From fdbb242e65ba2dc66e356cdf72c317fdf8b02d77 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 21 Nov 2025 16:33:41 +0000
Subject: [PATCH 01/30] tetragon: 1.5.0 -> 1.6.0

---
 pkgs/by-name/te/tetragon/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/te/tetragon/package.nix b/pkgs/by-name/te/tetragon/package.nix
index c19b2e55f29c..448ad44a3e93 100644
--- a/pkgs/by-name/te/tetragon/package.nix
+++ b/pkgs/by-name/te/tetragon/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tetragon";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = "tetragon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-riuSByvMpbukA+pwbzecnyUvZGtPR6lLEA1s2oBnI+A=";
+    hash = "sha256-A6a7yjxenB/7sfdfoIaJAxdkw0ouNinZtahNMRAytwA=";
   };
 
   nativeBuildInputs = [

From 1b47ec8578b43750c761e6aa121d29cc86dcdeb3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 28 Nov 2025 01:30:49 +0000
Subject: [PATCH 02/30] debian-devscripts: 2.25.26 -> 2.25.27

---
 pkgs/by-name/de/debian-devscripts/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/de/debian-devscripts/package.nix b/pkgs/by-name/de/debian-devscripts/package.nix
index 5fb6d5906758..6a4e0902a5c9 100644
--- a/pkgs/by-name/de/debian-devscripts/package.nix
+++ b/pkgs/by-name/de/debian-devscripts/package.nix
@@ -30,14 +30,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "debian-devscripts";
-  version = "2.25.26";
+  version = "2.25.27";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "debian";
     repo = "devscripts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tO2IKC7ThHOrN6VZUPqPg8ezgv3Tq2U5GtESgNsmrYA=";
+    hash = "sha256-pTRJAiwEvfStsOOTwh6vP6kiiYppL5XG9QcCcHNaHp8=";
   };
 
   patches = [

From dfe57d7ade2ee48471300582da1d0c683b219532 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 29 Nov 2025 10:52:45 -0800
Subject: [PATCH 03/30] python3Packages.gguf: modernize

Modernize structure, build from github source, enable tests.
---
 .../python-modules/gguf/default.nix           | 40 +++++++++++++------
 1 file changed, 27 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/gguf/default.nix b/pkgs/development/python-modules/gguf/default.nix
index d1bdd9313a7b..aa36e03af5b1 100644
--- a/pkgs/development/python-modules/gguf/default.nix
+++ b/pkgs/development/python-modules/gguf/default.nix
@@ -1,40 +1,54 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  pythonOlder,
-  numpy,
+  fetchFromGitHub,
+
+  # build-system
   poetry-core,
+
+  # dependencies
+  numpy,
+  pyside6,
   pyyaml,
   sentencepiece,
   tqdm,
+
+  # check inputs
+  pytestCheckHook,
 }:
+
 buildPythonPackage rec {
   pname = "gguf";
   version = "0.17.1";
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Nq1xqtkAo+dfyU6+lupgKfA6TkS+difvetPQPox7y1M=";
+  src = fetchFromGitHub {
+    owner = "ggml-org";
+    repo = "llama.cpp";
+    tag = "gguf-v${version}";
+    hash = "sha256-XjDMDca4pyc72WQee4h3R6Iq9M0LzO+6ukV6CBWQO1M=";
   };
 
+  sourceRoot = "${src.name}/gguf-py";
+
+  build-system = [ poetry-core ];
+
   dependencies = [
     numpy
-    poetry-core
+    pyside6
     pyyaml
     sentencepiece
     tqdm
   ];
 
+  nativeCheckInputs = [ pytestCheckHook ];
+
   pythonImportsCheck = [ "gguf" ];
 
-  meta = with lib; {
+  meta = {
     description = "Module for writing binary files in the GGUF format";
     homepage = "https://ggml.ai/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ mitchmindtree ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mitchmindtree ];
   };
 }

From 666ded3f8e29af68f833cf3291b06a6d9f663bca Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 29 Nov 2025 11:21:09 -0800
Subject: [PATCH 04/30] python3Packages.gguf: add sarahec as maintainer

---
 pkgs/development/python-modules/gguf/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/gguf/default.nix b/pkgs/development/python-modules/gguf/default.nix
index aa36e03af5b1..4bddf387d180 100644
--- a/pkgs/development/python-modules/gguf/default.nix
+++ b/pkgs/development/python-modules/gguf/default.nix
@@ -49,6 +49,9 @@ buildPythonPackage rec {
     description = "Module for writing binary files in the GGUF format";
     homepage = "https://ggml.ai/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ mitchmindtree ];
+    maintainers = with lib.maintainers; [
+      mitchmindtree
+      sarahec
+    ];
   };
 }

From 9dea22dd33dca2b4b1d645dfae9a0c39fbcdd42d Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 29 Nov 2025 11:15:25 -0800
Subject: [PATCH 05/30] python3Packages.gguf: exclude optional sentencepiece on
 Darwin

Revert this once sentencepiece is fixed, see https://github.com/NixOS/nixpkgs/issues/466092
---
 pkgs/development/python-modules/gguf/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/gguf/default.nix b/pkgs/development/python-modules/gguf/default.nix
index 4bddf387d180..15b619f8374d 100644
--- a/pkgs/development/python-modules/gguf/default.nix
+++ b/pkgs/development/python-modules/gguf/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -37,8 +38,12 @@ buildPythonPackage rec {
     numpy
     pyside6
     pyyaml
-    sentencepiece
     tqdm
+  ]
+  # Sentencepiece is optional and its inclusion crashes darwin
+  # See https://github.com/NixOS/nixpkgs/issues/466092
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    sentencepiece
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];

From b75bc8b7fe544570ac870d90e5d5430295993caf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 30 Nov 2025 07:23:59 +0000
Subject: [PATCH 06/30] sgt-puzzles: 20251120.28032bd -> 20251127.a4f68b6

