From 76d004cde0a8831693ce1f5bbe1cede464bdc8be Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 26 Jan 2026 13:03:40 +0100
Subject: [PATCH 01/69] python313Packages.asyncio-dgram: 2.2.0 -> 3.0.0

Changelog: https://github.com/jsbronder/asyncio-dgram/blob/v3.0.0/ChangeLog
---
 pkgs/development/python-modules/asyncio-dgram/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/asyncio-dgram/default.nix b/pkgs/development/python-modules/asyncio-dgram/default.nix
index 0d8f652baf71..f65912291e09 100644
--- a/pkgs/development/python-modules/asyncio-dgram/default.nix
+++ b/pkgs/development/python-modules/asyncio-dgram/default.nix
@@ -3,24 +3,24 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  hatchling,
   pytest-asyncio,
   pytestCheckHook,
-  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "asyncio-dgram";
-  version = "2.2.0";
+  version = "3.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jsbronder";
     repo = "asyncio-dgram";
     tag = "v${version}";
-    hash = "sha256-9aO3xFmoR74uZSzxBPRVvz0QSW15TAdWEszLBX8AUR4=";
+    hash = "sha256-08XQHx+ArduVdkK5ZYq2lL2OWF9CvdSWcNLfc7ey2wI=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ hatchling ];
 
   nativeCheckInputs = [
     pytest-asyncio

From 7eab10d4130c2fbe91a8fcbf25c2969aee07aae3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 26 Jan 2026 13:05:43 +0100
Subject: [PATCH 02/69] python313Packages.asyncio-dgram: migrate to finalAttrs

---
 pkgs/development/python-modules/asyncio-dgram/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/asyncio-dgram/default.nix b/pkgs/development/python-modules/asyncio-dgram/default.nix
index f65912291e09..eb0ae2f6528d 100644
--- a/pkgs/development/python-modules/asyncio-dgram/default.nix
+++ b/pkgs/development/python-modules/asyncio-dgram/default.nix
@@ -8,7 +8,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "asyncio-dgram";
   version = "3.0.0";
   pyproject = true;
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jsbronder";
     repo = "asyncio-dgram";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-08XQHx+ArduVdkK5ZYq2lL2OWF9CvdSWcNLfc7ey2wI=";
   };
 
@@ -41,8 +41,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python support for higher level Datagram";
     homepage = "https://github.com/jsbronder/asyncio-dgram";
-    changelog = "https://github.com/jsbronder/asyncio-dgram/blob/v${version}/ChangeLog";
+    changelog = "https://github.com/jsbronder/asyncio-dgram/blob/v${finalAttrs.src.tag}/ChangeLog";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From e6909f5ac7b4ed569276c5a104201c589ee7b5ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20K=C3=B6gler?= <ck3d@gmx.de>
Date: Sat, 4 Apr 2026 22:36:11 +0200
Subject: [PATCH 03/69] nixos/systemd-initrd: support omitting kernel parameter
 root

---
 nixos/modules/system/boot/systemd/initrd.nix | 25 +++++++++++---------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 2c59d224176e..fc1fbe7106f5 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -260,10 +260,12 @@ in
     };
 
     root = lib.mkOption {
-      type = lib.types.enum [
-        "fstab"
-        "gpt-auto"
-      ];
+      type = lib.types.nullOr (
+        lib.types.enum [
+          "fstab"
+          "gpt-auto"
+        ]
+      );
       default = "fstab";
       example = "gpt-auto";
       description = ''
@@ -272,6 +274,7 @@ in
         allow specifying the root file system itself this
         way. Instead, the `fstab` value is used in order to interpret
         the root file system specified with the `fileSystems` option.
+        If root shall be omitted, set this option to `null`.
       '';
     };
 
@@ -469,13 +472,13 @@ in
     ]
     ++ lib.optional cfg.package.withEfi "efivarfs";
 
-    boot.kernelParams = [
-      "root=${config.boot.initrd.systemd.root}"
-    ]
-    ++ lib.optional (config.boot.resumeDevice != "") "resume=${config.boot.resumeDevice}"
-    # `systemd` mounts root in initrd as read-only unless "rw" is on the kernel command line.
-    # For NixOS activation to succeed, we need to have root writable in initrd.
-    ++ lib.optional (config.boot.initrd.systemd.root == "gpt-auto") "rw";
+    boot.kernelParams =
+      lib.optional (config.boot.initrd.systemd.root != null) "root=${config.boot.initrd.systemd.root}"
+
+      ++ lib.optional (config.boot.resumeDevice != "") "resume=${config.boot.resumeDevice}"
+      # `systemd` mounts root in initrd as read-only unless "rw" is on the kernel command line.
+      # For NixOS activation to succeed, we need to have root writable in initrd.
+      ++ lib.optional (config.boot.initrd.systemd.root == "gpt-auto") "rw";
 
     boot.initrd.systemd = {
       initrdBin = [

From 4a59d6908cf4c991be8283917011fe4c76d51bea Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Apr 2026 05:08:14 +0000
Subject: [PATCH 04/69] chatbox: 1.19.1 -> 1.20.0

---
 pkgs/by-name/ch/chatbox/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ch/chatbox/package.nix b/pkgs/by-name/ch/chatbox/package.nix
index f9b26d324c1a..0d9448b273f4 100644
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.19.1";
+  version = "1.20.0";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-xR653w7jiJlSHvbDcJG5pFjbgf/jZzbyx8C+pa0cPp4=";
+    hash = "sha256-VzrAXWacrX6ldHdSw12RmElMdWmHiCsE3qPEPoJqFA0=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };

From fc00e7451b1ce76b57696bb0608b36956bdc9e07 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 9 Apr 2026 00:06:12 +0000
Subject: [PATCH 05/69] n8n: 2.14.2 -> 2.15.0

---
 pkgs/by-name/n8/n8n/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 7168f00a8e3a..00fc217462bc 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -25,20 +25,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.14.2";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-nWV3DFDkBlfDdoOxwYB0HSrTyKpTt70YxAQYUPartkE=";
+    hash = "sha256-TOIJqLa68ibry9LSqMkHrJJ+v9t2bK2ybNPUDdiJ66Q=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-0SnPF3CgIja3M1ubLrwyFcx7vY0eHz9DEgn/gDLXN80=";
+    hash = "sha256-YGplNNvIOIY1BthWmejAzucXujq8AkgPJus774GmWCA=";
   };
 
   nativeBuildInputs = [

From 59ffef8450bce36066f2045a1621cce05aede2ed Mon Sep 17 00:00:00 2001
From: Tom van Dijk <18gatenmaker6@gmail.com>
Date: Sun, 27 Jul 2025 01:27:55 +0200
Subject: [PATCH 06/69] github-desktop: add dtomvan as a maintainer

In response to https://github.com/NixOS/nixpkgs/pull/428716
---
 pkgs/by-name/gi/github-desktop/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index 3ac3f6182756..6a00f32c2dbe 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -101,7 +101,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://desktop.github.com/";
     license = lib.licenses.mit;
     mainProgram = "github-desktop";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ dtomvan ];
     platforms = lib.platforms.linux;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };

From edae3a213ba469f63cf51b65a4d32af57fcb4e54 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Apr 2026 22:34:07 +0000
Subject: [PATCH 07/69] filebeat8: 8.19.13 -> 8.19.14

---
 pkgs/by-name/fi/filebeat8/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fi/filebeat8/package.nix b/pkgs/by-name/fi/filebeat8/package.nix
index 72db913dcf73..3d36d5e8a399 100644
--- a/pkgs/by-name/fi/filebeat8/package.nix
+++ b/pkgs/by-name/fi/filebeat8/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "filebeat";
-  version = "8.19.13";
+  version = "8.19.14";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "beats";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KUbGtQW0GsMmEQPQA5DJtxMt+5pNs0LdQHr66e8sW/I=";
+    hash = "sha256-rNXT8GVL5M/Hx0XA3oksbW1w+tt9FhobZlg2tCQxroc=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
 
-  vendorHash = "sha256-eZuqIOLNMnFBkZocYP1OCtny5DOPl+k2Hym51rqVQPA=";
+  vendorHash = "sha256-4jLLZxnjV8QnHh/FtBWD0OcvcdqEMSJxFeRjURZPAVo=";
 
   subPackages = [ "filebeat" ];
 

From 984b62c475023aec361a5e2f46e3c7d04faaa4fd Mon Sep 17 00:00:00 2001
From: Tom van Dijk <18gatenmaker6@gmail.com>
Date: Sun, 27 Jul 2025 01:27:55 +0200
Subject: [PATCH 08/69] github-desktop: package from source

Co-authored-by: Ulysses Zhan <UlyssesZhan@gmail.com>
---
 pkgs/by-name/gi/github-desktop/package.nix | 211 +++++++++++++--------
 1 file changed, 137 insertions(+), 74 deletions(-)

diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index 6a00f32c2dbe..06e539a1257f 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -1,108 +1,171 @@
 {
-  stdenvNoCC,
   lib,
-  fetchurl,
-  autoPatchelfHook,
-  buildPackages,
+  stdenv,
+  copyDesktopItems,
+  desktopToDarwinBundle,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  makeBinaryWrapper,
+  makeDesktopItem,
+  yarnBuildHook,
+  yarnConfigHook,
+
+  electron,
+  git,
+  git-lfs,
+  node-gyp,
+  nodejs,
+  pkg-config,
+  python3,
+  typescript,
+  zip,
+
   gnome-keyring,
   libsecret,
-  git,
   curl,
-  nss,
-  nspr,
-  libxdamage,
-  libx11,
-  libdrm,
-  alsa-lib,
-  cups,
-  libgbm,
-  systemdLibs,
-  openssl,
-  libglvnd,
 }:
 
 let
-  rcversion = "1";
+  inherit (stdenv.hostPlatform.node) arch platform;
 in
-stdenvNoCC.mkDerivation (finalAttrs: {
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "github-desktop";
   version = "3.4.13";
 
-  src =
-    let
-      urls = {
-        "x86_64-linux" = {
-          url = "https://github.com/shiftkey/desktop/releases/download/release-${finalAttrs.version}-linux${rcversion}/GitHubDesktop-linux-amd64-${finalAttrs.version}-linux${rcversion}.deb";
-          hash = "sha256-i1V3dhx5AMrCiWtfvB2I9a6ki2zncUNyYr4qZqs42Yc=";
-        };
-        "aarch64-linux" = {
-          url = "https://github.com/shiftkey/desktop/releases/download/release-${finalAttrs.version}-linux${rcversion}/GitHubDesktop-linux-arm64-${finalAttrs.version}-linux${rcversion}.deb";
-          hash = "sha256-SN4qtEI4q/AAgfUaBiM5eWyCK5Kr77CrTHsIAmvEceU=";
-        };
-      };
-    in
-    fetchurl
-      urls."${stdenvNoCC.hostPlatform.system}"
-        or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
+  src = fetchFromGitHub {
+    owner = "desktop";
+    repo = "desktop";
+    tag = "release-${finalAttrs.version}";
+    hash = "sha256-srXX49sXJnxa/7GQzP1pdJ77qeZbK1Ge8OPfrq3s5m8=";
+    fetchSubmodules = true;
+    postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
+  };
 
-  nativeBuildInputs = [
-    autoPatchelfHook
-    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
-    # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
-    (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
-  ];
+  yarnBuildScript = "build:prod";
 
   buildInputs = [
     gnome-keyring
-    libxdamage
-    libx11
     libsecret
-    git
     curl
-    nss
-    nspr
-    libdrm
-    alsa-lib
-    cups
-    libgbm
-    openssl
   ];
 
-  unpackPhase = ''
-    runHook preUnpack
-    mkdir -p $TMP/github-desktop $out/{opt,bin}
-    cp $src $TMP/github-desktop.deb
-    ar vx github-desktop.deb
-    tar --no-overwrite-dir -xvf data.tar.xz -C $TMP/github-desktop/
-    runHook postUnpack
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeBinaryWrapper
+    yarnBuildHook
+    yarnConfigHook
+
+    git
+    nodejs
+    node-gyp
+    pkg-config
+    python3
+    # desktop-notifications build doesn't pick up tsc from node_modules for some reason
+    typescript
+    zip
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin desktopToDarwinBundle;
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+    npm_config_nodedir = electron.headers;
+  };
+
+  cacheRoot = fetchYarnDeps {
+    name = "${finalAttrs.pname}-cache-root";
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-PhjMY4bAt+Prx8tmgGCZ7fhAyKhOUudrJO9K8yr7F18=";
+  };
+
+  cacheApp = fetchYarnDeps {
+    name = "${finalAttrs.pname}-cache-app";
+    yarnLock = finalAttrs.src + "/app/yarn.lock";
+    hash = "sha256-eW3G4saTbjRUexgg+n0z4EU1YtAgvSoW+uU0rNZZ1l0=";
+  };
+
+  dontYarnInstallDeps = true;
+
+  postConfigure = ''
+    yarnOfflineCache="$cacheRoot" runHook yarnConfigHook
+
+    pushd app
+    yarnOfflineCache="$cacheApp" runHook yarnConfigHook
+    popd
+
+    yarn --cwd app/node_modules/desktop-notifications run install
+
+    # use git from nixpkgs instead of an automatically downloaded one by dugite
+    makeWrapper ${lib.getExe git} app/node_modules/dugite/git/bin/git \
+      --prefix PATH : ${lib.makeBinPath [ git-lfs ]}
+
+
+    for native in fs-admin keytar desktop-trampoline windows-argv-parser; do
+      yarn --offline --cwd app/node_modules/$native build
+    done
+
+    yarn compile:script
+
+    touch electron
+    zip -0Xqr electron-v${electron.version}-${platform}-${arch}.zip electron
+    rm electron
+
+    substituteInPlace script/build.ts \
+      --replace-fail "return packager({" "return packager({electronZipDir:\"$(pwd)\",electronVersion: \"${electron.version}\","
   '';
 
