From d4c403493742e8d4a16bea691411b326d2e8b435 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 4 Jun 2025 04:51:54 +0000
Subject: [PATCH 001/181] dhcpcd: 10.1.0 -> 10.2.4

---
 pkgs/by-name/dh/dhcpcd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/dh/dhcpcd/package.nix b/pkgs/by-name/dh/dhcpcd/package.nix
index b6b814248050..3e1e04ed508f 100644
--- a/pkgs/by-name/dh/dhcpcd/package.nix
+++ b/pkgs/by-name/dh/dhcpcd/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dhcpcd";
-  version = "10.1.0";
+  version = "10.2.4";
 
   src = fetchFromGitHub {
     owner = "NetworkConfiguration";
     repo = "dhcpcd";
     rev = "v${version}";
-    sha256 = "sha256-Qtg9jOFMR/9oWJDmoNNcEAMxG6G1F187HF4MMBJIoTw=";
+    sha256 = "sha256-ysaKgF4Cu/S6yhSn/4glA0+Ey54KNp3/1Oh82yE0/PY=";
   };
 
   nativeBuildInputs = [ pkg-config ];

From 85dec7df938b7d90e580df411f0b63e1a5ce1415 Mon Sep 17 00:00:00 2001
From: transcaffeine <transcaffeine@finally.coffee>
Date: Fri, 4 Jul 2025 17:08:45 +0200
Subject: [PATCH 002/181] gradle_7: 7.6.5 -> 7.6.6

Release notes: https://github.com/gradle/gradle/releases/tag/v7.6.6
Full changelog: https://github.com/gradle/gradle/compare/v7.6.5...v7.6.6
---
 pkgs/development/tools/build-managers/gradle/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 69547ad9d803..2687a199d351 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -231,8 +231,8 @@ rec {
   };
 
   gradle_7 = gen {
-    version = "7.6.5";
-    hash = "sha256-uBL+wO230n4K41lViHuylUU2+j5E7a9IEVDaBY4VTZo=";
+    version = "7.6.6";
+    hash = "sha256-Zz2XdvMDvHBI/DMp0jLW6/EFGweJO9nRFhb62ahnO+A=";
     defaultJava = jdk17;
   };
 

From a70581ef626e844a8276bffd56a81f823f2c684f Mon Sep 17 00:00:00 2001
From: transcaffeine <transcaffeine@finally.coffee>
Date: Fri, 4 Jul 2025 17:12:04 +0200
Subject: [PATCH 003/181] gradle_8: 8.14.2 -> 8.14.3

Release notes: https://github.com/gradle/gradle/releases/tag/v8.14.3
Full changelog: https://github.com/gradle/gradle/compare/v8.14.2...v8.14.3
---
 pkgs/development/tools/build-managers/gradle/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 69547ad9d803..ab357f035ad6 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -225,8 +225,8 @@ rec {
   # https://docs.gradle.org/current/userguide/compatibility.html
 
   gradle_8 = gen {
-    version = "8.14.2";
-    hash = "sha256-cZehL0UHlJMVMkadT/IaWeosHNWaPsP4nANcPEIKaZk=";
+    version = "8.14.3";
+    hash = "sha256-vXEQIhNJMGCVbsIp2Ua+7lcVjb2J0OYrkbyg+ixfNTE=";
     defaultJava = jdk21;
   };
 

From 521f729120943c559b19549be2c95d8daa99ee40 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Sat, 5 Jul 2025 19:54:07 +0200
Subject: [PATCH 004/181] openblas: Add config for powerpc64-linux

---
 .../libraries/science/math/openblas/default.nix            | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 57d301d9c853..8bfd8115cbaa 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -109,6 +109,13 @@ let
       USE_OPENMP = false;
     };
 
+    powerpc64-linux = {
+      BINARY = 64;
+      TARGET = setTarget "POWER4";
+      DYNAMIC_ARCH = setDynamicArch false;
+      USE_OPENMP = !stdenv.hostPlatform.isMusl;
+    };
+
     powerpc64le-linux = {
       BINARY = 64;
       TARGET = setTarget "POWER5";

From e80c06264b0fa368e491d1e078995e2a71b14fbd Mon Sep 17 00:00:00 2001
From: Saterfield990 <traysaterfield@outlook.com>
Date: Mon, 23 Jun 2025 10:29:30 +0300
Subject: [PATCH 005/181] torsocks: move to by-name

---
 .../tor/torsocks.nix => by-name/to/torsocks/package.nix}        | 0
 .../to/torsocks}/torsocks-gethostbyaddr-darwin.patch            | 0
 pkgs/top-level/all-packages.nix                                 | 2 --
 3 files changed, 2 deletions(-)
 rename pkgs/{tools/security/tor/torsocks.nix => by-name/to/torsocks/package.nix} (100%)
 rename pkgs/{tools/security/tor => by-name/to/torsocks}/torsocks-gethostbyaddr-darwin.patch (100%)

diff --git a/pkgs/tools/security/tor/torsocks.nix b/pkgs/by-name/to/torsocks/package.nix
similarity index 100%
rename from pkgs/tools/security/tor/torsocks.nix
rename to pkgs/by-name/to/torsocks/package.nix
diff --git a/pkgs/tools/security/tor/torsocks-gethostbyaddr-darwin.patch b/pkgs/by-name/to/torsocks/torsocks-gethostbyaddr-darwin.patch
similarity index 100%
rename from pkgs/tools/security/tor/torsocks-gethostbyaddr-darwin.patch
rename to pkgs/by-name/to/torsocks/torsocks-gethostbyaddr-darwin.patch
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e611c86f0fa4..e31d8a76d5c1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4490,8 +4490,6 @@ with pkgs;
 
   tor = callPackage ../tools/security/tor { };
 
-  torsocks = callPackage ../tools/security/tor/torsocks.nix { };
-
   trackma-curses = trackma.override { withCurses = true; };
 
   trackma-gtk = trackma.override { withGTK = true; };

From bb1e393337761062dab85ecdd0224e92531de8de Mon Sep 17 00:00:00 2001
From: Saterfield990 <traysaterfield@outlook.com>
Date: Mon, 23 Jun 2025 11:11:46 +0300
Subject: [PATCH 006/181] torsocks: 2.4.0 -> 2.5.0

---
 pkgs/by-name/to/torsocks/package.nix | 46 ++++++++++++----------------
 1 file changed, 19 insertions(+), 27 deletions(-)

diff --git a/pkgs/by-name/to/torsocks/package.nix b/pkgs/by-name/to/torsocks/package.nix
index 5092a1e42af9..db78e0a0dc6a 100644
--- a/pkgs/by-name/to/torsocks/package.nix
+++ b/pkgs/by-name/to/torsocks/package.nix
@@ -5,28 +5,26 @@
   fetchpatch,
   autoreconfHook,
   libcap,
+  nix-update-script,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "torsocks";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
     group = "tpo";
     owner = "core";
     repo = "torsocks";
-    rev = "v${version}";
-    sha256 = "sha256-ocJkoF9LMLC84ukFrm5pzjp/1gaXqDz8lzr9TdG+f88=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-um5D6d/fzKynfa1kA/VbdnKvAlZ7jQs+pmOgWQMpwgM=";
   };
 
+  nativeBuildInputs = [ autoreconfHook ];
+
   patches = [
-    # fix compatibility with C99
-    # https://gitlab.torproject.org/tpo/core/torsocks/-/merge_requests/9
-    (fetchpatch {
-      url = "https://gitlab.torproject.org/tpo/core/torsocks/-/commit/1171bf2fd4e7a0cab02cf5fca59090b65af9cd29.patch";
-      hash = "sha256-qu5/0fy72+02QI0cVE/6YrR1kPuJxsZfG8XeODqVOPY=";
-    })
     # tsocks_libc_accept4 only exists on Linux, use tsocks_libc_accept on other platforms
     (fetchpatch {
       url = "https://gitlab.torproject.org/tpo/core/torsocks/uploads/eeec9833512850306a42a0890d283d77/0001-Fix-macros-for-accept4-2.patch";
@@ -36,30 +34,24 @@ stdenv.mkDerivation rec {
     ./torsocks-gethostbyaddr-darwin.patch
   ];
 
-  postPatch =
-    ''
-      # Patch torify_app()
-      sed -i \
-        -e 's,\(local app_path\)=`which $1`,\1=`type -P $1`,' \
-        src/bin/torsocks.in
-    ''
-    + lib.optionalString stdenv.hostPlatform.isLinux ''
-      sed -i \
-        -e 's,\(local getcap\)=.*,\1=${libcap}/bin/getcap,' \
-        src/bin/torsocks.in
-    '';
-
-  nativeBuildInputs = [ autoreconfHook ];
+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace src/bin/torsocks.in --replace-fail \
+    '"$(PATH="$PATH:/usr/sbin:/sbin" command -v getcap)"' '${libcap}/bin/getcap'
+  '';
 
   doInstallCheck = true;
   installCheckTarget = "check-recursive";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
+    changelog = "https://gitlab.torproject.org/tpo/core/torsocks/-/releases/v${finalAttrs.version}";
     description = "Wrapper to safely torify applications";
-    mainProgram = "torsocks";
     homepage = "https://gitlab.torproject.org/tpo/core/torsocks";
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.unix;
+    mainProgram = "torsocks";
     maintainers = with lib.maintainers; [ thoughtpolice ];
+    platforms = lib.platforms.unix;
   };
-}
+})

From 60a6246f2bb3872134366088cfba3170ef4f86f2 Mon Sep 17 00:00:00 2001
From: Saterfield990 <traysaterfield@outlook.com>
Date: Mon, 23 Jun 2025 11:15:13 +0300
Subject: [PATCH 007/181] tor: move to by-name

---
 .../to}/tor/disable-monotonic-timer-tests.patch                 | 0
 .../security/tor/default.nix => by-name/to/tor/package.nix}     | 0
 pkgs/{tools/security => by-name/to}/tor/update.nix              | 0
 pkgs/top-level/all-packages.nix                                 | 2 --
 4 files changed, 2 deletions(-)
 rename pkgs/{tools/security => by-name/to}/tor/disable-monotonic-timer-tests.patch (100%)
 rename pkgs/{tools/security/tor/default.nix => by-name/to/tor/package.nix} (100%)
 rename pkgs/{tools/security => by-name/to}/tor/update.nix (100%)

diff --git a/pkgs/tools/security/tor/disable-monotonic-timer-tests.patch b/pkgs/by-name/to/tor/disable-monotonic-timer-tests.patch
similarity index 100%
rename from pkgs/tools/security/tor/disable-monotonic-timer-tests.patch
rename to pkgs/by-name/to/tor/disable-monotonic-timer-tests.patch
diff --git a/pkgs/tools/security/tor/default.nix b/pkgs/by-name/to/tor/package.nix
similarity index 100%
rename from pkgs/tools/security/tor/default.nix
rename to pkgs/by-name/to/tor/package.nix
diff --git a/pkgs/tools/security/tor/update.nix b/pkgs/by-name/to/tor/update.nix
similarity index 100%
rename from pkgs/tools/security/tor/update.nix
rename to pkgs/by-name/to/tor/update.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e31d8a76d5c1..cbdb29eb9332 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4488,8 +4488,6 @@ with pkgs;
     }
   );
 
-  tor = callPackage ../tools/security/tor { };
-
   trackma-curses = trackma.override { withCurses = true; };
 
   trackma-gtk = trackma.override { withGTK = true; };

From 3283402efe94ac769ae764c039565bb5d0e2a5d2 Mon Sep 17 00:00:00 2001
From: Saterfield990 <traysaterfield@outlook.com>
Date: Mon, 7 Jul 2025 09:55:34 +0300
Subject: [PATCH 008/181] tor: cleanup

---
 pkgs/by-name/to/tor/package.nix | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/to/tor/package.nix b/pkgs/by-name/to/tor/package.nix
index 18aabfcd33c4..006c0f204029 100644
--- a/pkgs/by-name/to/tor/package.nix
+++ b/pkgs/by-name/to/tor/package.nix
@@ -15,6 +15,7 @@
   scrypt,
   nixosTests,
   writeShellScript,
+  versionCheckHook,
 
   # for update.nix
   writeScript,
@@ -27,6 +28,7 @@
   gnused,
   nix,
 }:
+
 let
   tor-client-auth-gen = writeShellScript "tor-client-auth-gen" ''
     PATH="${
@@ -48,13 +50,14 @@ let
     base64 -d | tail --bytes=32 | base32 | tr -d =
   '';
 in
-stdenv.mkDerivation rec {
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "tor";
   version = "0.4.8.17";
 
   src = fetchurl {
-    url = "https://dist.torproject.org/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ebRyXh1LiHueaP0JsNIkN3fVzjzUceU4WDvPb52M21Y=";
+    url = "https://dist.torproject.org/tor-${finalAttrs.version}.tar.gz";
+    hash = "sha256-ebRyXh1LiHueaP0JsNIkN3fVzjzUceU4WDvPb52M21Y=";
   };
 
   outputs = [
@@ -63,6 +66,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkg-config ];
+
   buildInputs =
     [
       libevent
@@ -98,8 +102,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace contrib/client-tools/torify \
-      --replace 'pathfind torsocks' true          \
-      --replace 'exec torsocks' 'exec ${torsocks}/bin/torsocks'
+      --replace-fail 'exec torsocks' 'exec ${torsocks}/bin/torsocks'
 
     patchShebangs ./scripts/maint/checkShellScripts.sh
   '';
@@ -117,6 +120,10 @@ stdenv.mkDerivation rec {
     ln -s ${tor-client-auth-gen} $out/bin/tor-client-auth-gen
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
   passthru = {
     tests.tor = nixosTests.tor;
     updateScript = import ./update.nix {
@@ -135,10 +142,9 @@ stdenv.mkDerivation rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.torproject.org/";
     description = "Anonymizing overlay network";
-
     longDescription = ''
       Tor helps improve your privacy by bouncing your communications around a
       network of relays run by volunteers all around the world: it makes it
@@ -148,17 +154,16 @@ stdenv.mkDerivation rec {
       instant messaging clients, remote login, and other applications based on
       the TCP protocol.
     '';
-
-    license = with licenses; [
+    license = with lib.licenses; [
       bsd3
       gpl3Only
     ];
-
-    maintainers = with maintainers; [
+    mainProgram = "tor";
+    maintainers = with lib.maintainers; [
       thoughtpolice
       joachifm
       prusnak
     ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
-}
+})

From d780e942be3caaa81ad8d42fa058af71a4983dc0 Mon Sep 17 00:00:00 2001
From: "Alexander V. Nikolaev" <avn@avnik.info>
Date: Tue, 8 Jul 2025 14:27:54 +0300
Subject: [PATCH 009/181] pop-gtk-theme: fix cross-compilation

Use optipng and inkscape from buildPackages, not from target

Signed-off-by: Alexander V. Nikolaev <avn@avnik.info>
---
 pkgs/by-name/po/pop-gtk-theme/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/po/pop-gtk-theme/package.nix b/pkgs/by-name/po/pop-gtk-theme/package.nix
index ffcd53531128..da11dd534d50 100644
--- a/pkgs/by-name/po/pop-gtk-theme/package.nix
+++ b/pkgs/by-name/po/pop-gtk-theme/package.nix
@@ -12,6 +12,7 @@
   gdk-pixbuf,
   librsvg,
   python3,
+  buildPackages,
 }:
 
 stdenv.mkDerivation {
@@ -50,9 +51,9 @@ stdenv.mkDerivation {
     for file in $(find -name render-\*.sh); do
       substituteInPlace "$file" \
         --replace 'INKSCAPE="/usr/bin/inkscape"' \
-                  'INKSCAPE="${inkscape}/bin/inkscape"' \
+                  'INKSCAPE="${buildPackages.inkscape}/bin/inkscape"' \
         --replace 'OPTIPNG="/usr/bin/optipng"' \
-                  'OPTIPNG="${optipng}/bin/optipng"'
+                  'OPTIPNG="${buildPackages.optipng}/bin/optipng"'
     done
   '';
 

From 8046e4a6f8e4eec20f404911b090025c1fde99e9 Mon Sep 17 00:00:00 2001
From: Christian Theune <ct@flyingcircus.io>
Date: Tue, 1 Jul 2025 14:32:10 +0200
Subject: [PATCH 010/181] nixos/varnish: turn listen addresses into structured
 config

Introduces `services.varnish.listen` as a list of structured
listen addresses with all allowed variations of arguments
documented in the man page.

Deprecates `services.varnish.http_address`.
---
 .../manual/release-notes/rl-2511.section.md   |   3 +
 .../services/web-servers/varnish/default.nix  | 126 +++++++++++++++++-
 nixos/tests/varnish.nix                       |  52 +++++++-
 3 files changed, 175 insertions(+), 6 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 1d3c230e682d..b05aef58037c 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -103,4 +103,7 @@
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
 
+- `services.varnish.http_address` has been superseeded by `services.varnish.listen` which is now
+  structured config for all of varnish's `-a` variations.
+
 - [](#opt-services.gnome.gnome-keyring.enable) does not ship with an SSH agent anymore, as this is now handled by the `gcr_4` package instead of `gnome-keyring`. A new module has been added to support this, under [](#opt-services.gnome.gcr-ssh-agent.enable) (its default value has been set to [](#opt-services.gnome.gnome-keyring.enable) to ensure a smooth transition). See the [relevant upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67) for more details.
diff --git a/nixos/modules/services/web-servers/varnish/default.nix b/nixos/modules/services/web-servers/varnish/default.nix
index 6b3ff33d2348..f42ed39ece80 100644
--- a/nixos/modules/services/web-servers/varnish/default.nix
+++ b/nixos/modules/services/web-servers/varnish/default.nix
@@ -6,6 +6,16 @@
 }:
 
 let
+  inherit (lib)
+    types
+    mkOption
+    hasPrefix
+    concatMapStringsSep
+    optionalString
+    concatMap
+    ;
+  inherit (builtins) isNull;
+
   cfg = config.services.varnish;
 
   # Varnish has very strong opinions and very complicated code around handling
@@ -26,6 +36,91 @@ let
     else
       "/var/run/varnishd";
 
+  # from --help:
+  #   -a [<name>=]address[:port][,proto] # HTTP listen address and port
+  #      [,user=<u>][,group=<g>]   # Can be specified multiple times.
+  #      [,mode=<m>]               #   default: ":80,HTTP"
+  #                                # Proto can be "PROXY" or "HTTP" (default)
+  #                                # user, group and mode set permissions for
+  #                                #   a Unix domain socket.
+  commandLineAddresses =
+    (concatMapStringsSep " " (
+      a:
+      "-a "
+      + optionalString (!isNull a.name) "${a.name}="
+      + a.address
+      + optionalString (!isNull a.port) ":${toString a.port}"
+      + optionalString (!isNull a.proto) ",${a.proto}"
+      + optionalString (!isNull a.user) ",user=${a.user}"
+      + optionalString (!isNull a.group) ",group=${a.group}"
+      + optionalString (!isNull a.mode) ",mode=${a.mode}"
+    ) cfg.listen)
+    + lib.optionalString (!isNull cfg.http_address) " -a ${cfg.http_address}";
+  addressSubmodule = types.submodule {
+    options = {
+      name = mkOption {
+        description = "Name is referenced in logs. If name is not specified, 'a0', 'a1', etc. is used.";
+        default = null;
+        type = with types; nullOr str;
+      };
+      address = mkOption {
+        description = ''
+          If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad
+          ("127.0.0.1") or an IPv6  address enclosed in square brackets ("[::1]").
+
+          (VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@"
+          followed by the name of an abstract socket ("@myvarnishd") accept connections
+          on a Unix domain socket.
+
+          The user, group and mode sub-arguments may be used to specify the permissions
+          of the socket file. These sub-arguments do not apply to  abstract sockets.
+        '';
+        type = types.str;
+      };
+      port = mkOption {
+        description = "The port to use for IP sockets. If port is not specified, port 80 (http) is used.";
+        default = null;
+        type = with types; nullOr int;
+      };
+      proto = mkOption {
+        description = "PROTO can be 'HTTP' (the default) or 'PROXY'.  Both version 1 and 2 of the proxy protocol can be used.";
+        type = types.enum [
+          "HTTP"
+          "PROXY"
+        ];
+        default = "HTTP";
+      };
+      user = mkOption {
+        description = "User name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      group = mkOption {
+        description = "Group name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      mode = mkOption {
+        description = "Permission of the socket file (3-digit octal value).";
+        default = null;
+        type = with types; nullOr str;
+      };
+    };
+  };
+  checkedAddressModule = types.addCheck addressSubmodule (
+    m:
+    (
+      if ((hasPrefix "@" m.address) || (hasPrefix "/" m.address)) then
+        # this is a unix socket
+        (m.port != null)
+      else
+      # this is not a path-based unix socket
+      if !(hasPrefix "/" m.address) && (m.group != null) || (m.user != null) || (m.mode != null) then
+        false
+      else
+        true
+    )
+  );
   commandLine =
     "-f ${pkgs.writeText "default.vcl" cfg.config}"
     +
@@ -54,13 +149,23 @@ in
       package = lib.mkPackageOption pkgs "varnish" { };
 
       http_address = lib.mkOption {
-        type = lib.types.str;
-        default = "*:6081";
+        type = with lib.types; nullOr str;
+        default = null;
         description = ''
           HTTP listen address and port.
         '';
       };
 
+      listen = lib.mkOption {
+        description = "Accept for client requests on the specified listen addresses.";
+        type = lib.types.listOf checkedAddressModule;
+        defaultText = lib.literalExpression ''[ { address="*"; port=6081; } ]'';
+        default = lib.optional (isNull cfg.http_address) {
+          address = "*";
+          port = 6081;
+        };
+      };
+
       config = lib.mkOption {
         type = lib.types.lines;
         description = ''
@@ -97,7 +202,7 @@ in
       serviceConfig = {
         Type = "simple";
         PermissionsStartOnly = true;
-        ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
+        ExecStart = "${cfg.package}/sbin/varnishd ${commandLineAddresses} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
         Restart = "always";
         RestartSec = "5s";
         User = "varnish";
@@ -118,6 +223,21 @@ in
       '')
     ];
 
+    assertions = concatMap (m: [
+      {
+        assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
+        message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
+      }
+      {
+        assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
+        message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
+      }
+    ]) cfg.listen;
+
+    warnings =
+      lib.optional (!isNull cfg.http_address)
+        "The option `services.varnish.http_address` is deprecated. Use `services.varnish.listen` instead.";
+
     users.users.varnish = {
       group = "varnish";
       uid = config.ids.uids.varnish;
diff --git a/nixos/tests/varnish.nix b/nixos/tests/varnish.nix
index 8fa18da31236..10946fcdff65 100644
--- a/nixos/tests/varnish.nix
+++ b/nixos/tests/varnish.nix
@@ -10,7 +10,12 @@ in
 
   nodes = {
     varnish =
-      { config, pkgs, ... }:
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
       {
         services.nix-serve = {
           enable = true;
@@ -19,9 +24,29 @@ in
         services.varnish = {
           inherit package;
           enable = true;
-          http_address = "0.0.0.0:80";
+          http_address = "0.0.0.0:81";
+          listen = [
+            {
+              address = "0.0.0.0";
+              port = 80;
+              proto = "HTTP";
+            }
+            {
+              name = "proxyport";
+              address = "0.0.0.0";
+              port = 8080;
+              proto = "PROXY";
+            }
+            { address = "@asdf"; }
+            {
+              address = "/run/varnishd/client.http.sock";
+              user = "varnish";
+              group = "varnish";
+              mode = "660";
+            }
+          ];
           config = ''
-            vcl 4.0;
+            vcl 4.1;
 
             backend nix-serve {
               .host = "127.0.0.1";
@@ -32,6 +57,26 @@ in
 
         networking.firewall.allowedTCPPorts = [ 80 ];
         system.extraDependencies = [ testPath ];
+
+        assertions =
+          map
+            (
+              pattern:
+              let
+                cmdline = config.systemd.services.varnish.serviceConfig.ExecStart;
+              in
+              {
+                assertion = lib.hasInfix pattern cmdline;
+                message = "Address argument `${pattern}` missing in commandline `${cmdline}`.";
+              }
+            )
+            [
+              " -a 0.0.0.0:80,HTTP "
+              " -a proxyport=0.0.0.0:8080,PROXY "
+              " -a @asdf,HTTP "
+              " -a /run/varnishd/client.http.sock,HTTP,user=varnish,group=varnish,mode=660 "
+              " -a 0.0.0.0:81 "
+            ];
       };
 
     client =
@@ -48,6 +93,7 @@ in
     start_all()
     varnish.wait_for_open_port(80)
 
