From 449f000a7e8f12f4791315bd35561f16f4cb46f4 Mon Sep 17 00:00:00 2001
From: WheelsForReals <WheelsForReals@proton.me>
Date: Wed, 12 Nov 2025 19:15:46 -0600
Subject: [PATCH 01/32] mpvScripts.buildLua: rename extraScripts arg to be more
 accurate

---
 pkgs/applications/video/mpv/scripts/buildLua.nix       | 10 +++++-----
 pkgs/applications/video/mpv/scripts/cutter.nix         |  2 +-
 pkgs/applications/video/mpv/scripts/mpv-osc-tethys.nix |  2 +-
 pkgs/applications/video/mpv/scripts/quality-menu.nix   |  2 +-
 pkgs/applications/video/mpv/scripts/sponsorblock.nix   |  2 +-
 pkgs/applications/video/mpv/scripts/thumbnail.nix      |  2 +-
 6 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/video/mpv/scripts/buildLua.nix b/pkgs/applications/video/mpv/scripts/buildLua.nix
index 7e4b5b3882ce..d078790ee3cc 100644
--- a/pkgs/applications/video/mpv/scripts/buildLua.nix
+++ b/pkgs/applications/video/mpv/scripts/buildLua.nix
@@ -23,7 +23,7 @@ lib.makeOverridable (
     extendedBy (if lib.isFunction args then args else (_: args)) (
       {
         pname,
-        extraScripts ? [ ],
+        extraScriptsToCopy ? [ ],
         runtime-dependencies ? [ ],
         ...
       }@args:
@@ -59,8 +59,8 @@ lib.makeOverridable (
               echo "Script directory '${scriptPath}' does not contain 'main.lua'" >&2
               exit 1
             }
-            [ ${with builtins; toString (length extraScripts)} -eq 0 ] || {
-              echo "mpvScripts.buildLua does not support 'extraScripts'" \
+            [ ${with builtins; toString (length extraScriptsToCopy)} -eq 0 ] || {
+              echo "mpvScripts.buildLua does not support 'extraScriptsToCopy'" \
                    "when 'scriptPath' is a directory" >&2
               exit 1
             }
@@ -69,8 +69,8 @@ lib.makeOverridable (
           else
             install -m644 -Dt "${scriptsDir}" ${escaped scriptPath}
             ${lib.optionalString (
-              extraScripts != [ ]
-            ) ''cp -at "${scriptsDir}/" ${escapedList extraScripts}''}
+              extraScriptsToCopy != [ ]
+            ) ''cp -at "${scriptsDir}/" ${escapedList extraScriptsToCopy}''}
           fi
 
           runHook postInstall
diff --git a/pkgs/applications/video/mpv/scripts/cutter.nix b/pkgs/applications/video/mpv/scripts/cutter.nix
index b051c08a8547..ef18977c88a7 100644
--- a/pkgs/applications/video/mpv/scripts/cutter.nix
+++ b/pkgs/applications/video/mpv/scripts/cutter.nix
@@ -32,7 +32,7 @@ buildLua {
   '';
 
   passthru.scriptName = "cutter.lua";
-  extraScripts = [ "c_concat.sh" ];
+  extraScriptsToCopy = [ "c_concat.sh" ];
 
   postInstall = ''
     wrapProgram $out/share/mpv/scripts/c_concat.sh \
diff --git a/pkgs/applications/video/mpv/scripts/mpv-osc-tethys.nix b/pkgs/applications/video/mpv/scripts/mpv-osc-tethys.nix
index 6f0d6bddb4a4..eff4397616f9 100644
--- a/pkgs/applications/video/mpv/scripts/mpv-osc-tethys.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-osc-tethys.nix
@@ -8,7 +8,7 @@ buildLua (finalAttrs: {
   version = "0-unstable-2024-08-19";
 
   scriptPath = "osc_tethys.lua";
-  extraScripts = [ "mpv_thumbnail_script_server.lua" ];
+  extraScriptsToCopy = [ "mpv_thumbnail_script_server.lua" ];
 
   src = fetchFromGitHub {
     owner = "Zren";
diff --git a/pkgs/applications/video/mpv/scripts/quality-menu.nix b/pkgs/applications/video/mpv/scripts/quality-menu.nix
index 8c6f00240c19..e910cf1a9984 100644
--- a/pkgs/applications/video/mpv/scripts/quality-menu.nix
+++ b/pkgs/applications/video/mpv/scripts/quality-menu.nix
@@ -18,7 +18,7 @@ buildLua rec {
   };
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
-  extraScripts = lib.optional oscSupport "quality-menu-osc.lua";
+  extraScriptsToCopy = lib.optional oscSupport "quality-menu-osc.lua";
 
   meta = with lib; {
     description = "Userscript for MPV that allows you to change youtube video quality (ytdl-format) on the fly";
diff --git a/pkgs/applications/video/mpv/scripts/sponsorblock.nix b/pkgs/applications/video/mpv/scripts/sponsorblock.nix
index 0a9dadfaa7c6..5a4ebb998d45 100644
--- a/pkgs/applications/video/mpv/scripts/sponsorblock.nix
+++ b/pkgs/applications/video/mpv/scripts/sponsorblock.nix
@@ -39,7 +39,7 @@ buildLua {
       --replace-fail 'mp.find_config_file("scripts")' "\"$out/share/mpv/scripts\""
   '';
 
-  extraScripts = [ "sponsorblock_shared" ];
+  extraScriptsToCopy = [ "sponsorblock_shared" ];
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
diff --git a/pkgs/applications/video/mpv/scripts/thumbnail.nix b/pkgs/applications/video/mpv/scripts/thumbnail.nix
index a3ed87ee74a2..414fb67cb073 100644
--- a/pkgs/applications/video/mpv/scripts/thumbnail.nix
+++ b/pkgs/applications/video/mpv/scripts/thumbnail.nix
@@ -23,7 +23,7 @@ buildLua rec {
   dontBuild = false;
 
   scriptPath = "mpv_thumbnail_script_client_osc.lua";
-  extraScripts = [ "mpv_thumbnail_script_server.lua" ];
+  extraScriptsToCopy = [ "mpv_thumbnail_script_server.lua" ];
   passthru.scriptName = "mpv_thumbnail_script_{client_osc,server}.lua";
 
   meta = {

From e4bb290195c57c5b43d17df3c66ddd611825ec95 Mon Sep 17 00:00:00 2001
From: WheelsForReals <WheelsForReals@proton.me>
Date: Wed, 12 Nov 2025 19:22:09 -0600
Subject: [PATCH 02/32] mpv: update wrapper to support multiple `--script` args

---
 .../video/mpv/scripts/mpv-osc-tethys.nix        |  1 +
 .../video/mpv/scripts/quality-menu.nix          |  1 +
 .../video/mpv/scripts/thumbnail.nix             |  2 +-
 pkgs/applications/video/mpv/wrapper.nix         | 17 +++++++++++------
 4 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/video/mpv/scripts/mpv-osc-tethys.nix b/pkgs/applications/video/mpv/scripts/mpv-osc-tethys.nix
index eff4397616f9..fe8908ba09d3 100644
--- a/pkgs/applications/video/mpv/scripts/mpv-osc-tethys.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-osc-tethys.nix
@@ -9,6 +9,7 @@ buildLua (finalAttrs: {
 
   scriptPath = "osc_tethys.lua";
   extraScriptsToCopy = [ "mpv_thumbnail_script_server.lua" ];
+  extraScriptsToLoad = [ "mpv_thumbnail_script_server.lua" ];
 
   src = fetchFromGitHub {
     owner = "Zren";
diff --git a/pkgs/applications/video/mpv/scripts/quality-menu.nix b/pkgs/applications/video/mpv/scripts/quality-menu.nix
index e910cf1a9984..f08c383e6559 100644
--- a/pkgs/applications/video/mpv/scripts/quality-menu.nix
+++ b/pkgs/applications/video/mpv/scripts/quality-menu.nix
@@ -19,6 +19,7 @@ buildLua rec {
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
   extraScriptsToCopy = lib.optional oscSupport "quality-menu-osc.lua";
+  extraScriptsToLoad = lib.optional oscSupport "quality-menu-osc.lua";
 
   meta = with lib; {
     description = "Userscript for MPV that allows you to change youtube video quality (ytdl-format) on the fly";
diff --git a/pkgs/applications/video/mpv/scripts/thumbnail.nix b/pkgs/applications/video/mpv/scripts/thumbnail.nix
index 414fb67cb073..c84cb6f95a67 100644
--- a/pkgs/applications/video/mpv/scripts/thumbnail.nix
+++ b/pkgs/applications/video/mpv/scripts/thumbnail.nix
@@ -24,7 +24,7 @@ buildLua rec {
 
   scriptPath = "mpv_thumbnail_script_client_osc.lua";
   extraScriptsToCopy = [ "mpv_thumbnail_script_server.lua" ];
-  passthru.scriptName = "mpv_thumbnail_script_{client_osc,server}.lua";
+  extraScriptsToLoad = [ "mpv_thumbnail_script_server.lua" ];
 
   meta = {
     description = "Lua script to show preview thumbnails in mpv's OSC seekbar";
diff --git a/pkgs/applications/video/mpv/wrapper.nix b/pkgs/applications/video/mpv/wrapper.nix
index bbfdab038454..ed3dfbbb88f2 100644
--- a/pkgs/applications/video/mpv/wrapper.nix
+++ b/pkgs/applications/video/mpv/wrapper.nix
@@ -73,12 +73,17 @@ let
             # For every script in the `scripts` argument, add the necessary flags to the wrapper
             (
               script:
-              [
-                "--add-flags"
-                # Here we rely on the existence of the `scriptName` passthru
-                # attribute of the script derivation from the `scripts`
-                "--script=${script}/share/mpv/scripts/${script.scriptName}"
-              ]
+              let
+                mkScriptArgs = script: scriptName: [
+                  "--add-flags"
+                  "--script=${script}/share/mpv/scripts/${scriptName}"
+                ];
+              in
+              # Here we rely on the existence of the `scriptName` passthru
+              # attribute of the script derivation from the `scripts`
+              (mkScriptArgs script script.scriptName)
+              # scripts might need others to be explicitly loaded
+              ++ (map (extraScriptName: mkScriptArgs script extraScriptName) (script.extraScriptsToLoad or [ ]))
               # scripts can also set the `extraWrapperArgs` passthru
               ++ (script.extraWrapperArgs or [ ])
             )