+  preBuild = ''
+    export CIRCLE_SHA1="$(cat .gitrev)"
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "github-desktop";
+      desktopName = "GitHub Desktop";
+      comment = "Focus on what matters instead of fighting with Git";
+      exec = "github-desktop %u";
+      icon = "github-desktop";
+      mimeTypes = [
+        "x-scheme-handler/x-github-client"
+        "x-scheme-handler/x-github-desktop-auth"
+        "x-scheme-handler/x-github-desktop-dev-auth"
+      ];
+      terminal = false;
+    })
+  ];
+
   installPhase = ''
     runHook preInstall
-    cp -R $TMP/github-desktop/usr/share $out/
-    cp -R $TMP/github-desktop/usr/lib/github-desktop/* $out/opt/
-    ln -sf $out/opt/github-desktop $out/bin/github-desktop
+
+    mkdir -p $out/share/github-desktop
+
+    # transpose [name][size] into [size][name]
+    for icon in app/static/logos/*.png; do
+      size="$(basename "$icon" .png)"
+      install -Dm444 "$icon" -T "$out/share/icons/hicolor/$size/github-desktop.png"
+    done
+
+    cp -r dist/*/resources $out/share/github-desktop
+
+    makeWrapper ${lib.getExe electron} $out/bin/github-desktop \
+      --add-flag $out/share/github-desktop/resources/app \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --inherit-argv0
+
+    mkdir -p $out/share/icons/hicolor/512x512/apps
+    ln -s $out/share/github-desktop/resources/app/static/icon-logo.png $out/share/icons/hicolor/512x512/apps/github-desktop.png
+
     runHook postInstall
   '';
 
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-wayland-ime=true}}"
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libglvnd ]}
-    )
-  '';
-
-  runtimeDependencies = [
-    systemdLibs
-  ];
-
   meta = {
     description = "GUI for managing Git and GitHub";
-    homepage = "https://desktop.github.com/";
+    homepage = "https://desktop.github.com";
+    changelog = "https://desktop.github.com/release-notes";
+    downloadPage = "https://desktop.github.com/download";
     license = lib.licenses.mit;
     mainProgram = "github-desktop";
     maintainers = with lib.maintainers; [ dtomvan ];
-    platforms = lib.platforms.linux;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    inherit (electron.meta) platforms;
   };
 })

From 4304e214d08f35aa2304030762bc99bfb9a65998 Mon Sep 17 00:00:00 2001
From: Tom van Dijk <18gatenmaker6@gmail.com>
Date: Sun, 27 Jul 2025 01:27:55 +0200
Subject: [PATCH 09/69] github-desktop: 3.4.13 -> 3.5.7

---
 pkgs/by-name/gi/github-desktop/package.nix | 31 +++++++++++++++++-----
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index 06e539a1257f..13789c630c27 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -27,17 +27,19 @@
 
 let
   inherit (stdenv.hostPlatform.node) arch platform;
+  cacheRootHash = "sha256-mR5geiPPAv+oK1efT3pMfnUT1keOxB8Ge1yiq4hLtj0=";
+  cacheAppHash = "sha256-y8brlXwBur2RqJD8xlpA9ivg09xIDBuAtolhyzYkRx4=";
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-desktop";
-  version = "3.4.13";
+  version = "3.5.7";
 
   src = fetchFromGitHub {
     owner = "desktop";
     repo = "desktop";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-srXX49sXJnxa/7GQzP1pdJ77qeZbK1Ge8OPfrq3s5m8=";
+    hash = "sha256-H6FPMp+Y3PmRtuaOVX+8Yd3a5JA+zvLeGeLp99X1+y0=";
     fetchSubmodules = true;
     postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
   };
@@ -75,13 +77,13 @@ stdenv.mkDerivation (finalAttrs: {
   cacheRoot = fetchYarnDeps {
     name = "${finalAttrs.pname}-cache-root";
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-PhjMY4bAt+Prx8tmgGCZ7fhAyKhOUudrJO9K8yr7F18=";
+    hash = cacheRootHash;
   };
 
   cacheApp = fetchYarnDeps {
     name = "${finalAttrs.pname}-cache-app";
     yarnLock = finalAttrs.src + "/app/yarn.lock";
-    hash = "sha256-eW3G4saTbjRUexgg+n0z4EU1YtAgvSoW+uU0rNZZ1l0=";
+    hash = cacheAppHash;
   };
 
   dontYarnInstallDeps = true;
@@ -100,10 +102,27 @@ stdenv.mkDerivation (finalAttrs: {
       --prefix PATH : ${lib.makeBinPath [ git-lfs ]}
 
 
-    for native in fs-admin keytar desktop-trampoline windows-argv-parser; do
-      yarn --offline --cwd app/node_modules/$native build
+    # exception: printenvz needs `node-gyp` configure first for some reason
+    pushd node_modules/printenvz
+    node node_modules/.bin/node-gyp configure
+    popd
+
+    declare -a natives=(
+      app/node_modules/fs-admin
+      app/node_modules/keytar
+      app/node_modules/desktop-trampoline
+      app/node_modules/windows-argv-parser
+      node_modules/printenvz
+    )
+    for native in "''${natives[@]}"; do
+      yarn --offline --cwd $native build
     done
 
+    # exception: desktop-trampoline doesn't include `node-gyp rebuild` in its build script anymore
+    pushd app/node_modules/desktop-trampoline
+    node-gyp rebuild
+    popd
+
     yarn compile:script
 
     touch electron

From 93a1818f1be1ea45b0a53cbdb1f212424214a1ce Mon Sep 17 00:00:00 2001
From: Tom van Dijk <18gatenmaker6@gmail.com>
Date: Sat, 2 Aug 2025 15:03:27 +0200
Subject: [PATCH 10/69] github-desktop: add update script

---
 pkgs/by-name/gi/github-desktop/package.nix    | 17 ++++++++++++
 .../gi/github-desktop/update-yarn-caches.sh   | 27 +++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100755 pkgs/by-name/gi/github-desktop/update-yarn-caches.sh

diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index 13789c630c27..da9ad0ae1bdc 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -23,6 +23,9 @@
   gnome-keyring,
   libsecret,
   curl,
+
+  _experimental-update-script-combinators,
+  nix-update-script,
 }:
 
 let
@@ -177,6 +180,20 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru = {
+    inherit (finalAttrs) cacheRoot cacheApp;
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script {
+        extraArgs = [
+          "--version-regex"
+          ''^release-(\d\.\d\.\d)$''
+        ];
+      })
+      # TODO: in the future, use `nix-update --custom-dep`.
+      ./update-yarn-caches.sh
+    ];
+  };
+
   meta = {
     description = "GUI for managing Git and GitHub";
     homepage = "https://desktop.github.com";
diff --git a/pkgs/by-name/gi/github-desktop/update-yarn-caches.sh b/pkgs/by-name/gi/github-desktop/update-yarn-caches.sh
new file mode 100755
index 000000000000..21909d82c06e
--- /dev/null
+++ b/pkgs/by-name/gi/github-desktop/update-yarn-caches.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix gnused common-updater-scripts
+
+set -euxo pipefail
+
+cd "$(dirname $0)"
+
+setKV() {
+  sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" package.nix
+}
+
+for cache in cacheApp cacheRoot; do
+  hashKey="${cache}Hash"
+  setKV "$hashKey" sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+
+  pushd ../../../..
+  set +e
+  newHash="$(nix-build --no-out-link -A github-desktop.$cache 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')"
+  set -e
+  popd
+
+  if [ -z "$newHash" ]; then
+    echo Failed to update hash for $cache
+    exit 1
+  fi
+  setKV "$hashKey" "$newHash"
+done

From 0ab25e4a61368204bb65893e8dfcbbab06cf7502 Mon Sep 17 00:00:00 2001
From: Letgamer <alexstephan005@protonmail.com>
Date: Sat, 11 Apr 2026 23:11:25 +0200
Subject: [PATCH 11/69] python3Packages.pynfsclient: switch to Pennyw0rth Fork

---
 .../python-modules/pynfsclient/default.nix    | 32 ++++++++-----------
 1 file changed, 14 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/python-modules/pynfsclient/default.nix b/pkgs/development/python-modules/pynfsclient/default.nix
index 11b0d47f2939..6b5a2a455a2c 100644
--- a/pkgs/development/python-modules/pynfsclient/default.nix
+++ b/pkgs/development/python-modules/pynfsclient/default.nix
@@ -1,30 +1,22 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  pythonAtLeast,
+  fetchFromGitHub,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pynfsclient";
-  version = "0.1.5";
+  version = "1.0.6";
   pyproject = true;
 
-  disabled = pythonAtLeast "3.13";
-
-  src = fetchPypi {
-    pname = "pyNfsClient";
-    inherit version;
-    hash = "sha256-xgZL08NlMCpSkALQwklh7Xq16bK2Sm2hAynbrIWsgaU=";
+  src = fetchFromGitHub {
+    owner = "Pennyw0rth";
+    repo = "NfsClient";
+    rev = "v${version}";
+    hash = "sha256-9PV/RpK/rOI9jpTDy0FmkXY2Cf54vve6j1kM5dcZgV8=";
   };
 
-  postPatch = ''
-    # HISTORY.md is missing
-    substituteInPlace setup.py \
-      --replace-fail "HISTORY.md" "README.rst"
-  '';
-
   build-system = [ setuptools ];
 
   # Module has no tests
@@ -33,9 +25,13 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pyNfsClient" ];
 
   meta = {
-    description = "Pure python NFS client";
-    homepage = "https://pypi.org/project/pyNfsClient/";
+    description = "Pure python library to simulate NFS client";
+    homepage = "https://github.com/Pennyw0rth/NfsClient";
+    changelog = "https://github.com/Pennyw0rth/NfsClient/releases/tag/v${version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ fab ];
+    maintainers = with lib.maintainers; [
+      fab
+      letgamer
+    ];
   };
 }

From e70353bbcc767798158621625089c88e8c6fb7cd Mon Sep 17 00:00:00 2001
From: Lein Matsumaru <applePrincess@applePrincess.io>
Date: Thu, 9 Apr 2026 14:02:20 +0000
Subject: [PATCH 12/69] radcli: fix hash

---
 pkgs/by-name/ra/radcli/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ra/radcli/package.nix b/pkgs/by-name/ra/radcli/package.nix
index f60a527e42bc..42ec2653ec4a 100644
--- a/pkgs/by-name/ra/radcli/package.nix
+++ b/pkgs/by-name/ra/radcli/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "radcli";
     repo = "radcli";
     tag = finalAttrs.version;
-    hash = "sha256-PpPKNH9gDE9FewDCeBCog3p5C6FBBYBPVnhahVHYKnA=";
+    hash = "sha256-Q+rcNhYmQpEE5LYC/zvbh4RIxx2g9djuWmrSUdh00+c=";
   };
 
   postUnpack = ''

From 6416786e324801f52af809f9e3a042a3135c451e Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Apr 2026 17:10:56 +0000
Subject: [PATCH 13/69] python3Packages.chromadb: 1.5.5 -> 1.5.7

---
 pkgs/development/python-modules/chromadb/default.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 25f2b15209b1..000a11787feb 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -68,19 +68,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "chromadb";
-  version = "1.5.5";
+  version = "1.5.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chroma-core";
     repo = "chroma";
     tag = finalAttrs.version;
-    hash = "sha256-Y/M7awTi2AJTh4xRY0MIfnC9ygy62fG7X3W9QUxW2XE=";
+    hash = "sha256-JrkfLwEL7iTL9P/4UDM4hFQtRL1JYH47dgZ1d+Mphqw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-yx5OMZSWRAP732lRypap79vr2I72aT+TWooo+5e0wDQ=";
+    hash = "sha256-Szy2mSTriMwMViVTbI+0XaizcQBKh1Ncipf84moDREI=";
   };
 
   # Can't use fetchFromGitHub as the build expects a zipfile
@@ -102,7 +102,12 @@ buildPythonPackage (finalAttrs: {
                        "anonymized_telemetry: bool = False"
     ''
     # error: queries overflow the depth limit!
+    # https://github.com/chroma-core/chroma/issues/6891
+    # https://github.com/chroma-core/chroma/issues/6892
+    # https://github.com/chroma-core/chroma/issues/6687
     + ''
+      sed -i '1i #![recursion_limit = "256"]' rust/blockstore/src/lib.rs
+      sed -i '1i #![recursion_limit = "256"]' rust/index/src/lib.rs
       sed -i '1i #![recursion_limit = "256"]' rust/segment/src/lib.rs
     '';
 

From e7785c6a639092171f3c1de68fe3c57c2bcbf87d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Apr 2026 22:54:24 +0000
Subject: [PATCH 14/69] updatecli: 0.115.0 -> 0.116.0

---
 pkgs/by-name/up/updatecli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/up/updatecli/package.nix b/pkgs/by-name/up/updatecli/package.nix
index 8f574346f95a..06da056b38c0 100644
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "updatecli";
-  version = "0.115.0";
+  version = "0.116.0";
 
   src = fetchFromGitHub {
     owner = "updatecli";
     repo = "updatecli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-TUFOtMABC8Ut9EHhEveyLK9UTDxRS5Yz6znj4lhHfCU=";
+    hash = "sha256-34XXA8cBifuPC4Sls34D4kFkMOv9+1oYV3ZqPrWF1zY=";
   };
 
-  vendorHash = "sha256-z1nACmowcOerHWSI2SDRlombb8coYsrDTYaHY9eFPMQ=";
+  vendorHash = "sha256-UK6KC/NsEy08mK2tikpAN+H4C61cyHGzqqeoz5kylEg=";
 
   # tests require network access
   doCheck = false;

From 8fee2c5fe6b682a159d020305a161ab278c3673c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 02:55:24 +0000
Subject: [PATCH 15/69] gefyra: 2.4.0 -> 2.4.1

