From 148a5ecf9de7380ce8c6b38932eb7bc98f9ca1eb Mon Sep 17 00:00:00 2001
From: Ulysses Zhan <UlyssesZhan@gmail.com>
Date: Fri, 20 Mar 2026 11:15:27 -0700
Subject: [PATCH 01/28] mojoshader: init at 0-unstable-2026-02-10

---
 pkgs/by-name/mo/mojoshader/package.nix | 80 ++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 pkgs/by-name/mo/mojoshader/package.nix

diff --git a/pkgs/by-name/mo/mojoshader/package.nix b/pkgs/by-name/mo/mojoshader/package.nix
new file mode 100644
index 000000000000..ecf3dd311254
--- /dev/null
+++ b/pkgs/by-name/mo/mojoshader/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  writeScript,
+  writeShellScriptBin,
+  cmake,
+  SDL2,
+  dxvk_2,
+}:
+
+let
+  fakeGit = writeShellScriptBin "git" ''
+    if [[ "$1" = "rev-parse" ]]; then
+      echo $out
+    elif [[ "$1" = "rev-list" ]]; then
+      cat $src/.gitrev
+    else
+      echo "fakeGit: unexpected git command: $@" >&2
+      exit 1
+    fi
+  '';
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mojoshader";
+  version = "0-unstable-2026-02-10";
+
+  src = fetchFromGitHub {
+    owner = "icculus";
+    repo = "mojoshader";
+    rev = "abdc80360c1d4560ab8f356035dcd53ae6e9b87f";
+    postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
+    hash = "sha256-NWXJfi12zLDDg8jvC+G/Dxf2CZPWtSjYFSo/6EV6qxY=";
+  };
+
+  buildInputs = [ SDL2 ];
+
+  nativeBuildInputs = [
+    cmake
+    fakeGit # https://github.com/icculus/mojoshader/blob/abdc80360c1d4560ab8f356035dcd53ae6e9b87f/CMakeLists.txt#L41-L68
+  ];
+
+  NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.hostPlatform.isDarwin) "-I${dxvk_2}/include/dxvk";
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "FLIP_VIEWPORT" true)
+    (lib.cmakeBool "DEPTH_CLIPPING" true)
+    (lib.cmakeBool "XNA4_VERTEXTEXTURE" true)
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    install -Dm644 libmojoshader.* -t $out/lib
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = writeScript "update.sh" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl jq common-updater-scripts
+
+    set -euo pipefail
+
+    response=$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL "https://api.github.com/repos/${finalAttrs.src.owner}/${finalAttrs.src.repo}/commits?per_page=1")
+    rev=$(echo "$response" | jq -r '.[0].sha')
+    date=$(echo "$response" | jq -r '.[0].commit.committer.date' | cut -c1-10)
+    update-source-version mojoshader 0-unstable-$date --rev=$rev
+  '';
+
+  meta = {
+    description = "Library to work with Direct3D shaders on alternate 3D APIs and non-Windows platforms";
+    homepage = "https://icculus.org/mojoshader";
+    license = lib.licenses.zlib;
+    maintainers = with lib.maintainers; [ ulysseszhan ];
+    platforms = lib.platforms.unix;
+  };
+})

From 7767dd4b4e33b016a6ec7283b50a1629e781e002 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 27 Mar 2026 23:12:53 +0100
Subject: [PATCH 02/28] turbo-unwrapped: fix passthru.updateScript

---
 pkgs/by-name/tu/turbo-unwrapped/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/tu/turbo-unwrapped/package.nix b/pkgs/by-name/tu/turbo-unwrapped/package.nix
index 51e16fd96468..24c4eca77d37 100644
--- a/pkgs/by-name/tu/turbo-unwrapped/package.nix
+++ b/pkgs/by-name/tu/turbo-unwrapped/package.nix
@@ -69,8 +69,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru = {
     updateScript = nix-update-script {
       extraArgs = [
-        "--version-regex"
-        "v(\\d+\\.\\d+\\.\\d+)$"
+        "--use-github-releases"
       ];
     };
   };

From dbb5885d2af6a11d56ca73fbab0261c42e807947 Mon Sep 17 00:00:00 2001
From: Cameron Smith <cameron.ray.smith@gmail.com>
Date: Mon, 30 Mar 2026 13:09:29 -0400
Subject: [PATCH 03/28] duckdb: add cameronraysmith as maintainer

---
 pkgs/by-name/du/duckdb/package.nix                 | 1 +
 pkgs/development/python-modules/duckdb/default.nix | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix
index 9849e2f7e01b..69bc6608415e 100644
--- a/pkgs/by-name/du/duckdb/package.nix
+++ b/pkgs/by-name/du/duckdb/package.nix
@@ -144,6 +144,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     mainProgram = "duckdb";
     maintainers = with lib.maintainers; [
+      cameronraysmith
       costrouc
       cpcloud
     ];
diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index 2f9287fd4b35..9736c5eeae5f 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -145,6 +145,9 @@ buildPythonPackage rec {
     description = "Python binding for DuckDB";
     homepage = "https://duckdb.org/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ cpcloud ];
+    maintainers = with lib.maintainers; [
+      cameronraysmith
+      cpcloud
+    ];
   };
 }

From c817228a5fbd894d0d76616f9fbbd32c44a78362 Mon Sep 17 00:00:00 2001
From: Cameron Smith <cameron.ray.smith@gmail.com>
Date: Mon, 30 Mar 2026 13:08:47 -0400
Subject: [PATCH 04/28] duckdb: 1.4.4 -> 1.5.1

https://github.com/duckdb/duckdb/releases/tag/v1.5.1
---
 pkgs/by-name/du/duckdb/versions.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/du/duckdb/versions.json b/pkgs/by-name/du/duckdb/versions.json
index c570a27d61ca..14c629fe5313 100644
--- a/pkgs/by-name/du/duckdb/versions.json
+++ b/pkgs/by-name/du/duckdb/versions.json
@@ -1,6 +1,6 @@
 {
-  "version": "1.4.4",
-  "rev": "6ddac802ffa9bcfbcc3f5f0d71de5dff9b0bc250",
-  "hash": "sha256-h9Mldv29u47DnFOCN28HBHWz8daFGE/Nj1JcnNhhQ5Q=",
-  "python_hash": "sha256-860KbaM7Ojp4Qwm5x5WPQg176XKOYayk8pLVaUAuC4M="
+  "version": "1.5.1",
+  "rev": "7dbb2e646fea939a89f10a55aa98c474cbb0c098",
+  "hash": "sha256-FygBpfhvezvUbI969Dta+vZOPt6BnSW2d5gO4I4oB2A=",
+  "python_hash": "sha256-ZB+Zcxg5VjBzfTkQk7TxoP9pw+hvOXpB2qqnqqmjhxM="
 }

From 8674da8f81ece1d3e51fd416284e2fd1d0eae3ee Mon Sep 17 00:00:00 2001
From: Cameron Smith <cameron.ray.smith@gmail.com>
Date: Mon, 30 Mar 2026 13:09:01 -0400
Subject: [PATCH 05/28] duckdb: exclude iejoin tests on darwin