+
     client.wait_until_succeeds("curl -f http://varnish/nix-cache-info");
 
     client.wait_until_succeeds("nix-store -r ${testPath}")

From 51b1a4d21002b236ec30dc82890605d4b6196ef8 Mon Sep 17 00:00:00 2001
From: Friedrich Altheide <friedrich.altheide@w34you.de>
Date: Tue, 8 Jul 2025 15:31:24 +0200
Subject: [PATCH 011/181] networkmanager: 1.52.0 -> 1.52.1

---
 pkgs/tools/networking/networkmanager/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 2feabeefa54a..a32da370bef2 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -60,11 +60,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "networkmanager";
-  version = "1.52.0";
+  version = "1.52.1";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/${finalAttrs.version}/downloads/NetworkManager-${finalAttrs.version}.tar.xz";
-    hash = "sha256-NW8hoV2lHkIY/U0P14zqYeBnsRFqJc3e5K+d8FBi6S0=";
+    hash = "sha256-ixIsc0k6cvK65SfBJc69h3EWcbkDUtvisXiKupV1rG8=";
   };
 
   outputs = [

From aa139f0e239922c7f6d2d8b88f18168fb3bf98c3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 15:20:30 +0000
Subject: [PATCH 012/181] searxng: 0-unstable-2025-06-28 ->
 0-unstable-2025-07-08

---
 pkgs/by-name/se/searxng/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index 035bf1c2a8ca..ea1af5f85b13 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -38,14 +38,14 @@ in
 python.pkgs.toPythonModule (
   python.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2025-06-28";
+    version = "0-unstable-2025-07-08";
     format = "setuptools";
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "df76647c52b56101f152c5dec7c1d08f1732ceb7";
-      hash = "sha256-8Rh42DFLyQz+4cWA8x5wpFO41DusMuTo8NAloprw5w0=";
+      rev = "bd593d0bad2189f57657bbcfa2c5e86f795c680e";
+      hash = "sha256-vNI66OKA8LPXqc2mt8lm4iKS6njRLQhjzcykCQyPJsk=";
     };
 
     postPatch = ''

From c821b3953025fbd8232881efc862a9da48e2eacf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 01:52:39 +0000
Subject: [PATCH 013/181] nomad: 1.10.2 -> 1.10.3

---
 pkgs/applications/networking/cluster/nomad/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/nomad/default.nix b/pkgs/applications/networking/cluster/nomad/default.nix
index b86cbb7d8bdf..9f34af0fa64c 100644
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@@ -91,9 +91,9 @@ rec {
 
   nomad_1_10 = generic {
     buildGoModule = buildGo124Module;
-    version = "1.10.2";
-    hash = "sha256-7i/tMQwaEmLGXNarrdPzmorv+SHrxCzeaF3BI9Jjhwg=";
-    vendorHash = "sha256-yq8xQ9wThPK/X9/lEHD8FCXq1Mrz0lO6UvrP2ipXMnw=";
+    version = "1.10.3";
+    hash = "sha256-sDOo7b32H/d5OJ6CRyga1rZZk55bFTi4ynHL/aIH87w=";
+    vendorHash = "sha256-bpCnpeRk329vUd9e6x7iCh+1ouSGd4o4Hq79K0qchJ8=";
     license = lib.licenses.bsl11;
     passthru.tests.nomad = nixosTests.nomad;
     preCheck = ''

From 8d74a9061c4cd4b131089fae99269e3d3ddda47e Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 9 Jul 2025 14:46:42 +0200
Subject: [PATCH 014/181] nodejs_24: 24.3.0 -> 24.4.0

---
 pkgs/development/web/nodejs/v24.nix | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 9b44178afda9..c4bb1f022071 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -17,8 +17,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "24.3.0";
-  sha256 = "eb688ef8a63fda9ebc0b5f907609a46e26db6d9aceefc0832009a98371e992ed";
+  version = "24.4.0";
+  sha256 = "42fa8079da25a926013cd89b9d3467d09110e4fbb0c439342ebe4dd6ecc26bbb";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -51,13 +51,6 @@ buildNodejs {
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
-
-      # Fix for flaky test
-      # TODO: remove when included in a release
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/cd685fe3b6b18d2a1433f2635470513896faebe6.patch?full_index=1";
-        hash = "sha256-KA7WBFnLXCKx+QVDGxFixsbj3Y7uJkAKEUTeLShI1Xo=";
-      })
     ]
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [
       # test-icu-env is failing without the reverts

From 65648b547119f1096476ed67a800f5a2ced6f9f6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Jul 2025 18:16:38 +0000
Subject: [PATCH 015/181] master_me: 1.3.0 -> 1.3.1

---
 pkgs/by-name/ma/master_me/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/master_me/package.nix b/pkgs/by-name/ma/master_me/package.nix
index a12562ff8cab..38836aa35544 100644
--- a/pkgs/by-name/ma/master_me/package.nix
+++ b/pkgs/by-name/ma/master_me/package.nix
@@ -11,14 +11,14 @@
 }:
 stdenv.mkDerivation rec {
   pname = "master_me";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "trummerschlunk";
     repo = "master_me";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-PEa1EHgr3dcM2Kh0AHvy1knKkRo89D6J4h6qGFy1vVY=";
+    hash = "sha256-eesMXxRcCgzhSQ+WUqM00EuKYhFxysjH+RWKHKGYzUM=";
   };
 
   nativeBuildInputs = [ pkg-config ];

From 89445e7a4b0ad86017de4380585c5254ca65d2a0 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 9 Jul 2025 20:57:21 +0100
Subject: [PATCH 016/181] naev: 0.12.5 -> 0.12.6

Changes: https://github.com/naev/naev/releases/tag/v0.12.6
---
 pkgs/by-name/na/naev/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/na/naev/package.nix b/pkgs/by-name/na/naev/package.nix
index 970af62c4330..a988a316c909 100644
--- a/pkgs/by-name/na/naev/package.nix
+++ b/pkgs/by-name/na/naev/package.nix
@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "naev";
-  version = "0.12.5";
+  version = "0.12.6";
 
   src = fetchFromGitHub {
     owner = "naev";
     repo = "naev";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-I+OU3sr+C8HPnJTQ+Cc/EvshzawqikoMg3cp9uQ5dSQ=";
+    hash = "sha256-Phes5d7q1PgviwKFcvDvm9xregcbj2NTTPdmbaXJ19Y=";
     fetchSubmodules = true;
   };
 

From 3804083ce4b4fa87d90bfff429b0623280a8b268 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 10 Jul 2025 14:02:48 +0200
Subject: [PATCH 017/181] python313Packages.pylitterbot: 2024.2.1 -> 2024.2.2

Diff: https://github.com/natekspencer/pylitterbot/compare/refs/tags/v2024.2.1...refs/tags/v2024.2.2

Changelog: https://github.com/natekspencer/pylitterbot/releases/tag/v2024.2.2
---
 pkgs/development/python-modules/pylitterbot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pylitterbot/default.nix b/pkgs/development/python-modules/pylitterbot/default.nix
index 7f9d01ae3964..26f7b8934954 100644
--- a/pkgs/development/python-modules/pylitterbot/default.nix
+++ b/pkgs/development/python-modules/pylitterbot/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pylitterbot";
-  version = "2024.2.1";
+  version = "2024.2.2";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "natekspencer";
     repo = "pylitterbot";
     tag = "v${version}";
-    hash = "sha256-33LiWgI9E7/I6fyrdv+YXcw+gxUOsPZ0mYvEIF8/fOI=";
+    hash = "sha256-FKBgvP3qXT3nKHn5R9pp4nYNX+mO4vfDi5fzQ5+y1Nc=";
   };
 
   pythonRelaxDeps = [ "deepdiff" ];

From 4a3cdf0ca093ed71dd49d8ed0106bb23174f52ac Mon Sep 17 00:00:00 2001
From: Ivan Mincik <ivan.mincik@gmail.com>
Date: Thu, 10 Jul 2025 12:34:02 +0200
Subject: [PATCH 018/181] qt6Packages.qwt: build qwt for Qt6

---
 pkgs/top-level/qt6-packages.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index 5efa85cfec65..8a64dc00c9f9 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -117,6 +117,8 @@ makeScopeWithSplicing' {
         wlroots = pkgs.wlroots_0_18;
       };
 
+      qwt = callPackage ../development/libraries/qwt/default.nix { };
+
       qxlsx = callPackage ../development/libraries/qxlsx { };
 
       qzxing = callPackage ../development/libraries/qzxing { };

From fda9a5f9e34131008ca8e8b9d33f688edec58c07 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 21:09:08 +0000
Subject: [PATCH 019/181] g-ls: 0.30.0 -> 0.31.0

---
 pkgs/by-name/g-/g-ls/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/g-/g-ls/package.nix b/pkgs/by-name/g-/g-ls/package.nix
index bea5ed3e1b43..77a3664dd896 100644
--- a/pkgs/by-name/g-/g-ls/package.nix
+++ b/pkgs/by-name/g-/g-ls/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "g-ls";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "Equationzhao";
     repo = "g";
     tag = "v${version}";
-    hash = "sha256-OaYWorybwUxG452b0vEKwryxmRaNTQ5xDWe9GmEWuGE=";
+    hash = "sha256-cHB9oW4vF00hvhZ7KNY5TUjIjLjEoiJb/psMSq+kSHU=";
   };
 
-  vendorHash = "sha256-E/4iB1apLCOEtijCZymObz0Zjlf0+dQC37ALSbl1tr0=";
+  vendorHash = "sha256-5ksa0AJ7JbQPzBypDDMUvnXtIeXNEm9zKL5JetHWnrs=";
 
   subPackages = [ "." ];
 

From a4114b2a0c649392eb032b6b6de4ba1027c0524e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 21:14:55 +0000
Subject: [PATCH 020/181] vacuum-go: 0.17.1 -> 0.17.5

---
 pkgs/by-name/va/vacuum-go/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index 673958c802bc..b51a1cf70126 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.17.1";
+  version = "0.17.5";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zWnYBDNsOoyc28JB8/dbommIxKUU2XGOHHYsR2q1hj0=";
+    hash = "sha256-QBbpDV/hlzFgrmCsywH5CC43V2Rt0fwPkf6ZCgjqqUc=";
   };
 
-  vendorHash = "sha256-4cYG8ilWSI+bSoEBpohN6Fr3kmsBUNmbz0iyHmiCDgw=";
+  vendorHash = "sha256-AjmET86E/xu6DTK07kMySWp5Z8W1RE/QPSe2B/IfDl0=";
 
   env.CGO_ENABLED = 0;
   ldflags = [

From 7dc2414beb3a8aad4719428e40b14f86740f0754 Mon Sep 17 00:00:00 2001
From: Jon Hermansen <jon@jh86.org>
Date: Thu, 10 Jul 2025 17:50:23 -0400
Subject: [PATCH 021/181] microsoft-edge: 138.0.3351.77 -> 138.0.3351.83

---
 pkgs/by-name/mi/microsoft-edge/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index de3ebc0f46f5..74c8548b6a20 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -179,11 +179,11 @@ in
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "138.0.3351.77";
+  version = "138.0.3351.83";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-8D0aYlzkp5ol7s6m1342BJONiiQgyZeClREFw0mZqHY=";
+    hash = "sha256-NcDw2483l+VmBgr4Ue2vZmFFs3ZdWJvsfsub7stMEOE=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly

From e2fc417b2eea8b22dca75f46dad675e7cb09092d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 22:00:08 +0000
Subject: [PATCH 022/181] trealla: 2.77.23 -> 2.78.0

---
 pkgs/by-name/tr/trealla/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/tr/trealla/package.nix b/pkgs/by-name/tr/trealla/package.nix
index b767ffb6dea9..a7cb1b88a7cb 100644
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@@ -23,13 +23,13 @@ assert lib.elem lineEditingLibrary [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.77.23";
+  version = "2.78.0";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PkQ9fBkkhGBlkbII/C+E5g4AQR6xckrRkAgKBwVhNuk=";
+    hash = "sha256-CJ1/Qbt6osuJZNuKiEaGEsDztVo8hTNOv6XvUQyWbFU=";
   };
 
   postPatch = ''

From 31dc88c4ad5caeccadf894d4b4cf51c74458ffd8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 06:47:35 +0000
Subject: [PATCH 023/181] python3Packages.redshift-connector: 2.1.7 -> 2.1.8

---
 .../development/python-modules/redshift-connector/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/redshift-connector/default.nix b/pkgs/development/python-modules/redshift-connector/default.nix
index dda175d64495..7f5e9fb48e30 100644
--- a/pkgs/development/python-modules/redshift-connector/default.nix
+++ b/pkgs/development/python-modules/redshift-connector/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "redshift-connector";
-  version = "2.1.7";
+  version = "2.1.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "amazon-redshift-python-driver";
     tag = "v${version}";
-    hash = "sha256-OMi8788F2qjMOVDLuJLVReqNv7c/DpXTy1UpqoKRmnQ=";
+    hash = "sha256-q8TQYiPmm3w9Bh4+gvVW5XAa4FZ3+/MZqZL0RCgl77E=";
   };
 
   # remove addops as they add test directory and coverage parameters to pytest

From 0bcdde01294b874346912f489fb9c3338b8102ce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 07:46:24 +0000
Subject: [PATCH 024/181] amazon-q-cli: 1.12.2 -> 1.12.4

---
 pkgs/by-name/am/amazon-q-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/am/amazon-q-cli/package.nix b/pkgs/by-name/am/amazon-q-cli/package.nix
index bf68e93100d0..e793ec319dbb 100644
--- a/pkgs/by-name/am/amazon-q-cli/package.nix
+++ b/pkgs/by-name/am/amazon-q-cli/package.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "amazon-q-cli";
-  version = "1.12.2";
+  version = "1.12.4";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-q-developer-cli-autocomplete";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TIKG1nzpmjiHE+EjTJR+/GklQNJQeUzmDXaPEiRT80Y=";
+    hash = "sha256-juZuqZkBsIHhLOCZk+QpTaO1BsHj2RZyCvkvc0G5KbU=";
   };
 
   nativeBuildInputs = [
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-lJbHPqQ3eybo03oZY2VyKlsxcTdbdrc8q8AjV+IahEY=";
+  cargoHash = "sha256-BT3LNOkRf4gfBy5SwuAnMoJVF9PmwiLsS5phdtEgIrs=";
 
   cargoBuildFlags = [
     "-p"

From 354336f686e97ede48034f0da42f2e54972d0d44 Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Fri, 4 Jul 2025 15:57:50 +0200
Subject: [PATCH 025/181] docker: 28.2.2 -> 28.3.2

https://github.com/moby/moby/compare/v28.2.2...v28.3.2
https://github.com/docker/cli/compare/v28.2.2...v28.3.2
---
 pkgs/applications/virtualization/docker/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 8449e7a75a64..283dedb1047a 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -383,11 +383,11 @@ rec {
   };
 
   docker_28 = callPackage dockerGen rec {
-    version = "28.2.2";
+    version = "28.3.2";
     cliRev = "v${version}";
-    cliHash = "sha256-ZaKG4H8BqIzgs9OFktH9bjHSf9exAlh5kPCGP021BWI=";
+    cliHash = "sha256-LsV9roOPw0LccvBUeF3bY014OwG6QpnVsLf+dqKyvsg=";
     mobyRev = "v${version}";
-    mobyHash = "sha256-Y2yP2NBJLrI83iHe2EoA7/cXiQifrCkUKlwJhINKBXE=";
+    mobyHash = "sha256-YfdnCAc9NgLTuvxLHGhTPdWqXz9VSVsQsfzLD3YER3g=";
     runcRev = "v1.2.6";
     runcHash = "sha256-XMN+YKdQOQeOLLwvdrC6Si2iAIyyHD5RgZbrOHrQE/g=";
     containerdRev = "v1.7.27";

From 651d395beb3a01e52827bfe236537b514ad876f0 Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Fri, 11 Jul 2025 10:04:26 +0200
Subject: [PATCH 026/181] docker_25: 25.0.10 -> 25.0.11

https://github.com/moby/moby/milestone/197?closed=1

Upstream did not tag a new release for docker/cli, and there are no new
commits in the 25.0 branch:
https://github.com/docker/cli/compare/43987fca488a535d810c429f75743d8c7b63bf4f...25.0

https://github.com/moby/moby/compare/v25.0.10...v25.0.11
---
 pkgs/applications/virtualization/docker/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 283dedb1047a..9d8e38a8b28f 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -367,13 +367,13 @@ rec {
   # Get revisions from
   # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
   docker_25 = callPackage dockerGen rec {
-    version = "25.0.10";
+    version = "25.0.11";
     # Upstream forgot to tag release
     # https://github.com/docker/cli/issues/5789
     cliRev = "43987fca488a535d810c429f75743d8c7b63bf4f";
     cliHash = "sha256-OwufdfuUPbPtgqfPeiKrQVkOOacU2g4ommHb770gV40=";
     mobyRev = "v${version}";
-    mobyHash = "sha256-57iXL+QYtbEz099yOTR4k/2Z7CT08OAkQ3kVJSmsa/U=";
+    mobyHash = "sha256-vHHi0/sX9fm83gyUjDpRYTGV9h18IVia1oSmj4n31nc=";
     runcRev = "v1.2.5";
     runcHash = "sha256-J/QmOZxYnMPpzm87HhPTkYdt+fN+yeSUu2sv6aUeTY4=";
     containerdRev = "v1.7.27";

From ffe79b95e8c9debef031d80d801fc7a35cdf9672 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 08:39:11 +0000
Subject: [PATCH 027/181] sheldon: 0.8.3 -> 0.8.4

---
 pkgs/by-name/sh/sheldon/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sh/sheldon/package.nix b/pkgs/by-name/sh/sheldon/package.nix
index 87ecc05bbc28..1dc0e140ca84 100644
--- a/pkgs/by-name/sh/sheldon/package.nix
+++ b/pkgs/by-name/sh/sheldon/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sheldon";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "rossmacarthur";
     repo = "sheldon";
     rev = version;
-    hash = "sha256-+NtiscyNlrXNNj3njvdZQB8dHs/PBYpEo9VwodEOtDs=";
+    hash = "sha256-CkcY4YVTguULE/4QGX72X3Jdi+z1XWo1M0J6ocCavCI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-O9v77mwOeTnT4LetcrzQjdd3MDXDbpptUODMAVBwZv8=";
+  cargoHash = "sha256-H2PQyfBaQ0jD69LMEi3kkgPWk0RkOI8b7ODGzks/gj0=";
 
   buildInputs =
     [ openssl ]

From f2652ec5da533f8ee4fe3662990ef29c44334f0a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 11:23:23 +0000
Subject: [PATCH 028/181] python3Packages.optype: 0.10.0 -> 0.11.0

---
 pkgs/development/python-modules/optype/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/optype/default.nix b/pkgs/development/python-modules/optype/default.nix
index a6bc03c35523..2692774265a7 100644
--- a/pkgs/development/python-modules/optype/default.nix
+++ b/pkgs/development/python-modules/optype/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "optype";
-  version = "0.10.0";
+  version = "0.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jorenham";
     repo = "optype";
     tag = "v${version}";
-    hash = "sha256-F6nkbSSmAHIs2I/Yi1+PPtEsSSTnCO8Hsws7JyleJsM=";
+    hash = "sha256-jExwQiEkCLiVFwiFYp2dBvH5PiRlSVG20CneGnht+No=";
   };
 
   disabled = pythonOlder "3.11";

From 8049bef5a694d12486c4cf8c2c687148c00efec4 Mon Sep 17 00:00:00 2001
From: Ingo Reitz <9l@9lo.re>
Date: Fri, 11 Jul 2025 13:37:58 +0200
Subject: [PATCH 029/181] coreboot-toolchain: pin gcc and gnat to 14

---
 pkgs/development/tools/misc/coreboot-toolchain/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/coreboot-toolchain/default.nix b/pkgs/development/tools/misc/coreboot-toolchain/default.nix
index a0d9a450ff55..03da396b9950 100644
--- a/pkgs/development/tools/misc/coreboot-toolchain/default.nix
+++ b/pkgs/development/tools/misc/coreboot-toolchain/default.nix
@@ -15,8 +15,8 @@ let
         flex,
         getopt,
         git,
-        gnat,
-        gcc,
+        gnat14,
+        gcc14,
         lib,
         perl,
         stdenvNoCC,
@@ -50,7 +50,7 @@ let
         buildInputs = [
           flex
           zlib
-          (if withAda then gnat else gcc)
+          (if withAda then gnat14 else gcc14)
         ];
 
         enableParallelBuilding = true;

From c1db8a0cfebdf77066776728854c3bf0f32df09c Mon Sep 17 00:00:00 2001
From: "Ifiok Jr." <ifiokotung@gmail.com>
Date: Fri, 11 Jul 2025 08:09:37 +0100
Subject: [PATCH 030/181] scooter: compile only `scooter`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I was seeing the following error when installing `scooter` after
installing `lsp-ai`. This change specifies the bin `scooter`.

```bash
➜ nix profile add nixpkgs#scooter
error: An existing package already provides the following file:

/nix/store/lzqlq6jrb4rlx6si51xrg3blgcvpn0d9-lsp-ai-0.7.1/bin/xtask

       This is the conflicting file from the new package:

/nix/store/nminr7pl0zd9ikr2xbdbx74lilwcm3bk-scooter-0.5.3/bin/xtask

       To remove the existing package:

         nix profile remove lsp-ai

       The new package can also be added next to the existing one by
assigning a different priority.
       The conflicting packages have a priority of 5.
       To prioritise the new package:

         nix profile add
flake:nixpkgs#legacyPackages.aarch64-darwin.scooter --priority 4

       To prioritise the existing package:

         nix profile add
flake:nixpkgs#legacyPackages.aarch64-darwin.scooter --priority 6
```
---
 pkgs/by-name/sc/scooter/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/sc/scooter/package.nix b/pkgs/by-name/sc/scooter/package.nix
index cac351608edf..59e0d7975a78 100644
--- a/pkgs/by-name/sc/scooter/package.nix
+++ b/pkgs/by-name/sc/scooter/package.nix
@@ -18,6 +18,12 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-kPweKXAitvODNoKTr2iB+qM9qMWGoKEQCxpkgrpnewY=";
 
+  # Ensure that only the `scooter` package is built (excluding `xtask`)
+  cargoBuildFlags = [
+    "--package"
+    "scooter"
+  ];
+
   # Many tests require filesystem writes which fail in Nix sandbox
   doCheck = false;
 