From 4b5a4369a715f3bd3d1cf1e9b496bc9d0b90d0ff Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 13 Nov 2025 03:32:11 +0000
Subject: [PATCH 03/32] gitkraken: 11.5.1 -> 11.6.0

---
 pkgs/by-name/gi/gitkraken/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/gi/gitkraken/package.nix b/pkgs/by-name/gi/gitkraken/package.nix
index f5eaf100d71d..74302ee33e85 100644
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@@ -56,24 +56,24 @@
 
 let
   pname = "gitkraken";
-  version = "11.5.1";
+  version = "11.6.0";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/linux/x64/${version}/gitkraken-amd64.tar.gz";
-      hash = "sha256-ctwkU8AWCuOKFetgCIPp6npk1ZO8ozfELrRp4PR3Xjs=";
+      hash = "sha256-MU/WB4RsNViEulvE6fB7S4QTjjMI/50enlyCIX+xar4=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/x64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-7wXpMwFGQeLgT7ObrZ5nUd84jzVArAIQ8vgp+fYDgsw=";
+      hash = "sha256-Ty+eRZJ6bnBsrs1VtGem1+m9WDZZf/PgiOvFIazQF6I=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/arm64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-YkY6izRicIapNF9yMCL+YHJoxrWDdVwrcpj8N99tQCs=";
+      hash = "sha256-mpJNhvKIBYt3Yd+RjxSgzRP6AfnfHPRbQ0dzd5kQQIQ=";
     };
   };
 

From d8d1b59ece2c568bae947a9f2c3bf30b583c1a32 Mon Sep 17 00:00:00 2001
From: aleksana <me@aleksana.moe>
Date: Fri, 14 Nov 2025 21:41:09 +0800
Subject: [PATCH 04/32] deja-dup: 48.4 ->49.2

---
 pkgs/by-name/de/deja-dup/fix-paths.patch | 13 -------
 pkgs/by-name/de/deja-dup/package.nix     | 43 ++++++++++++------------
 2 files changed, 21 insertions(+), 35 deletions(-)
 delete mode 100644 pkgs/by-name/de/deja-dup/fix-paths.patch

diff --git a/pkgs/by-name/de/deja-dup/fix-paths.patch b/pkgs/by-name/de/deja-dup/fix-paths.patch
deleted file mode 100644
index c5a735b1c558..000000000000
--- a/pkgs/by-name/de/deja-dup/fix-paths.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/libdeja/duplicity/DuplicityInstance.vala
-+++ b/libdeja/duplicity/DuplicityInstance.vala
-@@ -114,8 +114,8 @@ internal class DuplicityInstance : Object
-     // We already are pretty sure we don't have other duplicities in our
-     // archive directories, because we use our own and we ensure we only have
-     // one deja-dup running at a time via DBus.
-     var lockfile_glob = Shell.quote(cache_dir) + "/*/lockfile.lock";
--    if (Posix.system("/bin/rm -f " + lockfile_glob) != 0)
-+    if (Posix.system("@coreutils@/bin/rm -f " + lockfile_glob) != 0)
-       warning("Could not delete '%s'", lockfile_glob);
- 
-     Process.spawn_async_with_pipes(null, real_argv, real_envp,
-                         SpawnFlags.SEARCH_PATH |
diff --git a/pkgs/by-name/de/deja-dup/package.nix b/pkgs/by-name/de/deja-dup/package.nix
index e4e3dc104bc3..9ceb043ee771 100644
--- a/pkgs/by-name/de/deja-dup/package.nix
+++ b/pkgs/by-name/de/deja-dup/package.nix
@@ -2,25 +2,26 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  replaceVars,
   meson,
   ninja,
   pkg-config,
   vala,
   gettext,
   itstool,
+  blueprint-compiler,
   desktop-file-utils,
   glib,
   glib-networking,
   gtk4,
-  coreutils,
   libsoup_3,
   libsecret,
   libadwaita,
   wrapGAppsHook4,
   libgpg-error,
   json-glib,
+  borgbackup,
   duplicity,
+  fuse,
   rclone,
   restic,
   nix-update-script,
@@ -28,22 +29,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "deja-dup";
-  version = "48.4";
+  version = "49.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "deja-dup";
-    rev = finalAttrs.version;
-    hash = "sha256-hFmuJqUHBMSsQW+a9GjI82wNOQjHt5f3rEkGUxYA6Y0=";
+    tag = finalAttrs.version;
+    hash = "sha256-yH4XX1MwPxTmKh6p27pYQBQDyeGIT+Ed9E0Y508EF7s=";
   };
 
-  patches = [
-    (replaceVars ./fix-paths.patch {
-      inherit coreutils;
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
@@ -51,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     vala
     gettext
     itstool
+    blueprint-compiler
     desktop-file-utils
     wrapGAppsHook4
   ];
@@ -67,10 +63,13 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
-    "-Dduplicity_command=${lib.getExe duplicity}"
-    "-Drclone_command=${lib.getExe rclone}"
-    "-Denable_restic=true"
-    "-Drestic_command=${lib.getExe restic}"
+    # Check https://gitlab.gnome.org/World/deja-dup/-/blob/main/meson.options
+    (lib.mesonOption "borg_command" (lib.getExe borgbackup))
+    (lib.mesonOption "duplicity_command" (lib.getExe duplicity))
+    (lib.mesonOption "fusermount_command" (lib.getExe' fuse "fusermount"))
+    (lib.mesonOption "rclone_command" (lib.getExe rclone))
+    (lib.mesonOption "restic_command" (lib.getExe restic))
+    (lib.mesonEnable "packagekit" false) # packagekit-glib not packaged
   ];
 
   preFixup = ''
@@ -84,19 +83,19 @@ stdenv.mkDerivation (finalAttrs: {
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Simple backup tool";
     longDescription = ''
-      Déjà Dup is a simple backup tool. It hides the complexity \
-      of backing up the Right Way (encrypted, off-site, and regular) \
+      Déjà Dup is a simple backup tool. It hides the complexity
+      of backing up the Right Way (encrypted, off-site, and regular)
       and uses duplicity as the backend.
     '';
     homepage = "https://apps.gnome.org/DejaDup/";
     changelog = "https://gitlab.gnome.org/World/deja-dup/-/releases/${finalAttrs.version}";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ jtojnar ];
-    teams = [ teams.gnome-circle ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ jtojnar ];
+    teams = [ lib.teams.gnome-circle ];
+    platforms = lib.platforms.linux;
     mainProgram = "deja-dup";
   };
 })

From b05c7a8ea727a504a571a00f7cfe858d2db73f79 Mon Sep 17 00:00:00 2001
From: aleksana <me@aleksana.moe>
Date: Sat, 15 Nov 2025 18:25:33 +0800
Subject: [PATCH 05/32] resources: 1.8.0 -> 1.9.0

---
 pkgs/by-name/re/resources/package.nix | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/re/resources/package.nix b/pkgs/by-name/re/resources/package.nix
index eab66add2b3b..c0eaa188e754 100644
--- a/pkgs/by-name/re/resources/package.nix
+++ b/pkgs/by-name/re/resources/package.nix
@@ -17,23 +17,24 @@
   libadwaita,
   dmidecode,
   util-linux,
+  systemd,
   nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "resources";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "nokyan";
     repo = "resources";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z4ZVj/nS4n3oqENSK87YJ8sQRnqK7c4tWzKHUD0Qw2s=";
+    hash = "sha256-ayptMBniaqVQwLThxTbMn5498kURjwRkC9lVPs7pryo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-jHdEiK3nu9mN2A6biHq9Iu4bSniD74hGnKFBTt5xVDM=";
+    hash = "sha256-b6zWjSTkqdLaWRtMIHTLT0rEHlIxEKejYuoJkr4C3nY=";
   };
 
   nativeBuildInputs = [
@@ -55,19 +56,21 @@ stdenv.mkDerivation (finalAttrs: {
     libadwaita
   ];
 
-  postPatch = ''
-    substituteInPlace src/utils/memory.rs \
-      --replace '"dmidecode"' '"${dmidecode}/bin/dmidecode"'
-    substituteInPlace src/utils/cpu.rs \
-      --replace '"lscpu"' '"${util-linux}/bin/lscpu"'
-    substituteInPlace src/utils/memory.rs \
-      --replace '"pkexec"' '"/run/wrappers/bin/pkexec"'
-  '';
+  # Check all Command::new
+  runtimeDeps = [
+    dmidecode
+    util-linux # lscpu
+    systemd # udevadm
+  ];
 
   mesonFlags = [
     (lib.mesonOption "profile" "default")
   ];
 
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix PATH : ${lib.makeBinPath finalAttrs.runtimeDeps})
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };

From 8384a02b862545920f657a63590d019db3adeff1 Mon Sep 17 00:00:00 2001
From: aleksana <me@aleksana.moe>
Date: Sun, 16 Nov 2025 10:41:01 +0800
Subject: [PATCH 06/32] wike: 3.1.1 -> 3.1.3; refactor

---
 pkgs/by-name/wi/wike/package.nix | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/wi/wike/package.nix b/pkgs/by-name/wi/wike/package.nix
index 130c0bd46ebb..c6864bfc8d79 100644
--- a/pkgs/by-name/wi/wike/package.nix
+++ b/pkgs/by-name/wi/wike/package.nix
@@ -1,11 +1,10 @@
 {
   lib,
   fetchFromGitHub,
-  python3,
+  python3Packages,
   meson,
   ninja,
   pkg-config,
-  pkgsCross,
   appstream-glib,
   desktop-file-utils,
   gobject-introspection,
@@ -19,16 +18,16 @@
   nix-update-script,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "wike";
-  version = "3.1.1";
-  format = "other";
+  version = "3.1.3";
+  pyproject = false; # built with meson
 
   src = fetchFromGitHub {
     owner = "hugolabe";
     repo = "Wike";
-    rev = version;
-    hash = "sha256-Unw+r8NlfaSn/UCtdnkCCsC6xM33Qy6hQdUg/4bIG+I=";
+    tag = version;
+    hash = "sha256-+N9yhzIErFc0z/2JqEtit02GZKqo11viGCLoyQxtxBU=";
   };
 
   nativeBuildInputs = [
@@ -50,7 +49,7 @@ python3.pkgs.buildPythonApplication rec {
     webkitgtk_6_0
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3Packages; [
     requests
     pygobject3
   ];
@@ -64,17 +63,16 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   passthru = {
-    tests.cross = pkgsCross.aarch64-multiplatform.wike;
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Wikipedia Reader for the GNOME Desktop";
     homepage = "https://github.com/hugolabe/Wike";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ samalws ];
-    teams = [ teams.gnome-circle ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ samalws ];
+    teams = [ lib.teams.gnome-circle ];
     mainProgram = "wike";
   };
 }