The iejoin implementation was rewritten in 1.5.x with new parallel task
scheduling that crashes with SIGTRAP on aarch64-darwin. The crash is
non-deterministic across all 14 iejoin test files, reproducible both with
and without the nix sandbox. All remaining ~4370 tests pass.
---
 pkgs/by-name/du/duckdb/package.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix
index 69bc6608415e..905eab0038ee 100644
--- a/pkgs/by-name/du/duckdb/package.nix
+++ b/pkgs/by-name/du/duckdb/package.nix
@@ -122,6 +122,24 @@ stdenv.mkDerivation (finalAttrs: {
           "test/sql/function/list/aggregates/skewness.test"
           "test/sql/aggregate/aggregates/histogram_table_function.test"
         ]
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          # SIGTRAP during iejoin tests on aarch64-darwin (with and without sandbox)
+          # iejoin implementation rewritten in 1.5.x with new parallel task scheduling
+          "test/sql/join/iejoin/iejoin_issue_6861.test"
+          "test/sql/join/iejoin/iejoin_issue_7278.test"
+          "test/sql/join/iejoin/iejoin_projection_maps.test"
+          "test/sql/join/iejoin/merge_join_switch.test"
+          "test/sql/join/iejoin/predicate_expressions.test"
+          "test/sql/join/iejoin/test_countzeros.test"
+          "test/sql/join/iejoin/test_ieantijoin.test"
+          "test/sql/join/iejoin/test_iejoin.test"
+          "test/sql/join/iejoin/test_iejoin_east_west.test"
+          "test/sql/join/iejoin/test_iejoin_events.test"
+          "test/sql/join/iejoin/test_iejoin_null_keys.test"
+          "test/sql/join/iejoin/test_iejoin_overlaps.test"
+          "test/sql/join/iejoin/test_iejoin_predicate.test"
+          "test/sql/join/iejoin/test_iesemijoin.test"
+        ]
       );
       LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isDarwin "DY" + "LD_LIBRARY_PATH";
     in

From 4b2b5be22fa3e34fd1e5a6a60f355f70fcba8b20 Mon Sep 17 00:00:00 2001
From: Jamie Magee <jamie.magee@gmail.com>
Date: Mon, 30 Mar 2026 23:43:28 -0700
Subject: [PATCH 06/28] uboot: 2025.10 -> 2026.01

---
 pkgs/misc/uboot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index d58772e6463f..aee66f2f36e0 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -34,10 +34,10 @@
 }@pkgs:
 
 let
-  defaultVersion = "2025.10";
+  defaultVersion = "2026.01";
   defaultSrc = fetchurl {
     url = "https://ftp.denx.de/pub/u-boot/u-boot-${defaultVersion}.tar.bz2";
-    hash = "sha256-tPAyhI5WzI8hOtWfkTLAhNu7YyvCkXbQJOWCIODv30o=";
+    hash = "sha256-tg1YZc79vHXajaQVbFbEWOAN51pJuAwaLlipbjCtDVQ=";
   };
 
   # Dependencies for the tools need to be included as either native or cross,

From eb37af69ab439eb3e27ad2638198c51897c9757b Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 5 Apr 2026 13:44:41 +0200
Subject: [PATCH 07/28] poco: add passthru.updateScript

---
 pkgs/by-name/po/poco/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/po/poco/package.nix b/pkgs/by-name/po/poco/package.nix
index 9475a681a1d0..9183abea2921 100644
--- a/pkgs/by-name/po/poco/package.nix
+++ b/pkgs/by-name/po/poco/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
+  nix-update-script,
   pkg-config,
   zlib,
   pcre2,
@@ -109,6 +110,10 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version-regex=poco-(.*)-release" ];
+  };
+
   meta = {
     homepage = "https://pocoproject.org/";
     description = "Cross-platform C++ libraries with a network/internet focus";

From d2a0513c7bbae548c4b666aa0bd440de672c693e Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 5 Apr 2026 13:58:09 +0200
Subject: [PATCH 08/28] poco: 1.14.2 -> 1.15.1

changelog: https://github.com/pocoproject/poco/releases/tag/poco-1.15.1-release

diff: https://github.com/pocoproject/poco/compare/poco-1.14.2-release...poco-1.15.1-release
---
 .../by-name/po/poco/disable-flaky-tests.patch | 18 ----------
 pkgs/by-name/po/poco/package.nix              | 33 +++++++------------
 2 files changed, 12 insertions(+), 39 deletions(-)
 delete mode 100644 pkgs/by-name/po/poco/disable-flaky-tests.patch

diff --git a/pkgs/by-name/po/poco/disable-flaky-tests.patch b/pkgs/by-name/po/poco/disable-flaky-tests.patch
deleted file mode 100644
index 4f3b6ca5833e..000000000000
--- a/pkgs/by-name/po/poco/disable-flaky-tests.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/Foundation/testsuite/src/ExpireLRUCacheTest.cpp b/Foundation/testsuite/src/ExpireLRUCacheTest.cpp
---- a/Foundation/testsuite/src/ExpireLRUCacheTest.cpp
-+++ b/Foundation/testsuite/src/ExpireLRUCacheTest.cpp
-@@ -336 +336 @@
--	CppUnit_addTest(pSuite, ExpireLRUCacheTest, testExpireN);
-+	// CppUnit_addTest(pSuite, ExpireLRUCacheTest, testExpireN);
-diff --git a/Foundation/testsuite/src/TimestampTest.cpp b/Foundation/testsuite/src/TimestampTest.cpp
---- a/Foundation/testsuite/src/TimestampTest.cpp
-+++ b/Foundation/testsuite/src/TimestampTest.cpp
-@@ -97 +97 @@
--	CppUnit_addTest(pSuite, TimestampTest, testTimestamp);
-+	// CppUnit_addTest(pSuite, TimestampTest, testTimestamp);
-diff --git a/Foundation/testsuite/src/UniqueExpireCacheTest.cpp b/Foundation/testsuite/src/UniqueExpireCacheTest.cpp
---- a/Foundation/testsuite/src/UniqueExpireCacheTest.cpp
-+++ b/Foundation/testsuite/src/UniqueExpireCacheTest.cpp
-@@ -248 +248 @@
--	CppUnit_addTest(pSuite, UniqueExpireCacheTest, testExpireN);
-+	// CppUnit_addTest(pSuite, UniqueExpireCacheTest, testExpireN);
diff --git a/pkgs/by-name/po/poco/package.nix b/pkgs/by-name/po/poco/package.nix
index 9183abea2921..a0aad31cf36e 100644
--- a/pkgs/by-name/po/poco/package.nix
+++ b/pkgs/by-name/po/poco/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   nix-update-script,
   pkg-config,
@@ -14,19 +13,20 @@
   openssl,
   unixodbc,
   libmysqlclient,
+  libpng,
   writableTmpDirAsHomeHook,
 }:
 
 stdenv.mkDerivation rec {
   pname = "poco";
 