From 2ed6f86266a54388cb21d5ab2800571169134254 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Fri, 11 Jul 2025 21:16:49 +0000
Subject: [PATCH 031/181] cowsql: 1.15.8 -> 1.15.9

https://github.com/cowsql/cowsql/compare/v1.15.8...v1.15.9
---
 pkgs/by-name/co/cowsql/37.patch    | 57 ------------------------------
 pkgs/by-name/co/cowsql/package.nix | 10 ++----
 2 files changed, 2 insertions(+), 65 deletions(-)
 delete mode 100644 pkgs/by-name/co/cowsql/37.patch

diff --git a/pkgs/by-name/co/cowsql/37.patch b/pkgs/by-name/co/cowsql/37.patch
deleted file mode 100644
index 9f7eb84afc35..000000000000
--- a/pkgs/by-name/co/cowsql/37.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From c0d7c99632ea2ee01066988708cbb41f335cbdc3 Mon Sep 17 00:00:00 2001
-From: Brahmajit Das <listout@listout.xyz>
-Date: Sat, 14 Jun 2025 00:18:38 +0530
-Subject: [PATCH] src/lib/serialize.h: don't define double as float_t
-
-libuv with commit 85b526f makes uv.h include math.h for the definitions
-of NAN/INFINITY. That header also defines the ISO C standard float_t
-type. Now that that definition is in scope, the cowsql definition in
-src/lib/serialize.h conflicts with it.
-
-Fixes: 451cff63b29366237a9502823299b05bbff8662b
-Closes: https://github.com/cowsql/cowsql/issues/35
-Signed-off-by: Brahmajit Das <listout@listout.xyz>
----
- src/lib/serialize.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/lib/serialize.h b/src/lib/serialize.h
-index 9fbd49c..a7f9147 100644
---- a/src/lib/serialize.h
-+++ b/src/lib/serialize.h
-@@ -37,7 +37,7 @@ static_assert(sizeof(double) == sizeof(uint64_t),
-  * Basic type aliases to used by macro-based processing.
-  */
- typedef const char *text_t;
--typedef double float_t;
-+typedef double cowsql_float;
- typedef uv_buf_t blob_t;
- 
- /**
-@@ -143,7 +143,7 @@ COWSQL_INLINE size_t int64__sizeof(const int64_t *value)
- 	return sizeof(int64_t);
- }
- 
--COWSQL_INLINE size_t float__sizeof(const float_t *value)
-+COWSQL_INLINE size_t float__sizeof(const cowsql_float *value)
- {
- 	(void)value;
- 	return sizeof(double);
-@@ -190,7 +190,7 @@ COWSQL_INLINE void int64__encode(const int64_t *value, void **cursor)
- 	*cursor += sizeof(int64_t);
- }
- 
--COWSQL_INLINE void float__encode(const float_t *value, void **cursor)
-+COWSQL_INLINE void float__encode(const cowsql_float *value, void **cursor)
- {
- 	*(uint64_t *)(*cursor) = ByteFlipLe64(*(uint64_t *)value);
- 	*cursor += sizeof(uint64_t);
-@@ -273,7 +273,7 @@ COWSQL_INLINE int int64__decode(struct cursor *cursor, int64_t *value)
- 	return 0;
- }
- 
--COWSQL_INLINE int float__decode(struct cursor *cursor, float_t *value)
-+COWSQL_INLINE int float__decode(struct cursor *cursor, cowsql_float *value)
- {
- 	size_t n = sizeof(double);
- 	if (n > cursor->cap) {
diff --git a/pkgs/by-name/co/cowsql/package.nix b/pkgs/by-name/co/cowsql/package.nix
index f7e19e77757e..538a46889ce1 100644
--- a/pkgs/by-name/co/cowsql/package.nix
+++ b/pkgs/by-name/co/cowsql/package.nix
@@ -13,21 +13,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cowsql";
-  version = "1.15.8";
+  version = "1.15.9";
 
   src = fetchFromGitHub {
     owner = "cowsql";
     repo = "cowsql";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rwTa9owtnkyI9OpUKLk6V7WbAkqlYucpGzPnHHvKW/A=";
+    hash = "sha256-7djVcozWklI/0KhDC20df+H3YQbodUZaXBnQT4Ug8oI=";
   };
 
-  patches = [
-    # fix libuv changes. review removal in > 1.15.8
-    # https://github.com/cowsql/cowsql/pull/37
-    ./37.patch
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     pkg-config

From 90fd14e7f384b63193a6bf7d9ee123ba32044f91 Mon Sep 17 00:00:00 2001
From: Antoine Labarussias <antoinelabarussias@gmail.com>
Date: Fri, 11 Jul 2025 23:59:00 +0200
Subject: [PATCH 032/181] kube-linter: 0.6.8 -> 0.7.4

---
 pkgs/by-name/ku/kube-linter/package.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ku/kube-linter/package.nix b/pkgs/by-name/ku/kube-linter/package.nix
index ceff52574dc9..716282cfd080 100644
--- a/pkgs/by-name/ku/kube-linter/package.nix
+++ b/pkgs/by-name/ku/kube-linter/package.nix
@@ -9,16 +9,18 @@
 
 buildGoModule rec {
   pname = "kube-linter";
-  version = "0.6.8";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "kube-linter";
     rev = "v${version}";
-    sha256 = "sha256-abfNzf+84BWHpvLQZKyzl7WBt7UHj2zqzKq3VCqAwwY=";
+    sha256 = "sha256-19roNwTRyP28YTIwkDDXlvsg7yY4vRLHUnBRREOe7iQ=";
   };
 
-  vendorHash = "sha256-FUkGiJ/6G9vSYtAj0v9GT4OINbO3d/OKlJ0YwhONftY=";
+  vendorHash = "sha256-wCYEgQ+mm50ESQOs7IivTUhjTDiaGETogLOHcJtNfaM=";
+
+  excludedPackages = [ "tool-imports" ];
 
   ldflags = [
     "-s"

From 88c244df810ec2df9545b0bb2f66a90d099a60b9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 23:57:53 +0000
Subject: [PATCH 033/181] python3Packages.ancp-bids: 0.2.9 -> 0.3.0

---
 pkgs/development/python-modules/ancp-bids/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ancp-bids/default.nix b/pkgs/development/python-modules/ancp-bids/default.nix
index ffb1c0ef7859..6fec7db3ce8d 100644
--- a/pkgs/development/python-modules/ancp-bids/default.nix
+++ b/pkgs/development/python-modules/ancp-bids/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "ancp-bids";
-  version = "0.2.9";
+  version = "0.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "ANCPLabOldenburg";
     repo = "ancp-bids";
     tag = version;
-    hash = "sha256-vmw8SAikvbaHnPOthBQxTbyvDwnnZwCOV97aUogIgxw=";
+    hash = "sha256-n8QfQ2PGdAO6kTfkbFpj3f2gYa3vwuYg+vPpZlGNpb0=";
   };
 
   build-system = [ setuptools ];

From e982a42e483ca2d561142ce5c63057b3186188ed Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sat, 12 Jul 2025 04:18:35 +0200
Subject: [PATCH 034/181] rss2email: modernize, move to pkgs/by-name

---
 .../rs/rss2email/package.nix}                 | 45 +++++++++++--------
 pkgs/top-level/all-packages.nix               |  4 --
 2 files changed, 27 insertions(+), 22 deletions(-)
 rename pkgs/{applications/networking/feedreaders/rss2email/default.nix => by-name/rs/rss2email/package.nix} (66%)

diff --git a/pkgs/applications/networking/feedreaders/rss2email/default.nix b/pkgs/by-name/rs/rss2email/package.nix
similarity index 66%
rename from pkgs/applications/networking/feedreaders/rss2email/default.nix
rename to pkgs/by-name/rs/rss2email/package.nix
index c13135dbb31b..143a3a9edc56 100644
--- a/pkgs/applications/networking/feedreaders/rss2email/default.nix
+++ b/pkgs/by-name/rs/rss2email/package.nix
@@ -1,23 +1,15 @@
 {
   lib,
-  pythonPackages,
+  python3Packages,
   fetchPypi,
   fetchpatch2,
   nixosTests,
 }:
 
-with pythonPackages;
-
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "rss2email";
   version = "3.14";
-  format = "setuptools";
-
-  propagatedBuildInputs = [
-    feedparser
-    html2text
-  ];
-  nativeCheckInputs = [ beautifulsoup4 ];
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -30,6 +22,11 @@ buildPythonApplication rec {
       url = "https://github.com/rss2email/rss2email/commit/b5c0e78006c2db6929b5ff50e8529de58a00412a.patch";
       hash = "sha256-edmsi3I0acx5iF9xoAS9deSexqW2UtWZR/L7CgeZs/M=";
     })
+    (fetchpatch2 {
+      name = "use-poetry-core.patch";
+      url = "https://github.com/rss2email/rss2email/commit/183a17aefe4eb66f898cf088519b1e845559f2bd.patch";
+      hash = "sha256-SoWahlOJ7KkaHMwOrKIBgwEz8zJQrSXVD1w2wiV1phE=";
+    })
   ];
 
   outputs = [
@@ -40,10 +37,19 @@ buildPythonApplication rec {
 
   postPatch = ''
     # sendmail executable is called from PATH instead of sbin by default
-    sed -e 's|/usr/sbin/sendmail|sendmail|' \
-        -i rss2email/config.py
+    substituteInPlace  rss2email/config.py \
+      --replace-fail '/usr/sbin/sendmail' 'sendmail'
   '';
 
+  build-system = with python3Packages; [
+    poetry-core
+  ];
+
+  dependencies = with python3Packages; [
+    feedparser
+    html2text
+  ];
+
   postInstall = ''
     install -Dm 644 r2e.1 $man/share/man/man1/r2e.1
     # an alias for better finding the manpage
@@ -54,11 +60,14 @@ buildPythonApplication rec {
     cp AUTHORS COPYING CHANGELOG README.rst $doc/share/doc/rss2email/
   '';
 
-  checkPhase = ''
-    runHook preCheck
-    env PATH=$out/bin:$PATH python ./test/test.py
-    runHook postCheck
-  '';
+  nativeCheckInputs = [
+    python3Packages.unittestCheckHook
+  ];
+
+  unittestFlagsArray = [
+    "-s"
+    "test"
+  ];
 
   meta = with lib; {
     description = "Tool that converts RSS/Atom newsfeeds to email";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 286e790df8e3..f714de902e8d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4278,10 +4278,6 @@ with pkgs;
 
   rsibreak = libsForQt5.callPackage ../applications/misc/rsibreak { };
 
-  rss2email = callPackage ../applications/networking/feedreaders/rss2email {
-    pythonPackages = python3Packages;
-  };
-
   rucio = callPackage ../by-name/ru/rucio/package.nix {
     # Pinned to python 3.12 while python313Packages.future does not evaluate and
     # until https://github.com/CZ-NIC/pyoidc/issues/649 is resolved

From a61d99e3734a00b82a1241865b3bcf70f7f8c36d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 02:47:26 +0000
Subject: [PATCH 035/181] mise: 2025.7.0 -> 2025.7.4

---
 pkgs/by-name/mi/mise/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 09154c9cf804..d0199b2955ab 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -21,17 +21,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2025.7.0";
+  version = "2025.7.4";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-PIUw84xwR9m06fPkO7MYf95Q21YvYnBMi+MY+OOz+2k=";
+    hash = "sha256-l1Bce0CFhR5cyBnlNGy4KM8aqVntGkzRsi+Qh6KODQk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-5876Lc4rRNwTH8u5bMyV52Eps9QOcBHhE3v+33hzeBA=";
+  cargoHash = "sha256-ujZ6iPwsIlAFCfkZbGLqgLjvJMZE+ehKRw10NnwS7jE=";
 
   nativeBuildInputs = [
     installShellFiles

From 36361138abfe203bb8f72001671f4dd7123478c4 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 11 Jul 2025 22:21:28 -0500
Subject: [PATCH 036/181] kdePackages.kquickimageedit: 0.3.0 -> 0.5.1

---
 .../libraries/kquickimageedit/0.3.0.nix       | 37 +++++++++++++++++++
 .../libraries/kquickimageedit/default.nix     |  7 ++--
 pkgs/top-level/qt5-packages.nix               |  2 +-
 3 files changed, 42 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/development/libraries/kquickimageedit/0.3.0.nix

diff --git a/pkgs/development/libraries/kquickimageedit/0.3.0.nix b/pkgs/development/libraries/kquickimageedit/0.3.0.nix
new file mode 100644
index 000000000000..358105ed2c1b
--- /dev/null
+++ b/pkgs/development/libraries/kquickimageedit/0.3.0.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  extra-cmake-modules,
+  qtbase,
+  qtdeclarative,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "kquickimageeditor";
+  version = "0.3.0";
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "libraries";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-+BByt07HMb4u6j9bVZqkUPvyRaElKvJ2MjKlPakL87E=";
+  };
+
+  nativeBuildInputs = [ extra-cmake-modules ];
+  buildInputs = [
+    qtbase
+    qtdeclarative
+  ];
+  cmakeFlags = [ "-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}" ];
+  dontWrapQtApps = true;
+
+  meta = with lib; {
+    description = "Set of QtQuick components providing basic image editing capabilities";
+    homepage = "https://invent.kde.org/libraries/kquickimageeditor";
+    license = licenses.lgpl21Plus;
+    platforms = platforms.unix;
+    badPlatforms = platforms.darwin;
+  };
+}
diff --git a/pkgs/development/libraries/kquickimageedit/default.nix b/pkgs/development/libraries/kquickimageedit/default.nix
index 358105ed2c1b..6b7950d4fd8b 100644
--- a/pkgs/development/libraries/kquickimageedit/default.nix
+++ b/pkgs/development/libraries/kquickimageedit/default.nix
@@ -3,28 +3,29 @@
   stdenv,
   fetchFromGitLab,
   extra-cmake-modules,
+  kdePackages,
   qtbase,
   qtdeclarative,
 }:
 
 stdenv.mkDerivation rec {
   pname = "kquickimageeditor";
-  version = "0.3.0";
+  version = "0.5.1";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "libraries";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+BByt07HMb4u6j9bVZqkUPvyRaElKvJ2MjKlPakL87E=";
+    sha256 = "sha256-8TJBg42E9lNbLpihjtc5Z/drmmSGQmic8yO45yxSNQ4=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [
+    kdePackages.kirigami
     qtbase
     qtdeclarative
   ];
-  cmakeFlags = [ "-DQT_MAJOR_VERSION=${lib.versions.major qtbase.version}" ];
   dontWrapQtApps = true;
 
   meta = with lib; {
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index 0e635efa2316..e4d3d4582ab0 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -174,7 +174,7 @@ makeScopeWithSplicing' {
 
         kreport = callPackage ../development/libraries/kreport { };
 
-        kquickimageedit = callPackage ../development/libraries/kquickimageedit { };
+        kquickimageedit = callPackage ../development/libraries/kquickimageedit/0.3.0.nix { };
 
         kuserfeedback = callPackage ../development/libraries/kuserfeedback { };
 

From 1112944ee3b09625112b3e57985c4275cac0da68 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 11 Jul 2025 22:21:34 -0500
Subject: [PATCH 037/181] kaidan: 0.11.0 -> 0.12.2

---
 pkgs/by-name/ka/kaidan/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ka/kaidan/package.nix b/pkgs/by-name/ka/kaidan/package.nix
index 396212ad3de8..95beeba72cf8 100644
--- a/pkgs/by-name/ka/kaidan/package.nix
+++ b/pkgs/by-name/ka/kaidan/package.nix
@@ -6,6 +6,7 @@
   extra-cmake-modules,
   pkg-config,
   kdePackages,
+  kdsingleapplication,
   zxing-cpp,
   qxmpp,
   gst_all_1,
@@ -14,14 +15,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kaidan";
-  version = "0.11.0";
+  version = "0.12.2";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "network";
     repo = "kaidan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8pC4vINeKSYY+LlVgCXUtBq9UjraPdTikBOwLBLeQ3Y=";
+    hash = "sha256-+9L1NuyHnyX7yThC3LGqKJd9XU8Mo7NAdnGoJSdq4TM=";
   };
 
   nativeBuildInputs = [
@@ -44,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
     kdePackages.qtlocation
     kdePackages.qqc2-desktop-style
     kdePackages.sonnet
+    kdsingleapplication
     zxing-cpp
     qxmpp
     gst_all_1.gstreamer

From 23af69ee041298d8bd5c595a8835d448ad18869b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 06:59:25 +0000
Subject: [PATCH 038/181] python3Packages.mpi-pytest: 2025.6.0 -> 2025.7

---
 pkgs/development/python-modules/mpi-pytest/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mpi-pytest/default.nix b/pkgs/development/python-modules/mpi-pytest/default.nix
index 875f0d949bcc..c436e1f0a69a 100644
--- a/pkgs/development/python-modules/mpi-pytest/default.nix
+++ b/pkgs/development/python-modules/mpi-pytest/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "mpi-pytest";
-  version = "2025.6.0";
+  version = "2025.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firedrakeproject";
     repo = "mpi-pytest";
     tag = "v${version}";
-    hash = "sha256-hZPTVqVaCd75UMoUQTZXrmnFM6cpMp9ejKqct3lN0Bo=";
+    hash = "sha256-TZj1hObMVzYfAUC0UjXMvUThbKCNdiB1FMSA0AHjZ9s=";
   };
 
   build-system = [

From 696ecc14107e4d7c3aedbfbedf342a61baa45485 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Sat, 12 Jul 2025 01:15:26 -0600
Subject: [PATCH 039/181] python3Packages.tidalapi: 0.8.3 -> 0.8.4

https://github.com/EbbLabs/python-tidal/releases/tag/v0.8.4
Diff: https://github.com/EbbLabs/python-tidal/compare/v0.8.3...v0.8.4
---
 .../python-modules/tidalapi/default.nix       | 20 ++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/tidalapi/default.nix b/pkgs/development/python-modules/tidalapi/default.nix
index 956846ba82f1..628893235352 100644
--- a/pkgs/development/python-modules/tidalapi/default.nix
+++ b/pkgs/development/python-modules/tidalapi/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   python-dateutil,
   poetry-core,
   requests,
@@ -12,15 +12,19 @@
 }:
 buildPythonPackage rec {
   pname = "tidalapi";
-  version = "0.8.3";
+  version = "0.8.4";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-3I5Xi9vmyAlUNKBmmTuGnetaiiVzL3sEEy31npRZlFU=";
+  src = fetchFromGitHub {
+    owner = "EbbLabs";
+    repo = "python-tidal";
+    tag = "v${version}";
+    hash = "sha256-PSM4aLjvG8b2HG86SCLgPjPo8PECVD5XrNZSbiAxcSk=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [
+    poetry-core
+  ];
 
   dependencies = [
     requests
@@ -33,7 +37,9 @@ buildPythonPackage rec {
 
   doCheck = false; # tests require internet access
 
-  pythonImportsCheck = [ "tidalapi" ];
+  pythonImportsCheck = [
+    "tidalapi"
+  ];
 
   meta = {
     changelog = "https://github.com/tamland/python-tidal/blob/v${version}/HISTORY.rst";

From 5fd33bd90e8ad9ff7acba0c7d8ba27ed1aab0002 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Sat, 12 Jul 2025 01:16:50 -0600
Subject: [PATCH 040/181] python3Packages.tidalapi: add ryand56 as maintainer

---
 pkgs/development/python-modules/tidalapi/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/tidalapi/default.nix b/pkgs/development/python-modules/tidalapi/default.nix
index 628893235352..875a2af1cff9 100644
--- a/pkgs/development/python-modules/tidalapi/default.nix
+++ b/pkgs/development/python-modules/tidalapi/default.nix
@@ -46,6 +46,9 @@ buildPythonPackage rec {
     description = "Unofficial Python API for TIDAL music streaming service";
     homepage = "https://github.com/tamland/python-tidal";
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ drawbu ];
+    maintainers = with lib.maintainers; [
+      drawbu
+      ryand56
+    ];
   };
 }

From ca570b5b68117c179b222d1b7bca8b499cf05586 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 07:45:13 +0000
Subject: [PATCH 041/181] grml-zsh-config: 0.19.21 -> 0.19.23

---
 pkgs/by-name/gr/grml-zsh-config/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/grml-zsh-config/package.nix b/pkgs/by-name/gr/grml-zsh-config/package.nix
index 4d39810fd783..0553e99b92e9 100644
--- a/pkgs/by-name/gr/grml-zsh-config/package.nix
+++ b/pkgs/by-name/gr/grml-zsh-config/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "grml-zsh-config";
-  version = "0.19.21";
+  version = "0.19.23";
 
   src = fetchFromGitHub {
     owner = "grml";
     repo = "grml-etc-core";
     rev = "v${version}";
-    sha256 = "sha256-OazsDuIMFnyJrmd4Idt6ciV0huC9QmtcqBxEVD4nf6g=";
+    sha256 = "sha256-kaVDX+f2WeRjrpyW5pKkamNIKemdUq+1AU+8W+0vAx8=";
   };
 
   strictDeps = true;

From 75af7ecc9cf147b30dc296cdabe31545715a601f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment?= <git@drawbu.dev>
Date: Tue, 8 Jul 2025 16:06:53 +0200
Subject: [PATCH 042/181] python3Packages.ddgs: init at 9.0.2

---
 .../python-modules/ddgs/default.nix           | 45 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/development/python-modules/ddgs/default.nix

diff --git a/pkgs/development/python-modules/ddgs/default.nix b/pkgs/development/python-modules/ddgs/default.nix
new file mode 100644
index 000000000000..9ca4c278600e
--- /dev/null
+++ b/pkgs/development/python-modules/ddgs/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  click,
+  primp,
+  lxml,
+  versionCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "ddgs";
+  version = "9.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "deedy5";
+    repo = "ddgs";
+    tag = "v${version}";
+    hash = "sha256-c0kTZV+lM1/vkI51TK6klUmnoaAdt8KSEn/rjeqcBa8=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    click
+    primp
+    lxml
+  ];
+
+  nativeCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  pythonImportsCheck = [ "ddgs" ];
+
+  meta = {
+    description = "D.D.G.S. | Dux Distributed Global Search. A metasearch library that aggregates results from diverse web search services";
+    mainProgram = "ddgs";
+    homepage = "https://github.com/deedy5/ddgs";
+    changelog = "https://github.com/deedy5/ddgs/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drawbu ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9a5fa59e59dc..211ddc85bc24 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3409,6 +3409,8 @@ self: super: with self; {
 
   dctorch = callPackage ../development/python-modules/dctorch { };
 
+  ddgs = callPackage ../development/python-modules/ddgs { };
+
   ddt = callPackage ../development/python-modules/ddt { };
 
   deal = callPackage ../development/python-modules/deal { };

From d32c8bbc5edd1eb8906e07e81ea5e5594e6962b7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 08:08:50 +0000
Subject: [PATCH 043/181] astal.source: 0-unstable-2025-06-28 ->
 0-unstable-2025-07-11

---
 pkgs/development/libraries/astal/source.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/astal/source.nix b/pkgs/development/libraries/astal/source.nix
index ec4678cb0894..be6aa94308ab 100644
--- a/pkgs/development/libraries/astal/source.nix
+++ b/pkgs/development/libraries/astal/source.nix
@@ -7,15 +7,15 @@ let
   originalDrv = fetchFromGitHub {
     owner = "Aylur";
     repo = "astal";
-    rev = "ac90f09385a2295da9fdc108aaba4a317aaeacc7";
-    hash = "sha256-AodIKw7TmI7rHVcOfEsO82stupMYIMVQeLAUQfVxnkU=";
+    rev = "81eb3770965190024803ed6dd0fe35318da64831";
+    hash = "sha256-5Nr80lTZJ8ewuxIzRHc6E8L4LW4rdGZukiZyL7nOVSE=";
   };
 in
 originalDrv.overrideAttrs (
   final: prev: {
     name = "${final.pname}-${final.version}"; # fetchFromGitHub already defines name
     pname = "astal-source";
-    version = "0-unstable-2025-06-28";
+    version = "0-unstable-2025-07-11";
 
     meta = prev.meta // {
       description = "Building blocks for creating custom desktop shells (source)";

From b1d7400ad2b9941f0b990649ea45d584c0719f78 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 11:36:30 +0000
Subject: [PATCH 044/181] stevenblack-blocklist: 3.15.51 -> 3.15.55

