From 0abc48b78a9fc6d4c6e2c3e90c03e3f1c0ffb097 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Oct 2025 04:25:43 +0000
Subject: [PATCH 01/25] chirpstack-mqtt-forwarder: 4.4.0 -> 4.4.1

---
 pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix b/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix
index e2e700e9197a..87c66935d2fb 100644
--- a/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix
+++ b/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "chirpstack-mqtt-forwarder";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "chirpstack";
     repo = "chirpstack-mqtt-forwarder";
     rev = "v${version}";
-    hash = "sha256-HopcEwj/WOialvttVJ6bTyRRTqrgfIJ/dYKti5T87Os=";
+    hash = "sha256-qkktkydg5Xe6q5IFalkxtGjO2zK9mZVMnKOBassiEtk=";
   };
 
-  cargoHash = "sha256-uR+Y8+/XbIQdbGOoS/tHBo/r7DLiwiRiaXQ7CjaPpoI=";
+  cargoHash = "sha256-rQPmFmra9Gd8XDP9HuTZZru780RmmqWEKX2iuuRkZQw=";
 
   nativeBuildInputs = [ protobuf ];
 

From f527620e4082a67c301f2b008825b42abc2b9f3b Mon Sep 17 00:00:00 2001
From: loudgolem <phanirithvij2000@gmail.com>
Date: Fri, 24 Oct 2025 22:39:33 +0530
Subject: [PATCH 02/25] apprise: licenses.bsd3 -> bsd2

It was changed after https://github.com/caronc/apprise/commit/34e52e5d9285f2612244560aca13abf3b2fe6dc1
---
 pkgs/development/python-modules/apprise/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
index 4bf5cedaa077..3f7d2cf211f0 100644
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -72,7 +72,7 @@ buildPythonPackage rec {
     description = "Push Notifications that work with just about every platform";
     homepage = "https://github.com/caronc/apprise";
     changelog = "https://github.com/caronc/apprise/releases/tag/v${version}";
-    license = lib.licenses.bsd3;
+    license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ getchoo ];
     mainProgram = "apprise";
   };

From 304b4f4943ab12f89658f596e867b867a8972fd3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 25 Oct 2025 07:49:41 +0000
Subject: [PATCH 03/25] bign-handheld-thumbnailer: 1.1.3 -> 1.2.0

---
 pkgs/by-name/bi/bign-handheld-thumbnailer/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bi/bign-handheld-thumbnailer/package.nix b/pkgs/by-name/bi/bign-handheld-thumbnailer/package.nix
index b6cbffb51dd9..290f197fd0a2 100644
--- a/pkgs/by-name/bi/bign-handheld-thumbnailer/package.nix
+++ b/pkgs/by-name/bi/bign-handheld-thumbnailer/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bign-handheld-thumbnailer";
-  version = "1.1.3";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "MateusRodCosta";
     repo = "bign-handheld-thumbnailer";
     tag = "v${version}";
-    hash = "sha256-qS1bKEkZPmNMfiLUZVlx8EAXMMYCcGGTTZFhWwlZ3gQ=";
+    hash = "sha256-+iWf5ybCUHlZz3Ybw3bwLKzlsmiVwep2alVDvL9bG2A=";
   };
 
-  cargoHash = "sha256-LyT0HDR51/bYnXtavgtff1nCKuJn41UmZuH/uJmykkk=";
+  cargoHash = "sha256-vfTbfg1CAbc//UZtI5trw6znqnNGy6AiCSQNE68vch8=";
 
   strictDeps = true;
 

From 93ef27018606f440e47f0b824a4177e3f688225d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 25 Oct 2025 09:14:19 +0000
Subject: [PATCH 04/25] home-manager: 0-unstable-2025-10-18 ->
 0-unstable-2025-10-25

---
 pkgs/by-name/ho/home-manager/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix
index 9c018c365756..1af40524d040 100644
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2025-10-18";
+  version = "0-unstable-2025-10-25";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "870883ba11ba1c84f756c0c1f9fa74cdb2a16c1e";
-    hash = "sha256-OxGcFcQdfOK8veZkPdQuqXIotFYiy4sBQB58dMNLeHY=";
+    rev = "c644cb018f9fdec55f5ac2afb4713a8c7beb757c";
+    hash = "sha256-6LNSptFYhiAd0M/maJoixJw7V0Kp5BSoMRtIahcfu3M=";
   };
 
   nativeBuildInputs = [

From 991b73606a526299a19d36cf32a196d72313e7ca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 25 Oct 2025 19:09:21 +0000
Subject: [PATCH 05/25] procfd: 1.1.0 -> 1.2.0

---
 pkgs/by-name/pr/procfd/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pr/procfd/package.nix b/pkgs/by-name/pr/procfd/package.nix
index 53f12202e087..16aa478eacdb 100644
--- a/pkgs/by-name/pr/procfd/package.nix
+++ b/pkgs/by-name/pr/procfd/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "procfd";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "deshaw";
     repo = "procfd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-M2VFy7WqvoxgzEpS0qd7nGLRt2pKGZlfU9uUHlwDC7Y=";
+    hash = "sha256-KhnSHtPT9H9CWotwQIA9gFvwgm0PKsmDjQS817PxMw0=";
   };
 