From 858782eec1646483e1d314e3cc4376207e7ef689 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 16 Nov 2025 22:54:35 -0800
Subject: [PATCH 07/32] python3Packages.pytest-unordered: 0.6.1 -> 0.7.0

Diff: https://github.com/utapyngo/pytest-unordered/compare/v0.6.1...v0.7.0

Changelog: https://github.com/utapyngo/pytest-unordered/blob/v0.7.0/CHANGELOG.md
---
 .../development/python-modules/pytest-unordered/default.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-unordered/default.nix b/pkgs/development/python-modules/pytest-unordered/default.nix
index dc5aacf40ce2..d0d85ef14cd0 100644
--- a/pkgs/development/python-modules/pytest-unordered/default.nix
+++ b/pkgs/development/python-modules/pytest-unordered/default.nix
@@ -3,21 +3,20 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
-  mock,
   pytest,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "pytest-unordered";
-  version = "0.6.1";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "utapyngo";
     repo = "pytest-unordered";
     tag = "v${version}";
-    hash = "sha256-nANsX28+G8jcSe8X0dB6Tu3HYHd9ebGkh1AUx8Xq8HM=";
+    hash = "sha256-JmP2zStxIt+u7sgfRKlnBwM5q5R0GfXtiE7ZgHKtg94=";
   };
 
   build-system = [ setuptools ];
@@ -25,7 +24,6 @@ buildPythonPackage rec {
   buildInputs = [ pytest ];
 
   nativeCheckInputs = [
-    mock
     pytestCheckHook
   ];
 

From d6d7102a4bbabbb5a4028c9567e16df03edc640b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 16 Nov 2025 18:59:51 -0800
Subject: [PATCH 08/32] home-assistant: reduce dependencies

---
 pkgs/servers/home-assistant/default.nix | 13 +++----------
 pkgs/servers/home-assistant/tests.nix   | 10 +++++++---
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index e13ae67adf8f..7483b9cfa632 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -376,7 +376,6 @@ python.pkgs.buildPythonApplication rec {
   dependencies = with python.pkgs; [
     # Only packages required in pyproject.toml
     aiodns
-    aiofiles
     aiohasupervisor
     aiohttp
     aiohttp-asyncmdnsresolver
@@ -396,28 +395,20 @@ python.pkgs.buildPythonApplication rec {
     cronsim
     cryptography
     fnv-hash-fast
-    ha-ffmpeg
     hass-nabucasa
-    hassil
     home-assistant-bluetooth
-    home-assistant-intents
     httpx
     ifaddr
     jinja2
     lru-dict
-    mutagen
-    numpy
     orjson
     packaging
     pillow
     propcache
     psutil-home-assistant
     pyjwt
-    pymicro-vad
     pyopenssl
-    pyspeex-noise
     python-slugify
-    pyturbojpeg
     pyyaml
     requests
     securetar
@@ -467,8 +458,10 @@ python.pkgs.buildPythonApplication rec {
     ]
     ++ lib.concatMap (component: getPackages component python.pkgs) [
       # some components are needed even if tests in tests/components are disabled
-      "default_config"
+      "assist_pipeline"
+      "frontend"
       "hue"
+      "mobile_app"
     ];
 
   pytestFlags = [
diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index 19d31b0c774a..08458c2fb5fa 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -9,6 +9,9 @@ let
   # some components' tests have additional dependencies
   extraCheckInputs = with home-assistant.python.pkgs; {
     axis = getComponentDeps "deconz";
+    emulated_hue = [
+      defusedxml
+    ];
     homeassistant_connect_zbt2 = getComponentDeps "zha";
     gardena_bluetooth = getComponentDeps "husqvarna_automower_ble";
     govee_ble = [
@@ -29,6 +32,9 @@ let
     raspberry_pi = [
       rpi-bad-power
     ];
+    rss_feed_template = [
+      defusedxml
+    ];
     shelly = [
       pyswitchbot
     ];
@@ -42,9 +48,7 @@ let
     xiaomi_miio = [
       arrow
     ];
-    zeroconf = [
-      aioshelly
-    ];
+    zeroconf = getComponentDeps "shelly";
     zha = [
       pydeconz
     ];

From b432285eee369eabe703ffeba48a7c1dabd4c070 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 16 Nov 2025 22:20:49 -0800
Subject: [PATCH 09/32] home-assistant-custom-components.moonraker: fix tests

---
 .../home-assistant/custom-components/moonraker/package.nix    | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/custom-components/moonraker/package.nix b/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
index 05cbc40897c3..2cb9f006e74d 100644
--- a/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/moonraker/package.nix
@@ -2,6 +2,7 @@
   lib,
   buildHomeAssistantComponent,
   fetchFromGitHub,
+  home-assistant,
   pytestCheckHook,
   pytest-cov-stub,
   pytest-homeassistant-custom-component,
@@ -30,7 +31,8 @@ buildHomeAssistantComponent rec {
     pytest-homeassistant-custom-component
     pytest-cov-stub
     pytestCheckHook
-  ];
+  ]
+  ++ home-assistant.getPackages "camera" home-assistant.python.pkgs;
 
   #skip phases with nothing to do
   dontConfigure = true;

From 3b49b8934cf851ff17b1411d909edc8a27eb1ab4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 16 Nov 2025 22:31:31 -0800
Subject: [PATCH 10/32] home-assistant-component-tests: don't use all of
 home-assistant's nativeCheckInputs

---
 pkgs/servers/home-assistant/default.nix |  35 ++++---
 pkgs/servers/home-assistant/tests.nix   | 127 +++++++++++++++++++++---
 2 files changed, 132 insertions(+), 30 deletions(-)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 7483b9cfa632..f67328acd3a7 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -435,27 +435,30 @@ python.pkgs.buildPythonApplication rec {
   # upstream only tests on Linux, so do we.
   doCheck = stdenv.hostPlatform.isLinux;
 
+  requirementsTest = with python.pkgs; [
+    # test infrastructure (selectively from requirement_test.txt)
+    freezegun
+    pytest-asyncio
+    pytest-aiohttp
+    pytest-freezer
+    pytest-socket
+    pytest-timeout
+    pytest-unordered
+    pytest-xdist
+    pytestCheckHook
+    requests-mock
+    respx
+    syrupy
+  ];
+
   nativeCheckInputs =
-    with python.pkgs;
-    [
-      # test infrastructure (selectively from requirement_test.txt)
-      freezegun
-      pytest-asyncio
-      pytest-aiohttp
-      pytest-freezer
-      pytest-socket
-      pytest-timeout
-      pytest-unordered
-      pytest-xdist
-      pytestCheckHook
-      requests-mock
-      respx
-      syrupy
+    requirementsTest
+    ++ (with python.pkgs; [
       # Used in tests/non_packaged_scripts/test_alexa_locales.py
       beautifulsoup4
       # Used in tests/scripts/test_check_config.py
       colorlog
-    ]
+    ])
     ++ lib.concatMap (component: getPackages component python.pkgs) [
       # some components are needed even if tests in tests/components are disabled
       "assist_pipeline"
diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index 08458c2fb5fa..0ba85f3d459b 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -8,50 +8,149 @@ let
 