---
 pkgs/by-name/st/stevenblack-blocklist/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/st/stevenblack-blocklist/package.nix b/pkgs/by-name/st/stevenblack-blocklist/package.nix
index f7aa71f359c0..0626ec7dcca2 100644
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.15.51";
+  version = "3.15.55";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-NISp1TNEgoLn2sBglpoKfg/aiiLynNOrOWqTppkbDs0=";
+    hash = "sha256-eDKP15xvd/SHZd4i2EorRZkS7ih5d8YNvCJQsRQeMYs=";
   };
 
   outputs = [

From d4af814753094c6af17ec091361ab4b45b220689 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sat, 12 Jul 2025 12:00:00 +0000
Subject: [PATCH 045/181] libdwarf: actually compile with compression support

---
 pkgs/by-name/li/libdwarf/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libdwarf/package.nix b/pkgs/by-name/li/libdwarf/package.nix
index 9c61445ee549..6c68ef9c26dc 100644
--- a/pkgs/by-name/li/libdwarf/package.nix
+++ b/pkgs/by-name/li/libdwarf/package.nix
@@ -6,6 +6,7 @@
   ninja,
   zlib,
   zstd,
+  pkg-config,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -22,6 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     meson
     ninja
+    pkg-config
   ];
 
   buildInputs = [

From 8a92f0420a43c0a8bb58ec658d2adf518c39c8e9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 13:30:13 +0000
Subject: [PATCH 046/181] obs-studio-plugins.obs-shaderfilter: 2.5.0 -> 2.5.1

---
 .../video/obs-studio/plugins/obs-shaderfilter.nix             | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix b/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix
index 744ba03ca442..ae4a77d246c8 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-shaderfilter.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-shaderfilter";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-shaderfilter";
     rev = version;
-    sha256 = "sha256-HJFgGicOtEZMMJyAkwgHCvWPoj00C6YGU9NwagD4Fpw=";
+    sha256 = "sha256-1RRGXAzP7BIwJJMmXSknPDtHxXZex9SqDDVbWOE43Yk=";
   };
 
   nativeBuildInputs = [ cmake ];

From 19468c1ee503411d47e739acb559b095d1ad09c5 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sat, 12 Jul 2025 12:46:28 -0400
Subject: [PATCH 047/181] bootc: 1.1.2 -> 1.4.0

Diff: https://github.com/containers/bootc/compare/v1.1.2...v1.4.0
---
 pkgs/by-name/bo/bootc/package.nix | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bo/bootc/package.nix b/pkgs/by-name/bo/bootc/package.nix
index a2a7fa796bf3..126c5a4c8d98 100644
--- a/pkgs/by-name/bo/bootc/package.nix
+++ b/pkgs/by-name/bo/bootc/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bootc";
-  version = "1.1.2";
+  version = "1.4.0";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-/Sb2XtVguj5zpj/OTl90xFHFSaBeLgb8xIlNm4UrnRI=";
+  cargoHash = "sha256-7Fn68bcm8ZyR5eALCMIdcXcZ595EnWFHKdnqI5vMso4=";
   doInstallCheck = true;
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "bootc";
     rev = "v${version}";
-    hash = "sha256-p1+j62MllmPcvWnijieSZmlgwYy76X17fv12Haetz78=";
+    hash = "sha256-FuU3rQtKpK+ScQ10GivisSJseY2GOFJ/y2HRKIiU0G8=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -35,6 +35,19 @@ rustPlatform.buildRustPackage rec {
     ostree-full
   ];
 
+  checkFlags = [
+    # These all require a writable /var/tmp
+    "--skip=test_cli_fns"
+    "--skip=test_diff"
+    "--skip=test_tar_export_reproducible"
+    "--skip=test_tar_export_structure"
+    "--skip=test_tar_import_empty"
+    "--skip=test_tar_import_export"
+    "--skip=test_tar_import_signed"
+    "--skip=test_tar_write"
+    "--skip=test_tar_write_tar_layer"
+  ];
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];

From 13e949783ecb4d22f37673838e1886c1b5441ce0 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sat, 12 Jul 2025 12:47:35 -0400
Subject: [PATCH 048/181] bootc: update upstream

https://github.com/containers/bootc redirects to https://github.com/bootc-dev/bootc
---
 pkgs/by-name/bo/bootc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bo/bootc/package.nix b/pkgs/by-name/bo/bootc/package.nix
index 126c5a4c8d98..e0f4f3a0473c 100644
--- a/pkgs/by-name/bo/bootc/package.nix
+++ b/pkgs/by-name/bo/bootc/package.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
   doInstallCheck = true;
 
   src = fetchFromGitHub {
-    owner = "containers";
+    owner = "bootc-dev";
     repo = "bootc";
     rev = "v${version}";
     hash = "sha256-FuU3rQtKpK+ScQ10GivisSJseY2GOFJ/y2HRKIiU0G8=";
@@ -54,7 +54,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = {
     description = "Boot and upgrade via container images";
-    homepage = "https://containers.github.io/bootc";
+    homepage = "https://bootc-dev.github.io/bootc";
     license = lib.licenses.mit;
     mainProgram = "bootc";
     maintainers = with lib.maintainers; [ thesola10 ];

From c720632082ed87ee97c917f626dec87e51a2a798 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 18:26:32 +0000
Subject: [PATCH 049/181] reth: 1.5.0 -> 1.5.1

---
 pkgs/by-name/re/reth/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/re/reth/package.nix b/pkgs/by-name/re/reth/package.nix
index 7b9498ebb3ef..f96f1237dc7d 100644
--- a/pkgs/by-name/re/reth/package.nix
+++ b/pkgs/by-name/re/reth/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reth";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "paradigmxyz";
     repo = "reth";
     rev = "v${version}";
-    hash = "sha256-bEWgXRV82FIeJSO5voDewFxjUzphRlZ1W+k/QqJCigM=";
+    hash = "sha256-R+TE9MRSAZuBHglgFECrYrTkGDbi2WceFUNYAvd1O9g=";
   };
 
-  cargoHash = "sha256-Mp5Ydf3/okos2nPK3ghc/hAS3y6b2kxgPS2+kZS/rF4=";
+  cargoHash = "sha256-/LoqFP/vGWMTiBp6wiTabTec+Uwoc35683HnPe9QUGA=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook

From bb1f8a724f7e8329644bc5bdce64215e21ec4f65 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 19:37:00 +0000
Subject: [PATCH 050/181] salt: 3007.5 -> 3007.6

---
 pkgs/by-name/sa/salt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sa/salt/package.nix b/pkgs/by-name/sa/salt/package.nix
index 8902eeca366c..1608a9078ff6 100644
--- a/pkgs/by-name/sa/salt/package.nix
+++ b/pkgs/by-name/sa/salt/package.nix
@@ -12,12 +12,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "salt";
-  version = "3007.5";
+  version = "3007.6";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f1cuA5BZ8aWXuhCpvcgdzCN1pJxJEGWBmI9QYDmz3aU=";
+    hash = "sha256-F2qLl8Q8UO2H3xInmz3SSLu2q0jNMrLekPRSNMfE0JQ=";
   };
 
   patches = [

From 48a5651c21a190db7f56ac3f4f6a280a0a3509f2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 19:47:30 +0000
Subject: [PATCH 051/181] goctl: 1.8.4 -> 1.8.5

---
 pkgs/by-name/go/goctl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/goctl/package.nix b/pkgs/by-name/go/goctl/package.nix
index 2b3ad122f511..7eb8e461ef5a 100644
--- a/pkgs/by-name/go/goctl/package.nix
+++ b/pkgs/by-name/go/goctl/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "goctl";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "zeromicro";
     repo = "go-zero";
     tag = "v${version}";
-    hash = "sha256-N0U/8YbqhyD5kb14lq8JKWwfYHUZ57Z/KZyIf6kKl0U=";
+    hash = "sha256-12nlrwzzM5wPyiC3vJfs7sJ7kPiRy1H0gTeWB+9bqKI=";
   };
 
-  vendorHash = "sha256-D56zTwn4y03eaP2yP8Q2F6ixGMaQJwKEqonHNJGp2Ec=";
+  vendorHash = "sha256-ReLXN4SUNQ7X0yHy8FFwD8lRRm05q2FdEdohXpfuZIY=";
 
   modRoot = "tools/goctl";
   subPackages = [ "." ];

From 0c9dc19bc0f28417a4afc836ce54b431ddf4d0bd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 23:34:29 +0000
Subject: [PATCH 052/181] wayfreeze: 0-unstable-2025-06-29 ->
 0-unstable-2025-07-08

---
 pkgs/by-name/wa/wayfreeze/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/wa/wayfreeze/package.nix b/pkgs/by-name/wa/wayfreeze/package.nix
index 2f4328c6c8ae..3b7e0ec5faca 100644
--- a/pkgs/by-name/wa/wayfreeze/package.nix
+++ b/pkgs/by-name/wa/wayfreeze/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage {
   pname = "wayfreeze";
-  version = "0-unstable-2025-06-29";
+  version = "0-unstable-2025-07-08";
 
   src = fetchFromGitHub {
     owner = "Jappie3";
     repo = "wayfreeze";
-    rev = "57877b94804b23e725257fcf26f7c296a5a38f8c";
-    hash = "sha256-dArJwfAm3jqJurNYMUOVzGMMp1ska0D+SkQ6tj0HhqQ=";
+    rev = "dc41ae1662c4c760f3deba9f826ba605e99971cc";
+    hash = "sha256-dDncKClSsRfkQ27x67U2Mpdcc+nx28bNZughJKar+RU=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

From d5953612a45974dd7a0c1b3fb5f3b83f03ad913d Mon Sep 17 00:00:00 2001
From: Lin Xianyi <iynaix@gmail.com>
Date: Sun, 13 Jul 2025 09:08:04 +0800
Subject: [PATCH 053/181] swaybg: add webp support

---
 pkgs/by-name/sw/swaybg/package.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pkgs/by-name/sw/swaybg/package.nix b/pkgs/by-name/sw/swaybg/package.nix
index 3f24ffb75864..48af7410eb36 100644
--- a/pkgs/by-name/sw/swaybg/package.nix
+++ b/pkgs/by-name/sw/swaybg/package.nix
@@ -10,6 +10,8 @@
   wayland-protocols,
   cairo,
   gdk-pixbuf,
+  gnome,
+  webp-pixbuf-loader,
   wayland-scanner,
   wrapGAppsNoGuiHook,
   librsvg,
@@ -50,6 +52,18 @@ stdenv.mkDerivation rec {
     "-Dman-pages=enabled"
   ];
 
+  # add support for webp
+  postInstall = ''
+    export GDK_PIXBUF_MODULE_FILE="${
+      gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+        extraLoaders = [
+          librsvg
+          webp-pixbuf-loader
+        ];
+      }
+    }"
+  '';
+
   meta = with lib; {
     description = "Wallpaper tool for Wayland compositors";
     inherit (src.meta) homepage;

From 8cefb51683bd059f8f6bc1251618b8f562933666 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 07:57:35 +0000
Subject: [PATCH 054/181] atmos: 1.180.0 -> 1.182.0

---
 pkgs/by-name/at/atmos/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/at/atmos/package.nix b/pkgs/by-name/at/atmos/package.nix
index 1b029ce7ae8f..0e1aaa50fe6d 100644
--- a/pkgs/by-name/at/atmos/package.nix
+++ b/pkgs/by-name/at/atmos/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "atmos";
-  version = "1.180.0";
+  version = "1.182.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = "atmos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/yCgC73J4PVTqmJBW0eLCMVWtsyMGLeF0Rmvx+N/oP8=";
+    hash = "sha256-xGNexXxeX6ZKG4eWCoj0laHHXegnNqSfRPEkIWcieNQ=";
   };
 
-  vendorHash = "sha256-k1zC3tUF2uDAo86J6dZmYOGZcYFBNdSH15cyX2tiZEg=";
+  vendorHash = "sha256-P+Fsc6z3kTG8iq29KEp7DUV4zeT7Kee384TMosTDKGU=";
 
   ldflags = [
     "-s"

From 46b0f0b3c938eb1f2ae4e3f3b01abab949f548dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Viorel-C=C4=83t=C4=83lin=20R=C4=83pi=C8=9Beanu?=
 <rapiteanu.catalin@gmail.com>
Date: Sun, 13 Jul 2025 14:47:54 +0300
Subject: [PATCH 055/181] python3Packages.proton-vpn-network-manager: 0.12.13
 -> 0.12.14

Update the package to the latest upstream version.
---
 .../python-modules/proton-vpn-network-manager/default.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/proton-vpn-network-manager/default.nix b/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
index 937c54b5c103..1d1da8138ed5 100644
--- a/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-network-manager/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-network-manager";
-  version = "0.12.13";
+  version = "0.12.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-network-manager";
     tag = "v${version}";
-    hash = "sha256-LRjC1uuAG2OG52moRBSvTR7HvqdldNmW0Tv7AZmUf60=";
+    hash = "sha256-flZeEdmGXsSFHtlm6HrBtuwOcYJFjWmkMvGgnHL4cPw=";
   };
 
   nativeBuildInputs = [

From d173f1883ca8ad0b5b3d569c2195358ce4eaf499 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Viorel-C=C4=83t=C4=83lin=20R=C4=83pi=C8=9Beanu?=
 <rapiteanu.catalin@gmail.com>
Date: Sun, 13 Jul 2025 14:52:38 +0300
Subject: [PATCH 056/181] python3Packages.proton-vpn-api-core: 0.42.4 -> 0.42.5

Update the package to the latest version.
---
 .../python-modules/proton-vpn-api-core/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/proton-vpn-api-core/default.nix b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
index babb3c02bcf4..b74f34be696b 100644
--- a/pkgs/development/python-modules/proton-vpn-api-core/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-api-core";
-  version = "0.42.4";
+  version = "0.42.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-api-core";
     rev = "v${version}";
-    hash = "sha256-WzyxBeIiOXDxyv0/guPWO16pN41ZVXnxd6iiiZ+bLR4=";
+    hash = "sha256-sSLBo2nTn7rvtSZqCWZLwca5DRIgqSkImRM6U6/xJ70=";
   };
 
   build-system = [

From e8197af02535faa8f51b7745c31726c2eb4029e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Viorel-C=C4=83t=C4=83lin=20R=C4=83pi=C8=9Beanu?=
 <rapiteanu.catalin@gmail.com>
Date: Sun, 13 Jul 2025 14:57:59 +0300
Subject: [PATCH 057/181] protonvpn-gui: 4.9.6 -> 4.9.7

Update the package to the latest version. Also, this commit takes into
consideration that the latest tag is named 'v4.9.7' instead of only
'4.9.7'.
---
 pkgs/applications/networking/protonvpn-gui/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/protonvpn-gui/default.nix b/pkgs/applications/networking/protonvpn-gui/default.nix
index eb4d15dc1986..af16cdc05a44 100644
--- a/pkgs/applications/networking/protonvpn-gui/default.nix
+++ b/pkgs/applications/networking/protonvpn-gui/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonApplication rec {
   pname = "protonvpn-gui";
-  version = "4.9.6";
+  version = "4.9.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "proton-vpn-gtk-app";
-    tag = "${version}";
-    hash = "sha256-Undf3qSClcRa1e9f6B/1hLPIjc2KPG745AXxYHQA0nE=";
+    tag = "v${version}";
+    hash = "sha256-xpMXpYLLui+1bjK72VPhUT6T/sYpoqN2Jz6sczKJO5U=";
   };
 
   nativeBuildInputs = [

From 2aefa2c2237e8bbe480da2dec17bf8bb1f61e17a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 17:12:43 +0000
Subject: [PATCH 058/181] python3Packages.langchain-aws: 0.2.27 -> 0.2.28

---
 pkgs/development/python-modules/langchain-aws/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-aws/default.nix b/pkgs/development/python-modules/langchain-aws/default.nix
index e6af33502323..5c3679dc9dd1 100644
--- a/pkgs/development/python-modules/langchain-aws/default.nix
+++ b/pkgs/development/python-modules/langchain-aws/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-aws";
-  version = "0.2.27";
+  version = "0.2.28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-aws";
     tag = "langchain-aws==${version}";
-    hash = "sha256-FHWozXf0zEyKvFODZ+8JHMiwARJETJxmLh3z1HJSNV4=";
+    hash = "sha256-sfdijQxcw0TNK1/IOmHQTHznDIMDTvXqMWBb58cTPlI=";
   };
 
   postPatch = ''

From 28b7f2ca401674f6293d5d6e6ecf4386de58c668 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 17:14:04 +0000
Subject: [PATCH 059/181] servo: 0-unstable-2025-07-08 -> 0-unstable-2025-07-13

---
 pkgs/by-name/se/servo/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/se/servo/package.nix b/pkgs/by-name/se/servo/package.nix
index b33d7df53314..aaf9dfb941a5 100644
--- a/pkgs/by-name/se/servo/package.nix
+++ b/pkgs/by-name/se/servo/package.nix
@@ -65,13 +65,13 @@ in
 
 rustPlatform.buildRustPackage {
   pname = "servo";
-  version = "0-unstable-2025-07-08";
+  version = "0-unstable-2025-07-13";
 
   src = fetchFromGitHub {
     owner = "servo";
     repo = "servo";
-    rev = "c3f441d7abe7243a31150bf424babf0f1679ea88";
-    hash = "sha256-rFROwsU/x8LsD8vpCcmLyQMYCl9AQwgbv/kHk7JTa4c=";
+    rev = "93e5b672a78247205c431d5741952bdf23c3fcc2";
+    hash = "sha256-0826hNZ45BXXNzdZKbyUW/CfwVRZmpYU1e6efaACh4o=";
     # Breaks reproducibility depending on whether the picked commit
     # has other ref-names or not, which may change over time, i.e. with
     # "ref-names: HEAD -> main" as long this commit is the branch HEAD
@@ -82,7 +82,7 @@ rustPlatform.buildRustPackage {
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-2J6ByE2kmoHBGWgwYU2FWgTt47cw+s8IPcm4ElRVWMc=";
+  cargoHash = "sha256-uB5eTGiSq+DV7VwYoyLR2HH3DQpSV4xnP7C7iXZa7S0=";
 
   # set `HOME` to a temp dir for write access
   # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)

From 916374c2def29bc206b373d933e57fd67abe0111 Mon Sep 17 00:00:00 2001
From: sg-qwt <115715554+sg-qwt@users.noreply.github.com>
Date: Mon, 14 Jul 2025 02:36:15 +0800
Subject: [PATCH 060/181] solaar: add meta.mainProgram

---
 pkgs/by-name/so/solaar/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/so/solaar/package.nix b/pkgs/by-name/so/solaar/package.nix
index 01cac2c422f3..f48f559fd9ee 100644
--- a/pkgs/by-name/so/solaar/package.nix
+++ b/pkgs/by-name/so/solaar/package.nix
@@ -95,6 +95,7 @@ python3Packages.buildPythonApplication rec {
     '';
     homepage = "https://pwr-solaar.github.io/Solaar/";
     license = licenses.gpl2Only;
+    mainProgram = "solaar";
     maintainers = with maintainers; [
       spinus
       ysndr

From 94ea058365d9f323cee91bd28a39347be6683162 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 20:07:54 +0000
Subject: [PATCH 061/181] gollama: v1.34.0 -> v1.34.1

---
 pkgs/by-name/go/gollama/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/go/gollama/package.nix b/pkgs/by-name/go/gollama/package.nix
index ab08580ed1bc..5ebd9917b0b0 100644
--- a/pkgs/by-name/go/gollama/package.nix
+++ b/pkgs/by-name/go/gollama/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gollama";
-  version = "v1.34.0";
+  version = "v1.34.1";
 
   src = fetchFromGitHub {
     owner = "sammcj";
     repo = "gollama";
     tag = "v${version}";
-    hash = "sha256-gWEm5aUVq2yfxuZ6GxITiAAsn5gj1HR9I7seyRX8DoA=";
+    hash = "sha256-Zysy8UTpUzIb4ekg9tAg5Wj7LRIIw8axENYqK8z2TdY=";
   };
 
   vendorHash = "sha256-7e1wM2FDaQGAIhb0gERy/RgJupra1B52SgTV0EHD570=";

From dd04ec154f8cf901207650da9cc75126d461ce63 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 21:02:35 +0000
Subject: [PATCH 062/181] vscode-extensions.tboby.cwtools-vscode: 0.10.25 ->
 0.10.26

---
 .../vscode/extensions/tboby.cwtools-vscode/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/tboby.cwtools-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/tboby.cwtools-vscode/default.nix
index a8b86799c554..9d06557b795a 100644
--- a/pkgs/applications/editors/vscode/extensions/tboby.cwtools-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tboby.cwtools-vscode/default.nix
@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "cwtools-vscode";
     publisher = "tboby";
-    version = "0.10.25";
-    hash = "sha256-TcnS4Cwn+V9hwScpLgUK5u8Jfm89EBv+koUOi1bB0DM=";
+    version = "0.10.26";
+    hash = "sha256-1ZfmcF87LyRxCbQvVX21m1yFu+7QeDCofKXEHj5W8DA=";
   };
   meta = {
     description = "Paradox Language Features for Visual Studio Code";

From d7475efe551cf901f3d00db547cfb707365128b8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 22:31:13 +0000
Subject: [PATCH 063/181] hyperswarm: 4.11.7 -> 4.12.1

---
 pkgs/by-name/hy/hyperswarm/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hy/hyperswarm/package.nix b/pkgs/by-name/hy/hyperswarm/package.nix
index 5c0072f448e5..a805c136fb86 100644
--- a/pkgs/by-name/hy/hyperswarm/package.nix
+++ b/pkgs/by-name/hy/hyperswarm/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "hyperswarm";
-  version = "4.11.7";
+  version = "4.12.1";
 
   src = fetchFromGitHub {
     owner = "holepunchto";
     repo = "hyperswarm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z/FNBDJbiyR5AY40RDtiuQmjNUZ+BSGv8aewBnhSNZw=";
+    hash = "sha256-BQ1/kNJAFoxPJ2I3dyV7EHafKfbbDqCQw039VT4YLT8=";
   };
 
   npmDepsHash = "sha256-4ysUYFIFlzr57J7MdZit1yX3Dgpb2eY0rdYnwyppwK0=";

From 05d0e752e80c75028e548747ddc4ad5c27d0841f Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Sun, 13 Jul 2025 23:14:44 +0000
Subject: [PATCH 064/181] miniserve: 0.29.0 -> 0.31.0

Changelog: https://github.com/svenstaro/miniserve/blob/v0.31.0/CHANGELOG.md
Diff: https://github.com/svenstaro/miniserve/compare/v0.29.0...v0.31.0
---
 pkgs/by-name/mi/miniserve/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mi/miniserve/package.nix b/pkgs/by-name/mi/miniserve/package.nix
index 34f88c26958e..b9558bade88c 100644
--- a/pkgs/by-name/mi/miniserve/package.nix
+++ b/pkgs/by-name/mi/miniserve/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "miniserve";
-  version = "0.29.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = "miniserve";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HHTNBqMYf7WrqJl5adPmH87xfrzV4TKJckpwTPiiw7w=";
+    hash = "sha256-sSCS5jHhu0PBF/R3YqbR9krZghNNa2cPkLkK8kvWWd4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Rjql9cyw7RS66HE50iUrjNvS5JRhR1HBaalOY9eDGH4=";
+  cargoHash = "sha256-Gb1k4sd2/OV1GskFZBn7EapZTlhb9LK19lJHVP7uCK0=";
 
   nativeBuildInputs = [
     pkg-config

From d48f3a2948ef6070524ef31f88deca16c918a05c Mon Sep 17 00:00:00 2001
From: Igor Svistoun <igor@svistoun.com>
Date: Sun, 6 Jul 2025 20:03:32 -0400
Subject: [PATCH 065/181] gitea-actions-runner: 0.2.11 -> 0.2.12

