From 0bd48eae0dad5f4b65d970a754aae579517d10a6 Mon Sep 17 00:00:00 2001
From: Letgamer <alexstephan005@protonmail.com>
Date: Sun, 12 Apr 2026 16:54:40 +0200
Subject: [PATCH 01/69] python3Packages.gradient: overhaul package

---
 .../python-modules/gradient/default.nix       | 95 +++++++------------
 1 file changed, 34 insertions(+), 61 deletions(-)

diff --git a/pkgs/development/python-modules/gradient/default.nix b/pkgs/development/python-modules/gradient/default.nix
index a03dd7d1de8a..47af6704df75 100644
--- a/pkgs/development/python-modules/gradient/default.nix
+++ b/pkgs/development/python-modules/gradient/default.nix
@@ -1,83 +1,56 @@
 {
   lib,
-  attrs,
-  boto3,
   buildPythonPackage,
-  click-completion,
-  click-didyoumean,
-  click-help-colors,
-  colorama,
-  fetchPypi,
-  gradient-statsd,
-  gradient-utils,
-  gql,
-  halo,
-  marshmallow,
-  progressbar2,
-  pyopenssl,
-  pyyaml,
-  requests,
-  requests-toolbelt,
-  terminaltables,
-  websocket-client,
+  fetchFromGitHub,
+  hatchling,
+  hatch-fancy-pypi-readme,
+  httpx,
+  pydantic,
+  typing-extensions,
+  anyio,
+  distro,
+  sniffio,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "gradient";
   version = "3.10.1";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-TL9Jbo9UvQhgG9aT3wjLD8DvTY48Os04DdaUfNAwcu4=";
+  src = fetchFromGitHub {
+    owner = "digitalocean";
+    repo = "gradient-python";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Psre4HdF4/cgQ5CcM3H6PC+6asej4Is4+932Gvym774=";
   };
 
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace 'attrs<=' 'attrs>=' \
-      --replace 'colorama==' 'colorama>=' \
-      --replace 'gql[requests]==3.0.0a6' 'gql' \
-      --replace 'PyYAML==5.*' 'PyYAML' \
-      --replace 'marshmallow<' 'marshmallow>=' \
-      --replace 'websocket-client==0.57.*' 'websocket-client'
+    substituteInPlace pyproject.toml \
+      --replace-fail "hatchling==1.26.3" "hatchling"
   '';
 
-  propagatedBuildInputs = [
-    attrs
-    boto3
-    click-completion
-    click-didyoumean
-    click-help-colors
-    colorama
-    gql
-    gradient-statsd
-    gradient-utils
-    halo
-    marshmallow
-    progressbar2
-    pyopenssl
-    pyyaml
-    requests
-    requests-toolbelt
-    terminaltables
-    websocket-client
+  nativeBuildInputs = [
+    hatchling
+    hatch-fancy-pypi-readme
   ];
 
-  # Tries to use /homeless-shelter to mimic container usage, etc
-  doCheck = false;
+  dependencies = [
+    httpx
+    pydantic
+    typing-extensions
+    anyio
+    distro
+    sniffio
+  ];
 
-  # marshmallow.exceptions.StringNotCollectionError: "only" should be a collection of strings.
-  # Support for marshmallow > 3
-  # pythonImportsCheck = [
-  #   "gradient"
-  # ];
+  pythonImportsCheck = [ "gradient" ];
 
   meta = {
-    description = "Command line interface for Gradient";
+    description = "Python API library for Gradient";
     mainProgram = "gradient";
-    homepage = "https://github.com/Paperspace/gradient-cli";
-    license = lib.licenses.isc;
+    homepage = "https://github.com/digitalocean/gradient-python";
+    license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ thoughtpolice ];
   };
-}
+})

From 33f539df43ae63a09cb69baec738fb43f073e5b4 Mon Sep 17 00:00:00 2001
From: Konstantin Alekseev <konstantin@kotify.com>
Date: Tue, 19 May 2026 07:00:04 +0300
Subject: [PATCH 02/69] playwright: 1.59.1 -> 1.60.0

---
 pkgs/by-name/pl/playwright-mcp/package.nix    | 18 ++---
 .../python-modules/playwright/default.nix     | 14 ++--
 pkgs/development/web/playwright/browsers.json | 14 ++--
 .../playwright/chromium-headless-shell.nix    |  8 +--
 pkgs/development/web/playwright/chromium.nix  |  8 +--
 pkgs/development/web/playwright/driver.nix    | 69 +------------------
 pkgs/development/web/playwright/firefox.nix   |  8 +--
 pkgs/development/web/playwright/webkit.nix    | 10 +--
 8 files changed, 41 insertions(+), 108 deletions(-)

diff --git a/pkgs/by-name/pl/playwright-mcp/package.nix b/pkgs/by-name/pl/playwright-mcp/package.nix
index 2f045c3588bd..8fc87b78605f 100644
--- a/pkgs/by-name/pl/playwright-mcp/package.nix
+++ b/pkgs/by-name/pl/playwright-mcp/package.nix
@@ -2,40 +2,34 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  makeWrapper,
   playwright-driver,
   playwright-test,
 }:
 buildNpmPackage rec {
   pname = "playwright-mcp";
-  version = "0.0.69";
+  version = "0.0.74";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "playwright-mcp";
     tag = "v${version}";
-    hash = "sha256-zX9RsHVInRib69N4LkG3R4TB5qjlBirpu9BBftcr92I=";
+    hash = "sha256-dGYZTBPNszVtxvYWTIF77dDm9elGvcLwbn+yG/lfR68=";
   };
 
-  npmDepsHash = "sha256-hc5AkUTGoXxXlDW9vPpiO23QOgANJp1lX4xoaySHoK4=";
+  npmDepsHash = "sha256-IgoflKLyY4plURB++N4YSzqfG4Y7aGSUvND+WiHYiQo=";
 
-  npmWorkspace = "packages/playwright-mcp";
+  nativeBuildInputs = [ makeWrapper ];
 
   # Codex MCP smoke test (after `codex mcp add playwright-nix --env DISPLAY=:0 -- $out/bin/playwright-mcp --headless --isolated`):
   # timeout 45s codex exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check "Use only playwright-nix MCP tools. Navigate to https://example.com and return only the page title."
   postInstall = ''
-    pkg_dir="$out/lib/node_modules/playwright-mcp-internal"
+    pkg_dir="$out/lib/node_modules/@playwright/mcp"
     rm -rf "$pkg_dir/node_modules/playwright"
     rm -rf "$pkg_dir/node_modules/playwright-core"
     ln -s ${playwright-test}/lib/node_modules/playwright "$pkg_dir/node_modules/playwright"
     ln -s ${playwright-test}/lib/node_modules/playwright-core "$pkg_dir/node_modules/playwright-core"
 
-    # Workspace symlinks point to a packages/ tree that npmInstallHook does not
-    # ship; npm hoisted the workspace contents directly into playwright-mcp-internal.
-    rm "$pkg_dir/node_modules/@playwright/mcp"
-    rm "$pkg_dir/node_modules/@playwright/mcp-extension"
-    rm "$pkg_dir/node_modules/playwright-cli"
-    rm "$pkg_dir/node_modules/.bin/playwright-mcp"
-
     wrapProgram $out/bin/playwright-mcp \
       --set PLAYWRIGHT_BROWSERS_PATH ${playwright-driver.browsers} \
       --set-default PLAYWRIGHT_MCP_BROWSER chromium
diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index 7a9e257d12a4..1994e7775b12 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -31,14 +31,14 @@ in
 buildPythonPackage (finalAttrs: {
   pname = "playwright";
   # run ./pkgs/development/web/playwright/update.sh to update
-  version = "1.59.0";
+  version = "1.60.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "playwright-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CbvVSx/KDaX+CZEJRlDd4GUwWejzjTKNyL4+FhgT6qE=";
+    hash = "sha256-gbPWUmELw77Fw5M236et2TjkkGisMVVOJzmgq61/bg0=";
   };
 
   patches = [
@@ -54,11 +54,11 @@ buildPythonPackage (finalAttrs: {
   ];
 
   postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail ', "auditwheel==6.2.0"' "" \
-      --replace-fail "setuptools-scm==8.3.1" "setuptools-scm" \
-      --replace-fail "setuptools==80.9.0" "setuptools" \
-      --replace-fail "wheel==0.45.1" "wheel"
+    # Use sed with a regex instead of substituteInPlace so we don't have to
+    # bump pinned versions on every upstream release. grep -q precheck makes
+    # the build fail loudly if upstream restructures the requires list.
+    grep -q 'requires = \["setuptools==.*", "setuptools-scm==.*", "wheel==.*", "auditwheel==.*"\]' pyproject.toml
+    sed -i -e 's/requires = \["setuptools==.*", "setuptools-scm==.*", "wheel==.*", "auditwheel==.*"\]/requires = ["setuptools", "setuptools-scm", "wheel"]/' pyproject.toml
 
     # setup.py downloads and extracts the driver.
     # This is done manually in postInstall instead.
diff --git a/pkgs/development/web/playwright/browsers.json b/pkgs/development/web/playwright/browsers.json
index 4ed4747f928b..cd90b574e67b 100644
--- a/pkgs/development/web/playwright/browsers.json
+++ b/pkgs/development/web/playwright/browsers.json
@@ -2,22 +2,22 @@
   "comment": "This file is kept up to date via update.sh",
   "browsers": {
     "chromium": {
-      "revision": "1217",
-      "browserVersion": "147.0.7727.15",
+      "revision": "1223",
+      "browserVersion": "148.0.7778.96",
       "title": "Chrome for Testing"
     },
     "chromium-headless-shell": {
-      "revision": "1217",
-      "browserVersion": "147.0.7727.15",
+      "revision": "1223",
+      "browserVersion": "148.0.7778.96",
       "title": "Chrome Headless Shell"
     },
     "firefox": {
-      "revision": "1511",
-      "browserVersion": "148.0.2",
+      "revision": "1522",
+      "browserVersion": "150.0.2",
       "title": "Firefox"
     },
     "webkit": {
-      "revision": "2272",
+      "revision": "2287",
       "revisionOverrides": {
         "mac14": "2251",
         "mac14-arm64": "2251",
diff --git a/pkgs/development/web/playwright/chromium-headless-shell.nix b/pkgs/development/web/playwright/chromium-headless-shell.nix
index c84c8593572c..bb7e2fabdfc1 100644
--- a/pkgs/development/web/playwright/chromium-headless-shell.nix
+++ b/pkgs/development/web/playwright/chromium-headless-shell.nix
@@ -36,8 +36,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-kQCw0nQHHuUIfn8rGVcN7Ip6ZOk5c3Or+GG5RvSica4=";
-          aarch64-linux = "sha256-s2IIjSY5t9AtT05dUS0mp4fPlaixND9+Cg0+0S8Kkx8=";
+          x86_64-linux = "sha256-Nr0/uczFTBTqvRPR0c/wflIqG5relgKfC9XsMOdE9iE=";
+          aarch64-linux = "sha256-veEBmsivFDrG1bArQ780+gMbsoT1Zv4VLcIPpgn4M/I=";
         }
         .${system} or throwSystem;
     };
@@ -72,8 +72,8 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        x86_64-darwin = "sha256-kzbLpzzMpBurQHyGaz561A0K46GzgWPP2JSQKRV6C+Y=";
-        aarch64-darwin = "sha256-67ekk37uq5ITq9ZvwPTZhhqEgQY17g/3KJ/vnqZz3h0=";
+        x86_64-darwin = "sha256-GEomMUuaIjhBEuWF/HyMohseJtwKOn5MCgh6kIB9ZeE=";
+        aarch64-darwin = "sha256-7laJtPAiy6pYAxCNBxRYk+FmriXemmLW8UYteEdVrd0=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/chromium.nix b/pkgs/development/web/playwright/chromium.nix
index d1fb44b11cac..9b39a8322050 100644
--- a/pkgs/development/web/playwright/chromium.nix
+++ b/pkgs/development/web/playwright/chromium.nix
@@ -63,8 +63,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-GtaJk9Qr1bTbDfpB+noGlLcIDEIS2uzDiV5rb2DZhVQ=";
-          aarch64-linux = "sha256-jsesQ6juzMPQzmn0Ygb8hmpxCeLHJVBL89qto5yuh5s=";
+          x86_64-linux = "sha256-TnplS4C/PPcmyWrMCqWh7c1KrpevHJFKO0gfh46M3tk=";
+          aarch64-linux = "sha256-E7Nmz9fET0kXNf7ooaUBDHtDBWTGq4JDKKUbo/UfA+c=";
         }
         .${system} or throwSystem;
     };
@@ -130,8 +130,8 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        x86_64-darwin = "sha256-CxnLSe+sZYskO7H5f3cA+BlWCZsFOPpp1gVG5s37r80=";
-        aarch64-darwin = "sha256-n3JLK+hJwzPihC2qSHrSCYPz3jonZNz7GMgXiPBLaS0=";
+        x86_64-darwin = "sha256-W6xH9iX81H+o689LZvJZO7tF79V0Gv7AksUwflPuQ8A=";
+        aarch64-darwin = "sha256-T0rVp4M/ymrJtNVtF0RDmIOT6kC3/tRkzPYrwvFbEQY=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/driver.nix b/pkgs/development/web/playwright/driver.nix
index 7c0444c5f31b..cbfb0167dfb8 100644
--- a/pkgs/development/web/playwright/driver.nix
+++ b/pkgs/development/web/playwright/driver.nix
@@ -19,64 +19,13 @@ let
   throwSystem = throw "Unsupported system: ${system}";
   browsersJSON = (lib.importJSON ./browsers.json).browsers;
 