---
 pkgs/by-name/sg/sgt-puzzles/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sg/sgt-puzzles/package.nix b/pkgs/by-name/sg/sgt-puzzles/package.nix
index f41848add13c..f9813627dcaf 100644
--- a/pkgs/by-name/sg/sgt-puzzles/package.nix
+++ b/pkgs/by-name/sg/sgt-puzzles/package.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sgt-puzzles";
-  version = "20251120.28032bd";
+  version = "20251127.a4f68b6";
 
   src = fetchurl {
     url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${finalAttrs.version}.tar.gz";
-    hash = "sha256-aD4EOuquUpjtmKVClzIKbO+6LD2T3vqgSDf7D/wPYrE=";
+    hash = "sha256-NaRLonSMOKZaZjttBDnM2VV1oa21rLDISvSyV8F9tQ0=";
   };
 
   sgt-puzzles-menu = fetchurl {

From 833f923551a06dc863f3931d8217ee45555341b5 Mon Sep 17 00:00:00 2001
From: natsukium <tomoya.otabi@gmail.com>
Date: Sun, 30 Nov 2025 19:57:28 +0900
Subject: [PATCH 07/30] zenn-cli: 0.2.1 -> 0.2.10

Diff: https://github.com/zenn-dev/zenn-editor/compare/0.2.1...0.2.10

Changelog: https://github.com/zenn-dev/zenn-editor/releases/tag/0.2.10
---
 pkgs/by-name/ze/zenn-cli/package.nix | 64 +++++++++-------------------
 1 file changed, 20 insertions(+), 44 deletions(-)

diff --git a/pkgs/by-name/ze/zenn-cli/package.nix b/pkgs/by-name/ze/zenn-cli/package.nix
index ae11b2769124..5fd35e6cc3d5 100644
--- a/pkgs/by-name/ze/zenn-cli/package.nix
+++ b/pkgs/by-name/ze/zenn-cli/package.nix
@@ -2,70 +2,43 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchurl,
-  autoPatchelfHook,
   makeWrapper,
   nodejs,
-  pnpm_9,
+  pnpm_10,
   testers,
 }:
-let
-  go-turbo-version = "1.7.4";
-  go-turbo-srcs = {
-    x86_64-linux = fetchurl {
-      url = "https://registry.npmjs.org/turbo-linux-64/-/turbo-linux-64-${go-turbo-version}.tgz";
-      hash = "sha256-bwi+jthoDe+SEvCPPNNNv9AR8n5IA1fc4I8cnfC095Y=";
-    };
-    aarch64-linux = fetchurl {
-      url = "https://registry.npmjs.org/turbo-linux-arm64/-/turbo-linux-arm64-${go-turbo-version}.tgz";
-      hash = "sha256-j3mUd3x16tYR3QQweIB07IbCKYuKPeEkKkUHhrpHzyc=";
-    };
-  };
-  go-turbo = stdenv.mkDerivation {
-    pname = "go-turbo";
-    version = go-turbo-version;
-    src =
-      go-turbo-srcs.${stdenv.hostPlatform.system}
-        or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-    nativeBuildInputs = [ autoPatchelfHook ];
-    dontBuild = true;
-    installPhase = ''
-      install -Dm755 bin/go-turbo -t $out/bin
-    '';
-  };
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "zenn-cli";
-  version = "0.2.1";
+  version = "0.2.10";
 
   src = fetchFromGitHub {
     owner = "zenn-dev";
     repo = "zenn-editor";
     tag = finalAttrs.version;
-    hash = "sha256-LFbC3GXYLCgBOYBdNJRdESGb37DuGBCEL8ak1Qf9DVA=";
-    # turborepo requires .git directory
-    leaveDotGit = true;
+    hash = "sha256-H46wFDSxG5Fg9HuJOLulBXoXR+osf4gJEa+ZMUMWT5Q=";
   };
 
   nativeBuildInputs = [
     nodejs
-    pnpm_9.configHook
+    pnpm_10.configHook
     makeWrapper
   ];
 
-  pnpmDeps = pnpm_9.fetchDeps {
-    inherit (finalAttrs) pname version src;
+  pnpmWorkspaces = [ "zenn-cli..." ];
+
+  pnpmDeps = pnpm_10.fetchDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      pnpmWorkspaces
+      ;
     fetcherVersion = 1;
-    hash = "sha256-AjdXclrNl1AHJ4LXq9I5Rk6KGyDaWXW187o2uLwRy/o=";
+    hash = "sha256-QEOGL/FK0Vq8opPu7NeTTrk/rwWlMgisx+A7edMN9fw=";
   };
 
   preBuild = ''
     echo VITE_EMBED_SERVER_ORIGIN="https://embed.zenn.studio" > packages/zenn-cli/.env
-  ''
-  # replace go-turbo since the existing one can't be executed
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    cp ${go-turbo}/bin/go-turbo node_modules/.pnpm/turbo-linux-*/node_modules/turbo-linux*/bin/go-turbo
   '';
 
   buildPhase = ''
@@ -79,11 +52,14 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/{bin,lib/node_modules/zenn-cli}
-    cp -r packages/zenn-cli/{dist,LICENSE,package.json,README.md} $out/lib/node_modules/zenn-cli
+    mkdir -p $out/{bin,lib/packages}
+    rm -r node_modules packages/zenn-cli/node_modules
+    pnpm install --filter=zenn-cli --prod --ignore-scripts
+    cp -r node_modules $out/lib
+    cp -r packages/zenn-cli $out/lib/packages/zenn-cli
 
     makeWrapper "${lib.getExe nodejs}" "$out/bin/zenn" \
-      --add-flags "$out/lib/node_modules/zenn-cli/dist/server/zenn.js"
+      --add-flags "$out/lib/packages/zenn-cli/dist/server/zenn.js"
 
     runHook postInstall
   '';