-  version = "1.14.2";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "pocoproject";
     repo = "poco";
-    hash = "sha256-koREkrfAHWfpqITN5afiXwZg37Wve2Ftx8sr8t2bSV4=";
-    rev = "poco-${version}-release";
+    hash = "sha256-JyjEs5aecKSdrNEaSs4Dzs3mAu2rhhBNAG93VLHdU3E=";
+    tag = "poco-${version}-release";
   };
 
   nativeBuildInputs = [
@@ -37,6 +37,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     unixodbc
     libmysqlclient
+    libpng
   ];
 
   propagatedBuildInputs = [
@@ -79,23 +80,13 @@ stdenv.mkDerivation rec {
       (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;'${excludeTestsRegex}'")
     ];
 
-  patches = [
-    # Remove on next release
-    (fetchpatch {
-      name = "disable-included-pcre-if-pcre-is-linked-staticly";
-      # this happens when building pkgsStatic.poco
-      url = "https://patch-diff.githubusercontent.com/raw/pocoproject/poco/pull/4879.patch";
-      hash = "sha256-VFWuRuf0GPYFp43WKI8utl+agP+7a5biLg7m64EMnVo=";
-    })
-    # https://github.com/pocoproject/poco/issues/4977
-    ./disable-flaky-tests.patch
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    ./disable-broken-tests-darwin.patch
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    ./disable-broken-tests-linux.patch
-  ];
+  patches =
+    lib.optionals stdenv.hostPlatform.isDarwin [
+      ./disable-broken-tests-darwin.patch
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      ./disable-broken-tests-linux.patch
+    ];
 
   doCheck = true;
   nativeCheckInputs = [

From 06f6d2f85d5a959e4ec8901081b7777b3f1f8881 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 5 Apr 2026 12:26:41 +0000
Subject: [PATCH 09/28] searxng: 0-unstable-2026-03-27 -> 0-unstable-2026-04-05

---
 pkgs/by-name/se/searxng/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index b7c9743af3d5..867d9dd1379d 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -13,14 +13,14 @@ in
 python.pkgs.toPythonModule (
   python.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2026-03-27";
+    version = "0-unstable-2026-04-05";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "265858ee2bd983ac3872303e5c55d2cdda5e500a";
-      hash = "sha256-G71XX6TAxeUk1Uw9HeeqK82wejnAE45qnWdQh117PDU=";
+      rev = "474b0a55b0cb09a3bb6e18d5579836058b075584";
+      hash = "sha256-xRI9JpF/Kx0DNZeGS1CW25j7DVq0fs6tlrGSjcl6k1Y=";
     };
 
     nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];

From baeefc9276b667bc38db2b4eb3c85d8ec779a7cf Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 5 Apr 2026 13:58:48 +0200
Subject: [PATCH 10/28] poco: add hythera as maintainer

---
 pkgs/by-name/po/poco/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/po/poco/package.nix b/pkgs/by-name/po/poco/package.nix
index a0aad31cf36e..22a783f84e61 100644
--- a/pkgs/by-name/po/poco/package.nix
+++ b/pkgs/by-name/po/poco/package.nix
@@ -110,6 +110,7 @@ stdenv.mkDerivation rec {
     description = "Cross-platform C++ libraries with a network/internet focus";
     license = lib.licenses.boost;
     maintainers = with lib.maintainers; [
+      hythera
       tomodachi94
     ];
     platforms = lib.platforms.unix;

From d9e8b605786b21cca0eafc81e54c92645bf858d8 Mon Sep 17 00:00:00 2001
From: eilvelia <hi@eilvelia.cat>
Date: Wed, 8 Apr 2026 11:41:34 +0000
Subject: [PATCH 11/28] check-sieve: 0.11 -> 1.0.0

---
 pkgs/by-name/ch/check-sieve/package.nix | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/ch/check-sieve/package.nix b/pkgs/by-name/ch/check-sieve/package.nix
index e07ce964f47d..3148570e1a73 100644
--- a/pkgs/by-name/ch/check-sieve/package.nix
+++ b/pkgs/by-name/ch/check-sieve/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "check-sieve";
-  version = "0.11";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "dburkart";
     repo = "check-sieve";
-    tag = "check-sieve-${finalAttrs.version}";
-    hash = "sha256-vmfHXjcZ5J/+kO3/a0p8krLOuC67+q8SxcPJgW+UaTw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dElVfLSVtlELleuxCScR6BGuLsJ+KRqcNA8y0lgrBfI=";
   };
 
   nativeBuildInputs = [
@@ -28,8 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
     (python3.withPackages (p: [ p.setuptools ]))
   ];
 
-  # https://github.com/dburkart/check-sieve/issues/67
-  # Remove after the next (>0.10) release
   env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
 
   installPhase = ''
@@ -39,17 +37,14 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   preCheck = ''
-    substituteInPlace test/AST/util.py \
+    substituteInPlace test/{AST,simulate}/util.py \
       --replace-fail "/usr/bin/diff" "${diffutils}/bin/diff"
-    # Disable flaky tests: https://github.com/dburkart/check-sieve/issues/68
-    # Remove after the next (>0.10) release
-    rm -rf test/{6785,7352}
   '';
 
   doCheck = true;
 
   passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version-regex=check-sieve-(.*)" ];
+    extraArgs = [ "--version-regex=v(.*)" ];
   };
 
   meta = {

From 9ac62ecd610df82312d4c396de11b446f94ce249 Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel.dionne-riel@cyberus-technology.de>
Date: Wed, 8 Apr 2026 14:09:28 -0400
Subject: [PATCH 12/28] doc/meta: Reword *logical values* for CPEs

The original wording missed the *not meaningful* nuance, and adding an
`or` clause within the sentence would have made it hard to understand.

Instead, it is now split into a list, and ordered in the same order as
found in `5.3.1` in NISTIR 7695.

The logical name used by the specification (ANY/NA) was also added.
---
 doc/stdenv/meta.chapter.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index 1e1e190b3eda..285211a401da 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -296,7 +296,10 @@ Some of them are as follows:
 
 You can find information about all of these attributes in the [official specification](https://csrc.nist.gov/projects/security-content-automation-protocol/specifications/cpe/naming) (heading 5.3.3, pages 11-13).
 
-Any fields that don't have a value are set to either `-` if the value is not available or `*` when the field can match any value.
+Any fields that don't have a value are set to either:
+
+* `*` (ANY) when the field can match any value
+* `-` (NA) when the value is not meaningful or not used in the description
 
 For example, for glibc 2.40.1 CPE would be `cpe:2.3:a:gnu:glibc:2.40:1:*:*:*:*:*:*`.
 

From e52e23f041e6802d5695258d61eb184428dab1cc Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel.dionne-riel@cyberus-technology.de>
Date: Wed, 8 Apr 2026 13:48:37 -0400
Subject: [PATCH 13/28] doc/meta: Fix documentation for `edition` CPE field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The field could have been simply removed from the list, as it is not
used, but it should be present in that form at least for *some
undefined* length of time to present as a correction for anyone using
the `edition` field mistakenly.

My claim comes from the literal source listed in the next paragraph
(NISTIR 7695), the first few words of `5.3.3.6` are:

> The edition attribute is considered deprecated

Thus we consider it deprecated.