-  version = "1.59.1";
+  version = "1.60.0";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "playwright";
     rev = "v${version}";
-    hash = "sha256-kiH1jDyt5xMWc5C2dytoDC9fi1b5tWXZG8S6KEpuotM=";
-  };
-
-  babel-bundle = buildNpmPackage {
-    pname = "babel-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright/bundles/babel";
-    npmDepsHash = "sha256-ByCy4go8PM0ksDg+2DcJPyoKG7Z0uIqKM647ZQwYwAE=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  expect-bundle = buildNpmPackage {
-    pname = "expect-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright/bundles/expect";
-    npmDepsHash = "sha256-PbPCsMqRkfU2c/mCsLSagew84XTgeO6H5+isNZQl2ek=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  utils-bundle = buildNpmPackage {
-    pname = "utils-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright/bundles/utils";
-    npmDepsHash = "sha256-BTaF1atpK+kG++ZJBUK4r3A7mbN2vv3xpDmb1NiNngE=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  utils-bundle-core = buildNpmPackage {
-    pname = "utils-bundle-core";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright-core/bundles/utils";
-    npmDepsHash = "sha256-O8X80rTT10ht97towSocANnGwH4fH1f3nZMSl8TOc+Y=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  zip-bundle = buildNpmPackage {
-    pname = "zip-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright-core/bundles/zip";
-    npmDepsHash = "sha256-5BHgCelIPh8ljIcdrO4AHafjqfLowDwJcpN+mD13Syw=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
+    hash = "sha256-jtQHyphdZsS8hf7uhe9zrx16Uf+kgLLha6dTCsCTT/8=";
   };
 
   playwright = buildNpmPackage {
@@ -84,7 +33,7 @@ let
     inherit version src;
 
     sourceRoot = "${src.name}"; # update.sh depends on sourceRoot presence
-    npmDepsHash = "sha256-H3kKFthmZH4fqFPQA34w7iw2rubpEKLlJ9jaW6mpuyo=";
+    npmDepsHash = "sha256-K1bCDURaq2+kaqGQcOL1tD6tQt/37pyDFWq2njUVNS4=";
 
     nativeBuildInputs = [
       cacert
@@ -95,22 +44,10 @@ let
 
     postPatch = ''
       sed -i '/\/\/ Update test runner./,/^\s*$/{d}' utils/build/build.js
-      sed -i '/^\/\/ Update bundles\./,/^[[:space:]]*}$/d' utils/build/build.js
-      sed -i '/execSync/d' ./utils/generate_third_party_notice.js
       # The dlopen library check uses ldconfig which doesn't work under Nix.
       # These libraries are already provided via rpath by autoPatchelfHook and wrapProgram.
       substituteInPlace packages/playwright-core/src/server/registry/index.ts \
         --replace-fail "['libGLESv2.so.2', 'libx264.so']" "[]"
-      chmod +w packages/playwright/bundles/babel
-      ln -s ${babel-bundle}/node_modules packages/playwright/bundles/babel/node_modules
-      chmod +w packages/playwright/bundles/expect
-      ln -s ${expect-bundle}/node_modules packages/playwright/bundles/expect/node_modules
-      chmod +w packages/playwright/bundles/utils
-      ln -s ${utils-bundle}/node_modules packages/playwright/bundles/utils/node_modules
-      chmod +w packages/playwright-core/bundles/utils
-      ln -s ${utils-bundle-core}/node_modules packages/playwright-core/bundles/utils/node_modules
-      chmod +w packages/playwright-core/bundles/zip
-      ln -s ${zip-bundle}/node_modules packages/playwright-core/bundles/zip/node_modules
     '';
 
     installPhase = ''
diff --git a/pkgs/development/web/playwright/firefox.nix b/pkgs/development/web/playwright/firefox.nix
index 4f2ad3f89e19..96d64ba3d088 100644
--- a/pkgs/development/web/playwright/firefox.nix
+++ b/pkgs/development/web/playwright/firefox.nix
@@ -19,8 +19,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-kfXBssU8pJbBqEUQkgpUFXaskx95OyQEYXDhe6cteR8=";
-          aarch64-linux = "sha256-OMPpE0VUgZ65cPOZ7f3sfQMaI++lp6B/RBmhH0E7Y9k=";
+          x86_64-linux = "sha256-DXUCNHLzN8rdq/I7JRAHbSPtgK8pJy3sKNEx4xsbd0E=";
+          aarch64-linux = "sha256-Kl7Z9mE+1Vy6VEnnl0DOZY/jtYjhUTwjqfFe9UZu2UA=";
         }
         .${system} or throwSystem;
     };
@@ -42,8 +42,8 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        x86_64-darwin = "sha256-OfNmamn82tJ8+eY6DC8a3AynmhObZ8E0GTegF8l7km4=";
-        aarch64-darwin = "sha256-WEYhmqGhGvO47i/OICJgXyqj64Wt52juJDEe7nD7HXU=";
+        x86_64-darwin = "sha256-eXS88URYKAbFP6/3pukb2qgrdqVBOR99VGyqKPFZ2Tw=";
+        aarch64-darwin = "sha256-lVNFp20v+zBC3Up9ElhWh8C8ptEUqCHEsfQiuPp3lVM=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/webkit.nix b/pkgs/development/web/playwright/webkit.nix
index 250c815a24b0..3a4d54605349 100644
--- a/pkgs/development/web/playwright/webkit.nix
+++ b/pkgs/development/web/playwright/webkit.nix
@@ -23,6 +23,7 @@
   icu74,
   lcms,
   libavif,
+  libbacktrace,
   libdrm,
   libepoxy,
   libevent,
@@ -120,8 +121,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-BVIZxnnfhBvI737ojRZ+yUX8mcbQ6WOlNdYJ9t4R5yY=";
-          aarch64-linux = "sha256-t9kqUdyOgDXroKp7LWQsaiaRGZVZN3ZdfYLahl5GW2E=";
+          x86_64-linux = "sha256-hefWMElsTGTkPvSnovwR8P0kunnPLUGDR5Hvoa31SMM=";
+          aarch64-linux = "sha256-4leXyoebeqWPHxO9D2MomnVqza/9IEcJEuiRCf3/eUc=";
         }
         .${system} or throwSystem;
     };
@@ -149,6 +150,7 @@ let
       icu74
       lcms
       libavif
+      libbacktrace
       libdrm
       libepoxy
       libevent
@@ -193,8 +195,8 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        x86_64-darwin = "sha256-NjuRZrYzraE1FrPAmyMcQFAS2zWZXYe8cBQVbSU6zFw=";
-        aarch64-darwin = "sha256-9g7YHg+TQNmAE07K6jKSSRUJ7IENUQMp2q54Mk2BbaY=";
+        x86_64-darwin = "sha256-D9iZitRG3lPWQ/Zu/HAjx2gEehr/xr0d+j2jo7yjnoQ=";
+        aarch64-darwin = "sha256-383PHqwW+QoXL4qxXEE3ytbQVQ4rg2YDK+B+XvIfBmY=";
       }
       .${system} or throwSystem;
   };

From 26e668a09ab3bb0ca6d2a6e70afac733ccf49c20 Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Sat, 23 May 2026 19:56:11 +0200
Subject: [PATCH 03/69] ivpn-service: support quantum resistance

---
 pkgs/by-name/iv/ivpn-service/package.nix | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/iv/ivpn-service/package.nix b/pkgs/by-name/iv/ivpn-service/package.nix
index e62ed995af50..2a012785f548 100644
--- a/pkgs/by-name/iv/ivpn-service/package.nix
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@@ -13,13 +13,17 @@
   iptables,
   gawk,
   util-linux,
+  liboqs,
   nix-update-script,
 }:
 buildGoModule (finalAttrs: {
   pname = "ivpn-service";
   version = "3.15.6";
 
-  buildInputs = [ wirelesstools ];
+  buildInputs = [
+    wirelesstools
+    liboqs
+  ];
   nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
@@ -62,7 +66,9 @@ buildGoModule (finalAttrs: {
       --replace-fail 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \
       'dnscryptproxyBinPath = "${dnscrypt-proxy}/bin/dnscrypt-proxy"' \
       --replace-fail 'v2rayBinaryPath = path.Join(installDir, "v2ray/v2ray")' \
-      'v2rayBinaryPath = "${v2ray}/bin/v2ray"'
+      'v2rayBinaryPath = "${v2ray}/bin/v2ray"' \
+      --replace-fail 'kemHelperBinaryPath = path.Join(installDir, "kem/kem-helper")' \
+      'kemHelperBinaryPath = "${placeholder "out"}/bin/kem-helper"'
   '';
 
   ldflags = [
@@ -72,8 +78,17 @@ buildGoModule (finalAttrs: {
     "-X github.com/ivpn/desktop-app/daemon/version._time=1970-01-01"
   ];
 
+  postBuild = ''
+    $CC -O2 -pthread \
+        References/common/kem-helper/main.c \
+        References/common/kem-helper/base64.c \
+        -loqs -Wl,-z,stack-size=5242880 \
+        -o kem-helper
+  '';
+
   postInstall = ''
     mv $out/bin/{daemon,ivpn-service}
+    install -Dm755 kem-helper $out/bin/kem-helper
   '';
 
   postFixup = ''

From d633cae73b72cf70737f5f78db3e755dbd83f884 Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Sat, 23 May 2026 23:45:19 +0200
Subject: [PATCH 04/69] ivpn-service: drop redundant update script

---
 pkgs/by-name/iv/ivpn-service/package.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/by-name/iv/ivpn-service/package.nix b/pkgs/by-name/iv/ivpn-service/package.nix
index 2a012785f548..5756d53a9da3 100644
--- a/pkgs/by-name/iv/ivpn-service/package.nix
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@@ -14,7 +14,6 @@
   gawk,
   util-linux,
   liboqs,
-  nix-update-script,
 }:
 buildGoModule (finalAttrs: {
   pname = "ivpn-service";
@@ -109,8 +108,6 @@ buildGoModule (finalAttrs: {
       }
   '';
 
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     description = "Official IVPN Desktop app service daemon";
     homepage = "https://www.ivpn.net/apps";

From a557cbe75fd6b8ef6689c7ae51adaa53fed86fec Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Sat, 23 May 2026 23:44:56 +0200
Subject: [PATCH 05/69] ivpn-service: vendor liboqs 0.10.0

---
 pkgs/by-name/iv/ivpn-service/package.nix | 31 +++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/iv/ivpn-service/package.nix b/pkgs/by-name/iv/ivpn-service/package.nix
index 5756d53a9da3..f318607f304c 100644
--- a/pkgs/by-name/iv/ivpn-service/package.nix
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
 
   buildInputs = [
     wirelesstools
-    liboqs
+    (finalAttrs.passthru.liboqs)
   ];
   nativeBuildInputs = [ makeWrapper ];
 
@@ -108,6 +108,35 @@ buildGoModule (finalAttrs: {
       }
   '';
 
+  # IVPN pins this to an older incompatible version, so we vendor it at that
+  # Lives in passthru so end-users can override it
+  passthru.liboqs = liboqs.overrideAttrs (
+    final: prev: {
+      version = "0.10.0";
+      src = fetchFromGitHub {
+        owner = "open-quantum-safe";
+        repo = "liboqs";
+        tag = "${final.version}";
+        hash = "sha256-BFDa5NUr02lFPcT4Hnb2rjGAi+2cXvh1SHLfqX/zLlI=";
+      };
+      # the main derivations patches don't apply onto the older version
+      patches = [ ];
+      # manually do what the main derivations pkg-config patch does (unbreak invalid path)
+      postPatch = ''
+        substituteInPlace src/liboqs.pc.in \
+          --replace-fail 'libdir=''${prefix}/@CMAKE_INSTALL_LIBDIR@' \
+          'libdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+          --replace-fail 'includedir=''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@' \
+          'includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@'
+      '';
+      # This matches IVPNs build script at $src/daemon/References/common/kem-helper/build.sh
+      cmakeFlags = (prev.cmakeFlags or [ ]) ++ [
+        "-DOQS_USE_OPENSSL=OFF"
+        "-DOQS_MINIMAL_BUILD=KEM_kyber_1024;KEM_classic_mceliece_348864"
+      ];
+    }
+  );
+
   meta = {
     description = "Official IVPN Desktop app service daemon";
     homepage = "https://www.ivpn.net/apps";

From 068be8967670418fa129b0c48453653122a8bf99 Mon Sep 17 00:00:00 2001
From: bandithedoge <bandithedoge@protonmail.com>
Date: Sun, 24 May 2026 00:35:19 +0200
Subject: [PATCH 06/69] decent-sampler: use autoPatchelfHook

Allows the plugin to be loaded in hosts that don't provide alsa and
expat in their RPATH
---
 pkgs/by-name/de/decent-sampler/package.nix | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/de/decent-sampler/package.nix b/pkgs/by-name/de/decent-sampler/package.nix
index 7ebace9899e1..7026c890da24 100644
--- a/pkgs/by-name/de/decent-sampler/package.nix
+++ b/pkgs/by-name/de/decent-sampler/package.nix
@@ -4,6 +4,7 @@
   fetchzip,
   fetchurl,
   makeDesktopItem,
+  autoPatchelfHook,
   copyDesktopItems,
   buildFHSEnv,
   alsa-lib,
@@ -32,7 +33,15 @@ let
       hash = "sha256-wL9L4I2iw9r3r69TOr37XXEs3iECMuNGX9Ez63P/f8w=";
     };
 
-    nativeBuildInputs = [ copyDesktopItems ];
+    nativeBuildInputs = [
+      autoPatchelfHook
+      copyDesktopItems
+    ];
+
+    buildInputs = [
+      alsa-lib
+      expat
+    ];
 
     desktopItems = [
       (makeDesktopItem {
@@ -67,13 +76,11 @@ buildFHSEnv {
   inherit (decent-sampler) pname version;
 
   targetPkgs = pkgs: [
-    alsa-lib
     alsa-plugins
     decent-sampler
     freetype
     nghttp2
     libx11
-    expat
   ];
 
   runScript = "decent-sampler";

From 70b397a734f4c6ff740615a860acb39bb15571f4 Mon Sep 17 00:00:00 2001
From: SkohTV <contact@skoh.dev>
Date: Mon, 25 May 2026 10:47:40 -0400
Subject: [PATCH 07/69] python3Packages.veryprettytable: migrate to pyproject

---
 .../development/python-modules/veryprettytable/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/veryprettytable/default.nix b/pkgs/development/python-modules/veryprettytable/default.nix
index 596bb2b30a35..c27262969824 100644
--- a/pkgs/development/python-modules/veryprettytable/default.nix
+++ b/pkgs/development/python-modules/veryprettytable/default.nix
@@ -4,19 +4,22 @@
   fetchPypi,
   termcolor,
   colorama,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "veryprettytable";
   version = "0.8.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "1k1rifz8x6qcicmx2is9vgxcj0qb2f5pvzrp7zhmvbmci3yack3f";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     termcolor
     colorama
   ];

From c3e3ac4553fe5f07981659b1de7f11c9f968bde1 Mon Sep 17 00:00:00 2001
From: SkohTV <contact@skoh.dev>
Date: Mon, 25 May 2026 10:49:15 -0400
Subject: [PATCH 08/69] python3Packages.veryprettytable: modernize

---
 .../python-modules/veryprettytable/default.nix            | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/veryprettytable/default.nix b/pkgs/development/python-modules/veryprettytable/default.nix
index c27262969824..194f41e432cd 100644
--- a/pkgs/development/python-modules/veryprettytable/default.nix
+++ b/pkgs/development/python-modules/veryprettytable/default.nix
@@ -7,14 +7,14 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "veryprettytable";
   version = "0.8.1";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "1k1rifz8x6qcicmx2is9vgxcj0qb2f5pvzrp7zhmvbmci3yack3f";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-bkym/Iisrl3hPzf/fYsTCwPJ+ttJR9Eriwybjr6LOcw=";
   };
 
   build-system = [ setuptools ];
@@ -29,4 +29,4 @@ buildPythonPackage rec {
     homepage = "https://github.com/smeggingsmegger/VeryPrettyTable";
     license = lib.licenses.free;
   };
-}
+})

From 0bfaeeec170446a2d93f0d833c08a3baf31c798c Mon Sep 17 00:00:00 2001
From: SkohTV <contact@skoh.dev>
Date: Mon, 25 May 2026 11:18:37 -0400
Subject: [PATCH 09/69] python3Packages.veryprettytable: add pythonImportsCheck

---
 pkgs/development/python-modules/veryprettytable/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/veryprettytable/default.nix b/pkgs/development/python-modules/veryprettytable/default.nix
index 194f41e432cd..ddfcf2ea545d 100644
--- a/pkgs/development/python-modules/veryprettytable/default.nix
+++ b/pkgs/development/python-modules/veryprettytable/default.nix
@@ -24,6 +24,8 @@ buildPythonPackage (finalAttrs: {
     colorama
   ];
 
+  pythonImportsCheck = [ "veryprettytable" ];
+
   meta = {
     description = "Simple Python library for easily displaying tabular data in a visually appealing ASCII table format";
     homepage = "https://github.com/smeggingsmegger/VeryPrettyTable";

From 116c3a4a700fa3eee0726048c3a0d85e81e7202d Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sat, 9 May 2026 18:20:24 +0200
Subject: [PATCH 10/69] chromium-xorg-conf: drop

Only used by the `cmt` NixOS module (`services.xserver.cmt`), which was
removed [1].