Release notes: https://gitea.com/gitea/act_runner/releases/tag/v0.2.12
---
 .../gi/gitea-actions-runner/package.nix       | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/gi/gitea-actions-runner/package.nix b/pkgs/by-name/gi/gitea-actions-runner/package.nix
index 6b2300e74186..08338d917e2d 100644
--- a/pkgs/by-name/gi/gitea-actions-runner/package.nix
+++ b/pkgs/by-name/gi/gitea-actions-runner/package.nix
@@ -1,42 +1,42 @@
 {
   lib,
   fetchFromGitea,
-  buildGo123Module,
+  buildGoModule,
   testers,
   gitea-actions-runner,
 }:
 
-buildGo123Module rec {
+buildGoModule (finalAttrs: {
   pname = "gitea-actions-runner";
-  version = "0.2.11";
+  version = "0.2.12";
 
   src = fetchFromGitea {
     domain = "gitea.com";
     owner = "gitea";
     repo = "act_runner";
-    rev = "v${version}";
-    hash = "sha256-PmDa8XIe1uZ4SSrs9zh5HBmFaOuj+uuLm7jJ4O5V1dI=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-z/wEs110Y2IZ2Jm6bayxlD2sjyl2V/v+gP6l9pwGi5o=";
   };
 
-  vendorHash = "sha256-lYJFySGqkhT89vHDp1FcTiiC7DG4ziQ1DaBHLh/kXQc=";
+  vendorHash = "sha256-HuiL6OLShSeGtHb4dOeOFOpOgl55s3x18uYgM4X8G7M=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X gitea.com/gitea/act_runner/internal/pkg/ver.version=v${version}"
+    "-X gitea.com/gitea/act_runner/internal/pkg/ver.version=v${finalAttrs.version}"
   ];
 
   passthru.tests.version = testers.testVersion {
     package = gitea-actions-runner;
-    version = "v${version}";
+    version = "v${finalAttrs.version}";
   };
 
   meta = {
     mainProgram = "act_runner";
     maintainers = with lib.maintainers; [ techknowlogick ];
     license = lib.licenses.mit;
-    changelog = "https://gitea.com/gitea/act_runner/releases/tag/v${version}";
+    changelog = "https://gitea.com/gitea/act_runner/releases/tag/v${finalAttrs.version}";
     homepage = "https://gitea.com/gitea/act_runner";
     description = "Runner for Gitea based on act";
   };
-}
+})

From 1bed5128f716fc3e2833e3b7695fd2374bf317f9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 02:12:44 +0000
Subject: [PATCH 066/181] ollama: 0.9.5 -> 0.9.6

---
 pkgs/by-name/ol/ollama/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 1e5d79cdb81b..ee48d94116c3 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -117,13 +117,13 @@ in
 goBuild (finalAttrs: {
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QP70s6gPL1GJv5G4VhYwWpf5raRIcOVsjPq3Jdw89eU=";
+    hash = "sha256-fVbHz/Sa3aSIYBic3lNQl5iUYo+9LHIk52vO9mx6XRE=";
     fetchSubmodules = true;
   };
 

From a7b41e31c2c10a30c67f8c4dcccfc31f5edc7604 Mon Sep 17 00:00:00 2001
From: MidAutumnMoon <me@418.im>
Date: Mon, 14 Jul 2025 14:26:38 +0800
Subject: [PATCH 067/181] mpdris2: fix build with gettext 0.25

---
 pkgs/by-name/mp/mpdris2/fix-gettext-0.25.patch | 14 ++++++++++++++
 pkgs/by-name/mp/mpdris2/package.nix            |  4 ++++
 2 files changed, 18 insertions(+)
 create mode 100644 pkgs/by-name/mp/mpdris2/fix-gettext-0.25.patch

diff --git a/pkgs/by-name/mp/mpdris2/fix-gettext-0.25.patch b/pkgs/by-name/mp/mpdris2/fix-gettext-0.25.patch
new file mode 100644
index 000000000000..f9b52f605dec
--- /dev/null
+++ b/pkgs/by-name/mp/mpdris2/fix-gettext-0.25.patch
@@ -0,0 +1,14 @@
+diff --git i/configure.ac w/configure.ac
+index dcc3c3d..888dc12 100644
+--- i/configure.ac
++++ w/configure.ac
+@@ -4,6 +4,9 @@ AC_INIT([mpDris2],
+ 	[mpdris2],
+ 	[https://github.com/eonpatapon/mpDris2])
+ AC_CONFIG_AUX_DIR([build-aux])
++AC_CONFIG_MACRO_DIRS([m4])
++AM_GNU_GETTEXT_VERSION([0.21])
++AM_GNU_GETTEXT([external])
+ AM_INIT_AUTOMAKE([1.11 tar-ustar foreign])
+ 
+ m4_ifdef([AM_SILENT_RULES],[AM_SILENT_RULES([yes])])
diff --git a/pkgs/by-name/mp/mpdris2/package.nix b/pkgs/by-name/mp/mpdris2/package.nix
index 77629454a09e..05935093bfb1 100644
--- a/pkgs/by-name/mp/mpdris2/package.nix
+++ b/pkgs/by-name/mp/mpdris2/package.nix
@@ -2,6 +2,7 @@
   lib,
   autoreconfHook,
   fetchFromGitHub,
+  gettext,
   glib,
   gobject-introspection,
   intltool,
@@ -28,6 +29,7 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     autoreconfHook
+    gettext
     gobject-introspection
     intltool
     wrapGAppsHook3
@@ -45,6 +47,8 @@ python3.pkgs.buildPythonApplication rec {
     pygobject3
   ];
 
+  patches = [ ./fix-gettext-0.25.patch ];
+
   meta = with lib; {
     description = "MPRIS 2 support for mpd";
     homepage = "https://github.com/eonpatapon/mpDris2/";

From b9fa2c75165ded685d3e0485483b8c2142f8ac15 Mon Sep 17 00:00:00 2001
From: sund3RRR <evenquantity@gmail.com>
Date: Mon, 14 Jul 2025 09:15:49 +0300
Subject: [PATCH 068/181] amnezia-vpn: 4.8.6.0 -> 4.8.8.3

---
 pkgs/by-name/am/amnezia-vpn/package.nix | 85 ++++++++++++-------------
 1 file changed, 40 insertions(+), 45 deletions(-)

diff --git a/pkgs/by-name/am/amnezia-vpn/package.nix b/pkgs/by-name/am/amnezia-vpn/package.nix
index 318253459ac7..3ff760bffdf0 100644
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -16,6 +16,7 @@
   wireguard-tools,
   libssh,
   zlib,
+  openssl,
   tun2socks,
   xray,
   nix-update-script,
@@ -41,16 +42,16 @@ let
   amnezia-xray = xray.overrideAttrs (
     finalAttrs: prevAttrs: {
       pname = "amnezia-xray";
-      version = "1.8.13";
+      version = "1.8.15";
 
       src = fetchFromGitHub {
         owner = "amnezia-vpn";
         repo = "amnezia-xray-core";
         tag = "v${finalAttrs.version}";
-        hash = "sha256-7XYdogoUEv3kTPTOQwRCohsPtfSDf+aRdI28IkTjvPk=";
+        hash = "sha256-3ZGkfGxYl9/yE7Q2CsJkFJ6xSGybBdq3DztQ0f4VsnY=";
       };
 
-      vendorHash = "sha256-zArdGj5yeRxU0X4jNgT5YBI9SJUyrANDaqNPAPH3d5M=";
+      vendorHash = "sha256-AimQsuBRhgpTY5rW8WRejCkx4s9Q9n+OuTf4XCrgpnE=";
     }
   );
 
@@ -64,56 +65,50 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "4.8.6.0";
+  version = "4.8.8.3";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-WQbay3dtGNPPpcK1O7bfs/HKO4ytfmQo60firU/9o28=";
+    hash = "sha256-hDbrp6eT+avFepJL55Vl2alOD+IMnyy8MPXZQTEmLJo=";
     fetchSubmodules = true;
   };
 
-  # Temporary patch header file to fix build with QT 6.9
-  patches = [
-    (fetchpatch {
-      name = "add-missing-include.patch";
-      url = "https://github.com/amnezia-vpn/amnezia-client/commit/c44ce0d77cc3acdf1de48a12459a1a821d404a1c.patch";
-      hash = "sha256-Q6UMD8PlKAcI6zNolT5+cULECnxNrYrD7cifvNg1ZrY=";
-    })
-  ];
-
-  postPatch =
-    ''
-      substituteInPlace client/platforms/linux/daemon/wireguardutilslinux.cpp \
-        --replace-fail 'm_tunnel.start(appPath.filePath("../../client/bin/wireguard-go"), wgArgs);' 'm_tunnel.start("${amneziawg-go}/bin/amneziawg-go", wgArgs);'
-      substituteInPlace client/utilities.cpp \
-        --replace-fail 'return Utils::executable("../../client/bin/openvpn", true);' 'return Utils::executable("${openvpn}/bin/openvpn", false);' \
-        --replace-fail 'return Utils::executable("../../client/bin/tun2socks", true);' 'return Utils::executable("${amnezia-tun2socks}/bin/amnezia-tun2socks", false);' \
-        --replace-fail 'return Utils::usrExecutable("wg-quick");' 'return Utils::executable("${wireguard-tools}/bin/wg-quick", false);'
-      substituteInPlace client/protocols/xrayprotocol.cpp \
-        --replace-fail 'return Utils::executable(QString("xray"), true);' 'return Utils::executable(QString("${amnezia-xray}/bin/xray"), false);'
-      substituteInPlace client/protocols/openvpnovercloakprotocol.cpp \
-        --replace-fail 'return Utils::executable(QString("/ck-client"), true);' 'return Utils::executable(QString("${cloak-pt}/bin/ck-client"), false);'
-      substituteInPlace client/protocols/shadowsocksvpnprotocol.cpp \
-        --replace-fail 'return Utils::executable(QString("/ss-local"), true);' 'return Utils::executable(QString("${shadowsocks-rust}/bin/sslocal"), false);'
-      substituteInPlace client/configurators/openvpn_configurator.cpp \
-        --replace-fail ".arg(qApp->applicationDirPath());" ".arg(\"$out/libexec\");"
-      substituteInPlace client/ui/qautostart.cpp \
-        --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "AmneziaVPN"
-      substituteInPlace deploy/installer/config/AmneziaVPN.desktop.in \
-        --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/pixmaps/AmneziaVPN.png"
-      substituteInPlace deploy/data/linux/AmneziaVPN.service \
-        --replace-fail "ExecStart=/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "ExecStart=$out/bin/AmneziaVPN-service" \
-        --replace-fail "Environment=LD_LIBRARY_PATH=/opt/AmneziaVPN/client/lib" ""
-    ''
-    + (lib.optionalString (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) ''
-      substituteInPlace client/cmake/3rdparty.cmake \
-        --replace-fail 'set(LIBSSH_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libssh.a")' 'set(LIBSSH_LIB_PATH "${libssh}/lib/libssh.so")' \
-        --replace-fail 'set(ZLIB_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libz.a")' 'set(ZLIB_LIB_PATH "${zlib}/lib/libz.so")' \
-        --replace-fail 'set(OPENSSL_LIB_SSL_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libssl.a")' 'set(OPENSSL_LIB_SSL_PATH "''${OPENSSL_ROOT_DIR}/linux/arm64/libssl.a")' \
-        --replace-fail 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")' 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/arm64/libcrypto.a")'
-    '');
+  postPatch = ''
+    substituteInPlace client/platforms/linux/daemon/wireguardutilslinux.cpp \
+      --replace-fail 'm_tunnel.start(appPath.filePath("../../client/bin/wireguard-go"), wgArgs);' 'm_tunnel.start("${amneziawg-go}/bin/amneziawg-go", wgArgs);'
+    substituteInPlace client/utilities.cpp \
+      --replace-fail 'return Utils::executable("../../client/bin/openvpn", true);' 'return Utils::executable("${openvpn}/bin/openvpn", false);' \
+      --replace-fail 'return Utils::executable("../../client/bin/tun2socks", true);' 'return Utils::executable("${amnezia-tun2socks}/bin/amnezia-tun2socks", false);' \
+      --replace-fail 'return Utils::usrExecutable("wg-quick");' 'return Utils::executable("${wireguard-tools}/bin/wg-quick", false);'
+    substituteInPlace client/protocols/xrayprotocol.cpp \
+      --replace-fail 'return Utils::executable(QString("xray"), true);' 'return Utils::executable(QString("${amnezia-xray}/bin/xray"), false);'
+    substituteInPlace client/protocols/openvpnovercloakprotocol.cpp \
+      --replace-fail 'return Utils::executable(QString("/ck-client"), true);' 'return Utils::executable(QString("${cloak-pt}/bin/ck-client"), false);'
+    substituteInPlace client/protocols/shadowsocksvpnprotocol.cpp \
+      --replace-fail 'return Utils::executable(QString("/ss-local"), true);' 'return Utils::executable(QString("${shadowsocks-rust}/bin/sslocal"), false);'
+    substituteInPlace client/configurators/openvpn_configurator.cpp \
+      --replace-fail ".arg(qApp->applicationDirPath());" ".arg(\"$out/libexec\");"
+    substituteInPlace client/ui/qautostart.cpp \
+      --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "AmneziaVPN"
+    substituteInPlace deploy/installer/config/AmneziaVPN.desktop.in \
+      --replace-fail "/usr/share/pixmaps/AmneziaVPN.png" "$out/share/pixmaps/AmneziaVPN.png"
+    substituteInPlace deploy/data/linux/AmneziaVPN.service \
+      --replace-fail "ExecStart=/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "ExecStart=$out/bin/AmneziaVPN-service" \
+      --replace-fail "Environment=LD_LIBRARY_PATH=/opt/AmneziaVPN/client/lib" ""
+    substituteInPlace client/cmake/3rdparty.cmake \
+      --replace-fail 'set(LIBSSH_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libssh.a")' 'set(LIBSSH_LIB_PATH "${libssh}/lib/libssh.so")' \
+      --replace-fail 'set(ZLIB_LIB_PATH "''${LIBSSH_ROOT_DIR}/linux/x86_64/libz.a")' 'set(ZLIB_LIB_PATH "${zlib}/lib/libz.so")' \
+      --replace-fail 'set(OPENSSL_INCLUDE_DIR "''${OPENSSL_ROOT_DIR}/linux/include")' 'set(OPENSSL_INCLUDE_DIR "${openssl.dev}/include")' \
+      --replace-fail 'set(OPENSSL_LIB_SSL_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libssl.a")' 'set(OPENSSL_LIB_SSL_PATH "${openssl.out}/lib/libssl.so")' \
+      --replace-fail 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")' 'set(OPENSSL_LIB_CRYPTO_PATH "${openssl.out}/lib/libcrypto.so")' \
+      --replace-fail 'set(OPENSSL_USE_STATIC_LIBS TRUE)' 'set(OPENSSL_USE_STATIC_LIBS FALSE)'
+    substituteInPlace service/server/CMakeLists.txt \
+      --replace-fail 'set(OPENSSL_INCLUDE_DIR "''${OPENSSL_ROOT_DIR}/linux/include")' 'set(OPENSSL_INCLUDE_DIR "${openssl.dev}/include")' \
+      --replace-fail 'set(OPENSSL_LIB_CRYPTO_PATH "''${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")' 'set(OPENSSL_LIB_CRYPTO_PATH "${openssl.out}/lib/libcrypto.so")' \
+      --replace-fail 'set(OPENSSL_USE_STATIC_LIBS TRUE)' 'set(OPENSSL_USE_STATIC_LIBS FALSE)'
+  '';
 
   strictDeps = true;
 

From 6f6c62502622fea6904d6d7e42b89f3ebc400ede Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 12 Jul 2025 15:24:14 +0200
Subject: [PATCH 069/181] ci/github-script: move from ci/labels

This just moves things around to use less specific naming - `labels` is
only *one* script that can potentially be run locally while still being
written in github-script. Later, we can add more.
---
 .github/workflows/labels.yml                   |  4 ++--
 ci/{labels => github-script}/.editorconfig     |  0
 ci/{labels => github-script}/.gitignore        |  0
 ci/{labels => github-script}/.npmrc            |  0
 ci/github-script/README.md                     | 13 +++++++++++++
 ci/{labels => github-script}/labels.cjs        |  0
 ci/{labels => github-script}/package-lock.json |  0
 ci/{labels => github-script}/package.json      |  0
 ci/{labels => github-script}/run.js            |  2 +-
 ci/{labels => github-script}/shell.nix         |  0
 ci/labels/README.md                            |  4 ----
 11 files changed, 16 insertions(+), 7 deletions(-)
 rename ci/{labels => github-script}/.editorconfig (100%)
 rename ci/{labels => github-script}/.gitignore (100%)
 rename ci/{labels => github-script}/.npmrc (100%)
 create mode 100644 ci/github-script/README.md
 rename ci/{labels => github-script}/labels.cjs (100%)
 rename ci/{labels => github-script}/package-lock.json (100%)
 rename ci/{labels => github-script}/package.json (100%)
 rename ci/{labels => github-script}/run.js (92%)
 rename ci/{labels => github-script}/shell.nix (100%)
 delete mode 100644 ci/labels/README.md

diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index f5a04ad073bc..ff6905d62164 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           sparse-checkout: |
-            ci/labels
+            ci/github-script
 
       - name: Install dependencies
         run: npm install @actions/artifact bottleneck
@@ -69,7 +69,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            require('./ci/labels/labels.cjs')({
+            require('./ci/github-script/labels.cjs')({
               github,
               context,
               core,
diff --git a/ci/labels/.editorconfig b/ci/github-script/.editorconfig
similarity index 100%
rename from ci/labels/.editorconfig
rename to ci/github-script/.editorconfig
diff --git a/ci/labels/.gitignore b/ci/github-script/.gitignore
similarity index 100%
rename from ci/labels/.gitignore
rename to ci/github-script/.gitignore
diff --git a/ci/labels/.npmrc b/ci/github-script/.npmrc
similarity index 100%
rename from ci/labels/.npmrc
rename to ci/github-script/.npmrc
diff --git a/ci/github-script/README.md b/ci/github-script/README.md
new file mode 100644
index 000000000000..73cb4119a68d
--- /dev/null
+++ b/ci/github-script/README.md
@@ -0,0 +1,13 @@
+# GitHub specific CI scripts
+
+This folder contains [`actions/github-script`](https://github.com/actions/github-script)-based JavaScript code.
+It provides a `nix-shell` environment to run and test these actions locally.
+
+To run any of the scripts locally:
+
+- Provide `gh` on `PATH` and make sure it's authenticated.
+- Enter `nix-shell` in `./ci/github-script`.
+
+## Labeler
+
+Run `./run.js OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
diff --git a/ci/labels/labels.cjs b/ci/github-script/labels.cjs
similarity index 100%
rename from ci/labels/labels.cjs
rename to ci/github-script/labels.cjs
diff --git a/ci/labels/package-lock.json b/ci/github-script/package-lock.json
similarity index 100%
rename from ci/labels/package-lock.json
rename to ci/github-script/package-lock.json
diff --git a/ci/labels/package.json b/ci/github-script/package.json
similarity index 100%
rename from ci/labels/package.json
rename to ci/github-script/package.json
diff --git a/ci/labels/run.js b/ci/github-script/run.js
similarity index 92%
rename from ci/labels/run.js
rename to ci/github-script/run.js
index d7e8e9ff9401..7f3f92e7b1f0 100755
--- a/ci/labels/run.js
+++ b/ci/github-script/run.js
@@ -7,7 +7,7 @@ import { getOctokit } from '@actions/github'
 import labels from './labels.cjs'
 
 if (process.argv.length !== 4)
-  throw new Error('Call this with exactly two arguments: ./run.js OWNER REPO')
+  throw new Error('Call this with exactly three arguments: ./run OWNER REPO')
 const [, , owner, repo] = process.argv
 
 const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
diff --git a/ci/labels/shell.nix b/ci/github-script/shell.nix
similarity index 100%
rename from ci/labels/shell.nix
rename to ci/github-script/shell.nix
diff --git a/ci/labels/README.md b/ci/labels/README.md
deleted file mode 100644
index 26cd88763fe6..000000000000
--- a/ci/labels/README.md
+++ /dev/null
@@ -1,4 +0,0 @@
-To test the labeler locally:
-- Provide `gh` on `PATH` and make sure it's authenticated.
-- Enter `nix-shell` in `./ci/labels`.
-- Run `./run.js OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".