---
 pkgs/by-name/ge/gefyra/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ge/gefyra/package.nix b/pkgs/by-name/ge/gefyra/package.nix
index febfc6194dfe..5e18be3f7040 100644
--- a/pkgs/by-name/ge/gefyra/package.nix
+++ b/pkgs/by-name/ge/gefyra/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gefyra";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchzip {
     url = "https://github.com/gefyrahq/gefyra/releases/download/${finalAttrs.version}/gefyra-${finalAttrs.version}-linux-amd64.zip";
-    hash = "sha256-PBwAVdTa1DL7KwAFhei1AcTdPyrcaCsyo6zif+UwJPk=";
+    hash = "sha256-XS+vtwb6UIJK7f3R3QLoyX9+P4n79Fh+v7odiot7Yic=";
     stripRoot = false;
   };
 

From 16684c97179d82d6dbb353bc091acb4838aad34c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 00:39:25 +0000
Subject: [PATCH 16/69] python3Packages.beets: 2.8.0 -> 2.9.0

---
 pkgs/development/python-modules/beets/default.nix | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/beets/default.nix b/pkgs/development/python-modules/beets/default.nix
index 0206b6e48488..37f7ee3783cb 100644
--- a/pkgs/development/python-modules/beets/default.nix
+++ b/pkgs/development/python-modules/beets/default.nix
@@ -27,7 +27,6 @@
   lib,
   stdenv,
   buildPythonPackage,
-  pythonAtLeast,
   fetchFromGitHub,
 
   # build-system
@@ -113,16 +112,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "beets";
-  version = "2.8.0";
+  version = "2.9.0";
   src = fetchFromGitHub {
     owner = "beetbox";
     repo = "beets";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8sYoy11eocn7UDeTuaPqOxXZLdUqkabU4DMNLBD5Xp4=";
+    hash = "sha256-dJhWKZwhKXyFQVO9xt2v/NSa7bSg0e78zga/t9dlTyE=";
   };
   pyproject = true;
-  # Waiting for https://github.com/beetbox/beets/pull/6267
-  disabled = pythonAtLeast "3.14";
 
   patches = extraPatches;
 
@@ -181,6 +178,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   nativeCheckInputs = [
+    ffmpeg
     pytestCheckHook
     pytest-cov-stub
     pytest-flask
@@ -273,13 +271,12 @@ buildPythonPackage (finalAttrs: {
         bareasc = { };
         beatport.propagatedBuildInputs = [ requests-oauthlib ];
         bench.testPaths = [ ];
-        bpd.testPaths = [ ];
+        bpd = { };
         bpm.testPaths = [ ];
         bpsync.testPaths = [ ];
         bucket = { };
         chroma = {
           propagatedBuildInputs = [ pyacoustid ];
-          testPaths = [ ];
           wrapperBins = [
             chromaprint
           ];

From 2c1c0baf5b6ef1a6d3643b0e4e39944dab33be3e Mon Sep 17 00:00:00 2001
From: Letgamer <alexstephan005@protonmail.com>
Date: Sun, 12 Apr 2026 13:30:23 +0200
Subject: [PATCH 17/69] python3Packages.certihound: init at 0.3.0

---
 .../python-modules/certihound/default.nix     | 43 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 45 insertions(+)
 create mode 100644 pkgs/development/python-modules/certihound/default.nix

diff --git a/pkgs/development/python-modules/certihound/default.nix b/pkgs/development/python-modules/certihound/default.nix
new file mode 100644
index 000000000000..31651ecbbb75
--- /dev/null
+++ b/pkgs/development/python-modules/certihound/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  ldap3,
+  impacket,
+  cryptography,
+  pydantic,
+  click,
+  rich,
+}:
+
+buildPythonPackage rec {
+  pname = "certihound";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-ERJ5fbYikhKLwchSIBe5s4KF/1HsXZ1O00QnYXAe+ps=";
+  };
+
+  dependencies = [
+    ldap3
+    impacket
+    cryptography
+    pydantic
+    click
+    rich
+  ];
+
+  # Tests are stripped in pypi
+  doCheck = false;
+
+  pythonImportsCheck = [ "certihound" ];
+
+  meta = {
+    homepage = "https://github.com/0x0Trace/Certihound";
+    description = "Active Directory Certificate Services (ADCS) enumeration library with BloodHound CE v6 export support";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ letgamer ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 91208e3b4e53..6f8c0dc1306d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2609,6 +2609,8 @@ self: super: with self; {
 
   certifi = callPackage ../development/python-modules/certifi { };
 
+  certihound = callPackage ../development/python-modules/certihound { };
+
   certipy = callPackage ../development/python-modules/certipy { };
 
   certipy-ad = callPackage ../development/python-modules/certipy-ad { };

From 8a53f0196aebd71cc61d708702fa09c2b1a1288d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 16:23:08 +0000
Subject: [PATCH 18/69] vscode-extensions.teabyii.ayu: 1.1.11 -> 1.1.12

---
 pkgs/applications/editors/vscode/extensions/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index a00e2bad5927..8978420c823d 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4632,8 +4632,8 @@ let
         mktplcRef = {
           name = "ayu";
           publisher = "teabyii";
-          version = "1.1.11";
-          sha256 = "sha256-0gfevhXxrZC2rpWIaZM7aNfZrh/KIjoDWkZreeVU+EI=";
+          version = "1.1.12";
+          sha256 = "sha256-pwLvik3GRMLyr6GeTmZh1MrkgH1MgbyoembNmQxg4I0=";
         };
         meta = {
           description = "Simple theme with bright colors and comes in three versions — dark, light and mirage for all day long comfortable work";

From 525c398bd838b86a8f8d85767a5ee1e6cde31f4e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 16:27:44 +0000
Subject: [PATCH 19/69] fresh-editor: 0.2.21 -> 0.2.23

---
 pkgs/by-name/fr/fresh-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fr/fresh-editor/package.nix b/pkgs/by-name/fr/fresh-editor/package.nix
index 0049fd656899..8a87d81b52e2 100644
--- a/pkgs/by-name/fr/fresh-editor/package.nix
+++ b/pkgs/by-name/fr/fresh-editor/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fresh";
-  version = "0.2.21";
+  version = "0.2.23";
 
   src = fetchFromGitHub {
     owner = "sinelaw";
     repo = "fresh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-du5YCDPqrGsbajT676Zs2oPvJPPAFseTkd3bXNNg64M=";
+    hash = "sha256-yF17RnuUWj8hmVbYlAjXLgYQluKnxinEfFPSm+LqDgM=";
   };
 
-  cargoHash = "sha256-UDbW8R8XNbif+beReQsCrCqtpUw8DhDMIAlZBKqUWaQ=";
+  cargoHash = "sha256-G5cJBLhlSGp7KWOAnk+HEB+iGnZfnkHY9iqMSfaof3Y=";
 
   nativeBuildInputs = [
     gzip

From ec42c4aa6f224da6c7ef89c4f8c795c7d932316f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 16:57:04 +0000
Subject: [PATCH 20/69] dotenvx: 1.59.1 -> 1.61.0

---
 pkgs/by-name/do/dotenvx/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/do/dotenvx/package.nix b/pkgs/by-name/do/dotenvx/package.nix
index 6e0ba140cff9..04dab004f602 100644
--- a/pkgs/by-name/do/dotenvx/package.nix
+++ b/pkgs/by-name/do/dotenvx/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "dotenvx";
-  version = "1.59.1";
+  version = "1.61.0";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${version}";
-    hash = "sha256-P1k1cd6DfxGom2VKPKkNqhfs0h89QHQW19ZtePlutJk=";
+    hash = "sha256-Ph/L+OOoO3UMc8FmZSNSLNqyMSAnxyXL+jFV3WkAfMw=";
   };
 
-  npmDepsHash = "sha256-OUggLKCzvgH158HSavEJBKtVs2EsddHDs/1q7H/5pPY=";
+  npmDepsHash = "sha256-7Ei3roqBrwtdko6qdD88ljRw3MzkgonMyT7fFQDdSpo=";
 
   dontNpmBuild = true;
 

From 54e017393240a419ba948afdc12724edb22429a8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 18:47:01 +0000
Subject: [PATCH 21/69] renode-unstable: 1.16.1-unstable-2026-04-03 ->
 1.16.1-unstable-2026-04-12

---
 pkgs/by-name/re/renode-unstable/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index f4a0c0ec0394..15c6772e4c73 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -14,13 +14,13 @@ let
 in
 renode.overrideAttrs (old: rec {
   pname = "renode-unstable";
-  version = "1.16.1-unstable-2026-04-03";
+  version = "1.16.1-unstable-2026-04-12";
 
   src = fetchFromGitHub {
     owner = "renode";
     repo = "renode";
-    rev = "a5e76fbb6f3b2a15e6b1e3bfe021fdc2619f773a";
-    hash = "sha256-FCeZ/6Dp/IgFgaKu589rMAOk0NIisR4uJyCKcuSsM90=";
+    rev = "1ad93ffd5b0f2d67ff04f593de6318d12379d897";
+    hash = "sha256-MOCjxn4VB9uaq5UkHbZiGOdJDetUP816lnuPN0kXjTM=";
     fetchSubmodules = true;
   };
 

From f7afb1dc30fbf9ad7026a9f137eebbadc4e94ba4 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Sun, 12 Apr 2026 11:58:16 +0100
Subject: [PATCH 22/69] sdformat: init at 0.2.0

---
 pkgs/by-name/sd/sdformat/package.nix          | 49 +++++++++++++++++++
 .../sdformat/remove-hardcoded-lsblk-path.diff | 39 +++++++++++++++
 2 files changed, 88 insertions(+)
 create mode 100644 pkgs/by-name/sd/sdformat/package.nix
 create mode 100644 pkgs/by-name/sd/sdformat/remove-hardcoded-lsblk-path.diff

diff --git a/pkgs/by-name/sd/sdformat/package.nix b/pkgs/by-name/sd/sdformat/package.nix
new file mode 100644
index 000000000000..1c84dcf5950a
--- /dev/null
+++ b/pkgs/by-name/sd/sdformat/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  util-linuxMinimal,
+  installShellFiles,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sdformat";
+  version = "0.2.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "profi200";
+    repo = "sdFormatLinux";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-AoAhP1dr+hQSnOpZC0oHt0j3fUVNVhD+3jWm6iMfskk=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  patches = [ ./remove-hardcoded-lsblk-path.diff ];
+
+  strictDeps = true;
+
+  makeFlags = [
+    "TARGET=${finalAttrs.pname}"
+    "LSBLK_PATH=${lib.getExe' util-linuxMinimal "lsblk"}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    installBin ${finalAttrs.pname}
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Format your SD card the way the SD Association intended";
+    homepage = "https://github.com/profi200/sdFormatLinux";
+    license = lib.licenses.mit;
+    mainProgram = finalAttrs.pname;
+    maintainers = with lib.maintainers; [ thiagokokada ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/sd/sdformat/remove-hardcoded-lsblk-path.diff b/pkgs/by-name/sd/sdformat/remove-hardcoded-lsblk-path.diff
new file mode 100644
index 000000000000..22d786ae9fb7
--- /dev/null
+++ b/pkgs/by-name/sd/sdformat/remove-hardcoded-lsblk-path.diff
@@ -0,0 +1,39 @@
+diff --git i/Makefile w/Makefile
+index c45b32b..258189c 100644
+--- i/Makefile
++++ w/Makefile
+@@ -5,7 +5,8 @@ TARGET   := $(notdir $(CURDIR))
+ BUILD    := build
+ INCLUDES := include
+ SOURCES  := source
+-DEFINES  := -D_FORTIFY_SOURCE=2
++LSBLK_PATH ?= /usr/bin/lsblk
++DEFINES  := -D_FORTIFY_SOURCE=2 -DLSBLK_PATH=\"$(LSBLK_PATH)\"
+ 
+ 
+ # Compiler settings
+diff --git i/source/blockdev.cpp w/source/blockdev.cpp
+index a179604..b4de5ef 100644
+--- i/source/blockdev.cpp
++++ w/source/blockdev.cpp
+@@ -7,6 +7,7 @@
+ #include <errno.h>
+ #include <fcntl.h>     // open()...
+ #include <linux/fs.h>  // BLKGETSIZE64...
++#include <limits.h>    // PATH_MAX
+ #include <sys/ioctl.h> // ioctl()...
+ #include <sys/stat.h>  // S_IRUSR, S_IWUSR...
+ #include <unistd.h>    // write(), close()...
+@@ -21,8 +22,10 @@
+ static int checkDevice(const char *const path)
+ {
+ 	int res = EINVAL; // By default assume the given path is not a suitable device.
+-	char cmd[64] = "/usr/bin/lsblk -dnr -oTYPE,HOTPLUG,PHY-SEC ";
+-	strncpy(&cmd[43], path, sizeof(cmd) - 43);
++	const char cmdPrefix[] = LSBLK_PATH " -dnr -oTYPE,HOTPLUG,PHY-SEC ";
++	char cmd[sizeof(cmdPrefix) + PATH_MAX];
++	memcpy(cmd, cmdPrefix, sizeof(cmdPrefix) - 1);
++	strncpy(&cmd[sizeof(cmdPrefix) - 1], path, sizeof(cmd) - sizeof(cmdPrefix));
+ 	cmd[sizeof(cmd) - 1] = '\0';
+ 	FILE *const p = ::popen(cmd, "r");
+ 	if(p == nullptr)

From 1e7184f71ce667bc81d554ef0559975055faa1fd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 19:37:49 +0000
Subject: [PATCH 23/69] kubecolor: 0.5.3 -> 0.6.0

---
 pkgs/by-name/ku/kubecolor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ku/kubecolor/package.nix b/pkgs/by-name/ku/kubecolor/package.nix
index 410e41c0905a..b56665058b86 100644
--- a/pkgs/by-name/ku/kubecolor/package.nix
+++ b/pkgs/by-name/ku/kubecolor/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubecolor";
-  version = "0.5.3";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "kubecolor";
     repo = "kubecolor";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-F/ws7KevH0mGtSqp+iHyWpNccIBdF5gIoZfmLJ5H4YM=";
+    sha256 = "sha256-1eLt75w/l6AQDDUMhKIvWnaQox87r5M3c30AtpNyZFw=";
   };
 