Furthermore the section documents that it should be using the value
`ANY`. It could be considered debatable as `NA` should be used “when
there is no legal or meaningful value for that attribute, or when
that attribute is not used as part of the description”... But the spec
states that `ANY` should be used, so we state `ANY` should be used.
---
 doc/stdenv/meta.chapter.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index 285211a401da..d1823717b4b8 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -292,7 +292,7 @@ Some of them are as follows:
 * *product* - name of the package
 * *version* - version of the package
 * *update* - name of the latest update, can be a patch version for semantically versioned packages
-* *edition* - any additional specification about the version
+* *edition* - deprecated and should be set to `*`
 
 You can find information about all of these attributes in the [official specification](https://csrc.nist.gov/projects/security-content-automation-protocol/specifications/cpe/naming) (heading 5.3.3, pages 11-13).
 

From 8b81adddcd447992f404ce8678ce011ba000034f Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel.dionne-riel@cyberus-technology.de>
Date: Wed, 8 Apr 2026 13:55:08 -0400
Subject: [PATCH 14/28] doc/meta: Fix documentation and example for `update`
 CPE field

The previous claims are unsourced, since they are not supported by the
source given for CPEs.

Quoting from the 5.3.3.5 section of the NISTIR 7695 document:

> Values for this attribute SHOULD be vendor-specific alphanumeric
> strings characterizing the particular update, service pack, or
> point release of the product.

So, first, they should be ***vendor-specific***, and dare I say,
vendor-specified. But let's not trip on the carpet's flower pattern, and
instead look at evidence from data.

Using the data from `official-cpe-dictionary_v2.3.xml`, gently massaged
into a form that can be queried, we can list all known CPE expressions
for glibc.

There is only one known entry using the `update` field. It's:

```
cpe:2.3:a:gnu:glibc:2.0.5:b:*:*:*:*:*:*
```

As such, the current example is plainly and demonstrably wrong.

```
SELECT * FROM cpe
WHERE cpe_update != ''
   AND cpe_vendor = 'gnu'
   AND cpe_product = 'glibc'
ORDER BY cpe_vendor, cpe_product, cpe_version

id    |title            |cpe_part|cpe_vendor|cpe_product|cpe_version|cpe_update|cpe_edition|cpe_language|cpe_sw_edition|cpe_target_sw|cpe_target_hw|cpe_other|
------+-----------------+--------+----------+-----------+-----------+----------+-----------+------------+--------------+-------------+-------------+---------+
460867|GNU glibc 2.0.5 B|a       |gnu       |glibc      |2.0.5      |b         |           |            |              |             |             |         |
```

Let's see good examples of `cpe_product` in contrast:

```
SELECT * FROM cpe
WHERE cpe_update != ''
   AND cpe_vendor = 'gnu'
   AND cpe_product = 'bash'
ORDER BY cpe_vendor, cpe_product, cpe_version DESC
LIMIT 10

id    |title                                                         |cpe_part|cpe_vendor|cpe_product|cpe_version|cpe_update|cpe_edition|cpe_language|cpe_sw_edition|cpe_target_sw|cpe_target_hw|cpe_other|
------+--------------------------------------------------------------+--------+----------+-----------+-----------+----------+-----------+------------+--------------+-------------+-------------+---------+
460088|GNU Bourne-Again SHell bash (GNU Bash) 4.3.30 Beta 1          |a       |gnu       |bash       |4.3.30     |beta1     |           |            |              |             |             |         |
460086|GNU Bourne-Again SHell bash (GNU Bash) 4.2.53 Beta 1          |a       |gnu       |bash       |4.2.53     |beta1     |           |            |              |             |             |         |
460081|GNU Bourne-Again SHell bash (GNU Bash) 3.2.57 Beta 1          |a       |gnu       |bash       |3.2.57     |beta1     |           |            |              |             |             |         |
460140|GNU Bourne-Again SHell bash (GNU Bash) 5.2                    |a       |gnu       |bash       |5.2        |-         |           |            |              |             |             |         |
460141|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Alpha              |a       |gnu       |bash       |5.2        |alpha     |           |            |              |             |             |         |
460142|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Beta               |a       |gnu       |bash       |5.2        |beta      |           |            |              |             |             |         |
460143|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Release Candidate 1|a       |gnu       |bash       |5.2        |rc1       |           |            |              |             |             |         |
460144|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Release Candidate 2|a       |gnu       |bash       |5.2        |rc2       |           |            |              |             |             |         |
460145|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Release Candidate 3|a       |gnu       |bash       |5.2        |rc3       |           |            |              |             |             |         |
460146|GNU Bourne-Again SHell bash (GNU Bash) 5.2 Release Candidate 4|a       |gnu       |bash       |5.2        |rc4       |           |            |              |             |             |         |
```
---
 doc/stdenv/meta.chapter.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index d1823717b4b8..3eb2b5e23772 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -291,7 +291,7 @@ Some of them are as follows:
 * *vendor* - can point to the source of the package, or to Nixpkgs itself
 * *product* - name of the package
 * *version* - version of the package
-* *update* - name of the latest update, can be a patch version for semantically versioned packages
+* *update* - vendor-specific string part of the version string of the latest update (e.g. `rc1`, `beta`, etc...)
 * *edition* - deprecated and should be set to `*`
 
 You can find information about all of these attributes in the [official specification](https://csrc.nist.gov/projects/security-content-automation-protocol/specifications/cpe/naming) (heading 5.3.3, pages 11-13).
@@ -301,7 +301,7 @@ Any fields that don't have a value are set to either:
 * `*` (ANY) when the field can match any value
 * `-` (NA) when the value is not meaningful or not used in the description
 
-For example, for glibc 2.40.1 CPE would be `cpe:2.3:a:gnu:glibc:2.40:1:*:*:*:*:*:*`.
+For example, for glibc 2.40.1 CPE would be `cpe:2.3:a:gnu:glibc:2.40.1:*:*:*:*:*:*:*`.
 
 #### `meta.identifiers.cpeParts` {#var-meta-identifiers-cpeParts}
 

From a353d89292eff8f07056ed37fb948812297b432d Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel.dionne-riel@cyberus-technology.de>
Date: Wed, 8 Apr 2026 14:20:43 -0400
Subject: [PATCH 15/28] check-meta.nix: Stop suggesting invalid possible CPE
 values

See the previous commit for the explanation as to why this is an invalid
value. See the follow-up commits for the complete removal of the
helpers.
---
 pkgs/stdenv/generic/check-meta.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 79f1bf5f1d09..fbf72005f92d 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -39,7 +39,6 @@ let
   inherit (lib.meta)
     availableOn
     cpeFullVersionWithVendor
-    tryCPEPatchVersionInUpdateWithVendor
     ;
 
   inherit (lib.generators)
@@ -491,7 +490,6 @@ let
       success = true;
       value = cpeFullVersionWithVendor vendor version;
     })
-    tryCPEPatchVersionInUpdateWithVendor
   ];
 
   # The meta attribute is passed in the resulting attribute set,

From 95584fa133c347b887a6d0c9b45e43f5b8cc79e6 Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel.dionne-riel@cyberus-technology.de>
Date: Wed, 8 Apr 2026 14:21:55 -0400
Subject: [PATCH 16/28] doc/meta: Drop incorrect
 `cpePatchVersionInUpdateWithVendor`