   # some components' tests have additional dependencies
   extraCheckInputs = with home-assistant.python.pkgs; {
-    axis = getComponentDeps "deconz";
-    emulated_hue = [
+    abode = getComponentDeps "camera";
+    agent_dvr = getComponentDeps "camera";
+    air_quality = getComponentDeps "camera" ++ getComponentDeps "conversation";
+    alexa = getComponentDeps "cloud" ++ getComponentDeps "frontend" ++ getComponentDeps "stream";
+    android_ip_webcam = getComponentDeps "camera";
+    assist_pipeline = getComponentDeps "frontend";
+    automation = getComponentDeps "frontend" ++ getComponentDeps "mobile_app";
+    axis = getComponentDeps "camera" ++ getComponentDeps "deconz";
+    blink = getComponentDeps "camera";
+    bthome = getComponentDeps "frontend";
+    buienradar = getComponentDeps "camera";
+    camera = getComponentDeps "conversation" ++ getComponentDeps "stream";
+    canary = getComponentDeps "camera";
+    climate = getComponentDeps "conversation";
+    color_extractor = getComponentDeps "camera" ++ getComponentDeps "conversation";
+    deconz = getComponentDeps "frontend";
+    demo = getComponentDeps "camera";
+    device_tracker = getComponentDeps "conversation";
+    dialogflow = getComponentDeps "assist_pipeline" ++ getComponentDeps "camera";
+    dlib_face_detect = getComponentDeps "image_processing";
+    dlib_face_identify = getComponentDeps "image_processing";
+    doorbird = getComponentDeps "camera";
+    dremel_3d_printer = getComponentDeps "camera";
+    elevenlabs = getComponentDeps "tts";
+    elkm1 = getComponentDeps "frontend";
+    emulated_hue = getComponentDeps "conversation" ++ [
       defusedxml
     ];
-    homeassistant_connect_zbt2 = getComponentDeps "zha";
+    emulated_kasa = getComponentDeps "camera" ++ getComponentDeps "conversation";
+    environment_canada = getComponentDeps "camera";
+    esphome = getComponentDeps "camera";
+    fan = getComponentDeps "conversation";
+    foscam = getComponentDeps "camera";
+    freebox = getComponentDeps "camera";
+    fully_kiosk = getComponentDeps "camera";
     gardena_bluetooth = getComponentDeps "husqvarna_automower_ble";
+    geofency = getComponentDeps "assist_pipeline" ++ getComponentDeps "camera";
+    google_assistant = getComponentDeps "conversation";
+    google_assistant_sdk = getComponentDeps "conversation" ++ getComponentDeps "frontend";
+    google_cloud = getComponentDeps "tts";
+    google_drive = getComponentDeps "frontend";
+    google_generative_ai_conversation = getComponentDeps "ai_task";
+    google_translate = getComponentDeps "tts";
     govee_ble = [
       ibeacon-ble
     ];
-    hassio = getComponentDeps "homeassistant_yellow";
+    gpslogger = getComponentDeps "assist_pipeline" ++ getComponentDeps "camera";
+    group = getComponentDeps "camera" ++ getComponentDeps "conversation";
+    hassio = getComponentDeps "frontend" ++ getComponentDeps "homeassistant_yellow";
+    homeassistant = getComponentDeps "camera" ++ getComponentDeps "conversation";
+    homeassistant_connect_zbt2 = getComponentDeps "zha";
     homeassistant_hardware = getComponentDeps "otbr" ++ getComponentDeps "zha";
     homeassistant_sky_connect = getComponentDeps "zha";
     homeassistant_yellow = getComponentDeps "zha";
+    homekit = getComponentDeps "conversation" ++ getComponentDeps "frontend";
+    homekit_controller = getComponentDeps "camera";
+    http = getComponentDeps "cloud" ++ getComponentDeps "frontend";
+    humidifier = getComponentDeps "conversation";
+    hyperion = getComponentDeps "camera";
+    ifttt = getComponentDeps "assist_pipeline" ++ getComponentDeps "camera";
+    image_processing = getComponentDeps "conversation";
+    intent = getComponentDeps "conversation";
+    light = getComponentDeps "conversation";
+    local_file = getComponentDeps "camera";
+    locative = getComponentDeps "assist_pipeline" ++ getComponentDeps "camera";
+    logbook = getComponentDeps "alexa";
     lovelace = [
       pychromecast
     ];
-    onboarding = [
+    lutron_caseta = getComponentDeps "frontend";
+    mailgun = getComponentDeps "assist_pipeline" ++ getComponentDeps "camera";
+    marytts = getComponentDeps "tts";
+    media_player = getComponentDeps "camera" ++ getComponentDeps "conversation";
+    microsoft = getComponentDeps "tts";
+    microsoft_face_detect = getComponentDeps "conversation";
+    microsoft_face_identify = getComponentDeps "conversation";
+    mjpeg = getComponentDeps "camera";
+    mobile_app = getComponentDeps "frontend";
+    motioneye = getComponentDeps "camera";
+    mqtt = getComponentDeps "camera";
+    nest = getComponentDeps "camera" ++ [
+      av
+    ];
+    number = getComponentDeps "conversation";
+    octoprint = getComponentDeps "camera";
+    ollama = getComponentDeps "ai_task";
+    onboarding = getComponentDeps "tts" ++ [
       pymetno
       radios
       rpi-bad-power
     ];
+    onvif = getComponentDeps "camera";
+    open_router = getComponentDeps "ai_task";
+    openai_conversation = getComponentDeps "camera";
+    openalpr_cloud = getComponentDeps "camera" ++ getComponentDeps "conversation";
+    prosegur = getComponentDeps "camera";
+    prusalink = getComponentDeps "camera";
+    push = getComponentDeps "camera";
     raspberry_pi = [
       rpi-bad-power
     ];
+    reolink = getComponentDeps "stream";
+    ring = getComponentDeps "camera";
+    roku = getComponentDeps "camera";
     rss_feed_template = [
       defusedxml
     ];
-    shelly = [
-      pyswitchbot
-    ];
+    script = getComponentDeps "frontend" ++ getComponentDeps "mobile_app";
+    sensor = getComponentDeps "camera" ++ getComponentDeps "conversation";
+    shelly = getComponentDeps "frontend" ++ getComponentDeps "switchbot";
+    sighthound = getComponentDeps "conversation" ++ getComponentDeps "image_processing";
+    skybell = getComponentDeps "camera";
+    sleep_as_android = getComponentDeps "assist_pipeline" ++ getComponentDeps "camera";
     songpal = [
       isal
     ];
     swiss_public_transport = getComponentDeps "cookidoo";
+    switch = getComponentDeps "camera" ++ getComponentDeps "conversation";
+    switch_as_x = getComponentDeps "camera" ++ getComponentDeps "conversation";
+    synology_dsm = getComponentDeps "camera";
     system_log = [
       isal
     ];
+    tasmota = getComponentDeps "camera";
+    todo = getComponentDeps "conversation";
+    traccar = getComponentDeps "assist_pipeline" ++ getComponentDeps "camera";
+    trafikverket_camera = getComponentDeps "camera";
+    tts = getComponentDeps "conversation";
+    tuya = getComponentDeps "camera";
+    twilio = getComponentDeps "assist_pipeline" ++ getComponentDeps "camera";
+    unifiprotect = getComponentDeps "camera";
+    universal = getComponentDeps "camera" ++ getComponentDeps "conversation";
+    uvc = getComponentDeps "camera";
+    voicerss = getComponentDeps "tts";
+    weather = getComponentDeps "conversation";
+    websocket_api = getComponentDeps "camera" ++ getComponentDeps "conversation";
     xiaomi_miio = [
       arrow
     ];
+    yandextts = getComponentDeps "tts";
     zeroconf = getComponentDeps "shelly";
-    zha = [
-      pydeconz
-    ];
+    zha = getComponentDeps "deconz" ++ getComponentDeps "frontend";
+    zwave_js = getComponentDeps "frontend";
   };
 
   extraDisabledTestPaths = {
@@ -133,12 +232,12 @@ lib.listToAttrs (
         dontInstall = true;
 
         nativeCheckInputs =
-          old.nativeCheckInputs
+          old.requirementsTest
           ++ home-assistant.getPackages component home-assistant.python.pkgs
           ++ extraCheckInputs.${component} or [ ];
 
-        disabledTests = old.disabledTests or [ ] ++ extraDisabledTests.${component} or [ ];
-        disabledTestPaths = old.disabledTestPaths or [ ] ++ extraDisabledTestPaths.${component} or [ ];
+        disabledTests = extraDisabledTests.${component} or [ ];
+        disabledTestPaths = extraDisabledTestPaths.${component} or [ ];
 
         # components are more often racy than the core
         dontUsePytestXdist = true;

From 1d29efae99a7e34f41a57e0ef16064e24273651d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 18 Nov 2025 12:09:48 -0800
Subject: [PATCH 11/32] python3Packages.coverage: 7.11.3 -> 7.12.0

Diff: https://github.com/coveragepy/coveragepy/compare/7.11.3...7.12.0

Changelog: https://github.com/coveragepy/coveragepy/blob/7.12.0/CHANGES.rst
---
 pkgs/development/python-modules/coverage/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/coverage/default.nix b/pkgs/development/python-modules/coverage/default.nix
index 9d262342d07a..f213f971e740 100644
--- a/pkgs/development/python-modules/coverage/default.nix
+++ b/pkgs/development/python-modules/coverage/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "coverage";
-  version = "7.11.3";
+  version = "7.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "coveragepy";
     repo = "coveragepy";
     tag = version;
-    hash = "sha256-NE5lvAy7TjsQwvduYS3+qo96YOymCIyepdPYTyIe3IA=";
+    hash = "sha256-Geoj48/MIrI8YDdyvAz7AaSa9wY41KhW5Ret4pzpLjc=";
   };
 
   build-system = [ setuptools ];

From 7a4fd62112f67934ffaab5a9049e616976b25cf6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 19 Nov 2025 01:10:34 +0000
Subject: [PATCH 12/32] gh-gei: 1.20.0 -> 1.21.0

---
 pkgs/by-name/gh/gh-gei/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gh/gh-gei/package.nix b/pkgs/by-name/gh/gh-gei/package.nix
index 109f15e2ea78..738446828cc8 100644
--- a/pkgs/by-name/gh/gh-gei/package.nix
+++ b/pkgs/by-name/gh/gh-gei/package.nix
@@ -7,13 +7,13 @@
 
 buildDotnetModule rec {
   pname = "gh-gei";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "gh-gei";
     rev = "v${version}";
-    hash = "sha256-00+yHDvDTJux2XKhJ3u1W1SrYArFGJtYusT/adC2XDE=";
+    hash = "sha256-hlhryJno8XpSITBv1ShhqP7jPoRtoscD/YGXIU6ubt0=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0_4xx;

From 527a37c09ddca8e92b5e7b5f24e0a7fb1a93b012 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 19 Nov 2025 16:16:01 +0000
Subject: [PATCH 13/32] python3Packages.safetensors: 0.6.2 -> 0.7.0

Diff: https://github.com/huggingface/safetensors/compare/v0.6.2...v0.7.0

Changelog: https://github.com/huggingface/safetensors/releases/tag/v0.7.0
---
 pkgs/development/python-modules/safetensors/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/safetensors/default.nix b/pkgs/development/python-modules/safetensors/default.nix
index 7a695ce0d610..a78e2939365a 100644
--- a/pkgs/development/python-modules/safetensors/default.nix
+++ b/pkgs/development/python-modules/safetensors/default.nix
@@ -7,6 +7,7 @@
 
   # optional-dependencies
   numpy,
+  packaging,
   torch,
   tensorflow,
   flax,
@@ -27,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "safetensors";
-  version = "0.6.2";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "safetensors";
     tag = "v${version}";
-    hash = "sha256-IyKk29jMAbYW+16mrpqQWjnsmNFEvUwkB048AAx/Cvw=";
+    hash = "sha256-qLRPMJJGs3C/PNqHSszNWRoX/DdvXt68TWW0b7aI664=";
   };
 
   sourceRoot = "${src.name}/bindings/python";
@@ -46,7 +47,7 @@ buildPythonPackage rec {
       src
       sourceRoot
       ;
-    hash = "sha256-+92fCILZwk/TknGXgR9lRN55WnmkgUJfCszFthstzXs=";
+    hash = "sha256-zNmL1Uoq/BLh6UBzMgUs/EEbzIvy7z2ylOR//Q959l4=";
   };
 
   nativeBuildInputs = [
@@ -57,6 +58,7 @@ buildPythonPackage rec {
   optional-dependencies = lib.fix (self: {
     numpy = [ numpy ];
     torch = self.numpy ++ [
+      packaging
       torch
     ];
     tensorflow = self.numpy ++ [

From b806c19e5560adb77cccb8c54a276108ff345d45 Mon Sep 17 00:00:00 2001
From: HHR2020 <76608828+HHR2020@users.noreply.github.com>
Date: Mon, 10 Nov 2025 19:54:25 +0800
Subject: [PATCH 14/32] clash-verge-rev: 2.4.2 -> 2.4.3