From 261d384ec140b46b6a7cbec7f82a9933e69c80ab Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 30 Nov 2025 16:27:15 +0000
Subject: [PATCH 08/30] python3Packages.cohere: 5.20.0 -> 5.20.1

---
 pkgs/development/python-modules/cohere/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cohere/default.nix b/pkgs/development/python-modules/cohere/default.nix
index c7d59b403351..8d0ca94e5f6e 100644
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "cohere";
-  version = "5.20.0";
+  version = "5.20.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cohere-ai";
     repo = "cohere-python";
     tag = version;
-    hash = "sha256-Y0IxKKq1D7tRzbNSjWDuLYEpRChRA89t91BstvE8Tng=";
+    hash = "sha256-oX3TSFR/Z33SpolWsEIGt7zH/6hJJE5p/j6oEdBfX6I=";
   };
 
   build-system = [ poetry-core ];

From b7dc9eb31c45d0d231b0e0d88db12567545733aa Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Fri, 14 Nov 2025 19:47:12 +0100
Subject: [PATCH 09/30] harper: 0.71.0 -> 0.72.0

Changelog: https://github.com/Automattic/harper/releases/tag/v0.72.0
Diff: https://github.com/Automattic/harper/compare/v0.71.0...v0.72.0
---
 .../vscode/extensions/elijah-potter.harper/default.nix        | 2 +-
 pkgs/by-name/ha/harper/package.nix                            | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix b/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
index 171d6038515f..bfc13059a2cb 100644
--- a/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
@@ -13,7 +13,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "harper";
     publisher = "elijah-potter";
     version = harper.version;
-    hash = "sha256-ldXQKAJX8YQVjtGjKRom14fNuA6ZwDwpPusbjS+4G+I=";
+    hash = "sha256-EznDi2q/ufpgTqkaO8KpNwi8KUqK2k+4d/pNtZppfT0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index 037379706c85..ec75a0da7aa9 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "harper";
-  version = "0.71.0";
+  version = "0.72.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildAndTestSubdir = "harper-ls";
 
-  cargoHash = "sha256-hS8fLWD3OTfEAa+4saeB9pK3zS/EQSnoQSUGIkVWocw=";
+  cargoHash = "sha256-oZUYU3ZR9i6DlcolYshPq24vvrMeDUhDjh5RbbZlwtI=";
 
   passthru.updateScript = nix-update-script { };
 

From 9dcb819dc8ed00503dbe0f63ce665a558deb6895 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Mon, 24 Nov 2025 18:30:41 +0100
Subject: [PATCH 10/30] harper: 0.72.0 -> 0.73.0

Changelog: https://github.com/Automattic/harper/releases/tag/v0.73.0
Diff: https://github.com/Automattic/harper/compare/v0.72.0...v0.73.0
---
 pkgs/by-name/ha/harper/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index ec75a0da7aa9..353632c6f2ac 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "harper";
-  version = "0.72.0";
+  version = "0.73.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildAndTestSubdir = "harper-ls";
 
-  cargoHash = "sha256-oZUYU3ZR9i6DlcolYshPq24vvrMeDUhDjh5RbbZlwtI=";
+  cargoHash = "sha256-K5/QPTLdT4SeZr6hvth8aDodaj2NnFsLpHDQle+FU1k=";
 
   passthru.updateScript = nix-update-script { };
 

From ee4f09d83c5337864ac39d817c82332b52075fcb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 1 Dec 2025 02:14:12 +0000
Subject: [PATCH 11/30] skippy-xd: 2025.10.05 -> 2025.11.30

---
 pkgs/by-name/sk/skippy-xd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sk/skippy-xd/package.nix b/pkgs/by-name/sk/skippy-xd/package.nix
index 66b449bf2ca0..fe32e56117e1 100644
--- a/pkgs/by-name/sk/skippy-xd/package.nix
+++ b/pkgs/by-name/sk/skippy-xd/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "skippy-xd";
-  version = "2025.10.05";
+  version = "2025.11.30";
 
   src = fetchFromGitHub {
     owner = "felixfung";
     repo = "skippy-xd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WrB633mhZwoP+54mjSE+3gSU/VsdBZVITfD0dkYaoa8=";
+    hash = "sha256-aN1ZJnN8xH5ggH3lknrIrz2MxrVreElUKhL8RjvZBO0=";
   };
 
   nativeBuildInputs = [ pkg-config ];

From 8028427a7c56802870c8c1c523a52a5868a31d4c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 1 Dec 2025 02:33:39 +0000
Subject: [PATCH 12/30] firefox-devedition-unwrapped: 145.0b9 -> 146.0b9

---
 .../browsers/firefox/packages/firefox-devedition.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index c65b04e5ac36..2c74b044c326 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = "firefox-devedition";
-  version = "145.0b9";
+  version = "146.0b9";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "36000021b8f30eb5e80ce3b2e4ae05499e8b8cbdec93ba97dfb9c8f107cbe80202a13c4923491c01c8c245fc1810bb6fc82a46a06817ab7e70a47c04385b306e";
+    sha512 = "6fac88325150620388f49ffe1ba0385216184b98e0faa54e01804292563798a032a8cef375dbc78a41b9ba3e18d1e9258aca5e090bc827f2e7e842f76ee34c25";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but

From a75d944cbbe13f9d1abc58379e17bf22996adf15 Mon Sep 17 00:00:00 2001
From: tilpner <git@tilpner.com>
Date: Mon, 1 Dec 2025 10:26:42 +0100
Subject: [PATCH 13/30] haproxy: drop USE_QUIC_OPENSSL_COMPAT for openssl >=
 3.5.2