-  vendorHash = "sha256-QenYTQTNXaBvzpyVHOCx3lEheiWZMfulEfzB+ll+q+4=";
+  vendorHash = "sha256-oTeDByJ81eWCCsIHyuScQS+lhE9cHqiATIlw2UdUZNo=";
 
   ldflags = [
     "-s"

From 9240373d7d04c645abf7b849b00b1d4ce26ca218 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 19:53:08 +0000
Subject: [PATCH 24/69] androidStudioPackages.canary: 2025.3.4.3 -> 2025.3.4.4

---
 pkgs/applications/editors/android-studio/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 5d7533f5e414..9884c28b95d3 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -26,9 +26,9 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.3.5/android-studio-panda3-rc1-linux.tar.gz";
   };
   latestVersion = {
-    version = "2025.3.4.3"; # "Android Studio Panda 4 | 2025.3.4 Canary 3"
-    sha256Hash = "sha256-8fqHdU6IPuRmcJeCZQOqUPgfild9k98sLnN77dl2Hs8=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.3/android-studio-panda4-canary3-linux.tar.gz";
+    version = "2025.3.4.4"; # "Android Studio Panda 4 | 2025.3.4 Canary 4"
+    sha256Hash = "sha256-sPGJuOm5T7EZV5hhOJsZc7P8CTXyv9A6k82hM1GZGpY=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.4/android-studio-panda4-canary4-linux.tar.gz";
   };
 in
 {

From ec5cd4a2ce057cd7a9f34977af811eb577a9370d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 20:09:34 +0000
Subject: [PATCH 25/69] vscode-extensions.ms-vsliveshare.vsliveshare: 1.1.119
 -> 1.1.122

---
 .../vscode/extensions/ms-vsliveshare.vsliveshare/default.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix b/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix
index d734acc1ea4f..b72aa226fffd 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vsliveshare";
     publisher = "ms-vsliveshare";
-    version = "1.1.119";
-    hash = "sha256-s7GCJvlMCcZ+OOwdSh82moU7BlQLz1hVPMwZ9MYtahM=";
+    version = "1.1.122";
+    hash = "sha256-XD8iLG8HA9u5Y4CKQKLnmeAN4IFf1LGDvhTKuroxkHg=";
   };
 
   postPatch = ''

From 465c4687aaf467ed3eac1273072de3c23b9a668d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 21:31:57 +0000
Subject: [PATCH 26/69] vscode-extensions.james-yu.latex-workshop: 10.13.1 ->
 10.14.1

---
 .../vscode/extensions/james-yu.latex-workshop/default.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix b/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix
index f67b77f25dcc..0fff354b20da 100644
--- a/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "latex-workshop";
     publisher = "James-Yu";
-    version = "10.13.1";
-    hash = "sha256-UyujvtuS0dok5xC4w1lGCwDxOSr58t1/YQ5Mpe6yNPM=";
+    version = "10.14.1";
+    hash = "sha256-lsbiKzZTlkq/9K7ptLg0kHAd4i5OyNh2pLGGYUOJS9A=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";

From 5f69fa740a33fdc231a3b6a892959b5da5bc3bdc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 22:40:45 +0000
Subject: [PATCH 27/69] rocketchat-desktop: 4.13.0 -> 4.14.0

---
 pkgs/by-name/ro/rocketchat-desktop/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ro/rocketchat-desktop/package.nix b/pkgs/by-name/ro/rocketchat-desktop/package.nix
index f1a0d6952860..ff8b89b8a7d9 100644
--- a/pkgs/by-name/ro/rocketchat-desktop/package.nix
+++ b/pkgs/by-name/ro/rocketchat-desktop/package.nix
@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocketchat-desktop";
-  version = "4.13.0";
+  version = "4.14.0";
 
   src = fetchFromGitHub {
     owner = "RocketChat";
     repo = "Rocket.Chat.Electron";
     tag = finalAttrs.version;
-    hash = "sha256-u2bGCtF+PBYUsYUytgJfhDVXlCwEeQCon5iRecvspEI=";
+    hash = "sha256-5p0WmTKHqiRtNeWxJuBUKVHc2DHtAGMyBsXq9SpytWA=";
   };
 
   # This might need to be updated between releases.
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-OevWuXmLlDPENVpc7L5mCY+iguqtrEeoFBHmD8YAxeY=";
+    hash = "sha256-Y6wdGp8Q5DW3f7pIrcE3ElKHFHYPxcAQFiM4R1cSYUA=";
   };
 
   nativeBuildInputs = [

From a74cedeb0f37db012602d9a2ade1139306c00aeb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 22:51:09 +0000
Subject: [PATCH 28/69] libretro.vba-m: 0-unstable-2024-10-21 ->
 0-unstable-2026-04-10

---
 pkgs/applications/emulators/libretro/cores/vba-m.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/vba-m.nix b/pkgs/applications/emulators/libretro/cores/vba-m.nix
index 7beabad5155d..f5b26fe8b8e8 100644
--- a/pkgs/applications/emulators/libretro/cores/vba-m.nix
+++ b/pkgs/applications/emulators/libretro/cores/vba-m.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "vbam";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-04-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "vbam-libretro";
-    rev = "60b48a3a4a46562f29120c1868a54778b40b60a2";
-    hash = "sha256-UbXSHdKfa91MpcYityo+aILbI0DfkLqZh8YfGcRx/BI=";
+    rev = "e8b2875d6cad10fc3c7c9f57bb5f1acc324d7c10";
+    hash = "sha256-tq2MxjPwVPkZotaZAKxmiz7Zjws22E8tK+FPcS+uujk=";
   };
 
   makefile = "Makefile";

From 421f79c3bb77c13836ebb3313b338e4d92f54e15 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Apr 2026 23:44:48 +0000
Subject: [PATCH 29/69] dokieli: 0-unstable-2026-03-25 -> 0-unstable-2026-04-13

---
 pkgs/by-name/do/dokieli/missing-hashes.json | 30 ++++++++++-----------
 pkgs/by-name/do/dokieli/package.nix         |  8 +++---
 2 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/pkgs/by-name/do/dokieli/missing-hashes.json b/pkgs/by-name/do/dokieli/missing-hashes.json
index eb73dcb5f662..9b0ac522e2ec 100644
--- a/pkgs/by-name/do/dokieli/missing-hashes.json
+++ b/pkgs/by-name/do/dokieli/missing-hashes.json
@@ -1,19 +1,19 @@
 {
-  "@rolldown/binding-android-arm64@npm:1.0.0-rc.9": "1777af709a7dee1cf188aa8248f915b9a8e33ebf08e542dad502bbc71d2b4da454cdb27099177606e8b180df406273abcd45d52774ce4e27cf2a439b84d52683",
-  "@rolldown/binding-darwin-arm64@npm:1.0.0-rc.9": "7c5a281f86d91ba3d18d079e8b67b4bb6cc9f0d414b13be2f0c4e9d4b821e8a16045c1324244841be48b94bb5312cb61295f9bf97808553614c6d5eddeb7a64a",
-  "@rolldown/binding-darwin-x64@npm:1.0.0-rc.9": "eec443021e7fc115a8378f3d664df84db7cd6e97b1741d663efdd7c68340d7e61558241031ea5434ef9ca1dfa66c1a4a480177e194cfd38925de876c157efb85",
-  "@rolldown/binding-freebsd-x64@npm:1.0.0-rc.9": "51c5863b592936299620c9200e704880ebd38b6f1ce4c4ba944558162913a8d7891c24982e85a484838fa80b025737dbd4042f94e2a25a2d927379ad572c1631",
-  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-rc.9": "d5b5391a590a9d3f0a792d78be5eaef4595c6bc25704caf28c7cc2b01853322d807bae922deabb1f2c2a197ac48dbf97b9ef4aef0212e8830a1f3c1d70af3608",
-  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-rc.9": "504c4d38e115f77fb44aa9ac56948e8d870021a5f4153af5b91fc5823b468f0268a9d451b11f7dea9aab47bc5fa07a014eecf34ad0baeb12eec46282aa8b4a22",
-  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-rc.9": "e3ebfeb46b68eca14fd36177d8e40edd5a3e8634f2b00a55531a88fa467ddc46a9a9d650e3b085b85b7a8377ad5223ebdf5b226507f3ac150528758eab70ed29",
-  "@rolldown/binding-linux-ppc64-gnu@npm:1.0.0-rc.9": "e240025464e6bf73aaff02e9412937948b6b944eee24a26ed578956e0ab7c6b00da5300e35650c1fbd5c37dee3cc8ad66c9ac3c1e036e17ea33b3cbca58f1356",
-  "@rolldown/binding-linux-s390x-gnu@npm:1.0.0-rc.9": "50e631b2efcdc93573311bc8ce8d1319bee3212c1872929d2b3752bf0be0896100f271aae829d3aafa9413b24ef47edf4a0fea48ee8dfa8386edbb23381dcd93",
-  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-rc.9": "8d59328c46ac1250c7666f2d723ec30be3119553c60e22656d08391c2a217c938f906906b6662da1984666643ba00ad7d43899041380fe6a7f5072f5e1cc4b97",
-  "@rolldown/binding-linux-x64-musl@npm:1.0.0-rc.9": "cd27570608123a824d4c779cca3cee1e93ac3a8318e030a881bb72d80a6ff3b9a22add1f550c13fd7472407aea02cda2cfbd04016975f88474826848bf463b0e",
-  "@rolldown/binding-openharmony-arm64@npm:1.0.0-rc.9": "0bb2f5ab0e2a461ac0f05e1efafaf4145702479792afc7b5229c92da18d0544fd63189fd15f6bca71a511d07131b231665933470ceceec7db67c628e2c43a152",
-  "@rolldown/binding-wasm32-wasi@npm:1.0.0-rc.9": "7208c5618e61b484d1272650c68d8908ac0a1b35ce365ef78f0b4290afa171055b24a15585c2a62d95abf1e6298e4aa3d08b71db6656415b8e7d2fdf37fd8b24",
-  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-rc.9": "f2605a92b218d088c20b0a2e71a8f47a5d5b5b04ed2edcafc59d692974cf62984228350eee176e94ea605b4326363c0962a8e97e2de34c926447c38ed6a73636",
-  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-rc.9": "091a4d27b9675b61dd598aa6ee827c5a2959b532ae52a0ac73aafd167567328a53fb38f2c0d556f8f78625c275f86d54491134fceefa9e43cb796c6af982fb75",
+  "@rolldown/binding-android-arm64@npm:1.0.0-rc.15": "0c78d6321d2dedc0c6ed4b5541328f6c04e8530a3c294b477cd9741e2af7c8377a51474f0171c85ecf63bff5c8bb31ee586f40f13fa265a869247ec3d6293204",
+  "@rolldown/binding-darwin-arm64@npm:1.0.0-rc.15": "598b8cb87d8ba8df4e880e0d6903f7f4f32b3e7b2804429cb3ccc47a69b8e7b852b2e3115a8c3a882d14979909f9464e8da55c2c52a52cb18a81df7e8a1aa654",
+  "@rolldown/binding-darwin-x64@npm:1.0.0-rc.15": "92fdfa58a8d9edaec4c1766c38c34f657715d2c8faec141590812d11ba6a6ce52530e55a6a2515fcd2ec6287e50187a458f06ca3c6813130cb9869a99c9f6f29",
+  "@rolldown/binding-freebsd-x64@npm:1.0.0-rc.15": "04e8288accf007c82e8bbe75af62d4ed570bddd7b25a178506fcf97daa0907cf6f85ea095be5826095242ac1a4923196059f53a9e8fdd0e3c34d9ed1c00d64ae",
+  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-rc.15": "4cd7452e4fe4433b730585bcbaf210efc50621bca5906204179ffe80748bea187398d4091dae64079f0c7ebfea1987f0b1c045ff60209ab0f60be9e04eccbef7",
+  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-rc.15": "fbddea791134b45a94aa5aea640a177d6feacd81a44f9ee3615da3daa824dc2a193ced6e8f2a0bb0676fca7b224525513b451cd8f78b379d7b1983fe6a0360ff",
+  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-rc.15": "b325fa98753bf41100c5d95145f30ce92b5f69f6989973306344b1644fb21633454aa216f28355c74d0e7bd5885bb6d2c80d0f96dcc2b869ca7e63d8b22dbe91",
+  "@rolldown/binding-linux-ppc64-gnu@npm:1.0.0-rc.15": "0bff0d2724912079dcedfbc0a86dbad8e3e376d2d619cf36917964701b9ae5a39afa5ff49d3cb5b2c3e17437c559314cf8e17433ad3bfb4b64229d9c8bf1ebca",
+  "@rolldown/binding-linux-s390x-gnu@npm:1.0.0-rc.15": "6718fd91ead389f3bdefe22fd0344b490d3f9350697e4aa35a0fb55957aa1b127d26aaecf9bc2d49f1dfde62d9d4717cf5dfb7d93ce3b871372ef9c6cb7a1b1a",
+  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-rc.15": "cb7628e1a7398ab5fd07dc79a38c73a27524d45adc989b5d906ea37e23b7692123d607d07fb9fda35485d6caba545ae41c561b9632aefa0bff76997208f83eae",
+  "@rolldown/binding-linux-x64-musl@npm:1.0.0-rc.15": "f59fb354b8cac55d123f6f3fe7bf8210402f97ed4be3f3a883c6c544ce1b825e36154f479d45f6e9f23c1fcd8861e9f3873dc24278631db871d263db3bea5580",
+  "@rolldown/binding-openharmony-arm64@npm:1.0.0-rc.15": "b6c220a48ace9c381d238dce2caaa8453da1d3fe9312bab7babf127a500bdec2bbe30bd381f9945af79c30fe9ca0185108b86ef311fc83ecb83ef24f7a587902",
+  "@rolldown/binding-wasm32-wasi@npm:1.0.0-rc.15": "9cd39e02ad5f43fc45901d074df10c0e3532d9077a6e334e431de60f90555c15e5445d1b5156c10df49d28839f9f15d5d808666bc8e70ab065bb9af3b8567e7a",
+  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-rc.15": "cfc32a72e8a3900f356b0b359520df3f18ac79379a273a4c53b00b1555123dcfd8204cf9976762664898b0c6c949c0edd4be850ae254d2e84a40fcb8352858eb",
+  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-rc.15": "f0bd2876247f0834f135c1ae150b7d5626d54ff399b4a6193626dc46a0eca22374a43c64afdf3eff8e8e9cf1f20df826bcd9fd4219df3fece03972b8ae080e20",
   "lightningcss-android-arm64@npm:1.32.0": "1cb326ad39dcb02cf9f45025c167b6900e3a04b08f5149d3c5ee26054b00d08db3736fb69183a6c3ed1cb32dddd148608c784b6631b4777623f7dd0c032c392d",
   "lightningcss-darwin-arm64@npm:1.32.0": "da954d0c215d0e95f15a92c8717f871017586e1332b98fd40e96196571d2fd3d51a727dc530768afee9f6a04da210510740574dd0c8dbf2ecced79e5996f1a06",
   "lightningcss-darwin-x64@npm:1.32.0": "b1d298c9173f839e8447d1917ed8bc5ab098ed0fc4e4b419d36ac5afe8b27bf21cb47d00a35c3d2edadcac598086e9b4f26c992a809d79f9681d6865a230d79e",
diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
index 008686575811..2ad85464c592 100644
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -16,19 +16,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dokieli";
-  version = "0-unstable-2026-03-25";
+  version = "0-unstable-2026-04-13";
 