Changelog: https://github.com/clash-verge-rev/clash-verge-rev/releases/tag/v2.4.3

Use the new service implementation: https://github.com/clash-verge-rev/clash-verge-service-ipc
---
 ...n_path-to-prevent-RCE-in-start_clash.patch | 49 ------------
 ...rwriting-existing-file-by-validating.patch | 33 --------
 ...-to-run-clash-verge-rev-service.sock.patch | 32 --------
 pkgs/by-name/cl/clash-verge-rev/package.nix   | 20 +----
 pkgs/by-name/cl/clash-verge-rev/service.nix   | 78 +++++++++----------
 pkgs/by-name/cl/clash-verge-rev/unwrapped.nix | 26 +++----
 6 files changed, 56 insertions(+), 182 deletions(-)
 delete mode 100644 pkgs/by-name/cl/clash-verge-rev/0001-core-validate-bin_path-to-prevent-RCE-in-start_clash.patch
 delete mode 100644 pkgs/by-name/cl/clash-verge-rev/0002-core-prevent-overwriting-existing-file-by-validating.patch
 delete mode 100644 pkgs/by-name/cl/clash-verge-rev/0003-IPC-move-path-to-run-clash-verge-rev-service.sock.patch

diff --git a/pkgs/by-name/cl/clash-verge-rev/0001-core-validate-bin_path-to-prevent-RCE-in-start_clash.patch b/pkgs/by-name/cl/clash-verge-rev/0001-core-validate-bin_path-to-prevent-RCE-in-start_clash.patch
deleted file mode 100644
index e01ecacee782..000000000000
--- a/pkgs/by-name/cl/clash-verge-rev/0001-core-validate-bin_path-to-prevent-RCE-in-start_clash.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 3f86afc3a14474bff39573b1806046c888203096 Mon Sep 17 00:00:00 2001
-From: wxt <3264117476@qq.com>
-Date: Thu, 19 Jun 2025 15:37:16 +0800
-Subject: [PATCH 1/2] core: validate bin_path to prevent RCE in start_clash
-
-Add a security check in CoreManager::start_clash to ensure that the provided
-binary path (`bin_path`) must be located under the current executable's
-directory. This prevents potential remote code execution (RCE) attacks
-caused by arbitrary binary path injection.
----
- src/service/core.rs | 15 +++++++++++++++
- 1 file changed, 15 insertions(+)
-
-diff --git a/src/service/core.rs b/src/service/core.rs
-index 28e1d42..21efb26 100644
---- a/src/service/core.rs
-+++ b/src/service/core.rs
-@@ -7,6 +7,7 @@ use once_cell::sync::Lazy;
- use std::{
-     sync::{atomic::Ordering, Arc, Mutex},
-     fs::File,
-+    env,
- };
- use log::{info, error};
- 
-@@ -223,6 +224,20 @@ impl CoreManager {
-     }
- 
-     pub fn start_clash(&self, body: StartBody) -> Result<(), String> {
-+        {
-+            let bin_path = std::path::Path::new(body.bin_path.as_str());
-+            let current_exe = std::env::current_exe()
-+                .map_err(|e| format!("Failed to get current exe path: {}", e))?;
-+            let current_dir = current_exe.parent()
-+                .ok_or("Failed to get current directory")?;
-+
-+            if !bin_path.starts_with(current_dir) {
-+                return Err(format!(
-+                    "Invalid binary path for clash kernel. It must be under: {}",
-+                    current_dir.display()
-+                ));
-+            }
-+        }
-         // 设置配置并测试
-         {
-             info!("设置Clash运行时配置: {:?}", body);
--- 
-2.49.0
-
diff --git a/pkgs/by-name/cl/clash-verge-rev/0002-core-prevent-overwriting-existing-file-by-validating.patch b/pkgs/by-name/cl/clash-verge-rev/0002-core-prevent-overwriting-existing-file-by-validating.patch
deleted file mode 100644
index b1acaf9c647d..000000000000
--- a/pkgs/by-name/cl/clash-verge-rev/0002-core-prevent-overwriting-existing-file-by-validating.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From f7b094a19a47ba515d734f65754d4e57b87239c1 Mon Sep 17 00:00:00 2001
-From: wxt <3264117476@qq.com>
-Date: Thu, 19 Jun 2025 15:45:44 +0800
-Subject: [PATCH 2/2] core: prevent overwriting existing file by validating its
- existence
-
-Add a check to verify whether the specified `log_file` already exists before proceeding.
-If the file exists, return an error to prevent accidental or malicious overwriting of files.
-This enhances the security of log file handling by mitigating arbitrary file overwrite risks.
----
- src/service/core.rs | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/src/service/core.rs b/src/service/core.rs
-index 21efb26..004d0f0 100644
---- a/src/service/core.rs
-+++ b/src/service/core.rs
-@@ -123,6 +123,12 @@ impl CoreManager {
-         let config_file = config.config_file.as_str();
-         let log_file = config.log_file.as_str();
-         let args = vec!["-d", config_dir, "-f", config_file];
-+        {
-+            let log_file_2 = std::path::Path::new(log_file);
-+            if log_file_2.exists() {
-+                return Err(anyhow!(format!("Log file already exists: {}", log_file_2.display())));
-+            }
-+        }
- 
-         info!("正在启动mihomo: {} -d {} -f {}", bin_path, config_dir, config_file);
- 
--- 
-2.49.0
-
diff --git a/pkgs/by-name/cl/clash-verge-rev/0003-IPC-move-path-to-run-clash-verge-rev-service.sock.patch b/pkgs/by-name/cl/clash-verge-rev/0003-IPC-move-path-to-run-clash-verge-rev-service.sock.patch
deleted file mode 100644
index 6ea69735448d..000000000000
--- a/pkgs/by-name/cl/clash-verge-rev/0003-IPC-move-path-to-run-clash-verge-rev-service.sock.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 75296a3059419b91f638ee45215e56781bfda256 Mon Sep 17 00:00:00 2001
-From: wxt <3264117476@qq.com>
-Date: Sat, 28 Jun 2025 14:30:23 +0800
-Subject: [PATCH] IPC: move path to /run/clash-verge-rev/service.sock
-
----
- src/service/ipc.rs | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/service/ipc.rs b/src/service/ipc.rs
-index df39787..f441cd2 100644
---- a/src/service/ipc.rs
-+++ b/src/service/ipc.rs
-@@ -20,7 +20,7 @@ use std::ffi::OsStr;
- const IPC_SOCKET_NAME: &str = if cfg!(windows) {
-     r"\\.\pipe\clash-verge-service"
- } else {
--    "/tmp/clash-verge-service.sock"
-+    "/run/clash-verge-rev/service.sock"
- };
- 
- /// 消息时间有效期(秒)
-@@ -660,4 +660,4 @@ fn handle_unix_connection_sync(mut stream: std::os::unix::net::UnixStream) -> Re
-         .context("写入响应内容失败")?;
-     
-     Ok(())
--} 
-\ No newline at end of file
-+} 
--- 
-2.49.0
-
diff --git a/pkgs/by-name/cl/clash-verge-rev/package.nix b/pkgs/by-name/cl/clash-verge-rev/package.nix
index 28d6cb31b733..5cd94a72e5a6 100644
--- a/pkgs/by-name/cl/clash-verge-rev/package.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/package.nix
@@ -12,32 +12,20 @@
 }:
 let
   pname = "clash-verge-rev";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-rev";
     tag = "v${version}";
-    hash = "sha256-HBWvk6bX0GjU/yvUejYgTQM8/IP5dYVrf30wNzgWv0s=";
+    hash = "sha256-GmoeOLKxdW1x6PHtslwNPVq8wDWA413NHA/VeDRb4mA=";
   };
 
-  src-service = fetchFromGitHub {
-    owner = "clash-verge-rev";
-    repo = "clash-verge-service";
-    rev = "396150683e01e79740563561ae2fe2db28fb8904"; # no meaningful tags in this repo. The only way is updating manully every time.
-    hash = "sha256-D6U22+tJ6vxn8/BTj/PV+4SF5fvGv6KAWtu5+PNJ1SQ=";
-  };
-
-  service-cargo-hash = "sha256-54nmhQjtPLMPoRML/3rG1jipT1VC5EDgRXnKDYuLVmM=";
-  pnpm-hash = "sha256-neRjVL29xxbQu/XxsQjdAka71oJww40LeDusjsgsY00=";
-  vendor-hash = "sha256-XszXDajAdYKEUoyrHZDxxp8ICReMnSdEeKVx7JHiaU4=";
+  pnpm-hash = "sha256-qDwXPTfh1yOlugZe1UPUMKRyZOSagG4lX2eiFACgHRw=";
+  vendor-hash = "sha256-z5xVbqh+CiaTDtAx2VPQ4UjliYnV44tdp3pS8vzb1K4=";
 
   service = callPackage ./service.nix {
     inherit
-      version
-      src-service
-      service-cargo-hash
-      pname
       meta
       ;
   };
diff --git a/pkgs/by-name/cl/clash-verge-rev/service.nix b/pkgs/by-name/cl/clash-verge-rev/service.nix
index 0eec8512f794..62fb4f588d49 100644
--- a/pkgs/by-name/cl/clash-verge-rev/service.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/service.nix
@@ -1,47 +1,47 @@
 {
-  version,
   rustPlatform,
-  src-service,
-  pkg-config,
-  openssl,
-  pname,
-  service-cargo-hash,
+  fetchFromGitHub,
   meta,
+  procps,
 }:
-rustPlatform.buildRustPackage {
-  pname = "${pname}-service";
-  inherit version meta;
 
-  src = src-service;
-  sourceRoot = "${src-service.name}";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "clash-verge-service-ipc";
+  version = "2.0.21";
 
-  patches = [
-    # I want to keep these patches because it's not harmful.
-
-    # Patch: Restrict bin_path in spawn_process to be under the clash-verge-service directory.
-    # This prevents arbitrary code execution by ensuring only trusted binaries from the Nix store are allowed to run.
-    ./0001-core-validate-bin_path-to-prevent-RCE-in-start_clash.patch
-
-    # Patch: Add validation to prevent overwriting existing files.
-    # This mitigates arbitrary file overwrite risks by ensuring a file does not already exist before writing.
-    ./0002-core-prevent-overwriting-existing-file-by-validating.patch
-
-    # Patch: move IPC directory from /tmp to /run/clash-verge-rev/service.lock
-    # This allows we enable ProtectSystem="strict" and PrivateTmp
-    ./0003-IPC-move-path-to-run-clash-verge-rev-service.sock.patch
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    openssl
-  ];
-
-  env = {
-    OPENSSL_NO_VENDOR = 1;
+  src = fetchFromGitHub {
+    owner = "clash-verge-rev";
+    repo = "clash-verge-service-ipc";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-9c9fM1l31NbY//Ri50Ql60BWWgISjMWj72ABixRaXvM=";
   };
 