[1] https://github.com/NixOS/nixpkgs/pull/518434
---
 pkgs/by-name/ch/chromium-xorg-conf/package.nix | 8 --------
 pkgs/top-level/aliases.nix                     | 1 +
 2 files changed, 1 insertion(+), 8 deletions(-)
 delete mode 100644 pkgs/by-name/ch/chromium-xorg-conf/package.nix

diff --git a/pkgs/by-name/ch/chromium-xorg-conf/package.nix b/pkgs/by-name/ch/chromium-xorg-conf/package.nix
deleted file mode 100644
index d9608650ed9d..000000000000
--- a/pkgs/by-name/ch/chromium-xorg-conf/package.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ fetchFromGitiles }:
-
-fetchFromGitiles {
-  name = "chromium-xorg-conf";
-  url = "https://chromium.googlesource.com/chromiumos/platform/xorg-conf";
-  rev = "26fb9d57e195c7e467616b35b17e2b5d279c1514";
-  sha256 = "0643y3l3hjk4mv4lm3h9z56h990q6k11hcr10lcqppgsii0d3zcf";
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c498269dad82..555570dbd7da 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -471,6 +471,7 @@ mapAliases {
   ChowPhaser = throw "'ChowPhaser' has been renamed to/replaced by 'chow-phaser'"; # Converted to throw 2025-10-27
   CHOWTapeModel = throw "'CHOWTapeModel' has been renamed to/replaced by 'chow-tape-model'"; # Converted to throw 2025-10-27
   chrome-gnome-shell = throw "'chrome-gnome-shell' has been renamed to/replaced by 'gnome-browser-connector'"; # Converted to throw 2025-10-27
+  chromium-xorg-conf = throw "'chromium-xorg-conf' has been removed as it was only used by the 'cmt' NixOS module, which was removed"; # Added 2026-05-25
   ci-edit = throw "'ci-edit' has been removed due to lack of maintenance upstream"; # Added 2025-08-26
   cinnamon-common = cinnamon; # Added 2025-08-06
   cisco-packet-tracer_8 = throw "'cisco-packet-tracer_8' has been removed as it vendored qt5 webengine. Consider updating to 'cisco-packet-tracer_9' instead."; # Added 2026-04-26

From f4e695b936c017ee63ac0e27d6c9d9bbbdb5b126 Mon Sep 17 00:00:00 2001
From: haansn08 <stefan@kikeriki.at>
Date: Wed, 27 May 2026 17:15:32 +0200
Subject: [PATCH 11/69] python314Packages.slixmpp: 1.13.2 -> 1.15.0

https://codeberg.org/poezio/slixmpp/releases/tag/slix-1.15.0
---
 pkgs/development/python-modules/slixmpp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/slixmpp/default.nix b/pkgs/development/python-modules/slixmpp/default.nix
index f27793fb8349..2320d51cce71 100644
--- a/pkgs/development/python-modules/slixmpp/default.nix
+++ b/pkgs/development/python-modules/slixmpp/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "slixmpp";
-  version = "1.13.2";
+  version = "1.15.0";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "poezio";
     repo = "slixmpp";
     tag = "slix-${version}";
-    hash = "sha256-hjM1OIFYpHV5SSN32858pyuwOvaAA0tFZWCZI+5n9u4=";
+    hash = "sha256-1Jns7kqYGpUvwfwyMoZ9ygD2Sm148f/QdJ0atvfwGTo=";
   };
 
   patches = [

From 3ed300907a6b5ccd3d963cea89d98c4fd4317025 Mon Sep 17 00:00:00 2001
From: haansn08 <stefan@kikeriki.at>
Date: Wed, 27 May 2026 17:17:00 +0200
Subject: [PATCH 12/69] poezio: 0.16 -> 0.18

---
 pkgs/by-name/po/poezio/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/po/poezio/package.nix b/pkgs/by-name/po/poezio/package.nix
index 78a64d62ee49..834cd4ea8701 100644
--- a/pkgs/by-name/po/poezio/package.nix
+++ b/pkgs/by-name/po/poezio/package.nix
@@ -8,14 +8,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "poezio";
-  version = "0.16";
+  version = "0.18";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "poezio";
     repo = "poezio";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-bpudgf9oZ+7w7izAuWYKFVO9CIHraHaGvRKLDuSIF7c=";
+    hash = "sha256-/QGxJrWK8Sl+t8SBsU8ZAMU/5pR+daf7Q43jczzENmw=";
   };
 
   nativeBuildInputs = [ pkg-config ];

From 7c69005b703555af1e42535b350c40f7c9d7daea Mon Sep 17 00:00:00 2001
From: Ingo Reitz <9l@9lo.re>
Date: Wed, 20 May 2026 04:13:13 +0200
Subject: [PATCH 13/69] ethercat: add myself as maintainer, fix license(s)

---
 pkgs/by-name/et/ethercat/package.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/et/ethercat/package.nix b/pkgs/by-name/et/ethercat/package.nix
index b0734d3a7745..cb7a1167e6ba 100644
--- a/pkgs/by-name/et/ethercat/package.nix
+++ b/pkgs/by-name/et/ethercat/package.nix
@@ -35,8 +35,14 @@ stdenv.mkDerivation (finalAttrs: {
     description = "IgH EtherCAT Master for Linux";
     homepage = "https://etherlab.org/ethercat";
     changelog = "https://gitlab.com/etherlab.org/ethercat/-/blob/${finalAttrs.version}/NEWS";
-    license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ stv0g ];
+    license = with lib.licenses; [
+      gpl2Only
+      lgpl21Only
+    ];
+    maintainers = with lib.maintainers; [
+      ninelore
+      stv0g
+    ];
     platforms = [ "x86_64-linux" ];
   };
 })

From af49b2a0b0134dce99c92d28b9b76bbe04ec0c86 Mon Sep 17 00:00:00 2001
From: Ingo Reitz <9l@9lo.re>
Date: Wed, 20 May 2026 04:20:34 +0200
Subject: [PATCH 14/69] ethercat: add kernel module

---
 pkgs/by-name/et/ethercat/kernel-module.nix | 70 ++++++++++++++++++++++
 pkgs/by-name/et/ethercat/package.nix       |  5 +-
 pkgs/top-level/linux-kernels.nix           |  2 +
 3 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/et/ethercat/kernel-module.nix

diff --git a/pkgs/by-name/et/ethercat/kernel-module.nix b/pkgs/by-name/et/ethercat/kernel-module.nix
new file mode 100644
index 000000000000..8586e273ae02
--- /dev/null
+++ b/pkgs/by-name/et/ethercat/kernel-module.nix
@@ -0,0 +1,70 @@
+ethercat:
+{
+  lib,
+  stdenv,
+  kernelModuleMakeFlags,
+  kernel,
+}:
+let
+  # Aside from a generic drivers there are special drivers for specific NICs
+  # (for example r8139, r8169, e100, e1000, e1000e) which are only available
+  # for these kernel versions
+  extraSupportedKernel = lib.elem (lib.versions.majorMinor kernel.version) [
+    "5.10"
+    "5.14"
+    "5.15"
+    "6.1"
+    "6.4"
+    "6.12"
+  ];
+in
+stdenv.mkDerivation {
+  pname = "ethercat";
+  version = "${kernel.version}-${ethercat.version}";
+
+  __structuredAttrs = true;
+
+  enableParallelBuilding = true;
+
+  inherit (ethercat) src;
+
+  nativeBuildInputs = kernel.moduleBuildDependencies ++ ethercat.nativeBuildInputs;
+
+  configureFlags = [
+    "--with-linux-dir=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "--enable-userlib=no"
+    "--enable-tool=no"
+    "--enable-kernel=yes"
+    "--enable-ccat=yes"
+  ]
+  ++ lib.optionals extraSupportedKernel [
+    "--enable-e100=yes"
+    "--enable-e1000=yes"
+    "--enable-e1000e=yes"
+    "--enable-r8169=yes"
+    "--enable-igb=yes"
+  ]
+  ++ lib.optionals (extraSupportedKernel && lib.versionAtLeast kernel.version "5.14") [
+    "--enable-igc=yes"
+  ];
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  buildFlags = [ "modules" ];
+
+  installTargets = [ "modules_install" ];
+
+  meta = {
+    description = ethercat.meta.description + " - kernel modules";
+
+    inherit (ethercat.meta)
+      homepage
+      changelog
+      license
+      maintainers
+      platforms
+      ;
+  };
+}
diff --git a/pkgs/by-name/et/ethercat/package.nix b/pkgs/by-name/et/ethercat/package.nix
index cb7a1167e6ba..b87dc7c2224e 100644
--- a/pkgs/by-name/et/ethercat/package.nix
+++ b/pkgs/by-name/et/ethercat/package.nix
@@ -29,7 +29,10 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-kernel=no"
   ];
 
-  passthru.updateScript = gitUpdater { };
+  passthru = {
+    kernelModule = import ./kernel-module.nix finalAttrs.finalPackage;
+    updateScript = gitUpdater { };
+  };
 
   meta = {
     description = "IgH EtherCAT Master for Linux";
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index fe8ebd43504f..20c211fad60a 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -332,6 +332,8 @@ in
           inherit kernel;
         };
 
+        ethercat = callPackage pkgs.ethercat.kernelModule { };
+
         evdi = callPackage ../os-specific/linux/evdi { };
 
         fanout = callPackage ../os-specific/linux/fanout { };

From 64e9c87fd740c86ad403400c4abeef794a56dc47 Mon Sep 17 00:00:00 2001
From: Fabian Beu <5528922-Darks1de@users.noreply.gitlab.com>
Date: Wed, 27 May 2026 22:34:39 +0200
Subject: [PATCH 15/69] python3Packages.githubkit: mark as broken

uses an old library(hishel) with a removed function not available in the
version on nixpkgs
---
 pkgs/development/python-modules/githubkit/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/githubkit/default.nix b/pkgs/development/python-modules/githubkit/default.nix
index 6d205f922b7e..e8b3e5f7fe7e 100644
--- a/pkgs/development/python-modules/githubkit/default.nix
+++ b/pkgs/development/python-modules/githubkit/default.nix
@@ -71,6 +71,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
+    broken = true;
     description = "GitHub SDK for Python";
     homepage = "https://github.com/yanyongyu/githubkit";
     changelog = "https://github.com/yanyongyu/githubkit/releases/tag/${src.tag}";

From f41804ec3c3cfcff202c613f83aaf341f578b752 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 28 May 2026 20:36:36 +0200
Subject: [PATCH 16/69] python3Packages.slixmpp: migrate to finalAttrs

---
 pkgs/development/python-modules/slixmpp/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/slixmpp/default.nix b/pkgs/development/python-modules/slixmpp/default.nix
index 2320d51cce71..c87c0b7a78ec 100644
--- a/pkgs/development/python-modules/slixmpp/default.nix
+++ b/pkgs/development/python-modules/slixmpp/default.nix
@@ -20,7 +20,7 @@
   setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "slixmpp";
   version = "1.15.0";
   pyproject = true;
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   src = fetchFromCodeberg {
     owner = "poezio";
     repo = "slixmpp";
-    tag = "slix-${version}";
+    tag = "slix-${finalAttrs.version}";
     hash = "sha256-1Jns7kqYGpUvwfwyMoZ9ygD2Sm148f/QdJ0atvfwGTo=";
   };
 
@@ -90,8 +90,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python library for XMPP";
     homepage = "https://slixmpp.readthedocs.io/";
-    changelog = "https://codeberg.org/poezio/slixmpp/releases/tag/${src.tag}";
+    changelog = "https://codeberg.org/poezio/slixmpp/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From cb2fdc48abda3db51da396e98aaccfe2ebc093da Mon Sep 17 00:00:00 2001
From: Christian Flach <cmfcmf.flach@gmail.com>
Date: Sat, 30 May 2026 11:26:49 +0200
Subject: [PATCH 17/69] nixos/opensnitch: Set connection timeout of 3s for
 faster tests

The default connection timeout of curl appears to be much higher -
running these tests without specifying a connection timeout took around
10 minutes. With the timeout applied, the tests run within a few
seconds.

Note that I am not very familiar with these tests or NixOS tests in
general, but this seemed like a sensible change to me.
---
 nixos/tests/opensnitch.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/opensnitch.nix b/nixos/tests/opensnitch.nix
index 0e97717f45bd..31654fd8b77f 100644
--- a/nixos/tests/opensnitch.nix
+++ b/nixos/tests/opensnitch.nix
@@ -75,10 +75,10 @@ in
     lib.concatLines (
       map (m: ''
         client_blocked_${m}.wait_for_unit("opensnitchd.service")
-        client_blocked_${m}.fail("curl http://server")
+        client_blocked_${m}.fail("curl --connect-timeout 3 http://server")
 
         client_allowed_${m}.wait_for_unit("opensnitchd.service")
-        client_allowed_${m}.succeed("curl http://server")
+        client_allowed_${m}.succeed("curl --connect-timeout 3 http://server")
       '') monitorMethods
     )
     + ''

From e8b518e6b644aed8bfcf9d142c8a946d49d27b31 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sat, 30 May 2026 13:33:33 +0200
Subject: [PATCH 18/69] dusklight: 1.2.0 -> 1.3.1