-  cargoHash = "sha256-YmUzcJ8SM3iwjeDZXWBrDcT793ZyF6QdwxuYDh69xZw=";
+  cargoHash = "sha256-srFXs+h+ZMXeWRwGQUAqMACJG4ZUgztWr2ff6sRfkU8=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

From c905d0aa952ccbef0113ddc9e48e0a453156b4e3 Mon Sep 17 00:00:00 2001
From: Danny Breyfogle <27653146+dbreyfogle@users.noreply.github.com>
Date: Thu, 23 Oct 2025 21:21:15 -0700
Subject: [PATCH 06/25] github-copilot-cli: fix build by switching from
 buildNpmPackage to stdenv.mkDerivation

---
 .../gi/github-copilot-cli/package-lock.json   | 58 -------------------
 .../by-name/gi/github-copilot-cli/package.nix | 27 ++++++---
 2 files changed, 20 insertions(+), 65 deletions(-)
 delete mode 100644 pkgs/by-name/gi/github-copilot-cli/package-lock.json

diff --git a/pkgs/by-name/gi/github-copilot-cli/package-lock.json b/pkgs/by-name/gi/github-copilot-cli/package-lock.json
deleted file mode 100644
index 2d53b9d57986..000000000000
--- a/pkgs/by-name/gi/github-copilot-cli/package-lock.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  "name": "@github/copilot",
-  "version": "0.0.328",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "@github/copilot",
-      "version": "0.0.328",
-      "dependencies": {
-        "keytar-forked-forked": "^7.10.2",
-        "node-pty": "npm:@devm33/node-pty@^1.0.8"
-      },
-      "bin": {
-        "copilot": "index.js"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/keytar-forked-forked": {
-      "version": "7.10.3",
-      "resolved": "https://registry.npmjs.org/keytar-forked-forked/-/keytar-forked-forked-7.10.3.tgz",
-      "integrity": "sha512-ipErTUO1NPXmngYhnMrda0yOIOPSNbVJ2BRjk3kNozLx3UmGICnzCfEDemuLY6HgP+rV0c9F+Opt+89+Ydbw6w==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "dependencies": {
-        "node-addon-api": "^8.3.0"
-      }
-    },
-    "node_modules/node-addon-api": {
-      "version": "8.5.0",
-      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.5.0.tgz",
-      "integrity": "sha512-/bRZty2mXUIFY/xU5HLvveNHlswNJej+RnxBjOMkidWfwZzgTbPG1E3K5TOxRLOR+5hX7bSofy8yf1hZevMS8A==",
-      "license": "MIT",
-      "engines": {
-        "node": "^18 || ^20 || >= 21"
-      }
-    },
-    "node_modules/node-pty": {
-      "name": "@devm33/node-pty",
-      "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/@devm33/node-pty/-/node-pty-1.0.9.tgz",
-      "integrity": "sha512-5yzbTTywkaFk1iRwte2aWEpyDfcpDjCofVD1BiOUQI+fsCvp/+RdJnB4jgnULrdlWOEWuBf+bg4/NZKVApPhoQ==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "dependencies": {
-        "node-addon-api": "^7.1.0"
-      }
-    },
-    "node_modules/node-pty/node_modules/node-addon-api": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
-      "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
-      "license": "MIT"
-    }
-  }
-}
diff --git a/pkgs/by-name/gi/github-copilot-cli/package.nix b/pkgs/by-name/gi/github-copilot-cli/package.nix
index 2006f6db64d3..89d99bd3cd4e 100644
--- a/pkgs/by-name/gi/github-copilot-cli/package.nix
+++ b/pkgs/by-name/gi/github-copilot-cli/package.nix
@@ -1,11 +1,14 @@
 {
   lib,
-  buildNpmPackage,
+  stdenv,
   fetchzip,
+  nodejs,
+  makeBinaryWrapper,
+  versionCheckHook,
   nix-update-script,
 }:
 
-buildNpmPackage (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "github-copilot-cli";
   version = "0.0.328";
 
@@ -14,15 +17,25 @@ buildNpmPackage (finalAttrs: {
     hash = "sha256-9oTaVjvwyS8KY8N5kUEiAs+l6vEd/BZ0AGJI0p9Jie0=";
   };
 
-  npmDepsHash = "sha256-WK6t3IW4uF+MDu7Y5GRinbm8iDcYB8RhJ15GE9VBcjQ=";
+  nativeBuildInputs = [ makeBinaryWrapper ];
 
-  postPatch = ''
-    cp ${./package-lock.json} package-lock.json
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/node_modules/@github/copilot
+    cp -r . $out/lib/node_modules/@github/copilot
+
+    mkdir -p $out/bin
+    makeBinaryWrapper ${nodejs}/bin/node $out/bin/copilot \
+      --add-flags "$out/lib/node_modules/@github/copilot/index.js"
+
+    runHook postInstall
   '';
 
-  dontNpmBuild = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
 
-  passthru.updateScript = nix-update-script { extraArgs = [ "--generate-lockfile" ]; };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal";

From 86c2c5fe685563e15e2d8a8f03d11dc8824981c6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 25 Oct 2025 21:58:36 +0000
Subject: [PATCH 07/25] diesel-cli: 2.3.2 -> 2.3.3