-  cargoHash = service-cargo-hash;
-}
+  postPatch = ''
+    # set socket path for service and test respectively
+    substituteInPlace src/lib.rs \
+      --replace-fail "/tmp/verge/clash-verge-service.sock" "/run/clash-verge-rev/service.sock" \
+      --replace-fail "/tmp/verge/clash-verge-service-test.sock" "$sourceRoot/clash-verge-service-test.sock"
+    substituteInPlace tests/test_start_permissions.rs \
+      --replace-fail "owner_perm | group_perm | other_perm" "0o0755"
+  '';
+
+  cargoHash = "sha256-UbNN3uFu5anQV+3KMFPNnGrCDQTGb4uC9K83YghfQgY=";
+
+  buildFeatures = [
+    "standalone"
+  ];
+
+  nativeCheckInputs = [
+    procps
+  ];
+  # build mock_binary for tests
+  preCheck = ''
+    cargo build --features=test
+  '';
+  checkFeatures = [
+    "standalone"
+    "test"
+    "client"
+  ];
+  inherit meta;
+})
diff --git a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
index 58b985d92210..0fd7f14fe7c3 100644
--- a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
@@ -8,6 +8,7 @@
   vendor-hash,
 
   rustPlatform,
+  fetchpatch,
 
   cargo-tauri,
   jq,
@@ -44,20 +45,25 @@ rustPlatform.buildRustPackage {
     OPENSSL_NO_VENDOR = 1;
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/clash-verge-rev/clash-verge-rev/commit/645b92bc2815fe55bbc827907bff0edbfee48674.patch";
+      hash = "sha256-BH0SvVofW6YJ3e/LOHojisenMwcxYfm3gG/dbxvYBMs=";
+    })
+  ];
+
   postPatch = ''
     # We disable the option to try to use the bleeding-edge version of mihomo
     # If you need a newer version, you can override the mihomo input of the wrapped package
     sed -i -e '/Mihomo Alpha/d' ./src/components/setting/mods/clash-core-viewer.tsx
 
-    # See service.nix for reasons
-    substituteInPlace src-tauri/src/core/service_ipc.rs \
-      --replace-fail "/tmp/clash-verge-service.sock" "/run/clash-verge-rev/service.sock"
+    # Set service.sock path
+    substituteInPlace $cargoDepsCopy/clash_verge_service_ipc-*/src/lib.rs \
+      --replace-fail "/tmp/verge/clash-verge-service.sock" "/run/clash-verge-rev/service.sock"
     # Set verge-mihomo.sock path
-    # In service mode, use /run/clash-verge-rev
-    # In sidecar mode, use $XDG_RUNTIME_DIR or /run/user/$UID or /tmp
     substituteInPlace src-tauri/src/utils/dirs.rs \
-      --replace-fail '"/var/tmp", "/tmp"' '"/run/clash-verge-rev", &std::env::var("XDG_RUNTIME_DIR").unwrap_or_else(|_| std::env::var("UID").map(|uid| format!("/run/user/{}", uid)).unwrap_or_else(|_| "/tmp".to_string()))' \
-      --replace-fail 'base_dir.join("verge")' 'base_dir'
+      --replace-fail 'once("/tmp")' 'once(&std::env::var("XDG_RUNTIME_DIR").unwrap_or_else(|_| std::env::var("UID").map(|uid| format!("/run/user/{}", uid)).unwrap_or_else(|_| "/tmp".to_string())))' \
+      --replace-fail 'join("verge")' 'join("clash-verge-rev")'
 
     substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
       --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
@@ -80,12 +86,6 @@ rustPlatform.buildRustPackage {
     ' src-tauri/tauri.conf.json | sponge src-tauri/tauri.conf.json
 
     jq 'del(.bundle.externalBin)' src-tauri/tauri.linux.conf.json | sponge src-tauri/tauri.linux.conf.json
-
-    # As a side effect of patching the service to fix the arbitrary file overwrite issue,
-    # we also need to update the timestamp format in the filename to the second level.
-    # This ensures that the Clash kernel can still be restarted within one minute without problems.
-    substituteInPlace src-tauri/src/utils/dirs.rs \
-      --replace-fail '%Y-%m-%d-%H%M' '%Y-%m-%d-%H%M%S'
   '';
 
   nativeBuildInputs = [

From 22554afbd840c1549c6762006c1df85937117509 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Thu, 20 Nov 2025 20:11:49 +0800
Subject: [PATCH 15/32] xapp-symbolic-icons: 1.0.1 -> 1.0.2

https://github.com/xapp-project/xapp-symbolic-icons/compare/1.0.1...1.0.2
---
 pkgs/by-name/xa/xapp-symbolic-icons/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xa/xapp-symbolic-icons/package.nix b/pkgs/by-name/xa/xapp-symbolic-icons/package.nix
index f37f4125c07c..26dc86e412b5 100644
--- a/pkgs/by-name/xa/xapp-symbolic-icons/package.nix
+++ b/pkgs/by-name/xa/xapp-symbolic-icons/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "xapp-symbolic-icons";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "xapp-project";
     repo = "xapp-symbolic-icons";
     tag = finalAttrs.version;
-    hash = "sha256-TOSbEcxYXuUtc0RC1Seva8uqF5qveVRq2dpG0BZmCK0=";
+    hash = "sha256-Z5edMCjw1/LO0+Ms5KCfFJ/iAANO2MihVZmLcJd5d3A=";
   };
 
   nativeBuildInputs = [

From d2d4d499cd0ad9e6ee070cf0882ac416b5a6a212 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Thu, 20 Nov 2025 20:12:47 +0800
Subject: [PATCH 16/32] sticky: 1.27 -> 1.28

https://github.com/linuxmint/sticky/compare/1.27...1.28
---
 pkgs/by-name/st/sticky/package.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/st/sticky/package.nix b/pkgs/by-name/st/sticky/package.nix
index 1e5910ba4e5d..666d6e24563a 100644
--- a/pkgs/by-name/st/sticky/package.nix
+++ b/pkgs/by-name/st/sticky/package.nix
@@ -11,18 +11,19 @@
   glib,
   gspell,
   gtk3,
+  xapp-symbolic-icons,
   gitUpdater,
 }:
 
 stdenv.mkDerivation rec {
   pname = "sticky";
-  version = "1.27";
+  version = "1.28";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "sticky";
     rev = version;
-    hash = "sha256-IuYRcvoUyY03aEclkiOmamjb/c/JaYYIoqKdcwDSY8Q=";
+    hash = "sha256-6CRkeJ2xuUs3viyYxnrgGFUIakK7ANyVpPZuwU486NM=";
   };
 
   postPatch = ''
@@ -51,14 +52,13 @@ stdenv.mkDerivation rec {
     python-xapp
   ];
 
-  dontWrapGApps = true;
-
   preFixup = ''
     buildPythonPath "$out $pythonPath"
 
-    wrapProgram $out/bin/sticky \
-      --prefix PYTHONPATH : "$program_PYTHONPATH" \
-      ''${gappsWrapperArgs[@]}
+    gappsWrapperArgs+=(
+      --prefix PYTHONPATH : "$program_PYTHONPATH"
+      --prefix XDG_DATA_DIRS : "${lib.makeSearchPath "share" [ xapp-symbolic-icons ]}"
+    )
   '';
 
   passthru = {

From d76604cdc6b5172ede25c26dd5f4291b29542910 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Thu, 20 Nov 2025 20:13:19 +0800
Subject: [PATCH 17/32] lightdm-slick-greeter: 2.2.2 -> 2.2.3

https://github.com/linuxmint/slick-greeter/compare/2.2.2...2.2.3
---
 pkgs/by-name/li/lightdm-slick-greeter/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/lightdm-slick-greeter/package.nix b/pkgs/by-name/li/lightdm-slick-greeter/package.nix
index ca9bc2a58e27..c43509b41000 100644
--- a/pkgs/by-name/li/lightdm-slick-greeter/package.nix
+++ b/pkgs/by-name/li/lightdm-slick-greeter/package.nix
@@ -18,17 +18,18 @@
   linkFarm,
   lightdm-slick-greeter,
   numlockx,
+  xapp-symbolic-icons,
 }:
 
 stdenv.mkDerivation rec {
   pname = "lightdm-slick-greeter";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "slick-greeter";
     rev = version;
-    hash = "sha256-32H2Q/JdT5v0xrdsZfSJobJ4Dxx63LPgbiB9OKIyc1U=";
+    hash = "sha256-htyFH1Q8RFyvkW75NMpjajNJDzv/87k/Dr8+R5beT2w=";
   };
 
   nativeBuildInputs = [
@@ -85,6 +86,7 @@ stdenv.mkDerivation rec {
     buildPythonPath "$out $pythonPath"
     gappsWrapperArgs+=(
       --prefix PYTHONPATH : "$program_PYTHONPATH"
+      --prefix XDG_DATA_DIRS : "${lib.makeSearchPath "share" [ xapp-symbolic-icons ]}"
     )
   '';
 