---
 pkgs/by-name/du/dusklight/package.nix | 53 +++++++++++++++------------
 1 file changed, 29 insertions(+), 24 deletions(-)

diff --git a/pkgs/by-name/du/dusklight/package.nix b/pkgs/by-name/du/dusklight/package.nix
index 2b5da6952115..f078fcfce3b2 100644
--- a/pkgs/by-name/du/dusklight/package.nix
+++ b/pkgs/by-name/du/dusklight/package.nix
@@ -26,6 +26,7 @@
   makeWrapper,
   ninja,
   nlohmann_json,
+  nodtool,
   pkg-config,
   python3,
   sdl3,
@@ -40,19 +41,25 @@ let
   auroraSrc = fetchFromGitHub {
     owner = "encounter";
     repo = "aurora";
-    rev = "10006618ee493f248b8597e4dfa1d2871d76a1d9";
-    hash = "sha256-lY2xuVyB7aPJ9+2wwLRB3F5U/BuPSxdSpegdG+qNd9o=";
-  };
-  dawnSrc = fetchzip {
-    url = "https://github.com/encounter/dawn-build/releases/download/v20260423.175430/dawn-linux-x86_64.tar.gz";
-    hash = "sha256-HXfKTLHtMPwupnFnaflCARtXVPuS/0PoCePXidjE5xs=";
-    stripRoot = false;
-  };
-  nodSrc = fetchzip {
-    url = "https://github.com/encounter/nod/releases/download/v2.0.0-alpha.8/libnod-linux-x86_64.tar.gz";
-    hash = "sha256-mUqvLsbsqaZ+HAjMmHYPYO+MgtanGRTw7Gzn5uXR5rE=";
-    stripRoot = false;
+    rev = "cb2c340d6cde6827387f14c31ce19e5f28a40e09";
+    hash = "sha256-fiAe5DChCFeakI3pga/g0tXd27osnhQtMBQchuP2NwQ=";
   };
+  dawnSrc = fetchzip (
+    {
+      x86_64-linux = {
+        url = "https://github.com/encounter/dawn-build/releases/download/v20260523.201736/dawn-linux-x86_64.tar.gz";
+        hash = "sha256-KkdlSeiaw2gbQa+phZOpgbequshxQaFITzFdiuGBZvc=";
+      };
+      aarch64-linux = {
+        url = "https://github.com/encounter/dawn-build/releases/download/v20260523.201736/dawn-linux-aarch64.tar.gz";
+        hash = "sha256-accDTIBzgByQ8Rk2a1dAm85s8hj9SYI7NoHkih0vvAg=";
+      };
+    }
+    .${stdenv.hostPlatform.system}
+    // {
+      stripRoot = false;
+    }
+  );
   imguiSrc = fetchFromGitHub {
     owner = "ocornut";
     repo = "imgui";
@@ -70,13 +77,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dusklight";
-  version = "1.2.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "TwilitRealm";
     repo = "dusklight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a5nCri4XTpnotJY9qRrKTJ8cb9L6cfGKPXmvbbj/1fQ=";
+    hash = "sha256-TarPuCE6bjn4nGtHU54pE2gAo/dIgTyghWn7hjdFFgk=";
   };
 
   strictDeps = true;
@@ -111,6 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxscrnsaver
     libxtst
     nlohmann_json
+    nodtool
     sdl3
     tracy
     vulkan-loader
@@ -138,14 +146,14 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_XXHASH" xxhash.src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FMT" fmt.src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_TRACY" tracy.src.outPath)
-    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_NOD_PREBUILT" nodSrc.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FREETYPE" freetype.src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_ZSTD" zstd.src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_SQLITE3" sqliteSrc.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_IMGUI" imguiSrc.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_RMLUI" rmluiSrc.outPath)
     (lib.cmakeFeature "AURORA_SDL3_PROVIDER" "system")
-    (lib.cmakeFeature "AURORA_NOD_PROVIDER" "package")
+    (lib.cmakeFeature "AURORA_NOD_PROVIDER" "system")
+    (lib.cmakeFeature "AURORA_NOD_LINKAGE" "static")
     (lib.cmakeBool "CMAKE_CROSSCOMPILING" true)
     (lib.cmakeBool "DUSK_ENABLE_SENTRY_NATIVE" false)
   ];
@@ -159,16 +167,13 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ../share/dusklight/dusklight   $out/bin/dusklight
 
     install -Dm644 \
-      ../platforms/freedesktop/dusklight.desktop \
-      $out/share/applications/dusklight.desktop
-
-    substituteInPlace $out/share/applications/dusklight.desktop \
-      --replace-fail "Icon=dusklight" "Icon=dev.twilitrealm.dusklight"
+      ../platforms/freedesktop/dev.twilitrealm.dusk.desktop \
+      $out/share/applications/dev.twilitrealm.dusk.desktop
 
     for size in 16x16 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024; do
       install -Dm644 \
-        ../platforms/freedesktop/$size/apps/dusklight.png \
-        $out/share/icons/hicolor/$size/apps/dev.twilitrealm.dusklight.png
+        ../platforms/freedesktop/$size/apps/dev.twilitrealm.dusk.png \
+        $out/share/icons/hicolor/$size/apps/dev.twilitrealm.dusk.png
     done
 
     runHook postInstall
@@ -193,7 +198,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/TwilitRealm/dusklight/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.cc0;
     mainProgram = "dusklight";
-    platforms = [ "x86_64-linux" ];
+    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ liberodark ];
   };
 })

From e07ad9d0654d4bf887757160355abbd33b3b0d39 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Tue, 3 Feb 2026 15:24:14 +0100
Subject: [PATCH 19/69] linux: Build-in HFS+ support on POWER

To get an installer ISO recognised on some systems (Apple PowerMac G5 is what I'm working with), it must be made with
certain flags to xorriso that make the ISO9660 filesystem accessible as an HFS+ partition, to allow HFS+ blessing of the
boot files. Changes for that will be submitted at a later date.

When such an image is booted with the current kernel settings (DVD/USB, doesn't matter), GRUB works fine, but the kernel
gets stuck. There is no textual boot output on the machine at the point where it gets stuck, so I can't really debug. A
basic ISO9660 image (booted directly via firmware commands) goes all the way to the shell without issues, so the issue
is with the HFS+ partition format.

Building the HFS+ module into the kernel seems to fix this.

Some older machines are supposedly unable to read HFS+ and may instead need HFS. Such a disc setup might not be
producable with xorriso (haven't played around with that), and I don't have one of those machines to test anything on,
so I won't include HFS_FS for now.
---
 pkgs/os-specific/linux/kernel/common-config.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index d1734a2b32c5..4fa7506f842f 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -786,6 +786,10 @@ let
       DEVTMPFS = yes;
 
       UNICODE = yes; # Casefolding support for filesystems
+    }
+    // lib.optionalAttrs stdenv.hostPlatform.isPower {
+      # Needed to use the installation iso image formatted for tbxi booting (ISO9660 w/ hybrid HFS+ partition).
+      HFSPLUS_FS = yes;
     };
 
     security = {

From 48d00af90d7012116805d5f8e2756c79f7c5c917 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Sun, 8 Feb 2026 17:50:55 +0100
Subject: [PATCH 20/69] linux: Build-in IDE & MacIO support on POWER

The built-in graphical boot manager on PowerMacs usually doesn't acknowledge USBs. If one wants to boot an installer
without messing around in Open Firmware, then a disc must be used.

The disc drives in PowerMacs are connected via IDE, and will get stuck during early boot if IDE/ATA support is not
built into the kernel. The PATA_MACIO option is also needed to handle the particular controller used on Macs.
---
 pkgs/os-specific/linux/kernel/common-config.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 4fa7506f842f..b9fbf238c996 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1615,6 +1615,12 @@ let
         # > round to working out why.  The workaround is to build it in[…].
         # > (It won't do any harm on non-Mac systems.)
         I2C_POWERMAC = yes;
+      }
+      // lib.optionalAttrs stdenv.hostPlatform.isPower {
+        # Needed for booting PowerMacs from disc
+        # (the only nice way that doesn't involve messing around with internal drives or in Open Firmware)
+        ATA = yes;
+        PATA_MACIO = yes;
       };
 
     accel = {

From 2f6ab4f908247309d12322ddb56f9f9faa6e20b0 Mon Sep 17 00:00:00 2001
From: Willy Hille <willy.hille@intenta.de>
Date: Tue, 2 Jun 2026 16:32:31 +0200
Subject: [PATCH 21/69] python3Packages.molecule-plugins: 23.5.3 -> 25.8.12,
 fetch from github

fetchPypi fails for the new version, which smells like #501578
---
 pkgs/development/python-modules/molecule/plugins.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/molecule/plugins.nix b/pkgs/development/python-modules/molecule/plugins.nix
index ec41c0710069..6716c01a6091 100644
--- a/pkgs/development/python-modules/molecule/plugins.nix
+++ b/pkgs/development/python-modules/molecule/plugins.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools-scm,
   python-vagrant,
   docker,
@@ -9,12 +9,14 @@
 
 buildPythonPackage rec {
   pname = "molecule-plugins";
-  version = "23.5.3";
+  version = "25.8.12";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-orFDfVMtc24/vG23pp7FM+IzSyEV/5JFoLJ3LtlzjSM=";
+  src = fetchFromGitHub {
+    owner = "ansible-community";
+    repo = "molecule-plugins";
+    tag = "v${version}";
+    hash = "sha256-wTvJ+cjZMTOyaqqDZsA1wsKCpu2FEi69IBlSTxNs3/M=";
   };
 
   # reverse the dependency

From e916f6aac90fb5061aa68736657a1a1b15e49905 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 2 Jun 2026 21:14:45 +0000
Subject: [PATCH 22/69] autobrr: 1.79.0 -> 1.80.0

---
 pkgs/by-name/au/autobrr/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/au/autobrr/package.nix b/pkgs/by-name/au/autobrr/package.nix
index da4840c2c606..9881bb6ee8bf 100644
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@@ -16,12 +16,12 @@
 
 let
   pname = "autobrr";
-  version = "1.79.0";
+  version = "1.80.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "autobrr";
     tag = "v${version}";
-    hash = "sha256-grwXIDN+dYuWaArB76N3xJEVwYlrzopYZJQ+eXRwOY4=";
+    hash = "sha256-LWnax0/BNPDZeaH+KG1Fi8qrAvHhr1Oo8XNQWkO5pvM=";
   };
 
   autobrr-web = stdenvNoCC.mkDerivation {

From f0d605d58830dc9f2887580c007e9a00453f3cfe Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 18:17:08 +0200
Subject: [PATCH 23/69] nixos/tests/opensnitch: adopt

---
 nixos/tests/opensnitch.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/opensnitch.nix b/nixos/tests/opensnitch.nix
index cde4ae6efc17..2694e0f9b641 100644
--- a/nixos/tests/opensnitch.nix
+++ b/nixos/tests/opensnitch.nix
@@ -11,7 +11,10 @@ in
   name = "opensnitch";
 
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ onny ];
+    maintainers = [
+      onny
+      grimmauld
+    ];
   };
 
   nodes = {

From 26c9cea779e28bebb5bb624d16fc79168aa6cfd7 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 18:44:02 +0200
Subject: [PATCH 24/69] nixos/tests/opensnitch: skip broken ebpf test on
 aarch64

---
 nixos/tests/opensnitch.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/nixos/tests/opensnitch.nix b/nixos/tests/opensnitch.nix
index 2694e0f9b641..d2af561c36f4 100644
--- a/nixos/tests/opensnitch.nix
+++ b/nixos/tests/opensnitch.nix
@@ -1,11 +1,14 @@
 { pkgs, lib, ... }:
 let
+  # opensnitch ebpf seems to handle non-x86 syscalls incorrectly
+  test_ebpf = pkgs.stdenv.hostPlatform.isx86;
+
   monitorMethods = [
-    "ebpf"
     "proc"
     "ftrace"
     "audit"
-  ];
+  ]
+  ++ lib.optional test_ebpf "ebpf";
 in
 {
   name = "opensnitch";
@@ -97,7 +100,7 @@ in
         client_allowed_${m}.succeed("curl http://server")
       '') monitorMethods
     )
-    + ''
+    + lib.optionalString test_ebpf ''
       # make sure the kernel modules were actually properly loaded
       client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch\.o'")
       client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch-procs\.o'")

From fe171cb3a8dc1c7da6c73c0b872f902ff32252c7 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 18:59:14 +0200
Subject: [PATCH 25/69] nixos/opensnitch: define /etc/opensnitchd entries via
 environment.etc

---
 nixos/modules/services/security/opensnitch.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix
index bffe17a948d1..c0d76e83afff 100644
--- a/nixos/modules/services/security/opensnitch.nix
+++ b/nixos/modules/services/security/opensnitch.nix
@@ -207,11 +207,13 @@ in
       };
       tmpfiles.rules = [
         "d ${cfg.settings.Rules.Path} 0750 root root - -"
-        "L+ /etc/opensnitchd/network_aliases.json - - - - ${cfg.package}/etc/opensnitchd/network_aliases.json"
-        "L+ /etc/opensnitchd/system-fw.json - - - - ${cfg.package}/etc/opensnitchd/system-fw.json"
       ];
     };
 
+    environment.etc."opensnitchd/network_aliases.json".source =
+      "${cfg.package}/etc/opensnitchd/network_aliases.json";
+    environment.etc."opensnitchd/system-fw.json".source =
+      "${cfg.package}/etc/opensnitchd/system-fw.json";
   };
 
   meta.maintainers = with lib.maintainers; [

From 61ab732ed5fe6b85d88240642669c10f6702b245 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 20:28:45 +0200
Subject: [PATCH 26/69] nixos/opensnitch: make rules path and state directory
 match

---
 .../modules/services/security/opensnitch.nix  | 23 +++++++++++++++----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix
index c0d76e83afff..35eeef1d0443 100644
--- a/nixos/modules/services/security/opensnitch.nix
+++ b/nixos/modules/services/security/opensnitch.nix
@@ -13,6 +13,7 @@ let
       file = pkgs.writeText "rule" (builtins.toJSON cfg);
     }
   );
+  stateDir = lib.strings.match "/var/lib/([^/]+)/.+" cfg.settings.Rules.Path;
 in
 {
   options = {
@@ -139,7 +140,10 @@ in
             };
 
             Rules.Path = lib.mkOption {
-              type = lib.types.path;
+              type = lib.types.pathWith {
+                inStore = false;
+                absolute = true;
+              };
               default = "/var/lib/opensnitch/rules";
               description = ''
                 Path to the directory where firewall rules can be found and will
@@ -158,6 +162,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = stateDir != null;
+        message = "`config.services.opensnitch.settings.Rules.Path` must be a sub-directory of /var/lib/, currently is ${cfg.settings.Rules.Path}";
+      }
+    ];
 
     security.auditd = lib.mkIf (cfg.settings.ProcMonitorMethod == "audit") {
       enable = true;
@@ -174,8 +184,14 @@ in
             ""
             "${lib.getExe' cfg.package "opensnitchd"} --config-file ${cfg.configFile}"
           ];
+          StateDirectory = builtins.head stateDir; # match produces a list. Null case covered by assertion.
         };
-        preStart = lib.mkIf (cfg.rules != { }) (
+        preStart = ''
+          # assert rules directory exists before service starts
+          # will be in StateDirectory due to assertion
+          mkdir -p ${cfg.settings.Rules.Path}
+        ''
+        + lib.optionalString (cfg.rules != { }) (
           let
             rules = lib.flip lib.mapAttrsToList predefinedRules (
               file: content: {
@@ -205,9 +221,6 @@ in
           ''
         );
       };
-      tmpfiles.rules = [
-        "d ${cfg.settings.Rules.Path} 0750 root root - -"
-      ];
     };
 
     environment.etc."opensnitchd/network_aliases.json".source =

From ab83614656d9fd079311137dd7ce379418e7958a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 6 Jun 2026 14:11:24 +0000
Subject: [PATCH 27/69] git-town: 23.0.1 -> 23.0.2

---
 pkgs/by-name/gi/git-town/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gi/git-town/package.nix b/pkgs/by-name/gi/git-town/package.nix
index 78fdab8d4277..6c84a4be9e57 100644
--- a/pkgs/by-name/gi/git-town/package.nix
+++ b/pkgs/by-name/gi/git-town/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-town";
-  version = "23.0.1";
+  version = "23.0.2";
 
   src = fetchFromGitHub {
     owner = "git-town";
     repo = "git-town";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kAAzfb0rg10k9PnUKYEqdSWYWi0JR6jiKDHUv/RSUSs=";
+    hash = "sha256-FwwyX/Ncl8zCR1+/A49VIugESU1YFgDcQYbO8w84Lm0=";
   };
 
   vendorHash = null;

From 811397a21cd31c2f1d79cbf7dfd02d1f163ef1d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81lvaro=20Salcedo=20Garc=C3=ADa?= <alvaro@alvr.dev>
Date: Sat, 6 Jun 2026 23:22:28 +0200
Subject: [PATCH 28/69] pocket-id: 2.7.0 -> 2.8.0

---
 pkgs/by-name/po/pocket-id/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/po/pocket-id/package.nix b/pkgs/by-name/po/pocket-id/package.nix
index 5df33e8d77c7..b1daf150ee17 100644
--- a/pkgs/by-name/po/pocket-id/package.nix
+++ b/pkgs/by-name/po/pocket-id/package.nix
@@ -13,18 +13,18 @@
 }:
 buildGo126Module (finalAttrs: {
   pname = "pocket-id";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "pocket-id";
     repo = "pocket-id";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rWU1jldmdtXDcHrFty/Pmll1xFUQnLFF12j833M05rQ=";
+    hash = "sha256-mUBCX2FP/ieDCeqQwtAFmR3dKr8P5bGv8K3+f9ULhZM=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/backend";
 