---
 nixos/tests/haproxy.nix             | 3 ---
 pkgs/by-name/ha/haproxy/package.nix | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/nixos/tests/haproxy.nix b/nixos/tests/haproxy.nix
index 4b7f26765752..24c355788a38 100644
--- a/nixos/tests/haproxy.nix
+++ b/nixos/tests/haproxy.nix
@@ -8,9 +8,6 @@
         services.haproxy = {
           enable = true;
           config = ''
-            global
-              limited-quic
-
             defaults
               mode http
               timeout connect 10s
diff --git a/pkgs/by-name/ha/haproxy/package.nix b/pkgs/by-name/ha/haproxy/package.nix
index 67a6bbe0ffc9..ad0e4f3f9728 100644
--- a/pkgs/by-name/ha/haproxy/package.nix
+++ b/pkgs/by-name/ha/haproxy/package.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals (sslLibrary == "aws-lc") [
     "USE_OPENSSL_AWSLC=true"
   ]
-  ++ lib.optionals (sslLibrary == "openssl") [
+  ++ lib.optionals (sslLibrary == "openssl" && lib.versionOlder openssl.version "3.5.2") [
     "USE_QUIC_OPENSSL_COMPAT=yes"
   ]
   ++ lib.optionals (sslLibrary == "wolfssl") [

From b2759ab0ed1882bce6039e8f2e8c992b64ee3692 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Fri, 28 Nov 2025 23:40:25 +0100
Subject: [PATCH 14/30] harper: 0.73.0 -> 1.0.0

Changelog: https://github.com/Automattic/harper/releases/tag/v1.0.0
Diff: https://github.com/Automattic/harper/compare/v0.73.0...v1.0.0
---
 .../vscode/extensions/elijah-potter.harper/default.nix      | 2 +-
 pkgs/by-name/ha/harper/package.nix                          | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix b/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
index bfc13059a2cb..a744b9c40bc7 100644
--- a/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix
@@ -13,7 +13,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "harper";
     publisher = "elijah-potter";
     version = harper.version;
-    hash = "sha256-EznDi2q/ufpgTqkaO8KpNwi8KUqK2k+4d/pNtZppfT0=";
+    hash = "sha256-Mu1l/3twbdpqIV8ePNfR7No23Ib/8hkB2CfE59BZP9M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index 353632c6f2ac..9a3b8247e90e 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "harper";
-  version = "0.73.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Hf086Ub0nVGET4qELDMddOErGAhK8B6ohbI5JhnU6z8=";
+    hash = "sha256-U0k6DODMW9OK+sR9kt8JzpmV32d9py9Pehv/0h8SqDg=";
   };
 
   buildAndTestSubdir = "harper-ls";
 
-  cargoHash = "sha256-K5/QPTLdT4SeZr6hvth8aDodaj2NnFsLpHDQle+FU1k=";
+  cargoHash = "sha256-TyqUKAlrcoqsDBS2Y3jzUFNNRazSBsCf6una0znc+yw=";
 
   passthru.updateScript = nix-update-script { };
 

From 7732d71d6c379a2e92ed05a62e4454e699e479a9 Mon Sep 17 00:00:00 2001
From: r4v3n6101 <raven6107@gmail.com>
Date: Tue, 18 Nov 2025 08:24:35 +0300
Subject: [PATCH 15/30] openjk: add darwin support

---
 pkgs/by-name/op/openjk/package.nix | 90 ++++++++++++++++++++++--------
 1 file changed, 66 insertions(+), 24 deletions(-)

diff --git a/pkgs/by-name/op/openjk/package.nix b/pkgs/by-name/op/openjk/package.nix
index eb21e40db584..fd5344648179 100644
--- a/pkgs/by-name/op/openjk/package.nix
+++ b/pkgs/by-name/op/openjk/package.nix
@@ -71,6 +71,8 @@ stdenv.mkDerivation {
 
   outputs = [
     "out"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     "openjo"
     "openja"
   ];
@@ -83,40 +85,80 @@ stdenv.mkDerivation {
     "-DBuildJK2SPEngine:BOOL=ON"
     "-DBuildJK2SPGame:BOOL=ON"
     "-DBuildJK2SPRdVanilla:BOOL=ON"
+  ]
+  # Otherwise will fall with `not found <fp.h>`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "-DUseInternalJPEG:BOOL=OFF"
+    "-DUseInternalPNG:BOOL=OFF"
   ];
 
-  postInstall = ''
-    mkdir -p $out/bin $openja/bin $openjo/bin
-    mkdir -p $openja/share/applications $openjo/share/applications
-    mkdir -p $openja/share/icons/hicolor/128x128/apps $openjo/share/icons/hicolor/128x128/apps
-    mkdir -p $openja/opt $openjo/opt
-    mv $out/opt/JediAcademy $openja/opt/
-    mv $out/opt/JediOutcast $openjo/opt/
-    jaPrefix=$openja/opt/JediAcademy
-    joPrefix=$openjo/opt/JediOutcast
+  postInstall =
+    if stdenv.hostPlatform.isLinux then
+      ''
+        mkdir -p $out/bin $openja/bin $openjo/bin
+        mkdir -p $openja/share/applications $openjo/share/applications
+        mkdir -p $openja/share/icons/hicolor/128x128/apps $openjo/share/icons/hicolor/128x128/apps
+        mkdir -p $openja/opt $openjo/opt
+        mv $out/opt/JediAcademy $openja/opt/
+        mv $out/opt/JediOutcast $openjo/opt/
+        jaPrefix=$openja/opt/JediAcademy
+        joPrefix=$openjo/opt/JediOutcast
 