See the previous commit for the explanation as to why this is an invalid
value. See the follow-up commits for the complete removal of the
helpers.
---
 doc/stdenv/meta.chapter.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index 3eb2b5e23772..1fac5244af66 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -317,14 +317,13 @@ It is up to the package author to make sure all parts are correct and match expe
 Following functions help with filling out `version` and `update` fields:
 
 * [`lib.meta.cpeFullVersionWithVendor`](#function-library-lib.meta.cpeFullVersionWithVendor)
-* [`lib.meta.cpePatchVersionInUpdateWithVendor`](#function-library-lib.meta.cpePatchVersionInUpdateWithVendor)
 
 For many packages to make CPE available it should be enough to specify only:
 
 ```nix
 {
   # ...
-  meta.identifiers.cpeParts = lib.meta.cpePatchVersionInUpdateWithVendor vendor version;
+  meta.identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor vendor version;
 }
 ```
 

From ee0f02af4467e7e67c06b0234571c3be45bc0423 Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel.dionne-riel@cyberus-technology.de>
Date: Wed, 8 Apr 2026 14:23:13 -0400
Subject: [PATCH 17/28] lib.meta: Drop incorrect
 `cpePatchVersionInUpdateWithVendor` and `cpePatchVersionInUpdateWithVendor`

See the previous commits for the explanation as to why this is an invalid
value. See the follow-up commits for the complete removal of the
helpers.
---
 lib/meta.nix | 128 ---------------------------------------------------
 1 file changed, 128 deletions(-)

diff --git a/lib/meta.nix b/lib/meta.nix
index 1a1676f56aff..3341caf0e0fb 100644
--- a/lib/meta.nix
+++ b/lib/meta.nix
@@ -633,132 +633,4 @@ rec {
     update = "*";
   };
 
-  /**
-    Alternate version of [`lib.meta.cpePatchVersionInUpdateWithVendor`](#function-library-lib.meta.cpePatchVersionInUpdateWithVendor).
-    If `cpePatchVersionInUpdateWithVendor` succeeds, returns an attribute set with `success` set to `true` and `value` set to the result.
-    Otherwise, `success` is set to `false` and `error` is set to the string representation of the error.
-
-    # Inputs
-
-    `vendor`
-
-    : package's vendor
-
-    `version`
-
-    : package's version
-
-    # Type
-
-    ```
-    tryCPEPatchVersionInUpdateWithVendor :: String -> String -> ({ success = true; value :: { update :: String; vendor :: String; version :: String; }; } | { success = false; error :: String; })
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.tryCPEPatchVersionInUpdateWithVendor` usage example
-
-    ```nix
-    lib.meta.tryCPEPatchVersionInUpdateWithVendor "gnu" "1.2.3"
-    => {
-      success = true;
-      value = {
-        vendor = "gnu";
-        version = "1.2";
-        update = "3";
-      };
-    }
-    ```
-
-    :::
-    :::{.example}
-    ## `lib.meta.cpePatchVersionInUpdateWithVendor` error example
-
-    ```nix
-    lib.meta.tryCPEPatchVersionInUpdateWithVendor "gnu" "5.3p0"
-    => {
-      success = false;
-      error = "version 5.3p0 doesn't match regex `([0-9]+\\.[0-9]+)\\.([0-9]+)`";
-    }
-    ```
-
-    :::
-  */
-  tryCPEPatchVersionInUpdateWithVendor =
-    vendor: version:
-    let
-      regex = "([0-9]+\\.[0-9]+)\\.([0-9]+)";
-      # we have to call toString here in case version is an attrset with __toString attribute
-      versionMatch = builtins.match regex (toString version);
-    in
-    if versionMatch == null then
-      {
-        success = false;
-        error = "version ${version} doesn't match regex `${regex}`";
-      }
-    else
-      {
-        success = true;
-        value = {
-          inherit vendor;
-          version = elemAt versionMatch 0;
-          update = elemAt versionMatch 1;
-        };
-      };
-
-  /**
-    Generate [CPE parts](#var-meta-identifiers-cpeParts) from inputs. Copies `vendor` to the result. When `version` matches `X.Y.Z` where all parts are numerical, sets `version` and `update` fields to `X.Y` and `Z`. Throws an error if the version doesn't match the expected template.
-
-    # Inputs
-
-    `vendor`
-
-    : package's vendor
-
-    `version`
-
-    : package's version
-
-    # Type
-
-    ```
-    cpePatchVersionInUpdateWithVendor :: String -> String -> { update :: String; vendor :: String; version :: String; }
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.cpePatchVersionInUpdateWithVendor` usage example
-
-    ```nix
-    lib.meta.cpePatchVersionInUpdateWithVendor "gnu" "1.2.3"
-    => {
-      vendor = "gnu";
-      version = "1.2";
-      update = "3";
-    }
-    ```
-
-    :::
-    :::{.example}
-    ## `lib.meta.cpePatchVersionInUpdateWithVendor` usage in derivations
-
-    ```nix
-    mkDerivation rec {
-      version = "1.2.3";
-      # ...
-      meta = {
-        # ...
-        identifiers.cpeParts = lib.meta.cpePatchVersionInUpdateWithVendor "gnu" version;
-      };
-    }
-    ```
-
-    :::
-  */
-  cpePatchVersionInUpdateWithVendor =
-    vendor: version:
-    let
-      result = tryCPEPatchVersionInUpdateWithVendor vendor version;
-    in
-    if result.success then result.value else throw result.error;
 }

From 73a7d413dbf1434dcd5652b1d797a014ef72d3e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Tue, 7 Apr 2026 03:55:21 +0200
Subject: [PATCH 18/28] openclaw: 2026.4.2 -> 2026.4.9

---
 pkgs/by-name/op/openclaw/package.nix | 35 +++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/op/openclaw/package.nix b/pkgs/by-name/op/openclaw/package.nix
index 0f86c4ec9fb5..ce8300f339b3 100644
--- a/pkgs/by-name/op/openclaw/package.nix
+++ b/pkgs/by-name/op/openclaw/package.nix
@@ -11,7 +11,7 @@
   versionCheckHook,
   rolldown,
   installShellFiles,
-  version ? "2026.4.2",
+  version ? "2026.4.9",
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "openclaw";
@@ -21,10 +21,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "openclaw";
     repo = "openclaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wVS2OuBNrF1yWjmINxde0kC5mvY2QUUtwYpYrZcARkI=";
+    hash = "sha256-wqvLBe+cEoo0x096fK6qKR8bDs4QHPTlxK5e64K4yls=";
   };
 
-  pnpmDepsHash = "sha256-aHepSWiQ4+UyjPHBF+4+M9/nFrgfCw422q671saJM+U=";
+  pnpmDepsHash = "sha256-mdppNeJVf0Def0GohiKks6W3uzsaoJUYJo/ggGmypKQ=";
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
@@ -58,10 +58,27 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     chmod -R u+w node_modules/rolldown node_modules/@rolldown/pluginutils \
       node_modules/.pnpm/node_modules/rolldown node_modules/.pnpm/node_modules/@rolldown/pluginutils
 