From 78ba5285c794ce01d0816b8ee15de28397b9159e Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Thu, 20 Nov 2025 20:13:32 +0800
Subject: [PATCH 18/32] pix: 3.4.7 -> 3.4.8

https://github.com/linuxmint/pix/compare/3.4.7...3.4.8
---
 pkgs/by-name/pi/pix/package.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/pi/pix/package.nix b/pkgs/by-name/pi/pix/package.nix
index 7a750605a441..69f2975f3144 100644
--- a/pkgs/by-name/pi/pix/package.nix
+++ b/pkgs/by-name/pi/pix/package.nix
@@ -30,17 +30,18 @@
   desktop-file-utils,
   itstool,
   xapp,
+  xapp-symbolic-icons,
 }:
 
 stdenv.mkDerivation rec {
   pname = "pix";
-  version = "3.4.7";
+  version = "3.4.8";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "pix";
     rev = version;
-    hash = "sha256-Z8JGss5DA4Lsj7fhjRztF6Y+zYjZuIbmYRo7wvwxB8k=";
+    hash = "sha256-zK02qhTGuYgZWHkJ6c3EVinUcojNEWwecvPjblECLkw=";
   };
 
   nativeBuildInputs = [
@@ -85,7 +86,6 @@ stdenv.mkDerivation rec {
 
     patchShebangs data/gschemas/make-enums.py \
       pix/make-pix-h.py \
-      po/make-potfiles-in.py \
       postinstall.py \
       pix/make-authors-tab.py
   '';
@@ -95,7 +95,12 @@ stdenv.mkDerivation rec {
   mesonFlags = [ "-Dwebservices=false" ];
 
   preFixup = ''
-    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared-mime-info}/share")
+    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${
+      lib.makeSearchPath "share" [
+        shared-mime-info
+        xapp-symbolic-icons
+      ]
+    }")
   '';
 
   meta = with lib; {

From 3d7eae5f0f5e58415ec47fb6b3796a9c3c48a81b Mon Sep 17 00:00:00 2001
From: chillcicada <2210227279@qq.com>
Date: Thu, 20 Nov 2025 22:35:42 +0800
Subject: [PATCH 19/32] gitlogue: init at 0.3.0

---
 pkgs/by-name/gi/gitlogue/package.nix | 52 ++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 pkgs/by-name/gi/gitlogue/package.nix

diff --git a/pkgs/by-name/gi/gitlogue/package.nix b/pkgs/by-name/gi/gitlogue/package.nix
new file mode 100644
index 000000000000..fef1bced93c1
--- /dev/null
+++ b/pkgs/by-name/gi/gitlogue/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  libgit2,
+  libssh2,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "gitlogue";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "unhappychoice";
+    repo = "gitlogue";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IKCjv33I6bM5PSp1IBXEArHgNF1hV9J+Zko0uV2OPZA=";
+  };
+
+  cargoHash = "sha256-j8h+EI+vOf8nN69ROFiwuUBRi84T/QdhbdMpAMupkoM=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    openssl
+    libgit2
+    libssh2
+  ];
+
+  env = {
+    OPENSSL_NO_VENDOR = 1;
+    LIBGIT2_NO_VENDOR = 1;
+    LIBSSH2_SYS_USE_PKG_CONFIG = 1;
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Cinematic Git commit replay tool for the terminal";
+    longDescription = ''
+      A cinematic Git commit replay tool for the terminal, turning your Git history into a living, animated story.
+    '';
+    homepage = "https://github.com/unhappychoice/gitlogue";
+    changelog = "https://github.com/unhappychoice/gitlogue/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ chillcicada ];
+    mainProgram = "gitlogue";
+  };
+})

From dd92b9d35cf38cf6bad1c70456b5f6218585eb5f Mon Sep 17 00:00:00 2001
From: qbisi <qbisicwate@gmail.com>
Date: Fri, 21 Nov 2025 09:26:27 +0800
Subject: [PATCH 20/32] hmat-oss: fix build on darwin

---
 pkgs/by-name/hm/hmat-oss/package.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/hm/hmat-oss/package.nix b/pkgs/by-name/hm/hmat-oss/package.nix
index 569ec114d158..bc5974ee8a89 100644
--- a/pkgs/by-name/hm/hmat-oss/package.nix
+++ b/pkgs/by-name/hm/hmat-oss/package.nix
@@ -20,14 +20,15 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cmakeFlags = [
-    "-DHMAT_GIT_VERSION=OFF"
+    (lib.cmakeBool "HMAT_GIT_VERSION" false)
+    # Find BLAS/LAPACK via pkg-config to avoid linking against Accelerate on Darwin.
+    (lib.cmakeBool "BLA_PREFER_PKGCONFIG" true)
+    (lib.cmakeFeature "CBLAS_INCLUDE_DIR" "${lib.getDev blas}/include")
   ];
 
   nativeBuildInputs = [
     cmake
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    pkg-config # used to find the LAPACK
+    pkg-config
   ];
 
   buildInputs = [
@@ -35,8 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
     lapack
   ];
 
-  enableParallelBuilding = true;
-
   meta = {
     description = "Hierarchical matrix C/C++ library";
     homepage = "https://github.com/jeromerobert/hmat-oss";

From d781be818e5678f9687ceafcae423cb8244d3b53 Mon Sep 17 00:00:00 2001
From: aleksana <me@aleksana.moe>
Date: Fri, 21 Nov 2025 10:30:21 +0800
Subject: [PATCH 21/32] valent: replace gdk-pixbuf with libglycin, remove now
 default flag

---
 pkgs/by-name/va/valent/package.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/va/valent/package.nix b/pkgs/by-name/va/valent/package.nix
index 0b78dddad971..a59479fe7267 100644
--- a/pkgs/by-name/va/valent/package.nix
+++ b/pkgs/by-name/va/valent/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   desktop-file-utils,
+  glycin-loaders,
   gobject-introspection,
   meson,
   ninja,
@@ -10,13 +11,13 @@
   wrapGAppsHook4,
   vala,
   evolution-data-server-gtk4,
-  gdk-pixbuf,
   glib,
   glib-networking,
   gnutls,
   gst_all_1,
   json-glib,
   libadwaita,
+  libglycin,
   libpeas2,
   libphonenumber,
   libportal-gtk4,
@@ -52,7 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     evolution-data-server-gtk4
-    gdk-pixbuf
     glib
     glib-networking
     gnutls
@@ -60,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     gst_all_1.gst-plugins-base
     json-glib
     libadwaita
+    libglycin
     libpeas2
     libphonenumber
     libportal-gtk4
@@ -68,9 +69,11 @@ stdenv.mkDerivation (finalAttrs: {
     tinysparql
   ];
 
-  mesonFlags = [
-    (lib.mesonBool "plugin_bluez" true)
-  ];
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${glycin-loaders}/share"
+    )
+  '';
 
   passthru.updateScript = nix-update-script { };
 

From 5e93bc658ceec0b04ce00905422e8e0c0e452d47 Mon Sep 17 00:00:00 2001
From: Yiyu Zhou <yiyuzhou19@gmail.com>
Date: Tue, 18 Nov 2025 23:19:27 -0800
Subject: [PATCH 22/32] wl-clicker: 0.3.1 -> 0.4

---
 pkgs/by-name/wl/wl-clicker/package.nix | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/wl/wl-clicker/package.nix b/pkgs/by-name/wl/wl-clicker/package.nix
index aa54cf4d6db7..cf98ccccc065 100644
--- a/pkgs/by-name/wl/wl-clicker/package.nix
+++ b/pkgs/by-name/wl/wl-clicker/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wl-clicker";
-  version = "0.3.1";
+  version = "0.4";
 
   nativeBuildInputs = [ wayland-scanner ];
   buildInputs = [
@@ -18,16 +18,12 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   src = fetchFromGitHub {
-    owner = "phonetic112";
+    owner = "phoneticalb";
     repo = "wl-clicker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-HuUK1kkqIdB5SdcewJ1J8elzqrFaFWC3BRV3GgcasTU=";
+    hash = "sha256-+k3iZOv12WbqpeYbYjIXBIB4mO2DrY1pl+MJn2B+cZA=";
   };
 
-  postPatch = ''
-    sed -i 's|/usr|${wlr-protocols}|g' Makefile
-  '';
-
   installPhase = ''
     runHook preInstall
 
@@ -40,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Wayland autoclicker";
     longDescription = "Script for auto clicking at incredibly high speeds - user must be a part of `input` group to run.";
-    homepage = "https://github.com/phonetic112/wl-clicker";
+    homepage = "https://github.com/phoneticalb/wl-clicker";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.Flameopathic ];
     mainProgram = "wl-clicker";

From 37c9a46f4b64a83d024f293126bfe2ab3629f28c Mon Sep 17 00:00:00 2001
From: Yiyu Zhou <yiyuzhou19@gmail.com>
Date: Tue, 18 Nov 2025 23:24:03 -0800
Subject: [PATCH 23/32] wl-clicker: cleanup

---
 pkgs/by-name/wl/wl-clicker/package.nix | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/wl/wl-clicker/package.nix b/pkgs/by-name/wl/wl-clicker/package.nix
index cf98ccccc065..122a36f5cc88 100644
--- a/pkgs/by-name/wl/wl-clicker/package.nix
+++ b/pkgs/by-name/wl/wl-clicker/package.nix
@@ -5,6 +5,7 @@
   wayland-scanner,
   wlr-protocols,
   wayland,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -20,22 +21,28 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "phoneticalb";
     repo = "wl-clicker";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-+k3iZOv12WbqpeYbYjIXBIB4mO2DrY1pl+MJn2B+cZA=";
   };
 
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin
-    install build/wl-clicker $out/bin/wl-clicker
+    install -D build/wl-clicker --target-directory="$out"/bin
 
     runHook postInstall
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Wayland autoclicker";
-    longDescription = "Script for auto clicking at incredibly high speeds - user must be a part of `input` group to run.";
+    longDescription = ''
+      Script for auto clicking at incredibly high speeds - user must
+      be a part of `input` group to run.
+    '';
     homepage = "https://github.com/phoneticalb/wl-clicker";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.Flameopathic ];

From c2086680a51f1ae9bf8c93e4118a189f1f2025ba Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 21 Nov 2025 15:50:34 +0100
Subject: [PATCH 24/32] swayidle: replace `systemd` with `systemdLibs`

---
 pkgs/by-name/sw/swayidle/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/sw/swayidle/package.nix b/pkgs/by-name/sw/swayidle/package.nix
index 30fd4cbd0407..72ca93e7d2b0 100644
--- a/pkgs/by-name/sw/swayidle/package.nix
+++ b/pkgs/by-name/sw/swayidle/package.nix
@@ -10,8 +10,8 @@
   wayland,
   wayland-protocols,
   runtimeShell,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
 }:
 
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "swaywm";
     repo = "swayidle";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-fxDwRfAXb9D6epLlyWnXpy9g8V3ovJRpQ/f3M4jxY/s=";
   };
 
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     wayland
     wayland-protocols
   ]
-  ++ lib.optionals systemdSupport [ systemd ];
+  ++ lib.optionals systemdSupport [ systemdLibs ];
 
   mesonFlags = [
     "-Dman-pages=enabled"