---
 pkgs/by-name/di/diesel-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/di/diesel-cli/package.nix b/pkgs/by-name/di/diesel-cli/package.nix
index 164b69372ccc..909dd6d31e9c 100644
--- a/pkgs/by-name/di/diesel-cli/package.nix
+++ b/pkgs/by-name/di/diesel-cli/package.nix
@@ -27,15 +27,15 @@ assert lib.assertMsg (lib.elem true [
 
 rustPlatform.buildRustPackage rec {
   pname = "diesel-cli";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchCrate {
     inherit version;
     crateName = "diesel_cli";
-    hash = "sha256-JNDFXBNmwCWpk+Lub453wS+7lVMZcdiJBmPoVAedpug=";
+    hash = "sha256-AgPESgFLnL3jiYBP8DiWb0hLzsx5tJA+gcO/fdV5Cvo=";
   };
 
-  cargoHash = "sha256-qfXa6DuuhKbXCdOvhuPNx6xlDIouoDVJUMob9Fc5XgI=";
+  cargoHash = "sha256-yco4l/4UiYnqnZZLYm3EkHmYiQJhMC2xloFg0brDfsg=";
 
   nativeBuildInputs = [
     installShellFiles

From 81e609e813016ffcc8af59fe311b863ea0136cc3 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 26 Oct 2025 18:23:37 +0100
Subject: [PATCH 08/25] libreoffice-fresh: Fix build

The patch is part of libreoffice 25.8.2.1.
---
 pkgs/applications/office/libreoffice/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 213ae69d8f86..5dac65d51741 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -313,7 +313,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Revert part of https://github.com/LibreOffice/core/commit/6f60670877208612b5ea320b3677480ef6508abb that broke zlib linking
     ./readd-explicit-zlib-link.patch
-
+  ]
+  ++ lib.optionals (lib.versionOlder version "25.8.2.1") [
     # Backport patch to fix build with Poppler 25.09
     (fetchpatch2 {
       url = "https://github.com/LibreOffice/core/commit/7848e02819c007026952a3fdc9da0961333dc079.patch";
@@ -321,10 +322,10 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-Nw6GFmkFy13w/ktCxw5s7SHL34auP1BQ9JvQnQ65aVU=";
     })
   ]
-  ++ lib.optionals (lib.versionAtLeast version "25.8") [
+  ++ lib.optionals (lib.versionAtLeast version "25.8.2.2") [
     # Fix build with Poppler 25.10
     (fetchpatch2 {
-      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-fresh/-/raw/41e58e117c356af2be83993595caf61f9f30cc89/poppler-25.10.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-fresh/-/raw/f7b0e4385108b95c134599502a7bccf0a41925c8/poppler-25.10.patch";
       hash = "sha256-KMsjDtRRH8Vy/FXaVwxUo0Ww10PCE0sK8+ZL0Ja2kJQ=";
     })
   ]

From b6badb34ac9757d733667c24b115cab8e2c2acb9 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 26 Oct 2025 18:38:42 +0100
Subject: [PATCH 09/25] kdePackages.calligra: Fix build with Poppler 25.10

---
 pkgs/kde/gear/calligra/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/kde/gear/calligra/default.nix b/pkgs/kde/gear/calligra/default.nix
index 6cbdeb223aa4..b0d1e99c9b0c 100644
--- a/pkgs/kde/gear/calligra/default.nix
+++ b/pkgs/kde/gear/calligra/default.nix
@@ -1,6 +1,7 @@
 {
   mkKdeDerivation,
   lib,
+  fetchpatch,
   boost,
   eigen,
   gsl,
@@ -26,6 +27,14 @@
 mkKdeDerivation {
   pname = "calligra";
 
+  patches = [
+    # Fix build with Poppler 25.10
+    (fetchpatch {
+      url = "https://invent.kde.org/office/calligra/-/commit/45e8b302bce1d318f310ea13599d7ce84acc477e.patch";
+      hash = "sha256-TECB3eo24+gI8TXL8gw9BIdFWqw0JBKCWpoNVqBSan8=";
+    })
+  ];
+
   extraBuildInputs = [
     boost
     eigen

From c9b78f12c8bdf0fbed91aa5c46f111eaf0fa7875 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sun, 26 Oct 2025 18:43:12 +0100
Subject: [PATCH 10/25] libreoffice-still: actually fix build with poppler
 25.10.0

---
 pkgs/applications/office/libreoffice/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 5dac65d51741..8da0b046cba1 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -321,6 +321,11 @@ stdenv.mkDerivation (finalAttrs: {
       includes = [ "sdext/*" ];
       hash = "sha256-Nw6GFmkFy13w/ktCxw5s7SHL34auP1BQ9JvQnQ65aVU=";
     })
+    # Fix build with Poppler 25.10
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/f5241554e4a0f6fd95ac4e5cc398a30243407e6a/fix_build_with_poppler_25.10.patch";
+      hash = "sha256-lbPOkc1HeT5Qsp6XfVyVJtmvSL68qTrmbd3q9lvKSu8=";
+    })
   ]
   ++ lib.optionals (lib.versionAtLeast version "25.8.2.2") [
     # Fix build with Poppler 25.10