-  vendorHash = "sha256-nr9L7FVUQYzn+bLtvqKGsYydVCjW/fl53Od9lzRv8gk=";
+  vendorHash = "sha256-QJyy39v4+4+hJO14p6QjgUeHs3t5EXuqCHM/d91jKsM=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
@@ -65,7 +65,7 @@ buildGo126Module (finalAttrs: {
       inherit (finalAttrs) pname version src;
       pnpm = pnpm_10;
       fetcherVersion = 3;
-      hash = "sha256-DVNzFFHMMasKEx+adAhisE32qtirBhJlfMHKrOVl1dM=";
+      hash = "sha256-vohVXJWPQA/29ntx4hY1eTDHuTGx5UuYymQH02Ufd/Y=";
     };
 
     env.BUILD_OUTPUT_PATH = "dist";

From 3244b07e04d58b5beca5539a7a4bd49d92877db4 Mon Sep 17 00:00:00 2001
From: Palmer Cox <p@lmercox.com>
Date: Sat, 6 Jun 2026 21:37:09 -0400
Subject: [PATCH 29/69] conan: Fix on Darwin

The problem is that the test test_qbsprofile_rcflags requires gcc to be
available. But, gcc is not available on Darwin since Clang is used. I
considered trying to patch the test - but, that felt like the wrong
thing to do since we already have a number of tests that we are
disabling for not being compatible with Darwin.
---
 pkgs/by-name/co/conan/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/co/conan/package.nix b/pkgs/by-name/co/conan/package.nix
index 8d0bcbd356d2..3ca24edfab1e 100644
--- a/pkgs/by-name/co/conan/package.nix
+++ b/pkgs/by-name/co/conan/package.nix
@@ -99,6 +99,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "test_xcrun"
     "test_xcrun_in_required_by_tool_requires"
     "test_xcrun_in_tool_requires"
+    # Requires gcc to run
+    "test_qbsprofile_rcflags"
   ];
 
   disabledTestPaths = [

From b9e913b2ecde0e27ecc1d2fba7aeb5b6bff2b771 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 7 Jun 2026 13:50:01 +0000
Subject: [PATCH 30/69] n8n: 2.22.5 -> 2.23.4

---
 pkgs/by-name/n8/n8n/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 8a3b39bf0c54..f7027b35b302 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -26,20 +26,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.22.5";
+  version = "2.23.4";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-YF6VJLA+y8pcAE3RwTub1XjPVfeh8cR+3TQqb3VvV5U=";
+    hash = "sha256-0LROPZKLKEKHBgV0kWAfataZB2nMzdsmq1WImCA6bgA=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-lAe3GuZRdzEwOXWmpBtF7YfGvA4XJumLf80uDYS6j30=";
+    hash = "sha256-oqnLywIOhAZr7nmeGvq6k0brcGjHRhR3pVvBQK3Fg0k=";
   };
 
   nativeBuildInputs = [

From e9cd46ce608fb664b046f935fdb5104d453e0409 Mon Sep 17 00:00:00 2001
From: Tristan Ross <tristan.ross@determinate.systems>
Date: Sun, 7 Jun 2026 18:35:12 -0700
Subject: [PATCH 31/69] llvmPackages_git: 23.0.0-unstable-2026-05-31 ->
 23.0.0-unstable-2026-06-07

---
 pkgs/development/compilers/llvm/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 0274a050606b..ac4a5ef58288 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -28,9 +28,9 @@ let
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
     "22.1.7".officialRelease.sha256 = "sha256-AmozlrL8AAlfr+F7OrJqr3ecd/KhBx5Bngj3SopPdyY=";
     "23.0.0-git".gitRelease = {
-      rev = "0ecf562dac85a29f3de1dd598e3ae0ecc34d1240";
-      rev-version = "23.0.0-unstable-2026-05-31";
-      sha256 = "sha256-9F/X7c3i+eyMhutmG5qvaoWaikOTBI20njDwn5TWCOU=";
+      rev = "47ef7495ad781b742a0c4435ca72590d297ba8bf";
+      rev-version = "23.0.0-unstable-2026-06-07";
+      sha256 = "sha256-5x3wvNti/OCmdam0tUmkiiq/ONn23m4mcTh491hWLVA=";
     };
   }
   // llvmVersions;

From 2e9835cf0eb742b284188ff493e43e1118cd684b Mon Sep 17 00:00:00 2001
From: Antonis Kotronakis <mail@akotro.dev>
Date: Mon, 8 Jun 2026 12:43:22 +0300
Subject: [PATCH 32/69] it-tools: 2024.10.22-7ca5933 -> 0-unstable-2026-06-08

---
 pkgs/by-name/it/it-tools/package.nix | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/it/it-tools/package.nix b/pkgs/by-name/it/it-tools/package.nix
index 860c50322e23..c07a1b76ee6e 100644
--- a/pkgs/by-name/it/it-tools/package.nix
+++ b/pkgs/by-name/it/it-tools/package.nix
@@ -3,36 +3,36 @@
   lib,
   fetchFromGitHub,
   nodejs,
-  pnpm_8,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "it-tools";
-  version = "2024.10.22-7ca5933";
+  version = "0-unstable-2026-02-12";
 
   src = fetchFromGitHub {
     owner = "CorentinTh";
     repo = "it-tools";
-    rev = "v${version}";
-    hash = "sha256-SQAZv+9tINRH10lewcuv8G2qwfulLOP8sGjX47LxeUk=";
+    rev = "d505845f918e946ec300af7b36efc107e2f66e9e";
+    hash = "sha256-dWVRiLbJ1X4yHT5yRcq+KaHmjjtc24yQg0jQvWTPNwU=";
   };
 
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_8
+    pnpm_11
   ];
 
   pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit (finalAttrs)
       pname
       version
       src
       ;
-    pnpm = pnpm_8;
-    fetcherVersion = 3;
-    hash = "sha256-dsjf2TyLAqPzR8OXJgNcoOdDZj2t+H+tLfRhfPsu1G8=";
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-ju8YO0IHIGJtCi5TnxvfLUXcTqKWnTBKAGFBhzQJTok=";
   };
 
   buildPhase = ''
@@ -58,4 +58,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ akotro ];
   };
-}
+})

From 0fd107dc2e44950d1d35e448024389ca3e59229e Mon Sep 17 00:00:00 2001
From: Artemis Tosini <artemis.tosini@obsidian.systems>
Date: Mon, 1 Jun 2026 14:13:13 -0400
Subject: [PATCH 33/69] nixos/qemu-vm: set daemon user in register-nix-paths

The register-nix-paths service caused the nix database to be owned by
root, breaking unprivileged daemon support.

It is unclear why this worked previously.
---
 nixos/modules/virtualisation/qemu-vm.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 01d0c6cca8c8..121a62e1b6f2 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -1307,6 +1307,8 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        User = lib.mkIf (config.nix.daemonUser != "root") config.nix.daemonUser;
+        Group = lib.mkIf (config.nix.daemonGroup != "root") config.nix.daemonGroup;
       };
       script = ''
         if [[ "$(cat /proc/cmdline)" =~ regInfo=([^ ]*) ]]; then

From 097e117e4addaf98b945d411f5e92354445e38f7 Mon Sep 17 00:00:00 2001
From: Tatu Argillander <tatu.argillander@kouralabs.com>
Date: Tue, 27 Jan 2026 22:08:47 +0200
Subject: [PATCH 34/69] vtsls: 0.2.9 -> 0.3.0

---
 pkgs/by-name/vt/vtsls/package.nix | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/vt/vtsls/package.nix b/pkgs/by-name/vt/vtsls/package.nix
index 7cd84da104b5..e5e6ad17db52 100644
--- a/pkgs/by-name/vt/vtsls/package.nix
+++ b/pkgs/by-name/vt/vtsls/package.nix
@@ -5,23 +5,23 @@
   nodejs-slim_22,
   gitMinimal,
   gitSetupHook,
-  pnpm_8,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   nix-update-script,
 }:
 let
-  pnpm' = pnpm_8.override { nodejs-slim = nodejs-slim_22; };
+  pnpm' = pnpm_11.override { nodejs-slim = nodejs-slim_22; };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vtsls";
-  version = "0.2.9";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "yioneko";
     repo = "vtsls";
     tag = "server-v${finalAttrs.version}";
-    hash = "sha256-vlw84nigvQqRB9OQBxOmrR9CClU9M4dNgF/nrvGN+sk=";
+    hash = "sha256-RuxaT3u9OOUMbDN6A2biIeUC+Z4leELF3OhKXxmCqbM=";
     fetchSubmodules = true;
   };
 
@@ -36,7 +36,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ nodejs-slim_22 ];
 
-  pnpmWorkspaces = [ "@vtsls/language-server" ];
+  pnpmWorkspaces = [
+    "@vtsls/language-server"
+    "@vtsls/language-service"
+    "@vtsls/vscode-fuzzy"
+  ];
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs)
@@ -46,8 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
       version
       ;
     pnpm = pnpm';
-    fetcherVersion = 3;
-    hash = "sha256-1P2ph8ZX6/KptkLP4wk0dZzuvnYCLOWorM1b9+otKsE=";
+    fetcherVersion = 4;
+    hash = "sha256-jYh79MtcfW/p6twuDM1JDwukSnn2/TJQYvHBlut0QnE=";
   };
 
   # Patches to get submodule sha from file instead of 'git submodule status'

From 389d1a8463a7efefed2a13a7f57678abb164c002 Mon Sep 17 00:00:00 2001
From: Tatu Argillander <tatu.argillander@kouralabs.com>
Date: Tue, 27 Jan 2026 22:18:02 +0200
Subject: [PATCH 35/69] vtsls: add lsp initialization smoke test

---
 pkgs/by-name/vt/vtsls/package.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pkgs/by-name/vt/vtsls/package.nix b/pkgs/by-name/vt/vtsls/package.nix
index e5e6ad17db52..7fac88f81b36 100644
--- a/pkgs/by-name/vt/vtsls/package.nix
+++ b/pkgs/by-name/vt/vtsls/package.nix
@@ -9,6 +9,8 @@
   fetchPnpmDeps,
   pnpmConfigHook,
   nix-update-script,
+  vtsls,
+  runCommand,
 }:
 let
   pnpm' = pnpm_11.override { nodejs-slim = nodejs-slim_22; };
@@ -94,6 +96,25 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     updateScript = nix-update-script { };
+
+    tests.smoke =
+      runCommand "vtsls-smoke-test"
+        {
+        }
+        ''
+          INIT_REQUEST='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"processId":null,"rootUri":"file:///tmp","workspaceFolders":[{"uri":"file:///tmp","name":"test"}],"capabilities":{}}}'
+          CONTENT_LENGTH=''${#INIT_REQUEST}
+
+          RESPONSE=$(
+            {
+              printf "Content-Length: %d\r\n\r\n%s" "$CONTENT_LENGTH" "$INIT_REQUEST"
+              sleep 1
+            } | timeout 3  ${lib.getExe vtsls} --stdio 2>&1 | head -c 1000
+          ) || true
+
+          echo "$RESPONSE" | grep -q '"capabilities"'
+          touch $out
+        '';
   };
 
   meta = {

From a8a0117d4a5f0eb77a68d400bf2df7388831d5ac Mon Sep 17 00:00:00 2001
From: transcaffeine <transcaffeine@finally.coffee>
Date: Mon, 8 Jun 2026 21:22:20 +0200
Subject: [PATCH 36/69] victoriametrics: 1.144.0 -> 1.145.0

Release notes: https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.145.0
Full changelog: https://github.com/VictoriaMetrics/VictoriaMetrics/compare/v1.144.0...v1.145.0
---
 pkgs/by-name/vi/victoriametrics/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index 3c091d8e69b8..710d39a63429 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.144.0";
+  version = "1.145.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K8RCFHVL+E8w0webp6Bg3dma7I32iGXx9gCKnFp4d0g=";
+    hash = "sha256-nKG2ei1Gn1mU5TtD5YLYUHaJrM4fSxm/uUdY4tIGeVE=";
   };
 
   vendorHash = null;

From b323a813bfbf73de77205c3560287cd769b62ad9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Jun 2026 02:32:04 +0000
Subject: [PATCH 37/69] podofo: 1.1.0 -> 1.1.1

---
 pkgs/by-name/po/podofo/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/po/podofo/package.nix b/pkgs/by-name/po/podofo/package.nix
index bf635ab9b383..b0bcfa976dfc 100644
--- a/pkgs/by-name/po/podofo/package.nix
+++ b/pkgs/by-name/po/podofo/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "podofo";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "podofo";
     repo = "podofo";
     rev = finalAttrs.version;
-    hash = "sha256-gzkIMyGV3nmOrGX2PDLrA9NHbtAwk74vcyrQ+yc5TOw=";
+    hash = "sha256-y+3nOynd0xJRF14XA1oK2smL6irCfaFrJ8rvxJS6b8M=";
   };
 
   outputs = [

From 1daadb6e879d916a201df2b62e4a97149b4ab25e Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Tue, 9 Jun 2026 13:42:02 +0200
Subject: [PATCH 38/69] nixos/lauti: fix type on services.lauti.secrets

This made it impossible to set multiple secret files
---
 nixos/modules/services/web-apps/lauti.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/lauti.nix b/nixos/modules/services/web-apps/lauti.nix
index 1da419604b5e..f1d424e7fa05 100644
--- a/nixos/modules/services/web-apps/lauti.nix
+++ b/nixos/modules/services/web-apps/lauti.nix
@@ -72,7 +72,7 @@ in
         ExecStart = lib.getExe pkgs.lauti;
         WorkingDirectory = cfg.dataDir;
         StateDirectory = default;
-        EnvironmentFile = [ cfg.secrets ];
+        EnvironmentFile = cfg.secrets;
 
         # hardening
         AmbientCapabilities = "";

From c77b284a0eb5745b95924d6b962f8952fac2ee21 Mon Sep 17 00:00:00 2001
From: Guy Chronister <guychronister@outlook.com>
Date: Tue, 9 Jun 2026 13:49:34 -0500
Subject: [PATCH 39/69] fltrdr: migrate to finalAttrs, use tag and SRI hash,
 add strictDeps and structuredAttrs

Assisted-by: Cursor Composer 2.5

fltrdr: migrate to by-name

Assisted-by: Cursor Composer 2.5
---
 .../fl/fltrdr/package.nix}                      | 17 ++++++++++++-----
 pkgs/top-level/all-packages.nix                 |  4 ----
 2 files changed, 12 insertions(+), 9 deletions(-)
 rename pkgs/{tools/misc/fltrdr/default.nix => by-name/fl/fltrdr/package.nix} (84%)

diff --git a/pkgs/tools/misc/fltrdr/default.nix b/pkgs/by-name/fl/fltrdr/package.nix
similarity index 84%
rename from pkgs/tools/misc/fltrdr/default.nix
rename to pkgs/by-name/fl/fltrdr/package.nix
index 1f5884f4fed8..7716f364b0fa 100644
--- a/pkgs/tools/misc/fltrdr/default.nix
+++ b/pkgs/by-name/fl/fltrdr/package.nix
@@ -3,19 +3,26 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  icu,
+  icu63,
   openssl,
 }:
 
