKw=";
+  cargoHash = "sha256-qwROKSUiTvBix3mxnwtoS9pTlemi9U7oCa/nlERq9sw=";
 
   # many tests fail for various reasons of which most depend on the build sandbox
   doCheck = false;

From 995b3858d07c31a2d33fafd8466e780006340e73 Mon Sep 17 00:00:00 2001
From: Mika Tammi <mikatammi@gmail.com>
Date: Fri, 12 Sep 2025 15:16:10 +0300
Subject: [PATCH 44/47] maintainers: add `mikatammi`

Signed-off-by: Mika Tammi <mikatammi@gmail.com>
---
 maintainers/maintainer-list.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 950479a825bd..495eb98c6ae2 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -16790,6 +16790,14 @@
     githubId = 34864484;
     name = "Mikael Fangel";
   };
+  mikatammi = {
+    email = "mikatammi@gmail.com";
+    github = "mikatammi";
+    githubId = 826368;
+    name = "Mika Tammi";
+    matrix = "@oak:universumi.fi";
+    keys = [ { fingerprint = "3606 AD2B 342F 70B3 B306  E724 BF5B DF55 A973 5223"; } ];
+  };
   mikecm = {
     email = "mikecmcleod@gmail.com";
     github = "MaxwellDupre";

From 4a58ec0a791c2065dc9202f60f61f071c1b5579a Mon Sep 17 00:00:00 2001
From: Mika Tammi <mikatammi@gmail.com>
Date: Fri, 12 Sep 2025 15:48:55 +0300
Subject: [PATCH 45/47] haskellPackages.botan-bindings: add maintainer

Add `mikatammi` to maintainers

Signed-off-by: Mika Tammi <mikatammi@gmail.com>
---
 .../haskell-modules/configuration-hackage2nix/main.yaml         | 2 ++
 pkgs/development/haskell-modules/hackage-packages.nix           | 1 +
 2 files changed, 3 insertions(+)

diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
index 310ee2d4619d..ae771b56f435 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -338,6 +338,8 @@ package-maintainers:
     - tz
     - weeder
     - witch
+  mikatammi:
+    - botan-bindings
   mpscholten:
     - ihp-hsx
     - push-notify-apn
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index 45910e661c6d..ad21d3db7deb 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -114311,6 +114311,7 @@ self: {
       libraryPkgconfigDepends = [ botan ];
       description = "Raw Botan bindings";
       license = lib.licenses.bsd3;
+      maintainers = [ lib.maintainers.mikatammi ];
     }
   ) { botan = null; };
 

From 717ac3b883c8f6bc0f518042d998a0a59f614e97 Mon Sep 17 00:00:00 2001
From: Mika Tammi <mikatammi@gmail.com>
Date: Fri, 12 Sep 2025 18:10:43 +0300
Subject: [PATCH 46/47] haskellPackages.botan-low: add maintainer

Add `mikatammi` to maintainers

Signed-off-by: Mika Tammi <mikatammi@gmail.com>
---
 .../haskell-modules/configuration-hackage2nix/main.yaml          | 1 +
 pkgs/development/haskell-modules/hackage-packages.nix            | 1 +
 2 files changed, 2 insertions(+)

diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
index ae771b56f435..29abaea91b2f 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -340,6 +340,7 @@ package-maintainers:
     - witch
   mikatammi:
     - botan-bindings
+    - botan-low
   mpscholten:
     - ihp-hsx
     - push-notify-apn
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index ad21d3db7deb..7dee0b5eb04b 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -114356,6 +114356,7 @@ self: {
       description = "Low-level Botan bindings";
       license = lib.licenses.bsd3;
       hydraPlatforms = lib.platforms.none;
+      maintainers = [ lib.maintainers.mikatammi ];
     }
   ) { };
 

From 915ca47f28fc64a65dab2c0b99c43b5b204cd2cc Mon Sep 17 00:00:00 2001
From: Dmitry Ivankov <boltzmannrain@gmail.com>
Date: Tue, 9 Sep 2025 20:28:54 +0200
Subject: [PATCH 47/47] python3Packages.mitmproxy-macos: reuse meta attribute
 from mitmproxy-rs

Similar to mitmproxy-linux subpackage let's reuse changelog,license,maintainers.

Effective change is removing myself from mitmproxy-macos maintainers,
I haven't been involved or contributing a lot since a while ago.
At the same time there is activity supported by current mitmproxy-rs
maintainers and just documenting it sounds fair.
---
 .../python-modules/mitmproxy-linux/default.nix         |  2 --
 .../python-modules/mitmproxy-macos/default.nix         | 10 ++++------
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/mitmproxy-linux/default.nix b/pkgs/development/python-modules/mitmproxy-linux/default.nix
index 1af784ed3611..0dd4551a55e4 100644
--- a/pkgs/development/python-modules/mitmproxy-linux/default.nix
+++ b/pkgs/development/python-modules/mitmproxy-linux/default.nix
@@ -44,8 +44,6 @@ buildPythonPackage {
 
   meta = {
     inherit (mitmproxy-rs.meta) changelog license maintainers;
-  }
-  // {
     description = "Linux Rust bits in mitmproxy";
     homepage = "https://github.com/mitmproxy/mitmproxy_rs/tree/main/mitmproxy-linux";
     platforms = lib.platforms.linux;
diff --git a/pkgs/development/python-modules/mitmproxy-macos/default.nix b/pkgs/development/python-modules/mitmproxy-macos/default.nix
index 606ae484f274..3193cc4b405d 100644
--- a/pkgs/development/python-modules/mitmproxy-macos/default.nix
+++ b/pkgs/development/python-modules/mitmproxy-macos/default.nix
@@ -24,13 +24,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "mitmproxy_macos" ];
 
-  meta = with lib; {
+  meta = {
+    inherit (mitmproxy-rs.meta) changelog license maintainers;
     description = "MacOS Rust bits in mitmproxy";
     homepage = "https://github.com/mitmproxy/mitmproxy_rs/tree/main/mitmproxy-macos";
-    changelog = "https://github.com/mitmproxy/mitmproxy_rs/blob/${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ boltzmannrain ];
-    platforms = platforms.darwin;
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
   };
 }