   src = fetchFromGitHub {
     owner = "dokieli";
     repo = "dokieli";
-    rev = "d684e852325b2247b831b179efed5d96c211f864";
-    hash = "sha256-Af8KsH1tqPDuOUEaHRN3ULJwGWgZc5JgFT99sGKkkec=";
+    rev = "6f574408bc914347c3ba27869e61225fabbe6272";
+    hash = "sha256-PSDsV5Gg+JT9qwMBiRkyv/ZiZY9qvqhRuKjEiPMuQDU=";
   };
 
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-bUXAYeTJqz11Rl7vaNPNRBTqjLdSr0FrEQBAFLd9oEs=";
+    hash = "sha256-bO3yEh+P8al/oXXjqNOMOpXc0ggc17Wc00WtahniilE=";
   };
 
   buildPhase = ''

From cbe0413f0c00be8b8b016b8d3e8259a0bf70e5d5 Mon Sep 17 00:00:00 2001
From: Marcos Benevides <marcos.schonfinkel@gmail.com>
Date: Sun, 12 Apr 2026 20:28:14 -0400
Subject: [PATCH 30/69] lfe: fix install phase, make sure we get the binaries
 in the right place

---
 pkgs/development/interpreters/lfe/default.nix | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/interpreters/lfe/default.nix b/pkgs/development/interpreters/lfe/default.nix
index 33ad3d90bae0..1ec1f7a31f73 100644
--- a/pkgs/development/interpreters/lfe/default.nix
+++ b/pkgs/development/interpreters/lfe/default.nix
@@ -68,18 +68,23 @@ else
 
     beamDeps = [ proper ];
 
-    makeFlags = [
-      "-e"
-      "MANDB=''"
-      "PREFIX=$$out"
-    ];
-
     # override buildRebar3's install to let the builder use make install
-    installPhase = "";
+    installPhase = ''
+      runHook preInstall
+      make -e MANDB= PREFIX=$out install
+      runHook postInstall
+    '';
 
     doCheck = true;
     checkTarget = "travis";
 
+    doInstallCheck = true;
+    installCheckPhase = ''
+      runHook preInstallCheck
+      test -e $out/bin/lfe
+      runHook postInstallCheck
+    '';
+
     postFixup = ''
       # LFE binaries are shell scripts which run erl and lfe.
       # Add some stuff to PATH so the scripts can run without problems.

From 23d7be2248a34bed2d29d9997a812c3f08ea10ce Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Wed, 7 Jan 2026 20:41:26 +1100
Subject: [PATCH 31/69] tests/openssh: move order-dependent test to top

When working on nixosTests.openssh, I keep forgetting that there is
order-dependence, despite me adding a comment about this in commit
41911ed so let's solve ordering
once-and-for-all but making the order-dependent machine
predictably-first.
---
 nixos/tests/openssh.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index 97ed224b5afb..fca192c15fc7 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -90,9 +90,11 @@ in
         ];
       };
 
-    server-lazy-socket = {
+    # IP addresses are allocated according to the alphabetical order of the machine name, and since tests rely on the IP address of this machine, let's name it so it's order (and thus address) is predictable.
+    aaa-server-lazy-socket = {
       virtualisation.vlans = [
         1
+        # Allocate another VLAN so we can exercise listening on a non-standard address.
         2
       ];
       services.openssh = {
@@ -302,7 +304,7 @@ in
 
     server_lazy.wait_for_unit("sshd.socket", timeout=60)
     server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=60)
-    server_lazy_socket.wait_for_unit("sshd.socket", timeout=60)
+    aaa_server_lazy_socket.wait_for_unit("sshd.socket", timeout=60)
 
     # sshd-keygen is a oneshot unit, so just wait for multi-user.target, which
     # pulls it in.
@@ -340,14 +342,14 @@ in
             timeout=30
         )
 
-    with subtest("socket activation on a non-standard port"):
+    with subtest("socket activation on a non-standard address and port"):
         client.succeed(
             "cat ${snakeOilPrivateKey} > privkey.snakeoil"
         )
         client.succeed("chmod 600 privkey.snakeoil")
         # The final segment in this IP is allocated according to the alphabetical order of machines in this test.
         client.succeed(
-            "ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.5 true",
+            "ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.1 true",
             timeout=30
         )
 

From 41c383338e1881994bf517b4c66aacb30a2410f7 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Wed, 7 Jan 2026 20:50:50 +1100
Subject: [PATCH 32/69] nixos/sshd: add enableRecommendedAlgorithms option

Prior to this commit, NixOS enabled a set of curated algorithms.

This commit allows users to opt-out of this curation, and instead use
the upstream algorithms. This also allows users to set
Ciphers/KexAlgorithms/Macs themselves without lib.mkForce (and thus
wield NixOS modules to build the list).

Tests have been added to ensure test this new option works.
---
 .../manual/release-notes/rl-2605.section.md   |   2 +
 .../modules/services/networking/ssh/sshd.nix  | 118 +++++++++++++-----
 nixos/tests/openssh.nix                       |  52 +++++++-
 3 files changed, 134 insertions(+), 38 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index b855729692f6..e7c7d13e1c0a 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -342,6 +342,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - `services.openssh` now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving `services.openssh.enable` disabled.  This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.
 
+- `services.openssh.enableRecommendedAlgorithms` has been added to allow users to opt out of NixOS's curated set of recommended algorithms. This set to true by default, and thus is not a breaking change. Users may want to set this to false if they prefer upstream's default algorithms. See <https://github.com/NixOS/nixpkgs/pull/471330>.
+
 - IPVLAN interfaces can now be configured through the `networking.ipvlans` option in the networking module.
 
 - `services.caddy` now supports setting `httpPort` and `httpsPort` and opening them in the firewall via `openFirewall`.
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index b87e5ccad65f..9736387fd57a 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -412,6 +412,16 @@ in
         '';
       };
 
+      enableRecommendedAlgorithms = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Use algorithms curated and recommended by NixOS.
+
+          Set to false to use upstream's default algorithms.
+        '';
+      };
+
       authorizedKeysFiles = lib.mkOption {
         type = lib.types.listOf lib.types.str;
         default = [ ];
@@ -571,37 +581,64 @@ in
               };
               KexAlgorithms = lib.mkOption {
                 type = lib.types.nullOr (lib.types.listOf lib.types.str);
-                default = [
-                  "mlkem768x25519-sha256"
-                  "sntrup761x25519-sha512"
-                  "sntrup761x25519-sha512@openssh.com"
-                  "curve25519-sha256"
-                  "curve25519-sha256@libssh.org"
-                  "diffie-hellman-group-exchange-sha256"
-                ];
+                default =
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "mlkem768x25519-sha256"
+                      "sntrup761x25519-sha512"
+                      "sntrup761x25519-sha512@openssh.com"
+                      "curve25519-sha256"
+                      "curve25519-sha256@libssh.org"
+                      "diffie-hellman-group-exchange-sha256"
+                    ]
+                  else
+                    null;
+                defaultText = ''
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "mlkem768x25519-sha256"
+                      "sntrup761x25519-sha512"
+                      "sntrup761x25519-sha512@openssh.com"
+                      "curve25519-sha256"
+                      "curve25519-sha256@libssh.org"
+                      "diffie-hellman-group-exchange-sha256"
+                    ]
+                  else
+                    null;
+                '';
                 description = ''
                   Allowed key exchange algorithms
 
-                  Uses the lower bound recommended in both
-                  <https://stribika.github.io/2015/01/04/secure-secure-shell.html>
-                  and
-                  <https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67>
+                  Defaults to a curated set of algorithms.
+                  Set enableRecommendedAlgorithms to false to use upstream's defaults.
                 '';
               };
               Macs = lib.mkOption {
                 type = lib.types.nullOr (lib.types.listOf lib.types.str);
-                default = [
-                  "hmac-sha2-512-etm@openssh.com"
-                  "hmac-sha2-256-etm@openssh.com"
-                  "umac-128-etm@openssh.com"
-                ];
+                default =
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "hmac-sha2-512-etm@openssh.com"
+                      "hmac-sha2-256-etm@openssh.com"
+                      "umac-128-etm@openssh.com"
+                    ]
+                  else
+                    null;
+                defaultText = ''
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "hmac-sha2-512-etm@openssh.com"
+                      "hmac-sha2-256-etm@openssh.com"
+                      "umac-128-etm@openssh.com"
+                    ]
+                  else
+                    null;
+                '';
                 description = ''
                   Allowed MACs
 
-                  Defaults to recommended settings from both
-                  <https://stribika.github.io/2015/01/04/secure-secure-shell.html>
-                  and
-                  <https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67>
+                  Defaults to a curated set of algorithms.
+                  Set enableRecommendedAlgorithms to false to use upstream's defaults.
                 '';
               };
               StrictModes = lib.mkOption {
@@ -613,21 +650,36 @@ in
               };
               Ciphers = lib.mkOption {
                 type = lib.types.nullOr (lib.types.listOf lib.types.str);
-                default = [
-                  "chacha20-poly1305@openssh.com"
-                  "aes256-gcm@openssh.com"
-                  "aes128-gcm@openssh.com"
-                  "aes256-ctr"
-                  "aes192-ctr"
-                  "aes128-ctr"
-                ];
+                default =
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "chacha20-poly1305@openssh.com"
+                      "aes256-gcm@openssh.com"
+                      "aes128-gcm@openssh.com"
+                      "aes256-ctr"
+                      "aes192-ctr"
+                      "aes128-ctr"
+                    ]
+                  else
+                    null;
+                defaultText = ''
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "chacha20-poly1305@openssh.com"
+                      "aes256-gcm@openssh.com"
+                      "aes128-gcm@openssh.com"
+                      "aes256-ctr"
+                      "aes192-ctr"
+                      "aes128-ctr"
+                    ]
+                  else
+                    null;
+                '';
                 description = ''
                   Allowed ciphers
 
-                  Defaults to recommended settings from both
-                  <https://stribika.github.io/2015/01/04/secure-secure-shell.html>
-                  and
-                  <https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67>
+                  Defaults to a curated set of algorithms.
+                  Set enableRecommendedAlgorithms to false to use upstream's defaults.
                 '';
               };
               AllowUsers = lib.mkOption {
diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index fca192c15fc7..c6b2f6d707d6 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -193,12 +193,32 @@ in
               path = "/etc/ssh/ssh_host_ed25519_key";
             }
           ];
+          # The NixOS-curated algorithms require OpenSSL, and so since this test is against an OpenSSH-without-OpenSSL, we have to use the default algorithms, which adapt to not having OpenSSL.
+          enableRecommendedAlgorithms = false;
+        };
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilEd25519PublicKey
+        ];
+      };
+
+    server-default-algorithms =
+      { ... }:
+      {
+        services.openssh = {
+          enable = true;
+          enableRecommendedAlgorithms = false;
+        };
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilEd25519PublicKey
+        ];
+      };
+
+    server-null-algorithms =
+      { ... }:
+      {
+        services.openssh = {
+          enable = true;
           settings = {
-            # Since this test is against an OpenSSH-without-OpenSSL,
-            # we have to override NixOS's defaults ciphers (which require OpenSSL)
-            # and instead set these to null, which will mean OpenSSH uses its defaults.
-            # Expectedly, OpenSSH's defaults don't require OpenSSL when it's compiled
-            # without OpenSSL.
             Ciphers = null;
             KexAlgorithms = null;
             Macs = null;
@@ -294,10 +314,12 @@ in
 
     server.wait_for_unit("sshd", timeout=60)
     server_allowed_users.wait_for_unit("sshd", timeout=60)
+    server_default_algorithms.wait_for_unit("sshd", timeout=60)
     server_localhost_only.wait_for_unit("sshd", timeout=60)
     server_match_rule.wait_for_unit("sshd", timeout=60)
     server_no_openssl.wait_for_unit("sshd", timeout=60)
     server_no_pam.wait_for_unit("sshd", timeout=60)
+    server_null_algorithms.wait_for_unit("sshd", timeout=60)
     server_null_pam.wait_for_unit("sshd", timeout=60)
     server_null_pam.fail("journalctl -u sshd.service | grep 'Unsupported option UsePAM'")
     server_sftp.wait_for_unit("sshd", timeout=60)
@@ -402,6 +424,26 @@ in
             timeout=30
         )
 