-stdenv.mkDerivation rec {
+let
+  icu = icu63;
+in
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "fltrdr";
   version = "0.3.1";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     repo = "fltrdr";
     owner = "octobanana";
-    rev = version;
-    sha256 = "1vpci7vqzcpdd21zgigyz38k77r9fc81dmiwsvfr8w7gad5sg6sj";
+    tag = finalAttrs.version;
+    hash = "sha256-UpunS1PvcJTd1jzWFhBzKZ8z0fj+xfeDaO2yj/eJ7O4=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -48,4 +55,4 @@ stdenv.mkDerivation rec {
     maintainers = [ lib.maintainers.matthiasbeyer ];
     mainProgram = "fltrdr";
   };
-}
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0e33b38e0e8e..d1bb499f4f81 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2153,10 +2153,6 @@ with pkgs;
     binutils = binutils-unwrapped;
   };
 
-  fltrdr = callPackage ../tools/misc/fltrdr {
-    icu = icu63;
-  };
-
   file = callPackage ../tools/misc/file {
     inherit (windows) libgnurx;
   };

From 622a16d7236430fd380907a4c56a6aaf21064a81 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Jun 2026 21:13:33 +0000
Subject: [PATCH 40/69] all-the-package-names: 2.0.2460 -> 2.0.2469

---
 pkgs/by-name/al/all-the-package-names/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/al/all-the-package-names/package.nix b/pkgs/by-name/al/all-the-package-names/package.nix
index d498ceaa639c..ea0089621d8b 100644
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2460";
+  version = "2.0.2469";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-Sp2I3rukIzvXibd00TqlvuqlZnRGdQNsCiDSv+e38Xc=";
+    hash = "sha256-niA8ruXOnYXrjJcciwtl1oYTuYze7ii78XxBviTJ4LE=";
   };
 
-  npmDepsHash = "sha256-IHpFhf09+477yvfvoSpzs9WAY8djEXThrM3yUhhNrBQ=";
+  npmDepsHash = "sha256-DXm6gsQltoqo7A2rRwRO6d7XtlHVf1hotAZ1BYvOqSA=";
 
   passthru.updateScript = nix-update-script { };
 

From 0b74a6f0a506bb6872244e69c01d108ea667bc66 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Jun 2026 21:29:23 +0000
Subject: [PATCH 41/69] cargo-fuzz: 0.13.1 -> 0.13.2

---
 pkgs/by-name/ca/cargo-fuzz/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-fuzz/package.nix b/pkgs/by-name/ca/cargo-fuzz/package.nix
index 6cd374aff03a..86dc7bd078a5 100644
--- a/pkgs/by-name/ca/cargo-fuzz/package.nix
+++ b/pkgs/by-name/ca/cargo-fuzz/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-fuzz";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "rust-fuzz";
     repo = "cargo-fuzz";
     tag = finalAttrs.version;
-    hash = "sha256-wOzzPhAuCaJfp7uRZ1kPpzMIr03couRaIbbrjL0EyYo=";
+    hash = "sha256-DIvbxyIkmrxcFOpH0iZJGxJB60Bh5sjZX+kYUxpp/iQ=";
   };
 
-  cargoHash = "sha256-7HCdWkjIycVKZty760ZnLBtLOZ3gwPhwseIqxqf8xPQ=";
+  cargoHash = "sha256-7P3bii0Y0hf3z9RCPIH6uClFIw/CTtUSzbTbaZNQkYQ=";
 
   doCheck = false;
 

From a0c083b56f90f5d5555d7fa0eaf0ec86262af8f0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Jun 2026 21:29:56 +0000
Subject: [PATCH 42/69] cargo-update: 20.0.0 -> 20.0.1

---
 pkgs/by-name/ca/cargo-update/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-update/package.nix b/pkgs/by-name/ca/cargo-update/package.nix
index 2ace34600749..c06c8718e1bc 100644
--- a/pkgs/by-name/ca/cargo-update/package.nix
+++ b/pkgs/by-name/ca/cargo-update/package.nix
@@ -16,14 +16,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-update";
-  version = "20.0.0";
+  version = "20.0.1";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-J/FujtsQF8WfHFoHJ3r2M+vv8WVh4cxDFw07JntnW2g=";
+    hash = "sha256-wV1R95TBPLXzCmE9sjztxJdvwvWxedEQPI5TxZEGUqA=";
   };
 
-  cargoHash = "sha256-bH8Mg7QQbbXlF7fxwWEFYmYQD1CmDM+g4GhFPZwLy/M=";
+  cargoHash = "sha256-LsqDwGboCPGrRmpFqy13anszrwE8+VoqRqfm5K3VgM8=";
 
   nativeBuildInputs = [
     cmake

From b2d648ff9b219981860ec1baf4df76a98cc4a001 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 9 Jun 2026 21:57:26 +0000
Subject: [PATCH 43/69] lammps: cleanup

---
 pkgs/by-name/la/lammps/package.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/la/lammps/package.nix b/pkgs/by-name/la/lammps/package.nix
index 66715d1eeaf5..40ed6f08f348 100644
--- a/pkgs/by-name/la/lammps/package.nix
+++ b/pkgs/by-name/la/lammps/package.nix
@@ -52,10 +52,13 @@ stdenv.mkDerivation (finalAttrs: {
   version = "22Jul2025_update4";
   pname = "lammps";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "lammps";
     repo = "lammps";
-    rev = "stable_${finalAttrs.version}";
+    tag = "stable_${finalAttrs.version}";
     hash = "sha256-QH63nh7J3NjfdfpN7J96Q+9ZGqj8cA0YwEmgTuBbGmg=";
   };
   preConfigure = ''
@@ -67,7 +70,8 @@ stdenv.mkDerivation (finalAttrs: {
     # Although not always needed, it is needed if cmakeFlags include
     # GPU_API=cuda, and it doesn't users that don't enable the GPU package.
     autoAddDriverRunpath
-  ];
+  ]
+  ++ lib.optionals packages.PYTHON [ python3 ];
 
   passthru = {
     inherit packages;

From b9a151c18cadd95fda4a1822cbb2ff22301f404f Mon Sep 17 00:00:00 2001
From: nick-linux8 <nick.stationengineer@proton.me>
Date: Tue, 9 Jun 2026 17:03:43 -0400
Subject: [PATCH 44/69] inxi: add nick-linux to maintainers

---
 pkgs/by-name/in/inxi/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/in/inxi/package.nix b/pkgs/by-name/in/inxi/package.nix
index edb89c59524d..165ef9de3787 100644
--- a/pkgs/by-name/in/inxi/package.nix
+++ b/pkgs/by-name/in/inxi/package.nix
@@ -109,7 +109,9 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://codeberg.org/smxi/inxi/src/tag/${finalAttrs.version}/inxi.changelog";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
     mainProgram = "inxi";
   };
 })

From f1517b9d00047db4ea32b51461809350d67da8b5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Jun 2026 22:39:46 +0000
Subject: [PATCH 45/69] mympd: 25.1.0 -> 25.1.1

---
 pkgs/by-name/my/mympd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/my/mympd/package.nix b/pkgs/by-name/my/mympd/package.nix
index 1b763464df01..2346dc0e24f8 100644
--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "25.1.0";
+  version = "25.1.1";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-YX9nN4NxD/NrkTlVSxUrQ1ur67Rk2hfM9ZXDjnpoLGk=";
+    sha256 = "sha256-ckGFwnykpmA753bAoCX8ftUEZuxtFlyGTamn4cgK3+A=";
   };
 
   nativeBuildInputs = [

From 96149a836deea1922e551cb8defd616d505c85b1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 00:06:58 +0000
Subject: [PATCH 46/69] audacious: 4.6 -> 4.6.1

---
 pkgs/by-name/au/audacious-bare/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/au/audacious-bare/package.nix b/pkgs/by-name/au/audacious-bare/package.nix
index d2584c1af00e..5d7a2a6d7d77 100644
--- a/pkgs/by-name/au/audacious-bare/package.nix
+++ b/pkgs/by-name/au/audacious-bare/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "audacious";
-  version = "4.6";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "audacious-media-player";
     repo = "audacious";
     rev = "${pname}-${version}";
-    hash = "sha256-TKzsAroCbeTI2dJdAWJYI/0ocroc1L8CC8ciepfEVMc=";
+    hash = "sha256-f1ugxM57dYDDq/G+16bXs6++KXnaLwT+mcPY0R371tY=";
   };
 
   nativeBuildInputs = [

From 9bbc5f80becd317c982ead079da1d5f4d0b24efc Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Tue, 9 Jun 2026 14:06:31 -0700
Subject: [PATCH 47/69] python3Packages.perplexityai: init at 0.38.0

---
 .../python-modules/perplexityai/default.nix   | 102 ++++++++++++++++++
 pkgs/top-level/python-packages.nix            |   2 +
 2 files changed, 104 insertions(+)
 create mode 100644 pkgs/development/python-modules/perplexityai/default.nix

diff --git a/pkgs/development/python-modules/perplexityai/default.nix b/pkgs/development/python-modules/perplexityai/default.nix
new file mode 100644
index 000000000000..6f572887e89d
--- /dev/null
+++ b/pkgs/development/python-modules/perplexityai/default.nix
@@ -0,0 +1,102 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatch-fancy-pypi-readme,
+  hatchling,
+
+  # dependencies (incl. optional)
+  anyio,
+  distro,
+  httpx,
+  pydantic,
+  sniffio,
+  typing-extensions,
+  aiohttp,
+  httpx-aiohttp,
+
+  # tests
+  pyright,
+  mypy,
+  respx,
+  pytest,
+  pytest-asyncio,
+  ruff,
+  time-machine,
+  nox,
+  dirty-equals,
+  importlib-metadata,
+  rich,
+  pytest-xdist,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "perplexityai";
+  version = "0.38.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "perplexityai";
+    repo = "perplexity-py";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Yp5A3aoKtAjWRPZ1Un2OYwezZohWirNm2JhAWLhd6uQ=";
+  };
+
+  # Can't use relaxPythonDeps as this is a version lock in the build system
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"hatchling==1.26.3"' '"hatchling"'
+  '';
+
+  build-system = [
+    hatch-fancy-pypi-readme
+    hatchling
+  ];
+
+  dependencies = [
+    anyio
+    distro
+    httpx
+    pydantic
+    sniffio
+    typing-extensions
+  ];
+
+  optional-dependencies = {
+    aiohttp = [
+      aiohttp
+      httpx-aiohttp
+    ];
+  };
+
+  nativeCheckInputs = [
+    pyright
+    mypy
+    respx
+    pytest
+    pytest-asyncio
+    ruff
+    time-machine
+    nox
+    dirty-equals
+    importlib-metadata
+    rich
+    pytest-xdist
+  ]
+  ++ finalAttrs.passthru.optional-dependencies.aiohttp;
+
+  pythonImportsCheck = [
+    "perplexity"
+  ];
+
+  meta = {
+    description = "API for Perplexity AI";
+    homepage = "https://github.com/perplexityai/perplexity-py";
+    changelog = "https://github.com/perplexityai/perplexity-py/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sarahec ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0af660bc2b5e..e852c08a6c52 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12558,6 +12558,8 @@ self: super: with self; {
 
   permissionedforms = callPackage ../development/python-modules/permissionedforms { };
 
+  perplexityai = callPackage ../development/python-modules/perplexityai { };
+
   persim = callPackage ../development/python-modules/persim { };
 
   persist-queue = callPackage ../development/python-modules/persist-queue { };

From ba667b36b065dcad677aa81efd0edff4bf192550 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Tue, 9 Jun 2026 17:44:09 +0000
Subject: [PATCH 48/69] python3Packages.langchain-perplexity: 1.1.0 -> 1.3.2

---
 .../python-modules/langchain-perplexity/default.nix         | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-perplexity/default.nix b/pkgs/development/python-modules/langchain-perplexity/default.nix
index 8704e3615b8f..c5d9ca276e18 100644
--- a/pkgs/development/python-modules/langchain-perplexity/default.nix
+++ b/pkgs/development/python-modules/langchain-perplexity/default.nix
@@ -9,6 +9,7 @@
   # dependencies
   langchain-core,
   openai,
+  perplexityai,
 
   # tests
   langchain-tests,
@@ -23,14 +24,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-perplexity";
-  version = "1.1.0";
+  version = "1.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-perplexity==${finalAttrs.version}";
-    hash = "sha256-bm7sIa62CIvsYNDdaN+XZKpRnCv5bg9kPZ1Ym8utFcM=";
+    hash = "sha256-XSfnoJaj2VRXSxHHVnRNBvr4Ko7GAqnFEDM90ohaufo=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/perplexity";
@@ -40,6 +41,7 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     langchain-core
     openai
+    perplexityai
   ];
 
   pythonRelaxDeps = [

From cb0798da0390bad5f21b4c8168f21edc073429f1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 01:24:08 +0000
Subject: [PATCH 49/69] jetbrains.webstorm: 2026.1.2 -> 2026.1.3

---
 .../editors/jetbrains/ides/webstorm.nix       | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/editors/jetbrains/ides/webstorm.nix b/pkgs/applications/editors/jetbrains/ides/webstorm.nix
index a193754670dd..637302db7639 100644
--- a/pkgs/applications/editors/jetbrains/ides/webstorm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/webstorm.nix
@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2.tar.gz";
-      hash = "sha256-xoMOLYSuWqWUh5RLI1Q4OnAgGM6tqRDWd1VoULX17yE=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.tar.gz";
+      hash = "sha256-lryIoVxoytyDyfgjnobQ3e94wIIohmIKL88fwf2I49w=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2-aarch64.tar.gz";
-      hash = "sha256-Qe9yclQj971jK8V2SL5GAlNpgUfTwP/PS2ILv2LyhuE=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-oZQaxpVV0O4WlDE6Ia+KzHIF0SfWQBubBFIopSRMbvE=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2.dmg";
-      hash = "sha256-DmsOaBjKnhbipSrIfbTqNd9+qcd2i3zkKfVvLK1GXbI=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.dmg";
+      hash = "sha256-KUcQRWYUD/+4HHWnkGuqoltqL2an0WQkUEfUcttwjCI=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2-aarch64.dmg";
-      hash = "sha256-2YyCHi7yPXnq5KWkqC+Uodnc4xj+DkTsL1vUNqLNmPg=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.dmg";
+      hash = "sha256-1N1RtN1QLvuJ1QL8jbN5TdbOHAHSN84W9XEK2PEPijI=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "WebStorm";
 
   # update-script-start: version
-  version = "2026.1.2";
-  buildNumber = "261.24374.125";
+  version = "2026.1.3";
+  buildNumber = "261.25134.101";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

From e7b4815b1aeb7f15184b9de097a8a90bbf49d16e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 02:19:19 +0000
Subject: [PATCH 50/69] basedpyright: 1.39.3 -> 1.39.7

---
 pkgs/by-name/ba/basedpyright/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix
index 49fdb388ae4f..4196aae7a9ee 100644
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -18,16 +18,16 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.39.3";
+  version = "1.39.7";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-80RQO0UwDA9ZxIGQ0/8WaEj9QlqrQ4g7m9+WJDZrZbI=";
+    hash = "sha256-E4TR5deuPSf2YinrEzpP79Rq8zZHLJQUKiEsfUdMDOE=";
   };
 
-  npmDepsHash = "sha256-jut63CiYGTNIP27wYCPZnE/Ab90EWJnVkx58Oy3uo9o=";
+  npmDepsHash = "sha256-humpJB+fv3+PITcPCz3uY2jNANb3P7sXy0lFP8Eg58I=";
   npmWorkspace = "packages/pyright";
 
   preBuild = ''

From ccf8cdab111bd3ad8f216bb3033d3cf8bce19982 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 02:30:46 +0000
Subject: [PATCH 51/69] ghqr: 0.4.2 -> 0.4.3