From 10bada972ea925bb8bb99e117acb11e297e38a26 Mon Sep 17 00:00:00 2001
From: 7c6f434c <7c6f434c@mail.ru>
Date: Sun, 26 Oct 2025 19:54:47 +0100
Subject: [PATCH 11/25] rxvt-unicode-plugins.{bidi,tabbedex}: specify licenses

---
 .../rxvt-unicode-plugins/urxvt-bidi/default.nix                | 3 +++
 .../rxvt-unicode-plugins/urxvt-tabbedex/default.nix            | 1 +
 2 files changed, 4 insertions(+)

diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-bidi/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-bidi/default.nix
index ec2d08862ecd..ff7c1b1a2d7d 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-bidi/default.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-bidi/default.nix
@@ -32,5 +32,8 @@ perlPackages.buildPerlPackage rec {
     homepage = "https://github.com/mkamensky/Text-Bidi";
     maintainers = with maintainers; [ doronbehar ];
     platforms = with platforms; unix;
+    # Quote from the README:
+    # same terms as the Perl 5 programming language system itself
+    license = perlPackages.perl.meta.license;
   };
 }
diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-tabbedex/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-tabbedex/default.nix
index e1b3ff6233fa..98fb59bf9795 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-tabbedex/default.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-tabbedex/default.nix
@@ -25,5 +25,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/mina86/urxvt-tabbedex";
     maintainers = [ ];
     platforms = with platforms; unix;
+    license = lib.licenses.gpl3Plus;
   };
 }

From 22e163ef4c7e9bd88cd9aadcef4027458796486b Mon Sep 17 00:00:00 2001
From: 7c6f434c <7c6f434c@mail.ru>
Date: Sun, 26 Oct 2025 19:56:23 +0100
Subject: [PATCH 12/25] rxvt-unicode: skip unfree plugins by default

---
 pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix b/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix
index a161e9544265..8bd75245da0e 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix
@@ -16,7 +16,9 @@
 }:
 
 let
-  availablePlugins = lib.filterAttrs (_: v: lib.isDerivation v) rxvt-unicode-plugins;
+  availablePlugins = lib.filterAttrs (
+    _: v: (lib.isDerivation v && (v.meta.license.free or false))
+  ) rxvt-unicode-plugins;
 
   # Transform the string "self" to the plugin itself.
   # It's needed for plugins like bidi who depends on the perl

From 65bb095948c39864dae69a71ddd30e2150c75778 Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Sat, 5 Apr 2025 20:22:19 -0400
Subject: [PATCH 13/25] ci: fix issues found by zizmor

Co-authored-by: Thomas Gerbet <thomas@gerbet.me>
---
 .github/workflows/backport.yml           | 1 +
 .github/workflows/build.yml              | 1 +
 .github/workflows/check.yml              | 2 ++
 .github/workflows/eval.yml               | 8 +++++++-
 .github/workflows/labels.yml             | 1 +
 .github/workflows/lint.yml               | 3 +++
 .github/workflows/merge-group.yml        | 1 +
 .github/workflows/periodic-merge-24h.yml | 3 ++-
 .github/workflows/periodic-merge-6h.yml  | 3 ++-
 .github/workflows/periodic-merge.yml     | 5 +++++
 .github/workflows/pr.yml                 | 1 +
 .github/workflows/reviewers.yml          | 4 +++-
 .github/workflows/test.yml               | 1 +
 13 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 011e09a0023e..17a103c4ca7d 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -40,6 +40,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
 
       - name: Log current API rate limits
         env:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 918c82c94bbe..26d71b846369 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -46,6 +46,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout: .github/actions
       - name: Checkout the merge commit
         uses: ./.github/actions/checkout
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 0ee1146a4982..f55ff86dfdcf 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -34,6 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           path: trusted
           sparse-checkout: |
             ci/github-script
@@ -73,6 +74,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout: .github/actions
       - name: Checkout merge and target commits
         uses: ./.github/actions/checkout
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index dee31e1f5328..97d5c114acb0 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -34,6 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           path: trusted
           sparse-checkout: |
             ci/supportedVersions.nix
@@ -41,6 +42,7 @@ jobs:
       - name: Check out the PR at the test merge commit
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           ref: ${{ inputs.mergedSha }}
           path: untrusted
           sparse-checkout: |
@@ -84,6 +86,7 @@ jobs:
 
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout: .github/actions
       - name: Check out the PR at merged and target commits
         uses: ./.github/actions/checkout
@@ -155,6 +158,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout: .github/actions
       - name: Check out the PR at the target commit
         uses: ./.github/actions/checkout
@@ -181,8 +185,9 @@ jobs:
       - name: Compare against the target branch
         env:
           AUTHOR_ID: ${{ github.event.pull_request.user.id }}
+          TARGET_SHA: ${{ inputs.mergedSha }}
         run: |
-          git -C nixpkgs/trusted diff --name-only ${{ inputs.mergedSha }} \
+          git -C nixpkgs/trusted diff --name-only "$TARGET_SHA" \
             | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
 