From aaaabe0cb76f7a2e9705c06a1dc336df90789fda Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 13 Jul 2025 16:24:24 +0200
Subject: [PATCH 070/181] ci/github-script: add commander CLI interface

This makes it easier to add additional features.
---
 ci/github-script/README.md         |  2 +-
 ci/github-script/package-lock.json | 14 +++++-
 ci/github-script/package.json      |  3 +-
 ci/github-script/run.js            | 76 +++++++++++++++++-------------
 4 files changed, 58 insertions(+), 37 deletions(-)

diff --git a/ci/github-script/README.md b/ci/github-script/README.md
index 73cb4119a68d..e71a4f173c57 100644
--- a/ci/github-script/README.md
+++ b/ci/github-script/README.md
@@ -10,4 +10,4 @@ To run any of the scripts locally:
 
 ## Labeler
 
-Run `./run.js OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
+Run `./run.js labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
diff --git a/ci/github-script/package-lock.json b/ci/github-script/package-lock.json
index 5c5ee09ad67e..538083dcea93 100644
--- a/ci/github-script/package-lock.json
+++ b/ci/github-script/package-lock.json
@@ -1,5 +1,5 @@
 {
-  "name": "labels",
+  "name": "github-script",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
@@ -7,7 +7,8 @@
       "dependencies": {
         "@actions/artifact": "2.3.2",
         "@actions/github": "6.0.1",
-        "bottleneck": "2.19.5"
+        "bottleneck": "2.19.5",
+        "commander": "14.0.0"
       }
     },
     "node_modules/@actions/artifact": {
@@ -950,6 +951,15 @@
       "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
       "license": "MIT"
     },
+    "node_modules/commander": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.0.tgz",
+      "integrity": "sha512-2uM9rYjPvyq39NwLRqaiLtWHyDC1FvryJDa2ATTVims5YAS4PupsEQsDvP14FqhFr0P49CYDugi59xaxJlTXRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/compress-commons": {
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-6.0.2.tgz",
diff --git a/ci/github-script/package.json b/ci/github-script/package.json
index e07813aa86b5..906f371f0d5d 100644
--- a/ci/github-script/package.json
+++ b/ci/github-script/package.json
@@ -4,6 +4,7 @@
   "dependencies": {
     "@actions/artifact": "2.3.2",
     "@actions/github": "6.0.1",
-    "bottleneck": "2.19.5"
+    "bottleneck": "2.19.5",
+    "commander": "14.0.0"
   }
 }
diff --git a/ci/github-script/run.js b/ci/github-script/run.js
index 7f3f92e7b1f0..5127a6a0ee95 100755
--- a/ci/github-script/run.js
+++ b/ci/github-script/run.js
@@ -3,43 +3,53 @@ import { execSync } from 'node:child_process'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { program } from 'commander'
 import { getOctokit } from '@actions/github'
-import labels from './labels.cjs'
 
-if (process.argv.length !== 4)
-  throw new Error('Call this with exactly three arguments: ./run OWNER REPO')
-const [, , owner, repo] = process.argv
+async function run(action, owner, repo) {
+  const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
 
-const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
+  const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
+  try {
+    process.env.GITHUB_WORKSPACE = tmp
+    process.chdir(tmp)
 
-const tmp = mkdtempSync(join(tmpdir(), 'labels-'))
-try {
-  process.env.GITHUB_WORKSPACE = tmp
-  process.chdir(tmp)
-
-  await labels({
-    github: getOctokit(token),
-    context: {
-      payload: {},
-      repo: {
-        owner,
-        repo,
+    await action({
+      github: getOctokit(token),
+      context: {
+        payload: {},
+        repo: {
+          owner,
+          repo,
+        },
       },
-    },
-    core: {
-      getInput() {
-        return token
+      core: {
+        getInput() {
+          return token
+        },
+        error: console.error,
+        info: console.log,
+        notice: console.log,
+        setFailed(msg) {
+          console.error(msg)
+          process.exitCode = 1
+        },
       },
-      error: console.error,
-      info: console.log,
-      notice: console.log,
-      setFailed(msg) {
-        console.error(msg)
-        process.exitCode = 1
-      },
-    },
-    dry: true,
-  })
-} finally {
-  rmSync(tmp, { recursive: true })
+      dry: true,
+    })
+  } finally {
+    rmSync(tmp, { recursive: true })
+  }
 }
+
+program
+  .command('labels')
+  .description('Manage labels on pull requests.')
+  .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
+  .action(async (owner, repo) => {
+    const labels = (await import('./labels.cjs')).default
+    run(labels, owner, repo)
+  })
+
+await program.parse()

From d11eba1e1d3a899db5d794836baa837e955b652a Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 12 Jul 2025 15:56:29 +0200
Subject: [PATCH 071/181] ci/github-script: default to commonjs

Since all github-scripts need to be written in commonjs, we now default
to it by not setting package.json. Support from editors for .js files is
slightly better than .cjs. To still allow using module imports in the
test runner script, we trick node into loading the script itself as a
module again via `--import ./run`.
---
 .github/workflows/labels.yml               | 2 +-
 ci/github-script/.editorconfig             | 3 +--
 ci/github-script/README.md                 | 2 +-
 ci/github-script/{labels.cjs => labels.js} | 0
 ci/github-script/package.json              | 1 -
 ci/github-script/{run.js => run}           | 4 ++--
 6 files changed, 5 insertions(+), 7 deletions(-)
 rename ci/github-script/{labels.cjs => labels.js} (100%)
 rename ci/github-script/{run.js => run} (93%)

diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index ff6905d62164..14876ecf6294 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -69,7 +69,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            require('./ci/github-script/labels.cjs')({
+            require('./ci/github-script/labels.js')({
               github,
               context,
               core,
diff --git a/ci/github-script/.editorconfig b/ci/github-script/.editorconfig
index 08ca1a194873..67d678ef170c 100644
--- a/ci/github-script/.editorconfig
+++ b/ci/github-script/.editorconfig
@@ -1,4 +1,3 @@
-# TODO: Move to <top-level>/.editorconfig, once ci/.editorconfig has made its way through staging.
-[*.cjs]
+[run]
 indent_style = space
 indent_size = 2
diff --git a/ci/github-script/README.md b/ci/github-script/README.md
index e71a4f173c57..8ffff0c40922 100644
--- a/ci/github-script/README.md
+++ b/ci/github-script/README.md
@@ -10,4 +10,4 @@ To run any of the scripts locally:
 
 ## Labeler
 
-Run `./run.js labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
+Run `./run labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
diff --git a/ci/github-script/labels.cjs b/ci/github-script/labels.js
similarity index 100%
rename from ci/github-script/labels.cjs
rename to ci/github-script/labels.js
diff --git a/ci/github-script/package.json b/ci/github-script/package.json
index 906f371f0d5d..4671dd41f0cd 100644
--- a/ci/github-script/package.json
+++ b/ci/github-script/package.json
@@ -1,6 +1,5 @@
 {
   "private": true,
-  "type": "module",
   "dependencies": {
     "@actions/artifact": "2.3.2",
     "@actions/github": "6.0.1",
diff --git a/ci/github-script/run.js b/ci/github-script/run
similarity index 93%
rename from ci/github-script/run.js
rename to ci/github-script/run
index 5127a6a0ee95..1b670a8b2875 100755
--- a/ci/github-script/run.js
+++ b/ci/github-script/run
@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env -S node --import ./run
 import { execSync } from 'node:child_process'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
@@ -48,7 +48,7 @@ program
   .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
   .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
   .action(async (owner, repo) => {
-    const labels = (await import('./labels.cjs')).default
+    const labels = (await import('./labels.js')).default
     run(labels, owner, repo)
   })
 

From 2192c5b6e86ab333e7471d719bcbd5a74e3b02bb Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 12 Jul 2025 16:11:31 +0200
Subject: [PATCH 072/181] ci/github-script: extract common withRateLimit.js

This can and should be re-used across different scripts.
---
 ci/github-script/labels.js        | 71 ++++---------------------------
 ci/github-script/withRateLimit.js | 61 ++++++++++++++++++++++++++
 2 files changed, 69 insertions(+), 63 deletions(-)
 create mode 100644 ci/github-script/withRateLimit.js

diff --git a/ci/github-script/labels.js b/ci/github-script/labels.js
index 809dc4581bb8..7bbe1497d906 100644
--- a/ci/github-script/labels.js
+++ b/ci/github-script/labels.js
@@ -1,61 +1,12 @@
 module.exports = async function ({ github, context, core, dry }) {
-  const Bottleneck = require('bottleneck')
   const path = require('node:path')
   const { DefaultArtifactClient } = require('@actions/artifact')
   const { readFile, writeFile } = require('node:fs/promises')
+  const withRateLimit = require('./withRateLimit.js')
 
   const artifactClient = new DefaultArtifactClient()
 
-  const stats = {
-    issues: 0,
-    prs: 0,
-    requests: 0,
-    artifacts: 0,
-  }
-
-  // Rate-Limiting and Throttling, see for details:
-  //   https://github.com/octokit/octokit.js/issues/1069#throttling
-  //   https://docs.github.com/en/rest/using-the-rest-api/best-practices-for-using-the-rest-api
-  const allLimits = new Bottleneck({
-    // Avoid concurrent requests
-    maxConcurrent: 1,
-    // Will be updated with first `updateReservoir()` call below.
-    reservoir: 0,
-  })
-  // Pause between mutative requests
-  const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
-  github.hook.wrap('request', async (request, options) => {
-    // Requests to the /rate_limit endpoint do not count against the rate limit.
-    if (options.url == '/rate_limit') return request(options)
-    // Search requests are in a different resource group, which allows 30 requests / minute.
-    // We do less than a handful each run, so not implementing throttling for now.
-    if (options.url.startsWith('/search/')) return request(options)
-    stats.requests++
-    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
-      return writeLimits.schedule(request.bind(null, options))
-    else return allLimits.schedule(request.bind(null, options))
-  })
-
-  async function updateReservoir() {
-    let response
-    try {
-      response = await github.rest.rateLimit.get()
-    } catch (err) {
-      core.error(`Failed updating reservoir:\n${err}`)
-      // Keep retrying on failed rate limit requests instead of exiting the script early.
-      return
-    }
-    // Always keep 1000 spare requests for other jobs to do their regular duty.
-    // They normally use below 100, so 1000 is *plenty* of room to work with.
-    const reservoir = Math.max(0, response.data.resources.core.remaining - 1000)
-    core.info(`Updating reservoir to: ${reservoir}`)
-    allLimits.updateSettings({ reservoir })
-  }
-  await updateReservoir()
-  // Update remaining requests every minute to account for other jobs running in parallel.
-  const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
-
-  async function handlePullRequest(item) {
+  async function handlePullRequest({ item, stats }) {
     const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)
 
     const pull_number = item.number
@@ -221,7 +172,7 @@ module.exports = async function ({ github, context, core, dry }) {
     return prLabels
   }
 
-  async function handle(item) {
+  async function handle({ item, stats }) {
     try {
       const log = (k, v, skip) => {
         core.info(`#${item.number} - ${k}: ${v}` + (skip ? ' (skipped)' : ''))
@@ -237,7 +188,7 @@ module.exports = async function ({ github, context, core, dry }) {
 
       if (item.pull_request || context.payload.pull_request) {
         stats.prs++
-        Object.assign(itemLabels, await handlePullRequest(item))
+        Object.assign(itemLabels, await handlePullRequest({ item, stats }))
       } else {
         stats.issues++
       }
@@ -326,9 +277,9 @@ module.exports = async function ({ github, context, core, dry }) {
     }
   }
 
-  try {
+  await withRateLimit({ github, core }, async (stats) => {
     if (context.payload.pull_request) {
-      await handle(context.payload.pull_request)
+      await handle({ item: context.payload.pull_request, stats })
     } else {
       const lastRun = (
         await github.rest.actions.listWorkflowRuns({
@@ -447,17 +398,11 @@ module.exports = async function ({ github, context, core, dry }) {
             arr.findIndex((firstItem) => firstItem.number == thisItem.number),
         )
 
-      ;(await Promise.allSettled(items.map(handle)))
+      ;(await Promise.allSettled(items.map((item) => handle({ item, stats }))))
         .filter(({ status }) => status == 'rejected')
         .map(({ reason }) =>
           core.setFailed(`${reason.message}\n${reason.cause.stack}`),
         )
-
-      core.notice(
-        `Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`,
-      )
     }
-  } finally {
-    clearInterval(reservoirUpdater)
-  }
+  })
 }
diff --git a/ci/github-script/withRateLimit.js b/ci/github-script/withRateLimit.js
new file mode 100644
index 000000000000..03fbd54291a8
--- /dev/null
+++ b/ci/github-script/withRateLimit.js
@@ -0,0 +1,61 @@
+module.exports = async function ({ github, core }, callback) {
+  const Bottleneck = require('bottleneck')
+
+  const stats = {
+    issues: 0,
+    prs: 0,
+    requests: 0,
+    artifacts: 0,
+  }
+
+  // Rate-Limiting and Throttling, see for details:
+  //   https://github.com/octokit/octokit.js/issues/1069#throttling
+  //   https://docs.github.com/en/rest/using-the-rest-api/best-practices-for-using-the-rest-api
+  const allLimits = new Bottleneck({
+    // Avoid concurrent requests
+    maxConcurrent: 1,
+    // Will be updated with first `updateReservoir()` call below.
+    reservoir: 0,
+  })
+  // Pause between mutative requests
+  const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
+  github.hook.wrap('request', async (request, options) => {
+    // Requests to the /rate_limit endpoint do not count against the rate limit.
+    if (options.url == '/rate_limit') return request(options)
+    // Search requests are in a different resource group, which allows 30 requests / minute.
+    // We do less than a handful each run, so not implementing throttling for now.
+    if (options.url.startsWith('/search/')) return request(options)
+    stats.requests++
+    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
+      return writeLimits.schedule(request.bind(null, options))
+    else return allLimits.schedule(request.bind(null, options))
+  })
+
+  async function updateReservoir() {
+    let response
+    try {
+      response = await github.rest.rateLimit.get()
+    } catch (err) {
+      core.error(`Failed updating reservoir:\n${err}`)
+      // Keep retrying on failed rate limit requests instead of exiting the script early.
+      return
+    }
+    // Always keep 1000 spare requests for other jobs to do their regular duty.
+    // They normally use below 100, so 1000 is *plenty* of room to work with.
+    const reservoir = Math.max(0, response.data.resources.core.remaining - 1000)
+    core.info(`Updating reservoir to: ${reservoir}`)
+    allLimits.updateSettings({ reservoir })
+  }
+  await updateReservoir()
+  // Update remaining requests every minute to account for other jobs running in parallel.
+  const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
+
+  try {
+    await callback(stats)
+  } finally {
+    clearInterval(reservoirUpdater)
+    core.notice(
+      `Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`,
+    )
+  }
+}

From 97d410394634b8bb5963faba4dec6bfda6f67661 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 13 Jul 2025 18:58:35 +0200
Subject: [PATCH 073/181] ci/github-script: allow running for single PR

Makes specific tests in the upstream repo easier to do.
---
 ci/github-script/run | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/ci/github-script/run b/ci/github-script/run
index 1b670a8b2875..8241da429eeb 100755
--- a/ci/github-script/run
+++ b/ci/github-script/run
@@ -6,18 +6,28 @@ import { join } from 'node:path'
 import { program } from 'commander'
 import { getOctokit } from '@actions/github'
 
-async function run(action, owner, repo) {
+async function run(action, owner, repo, pull_number) {
   const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
 
+  const github = getOctokit(token)
+
+  const payload = !pull_number ? {} : {
+    pull_request: (await github.rest.pulls.get({
+      owner,
+      repo,
+      pull_number,
+    })).data
+  }
+
   const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
   try {
     process.env.GITHUB_WORKSPACE = tmp
     process.chdir(tmp)
 
     await action({
-      github: getOctokit(token),
+      github,
       context: {
-        payload: {},
+        payload,
         repo: {
           owner,
           repo,
@@ -47,9 +57,10 @@ program
   .description('Manage labels on pull requests.')
   .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
   .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
-  .action(async (owner, repo) => {
+  .argument('[pr]', 'Number of the Pull Request to label')
+  .action(async (owner, repo, pr) => {
     const labels = (await import('./labels.js')).default
-    run(labels, owner, repo)
+    run(labels, owner, repo, pr)
   })
 
 await program.parse()

From d71b8c3680b5eb0a2cfcacc1972b37dd051ff028 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 13 Jul 2025 18:59:07 +0200
Subject: [PATCH 074/181] ci/github-script: allow running without dry mode

---
 ci/github-script/run | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/ci/github-script/run b/ci/github-script/run
index 8241da429eeb..cbf3ea9315e0 100755
--- a/ci/github-script/run
+++ b/ci/github-script/run
@@ -6,7 +6,7 @@ import { join } from 'node:path'
 import { program } from 'commander'
 import { getOctokit } from '@actions/github'
 
-async function run(action, owner, repo, pull_number) {
+async function run(action, owner, repo, pull_number, dry) {
   const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
 
   const github = getOctokit(token)
@@ -45,7 +45,7 @@ async function run(action, owner, repo, pull_number) {
           process.exitCode = 1
         },
       },
-      dry: true,
+      dry,
     })
   } finally {
     rmSync(tmp, { recursive: true })
@@ -58,9 +58,10 @@ program
   .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
   .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
   .argument('[pr]', 'Number of the Pull Request to label')
-  .action(async (owner, repo, pr) => {
+  .option('--no-dry', 'Make actual modifications')
+  .action(async (owner, repo, pr, options) => {
     const labels = (await import('./labels.js')).default
-    run(labels, owner, repo, pr)
+    run(labels, owner, repo, pr, options.dry)
   })
 
 await program.parse()

From 96d97a740570786e5e3a899b13c7843d0221c891 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 12:55:36 +0000
Subject: [PATCH 075/181] tektoncd-cli: 0.41.0 -> 0.41.1

---
 pkgs/by-name/te/tektoncd-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/te/tektoncd-cli/package.nix b/pkgs/by-name/te/tektoncd-cli/package.nix
index 4bfdc93f4f4a..2916735697b1 100644
--- a/pkgs/by-name/te/tektoncd-cli/package.nix
+++ b/pkgs/by-name/te/tektoncd-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "tektoncd-cli";
-  version = "0.41.0";
+  version = "0.41.1";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-X+zFYPoHf8Q1K0bLjrsnwOZxxAeJCzgKqmr3FYK5AKA=";
+    sha256 = "sha256-AxE7Dom40xL+f2VXz9zlAZYFfW/iCbR9EdHfuCu8z7M=";
   };
 
   vendorHash = null;

From f4229917223228315169c2a3ee89e5cb7dc661d9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 13:38:27 +0000
Subject: [PATCH 076/181] leetgo: 1.4.14 -> 1.4.15

---
 pkgs/by-name/le/leetgo/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/le/leetgo/package.nix b/pkgs/by-name/le/leetgo/package.nix
index 12cb24a61efb..079444b6398c 100644
--- a/pkgs/by-name/le/leetgo/package.nix
+++ b/pkgs/by-name/le/leetgo/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "leetgo";
-  version = "1.4.14";
+  version = "1.4.15";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "leetgo";
     rev = "v${version}";
-    hash = "sha256-RRKQlCGVE8/RS1jPZBmzDXrv0dTW1zKR5mugByfIzsU=";
+    hash = "sha256-9GM4V7NOYMsvWwBgJSnGl4/S+UexdlVL/NyIiMRnL8A=";
   };
 
-  vendorHash = "sha256-VNJe+F/lbW+9fX6Fie91LLSs5H4Rn+kmHhsMd5mbYtA=";
+  vendorHash = "sha256-I3H2uVIvOGM6aQelM/69LpwJvg3TBZwq3i4R913etH4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 90de7fab2e2356fc6ed9d84620c5ca97cb10ecfb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 13:53:03 +0000
Subject: [PATCH 077/181] go-dnscollector: 1.8.0 -> 1.9.0

---
 pkgs/by-name/go/go-dnscollector/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/go-dnscollector/package.nix b/pkgs/by-name/go/go-dnscollector/package.nix
index cc428c1fdae0..08622db92926 100644
--- a/pkgs/by-name/go/go-dnscollector/package.nix
+++ b/pkgs/by-name/go/go-dnscollector/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "go-dnscollector";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "go-dnscollector";
     rev = "v${version}";
-    sha256 = "sha256-q12hMnSqA/KCkmiqsmBpvDmyHtuEWhMBTKwOOyw3Wfs=";
+    sha256 = "sha256-ebl/edMN45oLV1pN6mCaOSgxSSyAugsBP2sQWbIiPTI=";
   };
 
-  vendorHash = "sha256-TtlOwmNyO2/eQCajPBu6Pgdbuk4gacpgtcnr1vZgZdg=";
+  vendorHash = "sha256-Y0LOtyRJWOFAQwfg8roisSer0oCxPiaYICE1FY/SEF8=";
 
   subPackages = [ "." ];
 

From 2f20b75f8aa9019f79bed84bd91572952c3bcf22 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 14:30:07 +0000
Subject: [PATCH 078/181] ente-web: 1.1.53 -> 1.1.57

---
 pkgs/by-name/en/ente-web/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/en/ente-web/package.nix b/pkgs/by-name/en/ente-web/package.nix
index 7ca8ac8b1adf..1e717dae7ab1 100644
--- a/pkgs/by-name/en/ente-web/package.nix
+++ b/pkgs/by-name/en/ente-web/package.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ente-web";
-  version = "1.1.53";
+  version = "1.1.57";
 
   src = fetchFromGitHub {
     owner = "ente-io";
@@ -20,13 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
     sparseCheckout = [ "web" ];
     tag = "photos-v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-LYFkqB44pS7WLa4HEnYrnRanh04P82ydsqiZYHNAshc=";
+    hash = "sha256-SCkxGm/w0kES7wDuLBsUTgwrFYNLvLD51NyioAVTLrg=";
   };
   sourceRoot = "${finalAttrs.src.name}/web";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-8uqKlqBnYTft3P7r1rQaEqn7ixj55yWnSLKTNi/0MZA=";
+    hash = "sha256-FnLMXOpIVNOhaM7VjNEDlwpew9T/5Ch5eFed9tLpDsI=";
   };
 
   nativeBuildInputs = [

From 67992e37d94dffe07877f765b97b363ab953ddad Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 14:35:13 +0000
Subject: [PATCH 079/181] python3Packages.nodriver: 0.46.1 -> 0.47.0

---
 pkgs/development/python-modules/nodriver/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/nodriver/default.nix b/pkgs/development/python-modules/nodriver/default.nix
index 704437918246..2a408c9a2572 100644
--- a/pkgs/development/python-modules/nodriver/default.nix
+++ b/pkgs/development/python-modules/nodriver/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "nodriver";
-  version = "0.46.1";
+  version = "0.47.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zFyeSwMJJLoIrE+CJ79kJrFF4qQOWun/AFO64Je8440=";
+    hash = "sha256-X8MRgqTbcl6lb8BCJpopoT5Vorr4Pf3XMKqFHdUmlgg=";
   };
 
   disabled = pythonOlder "3.9";

From 73569c877199370db27670474f75d7666b767f69 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 16:58:58 +0000
Subject: [PATCH 080/181] hyprpanel: 0-unstable-2025-07-03 ->
 0-unstable-2025-07-12

---
 pkgs/by-name/hy/hyprpanel/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/hy/hyprpanel/package.nix b/pkgs/by-name/hy/hyprpanel/package.nix
index bc6ef56220e1..f6953012d783 100644
--- a/pkgs/by-name/hy/hyprpanel/package.nix
+++ b/pkgs/by-name/hy/hyprpanel/package.nix
@@ -37,7 +37,7 @@
 }:
 ags.bundle {
   pname = "hyprpanel";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-07-12";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -45,8 +45,8 @@ ags.bundle {
   src = fetchFromGitHub {
     owner = "Jas-SinghFSU";
     repo = "HyprPanel";
-    rev = "343c9857bd7f1d302d591e8d5f3f9952dc84775b";
-    hash = "sha256-MGJmxnjlERXJLDywrSHYSgpt7fhh3/HOHQboRrxDW64=";
+    rev = "59b57fca0634c98f23227ea948f87df7814e72f6";
+    hash = "sha256-cl1NEWTUsNxBmLjyvz+GDP4Hy7riaOszSGpfplHA7Y4=";
   };
 
   # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42

From 3cf49495aff6b3b54da9ebc0eefc643bc5a37d97 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 17:02:56 +0000
Subject: [PATCH 081/181] linuxPackages.rtw88: 0-unstable-2025-06-26 ->
 0-unstable-2025-07-13

---
 pkgs/os-specific/linux/rtw88/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/rtw88/default.nix b/pkgs/os-specific/linux/rtw88/default.nix
index 5c2bf316081c..0f2e47595e9a 100644
--- a/pkgs/os-specific/linux/rtw88/default.nix
+++ b/pkgs/os-specific/linux/rtw88/default.nix
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "rtw88";
-  version = "0-unstable-2025-06-26";
+  version = "0-unstable-2025-07-13";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtw88";
-    rev = "b89af8cd40d9528b0cdb9a6251efe49d8a69bfc6";
-    hash = "sha256-gzWVfb8nAN0mmOpiats+VDG/6iwdrxcQHEsDgC7eFZU=";
+    rev = "fa96fd4c014fa528d1fa50318e97aa71bf4f473c";
+    hash = "sha256-KFozxbpw6HJhbL5QLnGkKEBAbeEiHrhSJUMAcbM+lX4=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;

From a6886c7a6b2276bc4edb9c542cca2c74e030a8c3 Mon Sep 17 00:00:00 2001
From: Phillip Cloud <417981+cpcloud@users.noreply.github.com>
Date: Mon, 14 Jul 2025 13:06:49 -0400
Subject: [PATCH 082/181] freetds: make build compatible with gettext 0.25

---
 pkgs/by-name/fr/freetds/gettext-0.25.patch | 13 +++++++++++++
 pkgs/by-name/fr/freetds/package.nix        |  4 ++++
 2 files changed, 17 insertions(+)
 create mode 100644 pkgs/by-name/fr/freetds/gettext-0.25.patch

diff --git a/pkgs/by-name/fr/freetds/gettext-0.25.patch b/pkgs/by-name/fr/freetds/gettext-0.25.patch
new file mode 100644
index 000000000000..d584ad9aefb6
--- /dev/null
+++ b/pkgs/by-name/fr/freetds/gettext-0.25.patch
@@ -0,0 +1,13 @@
+diff --git i/configure.ac w/configure.ac
+index bb07bba1..c4e15d53 100644
+--- i/configure.ac
++++ w/configure.ac
+@@ -20,6 +20,8 @@ AM_INIT_AUTOMAKE([dist-bzip2 parallel-tests subdir-objects foreign])
+ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES(yes)])
+ AC_CONFIG_HEADERS(include/config.h)
+ AC_CONFIG_MACRO_DIR([m4])
++AM_GNU_GETTEXT_VERSION([0.25])
++AM_GNU_GETTEXT([external])
+ 
+ dnl configuration directory will be /usr/local/etc
+ AC_PREFIX_DEFAULT(/usr/local)
diff --git a/pkgs/by-name/fr/freetds/package.nix b/pkgs/by-name/fr/freetds/package.nix
index 5c0e0e7d11fe..9a01adc25221 100644
--- a/pkgs/by-name/fr/freetds/package.nix
+++ b/pkgs/by-name/fr/freetds/package.nix
@@ -22,6 +22,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-XLZsRqYKg7iihV5GYUi2+ieWLH/R3LP25dCrF+xf9t0=";
   };
 