-    makeWrapper $jaPrefix/openjk.* $openja/bin/jamp --chdir "$jaPrefix"
-    makeWrapper $jaPrefix/openjk_sp.* $openja/bin/jasp --chdir "$jaPrefix"
-    makeWrapper $jaPrefix/openjkded.* $openja/bin/openjkded --chdir "$jaPrefix"
-    makeWrapper $joPrefix/openjo_sp.* $openjo/bin/josp --chdir "$joPrefix"
+        makeWrapper $jaPrefix/openjk.* $openja/bin/jamp --chdir "$jaPrefix"
+        makeWrapper $jaPrefix/openjk_sp.* $openja/bin/jasp --chdir "$jaPrefix"
+        makeWrapper $jaPrefix/openjkded.* $openja/bin/openjkded --chdir "$jaPrefix"
+        makeWrapper $joPrefix/openjo_sp.* $openjo/bin/josp --chdir "$joPrefix"
 
-    cp $src/shared/icons/OpenJK_Icon_128.png $openjo/share/icons/hicolor/128x128/apps
-    cp $src/shared/icons/OpenJK_Icon_128.png $openja/share/icons/hicolor/128x128/apps
-    ln -s ${jamp}/share/applications/* $openja/share/applications
-    ln -s ${jasp}/share/applications/* $openja/share/applications
-    ln -s ${josp}/share/applications/* $openjo/share/applications
-    ln -s $openja/bin/* $out/bin
-    ln -s $openjo/bin/* $out/bin
-    rm -rf $out/opt
+        cp $src/shared/icons/OpenJK_Icon_128.png $openjo/share/icons/hicolor/128x128/apps
+        cp $src/shared/icons/OpenJK_Icon_128.png $openja/share/icons/hicolor/128x128/apps
+        ln -s ${jamp}/share/applications/* $openja/share/applications
+        ln -s ${jasp}/share/applications/* $openja/share/applications
+        ln -s ${josp}/share/applications/* $openjo/share/applications
+        ln -s $openja/bin/* $out/bin
+        ln -s $openjo/bin/* $out/bin
+        rm -rf $out/opt
+      ''
+    else if stdenv.hostPlatform.isDarwin then
+      ''
+        mkdir -p $out/Applications $out/bin
+        mv $out/opt/JediOutcast/openjo_sp.*.app $out/Applications/openjo_sp.app
+        mv $out/opt/JediAcademy/openjk.*.app $out/Applications/openjk.app
+        mv $out/opt/JediAcademy/openjk_sp.*.app $out/Applications/openjk_sp.app
+        mv $out/opt/JediAcademy/openjkded.* $out/bin/openjkded
+        rm -rf $out/opt
+
+        makeWrapper $out/Applications/openjk.app/Contents/MacOS/openjk.* $out/bin/openjk \
+          --chdir $out/Applications/openjk.app/Contents/MacOS/
+
+        makeWrapper $out/Applications/openjk_sp.app/Contents/MacOS/openjk_sp.* $out/bin/openjk_sp \
+          --chdir $out/Applications/openjk_sp.app/Contents/MacOS/
+
+        makeWrapper $out/Applications/openjo_sp.app/Contents/MacOS/openjo_sp.* $out/bin/openjo_sp \
+          --chdir $out/Applications/openjo_sp.app/Contents/MacOS/
+      ''
+    else
+      throw "unsupported system";
+
+  # CMake is copying libraries, but their links are needed
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    for app in openjk openjk_sp openjo_sp; do
+      pushd $out/Applications/$app.app/Contents/Frameworks/
+
+      rm *.dylib
+      ln -s ${SDL2}/lib/libSDL2.dylib libSDL2-2.0.0.dylib
+      ln -s ${zlib}/lib/libz.dylib libz.dylib
+
+      popd
+    done
   '';
 
   passthru.updateScript = unstableGitUpdater { };
 
-  meta = with lib; {
+  meta = {
     description = "Open-source engine for Star Wars Jedi Academy game";
     homepage = "https://github.com/JACoders/OpenJK";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Only;
+    platforms = with lib.platforms; linux ++ darwin;
     maintainers = [ ];
   };
 }

From cac88189887acaa4820157e31669951ac7c65765 Mon Sep 17 00:00:00 2001
From: r4v3n6101 <raven6107@gmail.com>
Date: Tue, 18 Nov 2025 08:24:52 +0300
Subject: [PATCH 16/30] openjk: add r4v3n6101 as a maintainer

---
 pkgs/by-name/op/openjk/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/op/openjk/package.nix b/pkgs/by-name/op/openjk/package.nix
index fd5344648179..bd40403d56e7 100644
--- a/pkgs/by-name/op/openjk/package.nix
+++ b/pkgs/by-name/op/openjk/package.nix
@@ -159,6 +159,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/JACoders/OpenJK";
     license = lib.licenses.gpl2Only;
     platforms = with lib.platforms; linux ++ darwin;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ r4v3n6101 ];
   };
 }

From ddb794edd557ba4910fab0674abece8728030303 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 1 Dec 2025 17:10:50 +0000
Subject: [PATCH 17/30] beeper: 4.2.229 -> 4.2.269

---
 pkgs/by-name/be/beeper/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/be/beeper/package.nix b/pkgs/by-name/be/beeper/package.nix
index 0bf1c7e2f237..36e856235d2a 100644
--- a/pkgs/by-name/be/beeper/package.nix
+++ b/pkgs/by-name/be/beeper/package.nix
@@ -9,10 +9,10 @@
 }:
 let
   pname = "beeper";
-  version = "4.2.229";
+  version = "4.2.269";
   src = fetchurl {
     url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-x86_64.AppImage";
-    hash = "sha256-AW976i1JO2nKqm7QV35lYFPftClOpEz+0/Zaec4sly8=";
+    hash = "sha256-2IASocz5dgO3KXSvm4i8wyFClEF/4oRtOJZAsfg0mJA=";
   };
   appimageContents = appimageTools.extract {
     inherit pname version src;