           # Use the target branch to get accurate maintainer info
@@ -318,6 +323,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout: .github/actions
       - name: Checkout the merge commit
         uses: ./.github/actions/checkout
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 3e520139bc28..74838ebb52ae 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -46,6 +46,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout: |
             ci/github-script
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index cb7a61edad83..358e090a7b2b 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -26,6 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout: .github/actions
       - name: Checkout the merge commit
         uses: ./.github/actions/checkout
@@ -60,6 +61,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout: .github/actions
       - name: Checkout the merge commit
         uses: ./.github/actions/checkout
@@ -87,6 +89,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout: .github/actions
       - name: Checkout merge and target commits
         uses: ./.github/actions/checkout
diff --git a/.github/workflows/merge-group.yml b/.github/workflows/merge-group.yml
index 6ae96f0900f7..24ab1095ea7d 100644
--- a/.github/workflows/merge-group.yml
+++ b/.github/workflows/merge-group.yml
@@ -24,6 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout: |
             ci/supportedSystems.json
 
diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index 63e3dfd13887..481a54191349 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -43,4 +43,5 @@ jobs:
       from: ${{ matrix.pairs.from }}
       into: ${{ matrix.pairs.into }}
     name: ${{ matrix.pairs.name || format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }}
-    secrets: inherit
+    secrets:
+      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/periodic-merge-6h.yml b/.github/workflows/periodic-merge-6h.yml
index 054ac713fe74..edd4cb0b2df6 100644
--- a/.github/workflows/periodic-merge-6h.yml
+++ b/.github/workflows/periodic-merge-6h.yml
@@ -42,4 +42,5 @@ jobs:
       from: ${{ matrix.pairs.from }}
       into: ${{ matrix.pairs.into }}
     name: ${{ format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }}
-    secrets: inherit
+    secrets:
+      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml
index 04c80ae9735c..606c03866e6f 100644
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -11,6 +11,9 @@ on:
         description: Target branch to merge into.
         required: true
         type: string
+    secrets:
+      NIXPKGS_CI_APP_PRIVATE_KEY:
+        required: true
 
 defaults:
   run:
@@ -32,6 +35,8 @@ jobs:
           permission-pull-requests: write
 
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
 
       - name: Find merge base between two branches
         if: contains(inputs.from, ' ')
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index d443d68cdad9..1ba548a4c44e 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -34,6 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
           sparse-checkout: |
             ci/github-script
diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index 245970531477..22ac1bb5bcd4 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -29,6 +29,7 @@ jobs:
       - name: Check out the PR at the base commit
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           path: trusted
           sparse-checkout: ci
 
@@ -146,6 +147,7 @@ jobs:
         if: ${{ steps.app-token.outputs.token }}
         env:
           GH_TOKEN: ${{ github.token }}
+          APP_GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPOSITORY: ${{ github.repository }}
           NUMBER: ${{ github.event.number }}
           AUTHOR: ${{ github.event.pull_request.user.login }}
@@ -156,7 +158,7 @@ jobs:
           # There appears to be no API to request reviews based on GitHub IDs
           jq -r 'keys[]' comparison/maintainers.json \
             | while read -r id; do gh api /user/"$id" --jq .login; done \
-            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
+            | GH_TOKEN="$APP_GH_TOKEN" result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
 
       - name: Log current API rate limits (app-token)
         if: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4431e89954f3..67b416a6dfb2 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,6 +21,7 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
           sparse-checkout: |
             ci/github-script

From 5c1efadfb35feefd7d46abffd392a51da6102f2a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Oct 2025 19:52:24 +0000
Subject: [PATCH 14/25] gofumpt: 0.9.1 -> 0.9.2

---
 pkgs/by-name/go/gofumpt/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/gofumpt/package.nix b/pkgs/by-name/go/gofumpt/package.nix
index e17cab3def16..3568eb7bae23 100644
--- a/pkgs/by-name/go/gofumpt/package.nix
+++ b/pkgs/by-name/go/gofumpt/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gofumpt";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = "gofumpt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2JahPQQfiYfctMi7AqNB9Y1dS1Pg8usLtzM2wSlC5E0=";
+    hash = "sha256-ngqg8YJHqW08hvZp+E+RLLjGArOZJov7/xKCMAWFI1E=";
   };
 
-  vendorHash = "sha256-ziqhBWkfWQ0T+gLFqv352PtNcpyCTRFHBfV6iilVGLs=";
+  vendorHash = "sha256-qCXpFxTZIhDDvvwytvftBnMwOHopO6/FkBWcLZhBDp8=";
 
   env.CGO_ENABLED = "0";
 

From 1a9867167dd7c954a01ef78b03cf8ca7a7d0a30d Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Sat, 5 Apr 2025 20:22:25 -0400
Subject: [PATCH 15/25] ci: add zizmor check and configuration

`zizmor` is a tool that uses static analysis to find potential security
issues in GitHub Actions [0]. (Yes, it's a bit absurd that GitHub
made a CI system so complicated that tools like this were created, but
I digress.)

Given our increase in GHA usage recently, I think this is a good step
towards keeping our security posture in tip-top shape. (It also keeps
with the theme of automating as many things as possible!)

The rule related to the usages of dangerous-triggers have been disabled
to avoid false-positives. Explanations about the usage of
`pull_request_target` and expectations around its usage can be found in
`.github/workflows/README.md`.