+  patches = [
+    ./gettext-0.25.patch
+  ];
+
   buildInputs = [
     openssl
   ] ++ lib.optional odbcSupport unixODBC;

From dcf49f8e33e06b088b62cc540d2d5e92b35000e3 Mon Sep 17 00:00:00 2001
From: matthewcroughan <matt@croughan.sh>
Date: Mon, 14 Jul 2025 16:23:41 +0100
Subject: [PATCH 083/181] greaseweazle: init at 1.22

Co-authored-by: bloxx12 <charlie@charlieroot.dev>
---
 pkgs/by-name/gr/greaseweazle/package.nix | 43 ++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 pkgs/by-name/gr/greaseweazle/package.nix

diff --git a/pkgs/by-name/gr/greaseweazle/package.nix b/pkgs/by-name/gr/greaseweazle/package.nix
new file mode 100644
index 000000000000..915d5910de06
--- /dev/null
+++ b/pkgs/by-name/gr/greaseweazle/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "greaseweazle";
+  version = "1.22";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "keirf";
+    repo = "greaseweazle";
+    rev = "v${version}";
+    hash = "sha256-Ki4OvtcFn5DH87OCWY7xN9fRhGxlzS9QIuQCJxPWJco=";
+  };
+
+  build-system = with python3.pkgs; [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = with python3.pkgs; [
+    crcmod
+    bitarray
+    pyserial
+    requests
+  ];
+
+  pythonImportsCheck = [
+    "greaseweazle"
+  ];
+
+  meta = {
+    description = "Tools for accessing a floppy drive at the raw flux level";
+    homepage = "https://github.com/keirf/greaseweazle";
+    license = lib.licenses.unlicense;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+    mainProgram = "greaseweazle";
+  };
+}

From dadd1f232a8231109c732c68982d41eb06fdc7a5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 19:36:48 +0000
Subject: [PATCH 084/181] terraform-providers.huaweicloud: 1.76.1 -> 1.76.4

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index b5b4b9e5b15f..4193af558f2a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -624,11 +624,11 @@
     "vendorHash": "sha256-SsEWNIBkgcdTlSrB4hIvRmhMv2eJ2qQaPUmiN09A+NM="
   },
   "huaweicloud": {
-    "hash": "sha256-v0UqXIK4SPGouETUWSQI1K1hpsPMyUuEpLQ++Gs4+yk=",
+    "hash": "sha256-jXppJtVMPpipXbEhgenVtFP5YxwlQzekquRoZmgoP0Q=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.76.1",
+    "rev": "v1.76.4",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

From 7c8bd8fac1aa0d069639bf1b695dd64039bdbc6f Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Mon, 14 Jul 2025 21:54:57 +0200
Subject: [PATCH 085/181] dvdauthor: fix build with gettext 0.25

---
 pkgs/by-name/dv/dvdauthor/gettext-0.25.patch | 14 ++++++++++++++
 pkgs/by-name/dv/dvdauthor/package.nix        |  1 +
 2 files changed, 15 insertions(+)
 create mode 100644 pkgs/by-name/dv/dvdauthor/gettext-0.25.patch

diff --git a/pkgs/by-name/dv/dvdauthor/gettext-0.25.patch b/pkgs/by-name/dv/dvdauthor/gettext-0.25.patch
new file mode 100644
index 000000000000..9503b6157f96
--- /dev/null
+++ b/pkgs/by-name/dv/dvdauthor/gettext-0.25.patch
@@ -0,0 +1,14 @@
+diff --git a/configure.ac b/configure.ac
+index f4b270f..17e102f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1,5 +1,9 @@
+ AC_INIT(DVDAuthor,0.7.2,dvdauthor-users@lists.sourceforge.net)
+ 
++AC_CONFIG_MACRO_DIRS([m4])
++AM_GNU_GETTEXT_VERSION([0.25])
++AM_GNU_GETTEXT([external])
++
+ AC_CONFIG_HEADERS(src/config.h)
+ AC_CONFIG_AUX_DIR(autotools)
+ 
diff --git a/pkgs/by-name/dv/dvdauthor/package.nix b/pkgs/by-name/dv/dvdauthor/package.nix
index fd46701f54f0..099670aa2eec 100644
--- a/pkgs/by-name/dv/dvdauthor/package.nix
+++ b/pkgs/by-name/dv/dvdauthor/package.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
       url = "https://github.com/ldo/dvdauthor/commit/45705ece5ec5d7d6b9ab3e7a68194796a398e855.patch?full_index=1";
       hash = "sha256-tykCr2Axc1qhUvjlGyXQ6X+HwzuFTm5Va2gjGlOlSH0=";
     })
+    ./gettext-0.25.patch
   ];
 
   buildInputs = [

From d0e7d40653d82f95c2fba033441febcc37562c89 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 20:51:34 +0000
Subject: [PATCH 086/181] circt: 1.124.0 -> 1.125.0

---
 pkgs/by-name/ci/circt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ci/circt/package.nix b/pkgs/by-name/ci/circt/package.nix
index ea2ca8e1cb4f..282079be6889 100644
--- a/pkgs/by-name/ci/circt/package.nix
+++ b/pkgs/by-name/ci/circt/package.nix
@@ -19,12 +19,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.124.0";
+  version = "1.125.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-IoS7mhQLiaVlqyosqOOaoGKBkS5WuQHRJK9v+FonCxc=";
+    hash = "sha256-bpQvBUSYpmv6bmgXSCz9pfGgFxlGVFFDfaSkvk7481E=";
     fetchSubmodules = true;
   };
 

From a0bfa8d84b256c402a262c75ef300e2086b96965 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 20:59:48 +0000
Subject: [PATCH 087/181] museum: 1.1.53 -> 1.1.57

---
 pkgs/by-name/mu/museum/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mu/museum/package.nix b/pkgs/by-name/mu/museum/package.nix
index 4939b5d66195..0be17c7a2aff 100644
--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@@ -9,14 +9,14 @@
 
 buildGoModule rec {
   pname = "museum";
-  version = "1.1.53";
+  version = "1.1.57";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     rev = "photos-v${version}";
-    hash = "sha256-lgxgtxRV4jRnOwlgX1jY6CrgVF0pSvoW5fVEU3L0jMY=";
+    hash = "sha256-801wTTxruhZc18+TAPSYrBRtCPNZXwSKs2Hkvc/6BjM=";
   };
 
   vendorHash = "sha256-px4pMqeH73Fe06va4+n6hklIUDMbPmAQNKKRIhwv6ec=";

From cc7944b57a16a331c906fcb132fcae6ab21def90 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <fabian@affolter-engineering.ch>
Date: Mon, 14 Jul 2025 23:24:24 +0200
Subject: [PATCH 088/181] python312Packages.tencentcloud-sdk-python: 3.0.1421
 -> 3.0.1423

Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/refs/tags/3.0.1421...refs/tags/3.0.1423

Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.0.1423/CHANGELOG.md
---
 .../python-modules/tencentcloud-sdk-python/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index fd93658c84ca..329a2d1707f8 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1421";
+  version = "3.0.1423";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-jUFi0KMj22PuCHQlVKV/yqWFam3/WfMZxcpCr2St9N8=";
+    hash = "sha256-HITx60SRPAXKdVCl3jMq+AknGl5Su6S0whWuPOTRIMU=";
   };
 
   build-system = [ setuptools ];

From 24f92176fbfc68803657904c70a63340a0343a57 Mon Sep 17 00:00:00 2001
From: matthewcroughan <matt@croughan.sh>
Date: Mon, 14 Jul 2025 22:26:58 +0100
Subject: [PATCH 089/181] nixos/kryoflux: init

---
 nixos/modules/hardware/kryoflux.nix | 33 +++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 nixos/modules/hardware/kryoflux.nix

diff --git a/nixos/modules/hardware/kryoflux.nix b/nixos/modules/hardware/kryoflux.nix
new file mode 100644
index 000000000000..fc46f2d0bbf4
--- /dev/null
+++ b/nixos/modules/hardware/kryoflux.nix
@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.kryoflux;
+
+in
+{
+  options.programs.kryoflux = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enables kryoflux udev rules, ensures 'floppy' group exists. This is a
+        prerequisite to using devices supported by kryoflux without being root,
+        since kryoflux device descriptors will be owned by floppy through udev.
+      '';
+    };
+    package = lib.mkPackageOption pkgs "kryoflux" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.udev.packages = [ cfg.package ];
+    environment.systemPackages = [ cfg.package ];
+    users.groups.floppy = { };
+  };
+
+  meta.maintainers = with lib.maintainers; [ matthewcroughan ];
+}

From 4a437e33721b6e8ae2d00d7bb37cee55bf5bbf96 Mon Sep 17 00:00:00 2001
From: matthewcroughan <matt@croughan.sh>
Date: Mon, 14 Jul 2025 22:27:15 +0100
Subject: [PATCH 090/181] kryoflux: init at 3.50

Co-authored-by: bloxx12 <charlie@charlieroot.dev>
---
 pkgs/by-name/kr/kryoflux/package.nix | 54 ++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 pkgs/by-name/kr/kryoflux/package.nix

diff --git a/pkgs/by-name/kr/kryoflux/package.nix b/pkgs/by-name/kr/kryoflux/package.nix
new file mode 100644
index 000000000000..3a6e415feac8
--- /dev/null
+++ b/pkgs/by-name/kr/kryoflux/package.nix
@@ -0,0 +1,54 @@
+{
+  stdenv,
+  lib,
+  autoPatchelfHook,
+  fetchurl,
+  makeWrapper,
+  jre,
+  fmt_9,
+  libusb1,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  name = "kryoflux";
+  version = "3.50";
+  src = fetchurl {
+    url = "https://www.kryoflux.com/download/kryoflux_${finalAttrs.version}_linux_r2.tar.gz";
+    hash = "sha256-qGFXu0FkmCB7cffOqNiOluDUww19MA/UuEVElgmSd3o=";
+  };
+  nativeBuildInputs = [
+    makeWrapper
+    autoPatchelfHook
+  ];
+  buildInputs = [
+    fmt_9
+    libusb1
+  ];
+  dontBuild = true;
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mkdir -p $out/share/java
+    cp -r {docs,testimages,schematics} $out/share
+    cp dtc/kryoflux-ui.jar $out/share/java
+    makeWrapper ${jre}/bin/java $out/bin/kryoflux-ui \
+      --add-flags "-jar $out/share/java/kryoflux-ui.jar" \
+      --set PATH "$out/bin"
+    tar -C $out -xf dtc/${stdenv.hostPlatform.linuxArch}/kryoflux-dtc*.tar.gz \
+      --strip-components=1 \
+      --wildcards '*/bin/*' '*/lib/*' '*/share/*'
+
+    mkdir -p $out/etc/udev/rules.d
+    echo 'ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="03eb", ATTR{idProduct}=="6124", GROUP="floppy", MODE="0660"' > 80-kryoflux.rules
+
+    runHook postInstall
+  '';
+  meta = {
+    description = "Software UI to accompany KryoFlux, the renowned forensic floppy controller";
+    homepage = "https://kryoflux.com";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+    mainProgram = "kryoflux-ui";
+    platforms = with lib.platforms; lib.intersectLists linux (x86_64 ++ aarch64);
+  };
+})

From 49ca7961689a984459491cf97ee416b72f8e68d1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 21:39:20 +0000
Subject: [PATCH 091/181] reindeer: 2025.06.30.00 -> 2025.07.14.00

---
 pkgs/by-name/re/reindeer/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index 05e0671b98d4..3fbd31ab3217 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "2025.06.30.00";
+  version = "2025.07.14.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${version}";
-    hash = "sha256-9TvYewY74ntI8iTo5UOTQ+OA6eJHmA/fUPRW0maZn00=";
+    hash = "sha256-gr5J2qqpn2kaFdM9Q+UvIugg435XTzyWvfRJwresQyE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-yxxh/ikFioEAHpuS/AAIpQClWvQxL/5/UkiSbbKRnBA=";
+  cargoHash = "sha256-QdGqvY0uUdxkDRgowSc35Bk5P2YOM5+MmUUMEt/pmCk=";
 
   nativeBuildInputs = [ pkg-config ];
 

From e74c2dd01028ca87eea332c350ad355ce279a3f6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 21:51:58 +0000
Subject: [PATCH 092/181] terraform-providers.datadog: 3.66.0 -> 3.67.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index b5b4b9e5b15f..acdb5606a42b 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -326,13 +326,13 @@
     "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
   },
   "datadog": {
-    "hash": "sha256-FYgjffK21Z/a7wpke5/Um0f8NiDfs7Xf4l7/f3i41+g=",
+    "hash": "sha256-u+iiWStjO2OFMkQp8Skynb4seTK61ETSKrEP+6o16LA=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v3.66.0",
+    "rev": "v3.67.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-9YkSNGNcdMBLJZSlMTGoDrLZFTeGSTfhX1H8ub77Ebk="
+    "vendorHash": "sha256-fLdJxYuN4p0ZwXUXcN6BtATcwVg9asgdjHg9nOPcxK4="
   },
   "deno": {
     "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",

From e6f8a3f0918f211c723915479835152774ffaf39 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 22:02:29 +0000
Subject: [PATCH 093/181] databricks-cli: 0.258.0 -> 0.259.0

---
 pkgs/by-name/da/databricks-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/da/databricks-cli/package.nix b/pkgs/by-name/da/databricks-cli/package.nix
index 9790889f4512..e676f0e74c2e 100644
--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "0.258.0";
+  version = "0.259.0";
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8JVU0tn0KINBdEE0nS2VQ8v9TUn9h2euPGZELSCbcLA=";
+    hash = "sha256-UzfLtGwiyEnHRn54qAwcqMXag8k8GjpB5BGMYh/93O8=";
   };
 
   # Otherwise these tests fail asserting that the version is 0.0.0-dev

From a55687dab64e76aae5ed3b686788bb2671c31975 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 22:19:58 +0000
Subject: [PATCH 094/181] zola: 0.20.0 -> 0.21.0

---
 pkgs/by-name/zo/zola/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/zo/zola/package.nix b/pkgs/by-name/zo/zola/package.nix
index 2d59b4a35f00..894f00b55d8a 100644
--- a/pkgs/by-name/zo/zola/package.nix
+++ b/pkgs/by-name/zo/zola/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zola";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "getzola";
     repo = "zola";
     rev = "v${version}";
-    hash = "sha256-pk7xlNgYybKHm7Zn6cbO1CMUOAKVtX1uxq+6vl48FZk=";
+    hash = "sha256-+/0MhKKDSbOEa5btAZyaS3bQPeGJuski/07I4Q9v9cg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3Po9PA5XJeiwkMaq/8glfaC1E7QmSeuR81BwOyMznOM=";
+  cargoHash = "sha256-K2wdq61FVVG9wJF+UcRZyZ2YSEw3iavboAGkzCcTGkU=";
 
   nativeBuildInputs = [
     pkg-config

From 366226945d8133dfed07c9074c597b1bbced1e59 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 23:11:37 +0000
Subject: [PATCH 095/181] seaweedfs: 3.92 -> 3.94

---
 pkgs/by-name/se/seaweedfs/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix
index 4fe69579cd36..1e3ced96b2a8 100644
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "3.92";
+  version = "3.94";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     rev = version;
-    hash = "sha256-In4LVN5Um7ettxDFuT2MFuU9kx50PXBpd5t5qp/2lzk=";
+    hash = "sha256-d8N9py3khwjg/tRyKUfImLy1CwtjoDvWzQB6F+tM5kQ=";
   };
 
-  vendorHash = "sha256-gTfoC5yHOSRSTsVXKrPx3Jxwh3IUmwjr9ynR02zYduA=";
+  vendorHash = "sha256-WURNRNjUylLsf3+AMfb48VHbqfiPIT0lPmLfNjWphSU=";
 
   subPackages = [ "weed" ];
 

From 10ccaad5f06aada80ab3696e881284913adfdf62 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 23:38:11 +0000
Subject: [PATCH 096/181] naabu: 2.3.4 -> 2.3.5

---
 pkgs/by-name/na/naabu/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/na/naabu/package.nix b/pkgs/by-name/na/naabu/package.nix
index 1255a198b1d3..a74a2ad81fe0 100644
--- a/pkgs/by-name/na/naabu/package.nix
+++ b/pkgs/by-name/na/naabu/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "naabu";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "naabu";
     tag = "v${version}";
-    hash = "sha256-Xri3kdpK1oPb2doL/x7PkZQBtFugesbNX3GGc/w3GY8=";
+    hash = "sha256-UHjWO/uCfUF6xylfYLbwiMwpNwZvlNoVRzRhRFxfqck=";
   };
 
-  vendorHash = "sha256-HpkFUHD3B09nxGK75zELTsjr4wXivY2o/DCjYSDepRI=";
+  vendorHash = "sha256-wl0BqZXd7NRNBY3SCLOwfwa3e91ar5JX6lxtkQChXHM=";
 
   buildInputs = [ libpcap ];
 

From 46f125202037eafd42c1b9779e55cb3f0260e739 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Tue, 15 Jul 2025 00:02:53 +0800
Subject: [PATCH 097/181] xfce.xfce4-screensaver: 4.18.4 -> 4.20.0

https://gitlab.xfce.org/apps/xfce4-screensaver/-/compare/xfce4-screensaver-4.18.4...xfce4-screensaver-4.20.0
---
 .../xfce4-screensaver/default.nix             | 58 ++++++++++++++-----
 1 file changed, 42 insertions(+), 16 deletions(-)

diff --git a/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix b/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
index 78690280af4f..abda11fd84cf 100644
--- a/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
@@ -1,6 +1,15 @@
 {
-  mkXfceDerivation,
-  gobject-introspection,
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  docbook_xml_dtd_412,
+  docbook-xsl-ns,
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
+  wrapGAppsHook3,
+  xmlto,
   dbus-glib,
   garcon,
   glib,
@@ -17,22 +26,37 @@
   systemd,
   xfconf,
   xfdesktop,
-  lib,
+  gitUpdater,
 }:
 
 let
   # For xfce4-screensaver-configure
   pythonEnv = python3.withPackages (pp: [ pp.pygobject3 ]);
 in
-mkXfceDerivation {
-  category = "apps";
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-screensaver";
-  version = "4.18.4";
+  version = "4.20.0";
 
-  sha256 = "sha256-vkxkryi7JQg1L/JdWnO9qmW6Zx6xP5Urq4kXMe7Iiyc=";
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "apps";
+    repo = "xfce4-screensaver";
+    tag = "xfce4-screensaver-${finalAttrs.version}";
+    hash = "sha256-Pt7Rl+WlR2D4KC6GTXjQhs3yirrUgUG5XkKXnyaJZbo=";
+  };
+
+  strictDeps = true;
 
   nativeBuildInputs = [
-    gobject-introspection
+    docbook_xml_dtd_412
+    docbook-xsl-ns
+    gettext
+    glib # glib-compile-resources
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook3
+    xmlto
   ];
 
   buildInputs = [
@@ -53,18 +77,20 @@ mkXfceDerivation {
     xfconf
   ];
 
-  configureFlags = [ "--without-console-kit" ];
-
-  makeFlags = [ "DBUS_SESSION_SERVICE_DIR=$(out)/etc" ];
-
   preFixup = ''
     # For default wallpaper.
     gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${xfdesktop}/share")
   '';
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "xfce4-screensaver-"; };
+
+  meta = {
+    homepage = "https://gitlab.xfce.org/apps/xfce4-screensaver";
     description = "Screensaver for Xfce";
-    maintainers = with maintainers; [ symphorien ];
-    teams = [ teams.xfce ];
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "xfce4-screensaver";
+    maintainers = with lib.maintainers; [ symphorien ];
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})

From 547e76f8ebbec0d9358e927f023a3195be89e286 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 14 Jul 2025 17:17:00 -0700
Subject: [PATCH 098/181] pubs: depend on standard-pipes

Otherwise running pubs fails with

    error: No module named 'pipes'
---
 pkgs/by-name/pu/pubs/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pu/pubs/package.nix b/pkgs/by-name/pu/pubs/package.nix
index 0aa4e6b47430..baa7fceab427 100644
--- a/pkgs/by-name/pu/pubs/package.nix
+++ b/pkgs/by-name/pu/pubs/package.nix
@@ -30,11 +30,11 @@ python3.pkgs.buildPythonApplication rec {
     })
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [
     setuptools
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     argcomplete
     beautifulsoup4
     bibtexparser
@@ -44,6 +44,7 @@ python3.pkgs.buildPythonApplication rec {
     pyyaml
     requests
     six
+    standard-pipes # https://github.com/pubs/pubs/issues/282
   ];
 
   nativeCheckInputs = with python3.pkgs; [

From 32f4ffd3787b9cd324bb9ce00af649d0015368f2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 01:06:09 +0000
Subject: [PATCH 099/181] automatic-timezoned: 2.0.80 -> 2.0.82

---
 pkgs/by-name/au/automatic-timezoned/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/au/automatic-timezoned/package.nix b/pkgs/by-name/au/automatic-timezoned/package.nix
index 352d04af20c2..df2e3d35f524 100644
--- a/pkgs/by-name/au/automatic-timezoned/package.nix
+++ b/pkgs/by-name/au/automatic-timezoned/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "2.0.80";
+  version = "2.0.82";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = "automatic-timezoned";
     rev = "v${version}";
-    sha256 = "sha256-5JrIcdNgi68g+5zF0y4YeNboFl6SS9QvZEsmcMh35gE=";
+    sha256 = "sha256-qUpPeuFfdj0rIygSo9C7LGdFi7l1erfz4XYTuxLgL7M=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-IX3lSupcKn1ET4Q7tLpUBhQ+wfmfUyM/onlTwW7wloU=";
+  cargoHash = "sha256-7QkrKeF1WY1ewe4GsdpZ/Na7hd9AGq+ixepeB473bDQ=";
 
   meta = {
     description = "Automatically update system timezone based on location";

From 82f2e267b6b98f131e73a7bb952aa0deb045801c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 02:01:16 +0000
Subject: [PATCH 100/181] ipget: 0.11.2 -> 0.11.3

---
 pkgs/by-name/ip/ipget/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ip/ipget/package.nix b/pkgs/by-name/ip/ipget/package.nix
index 1439acbd300b..1a91414abf21 100644
--- a/pkgs/by-name/ip/ipget/package.nix
+++ b/pkgs/by-name/ip/ipget/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "ipget";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "ipfs";
     repo = "ipget";
     rev = "v${version}";
-    hash = "sha256-5nddlFaQCGJzzH39DqqBNtdc8IFNSLfDv7yKgA4dR6Y=";
+    hash = "sha256-Q9rgbfPAdAulNuDQ1bXM08aK0IEerbsKqjK8aMnBwcM=";
   };
 
-  vendorHash = "sha256-miwOJcaSfa4eUIwAt+ewMELzS3Ib023pzFunVSoyBkM=";
+  vendorHash = "sha256-2boqKf/7y/71ThNodUuZXaRHZadx+TU0d6swHHN1VyM=";
 
   postPatch = ''
     # main module (github.com/ipfs/ipget) does not contain package github.com/ipfs/ipget/sharness/dependencies

From 5fd3562b76d033ef94de89e0a017cfa530e28646 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 02:02:53 +0000
Subject: [PATCH 101/181] saga: 9.8.1 -> 9.9.0