From 8013a4bdcc01a7ef3b582f86d3f97103d8051ae8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 1 Dec 2025 19:04:25 +0000
Subject: [PATCH 18/30] sigil: 2.6.2 -> 2.7.0

---
 pkgs/by-name/si/sigil/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/si/sigil/package.nix b/pkgs/by-name/si/sigil/package.nix
index e15163489769..5e4cedcb7d21 100644
--- a/pkgs/by-name/si/sigil/package.nix
+++ b/pkgs/by-name/si/sigil/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sigil";
-  version = "2.6.2";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     repo = "Sigil";
     owner = "Sigil-Ebook";
     tag = version;
-    hash = "sha256-3+ODd0/kkXfAchsErLjy6FDHoyVP9VyxbINKMn3N/PM=";
+    hash = "sha256-cKnWAVLScPZYNAFOiXaoHSXMl3YNOh6zmEryILaOR4w=";
   };
 
   pythonPath = with python3Packages; [ lxml ];

From 8f621a24fc375358e509d09414f7fd5aeb0f0930 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Dec 2025 12:16:39 -0800
Subject: [PATCH 19/30] python3Packages.volkswagencarnet: 5.1.6 -> 5.1.8

Diff: https://github.com/robinostlund/volkswagencarnet/compare/v5.1.6...v5.1.8

Changelog: https://github.com/robinostlund/volkswagencarnet/releases/tag/v5.1.8
---
 pkgs/development/python-modules/volkswagencarnet/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/volkswagencarnet/default.nix b/pkgs/development/python-modules/volkswagencarnet/default.nix
index e9c4725b62a2..fa6b44ec23ac 100644
--- a/pkgs/development/python-modules/volkswagencarnet/default.nix
+++ b/pkgs/development/python-modules/volkswagencarnet/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "volkswagencarnet";
-  version = "5.1.6";
+  version = "5.1.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "robinostlund";
     repo = "volkswagencarnet";
     tag = "v${version}";
-    hash = "sha256-GLsL9bvgLlfqiQdaIszthXXG/o4lKB4vAz5TMFfoGs8=";
+    hash = "sha256-LH8w+sIInez5hUM/rj1C8ew/RlfKTPKh0ZgLt6cRcnY=";
   };
 
   postPatch = ''

From e74be45368e4d50a3b51b45cb0e9d2c521ec6d2b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Dec 2025 12:25:13 -0800
Subject: [PATCH 20/30] python3Packages.aioesphomeapi: 42.8.0 -> 42.9.0

Diff: https://github.com/esphome/aioesphomeapi/compare/v42.8.0...v42.9.0

Changelog: https://github.com/esphome/aioesphomeapi/releases/tag/v42.9.0
---
 pkgs/development/python-modules/aioesphomeapi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 5057871ca8ff..1e644bd325ba 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "42.8.0";
+  version = "42.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "aioesphomeapi";
     tag = "v${version}";
-    hash = "sha256-33QldAjCuuZr/aqAN3chq57lKzfE8n0ZXybtrAoW4tc=";
+    hash = "sha256-wcDK84oAz+h8M0DEMpNxSq7/Un5AOfmdBtWueD8bfBo=";
   };
 
   build-system = [

From 3d2ff8389bebf3e43e73b01ed32e83acaaafcaeb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Dec 2025 12:26:59 -0800
Subject: [PATCH 21/30] python3Packages.aioshelly: 13.21.0 -> 13.22.0

Diff: https://github.com/home-assistant-libs/aioshelly/compare/13.21.0...13.22.0

Changelog: https://github.com/home-assistant-libs/aioshelly/releases/tag/13.22.0
---
 pkgs/development/python-modules/aioshelly/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aioshelly/default.nix b/pkgs/development/python-modules/aioshelly/default.nix
index 82fa73040591..73b44e34abd1 100644
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "13.21.0";
+  version = "13.22.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "aioshelly";
     tag = version;
-    hash = "sha256-ux4zxyl+XW5Fhkwz9mHi6TKRQ5x8SO3L2UzfVb0OeJk=";
+    hash = "sha256-SrnmEh+Re/DM3IM5rn/80D/ZqJeeWsn3kPtBJTGrYl0=";
   };
 
   build-system = [ setuptools ];

From 2de922c6370fdca3dcb478776d88b6d77bbf600c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Dec 2025 12:28:30 -0800
Subject: [PATCH 22/30] python3Packages.google-nest-sdm: 9.1.0 -> 9.1.1

Diff: https://github.com/allenporter/python-google-nest-sdm/compare/9.1.0...9.1.1

Changelog: https://github.com/allenporter/python-google-nest-sdm/releases/tag/9.1.1
---
 pkgs/development/python-modules/google-nest-sdm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-nest-sdm/default.nix b/pkgs/development/python-modules/google-nest-sdm/default.nix
index 6fab59b00440..f68b9bcc1efa 100644
--- a/pkgs/development/python-modules/google-nest-sdm/default.nix
+++ b/pkgs/development/python-modules/google-nest-sdm/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "google-nest-sdm";
-  version = "9.1.0";
+  version = "9.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "allenporter";
     repo = "python-google-nest-sdm";
     tag = version;
-    hash = "sha256-BvyflbmtgLSRaAc465bN+5AcPwum0UBsSAWzwvelwIk=";
+    hash = "sha256-qbw5KryI/h+uBddFrYBCQHXxFAhXR1SHdkuIeUKxbVw=";
   };
 
   build-system = [ setuptools ];

From 60a38bb0a4238f0d9bd48bd3324b7cccb829540a Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 1 Dec 2025 23:06:04 +0000
Subject: [PATCH 23/30] release-notes/rl-2511: fix link markdown for
 `#opt-services.pocket-id.enable`

The syntax is [](), not [][].
---
 nixos/doc/manual/release-notes/rl-2511.section.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 295b321f9cd8..3042ef3d89ba 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -287,7 +287,7 @@
 
 - The Perl implementation of the `switch-to-configuration` program is removed. All switchable systems now use the Rust rewrite. Any prior usage of `system.switch.enableNg` must now be removed. If you have any outstanding issues with the new implementation, please open an issue on GitHub.
 