[0]: https://woodruffw.github.io/zizmor/

Co-authored-by: Thomas Gerbet <thomas@gerbet.me>
---
 .github/zizmor.yml | 12 ++++++++++++
 ci/default.nix     |  2 ++
 2 files changed, 14 insertions(+)
 create mode 100644 .github/zizmor.yml

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 000000000000..f1b71580ebca
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,12 @@
+# This file defines the ignore rules for zizmor.
+#
+# For rules that contain a high number of false positives, prefer listing them here
+# instead of adding ignore comments. Note that zizmor cannot ignore by line-within-a-string, so
+# there are some ignore items that encompass multiple problems within one `run` block. An issue
+# tracking this is at https://github.com/woodruffw/zizmor/issues/648.
+#
+# For more info, see the documentation: https://woodruffw.github.io/zizmor/usage/#ignoring-results
+
+rules:
+  dangerous-triggers:
+    disable: true
diff --git a/ci/default.nix b/ci/default.nix
index 7b7424f4f5be..972c679a1492 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -136,6 +136,8 @@ let
             [ "--config=${config}" ];
           includes = [ "*.md" ];
         };
+
+        programs.zizmor.enable = true;
       };
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {

From afed1365ffaeb7b799632c73da1788d4c84f1582 Mon Sep 17 00:00:00 2001
From: magicquark <198001825+magicquark@users.noreply.github.com>
Date: Wed, 22 Oct 2025 04:49:36 +0100
Subject: [PATCH 16/25] qt6Packages.qxlsx: add fix for qt 6.10

`qxlsx` is failing to build with `nix-pkg-review`, with this error:

qxlsx> CMake Error at CMakeLists.txt:167 (target_link_libraries):
qxlsx>   Target "QXlsx" links to:
qxlsx>
qxlsx>     Qt6::GuiPrivate
qxlsx>
qxlsx>   but the target was not found.

The upstream `qxlsx` has been patched to fix this, but as a new upstream
version has not been released, this fix is not present in `nixpkgs` even
though `nixpkgs` has now bumped `qt6` to version 6.10.0 in PR 449572.

Thus, directly apply the patch made in this commit:
https://github.com/QtExcel/QXlsx/commit/90d762625750c6b2c73f6cd96b633e9158aed72e
---
 pkgs/development/libraries/qxlsx/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/libraries/qxlsx/default.nix b/pkgs/development/libraries/qxlsx/default.nix
index a9280ae76f47..59b734382ab6 100644
--- a/pkgs/development/libraries/qxlsx/default.nix
+++ b/pkgs/development/libraries/qxlsx/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   qtbase,
 }:
@@ -17,6 +18,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-twOlAiLE0v7+9nWo/Gd+oiKT1umL3UnG1Xa0zDG7u7s=";
   };
 
+  patches = [
+    # Fix for Qt 6.10, can likely be removed when version bump passes v1.5.0.
+    (fetchpatch {
+      url = "https://github.com/QtExcel/QXlsx/commit/90d762625750c6b2c73f6cd96b633e9158aed72e.patch";
+      hash = "sha256-/0xLrkjuJGZRocK1EyBhuaUmg0usueQz2F340DkQhb0=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ qtbase ];
 

From 560552a983a277cfbe7058b612f97e4ea313bcdf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 26 Oct 2025 22:25:56 +0000
Subject: [PATCH 17/25] python3Packages.dnf4: 4.23.0 -> 4.24.0

---
 pkgs/development/python-modules/dnf4/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dnf4/default.nix b/pkgs/development/python-modules/dnf4/default.nix
index 980e49b917b6..f1670daac402 100644
--- a/pkgs/development/python-modules/dnf4/default.nix
+++ b/pkgs/development/python-modules/dnf4/default.nix
@@ -18,7 +18,7 @@ in
 
 buildPythonPackage rec {
   pname = "dnf4";
-  version = "4.23.0";
+  version = "4.24.0";
   format = "other";
 
   outputs = [
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "rpm-software-management";
     repo = "dnf";
     tag = version;
-    hash = "sha256-qlOnFtEURhyxfsprhRaYUj141vZJp8qMjLpP1wGxikw=";
+    hash = "sha256-zzWOc2I9YW5gjsS2Umfx6GGgY4B3pdia0E2KHHtAH2s=";
   };
 
   patches = [ ./fix-python-install-dir.patch ];

From ae2f6f2c74092df3d0d4812e6264525e2095328f Mon Sep 17 00:00:00 2001
From: magicquark <198001825+magicquark@users.noreply.github.com>
Date: Sun, 26 Oct 2025 20:04:19 +0000
Subject: [PATCH 18/25] stellarium: fix build on qt610

---
 .../applications/science/astronomy/stellarium/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/applications/science/astronomy/stellarium/default.nix b/pkgs/applications/science/astronomy/stellarium/default.nix
index e883582bdcc8..ca6a9c36fa21 100644
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   perl,
   wrapGAppsHook3,
@@ -37,6 +38,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-9uQ6u1+dSszmKG8eY6kSXhqsCPRGw6tulCTCrLByIxc=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/stellarium/-/raw/ab559b6e9349569278f83c2dfc83990e971a8cb2/qt-6.10.patch";
+      hash = "sha256-a7zC9IQOj93VnPy8Bj/fLe4oJux7I4Edgj5OaKI4TZU=";
+    })
+  ];
+
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace CMakeLists.txt \
       --replace-fail 'SET(CMAKE_INSTALL_PREFIX "''${PROJECT_BINARY_DIR}/Stellarium.app/Contents")' \