+    with subtest("null-algorithms"):
+        client.succeed(
+            "cat ${snakeOilEd25519PrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-null-algorithms true",
+            timeout=30
+        )
+
+    with subtest("no-openssl"):
+        client.succeed(
+            "cat ${snakeOilEd25519PrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-default-algorithms true",
+            timeout=30
+        )
+
     with subtest("no-pam"):
         client.succeed(
             "cat ${snakeOilPrivateKey} > privkey.snakeoil"

From 8c8664e5847a41d6a61bbf7f8749558a928a91d9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 01:32:20 +0000
Subject: [PATCH 33/69] cherry-studio: 1.8.4 -> 1.9.1

---
 pkgs/by-name/ch/cherry-studio/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ch/cherry-studio/package.nix b/pkgs/by-name/ch/cherry-studio/package.nix
index 0d9c30858ca1..87b79a3b9452 100644
--- a/pkgs/by-name/ch/cherry-studio/package.nix
+++ b/pkgs/by-name/ch/cherry-studio/package.nix
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cherry-studio";
-  version = "1.8.4";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "CherryHQ";
     repo = "cherry-studio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TLV4N9WYuTD24UY+2lYmxRLO2jtdvuXyIOeH5mXb1V0=";
+    hash = "sha256-gk/sTkBr7PKBGS96bYVUXGpZuoaech4/0npB+NSstTA=";
   };
 
   postPatch = ''
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-qryToH1tytLSwPORkLBCCn3m/Xsl+vift9WF3Pn8oGg=";
+    hash = "sha256-DidMffZQEdYSERZZgDpQ8DqV773iBju89Pa0Z1Gz3I8=";
   };
 
   nativeBuildInputs = [

From e547b0255a656d048de6a460f9a4eb273e6976f5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 01:52:23 +0000
Subject: [PATCH 34/69] python3Packages.microsoft-kiota-abstractions: 1.9.10 ->
 1.10.1

---
 .../python-modules/microsoft-kiota-abstractions/default.nix   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
index dc9024c51cae..a3912c2405ab 100644
--- a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-abstractions";
-  version = "1.9.10";
+  version = "1.10.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-abstractions-v${version}";
-    hash = "sha256-J9OLxZ3vQpChhfwjXzrGF691zco/bKv51FG20VFieN0=";
+    hash = "sha256-KBCjVNZDPMh0wxWm8UVLsrfl2AYp3rKMjAT5c8F7+64=";
   };
 
   sourceRoot = "${src.name}/packages/abstractions/";

From f21739e2f9925d0c023238a6619e98a821aa3aae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 12 Apr 2026 19:09:03 -0700
Subject: [PATCH 35/69] vaultwarden: 1.35.4 -> 1.35.6

Diff: https://github.com/dani-garcia/vaultwarden/compare/1.35.4...1.35.6

Changelog: https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.6
---
 pkgs/by-name/va/vaultwarden/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/va/vaultwarden/package.nix b/pkgs/by-name/va/vaultwarden/package.nix
index 7e6808d5fa5d..734613e0a079 100644
--- a/pkgs/by-name/va/vaultwarden/package.nix
+++ b/pkgs/by-name/va/vaultwarden/package.nix
@@ -19,16 +19,16 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vaultwarden";
-  version = "1.35.4";
+  version = "1.35.6";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = "vaultwarden";
     tag = finalAttrs.version;
-    hash = "sha256-NphgKTlyVsH42TEGU8unhL798jTQMkS5JyNckKhk8YM=";
+    hash = "sha256-Q5D/tDE7rC9/iIaD0WlGr2AaoCdAEJQs++8uOdYgRXo=";
   };
 
-  cargoHash = "sha256-PkFxHhFrdVB/hfSoT6j87K4IEknl+ZO1omGHrXBWEMg=";
+  cargoHash = "sha256-LSmzR3X04i2dmPwj1ivPm/YeNtxGhfwsEXG93iVvhrI=";
 
   # used for "Server Installed" version in admin panel
   env.VW_VERSION = finalAttrs.version;

From cbbd72092a3b67b0406d234adb89d2914cbaa2ca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 02:26:48 +0000
Subject: [PATCH 36/69] python3Packages.adlfs: 2026.2.0 -> 2026.4.0

---
 pkgs/development/python-modules/adlfs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/adlfs/default.nix b/pkgs/development/python-modules/adlfs/default.nix
index 63379df0f0f3..58bc5e9164f4 100644
--- a/pkgs/development/python-modules/adlfs/default.nix
+++ b/pkgs/development/python-modules/adlfs/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "adlfs";
-  version = "2026.2.0";
+  version = "2026.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fsspec";
     repo = "adlfs";
     tag = finalAttrs.version;
-    hash = "sha256-wpj0MTpP5fBKTWA7sy4eRQo084pc+oNZgHVieC5NL2A=";
+    hash = "sha256-lqEyREVMdo59NhDZVdOb+w2bf5JVDg/nQHYhC+hKglo=";
   };
 
   build-system = [

From 26c921630420591a4d819b6d9fce3356bdef20fd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 03:06:24 +0000
Subject: [PATCH 37/69] nushell: 0.111.0 -> 0.112.1

---
 pkgs/by-name/nu/nushell/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/nu/nushell/package.nix b/pkgs/by-name/nu/nushell/package.nix
index 923b5481191a..2555ec7ad100 100644
--- a/pkgs/by-name/nu/nushell/package.nix
+++ b/pkgs/by-name/nu/nushell/package.nix
@@ -24,16 +24,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # NOTE: when updating this to a new non-patch version, please also try to
   # update the plugins. Plugins only work if they are compiled for the same
   # major/minor version.
-  version = "0.111.0";
+  version = "0.112.1";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nushell";
     tag = finalAttrs.version;
-    hash = "sha256-/jS75aVUCLWDq3zw8yv2pUjUneyYSngfELuKfDQtqqA=";
+    hash = "sha256-y0EfP95XEVvse0xaSWK5Yr748tTVYRG7Bx+Qf5JrlYY=";
   };
 
-  cargoHash = "sha256-7hXmBNvNRdO4pXfF7RNcPrB7BmKL/BWqjQoz6pB4P2A=";
+  cargoHash = "sha256-Y/yaWj2akccehFVxrGHrsjzZd02L8qE9KoSSwzAeEwg=";
 
   nativeBuildInputs = [
     pkg-config

From 33241219884dd5a539e872b70acfa1c308ad0c27 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 05:50:14 +0000
Subject: [PATCH 38/69] python3Packages.nominatim-api: 5.3.0 -> 5.3.1

---
 pkgs/by-name/no/nominatim/nominatim-api.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/no/nominatim/nominatim-api.nix b/pkgs/by-name/no/nominatim/nominatim-api.nix
index 0280d402f82b..6ae83eec07eb 100644
--- a/pkgs/by-name/no/nominatim/nominatim-api.nix
+++ b/pkgs/by-name/no/nominatim/nominatim-api.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "nominatim";
-  version = "5.3.0";
+  version = "5.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "osm-search";
     repo = "Nominatim";
     tag = "v${version}";
-    hash = "sha256-cICDzsEJ2yRi8PaQpjfVC9ZI3KeQPiqGu4U1nTxxBvk=";
+    hash = "sha256-3WU8n121JbFFZTntcKG6t0x2mC1AzI97q/fMe/UTGTs=";
   };
 
   postPatch = ''

From b975b60bef87715638f95d25dd0570be4901d527 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 05:51:37 +0000
Subject: [PATCH 39/69] wasmtime: 43.0.0 -> 43.0.1

---
 pkgs/by-name/wa/wasmtime/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/wa/wasmtime/package.nix b/pkgs/by-name/wa/wasmtime/package.nix
index 5200b7c99978..73ca5330e8f2 100644
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@@ -13,20 +13,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasmtime";
-  version = "43.0.0";
+  version = "43.0.1";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasmtime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zCU3CtqbqagSWQZULvTxCRwK709ZfyL9PGtjJpNAYQE=";
+    hash = "sha256-KnsnR9SJoAfKsEIwKRy+AKEdDFQMBfIwISJpEef8kFo=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-WJz7J9FHGRqni889o2omkC1K+rwZ8iM6SarT1nd1p0Q=";
+  cargoHash = "sha256-nfO16qAYL2NXaV9S1HTPIH+pyYLjWCo2I1EONJf7W74=";
   cargoBuildFlags = [
     "--package"
     "wasmtime-cli"

From e975a9293a5c983f62b1d396a4b59a0f67475fe2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 06:07:33 +0000
Subject: [PATCH 40/69] gauge-unwrapped: 1.6.29 -> 1.6.30

---
 pkgs/by-name/ga/gauge-unwrapped/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ga/gauge-unwrapped/package.nix b/pkgs/by-name/ga/gauge-unwrapped/package.nix
index db7335577ee3..7c466c165d38 100644
--- a/pkgs/by-name/ga/gauge-unwrapped/package.nix
+++ b/pkgs/by-name/ga/gauge-unwrapped/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "gauge";
-  version = "1.6.29";
+  version = "1.6.30";
 
   patches = [
     # adds a check which adds an error message when trying to
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "getgauge";
     repo = "gauge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mZmIxss0W5eufz7EzchjVxdXpM/npbIBWls5C3KYVbY=";
+    hash = "sha256-tAS2FVg1TCWyRlEMDcepC+riYxzIOTh2sHBbHL+TrsU=";
   };
 
-  vendorHash = "sha256-nZPRjCzYSdtx6Q4VGdTunfK9+4X14l3gXwMLJc855JY=";
+  vendorHash = "sha256-pCnf8wtj44eubq03noZs7MGxzssWFFn3AhL1v0icLa8=";
 
   excludedPackages = [
     "build"

From fcb8241fade6a448634815c878dbe5043f0fa900 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 06:15:08 +0000
Subject: [PATCH 41/69] lazyhetzner: 1.1.1 -> 1.2.0

---
 pkgs/by-name/la/lazyhetzner/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/la/lazyhetzner/package.nix b/pkgs/by-name/la/lazyhetzner/package.nix
index fb7e20ce1003..03ab775dbc4d 100644
--- a/pkgs/by-name/la/lazyhetzner/package.nix
+++ b/pkgs/by-name/la/lazyhetzner/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lazyhetzner";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "grammeaway";
     repo = "lazyhetzner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QFtlcio3yVyltoTqYH8RJknx/tKpn6dNu1WwnLLJY/A=";
+    hash = "sha256-G7IfB/tnhPKf/tG0b2HKUshc4x+AySiHlJZNSlOJr2I=";
 
     leaveDotGit = true;
     postFetch = ''

From 2abc0a9047617ca44724c31089ac25e4563d753e Mon Sep 17 00:00:00 2001
From: Nikita Uvarov <uv.nikita@gmail.com>
Date: Mon, 13 Apr 2026 08:22:33 +0200
Subject: [PATCH 42/69] home-assistant-custom-components.mitsubishi: ignore
 pymitsubishi version requirement

---
 .../home-assistant/custom-components/mitsubishi/package.nix     | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/servers/home-assistant/custom-components/mitsubishi/package.nix b/pkgs/servers/home-assistant/custom-components/mitsubishi/package.nix
index 9777ef932b99..050a1b771cd3 100644
--- a/pkgs/servers/home-assistant/custom-components/mitsubishi/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/mitsubishi/package.nix
@@ -24,6 +24,8 @@ buildHomeAssistantComponent rec {
     pymitsubishi
   ];
 
+  ignoreVersionRequirement = [ "pymitsubishi" ];
+
   nativeCheckInputs = [
     pytest-cov-stub
     pytestCheckHook

From f243a23777735602de42dfc110e4ae6c7d448294 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 06:46:01 +0000
Subject: [PATCH 43/69] nzbhydra2: 8.5.3 -> 8.5.4

---
 pkgs/by-name/nz/nzbhydra2/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nz/nzbhydra2/package.nix b/pkgs/by-name/nz/nzbhydra2/package.nix
index dcb4014ce633..a55fc21b5ee5 100644
--- a/pkgs/by-name/nz/nzbhydra2/package.nix
+++ b/pkgs/by-name/nz/nzbhydra2/package.nix
@@ -35,13 +35,13 @@ let
 in
 maven.buildMavenPackage rec {
   pname = "nzbhydra2";
-  version = "8.5.3";
+  version = "8.5.4";
 
   src = fetchFromGitHub {
     owner = "theotherp";
     repo = "nzbhydra2";
     tag = "v${version}";
-    hash = "sha256-yaXHbm2gBvmmST4Rurn7s4a1F7GSKfuYhswIDl8bTMA=";
+    hash = "sha256-chP++0ve734wOO7qNy4f+4KyYgBWlkzjaMJiueW4LkM=";
   };
 
   mvnHash = "sha256-dodZT40zNqfaPd8VxfNYY10VrFNlL4xESDdTrgcFaaY=";

From 8dffd3b19c046afa7c89792f21ecc56c5adcb6a3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 09:01:27 +0200
Subject: [PATCH 44/69] python3Packages.tencentcloud-sdk-python: 3.1.75 ->
 3.1.76

Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/3.1.75...3.1.76

Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.1.76/CHANGELOG.md
---
 .../python-modules/tencentcloud-sdk-python/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 57c4df9eb4d2..a15d64ebe8ee 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.75";
+  version = "3.1.76";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-O/heoxVZybJYZF3qFcuKXgbncClfKK21WpXGqtwxw58=";
+    hash = "sha256-21BXGAPXCyRHTqPSUjvWWbrEbxAqqeSZavqIZ6sax3Q=";
   };
 
   build-system = [ setuptools ];

From 69ad71b86ac4d63e7e8e1846f6bfedb28081f76d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 09:01:50 +0200
Subject: [PATCH 45/69] python3Packages.publicsuffixlist: 1.0.2.20260411 ->
 1.0.2.20260412