---
 pkgs/by-name/gh/ghqr/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gh/ghqr/package.nix b/pkgs/by-name/gh/ghqr/package.nix
index cc7878fec125..6c47091a4ed9 100644
--- a/pkgs/by-name/gh/ghqr/package.nix
+++ b/pkgs/by-name/gh/ghqr/package.nix
@@ -10,14 +10,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "ghqr";
-  version = "0.4.2";
+  version = "0.4.3";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "ghqr";
     tag = "v.${finalAttrs.version}";
-    hash = "sha256-goxKU48fWdCQo0Vng0O3gvRFXsDbuWA/03UH1qUbqrw=";
+    hash = "sha256-KKuxl8odNdMom8l524Mac+sM/5ZdtpakLqazZDQcXJs=";
   };
 
   vendorHash = "sha256-la/yXEZzAIt9l0q0P7+N8yCW0BQie9sLmAhLFK1qyGE=";

From 950fca0c8149fcfb295ec97d021e041f4bbabbe7 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sat, 30 May 2026 01:05:01 +0200
Subject: [PATCH 52/69] nodetool: init at 2.0.0-alpha.9

---
 pkgs/by-name/no/nodtool/package.nix | 97 +++++++++++++++++++++++++++++
 1 file changed, 97 insertions(+)
 create mode 100644 pkgs/by-name/no/nodtool/package.nix

diff --git a/pkgs/by-name/no/nodtool/package.nix b/pkgs/by-name/no/nodtool/package.nix
new file mode 100644
index 000000000000..1d6e554e48c2
--- /dev/null
+++ b/pkgs/by-name/no/nodtool/package.nix
@@ -0,0 +1,97 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  cmake,
+  git,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "nodtool";
+  version = "2.0.0-alpha.9";
+
+  src = fetchFromGitHub {
+    owner = "encounter";
+    repo = "nod";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-beWw+OgF4zCepv/7NQiwXOA8qMwMb8Z3C6icywT+Jr0=";
+  };
+
+  cargoHash = "sha256-+B7mjiCtuxPQ/zSMy8Lw6r5aGB+PVxhRES6zJhD5NAE=";
+
+  nativeBuildInputs = [
+    cmake
+    git
+  ];
+
+  cargoBuildFlags = [
+    "-p"
+    "nodtool"
+    "-p"
+    "nod-ffi"
+  ];
+
+  cargoTestFlags = [
+    "-p"
+    "nodtool"
+    "-p"
+    "nod-ffi"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    releaseDir="target/${stdenv.hostPlatform.config}/release"
+
+    install -Dm755 $releaseDir/nodtool -t $out/bin/
+    install -Dm755 $releaseDir/libnod${stdenv.hostPlatform.extensions.sharedLibrary} -t $out/lib/
+    install -Dm644 $releaseDir/libnod.a -t $out/lib/
+    install -Dm644 nod-ffi/include/nod.h -t $out/include/
+
+    cat > gen-cmake-config.cmake <<'EOF'
+    include(CMakePackageConfigHelpers)
+    set(CMAKE_INSTALL_LIBDIR lib)
+    set(CMAKE_INSTALL_INCLUDEDIR include)
+    set(CMAKE_INSTALL_BINDIR bin)
+    configure_package_config_file("''${NOD_SOURCE_DIR}/cmake/nodConfig.cmake.in" "''${CMAKE_INSTALL_PREFIX}/lib/cmake/nod/nodConfig.cmake" INSTALL_DESTINATION lib/cmake/nod)
+    write_basic_package_version_file("''${CMAKE_INSTALL_PREFIX}/lib/cmake/nod/nodConfigVersion.cmake" VERSION "''${NOD_VERSION}" COMPATIBILITY AnyNewerVersion)
+    EOF
+
+    cmake \
+      ${lib.cmakeFeature "NOD_SOURCE_DIR" "$PWD"} \
+      ${lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "$out"} \
+      ${lib.cmakeFeature "NOD_VERSION" "2.0.0"} \
+      -P gen-cmake-config.cmake
+
+    runHook postInstall
+  '';
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "GameCube/Wii disc image CLI tool and C library";
+    homepage = "https://github.com/encounter/nod";
+    changelog = "https://github.com/encounter/nod/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ liberodark ];
+    platforms = lib.platforms.linux;
+    mainProgram = "nodtool";
+  };
+})

From cd5d4bfca75b95b3839326b406d7de98fb88b06e Mon Sep 17 00:00:00 2001
From: Stefan Haan <stefan@kikeriki.at>
Date: Wed, 10 Jun 2026 05:19:24 +0200
Subject: [PATCH 53/69] python3Packages.slixmpp: 1.15.0 -> 1.16.0

---
 pkgs/development/python-modules/slixmpp/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/slixmpp/default.nix b/pkgs/development/python-modules/slixmpp/default.nix
index c87c0b7a78ec..6bf6b5f3e624 100644
--- a/pkgs/development/python-modules/slixmpp/default.nix
+++ b/pkgs/development/python-modules/slixmpp/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "slixmpp";
-  version = "1.15.0";
+  version = "1.16.0";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "poezio";
     repo = "slixmpp";
     tag = "slix-${finalAttrs.version}";
-    hash = "sha256-1Jns7kqYGpUvwfwyMoZ9ygD2Sm148f/QdJ0atvfwGTo=";
+    hash = "sha256-d0laQWaqZUoviF7NM/egENQ3ArQE12ER0TzfPBcnc7Q=";
   };
 
   patches = [
@@ -71,7 +71,10 @@ buildPythonPackage (finalAttrs: {
     safer-xml-parsing = [ defusedxml ];
   };
 
-  nativeCheckInputs = [ pytestCheckHook ] ++ lib.concatAttrValues optional-dependencies;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   preCheck = ''
     # don't test against pure python version in the source tree

From ea13c34f92f5ecbfde3b1d26efdee159dc9ebbff Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 04:29:47 +0000
Subject: [PATCH 54/69] linuxKernel.kernels.linux_zen: 7.0.10 -> 7.0.11

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 946868d206fc..6102340485fc 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -18,7 +18,7 @@ in
 buildLinux (
   args
   // rec {
-    version = "7.0.10";
+    version = "7.0.11";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "1xh7bbis9v7yq2s1zwdnmsx54zz9kcmyn1cnrqqlsassk7fzl7nx";
+      sha256 = "03h6f1pa96xdszpxcnd846n5jgwqmc49gf9wbyq1gy8rlzpc59yr";
     };
 
     # This is based on the following source:

From 1816eabedafb4b0a58f101ed6b9890e4cb12c645 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 05:07:39 +0000
Subject: [PATCH 55/69] ladybugdb: 0.17.0 -> 0.17.1

---
 pkgs/by-name/la/ladybugdb/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/la/ladybugdb/package.nix b/pkgs/by-name/la/ladybugdb/package.nix
index 6e859eeb85bf..46aaf1b950dc 100644
--- a/pkgs/by-name/la/ladybugdb/package.nix
+++ b/pkgs/by-name/la/ladybugdb/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybugdb";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "LadybugDB";
     repo = "ladybug";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-58Wx3QtDS1PSLjuyZ36u3Tq7kiQj+zFxfsMiCJyDUU4=";
+    hash = "sha256-3d0gsSLkO5Np6P4l8AEfEPvzMlkf2wYMCluAtDrwEDc=";
   };
 
   outputs = [

From 2dcaa56a0659daf69effb41de48551a5681a7948 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 9 Jun 2026 22:43:29 -0700
Subject: [PATCH 56/69] deltachat-desktop: 2.51.0 -> 2.52.0

Diff: https://github.com/deltachat/deltachat-desktop/compare/v2.51.0...v2.52.0

Changelog: https://github.com/deltachat/deltachat-desktop/blob/v2.52.0/CHANGELOG.md
---
 pkgs/by-name/de/deltachat-desktop/package.nix | 12 ++++++------
 pkgs/by-name/de/deltachat-tauri/package.nix   |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/de/deltachat-desktop/package.nix b/pkgs/by-name/de/deltachat-desktop/package.nix
index d65168a448be..dbcc517399ae 100644
--- a/pkgs/by-name/de/deltachat-desktop/package.nix
+++ b/pkgs/by-name/de/deltachat-desktop/package.nix
@@ -22,38 +22,38 @@
 
 let
   deltachat-rpc-server' = deltachat-rpc-server.overrideAttrs rec {
-    version = "2.51.0";
+    version = "2.52.0";
     src = fetchFromGitHub {
       owner = "chatmail";
       repo = "core";
       tag = "v${version}";
-      hash = "sha256-OXazjp3w4NxbcTUNsyeU46erbdj27n1I7dvt+Io/AZ0=";
+      hash = "sha256-AQo27qnHPCK6q/3+Umk6ueqkOIVBA8n4q9S5iEZ7TkM=";
     };
     cargoDeps = rustPlatform.fetchCargoVendor {
       pname = "chatmail-core";
       inherit version src;
-      hash = "sha256-gt//65v9PF2nnX/zkZGU9hm73lfzOTmw36rbkWu9VX0=";
+      hash = "sha256-ni8iaVPHXWhxfiBvtVzGRyPcxkbV0HiqcQCHGmAqk7s=";
     };
   };
   electron = electron_41;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "deltachat-desktop";
-  version = "2.51.0";
+  version = "2.52.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ORp8lZcHzswrSCe30cGKpZdyqZCcvqLgu2hwvadMHN0=";
+    hash = "sha256-/FdGI6Dr9lz0+g/xSzHXbMdqWHf4TliHDXXiAQKKkOs=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-BSDeOkT75usLmXdAY8QNO+9YxxchrJH2gjFpTzErPXo=";
+    hash = "sha256-0VvyZzWAdVGsuYb8CI36KqkqvjgRsTLJov1L44MxUHQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/de/deltachat-tauri/package.nix b/pkgs/by-name/de/deltachat-tauri/package.nix
index 5e8f206a9a70..f812683ceae5 100644
--- a/pkgs/by-name/de/deltachat-tauri/package.nix
+++ b/pkgs/by-name/de/deltachat-tauri/package.nix
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-JhsoIQZrU4GVcs/TCIug6y/84gODyEWl0Bl2jRNxL5Y=";
+  cargoHash = "sha256-euRUA4LTmAdb9466DAMqKgAPX3N4KNXCh1ED9cL42lA=";
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace $cargoDepsCopy/*/libappindicator-sys-*/src/lib.rs \

From f247e5660814433996adc9b9e9d090354d812608 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 06:30:05 +0000
Subject: [PATCH 57/69] python3Packages.moyopy: 0.10.0 -> 0.11.0

---
 pkgs/development/python-modules/moyopy/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/moyopy/default.nix b/pkgs/development/python-modules/moyopy/default.nix
index 1523fe4f4482..91387d6d924c 100644
--- a/pkgs/development/python-modules/moyopy/default.nix
+++ b/pkgs/development/python-modules/moyopy/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "moyopy";
-  version = "0.10.0";
+  version = "0.11.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     owner = "spglib";
     repo = "moyo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-C1260FQ/V/puPU41LQHxsvvQ3BAabxRKWBCVEm79gp0=";
+    hash = "sha256-PxKY/dhYKdvl2dfrDfsqg46TJ2EFx6Px27u8OddQjiI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/moyopy";
@@ -47,7 +47,7 @@ buildPythonPackage (finalAttrs: {
       sourceRoot
       cargoRoot
       ;
-    hash = "sha256-M/AWtXfexXbnFHYd6DxxrRSTuejXdt0DVxU/XtT9iPQ=";
+    hash = "sha256-8GNHuRv3neE0xhfLyxw92DvZRUJFrYm7JCi0Bd2KROs=";
   };
 
   build-system = [

From 9ae143e8b59b14ba71260b3c0cb94c3ce17fdf46 Mon Sep 17 00:00:00 2001
From: natsukium <tomoya.otabi@gmail.com>
Date: Sat, 30 May 2026 18:11:34 +0900
Subject: [PATCH 58/69] sqlx-cli: 0.8.6 -> 0.9.0

Changelog: https://github.com/transact-rs/sqlx/blob/v0.9.0/CHANGELOG.md

Diff: https://github.com/transact-rs/sqlx/compare/v0.8.6...v0.9.0
---
 pkgs/by-name/sq/sqlx-cli/package.nix | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/sq/sqlx-cli/package.nix b/pkgs/by-name/sq/sqlx-cli/package.nix
index 4278543242fb..d5e08028a73b 100644
--- a/pkgs/by-name/sq/sqlx-cli/package.nix
+++ b/pkgs/by-name/sq/sqlx-cli/package.nix
@@ -2,7 +2,7 @@
   stdenv,
   lib,
   rustPlatform,
-  fetchFromGitHub,
+  fetchCrate,
   installShellFiles,
   pkg-config,
   openssl,
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sqlx-cli";
-  version = "0.8.6";
+  version = "0.9.0";
 
-  src = fetchFromGitHub {
-    owner = "launchbadge";
-    repo = "sqlx";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Trnyrc17KWhX8QizKyBvXhTM7HHEqtywWgNqvQNMOAY=";
+  # Upstream stopped shipping a Cargo.lock starting with the v0.9.0 release
+  # https://github.com/transact-rs/sqlx/blob/v0.9.0/CHANGELOG.md#cargolock-removed-from-tracking
+  src = fetchCrate {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-XariusjsCgn0Qai0XWtr7EzSzDDTp1cCzjff1kJNO9Y=";
   };
 
-  cargoHash = "sha256-FxvzCe+dRfMUcPWA4lp4L6FJaSpMiXTqEyhzk+Dv1B8=";
+  cargoHash = "sha256-pHaMKuB9v3fjbgeVyLyRtfoQ9BkE6z+TjDfdBaVdbXM=";
 
   buildNoDefaultFeatures = true;
   buildFeatures = [
@@ -32,11 +32,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "sqlite"
     "mysql"
     "completions"
+    "sqlx-toml"
   ];
 
-  doCheck = false;
-  cargoBuildFlags = [ "--package sqlx-cli" ];
-
   nativeBuildInputs = [
     installShellFiles
     pkg-config
@@ -66,7 +64,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "CLI for managing databases, migrations, and enabling offline mode with `sqlx::query!()` and friends";
-    homepage = "https://github.com/launchbadge/sqlx";
+    homepage = "https://github.com/transact-rs/sqlx";
+    changelog = "https://github.com/transact-rs/sqlx/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       greizgh

From 31b4a28a70ccdd707820f2192b424dab1eb36e10 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Wed, 10 Jun 2026 08:15:44 +0200
Subject: [PATCH 59/69] nixos/wireless: fix for multiple interfaces

Closes issue #529889
---
 .../services/networking/wpa_supplicant.nix       |  2 +-
 nixos/tests/wpa_supplicant.nix                   | 16 ++++++++++------
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index 0e092de5e609..7c7df6688b99 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -127,7 +127,7 @@ let
           ]
           ++ lib.optionals cfg.userControlled [
             # set up client sockets directory
-            "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client"
+            "+${pkgs.coreutils}/bin/mkdir -p /run/wpa_supplicant/client"
             "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client"
             "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client"
           ];
diff --git a/nixos/tests/wpa_supplicant.nix b/nixos/tests/wpa_supplicant.nix
index 88b727ad4a69..02fdc6bb5b00 100644
--- a/nixos/tests/wpa_supplicant.nix
+++ b/nixos/tests/wpa_supplicant.nix
@@ -283,18 +283,22 @@ in
         enable = lib.mkOverride 0 true;
         userControlled = true;
         allowAuxiliaryImperativeNetworks = true;
-        interfaces = [ "wlan1" ];
+        interfaces = [
+          "wlan0"
+          "wlan1"
+        ];
       };
     };
 
     testScript = ''
       wpa_cli = "sudo -u alice -g wpa_supplicant wpa_cli"
 