From ce0937bc1d8da74461df0c27e6bae698fa69c547 Mon Sep 17 00:00:00 2001
From: magicquark <198001825+magicquark@users.noreply.github.com>
Date: Sun, 26 Oct 2025 22:34:16 +0000
Subject: [PATCH 19/25] stellarium: migrate to pkgs/by-name

---
 .../st/stellarium/package.nix}                | 36 ++++++++-----------
 pkgs/top-level/all-packages.nix               |  2 --
 2 files changed, 14 insertions(+), 24 deletions(-)
 rename pkgs/{applications/science/astronomy/stellarium/default.nix => by-name/st/stellarium/package.nix} (87%)

diff --git a/pkgs/applications/science/astronomy/stellarium/default.nix b/pkgs/by-name/st/stellarium/package.nix
similarity index 87%
rename from pkgs/applications/science/astronomy/stellarium/default.nix
rename to pkgs/by-name/st/stellarium/package.nix
index ca6a9c36fa21..28b977fc7117 100644
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/by-name/st/stellarium/package.nix
@@ -6,19 +6,11 @@
   cmake,
   perl,
   wrapGAppsHook3,
-  wrapQtAppsHook,
-  qtbase,
-  qtcharts,
-  qtpositioning,
-  qtmultimedia,
-  qtserialport,
-  qtwayland,
-  qtwebengine,
+  qt6,
+  qt6Packages,
   calcmysky,
-  qxlsx,
   indilib,
   libnova,
-  qttools,
   exiv2,
   nlopt,
   testers,
@@ -50,26 +42,26 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'SET(CMAKE_INSTALL_PREFIX "''${PROJECT_BINARY_DIR}/Stellarium.app/Contents")' \
                 'SET(CMAKE_INSTALL_PREFIX "${placeholder "out"}/Applications/Stellarium.app/Contents")'
     substituteInPlace src/CMakeLists.txt \
-      --replace-fail "\''${_qt_bin_dir}/../" "${qtmultimedia}/lib/qt-6/"
+      --replace-fail "\''${_qt_bin_dir}/../" "${qt6.qtmultimedia}/lib/qt-6/"
   '';
 
   nativeBuildInputs = [
     cmake
     perl
     wrapGAppsHook3
-    wrapQtAppsHook
-    qttools
+    qt6.wrapQtAppsHook
+    qt6.qttools
   ];
 
   buildInputs = [
-    qtbase
-    qtcharts
-    qtpositioning
-    qtmultimedia
-    qtserialport
-    qtwebengine
+    qt6.qtbase
+    qt6.qtcharts
+    qt6.qtpositioning
+    qt6.qtmultimedia
+    qt6.qtserialport
+    qt6.qtwebengine
     calcmysky
-    qxlsx
+    qt6Packages.qxlsx
     indilib
     libnova
     exiv2
@@ -77,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
     nlopt
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
-    qtwayland
+    qt6.qtwayland
   ];
 
   preConfigure = ''
@@ -88,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # fatal error: 'QtSerialPort/QSerialPortInfo' file not found
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-F${qtserialport}/lib";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-F${qt6.qtserialport}/lib";
 
   dontWrapGApps = true;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 486b519307ce..bc2b17fbb49b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -14232,8 +14232,6 @@ with pkgs;
 
   spyder = with python3.pkgs; toPythonApplication spyder;
 
-  stellarium = qt6Packages.callPackage ../applications/science/astronomy/stellarium { };
-
   tulip = libsForQt5.callPackage ../applications/science/misc/tulip {
     python3 = python312; # fails to build otherwise
   };

From 3261ab06006349e0697975ba4e2377d840f0a3a3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Oct 2025 00:36:53 +0000
Subject: [PATCH 20/25] limine: 10.1.1 -> 10.2.0

---
 pkgs/by-name/li/limine/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index c37a67fdc47f..9b34ffa7890e 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "10.1.1";
+  version = "10.2.0";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-pDhA8N7a5cTorIW8OgCimOxxfZ2slUhp3K+cb8KIAzc=";
+    hash = "sha256-eKoKjRJ+JbawucYXNvYrRMtkdybnxB3G1xk/7KR4YSI=";
   };
 
   enableParallelBuilding = true;

From 826567fc2347835a802670ad6bf20a8e4fd61ce5 Mon Sep 17 00:00:00 2001
From: EarthenGarland <>
Date: Wed, 22 Oct 2025 17:38:14 +0300
Subject: [PATCH 21/25] linuxKernel.kernels.linux_rt_{}: modify update script
 for sha256 -> hash