Changelog: https://github.com/ko-zu/psl/blob/v1.0.2.20260412-gha/CHANGES.md
---
 pkgs/development/python-modules/publicsuffixlist/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index c8ee8154e42f..383cdc6b6ffd 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "publicsuffixlist";
-  version = "1.0.2.20260411";
+  version = "1.0.2.20260412";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-24VElVHBxL7czt72+iDuHxw8V+ivpcOTx0wNDdmcPWM=";
+    hash = "sha256-wRQDRrKd86CZZ4bVBQXZKeeb25EQ+rUHWT+P5hEItnE=";
   };
 
   postPatch = ''

From 1b80c482c1dba8008e881de6696c579af40edc35 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 11 Apr 2026 11:05:38 +0200
Subject: [PATCH 46/69] python3Packages.iamdata: 0.1.202604101 -> 0.1.202604111

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202604101...v0.1.202604111

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202604111
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 1963012fec26..751877b466e1 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202604101";
+  version = "0.1.202604111";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YA6q5BMQ+71Jn54KEqAqt7LMg+t36f56paDtMYQcHGc=";
+    hash = "sha256-5SgvH8KUIjGdngQwhgAHZmWNP9upTtM24fYntstF1rY=";
   };
 
   __darwinAllowLocalNetworking = true;

From 20e1f7625b37fd1582065bdd7c8dd9a27340fd5f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 09:02:20 +0200
Subject: [PATCH 47/69] python3Packages.iamdata: 0.1.202604111 -> 0.1.202604131

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202604111...v0.1.202604131

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202604131
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 751877b466e1..e3dbdda8e4a5 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202604111";
+  version = "0.1.202604131";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5SgvH8KUIjGdngQwhgAHZmWNP9upTtM24fYntstF1rY=";
+    hash = "sha256-NFEhmbq0vAn0mZtdVnzyU8TWz3FaYbodFz6wMKOdjTk=";
   };
 
   __darwinAllowLocalNetworking = true;

From ddd2d118e9fd0444cc129fb310d1149a80f1d1c3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 07:08:56 +0000
Subject: [PATCH 48/69] libretro.twenty-fortyeight: 0-unstable-2026-03-31 ->
 0-unstable-2026-04-10

---
 .../emulators/libretro/cores/twenty-fortyeight.nix          | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/twenty-fortyeight.nix b/pkgs/applications/emulators/libretro/cores/twenty-fortyeight.nix
index af41c0b0ef4d..352f9c8ff282 100644
--- a/pkgs/applications/emulators/libretro/cores/twenty-fortyeight.nix
+++ b/pkgs/applications/emulators/libretro/cores/twenty-fortyeight.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "2048";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-2048";
-    rev = "1892de39d80ec37e1fac79729cd91917b21f1349";
-    hash = "sha256-lNcDdkiWiXhvwwpzMnceTDY+mJl1JTZfGCY+WIOvrP8=";
+    rev = "c90437d3c3913999624deca3fb55ecfa632b72c4";
+    hash = "sha256-dE3PanK+rpf01R4aoD3KMwVhEVvmmVS2klVPQUGTUC0=";
   };
 
   meta = {

From 10d1334ec69a21c1b0cc044c457fed728cae500f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 09:13:28 +0200
Subject: [PATCH 49/69] python3Packages.microsoft-kiota-abstractions: migrate
 to finalAttrs

---
 .../microsoft-kiota-abstractions/default.nix           | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
index a3912c2405ab..5badc3aa4ced 100644
--- a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
@@ -12,7 +12,7 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-abstractions";
   version = "1.10.1";
   pyproject = true;
@@ -20,11 +20,11 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
-    tag = "microsoft-kiota-abstractions-v${version}";
+    tag = "microsoft-kiota-abstractions-v${finalAttrs.version}";
     hash = "sha256-KBCjVNZDPMh0wxWm8UVLsrfl2AYp3rKMjAT5c8F7+64=";
   };
 
-  sourceRoot = "${src.name}/packages/abstractions/";
+  sourceRoot = "${finalAttrs.src.name}/packages/abstractions/";
 
   build-system = [ poetry-core ];
 
@@ -57,8 +57,8 @@ buildPythonPackage rec {
   meta = {
     description = "Abstractions library for Kiota generated Python clients";
     homepage = "https://github.com/microsoft/kiota-python/tree/main/packages/abstractions/";
-    changelog = "https://github.com/microsoft/kiota-python/releases/tag/${src.tag}";
+    changelog = "https://github.com/microsoft/kiota-python/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From 1db487ee6f8e88aed3ddd611348b708b8bd48578 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 09:19:05 +0200
Subject: [PATCH 50/69] python3Packages.claude-agent-sdk: 0.1.56 -> 0.1.58

Diff: https://github.com/anthropics/claude-agent-sdk-python/compare/v0.1.56...v0.1.58

Changelog: https://github.com/anthropics/claude-agent-sdk-python/blob/v0.1.58/CHANGELOG.md
---
 pkgs/development/python-modules/claude-agent-sdk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/claude-agent-sdk/default.nix b/pkgs/development/python-modules/claude-agent-sdk/default.nix
index 1e7387e84dfe..059e74dce539 100644
--- a/pkgs/development/python-modules/claude-agent-sdk/default.nix
+++ b/pkgs/development/python-modules/claude-agent-sdk/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "claude-agent-sdk";
-  version = "0.1.56";
+  version = "0.1.58";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anthropics";
     repo = "claude-agent-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lpgRTDaGJGFnhs60we+YqBurvMi/dmC5Y80RfJP8NS0=";
+    hash = "sha256-Xpl6/9+e1MFjCG/5fCzubAFIfLejdMPnTLmNmwglEy4=";
   };
 
   build-system = [ hatchling ];

From 4efedc535c93e052e1866f27a84e4fd5fbd6f687 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 09:25:25 +0200
Subject: [PATCH 51/69] python3Packages.aioopenexchangerates: 0.6.21 -> 0.7.0

Changelog: https://github.com/MartinHjelmare/aioopenexchangerates/blob/v0.7.0/CHANGELOG.md
---
 .../python-modules/aioopenexchangerates/default.nix    | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/aioopenexchangerates/default.nix b/pkgs/development/python-modules/aioopenexchangerates/default.nix
index 12ecf2f9b239..510309a98570 100644
--- a/pkgs/development/python-modules/aioopenexchangerates/default.nix
+++ b/pkgs/development/python-modules/aioopenexchangerates/default.nix
@@ -5,27 +5,27 @@
   buildPythonPackage,
   fetchFromGitHub,
   mashumaro,
-  poetry-core,
   pytest-aiohttp,
   pytest-cov-stub,
   pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "aioopenexchangerates";
-  version = "0.6.21";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MartinHjelmare";
     repo = "aioopenexchangerates";
     tag = "v${version}";
-    hash = "sha256-yPi2k1ajW+X78dF3OJTdGR3h8mzNfYCsW0P8baKUjoA=";
+    hash = "sha256-pNjpeoXBlz2bdUeEsOlW7RJmbKTZGuBVTLHymGHwAiY=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];
 
-  build-system = [ poetry-core ];
+  build-system = [ setuptools ];
 
   dependencies = [
     aiohttp
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     description = "Library for the Openexchangerates API";
     homepage = "https://github.com/MartinHjelmare/aioopenexchangerates";
     changelog = "https://github.com/MartinHjelmare/aioopenexchangerates/blob/v${version}/CHANGELOG.md";
-    license = with lib.licenses; [ asl20 ];
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
 }

From 2975f3bf8fa611d0a7d4ba3d407b16fecb753030 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 09:26:33 +0200
Subject: [PATCH 52/69] python3Packages.aioopenexchangerates: migrate to
 finalAttrs

---
 .../python-modules/aioopenexchangerates/default.nix       | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/aioopenexchangerates/default.nix b/pkgs/development/python-modules/aioopenexchangerates/default.nix
index 510309a98570..e19043d9043e 100644
--- a/pkgs/development/python-modules/aioopenexchangerates/default.nix
+++ b/pkgs/development/python-modules/aioopenexchangerates/default.nix
@@ -11,7 +11,7 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aioopenexchangerates";
   version = "0.7.0";
   pyproject = true;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "MartinHjelmare";
     repo = "aioopenexchangerates";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-pNjpeoXBlz2bdUeEsOlW7RJmbKTZGuBVTLHymGHwAiY=";
   };
 
@@ -44,8 +44,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library for the Openexchangerates API";
     homepage = "https://github.com/MartinHjelmare/aioopenexchangerates";
-    changelog = "https://github.com/MartinHjelmare/aioopenexchangerates/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/MartinHjelmare/aioopenexchangerates/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From ec64070f7f45b81197ce245e7ca5545eb965280a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 09:31:20 +0200
Subject: [PATCH 53/69] python3Packages.nominatim: migrate to finalAttrs

---
 pkgs/by-name/no/nominatim/nominatim-api.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/no/nominatim/nominatim-api.nix b/pkgs/by-name/no/nominatim/nominatim-api.nix
index 6ae83eec07eb..762257db1d96 100644
--- a/pkgs/by-name/no/nominatim/nominatim-api.nix
+++ b/pkgs/by-name/no/nominatim/nominatim-api.nix
@@ -12,7 +12,7 @@
   sqlalchemy,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "nominatim";
   version = "5.3.1";
   pyproject = true;
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "osm-search";
     repo = "Nominatim";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-3WU8n121JbFFZTntcKG6t0x2mC1AzI97q/fMe/UTGTs=";
   };
 
@@ -34,9 +34,7 @@ buildPythonPackage rec {
     cd packaging/nominatim-api
   '';
 
-  build-system = [
-    hatchling
-  ];
+  build-system = [ hatchling ];
 
   dependencies = [
     async-timeout
@@ -61,4 +59,4 @@ buildPythonPackage rec {
       ngi
     ];
   };
-}
+})

From 1e645638fbcb684091ee8555a3d51e67186bc179 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 12 Apr 2026 10:19:49 +0300
Subject: [PATCH 54/69] python3Packages.beets-alternatives: fix a test failing
 with beets 2.9.0

---
 .../python-modules/beets-alternatives/default.nix    | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/development/python-modules/beets-alternatives/default.nix b/pkgs/development/python-modules/beets-alternatives/default.nix
index 3cfc70696255..ec30ac64bade 100644
--- a/pkgs/development/python-modules/beets-alternatives/default.nix
+++ b/pkgs/development/python-modules/beets-alternatives/default.nix
@@ -32,6 +32,18 @@ buildPythonPackage rec {
     hash = "sha256-leZYXf6Oo/jAKbnJbP+rTnuRsh9P1BQXYAbthMNT60A=";
   };
 
+  patches = [
+    # Fixes a failing test, see:
+    # https://github.com/geigerzaehler/beets-alternatives/issues/212
+    (fetchpatch {
+      url = "https://github.com/geigerzaehler/beets-alternatives/commit/8b75974636897aabcf2ca75fb0987f7beb68f50f.patch";
+      hash = "sha256-lIJwuf3UklcJM4m7CO2+aNpPekHXuC5rpPVjK+kb+FQ=";
+      includes = [
+        "test/cli_test.py"
+      ];
+    })
+  ];
+
   build-system = [
     hatchling
   ];

From 9704065dabed871b833b5678cb86878ed60fad63 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 12 Apr 2026 12:07:53 +0300
Subject: [PATCH 55/69] python3Packages.beetcamp: 0.24.1 -> 0.24.2

Diff: https://github.com/snejus/beetcamp/compare/0.24.1...0.24.2
---
 pkgs/development/python-modules/beetcamp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/beetcamp/default.nix b/pkgs/development/python-modules/beetcamp/default.nix
index b279660c821c..3b8e97d9234a 100644
--- a/pkgs/development/python-modules/beetcamp/default.nix
+++ b/pkgs/development/python-modules/beetcamp/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "beetcamp";
-  version = "0.24.1";
+  version = "0.24.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "snejus";
     repo = "beetcamp";
     tag = finalAttrs.version;
-    hash = "sha256-Oe5pZ4gYgqBHuzt9LBe4G14+RYXrNL+L5GIGMMflyMI=";
+    hash = "sha256-AMHj7rsPAxUUvVg6vri2NnkO9+5NAVwGrWLvNvOtlLs=";
   };
 
   patches = [

From 3b3ed2c2f7c0aff1883095c6257e42eb3d49e00d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 08:54:54 +0000
Subject: [PATCH 56/69] python3Packages.unifi-discovery: 1.3.0 -> 1.4.0

---
 pkgs/development/python-modules/unifi-discovery/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/unifi-discovery/default.nix b/pkgs/development/python-modules/unifi-discovery/default.nix
index a508f25d1b33..7f1c1696901b 100644
--- a/pkgs/development/python-modules/unifi-discovery/default.nix
+++ b/pkgs/development/python-modules/unifi-discovery/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "unifi-discovery";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "unifi-discovery";
     tag = "v${version}";
-    hash = "sha256-/SsgBiCEfMYi3DccYKBZGoYX4egGW+bBIA/D73FaneE=";
+    hash = "sha256-pn8WRsYGbBy4EwQ1DufY2WbbVM65dM4h8ZReG+qkr6k=";
   };
 
   build-system = [ poetry-core ];

From f89111d314ec7a43f1a2c88f4e34f4bdc2777b92 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 09:46:02 +0000
Subject: [PATCH 57/69] tcping-rs: 1.2.24 -> 1.2.26

---
 pkgs/by-name/tc/tcping-rs/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tc/tcping-rs/package.nix b/pkgs/by-name/tc/tcping-rs/package.nix
index 715ec913de2d..df108e82e57f 100644
--- a/pkgs/by-name/tc/tcping-rs/package.nix
+++ b/pkgs/by-name/tc/tcping-rs/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tcping-rs";
-  version = "1.2.24";
+  version = "1.2.26";
 
   src = fetchFromGitHub {
     owner = "lvillis";
     repo = "tcping-rs";
     tag = finalAttrs.version;
-    hash = "sha256-gsTZls5guqtDk8x+3q4nFYGwhr+TAV5iE9kiZgbmzCI=";
+    hash = "sha256-qcvoV57t36c230p7KRec9CBIb+F+dVeGU4EVs0DrREM=";
   };
 