-      with subtest("Daemon is running and accepting connections"):
-          machine.wait_for_unit("wpa_supplicant-wlan1.service")
-          status = machine.wait_until_succeeds(f"{wpa_cli} -i wlan1 status")
-          assert "Failed to connect" not in status, \
-                 "Failed to connect to the daemon"
+      with subtest("Daemons are running and accepting connections"):
+          for iface in ["wlan0", "wlan1"]:
+            machine.wait_for_unit(f"wpa_supplicant-{iface}.service")
+            status = machine.wait_until_succeeds(f"{wpa_cli} -i {iface} status")
+            assert "Failed to connect" not in status, \
+                   f"Failed to connect to the daemon for {iface}"
 
       with subtest("Daemon can be configured imperatively"):
           machine.succeed(f"{wpa_cli} -i wlan1 add_network")

From d897cd29bb77f8958bfca356176dcc1d345d321b Mon Sep 17 00:00:00 2001
From: Marie Ramlow <me@nycode.dev>
Date: Wed, 10 Jun 2026 07:45:41 +0000
Subject: [PATCH 60/69] forgejo: 15.0.2 -> 15.0.3

---
 pkgs/by-name/fo/forgejo/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo/package.nix b/pkgs/by-name/fo/forgejo/package.nix
index 071a5fea9f2e..ad10007e9e99 100644
--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "15.0.2";
-  hash = "sha256-ba5jog6eXY4TTmBblhfVa2LSLPGE1/HPfslIb30b3kk=";
-  npmDepsHash = "sha256-70w39jbMWpuAsbzBC9oFHaUMwshtFDeTSEOXDgFNPmE=";
-  vendorHash = "sha256-I6bGvXBP2K3+Xx9E9DS/AyG6Ilqf/s8VjfBnCmLUHsk=";
+  version = "15.0.3";
+  hash = "sha256-tGZ83TEG6iyZd5mfSuSvVkmUJINWLN661YpOk1+dgbM=";
+  npmDepsHash = "sha256-BZSYjEsjUqMYWu3EUP+K35hqSOniv8Y6ek5bEC2vTPg=";
+  vendorHash = "sha256-z3YTjt+SM9yPCsJdfSQbTpy3vRiXaFV2QMz1y6J6k/Q=";
   lts = true;
   nixUpdateExtraArgs = [
     "--override-filename"

From 99417e1d3dc51fdb8c15a68659f45abb75f27c88 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Wed, 10 Jun 2026 09:09:01 +0200
Subject: [PATCH 61/69] rs-lxmf: init at 0.9.2

---
 pkgs/by-name/rs/rs-lxmf/package.nix | 43 +++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 pkgs/by-name/rs/rs-lxmf/package.nix

diff --git a/pkgs/by-name/rs/rs-lxmf/package.nix b/pkgs/by-name/rs/rs-lxmf/package.nix
new file mode 100644
index 000000000000..5de637e44fb5
--- /dev/null
+++ b/pkgs/by-name/rs/rs-lxmf/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  rs-reticulum,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rs-lxmf";
+  version = "0.9.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "ratspeak";
+    repo = "rsLXMF";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jba/uiQQUO3MdmF2+6AOtdbUXYW43yqplRFUGujN0Oo=";
+  };
+
+  postPatch = ''
+    for crate in rns-crypto rns-wire rns-identity rns-link rns-protocol rns-transport rns-runtime rns-interface; do
+      substituteInPlace Cargo.toml \
+        --replace-fail "../rsReticulum/crates/$crate" "${rs-reticulum.src}/crates/$crate"
+    done
+  '';
+
+  cargoHash = "sha256-ReWw16r9cYIEzilzSsFXYap9ZGhk1mrUVl/bKkQMcVA=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Rust implementation of LXMF for Reticulum";
+    homepage = "https://github.com/ratspeak/rsLXMF";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "lxmd-rs";
+  };
+})

From f8f14cc3a090fa43b798d2b74a746545e67e3152 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 08:14:11 +0000
Subject: [PATCH 62/69] terraform-providers.aliyun_alicloud: 1.279.0 -> 1.281.0

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 938e3af60545..866e96f6ce78 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -45,11 +45,11 @@
     "vendorHash": "sha256-5IfYhOEhXRpdL7G3Op9a0Ep14el2gwcVmRMkGB7oWH4="
   },
   "aliyun_alicloud": {
-    "hash": "sha256-YmfHL9uCtbxKE1wdacn9gf4Jo85/ivCkxOtMuBQin0I=",
+    "hash": "sha256-dIMlk/ZKIJjrkAk0EGCz3UTZvjbEltWq879331EEMD0=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.279.0",
+    "rev": "v1.281.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-lBD9ifRpUwg45V7zZG3grHvndG0V42oiX68zgcM7t74="
   },

From 8201c0fa00051e6b7282b28a60f75ee7390d1301 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 08:58:02 +0000
Subject: [PATCH 63/69] step-cli: 0.30.2 -> 0.30.4

---
 pkgs/by-name/st/step-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/step-cli/package.nix b/pkgs/by-name/st/step-cli/package.nix
index 8bf97e43bb39..07744e43c5e4 100644
--- a/pkgs/by-name/st/step-cli/package.nix
+++ b/pkgs/by-name/st/step-cli/package.nix
@@ -8,7 +8,7 @@
   unixtools,
 }:
 let
-  version = "0.30.2";
+  version = "0.30.4";
 in
 buildGoModule {
   pname = "step-cli";
@@ -18,7 +18,7 @@ buildGoModule {
     owner = "smallstep";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-xhkgPBPMxphlwTQiGPmvC8sQWCoepga3v6LVzHgh5zE=";
+    hash = "sha256-ToM+RzpioI+TlljlptYY0jnKGNdITzJ/xeWf4azhT/4=";
     # this file change depending on git branch status (via .gitattributes)
     # https://github.com/NixOS/nixpkgs/issues/84312
     postFetch = ''
@@ -39,7 +39,7 @@ buildGoModule {
     patchShebangs integration/openssl-jwt.sh
   '';
 
-  vendorHash = "sha256-SnU2jkHZNhn8zS9S/2/MiZRtBV0sVy28n+BJY6RpCag=";
+  vendorHash = "sha256-DTFp9K5iiS50QuD2knN/8miYb2k/7O1d3GyEf79i69Q=";
 
   nativeBuildInputs = [ installShellFiles ];
   nativeCheckInputs = [

From 00c4df0c09f5565079be64ff9ace14f327b38bb9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Justin=20Lex-Hammarskj=C3=B6ld?= <mail+github@jlh.name>
Date: Mon, 8 Jun 2026 10:49:16 +0000
Subject: [PATCH 64/69] mullvad-vpn: Add iproute2 to runtime dependencies

---
 pkgs/by-name/mu/mullvad-vpn/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/mu/mullvad-vpn/package.nix b/pkgs/by-name/mu/mullvad-vpn/package.nix
index 58dd314a2d96..60e664cdb4b5 100644
--- a/pkgs/by-name/mu/mullvad-vpn/package.nix
+++ b/pkgs/by-name/mu/mullvad-vpn/package.nix
@@ -40,6 +40,7 @@
   makeWrapper,
   coreutils,
   gnugrep,
+  iproute2,
 
   versionCheckHook,
 }:
@@ -119,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   runtimeDependencies = [
     (lib.getLib systemd)
+    iproute2
     libGL
     libnotify
     libappindicator

From d39f829a290d45cb5ceed6e6607a233227f6e6e9 Mon Sep 17 00:00:00 2001
From: Scott Edlund <sedlund@users.noreply.github.com>
Date: Mon, 27 Apr 2026 11:59:03 +0700
Subject: [PATCH 65/69] gping: fix ipv6 use

adds a patch to use ping -6 instead of ping6
---
 pkgs/by-name/gp/gping/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/gp/gping/package.nix b/pkgs/by-name/gp/gping/package.nix
index 9b32fcd56de5..920dceed657c 100644
--- a/pkgs/by-name/gp/gping/package.nix
+++ b/pkgs/by-name/gp/gping/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch,
   installShellFiles,
   iputils,
   versionCheckHook,
@@ -22,6 +23,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-F0QBL7tCCdjnavClqrw8yYxFrY8y4f8h/gcHSpEqBiM=";
 
+  patches = [
+    (fetchpatch {
+      name = "fix-ipv6-addrs-by-using-ping-dash-6.patch";
+      # https://github.com/orf/gping/pull/546
+      url = "https://github.com/orf/gping/commit/7ef8e1ddec847681c5ef3d4a010a0ad3a7aebab0.patch";
+      hash = "sha256-b3Nv+mobPUcgREaNvn7cXra24PgEUe60yE/kOPTQEos=";
+    })
+  ];
+
   nativeBuildInputs = [ installShellFiles ];
 
   nativeCheckInputs = lib.optionals stdenv.hostPlatform.isLinux [ iputils ];

From 21d81e347bf2ee51b62b6a9fa54a7bb010dcd05f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 09:47:20 +0000
Subject: [PATCH 66/69] nickel: 1.16.0 -> 1.17.0

---
 pkgs/by-name/ni/nickel/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ni/nickel/package.nix b/pkgs/by-name/ni/nickel/package.nix
index ba654f95e6c8..becfec74d3fd 100644
--- a/pkgs/by-name/ni/nickel/package.nix
+++ b/pkgs/by-name/ni/nickel/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nickel";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "nickel-lang";
     repo = "nickel";
     tag = finalAttrs.version;
-    hash = "sha256-G+ik4tMr+WsDpiEFYv80ruBR/SpeEg9agUWqgXrq7UI=";
+    hash = "sha256-D+OI00Ouwm0v65igIYSCGPXKCl6/SZsOyz1wFM1VAF4=";
   };
 
-  cargoHash = "sha256-E3UBkLxd7AC/Pk1Zgy+KvHTPXgATqIr7lZXPB8vlSWs=";
+  cargoHash = "sha256-hIeTHajL+h6xhuje8TmfgkkM9R+tGwYFzlnSwaN3nK8=";
 
   cargoBuildFlags = [
     "--package"

From cb5396f1235f2d93b50f91367f0a5b1bae14473c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 10 Jun 2026 11:24:22 +0000
Subject: [PATCH 67/69] resterm: 0.41.1 -> 0.42.1

---
 pkgs/by-name/re/resterm/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index 76e510f4737d..9204f07b18c4 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "0.41.1";
+  version = "0.42.1";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PSWgbq1aV+9AEhAXL3gZGKh6BzKc5CxufLTp80T0Tno=";
+    hash = "sha256-NyUSV5vsksr9LgwcN6f4f+1ol3304l0SalHzRI9R5mQ=";
   };
 
   vendorHash = "sha256-AjckKD6NScBa8w9nWMdVExuNadz3vHnK854XXg3nj84=";

From 3214367796ab0c847db641a372038c28ea82da1d Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 10 Jun 2026 13:38:01 +0200
Subject: [PATCH 68/69] nixos/opensnitch: default to nftables firewall backend

iptables backend is currently broken for unknown reasons.
`nftables` backend works for iptables firewall too,
if built with nftablesCompat = true (our default).
---
 nixos/modules/services/security/opensnitch.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix
index 35eeef1d0443..0631d0a1863b 100644
--- a/nixos/modules/services/security/opensnitch.nix
+++ b/nixos/modules/services/security/opensnitch.nix
@@ -106,10 +106,9 @@ in
                 "iptables"
                 "nftables"
               ];
-              default = if config.networking.nftables.enable then "nftables" else "iptables";
-              defaultText = lib.literalExpression ''if config.networking.nftables.enable then "nftables" else "iptables"'';
+              default = "nftables";
               description = ''
-                Which firewall backend to use.
+                Which firewall backend to use. `nftables` ruleset can be used for `iptables` firewall too, if `iptables` is built with nftables compatibility.
               '';
             };
             Ebpf.ModulesPath = lib.mkOption {

From 36709df191533428cd19549dbca85c92fb0dffc4 Mon Sep 17 00:00:00 2001
From: Matt Sturgeon <matt@sturgeon.me.uk>
Date: Wed, 10 Jun 2026 13:30:28 +0100
Subject: [PATCH 69/69] Revert "pkgs-lib/formats: Use .attrs.json directly for
 TOML"

---
 pkgs/pkgs-lib/formats.nix                |  6 ++++--
 pkgs/pkgs-lib/formats/json2x/src/main.rs | 24 +++---------------------
 2 files changed, 7 insertions(+), 23 deletions(-)

diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 2f3e5ad9d191..879b233bb670 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -472,12 +472,14 @@ optionalAttrs allowAliases aliases
           runCommand name
             {
               nativeBuildInputs = [ json2x ];
-              inherit value;
+              value = builtins.toJSON value;
               preferLocalBuild = true;
               __structuredAttrs = true;
             }
             ''
-              json2x toml --unwrap value "$NIX_ATTRS_JSON_FILE" "$out"
+              valuePath="$TMPDIR/value"
+              printf "%s" "$value" > "$valuePath"
+              json2x toml "$valuePath" "$out"
             ''
         ) { };
 
diff --git a/pkgs/pkgs-lib/formats/json2x/src/main.rs b/pkgs/pkgs-lib/formats/json2x/src/main.rs
index 1464fb8972b9..b9025c67f42a 100644
--- a/pkgs/pkgs-lib/formats/json2x/src/main.rs
+++ b/pkgs/pkgs-lib/formats/json2x/src/main.rs
@@ -10,9 +10,6 @@ use argh::{FromArgValue, FromArgs};
 /// Convert a JSON file to another format
 #[derive(FromArgs)]
 struct Args {
-    /// convert only value of this attribute
-    #[argh(option)]
-    unwrap: Option<String>,
     /// format of the output file, possible values: toml
     #[argh(positional)]
     format: Format,
@@ -32,31 +29,16 @@ enum Format {
 fn main() -> anyhow::Result<()> {
     let args: Args = argh::from_env();
 
-    let json_text = read_to_string(&args.input)
+    let input = read_to_string(&args.input)
         .with_context(|| format!("failed to read {}", args.input.display()))?;
-    let parsed_json: serde_json::Value = serde_json::from_str(&json_text)
+    let input: serde_json::Value = serde_json::from_str(&input)
         .with_context(|| format!("failed to parse {}", args.input.display()))?;
-    let output_value = if let Some(unwrap_key) = args.unwrap {
-        parsed_json
-            .as_object()
-            .ok_or_else(|| anyhow::anyhow!("{} does not contain an object", args.input.display()))?
-            .get(&unwrap_key)
-            .ok_or_else(|| {
-                anyhow::anyhow!(
-                    "{} does not containt attribute '{unwrap_key}'",
-                    args.input.display()
-                )
-            })?
-    } else {
-        &parsed_json
-    };
     let mut output = File::create(&args.output)
         .with_context(|| format!("failed to create {}", args.output.display()))?;
 
     match args.format {
         Format::Toml => {
-            let content =
-                toml::to_string(output_value).context("failed to serialize value to toml")?;
+            let content = toml::to_string(&input).context("failed to serialize value to toml")?;
             output
                 .write_all(content.as_bytes())
                 .with_context(|| format!("failed to write to {}", args.output.display()))?;