From c3b2cbe8c9ae29ca36f33f3b36c9c818c274ee2b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 21 Nov 2025 16:11:01 +0000
Subject: [PATCH 25/32] mitra: 4.13.0 -> 4.13.1

---
 pkgs/by-name/mi/mitra/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mi/mitra/package.nix b/pkgs/by-name/mi/mitra/package.nix
index ccb166f46769..921ad1f4bcee 100644
--- a/pkgs/by-name/mi/mitra/package.nix
+++ b/pkgs/by-name/mi/mitra/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mitra";
-  version = "4.13.0";
+  version = "4.13.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "silverpill";
     repo = "mitra";
     rev = "v${version}";
-    hash = "sha256-GPePSGQ40PaLo6twejaIkksJ2CDfzQ/TYcT+4qojmBY=";
+    hash = "sha256-cfE+4rbM5B9+ojevkoxc1ZY3r0TY5aRV8/qhZ3h4/0A=";
   };
 
-  cargoHash = "sha256-KSwfDuyh6Qy2TpjylwrKTMlQI/u3kAJuyX1IVDkuICM=";
+  cargoHash = "sha256-45vFKMPc73XBHCJISdab59HIkY3a0va8BGQMWsrhaZg=";
 
   # require running database
   doCheck = false;

From 77b792b0214773401cd3c2c18446d8e5a90a000c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 21 Nov 2025 16:21:35 +0000
Subject: [PATCH 26/32] paq: 1.2.0 -> 1.3.0

---
 pkgs/by-name/pa/paq/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pa/paq/package.nix b/pkgs/by-name/pa/paq/package.nix
index 2111ec6d502b..13cd81fcfc6a 100644
--- a/pkgs/by-name/pa/paq/package.nix
+++ b/pkgs/by-name/pa/paq/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "paq";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "gregl83";
     repo = "paq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vqJxFmPKQQil0iZOSfmy09/GkI3i1PorztIQPzg0UfE=";
+    hash = "sha256-rx9HkPLCRiaTbTLPPKOIhFU+WoJSr0dRtkvCUFZPn58=";
   };
 
-  cargoHash = "sha256-PpwYqwetylyYh6DKn2WiZrMOJmbnkv/cY5u51AVNVno=";
+  cargoHash = "sha256-XaP5rGEPL9Zlth0QYs736eaBPiw46u38GqmSXwnttX0=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";

From cb7163d8f334bbf39e37bfaf14f5473dc79833f8 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Fri, 21 Nov 2025 19:14:23 +0100
Subject: [PATCH 27/32] haskellPackages.cabalSdist: remove ghc workaround

The workaround added in https://github.com/NixOS/nixpkgs/pull/187726
for https://github.com/haskell/cabal/issues/8352 is no longer needed.

cabal-install 3.8.1.0 introduced a regression where `cabal sdist`
required GHC to be in PATH. This was fixed in cabal-install 3.10.1.0
(https://github.com/haskell/cabal/pull/8358), and nixpkgs now uses
cabal-install 3.16.0.0.

tests.haskell.cabalSdist passes.
---
 pkgs/development/haskell-modules/make-package-set.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/development/haskell-modules/make-package-set.nix b/pkgs/development/haskell-modules/make-package-set.nix
index 01d434a658ae..36d0fe878970 100644
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@@ -674,10 +674,6 @@ package-set { inherit pkgs lib callPackage; } self
         inherit src;
         nativeBuildInputs = [
           buildHaskellPackages.cabal-install
-
-          # TODO after https://github.com/haskell/cabal/issues/8352
-          #      remove ghc
-          self.ghc
         ];
         dontUnpack = false;
       }

From aafea336715565ef8f2f8bdf0d5fae71194605bd Mon Sep 17 00:00:00 2001
From: Xinyang Li <lixinyang411@gmail.com>
Date: Fri, 21 Nov 2025 21:05:29 +0200
Subject: [PATCH 28/32] eudic: fix incompatible Qt plugins version

---
 pkgs/by-name/eu/eudic/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/eu/eudic/package.nix b/pkgs/by-name/eu/eudic/package.nix
index e943552d3129..a2c486582b6f 100644
--- a/pkgs/by-name/eu/eudic/package.nix
+++ b/pkgs/by-name/eu/eudic/package.nix
@@ -74,7 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
     cp -r usr/share $out/share
     makeWrapper $out/share/eusoft-eudic/eudic $out/bin/eudic \
       --inherit-argv0 \
-      --set GST_PLUGIN_PATH $out/share/eusoft-eudic/gstreamer-1.0
+      --set GST_PLUGIN_PATH $out/share/eusoft-eudic/gstreamer-1.0 \
+      --set QT_PLUGIN_PATH $out/share/eusoft-eudic/plugins
 
     runHook postInstall
   '';

From 9662db19fae3267e441e8a5d4142e59f84c452e2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 21 Nov 2025 20:51:24 +0000
Subject: [PATCH 29/32] vscodium: 1.105.17075 -> 1.106.27818

---
 pkgs/applications/editors/vscode/vscodium.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 496a86337f80..7a914cee49b9 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -26,11 +26,11 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-+aMcRAM1mOu2rLCVGtkygGgM/8VNeteM66BOlmQCIpA=";
-      x86_64-darwin = "sha256-A/5l3LZn7SYNLkixNAfcb0HJlXY9dN9tjDT/KJ4Ycqk=";
-      aarch64-linux = "sha256-LxVKn5ld2mhsV9ya2V9zXEjtEZRAUWupMgkWXSgrL+8=";
-      aarch64-darwin = "sha256-jF18swYLWCtT0GerSLkT01M1sGZmkAb6bRZlRL5Bna4=";
-      armv7l-linux = "sha256-MlN22vWh0FiqgYQqZ1YjhAEtPRGaGv4Rz3J3LF6udts=";
+      x86_64-linux = "sha256-lteOBRRmAQbY1zlPaBU8wKdmtpCP4vkk5+YuQ0B5RXg=";
+      x86_64-darwin = "sha256-1AVMMMEVadg5NpV+xr9kyoX6bNB2uJjBbtXDJ878DvM=";
+      aarch64-linux = "sha256-XrY+WyRaEvczbtZWRdRhtOOzIOubM+2zvNQ8XMF8bQk=";
+      aarch64-darwin = "sha256-qgZTf8tWtpf1lRZL9hz3y1AAOn7zElAaCJRo4wUNYeQ=";
+      armv7l-linux = "sha256-mZof3m9FQrByZoUy7VtS56ePTzbSXmu2Uo1QC0Ay+nM=";
     }
     .${system} or throwSystem;
 
@@ -41,7 +41,7 @@ callPackage ./generic.nix rec {
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.105.17075";
+  version = "1.106.27818";
   pname = "vscodium";
 
   executableName = "codium";

From 4cb9036c4c37560b2c735984b304791dbc0bf941 Mon Sep 17 00:00:00 2001
From: vytskalt <vytskalt@protonmail.com>
Date: Sat, 22 Nov 2025 01:20:26 +0200
Subject: [PATCH 30/32] quickjs: fix cross compilation

---
 pkgs/by-name/qu/quickjs/package.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/qu/quickjs/package.nix b/pkgs/by-name/qu/quickjs/package.nix
index c687be6be8a2..41e949c8c5bb 100644
--- a/pkgs/by-name/qu/quickjs/package.nix
+++ b/pkgs/by-name/qu/quickjs/package.nix
@@ -24,7 +24,11 @@ stdenv.mkDerivation (finalAttrs: {
     texinfo
   ];
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "AR=${stdenv.cc.targetPrefix}ar"
+    "PREFIX=$(out)"
+  ];
 
   doInstallCheck = true;
 

From e31eb49db14f98b92b8c303561b81296faca1f26 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 22 Nov 2025 01:28:41 +0000
Subject: [PATCH 31/32] kodiPackages.youtube: 7.2.0.3 -> 7.3.0

---
 pkgs/applications/video/kodi/addons/youtube/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/video/kodi/addons/youtube/default.nix b/pkgs/applications/video/kodi/addons/youtube/default.nix
index b15ac8656b50..834ea94e8c0d 100644
--- a/pkgs/applications/video/kodi/addons/youtube/default.nix
+++ b/pkgs/applications/video/kodi/addons/youtube/default.nix
@@ -10,13 +10,13 @@
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.2.0.3";
+  version = "7.3.0";
 
   src = fetchFromGitHub {
     owner = "anxdpanic";
     repo = "plugin.video.youtube";
     rev = "v${version}";
-    hash = "sha256-Igw4F/6+Ewrxsz1RI4csYsHmB12bkbW+764fQvqCx+0=";
+    hash = "sha256-JVlIe63oyA8Re8nqLte4y5kyRENzyNg8ZJKdn9wJFwg=";
   };
 
   propagatedBuildInputs = [

From a1c388341ac04d089f018116c8b1efd18389e6a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 21 Nov 2025 17:33:44 -0800
Subject: [PATCH 32/32] diebahn: 2.9.2 -> 2.9.3

Diff: https://gitlab.com/schmiddi-on-mobile/railway/-/compare/2.9.2...2.9.3

Changelog: https://gitlab.com/schmiddi-on-mobile/railway/-/blob/2.9.3/CHANGELOG.md
---
 pkgs/by-name/di/diebahn/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/di/diebahn/package.nix b/pkgs/by-name/di/diebahn/package.nix
index 18e14e4dcfb6..9f10f9e61743 100644
--- a/pkgs/by-name/di/diebahn/package.nix
+++ b/pkgs/by-name/di/diebahn/package.nix
@@ -24,18 +24,18 @@
 
 stdenv.mkDerivation rec {
   pname = "diebahn";
-  version = "2.9.2";
+  version = "2.9.3";
 
   src = fetchFromGitLab {
     owner = "schmiddi-on-mobile";
     repo = "railway";
     tag = version;
-    hash = "sha256-e39FA0QKn91ZgN+SCY9kYQ6lGc8BgYgLxGj2dSUgi2Q=";
+    hash = "sha256-Bs+qn6QZnY37Kk7Xl4QE9k41T2W8gIvtcP4I5qLERNI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-UQc5Q2Wsr3YRSTjT+VWIWjOvDnS2ggvvcVPde+gjqlw=";
+    hash = "sha256-ijbVyVC0Vq5Olo3odzRv078CosAiIZ6KJNx0Gv5YunI=";
   };
 
   nativeBuildInputs = [