-- The Pocket ID module ([`services.pocket-id`][#opt-services.pocket-id.enable]) and package (`pocket-id`) has been updated to 1.0.0. Some environment variables have been changed or removed, see the [migration guide](https://pocket-id.org/docs/setup/migrate-to-v1/).
+- The Pocket ID module ([`services.pocket-id`](#opt-services.pocket-id.enable)) and package (`pocket-id`) has been updated to 1.0.0. Some environment variables have been changed or removed, see the [migration guide](https://pocket-id.org/docs/setup/migrate-to-v1/).
 
 - The Postfix module has been updated and likely requires configuration changes:
   - The `services.postfix.sslCert` and `sslKey` options were removed and you now need to configure

From c41a3da6c734f6f06d2f437d69f39ab6ca5d75aa Mon Sep 17 00:00:00 2001
From: Cheng Shao <terrorjack@type.dance>
Date: Mon, 1 Dec 2025 15:52:55 +0000
Subject: [PATCH 24/30] envoy: drop unused jdk blobs from deps tarball

---
 pkgs/by-name/en/envoy/package.nix | 42 +++++++++++++++++++++++++++++--
 1 file changed, 40 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 78fa316439da..9611303664ab 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -49,8 +49,8 @@ let
       depsHash
     else
       {
-        x86_64-linux = "sha256-AqXGk6IZ85TFNO7v8KFJOe8Caf1x4xQh/VuhaUq9rB4=";
-        aarch64-linux = "sha256-l70j1UcVNHGrzzvcqdeLDJUuaLkoLNM2yWCHKY4EShs=";
+        x86_64-linux = "sha256-cUpCkmJmFyd2mTImMKt5Cgi+A4bAWAXLYjJjMnV6haQ=";
+        aarch64-linux = "sha256-f1FbdFDunlF7uhCpkb5AqmKN5uimuKnFYBzXjIcRabk=";
       }
       .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
@@ -173,6 +173,44 @@ buildBazelPackage rec {
       rm -r $bazelOut/external/local_jdk
       rm -r $bazelOut/external/bazel_gazelle_go_repository_tools/bin
 
+      # Drop prebuilt JDK toolchains and non-Linux java tool bundles; we force @local_jdk anyway.
+      shopt -s nullglob
+      rm -rf $bazelOut/external/remotejdk*
+      for dir in $bazelOut/external/remote_java_tools*; do
+        base=$(basename "$dir")
+        if [[ "$base" != remote_java_tools_linux ]]; then
+          rm -rf "$dir"
+        fi
+      done
+      rm -rf $bazelOut/external/android_tools $bazelOut/external/android_gmaven_r8
+      find $bazelOut/external/repository_cache -maxdepth 1 -type f \
+        \( -iname '*remotejdk*' -o -iname '*remote_java_tools*' -o -iname '*android*' \) -delete
+
+      # Prune repository_cache entries for unused remote JDK/tool bundles.
+      keep_patterns=()
+      case ${stdenv.hostPlatform.system} in
+        x86_64-linux)
+          keep_patterns+=("remotejdk8_linux" "remotejdk11_linux" "remotejdk17_linux" "remotejdk21_linux" "remote_java_tools_linux")
+          ;;
+        aarch64-linux)
+          keep_patterns+=("remotejdk8_linux_aarch64" "remotejdk11_linux_aarch64" "remotejdk17_linux_aarch64" "remotejdk21_linux_aarch64" "remote_java_tools_linux")
+          ;;
+      esac
+
+      find $bazelOut/external/repository_cache -type f \( -iname '*remotejdk*' -o -iname '*remote_java_tools*' -o -iname '*android*' \) | while read f; do
+        keep=false
+        for pat in $keep_patterns; do
+          if [[ $(basename "$f") == *"$pat"* ]]; then
+            keep=true
+            break
+          fi
+        done
+        if ! $keep; then
+          rm -f "$f"
+        fi
+      done
+      shopt -u nullglob
+
       # CMake 4.1 drops compatibility with <3.5; bump libevent's floor to avoid configure failure.
       sed -i 's/cmake_minimum_required(VERSION 3\\.1.2 FATAL_ERROR)/cmake_minimum_required(VERSION 3.5 FATAL_ERROR)/' \
         $bazelOut/external/com_github_libevent_libevent/CMakeLists.txt

From fde0a68c5258ec8232d689f5a625088e7f1cd7df Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 1 Dec 2025 23:31:57 +0000
Subject: [PATCH 25/30] taze: 19.9.0 -> 19.9.2

---
 pkgs/by-name/ta/taze/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ta/taze/package.nix b/pkgs/by-name/ta/taze/package.nix
index 6ad11e238957..602332bcf7f6 100644
--- a/pkgs/by-name/ta/taze/package.nix
+++ b/pkgs/by-name/ta/taze/package.nix
@@ -13,19 +13,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taze";
-  version = "19.9.0";
+  version = "19.9.2";
 
   src = fetchFromGitHub {
     owner = "antfu-collective";
     repo = "taze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xpi5Wc8YP3hUSbEnfEM6uNvdlNiVMRz0oqZAJCBkLHQ=";
+    hash = "sha256-6VH1j2v9gySalq6OXL1WzEApcaoE1VxHdrZtYv2xKZk=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-g1LGiCb2NESywYN4tTVf8sXbuJla2whCm5amvPsdmRc=";
+    hash = "sha256-SV8dHPydTOz/cbOY3p4npp0uMjh3hSXH9ZNk4BtHb4w=";
   };
 
   nativeBuildInputs = [

From fdea717a6f7ce7212b018b0e5ae7c6993f7e2284 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Dec 2025 12:16:44 -0800
Subject: [PATCH 26/30] home-assistant-custom-components.volkswagencarnet:
 5.1.7 -> 5.1.9