-    # In Nix sandbox, npm install has no network access. Patch the staging
-    # script to accept version-mismatched deps from root node_modules
-    # instead of falling back to npm install.
-    sed -i 's/if (installedVersion === null || !dependencyVersionSatisfied(spec, installedVersion)) {/if (installedVersion === null) {/' scripts/stage-bundled-plugin-runtime-deps.mjs
+    # In Nix sandbox, npm install has no network access.
+    # 1) Skip missing/mismatched deps in closure walk instead of aborting.
+    # 2) Never fall through to the npm-install path.
+    substituteInPlace scripts/stage-bundled-plugin-runtime-deps.mjs \
+      --replace-fail \
+        'if (installedVersion === null || !dependencyVersionSatisfied(spec, installedVersion)) {
+          return null;
+        }' \
+        'if (installedVersion === null || !dependencyVersionSatisfied(spec, installedVersion)) {
+          continue;
+        }' \
+      --replace-fail \
+        'stageInstalledRootRuntimeDeps({ fingerprint, packageJson, pluginDir, repoRoot })
+      ) {
+        return;
+      }' \
+        'stageInstalledRootRuntimeDeps({ fingerprint, packageJson, pluginDir, repoRoot })
+      ) {
+        return;
+      }
+      return; // nix: sandbox has no npm'
     pnpm build
     pnpm ui:build
 
@@ -76,7 +93,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
 
     cp --reflink=auto -r package.json dist node_modules $libdir/
-    cp --reflink=auto -r assets docs skills patches extensions $libdir/
+    cp --reflink=auto -r assets docs skills patches extensions qa $libdir/
 
     rm -f $libdir/node_modules/.pnpm/node_modules/clawdbot \
       $libdir/node_modules/.pnpm/node_modules/moltbot \
@@ -84,6 +101,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     # Remove broken symlinks created by pnpm workspace linking in extensions
     find $libdir/extensions -xtype l -delete
+    # Remove symlinks pointing back to the build sandbox
+    find $libdir/dist/extensions -type l -lname '/build/*' -delete
 
     makeWrapper ${lib.getExe nodejs_22} $out/bin/openclaw \
       --add-flags "$libdir/dist/index.js" \

From f8d24454ca5b834f76b40747ba2f730004ef3d31 Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Fri, 10 Apr 2026 00:24:40 +0200
Subject: [PATCH 19/28] go_1_25: 1.25.8 -> 1.25.9

Changelog: https://go.dev/doc/devel/release#go1.25.minor
---
 pkgs/development/compilers/go/1.25.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index b76dda4db3ca..1227b0fe85d8 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.8";
+  version = "1.25.9";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-6YjUokRqx/4/baoImljpk2pSo4E1Wt7ByJgyMKjWxZ4=";
+    hash = "sha256-DsnvjrzqCXqsN97K6fCachi0Uc2Wvn1u1RPY5Lz5Cc8=";
   };
 
   strictDeps = true;

From 08a8389f959b3715ba9f569e207b1326465a7fde Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Fri, 10 Apr 2026 01:51:03 +0200
Subject: [PATCH 20/28] openclaw: fix broken symlink cleanup in installPhase

The -lname '/build/*' pattern didn't match the actual sandbox path
(/nix/var/nix/builds/...). Use $NIX_BUILD_TOP instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 pkgs/by-name/op/openclaw/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/op/openclaw/package.nix b/pkgs/by-name/op/openclaw/package.nix
index ce8300f339b3..420867cd233b 100644
--- a/pkgs/by-name/op/openclaw/package.nix
+++ b/pkgs/by-name/op/openclaw/package.nix
@@ -102,7 +102,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # Remove broken symlinks created by pnpm workspace linking in extensions
     find $libdir/extensions -xtype l -delete
     # Remove symlinks pointing back to the build sandbox
-    find $libdir/dist/extensions -type l -lname '/build/*' -delete
+    find $libdir/dist/extensions -type l -lname "$NIX_BUILD_TOP/*" -delete
 
     makeWrapper ${lib.getExe nodejs_22} $out/bin/openclaw \
       --add-flags "$libdir/dist/index.js" \

From 13470c0d1c7180c65b02975761868f65cb568eab Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 27 Mar 2026 23:17:27 +0100
Subject: [PATCH 21/28] turbo-unwrapped: 2.8.15 -> 2.9.6

changelog: https://github.com/vercel/turborepo/releases/tag/v2.9.6

diff: https://github.com/vercel/turborepo/compare/v2.8.15...v2.9.6
---
 pkgs/by-name/tu/turbo-unwrapped/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tu/turbo-unwrapped/package.nix b/pkgs/by-name/tu/turbo-unwrapped/package.nix
index 24c4eca77d37..43eb7004e36b 100644
--- a/pkgs/by-name/tu/turbo-unwrapped/package.nix
+++ b/pkgs/by-name/tu/turbo-unwrapped/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "turbo-unwrapped";
-  version = "2.8.15";
+  version = "2.9.6";
 
   src = fetchFromGitHub {
     owner = "vercel";
     repo = "turborepo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yUNUo+CAtUzeu4k4NLwz5xmZJsP4siwXKcN4xLa6nfI=";
+    hash = "sha256-baERDG5/r64Tn1Ay6ikFJfZLeR//88Fl42TPbLj6IrQ=";
   };
 
-  cargoHash = "sha256-9SjOB7G59oN2HCYohc1+IMINjy19aXSe+TdfNLo77Tk=";
+  cargoHash = "sha256-+ptA25gdZfZwr8+6qUSzYvc66WyaBwvXFRlhUiYSNVA=";
 
   nativeBuildInputs = [
     capnproto

From c35908815e157585d9f896b889564186eafba56e Mon Sep 17 00:00:00 2001
From: Stephane <stephane@github.no-sp.am>
Date: Fri, 10 Apr 2026 23:13:53 +0200
Subject: [PATCH 22/28] ollama: 0.20.4 -> 0.20.5

---
 pkgs/by-name/ol/ollama/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index f5a8bb751000..b526cc61d335 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -94,7 +94,7 @@ let
 
   cudaToolkit = buildEnv {
     # ollama hardcodes the major version in the Makefile to support different variants.
-    # - https://github.com/ollama/ollama/blob/v0.20.4/CMakePresets.json#L21-L47
+    # - https://github.com/ollama/ollama/blob/v0.20.5/CMakePresets.json#L21-L47
     name = "cuda-merged-${cudaMajorVersion}";
     paths = map lib.getLib cudaLibs ++ [
       (lib.getOutput "static" cudaPackages.cuda_cudart)
@@ -140,13 +140,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.20.4";
+  version = "0.20.5";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8TbZvxxaUdROpe3gnBx0XzX62tbQ9QeJP3Yp7XXJoTQ=";
+    hash = "sha256-/H4DZ/aRB04lKSke9XsK+vb76pcy940scoTunXO4pf4=";
   };
 
   vendorHash = "sha256-Lc1Ktdqtv2VhJQssk8K1UOimeEjVNvDWePE9WkamCos=";
@@ -232,7 +232,7 @@ goBuild (finalAttrs: {
     '';
 