-  cargoHash = "sha256-m/juo6+SPFAxQ7E2JgTkv47kxn4LhwfI4UGSDzHAXMc=";
+  cargoHash = "sha256-Y+Hv4oWHTzC/8DQ6/wQ3QLtDy/rqQs+89x312cYOpKY=";
 
   checkFlags = [
     # This test requires external network access

From f0412cc83f6fb1c3e9bd1e99d9842c3b9e9b570c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 11:48:18 +0200
Subject: [PATCH 58/69] python3Packages.unifi-discovery: migrate to finalAttrs

---
 .../python-modules/unifi-discovery/default.nix         | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/unifi-discovery/default.nix b/pkgs/development/python-modules/unifi-discovery/default.nix
index 7f1c1696901b..693155141219 100644
--- a/pkgs/development/python-modules/unifi-discovery/default.nix
+++ b/pkgs/development/python-modules/unifi-discovery/default.nix
@@ -11,7 +11,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "unifi-discovery";
   version = "1.4.0";
   pyproject = true;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "unifi-discovery";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-pn8WRsYGbBy4EwQ1DufY2WbbVM65dM4h8ZReG+qkr6k=";
   };
 
@@ -44,9 +44,9 @@ buildPythonPackage rec {
   meta = {
     description = "Module to discover Unifi devices";
     homepage = "https://github.com/bdraco/unifi-discovery";
-    changelog = "https://github.com/bdraco/unifi-discovery/releases/tag/v${version}";
-    license = with lib.licenses; [ asl20 ];
+    changelog = "https://github.com/bdraco/unifi-discovery/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     platforms = lib.platforms.linux;
   };
-}
+})

From 051da568320af663533b070b3affe2b775114752 Mon Sep 17 00:00:00 2001
From: Kamil Monicz <kamil@monicz.dev>
Date: Mon, 13 Apr 2026 09:41:08 +0000
Subject: [PATCH 59/69] buildVcode: replace glibc.bin with getconf

---
 pkgs/applications/editors/vscode/generic.nix | 29 ++++++++++++--------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index b2686a9df4e6..7f1b627c5ef0 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -3,9 +3,9 @@
   lib,
   coreutils,
   gawk,
+  getconf,
   gnugrep,
   gnused,
-  glibc,
   jq,
   copyDesktopItems,
   makeDesktopItem,
@@ -354,18 +354,23 @@ stdenv.mkDerivation (
               "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libdbusmenu ]}"
           }
         --prefix PATH : ${
-          lib.makeBinPath [
-            # for moving files to trash
-            glib
+          lib.makeBinPath (
+            [
+              # for moving files to trash
+              glib
 
-            # for launcher and bundled helper scripts
-            gawk
-            glibc.bin
-            gnugrep
-            gnused
-            coreutils
-            which
-          ]
+              # for launcher and bundled helper scripts
+              gawk
+              gnugrep
+              gnused
+              coreutils
+              which
+            ]
+            # provides `getconf` for ps-fallback script that only runs on Linux
+            # https://github.com/microsoft/vscode/blob/97c807618b413805fde466739ba14f77a1f12307/src/vs/base/node/ps.sh#L2
+            # https://github.com/microsoft/vscode/blob/97c807618b413805fde466739ba14f77a1f12307/src/vs/base/node/ps.ts#L203-L217
+            ++ lib.optional stdenv.hostPlatform.isLinux getconf
+          )
         }
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}"
         --add-flags ${lib.escapeShellArg commandLineArgs}

From 939c3c57ae1f70c8829bcf1406cd9fd67af9f00a Mon Sep 17 00:00:00 2001
From: Matteo Pacini <m+github@matteopacini.me>
Date: Mon, 13 Apr 2026 10:52:36 +0100
Subject: [PATCH 60/69] nzbhydra2: add meta.changelog

---
 pkgs/by-name/nz/nzbhydra2/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/nz/nzbhydra2/package.nix b/pkgs/by-name/nz/nzbhydra2/package.nix
index dcb4014ce633..1389f80158ca 100644
--- a/pkgs/by-name/nz/nzbhydra2/package.nix
+++ b/pkgs/by-name/nz/nzbhydra2/package.nix
@@ -90,6 +90,7 @@ maven.buildMavenPackage rec {
   meta = {
     description = "Usenet meta search";
     homepage = "https://github.com/theotherp/nzbhydra2";
+    changelog = "https://github.com/theotherp/nzbhydra2/releases/tag/v${version}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       matteopacini

From c515a64c2478cf96e61b879c2fbfbc4eb431eb83 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 10:00:04 +0000
Subject: [PATCH 61/69] shaka-packager: 3.7.1 -> 3.7.2

---
 pkgs/by-name/sh/shaka-packager/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sh/shaka-packager/package.nix b/pkgs/by-name/sh/shaka-packager/package.nix
index 44eb296226a2..b4f01d912c02 100644
--- a/pkgs/by-name/sh/shaka-packager/package.nix
+++ b/pkgs/by-name/sh/shaka-packager/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shaka-packager";
-  version = "3.7.1";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "shaka-project";
     repo = "shaka-packager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z98DXYa/M0SvohNxFWXPJGBSPWJzrz8oFUBO5DajknE=";
+    hash = "sha256-E493sleVbsuytneK51lxuQnaEzvAEJwAXYmsxcaOXSs=";
   };
 
   nativeBuildInputs = [

From c754ee1b356753af364b928f6c1d41ab239ee4eb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 10:27:07 +0000
Subject: [PATCH 62/69] jsonschema-cli: 0.45.0 -> 0.46.0

---
 pkgs/by-name/js/jsonschema-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/js/jsonschema-cli/package.nix b/pkgs/by-name/js/jsonschema-cli/package.nix
index 65817362a240..91c508cb1f5c 100644
--- a/pkgs/by-name/js/jsonschema-cli/package.nix
+++ b/pkgs/by-name/js/jsonschema-cli/package.nix
@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jsonschema-cli";
-  version = "0.45.0";
+  version = "0.46.0";
 
   src = fetchCrate {
     pname = "jsonschema-cli";
     inherit (finalAttrs) version;
-    hash = "sha256-9pz07T7i7pxNNOV/YGbneIA45VG9uBzhI+ygwknW07Q=";
+    hash = "sha256-tpapiI6FYHEgmI0XY5KZNNsZxKxkEN4BIJaNQXsMIJI=";
   };
 
-  cargoHash = "sha256-EiLXX0wZi9v8vsMxCeg8/XMfWH9FckuNjqPpLEUK5lc=";
+  cargoHash = "sha256-1Wih2VwK3hzdjuoAZI/1j0jPwWwL4l4y4rQRX0VV4Sc=";
 
   preCheck = ''
     export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt

From a1458aa056876683692f9595fdc75777e416473c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 10:36:45 +0000
Subject: [PATCH 63/69] cnspec: 13.3.3 -> 13.4.1

---
 pkgs/by-name/cn/cnspec/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index 62a3285c2696..3da84146f582 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "cnspec";
-  version = "13.3.3";
+  version = "13.4.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yCxry1f5CEF51WSgrYN1m9F8YpVjtt+UNZG978nPXbY=";
+    hash = "sha256-3Uo2x30K7b7NA5OGP8YYlcoEJmFhlkL7t7ohvzUlmYI=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-wgebRTa1ox+LUzxlYLb3pqcLEF/uUushZ1Oq2mvRGCk=";
+  vendorHash = "sha256-7XwLkvG0LYL0pIbjMs78wMSqbXR5SScPAgjRxYsPwlA=";
 
   subPackages = [ "apps/cnspec" ];
 

From 0b225d39b3d785427c9d221c7fc20dffeb9abdd0 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 12:42:30 +0200
Subject: [PATCH 64/69] python3Pakcages.pynfsclient: migrate to finalAttrs

---
 pkgs/development/python-modules/pynfsclient/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pynfsclient/default.nix b/pkgs/development/python-modules/pynfsclient/default.nix
index 6b5a2a455a2c..68e528c95d01 100644
--- a/pkgs/development/python-modules/pynfsclient/default.nix
+++ b/pkgs/development/python-modules/pynfsclient/default.nix
@@ -5,7 +5,7 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pynfsclient";
   version = "1.0.6";
   pyproject = true;
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Pennyw0rth";
     repo = "NfsClient";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-9PV/RpK/rOI9jpTDy0FmkXY2Cf54vve6j1kM5dcZgV8=";
   };
 
@@ -27,11 +27,11 @@ buildPythonPackage rec {
   meta = {
     description = "Pure python library to simulate NFS client";
     homepage = "https://github.com/Pennyw0rth/NfsClient";
-    changelog = "https://github.com/Pennyw0rth/NfsClient/releases/tag/v${version}";
+    changelog = "https://github.com/Pennyw0rth/NfsClient/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       fab
       letgamer
     ];
   };
-}
+})

From 32a3e446b9fdc7673576f556e39ce7eaaf8942a3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 10:56:31 +0000
Subject: [PATCH 65/69] python3Packages.reconplogger: 4.18.1 -> 5.0.0

---
 pkgs/development/python-modules/reconplogger/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/reconplogger/default.nix b/pkgs/development/python-modules/reconplogger/default.nix
index 100550fea61f..35e95c4d98ef 100644
--- a/pkgs/development/python-modules/reconplogger/default.nix
+++ b/pkgs/development/python-modules/reconplogger/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "reconplogger";
-  version = "4.18.1";
+  version = "5.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "omni-us";
     repo = "reconplogger";
     tag = "v${version}";
-    hash = "sha256-kYNidF1sTC6WulX3HXMUm+TFJWvHgZj86Asmi6uIKRs=";
+    hash = "sha256-/+nPLji8iGTBpWTCR83JRfxMltMYjP62KrB+HRTQQE8=";
   };
 
   build-system = [ setuptools ];

From 3e017e9576695942df00f5c3758912da8cf67190 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 12:59:15 +0200
Subject: [PATCH 66/69] python3Packages.certihound: add build-system

---
 pkgs/development/python-modules/certihound/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/certihound/default.nix b/pkgs/development/python-modules/certihound/default.nix
index 31651ecbbb75..404fa9e42c18 100644
--- a/pkgs/development/python-modules/certihound/default.nix
+++ b/pkgs/development/python-modules/certihound/default.nix
@@ -8,6 +8,7 @@
   pydantic,
   click,
   rich,
+  setuptools,
 }:
 
 buildPythonPackage rec {
@@ -20,6 +21,8 @@ buildPythonPackage rec {
     hash = "sha256-ERJ5fbYikhKLwchSIBe5s4KF/1HsXZ1O00QnYXAe+ps=";
   };
 
+  build-system = [ setuptools ];
+
   dependencies = [
     ldap3
     impacket

From b887779f249114e1448f530ad3328e58071210ce Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 13:00:08 +0200
Subject: [PATCH 67/69] python3Packages.certihound: migrate to finalAttrs

---
 pkgs/development/python-modules/certihound/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/certihound/default.nix b/pkgs/development/python-modules/certihound/default.nix
index 404fa9e42c18..a403d6a70200 100644
--- a/pkgs/development/python-modules/certihound/default.nix
+++ b/pkgs/development/python-modules/certihound/default.nix
@@ -11,13 +11,13 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "certihound";
   version = "0.3.0";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-ERJ5fbYikhKLwchSIBe5s4KF/1HsXZ1O00QnYXAe+ps=";
   };
 
@@ -43,4 +43,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ letgamer ];
   };
-}
+})

From 5dae3e65178bda2e65dfb166f5ca080d6034274c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 13 Apr 2026 13:09:20 +0200
Subject: [PATCH 68/69] python3Packages.reconplogger: migrate to finalAttrs

---
 pkgs/development/python-modules/reconplogger/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/reconplogger/default.nix b/pkgs/development/python-modules/reconplogger/default.nix
index 35e95c4d98ef..a016e303bfb8 100644
--- a/pkgs/development/python-modules/reconplogger/default.nix
+++ b/pkgs/development/python-modules/reconplogger/default.nix
@@ -11,7 +11,7 @@
   testfixtures,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "reconplogger";
   version = "5.0.0";
   pyproject = true;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "omni-us";
     repo = "reconplogger";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-/+nPLji8iGTBpWTCR83JRfxMltMYjP62KrB+HRTQQE8=";
   };
 
@@ -52,4 +52,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From a958c920524e4301653beaefef33b91883202a3b Mon Sep 17 00:00:00 2001
From: Ilan Joselevich <personal@ilanjoselevich.com>
Date: Mon, 13 Apr 2026 12:11:14 +0100
Subject: [PATCH 69/69] spire-tpm-plugin: init at 1.11.1

---
 pkgs/by-name/sp/spire-tpm-plugin/package.nix | 45 ++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 pkgs/by-name/sp/spire-tpm-plugin/package.nix

diff --git a/pkgs/by-name/sp/spire-tpm-plugin/package.nix b/pkgs/by-name/sp/spire-tpm-plugin/package.nix
new file mode 100644
index 000000000000..299bae4d1d00
--- /dev/null
+++ b/pkgs/by-name/sp/spire-tpm-plugin/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  openssl,
+  tpm2-tools,
+  xxd,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "spire-tpm-plugin";
+  version = "1.11.1";
+
+  src = fetchFromGitHub {
+    owner = "spiffe";
+    repo = "spire-tpm-plugin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6hy1aQg0tS2wxOZRbZLv82HQEufVmW/a5L6Da+bNeHU=";
+  };
+
+  proxyVendor = true;
+  vendorHash = "sha256-cENDkx/iz6H/AhAO1lKypHhOFz+F3gC3bMg8Jw7eeo0=";
+
+  ldflags = [ "-s" ];
+
+  buildInputs = [ openssl ];
+
+  nativeCheckInputs = [
+    openssl.bin
+    tpm2-tools
+    xxd
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Provides agent and server plugins for SPIRE to allow TPM 2-based node attestation";
+    homepage = "https://github.com/spiffe/spire-tpm-plugin";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ arianvp ];
+  };
+})