---
 pkgs/os-specific/linux/kernel/update-rt.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/update-rt.sh b/pkgs/os-specific/linux/kernel/update-rt.sh
index a9e0577fae92..38221e97716f 100755
--- a/pkgs/os-specific/linux/kernel/update-rt.sh
+++ b/pkgs/os-specific/linux/kernel/update-rt.sh
@@ -55,8 +55,8 @@ update-if-needed() {
         echo "$nixattr: $cur (up-to-date)"
         return
     fi
-    khash=$(nix-prefetch-url "$mirror/v${major}.x/linux-${kversion}.tar.xz")
-    phash=$(nix-prefetch-url "$mirror/projects/rt/${branch}/older/patch-${new}.patch.xz")
+    khash=$(nix-prefetch-url "$mirror/v${major}.x/linux-${kversion}.tar.xz" | nix-hash --type sha256 --to-sri)
+    phash=$(nix-prefetch-url "$mirror/projects/rt/${branch}/older/patch-${new}.patch.xz" | nix-hash --type sha256 --to-sri)
     if [ "$cur" ]; then
         msg="$nixattr: $cur -> $new"
     else
@@ -69,8 +69,8 @@ update-if-needed() {
     sed -i "$file" \
         -e "s/$cur/$new/" \
         -e "s|kernel/v[0-9]*|kernel/v$major|" \
-        -e "1,/.patch.xz/ s/sha256 = .*/sha256 = \"$khash\";/" \
-        -e "1,/.patch.xz/! s/sha256 = .*/sha256 = \"$phash\";/"
+        -e "1,/.patch.xz/ s|hash = .*|hash = \"$khash\";|" \
+        -e "1,/.patch.xz/! s|hash = .*|hash = \"$phash\";|"
     if [ "${COMMIT:-}" ]; then
         git add "$file"
         git commit -m "$msg"

From 9c13cbe1b5487107a5c1f2ace25ab38ae9305efa Mon Sep 17 00:00:00 2001
From: EarthenGarland <>
Date: Fri, 24 Oct 2025 16:05:24 +0300
Subject: [PATCH 22/25] linuxKernel.kernels.linux_rt_6_6: sha256 -> hash

---
 pkgs/os-specific/linux/kernel/linux-rt-6.6.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
index 5ce2e345bc97..d6783e3f3fe4 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-      sha256 = "08la2f8w5w2x0l9nmvzsmbwa951xyshhvdhwwhfyjmka66zr4zbc";
+      hash = "sha256-bH2SvzFqVukd5By2DaH2PZSk+Kr672oTBV3wwpETiiI=";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "01z2dwl54hfqfyc8xmlz6kaw522s55jsdrdw31pjnzkn6rxf7zbf";
+            hash = "sha256-bv3jejZ2fitvGLzlpmUpWojC1TSf1o6Yd9hBUihv4gc=";
           };
         };
       in

From f6ae789da3c133a3889a49e084fbb77f6b803a20 Mon Sep 17 00:00:00 2001
From: EarthenGarland <>
Date: Fri, 24 Oct 2025 16:06:26 +0300
Subject: [PATCH 23/25] linuxKernel.kernels.linux_rt_6_1: sha256 -> hash

---
 pkgs/os-specific/linux/kernel/linux-rt-6.1.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index 508da7ec98cd..25ee763a96b2 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-      sha256 = "13i2l04pmba7dksz2p5kwxgr5bydc5lp7284d4wfsnjf425i9fyl";
+      hash = "sha256-1LsUiyBOWu04aQSJc2lhza+SX+ezXPH1bEetegmgIo4=";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1smah5wa4lrgb13li025lpj80yxay4g13m7c4i09whxcgxhc294k";
+            hash = "sha256-kyTBYH+sQ55AJOzUER7xqnuA5KVFgEhHWC9ToniBquo=";
           };
         };
       in

From 57b4fd20badd0f8ef1346f9126bc9eb1a0cc9e6c Mon Sep 17 00:00:00 2001
From: EarthenGarland <>
Date: Fri, 24 Oct 2025 16:07:18 +0300
Subject: [PATCH 24/25] linuxKernel.kernels.linux_rt_5_15: sha256 -> hash

---
 pkgs/os-specific/linux/kernel/linux-rt-5.15.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
index 822d06217b1e..a694cf30d818 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-      sha256 = "0hd4p76qv29zlr0iik4j9y9qynyqisk6bgfiqcwkk7gr6bf81l13";
+      hash = "sha256-I9CA3DL5nTk5w9G9ZaaO2FuPk0+SzBhBpj+Jjc25pEE=";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "15n1l3b0yq7hl2zady3s3a3zym82clyycvf5icavvd68758sdp25";
+            hash = "sha256-RdymUTnItL0Vi8Vt5j1lAlX/hxp6+Ka+oPBgD9agwZY=";
           };
         };
       in

From 342a27929bf8d88ea5d71cc7fe76899e3286228d Mon Sep 17 00:00:00 2001
From: EarthenGarland <>
Date: Fri, 24 Oct 2025 16:08:07 +0300
Subject: [PATCH 25/25] linuxKernel.kernels.linux_rt_5_10: sha256 -> hash

---
 pkgs/os-specific/linux/kernel/linux-rt-5.10.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index c3c11fd7cd94..85fb35f38dbf 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -25,7 +25,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-      sha256 = "17wxs8i8vd5ivv99ra0sri3wmkw5c22wsaw8nf1xcvys2kmpa7hk";
+      hash = "sha256-Ex516xTab9aDs4grzYVghc/KR8waqJzS3rG0jSLSnZ8=";
     };
 
     kernelPatches =
@@ -34,7 +34,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1nqdshpcf775cmb1kqcq939b7qx6wsy91pf0l0vsd3rdpixidzyk";
+            hash = "sha256-0/8We7wtj6Y3oMDdkLzmpuOz0kiY4RlWZeUcxy7UDds=";
           };
         };
       in