   # ollama looks for acceleration libs in ../lib/ollama/ (now also for CPU-only with arch specific optimizations)
-  # https://github.com/ollama/ollama/blob/v0.20.4/docs/development.md#library-detection
+  # https://github.com/ollama/ollama/blob/v0.20.5/docs/development.md#library-detection
   postInstall = ''
     mkdir -p $out/lib
     cp -r build/lib/ollama $out/lib/
@@ -263,6 +263,8 @@ goBuild (finalAttrs: {
       skippedTests = [
         "TestPushHandler/unauthorized_push" # Writes to $HOME, see https://github.com/ollama/ollama/pull/12307#pullrequestreview-3249128660
         "TestPiRun_InstallAndWebSearchLifecycle" # Requires network access to install npm packages
+        "TestOpenclawRun_ChannelSetupHappensBeforeGatewayRestart" # /bin/mkdir and /bin/cat are unavailable on NixOS
+        "TestOpenclawChannelSetupPreflight" # /bin/mkdir and /bin/cat are unavailable on NixOS
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];

From 06e8add5c50bcecae1c3c5fdbde39503970a16ec Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 9 Apr 2026 11:49:09 +0000
Subject: [PATCH 23/28] python3Packages.deep-gemm: init at 2.1.1.post3

---
 .../python-modules/deep-gemm/default.nix      | 110 ++++++++++++++++++
 .../deep-gemm/use-system-libraries.patch      |  54 +++++++++
 pkgs/top-level/python-packages.nix            |   2 +
 3 files changed, 166 insertions(+)
 create mode 100644 pkgs/development/python-modules/deep-gemm/default.nix
 create mode 100644 pkgs/development/python-modules/deep-gemm/use-system-libraries.patch

diff --git a/pkgs/development/python-modules/deep-gemm/default.nix b/pkgs/development/python-modules/deep-gemm/default.nix
new file mode 100644
index 000000000000..6c873f09ea20
--- /dev/null
+++ b/pkgs/development/python-modules/deep-gemm/default.nix
@@ -0,0 +1,110 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+  torch,
+
+  # buildInputs
+  fmt,
+  pybind11,
+
+  # nativeBuildInputs
+  autoAddDriverRunpath,
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+
+  # passthru
+  deep-gemm,
+
+  config,
+  cudaPackages,
+  cudaSupport ? config.cudaSupport,
+}:
+
+let
+  inherit (lib)
+    getBin
+    optionalAttrs
+    optionals
+    ;
+in
+buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
+  pname = "deep-gemm";
+  version = "2.1.1.post3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "deepseek-ai";
+    repo = "DeepGEMM";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2yEHiuTaNUodWlZk7waqBsVMip2qiVJPgQHwsY0I63k=";
+  };
+
+  patches = [
+    ./use-system-libraries.patch
+  ];
+
+  env = optionalAttrs cudaSupport {
+    CUDA_HOME = (getBin cudaPackages.cuda_nvcc).outPath;
+
+    LDFLAGS = toString [
+      # Fake libcuda.so (the real one is deployed impurely)
+      "-L${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs"
+    ];
+  };
+
+  build-system = [
+    setuptools
+    torch
+  ];
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+  ];
+
+  buildInputs = [
+    fmt
+    pybind11
+  ]
+  ++ optionals cudaSupport (
+    with cudaPackages;
+    [
+      cuda_cudart # cuda_runtime_api.h
+      cuda_nvrtc # nvrtc.h
+      cutlass # cute/arch/mma_sm100_desc.hpp
+      libcublas # cublas_v2.h
+      libcusolver # cusolverDn.h
+      libcusparse # cusparse.h
+    ]
+  );
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  # Tests require GPU access
+  doCheck = false;
+
+  passthru.gpuCheck = deep-gemm.overridePythonAttrs {
+    requiredSystemFeatures = [ "cuda" ];
+
+    # dlopens libcuda.so at import time
+    pythonImportsCheck = [ "deep_gemm" ];
+
+    doCheck = true;
+  };
+
+  meta = {
+    description = "Clean and efficient FP8 GEMM kernels with fine-grained scaling";
+    homepage = "https://github.com/deepseek-ai/DeepGEMM";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    broken = !cudaSupport;
+  };
+})
diff --git a/pkgs/development/python-modules/deep-gemm/use-system-libraries.patch b/pkgs/development/python-modules/deep-gemm/use-system-libraries.patch
new file mode 100644
index 000000000000..c65daa26fd6b
--- /dev/null
+++ b/pkgs/development/python-modules/deep-gemm/use-system-libraries.patch
@@ -0,0 +1,54 @@
+diff --git a/setup.py b/setup.py
+index 38e891c..e846847 100644
+--- a/setup.py
++++ b/setup.py
+@@ -14,7 +14,7 @@ from setuptools import find_packages
+ from setuptools.command.build_py import build_py
+ from packaging.version import parse
+ from pathlib import Path
+-from torch.utils.cpp_extension import CUDAExtension, CUDA_HOME
++from torch.utils.cpp_extension import CUDAExtension
+ from wheel.bdist_wheel import bdist_wheel as _bdist_wheel
+ 
+ 
+@@ -33,20 +33,10 @@ if DG_JIT_USE_RUNTIME_API:
+ current_dir = os.path.dirname(os.path.realpath(__file__))
+ sources = ['csrc/python_api.cpp']
+ build_include_dirs = [
+-    f'{CUDA_HOME}/include',
+-    f'{CUDA_HOME}/include/cccl',
+     'deep_gemm/include',
+-    'third-party/cutlass/include',
+-    'third-party/fmt/include',
+ ]
+ build_libraries = ['cuda', 'cudart', 'nvrtc']
+ build_library_dirs = [
+-    f'{CUDA_HOME}/lib64',
+-    f'{CUDA_HOME}/lib64/stubs'
+-]
+-third_party_include_dirs = [
+-    'third-party/cutlass/include/cute',
+-    'third-party/cutlass/include/cutlass',
+ ]
+ 
+ # Release
+@@ -142,19 +132,6 @@ class CustomBuildPy(build_py):
+         build_include_dir = os.path.join(self.build_lib, 'deep_gemm/include')
+         os.makedirs(build_include_dir, exist_ok=True)
+ 
+-        # Copy third-party includes to the build directory
+-        for d in third_party_include_dirs:
+-            dirname = d.split('/')[-1]
+-            src_dir = os.path.join(current_dir, d)
+-            dst_dir = os.path.join(build_include_dir, dirname)
+-
+-            # Remove existing directory if it exists
+-            if os.path.exists(dst_dir):
+-                shutil.rmtree(dst_dir)
+-
+-            # Copy the directory
+-            shutil.copytree(src_dir, dst_dir)
+-
+ 
+ class CachedWheelsCommand(_bdist_wheel):
+     def run(self):
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e21a14733ed8..91208e3b4e53 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3748,6 +3748,8 @@ self: super: with self; {
 
   deep-ep = callPackage ../development/python-modules/deep-ep { };
 
+  deep-gemm = callPackage ../development/python-modules/deep-gemm { };
+
   deep-translator = callPackage ../development/python-modules/deep-translator { };
 
   deepdiff = callPackage ../development/python-modules/deepdiff { };