Diff: https://github.com/robinostlund/homeassistant-volkswagencarnet/compare/v5.1.7...v5.2.0

Changelog: https://github.com/robinostlund/homeassistant-volkswagencarnet/releases/tag/v5.2.0
---
 .../custom-components/volkswagencarnet/package.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/volkswagencarnet/package.nix b/pkgs/servers/home-assistant/custom-components/volkswagencarnet/package.nix
index 3ec638f64bef..3f287955fb3d 100644
--- a/pkgs/servers/home-assistant/custom-components/volkswagencarnet/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/volkswagencarnet/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "robinostlund";
   domain = "volkswagencarnet";
-  version = "5.1.7";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "robinostlund";
     repo = "homeassistant-volkswagencarnet";
     tag = "v${version}";
-    hash = "sha256-c3fj15TUboX/HRBLb3EENBkZIwluza8Q6MKbU4+BB/E=";
+    hash = "sha256-NAWE489MUyXwRtW7rOGOEz9BFF+BwqS0MWNYtunfOIo=";
   };
 
   dependencies = [ volkswagencarnet ];

From 4a2ac72f49bca1950c939dbddbf315be3467f6cb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 2 Dec 2025 01:04:40 +0000
Subject: [PATCH 27/30] nwg-clipman: 0.2.7 -> 0.2.8

---
 pkgs/by-name/nw/nwg-clipman/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nw/nwg-clipman/package.nix b/pkgs/by-name/nw/nwg-clipman/package.nix
index 30e97da20f82..8770b6098145 100644
--- a/pkgs/by-name/nw/nwg-clipman/package.nix
+++ b/pkgs/by-name/nw/nwg-clipman/package.nix
@@ -13,14 +13,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "nwg-clipman";
-  version = "0.2.7";
+  version = "0.2.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-clipman";
     tag = "v${version}";
-    hash = "sha256-EBxt1OSwddlMIwEqc89rzak3jhPwOhZ61Rz5l2LU2kY=";
+    hash = "sha256-GVA842yCSSO2vDD51AObEQNhDVuRIdH1c6BF1tv2Q8E=";
   };
 
   build-system = [ python3Packages.setuptools ];

From f1a181b24b1078ef3156c311432f675f7cee720a Mon Sep 17 00:00:00 2001
From: Austin Conatser <austin_conatser@outlook.com>
Date: Mon, 1 Dec 2025 20:11:27 -0500
Subject: [PATCH 28/30] grub: update savannah git to working url

---
 pkgs/tools/misc/grub/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index 68f3921354a1..29929257d726 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -74,7 +74,7 @@ let
   inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.attrNames pcSystems);
 
   gnulib = fetchgit {
-    url = "https://https.git.savannah.gnu.org/git/gnulib.git";
+    url = "https://git.savannah.gnu.org/git/gnulib.git";
     # NOTE: keep in sync with bootstrap.conf!
     rev = "9f48fb992a3d7e96610c4ce8be969cff2d61a01b";
     hash = "sha256-mzbF66SNqcSlI+xmjpKpNMwzi13yEWoc1Fl7p4snTto=";
@@ -98,7 +98,7 @@ stdenv.mkDerivation rec {
   version = "2.12";
 
   src = fetchgit {
-    url = "https://https.git.savannah.gnu.org/git/grub.git";
+    url = "https://git.savannah.gnu.org/git/grub.git";
     tag = "grub-${version}";
     hash = "sha256-lathsBb2f7urh8R86ihpTdwo3h1hAHnRiHd5gCLVpBc=";
   };

From 6a4cbb2a0301407efd9110f6e3e212c7f41b0c8d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 2 Dec 2025 01:13:08 +0000
Subject: [PATCH 29/30] gojq: 0.12.17 -> 0.12.18

---
 pkgs/by-name/go/gojq/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/gojq/package.nix b/pkgs/by-name/go/gojq/package.nix
index bc9946df3589..682afc5fef85 100644
--- a/pkgs/by-name/go/gojq/package.nix
+++ b/pkgs/by-name/go/gojq/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gojq";
-  version = "0.12.17";
+  version = "0.12.18";
 
   src = fetchFromGitHub {
     owner = "itchyny";
     repo = "gojq";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-zJkeghN3btF/fZZeuClHV1ndB/2tTTMljEukMYe7UWU=";
+    hash = "sha256-9oqyNG8kaM4LmMWOZ2aQqabx97xw6Bt1PgjhVuPU+YE=";
   };
 
-  vendorHash = "sha256-ZC0byawZLBwId5GcAgHXRdEOMUSAv4wDNHFHLrbhB+I=";
+  vendorHash = "sha256-NxhoCbDRduegRcBoZbNi2CB7QRXvqpLv7cAL2mEy9tM=";
 
   ldflags = [
     "-s"

From 91ca9f2ba4885b10ba2ba0e414e0739006e97d0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Dec 2025 20:05:19 -0800
Subject: [PATCH 30/30] beets: make ffmpeg overridable

---
 pkgs/by-name/be/beets/package.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/be/beets/package.nix b/pkgs/by-name/be/beets/package.nix
index 0d8837e0c0d8..e6b2b42c61b4 100644
--- a/pkgs/by-name/be/beets/package.nix
+++ b/pkgs/by-name/be/beets/package.nix
@@ -1,5 +1,10 @@
 {
-  python3,
+  ffmpeg,
+  python3Packages,
 }:
 
-python3.pkgs.toPythonApplication python3.pkgs.beets
+python3Packages.toPythonApplication (
+  python3Packages.beets.override {
+    inherit ffmpeg;
+  }
+)