From e3a746f7c54ad7b760bf12a318416efbbed55a8e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Apr 2026 23:48:00 +0000
Subject: [PATCH 24/28] mirrord: 3.198.0 -> 3.201.0

---
 pkgs/by-name/mi/mirrord/manifest.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index 0a2526fa0b65..d672715115f8 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.198.0",
+  "version": "3.201.0",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.198.0/mirrord_linux_x86_64",
-      "hash": "sha256-JrfS4KGARmNGAWDLzmCkafjyPgk3NHIALEWMpoBmbWc="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.201.0/mirrord_linux_x86_64",
+      "hash": "sha256-R5wiIpOA/9mkYjDmAYKOfDjpffV1Wm/GOLfzyi8dNVE="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.198.0/mirrord_linux_aarch64",
-      "hash": "sha256-As0ybf+UQ4+q0lCkpM+6VkvTWMt8mtfMKmrPm3eZIcY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.201.0/mirrord_linux_aarch64",
+      "hash": "sha256-U8DTLhl/LfC7xf9yx4iHQx0WF1xI/d36ikiqWX+pFkk="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.198.0/mirrord_mac_universal",
-      "hash": "sha256-uvAvNF1KKIfvjzgwmwVacXA/bEwHolCCqFoou5L8pXw="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.201.0/mirrord_mac_universal",
+      "hash": "sha256-n98D4F6XamC1BkB8VDGW/xEgVlejW/HLhcxrk+pkAHQ="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.198.0/mirrord_mac_universal",
-      "hash": "sha256-uvAvNF1KKIfvjzgwmwVacXA/bEwHolCCqFoou5L8pXw="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.201.0/mirrord_mac_universal",
+      "hash": "sha256-n98D4F6XamC1BkB8VDGW/xEgVlejW/HLhcxrk+pkAHQ="
     }
   }
 }

From b36f6605a454aa2aa54c19d835d2912d0e7f261a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Apr 2026 23:54:24 +0000
Subject: [PATCH 25/28] dprint: 0.53.2 -> 0.54.0

---
 pkgs/by-name/dp/dprint/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/dp/dprint/package.nix b/pkgs/by-name/dp/dprint/package.nix
index dd755de16e2c..d8aca72dd913 100644
--- a/pkgs/by-name/dp/dprint/package.nix
+++ b/pkgs/by-name/dp/dprint/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dprint";
-  version = "0.53.2";
+  version = "0.54.0";
 
   # Prefer repository rather than crate here
   #   - They have Cargo.lock in the repository
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "dprint";
     repo = "dprint";
     tag = finalAttrs.version;
-    hash = "sha256-n2nb8+Iplm9AMlyxCfRjGmuES1FvYIVgcilSg7LcjiM=";
+    hash = "sha256-dNs2LQeEndeXS8xR9SXVFWT9PS+haB9SDZ+3PUPkFjg=";
   };
 
-  cargoHash = "sha256-FTD8rCdMC1W+1SE5ezAz3rLNc6UErGbN0/5uiPCABuk=";
+  cargoHash = "sha256-fmbO14eTObK1cZu9gDls25KRmzAJPGiqQ8uURGD2vV0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From d41b7c5edc63e0c3a0bff3f81adeddd1e56dba8d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Apr 2026 02:59:31 +0000
Subject: [PATCH 26/28] tscli: 0.2.0 -> 0.3.0

---
 pkgs/by-name/ts/tscli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ts/tscli/package.nix b/pkgs/by-name/ts/tscli/package.nix
index 39b25169a38d..f4a475155e76 100644
--- a/pkgs/by-name/ts/tscli/package.nix
+++ b/pkgs/by-name/ts/tscli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tscli";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "jaxxstorm";
     repo = "tscli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zOl+AXVEUPJtEcptT1ApIs+3Fq19XZGY3JFVUAGciEg=";
+    hash = "sha256-vCRRPVQIMpVZr45dwKNCcA53j5lkGY8FvfXLmy/H5G8=";
   };
 
-  vendorHash = "sha256-bH8jYaA/54s2q9KgqEBHaPPwXJg/ch1ksKRvyEiMMmA=";
+  vendorHash = "sha256-sVpwrdA30QklyFVdg+F1k27fbJFWIVCAJi+NN0XVQOw=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From a99a4471411590a7e329ad9121b4609aba191952 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Apr 2026 03:14:41 +0000
Subject: [PATCH 27/28] terraform-providers.okta_okta: 6.6.1 -> 6.9.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 580980abb969..b9c42144edbb 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1004,13 +1004,13 @@
     "vendorHash": "sha256-ucXmHK7jrahc78nE2cf5p5PPCSNV5DAQ53KM2SfJnjo="
   },
   "okta_okta": {
-    "hash": "sha256-sr3Q39Lx47+OT4alUEic7PBvtZKTwQ9Do15YfbVn9b4=",
+    "hash": "sha256-Ub41ML88NKsMC6q1C67DCBTrG9qD0cBhAkizZdIRRBc=",
     "homepage": "https://registry.terraform.io/providers/okta/okta",
     "owner": "okta",
     "repo": "terraform-provider-okta",
-    "rev": "v6.6.1",
+    "rev": "v6.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-EqXLfVayaOG/G3c6EkgQoPGNwnG2qKSlDo2ai/onmQE="
+    "vendorHash": "sha256-0NaqVCibwiK7WY6hIFGd2kB/okyh6ZsZ+BAe5mGP38A="
   },
   "oktadeveloper_oktaasa": {
     "hash": "sha256-2LhxgowqKvDDDOwdznusL52p2DKP+UiXALHcs9ZQd0U=",

From a7f0de025c7d9cd84e47016d2318cfe24acbaf51 Mon Sep 17 00:00:00 2001
From: Zhengyi Fu <i@fuzy.me>
Date: Thu, 9 Apr 2026 23:11:10 +0800
Subject: [PATCH 28/28] emacsPackages.liberime: add build step to compile
 dynamic module

---
 .../emacs/elisp-packages/melpa-packages.nix   | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 2bc41cb0536b..ebb4ea03ae4f 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -1401,6 +1401,33 @@ let
 
           leaf-defaults = ignoreCompilationError super.leaf-defaults; # elisp error
 
+          liberime = super.liberime.overrideAttrs (
+            let
+              libExt = pkgs.stdenv.hostPlatform.extensions.sharedLibrary;
+            in
+            prevAttrs: {
+              buildInputs = prevAttrs.buildInputs ++ [
+                pkgs.librime
+              ];
+              nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [
+                pkgs.which
+              ];
+              postBuild =
+                prevAttrs.postBuild or ""
+                + "\n"
+                + ''
+                  make CC=$CC SUFFIX=${libExt}
+                '';
+              postInstall =
+                prevAttrs.postInstall or ""
+                + "\n"
+                + ''
+                  rm -rv $out/share/emacs/site-lisp/elpa/liberime-*/{src,emacs-module,Makefile}
+                  install src/liberime-core${libExt} $out/share/emacs/site-lisp/elpa/liberime-*
+                '';
+            }
+          );
+
           # https://github.com/abo-abo/lispy/pull/683
           # missing optional dependencies
           lispy = addPackageRequires (mkHome super.lispy) [ self.indium ];