---
 pkgs/by-name/sa/saga/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sa/saga/package.nix b/pkgs/by-name/sa/saga/package.nix
index 5dcfabab65dd..1c823d7bbafe 100644
--- a/pkgs/by-name/sa/saga/package.nix
+++ b/pkgs/by-name/sa/saga/package.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "saga";
-  version = "9.8.1";
+  version = "9.9.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/saga-gis/saga-${version}.tar.gz";
-    hash = "sha256-NCNeTxR4eWMJ3OHcBEQ2MZky9XiEExPscGhriDvXYf8=";
+    hash = "sha256-xS9h8QGm6PH8rx0qXmvolDpH9fy8ma7HlBVbQo5pX4Q=";
   };
 
   sourceRoot = "saga-${version}/saga-gis";

From 7c035f82fdd5b28be24b55a5e19faaff3c1565aa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 03:10:20 +0000
Subject: [PATCH 102/181] nwg-drawer: 0.7.1 -> 0.7.3

---
 pkgs/by-name/nw/nwg-drawer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nw/nwg-drawer/package.nix b/pkgs/by-name/nw/nwg-drawer/package.nix
index e31155c69989..6014dd10e6ee 100644
--- a/pkgs/by-name/nw/nwg-drawer/package.nix
+++ b/pkgs/by-name/nw/nwg-drawer/package.nix
@@ -13,13 +13,13 @@
 
 let
   pname = "nwg-drawer";
-  version = "0.7.1";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-drawer";
     rev = "v${version}";
-    hash = "sha256-vORjD6nMy0h2Udo6Sy6aD0td+sLBUusDRiuT6jssais=";
+    hash = "sha256-5e0NQ3A8KXnXAYma42JPvS6RLocFOTe76tPSFdg97NM=";
   };
 
   vendorHash = "sha256-ftE8u0m1KGyEdLVbmpFKCeuDFnBcY3AyqmWNGPST27k=";

From e080d80e9822ae3b65e4f75c630174b0f4a1adcc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 03:21:37 +0000
Subject: [PATCH 103/181] sigtop: 0.20.0 -> 0.21.0

---
 pkgs/by-name/si/sigtop/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/si/sigtop/package.nix b/pkgs/by-name/si/sigtop/package.nix
index c9e41c1c6a9f..dfdc42eca1d6 100644
--- a/pkgs/by-name/si/sigtop/package.nix
+++ b/pkgs/by-name/si/sigtop/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   name = "sigtop";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "tbvdm";
     repo = "sigtop";
     rev = "v${version}";
-    sha256 = "sha256-1ZZBsKkgBnkNtYdlarbi+6DtCWBRvgcsoH0v4VNjKh0=";
+    sha256 = "sha256-xW+fwyXNM11KoU3cCfPzAjBsz6yQlTHkmDWitoq1p1k=";
   };
 
-  vendorHash = "sha256-EWppsnZ/Ch7JjltkejOYKepZUfKNZY9+F7VbzjNCYNU=";
+  vendorHash = "sha256-V47Z96ZoIgDQbGocpAJ/4oiK6uJXY8XTndsAifETbCc=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libsecret ];

From 102ae404325bbefbaca9712d92d1b255a2329c7b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 04:26:39 +0000
Subject: [PATCH 104/181] byedpi: 0.17.1 -> 0.17.2

---
 pkgs/by-name/by/byedpi/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/by/byedpi/package.nix b/pkgs/by-name/by/byedpi/package.nix
index 5358b379ef88..c3ed44f2a0e0 100644
--- a/pkgs/by-name/by/byedpi/package.nix
+++ b/pkgs/by-name/by/byedpi/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "byedpi";
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchFromGitHub {
     owner = "hufrea";
     repo = "byedpi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-an0UmsAZw5DJMuM4WpAWBVVN0ZVBpXhn0cbZ0ZbfBjo=";
+    hash = "sha256-XeUcf8w6b0vZQwttopRnmg5320oF/Z+gHWcWMQ6kAkc=";
   };
 
   installPhase = ''

From a8e4187b10d41acf3f80eaf3c050721a72e70554 Mon Sep 17 00:00:00 2001
From: Jeff Huffman <tejing@tejing.com>
Date: Tue, 15 Jul 2025 00:38:40 -0400
Subject: [PATCH 105/181] rxvt-unicode: cherry-pick upstream bug fix affecting
 tmux

---
 .../terminal-emulators/rxvt-unicode/default.nix             | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
index ee3b038e7970..e732da52817c 100644
--- a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
@@ -113,6 +113,12 @@ stdenv.mkDerivation {
     )
     ++ [
       ./patches/256-color-resources.patch
+      (fetchPatchFromAUR {
+        name = "7-bit-queries.patch";
+        package = "rxvt-unicode-truecolor-wide-glyphs";
+        rev = "61ed186890a2bf37585e4704a095be61e6504ac6";
+        sha256 = "1xpv6g3bhxq5gp40k3rp8yjp4xrw7dr2g9sfkdmj0gi3rr0myx46";
+      })
     ]
     ++ lib.optional (perlSupport && lib.versionAtLeast perl.version "5.38") (fetchpatch {
       name = "perl538-locale-c.patch";

From 91fe8c6051f436718132dbe9d3070c91f22c9e5e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 05:45:11 +0000
Subject: [PATCH 106/181] virtnbdbackup: 2.29 -> 2.30

---
 pkgs/by-name/vi/virtnbdbackup/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vi/virtnbdbackup/package.nix b/pkgs/by-name/vi/virtnbdbackup/package.nix
index ae64b13ece2c..9b69133d1102 100644
--- a/pkgs/by-name/vi/virtnbdbackup/package.nix
+++ b/pkgs/by-name/vi/virtnbdbackup/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "virtnbdbackup";
-  version = "2.29";
+  version = "2.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "abbbi";
     repo = "virtnbdbackup";
     tag = "v${version}";
-    hash = "sha256-KIxRYD+GogYpZnUaBdhFd52sO51Two2vzY4LYRJRCto=";
+    hash = "sha256-4WnMY7eEEJD2l+GoQkKbVXSETh7+PEckrGspZhW2nMk=";
   };
 
   build-system = with python3Packages; [

From 1f267934d9bf65e274a3d5ed0390f0a4bf845a3c Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Tue, 15 Jul 2025 08:01:26 +0200
Subject: [PATCH 107/181] clisp: fix broken symlinks

---
 pkgs/development/interpreters/clisp/default.nix | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/interpreters/clisp/default.nix b/pkgs/development/interpreters/clisp/default.nix
index e32bbbdf24d2..601aa9db8868 100644
--- a/pkgs/development/interpreters/clisp/default.nix
+++ b/pkgs/development/interpreters/clisp/default.nix
@@ -130,10 +130,16 @@ stdenv.mkDerivation {
 
   doCheck = true;
 
-  postInstall = lib.optionalString (withModules != [ ]) (
-    ''bash ./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full''
-    + lib.concatMapStrings (x: " " + x) withModules
-  );
+  postInstall = lib.optionalString (withModules != [ ]) ''
+    bash ./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full \
+      ${lib.concatMapStrings (x: " " + x) withModules}
+
+    find "$out"/lib/clisp*/full -type l -name "*.o" | while read -r symlink; do
+      if [[ "$(readlink "$symlink")" =~ (.*\/builddir\/)(.*) ]]; then
+        ln -sf "../''${BASH_REMATCH[2]}" "$symlink"
+      fi
+    done
+  '';
 
   env.NIX_CFLAGS_COMPILE = "-O0 -falign-functions=${
     if stdenv.hostPlatform.is64bit then "8" else "4"

From 685af88d4c24fb537330f517bb83c75002494302 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 06:41:37 +0000
Subject: [PATCH 108/181] python3Packages.aiolifx: 1.2.0 -> 1.2.1

---
 pkgs/development/python-modules/aiolifx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiolifx/default.nix b/pkgs/development/python-modules/aiolifx/default.nix
index 266f9b072411..3818ad68ef14 100644
--- a/pkgs/development/python-modules/aiolifx/default.nix
+++ b/pkgs/development/python-modules/aiolifx/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "aiolifx";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pAuQLeqLVkVEW/iByXk9brfEm79rR4ZL+ncUA0MxOnM=";
+    hash = "sha256-h82KPrHcWUUrQFyMy3fY6BmQFA5a4DFJdhJ6zRnKMsc=";
   };
 
   build-system = [ setuptools ];

From 30df3355adfcce5ebd8fc0cd90817131658d61f0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 06:47:22 +0000
Subject: [PATCH 109/181] ddns-go: 6.11.2 -> 6.11.3

---
 pkgs/by-name/dd/ddns-go/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/dd/ddns-go/package.nix b/pkgs/by-name/dd/ddns-go/package.nix
index 099b1074859b..6599cf0a62f3 100644
--- a/pkgs/by-name/dd/ddns-go/package.nix
+++ b/pkgs/by-name/dd/ddns-go/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "ddns-go";
-  version = "6.11.2";
+  version = "6.11.3";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = "ddns-go";
     rev = "v${version}";
-    hash = "sha256-dzHNv7zfn1jU3F7nyQP/mP3icGCoeR3C7rerE3oYoTw=";
+    hash = "sha256-65j1hZqnpSRpDmkzjb8ciJoVGHbV2xuOwBLcsW65eOE=";
   };
 
   vendorHash = "sha256-oHiREhvqu14z5StjzD4PgtFasYQ0X435eMCRMiWUzg0=";

From 381be8e990e1f275f0a848aed2c4c492825518fc Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 2 Jul 2025 15:47:08 +0200
Subject: [PATCH 110/181] nixos/spamassassin: set home for spamd user

This should hopefully fix errors like the following:

	plugin: eval failed: bayes: (in learn) locker: safe_lock: cannot create tmp lockfile /var/empty/.spamassassin/bayes.lock.atuin.qyliss.net.398779 for /var/empty/.spamassassin/bayes.lock: No such file or directory
---
 nixos/modules/services/mail/spamassassin.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/mail/spamassassin.nix b/nixos/modules/services/mail/spamassassin.nix
index 5acbc3470820..33c34dafc404 100644
--- a/nixos/modules/services/mail/spamassassin.nix
+++ b/nixos/modules/services/mail/spamassassin.nix
@@ -121,6 +121,7 @@ in
 
     users.users.spamd = {
       description = "Spam Assassin Daemon";
+      home = "/var/lib/spamassassin";
       uid = config.ids.uids.spamd;
       group = "spamd";
     };

From 492046d268c2245e689bdc034f2228ab42c1c515 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 07:01:44 +0000
Subject: [PATCH 111/181] openasar: 0-unstable-2025-01-20 ->
 0-unstable-2025-07-14

---
 pkgs/by-name/op/openasar/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/openasar/package.nix b/pkgs/by-name/op/openasar/package.nix
index d37f6feb246a..d17c378fabb2 100644
--- a/pkgs/by-name/op/openasar/package.nix
+++ b/pkgs/by-name/op/openasar/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openasar";
-  version = "0-unstable-2025-01-20";
+  version = "0-unstable-2025-07-14";
 
   src = fetchFromGitHub {
     owner = "GooseMod";
     repo = "OpenAsar";
-    rev = "e88eebf440866a06f3eca3b4fe2a8cc07818ee61";
-    hash = "sha256-SejlIm9AIK09grP8j5h0O8DxIv85zGssr170xskGx2I=";
+    rev = "e6991e30910b4019bff1ad6e1934534ad546831e";
+    hash = "sha256-COz3X2sYSYnd436pOjiHgpYxQbn6hRCo8AefPzv5hTs=";
   };
 
   postPatch = ''

From dd0069ff43978f4dd69220826c290f4fdda4a5b5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 03:47:54 +0000
Subject: [PATCH 112/181] linuxKernel.kernels.linux_zen: 6.15.4 -> 6.15.6

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 8e04958ba462..49522576d3d3 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,9 +16,9 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.15.4"; # zen
-      suffix = "zen2"; # zen
-      sha256 = "0mf83mwpsa2zm1crc3gqbgmsrpsdxi52r1yvrknrcvi003m1y55y"; # zen
+      version = "6.15.6"; # zen
+      suffix = "zen1"; # zen
+      sha256 = "11nfmnyyqph9d0hihss9dg96z7dgiqk3p16c2i2li6q52walbj6g"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx

From 30ad5fbf9da82a598dd69529b4fbdc599c0bc47c Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Tue, 15 Jul 2025 09:07:40 +0200
Subject: [PATCH 113/181] msmtp: migrate to by-name

---
 .../ms}/msmtp/msmtpq-remove-binary-check.patch                | 0
 .../ms}/msmtp/msmtpq-systemd-logging.patch                    | 0
 .../msmtp/default.nix => by-name/ms/msmtp/package.nix}        | 4 ++--
 pkgs/top-level/all-packages.nix                               | 4 ----
 4 files changed, 2 insertions(+), 6 deletions(-)
 rename pkgs/{applications/networking => by-name/ms}/msmtp/msmtpq-remove-binary-check.patch (100%)
 rename pkgs/{applications/networking => by-name/ms}/msmtp/msmtpq-systemd-logging.patch (100%)
 rename pkgs/{applications/networking/msmtp/default.nix => by-name/ms/msmtp/package.nix} (98%)

diff --git a/pkgs/applications/networking/msmtp/msmtpq-remove-binary-check.patch b/pkgs/by-name/ms/msmtp/msmtpq-remove-binary-check.patch
similarity index 100%
rename from pkgs/applications/networking/msmtp/msmtpq-remove-binary-check.patch
rename to pkgs/by-name/ms/msmtp/msmtpq-remove-binary-check.patch
diff --git a/pkgs/applications/networking/msmtp/msmtpq-systemd-logging.patch b/pkgs/by-name/ms/msmtp/msmtpq-systemd-logging.patch
similarity index 100%
rename from pkgs/applications/networking/msmtp/msmtpq-systemd-logging.patch
rename to pkgs/by-name/ms/msmtp/msmtpq-systemd-logging.patch
diff --git a/pkgs/applications/networking/msmtp/default.nix b/pkgs/by-name/ms/msmtp/package.nix
similarity index 98%
rename from pkgs/applications/networking/msmtp/default.nix
rename to pkgs/by-name/ms/msmtp/package.nix
index 60946106d0dd..e2de1f2fe68d 100644
--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/by-name/ms/msmtp/package.nix
@@ -4,7 +4,7 @@
   symlinkJoin,
   lib,
   fetchFromGitHub,
-  autoreconfHook,
+  autoreconfHook269,
   pkg-config,
   bash,
   coreutils,
@@ -62,7 +62,7 @@ let
     ] ++ optionals withKeyring [ libsecret ];
 
     nativeBuildInputs = [
-      autoreconfHook
+      autoreconfHook269
       pkg-config
       texinfo
     ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1f6cde488533..2d89e07134d2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13308,10 +13308,6 @@ with pkgs;
 
   taxi-cli = with python3Packages; toPythonApplication taxi;
 
-  msmtp = callPackage ../applications/networking/msmtp {
-    autoreconfHook = buildPackages.autoreconfHook269;
-  };
-
   imapfilter = callPackage ../applications/networking/mailreaders/imapfilter.nix {
     lua = lua5;
   };

From f1dffb0363c6867fe1982eab3579b0b5e3b8f25c Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Tue, 15 Jul 2025 09:10:09 +0200
Subject: [PATCH 114/181] msmtp: 1.8.26 -> 1.8.30

Upgrade msmtp from 1.8.26 to 1.8.30. The update requires a couple of
additional changes:

  - msmtp has gained a dependency on libnotify via notify-send.

  - msmtp has gained a dependency on GNU sed.

  - msmtp does not configure anymore with autoreconf 2.69. This is fixed
    by unpinning the version.

  - The patch for improved logging via systemd does not apply anymore
    and has been update.
---
 .../ms/msmtp/msmtpq-systemd-logging.patch     | 20 +++++-----
 pkgs/by-name/ms/msmtp/package.nix             | 37 +++++++++++++------
 2 files changed, 35 insertions(+), 22 deletions(-)

diff --git a/pkgs/by-name/ms/msmtp/msmtpq-systemd-logging.patch b/pkgs/by-name/ms/msmtp/msmtpq-systemd-logging.patch
index a9db3e645808..55f386bb3190 100644
--- a/pkgs/by-name/ms/msmtp/msmtpq-systemd-logging.patch
+++ b/pkgs/by-name/ms/msmtp/msmtpq-systemd-logging.patch
@@ -1,17 +1,17 @@
 diff --git a/scripts/msmtpq/msmtpq b/scripts/msmtpq/msmtpq
-index bcb384e..dbaf1b5 100755
+index 28d0754..3eaac58 100755
 --- a/scripts/msmtpq/msmtpq
 +++ b/scripts/msmtpq/msmtpq
-@@ -92,6 +92,8 @@ if [ ! -v MSMTPQ_LOG ] ; then
-   fi
+@@ -182,6 +182,8 @@ if [ -n "$MSMTPQ_LOG" ] ; then
+   unset msmptq_log_dir
  fi
- [ -d "$(dirname "$MSMTPQ_LOG")" ] || mkdir -p "$(dirname "$MSMTPQ_LOG")"
-+
-+JOURNAL=@journal@
- ## ======================================================================================
  
- ## msmtpq can use the following environment variables :
-@@ -144,6 +146,7 @@ on_exit() {                          # unlock the queue on exit if the lock was
++JOURNAL=@journal@
++
+ umask 077                            # set secure permissions on created directories and files
+ 
+ declare -i CNT                       # a count of mail(s) currently in the queue
+@@ -214,6 +216,7 @@ on_exit() {                          # unlock the queue on exit if the lock was
  ## display msg to user, as well
  ##
  log() {
@@ -19,7 +19,7 @@ index bcb384e..dbaf1b5 100755
    local ARG RC PFX
    PFX="$('date' +'%Y %d %b %H:%M:%S')"
                                       # time stamp prefix - "2008 13 Mar 03:59:45 "
-@@ -161,10 +164,19 @@ log() {
+@@ -233,10 +236,19 @@ log() {
      done
    fi
  
diff --git a/pkgs/by-name/ms/msmtp/package.nix b/pkgs/by-name/ms/msmtp/package.nix
index e2de1f2fe68d..c801fa83ee9b 100644
--- a/pkgs/by-name/ms/msmtp/package.nix
+++ b/pkgs/by-name/ms/msmtp/package.nix
@@ -4,11 +4,12 @@
   symlinkJoin,
   lib,
   fetchFromGitHub,
-  autoreconfHook269,
+  autoreconfHook,
   pkg-config,
   bash,
   coreutils,
   gnugrep,
+  gnused,
   gnutls,
   gsasl,
   libidn2,
@@ -20,6 +21,8 @@
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
   systemd,
   withScripts ? true,
+  withLibnotify ? true,
+  libnotify,
   gitUpdater,
   binlore,
   msmtp,
@@ -28,13 +31,13 @@
 let
   inherit (lib) getBin getExe optionals;
 
-  version = "1.8.26";
+  version = "1.8.30";
 
   src = fetchFromGitHub {
     owner = "marlam";
     repo = "msmtp";
     rev = "msmtp-${version}";
-    hash = "sha256-MV3fzjjyr7qZw/BbKgsSObX+cxDDivI+0ZlulrPFiWM=";
+    hash = "sha256-aM2qId08zvT9LbncCQYHsklbvHVtcZJgr91JTjwpQ/0=";
   };
 
   meta = with lib; {
@@ -62,7 +65,7 @@ let
     ] ++ optionals withKeyring [ libsecret ];
 
     nativeBuildInputs = [
-      autoreconfHook269
+      autoreconfHook
       pkg-config
       texinfo
     ];
@@ -112,13 +115,17 @@ let
       msmtpq = {
         scripts = [ "bin/msmtpq" ];
         interpreter = getExe bash;
-        inputs = [
-          binaries
-          coreutils
-          gnugrep
-          netcat-gnu
-          which
-        ] ++ optionals withSystemd [ systemd ];
+        inputs =
+          [
+            binaries
+            coreutils
+            gnugrep
+            gnused
+            netcat-gnu
+            which
+          ]
+          ++ optionals withSystemd [ systemd ]
+          ++ optionals withLibnotify [ libnotify ];
         execer =
           [
             "cannot:${getBin binaries}/bin/msmtp"
@@ -126,9 +133,15 @@ let
           ]
           ++ optionals withSystemd [
             "cannot:${getBin systemd}/bin/systemd-cat"
+          ]
+          ++ optionals withLibnotify [
+            "cannot:${getBin libnotify}/bin/notify-send"
           ];
         fix."$MSMTP" = [ "msmtp" ];
-        fake.external = [ "ping" ] ++ optionals (!withSystemd) [ "systemd-cat" ];
+        fake.external =
+          [ "ping" ]
+          ++ optionals (!withSystemd) [ "systemd-cat" ]
+          ++ optionals (!withLibnotify) [ "notify-send" ];
         keep.source = [ "~/.msmtpqrc" ];
       };
 

From b41ec95d132af9b22d060244c25fe16fb0ecc1c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 08:02:08 +0000
Subject: [PATCH 115/181] sdl_gamecontrollerdb: 0-unstable-2025-07-03 ->
 0-unstable-2025-07-10

---
 pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
index 28ff9cb503ce..e3df4161d946 100644
--- a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
+++ b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sdl_gamecontrollerdb";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-07-10";
 
   src = fetchFromGitHub {
     owner = "mdqinc";
     repo = "SDL_GameControllerDB";
-    rev = "7979e7b29261c11ebce2deabc41ed081b6691398";
-    hash = "sha256-FSA1hsYvMQ49AxWY/sRP1Mx6XthKDVdixEW+JmNNsDU=";
+    rev = "0f63b5ea2932d1af560fcd874b9b8562b5c69403";
+    hash = "sha256-AZkLkSxdNbybf5AJTPHsBd0BQmZ+/1YWg2mSSlUlZTs=";
   };
 
   dontBuild = true;

From 665e869060f916da41053539fba68b6caec63e76 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 08:10:08 +0000
Subject: [PATCH 116/181] python3Packages.kernels: 0.6.2 -> 0.7.0

---
 pkgs/development/python-modules/kernels/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/kernels/default.nix b/pkgs/development/python-modules/kernels/default.nix
index b4fb9cf0308b..4f97afd113e0 100644
--- a/pkgs/development/python-modules/kernels/default.nix
+++ b/pkgs/development/python-modules/kernels/default.nix
@@ -7,14 +7,14 @@
 }:
 buildPythonPackage rec {
   pname = "kernels";
-  version = "0.6.2";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "kernels";
     tag = "v${version}";
-    hash = "sha256-Akd1gbWcWfxkrhdN6NQ8qRDPRFAPuqy7a3bj2Z+BxF4=";
+    hash = "sha256-IbOadtnuRgN54Sg+mFULkkqi6LVlW+ohBgtemz/Pxxc=";
   };
 
   build-system = [

From 3990bc30a30e7dd0cffe6288ab1eca6829ea79da Mon Sep 17 00:00:00 2001
From: sanana <umutinanerdogan@pm.me>
Date: Mon, 14 Jul 2025 20:50:25 +0300
Subject: [PATCH 117/181] limine: 9.4.0 -> 9.5.0

---
 pkgs/by-name/li/limine/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index b93ccaebffc7..25d8afd115be 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -42,14 +42,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "9.4.0";
+  version = "9.5.0";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/limine-bootloader/limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ddQB0wKMhKSnPrJflgsDfyWCzOiFehf/2CijPiVk65U=";
+    hash = "sha256-SWJ5e6/q92UyC0ea8yJAYcFNr5LreJ2qFY7hcunovEM=";
   };
 
   enableParallelBuilding = true;

From 6baed48380f1f5b78ffd767b7694915a0a7d281d Mon Sep 17 00:00:00 2001
From: sanana <umutinanerdogan@pm.me>
Date: Mon, 14 Jul 2025 21:09:54 +0300
Subject: [PATCH 118/181] limine-install: fix profile enumeration

Fixes #425158.
---
 nixos/modules/system/boot/loader/limine/limine-install.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/system/boot/loader/limine/limine-install.py b/nixos/modules/system/boot/loader/limine/limine-install.py
index 1992be83d73a..746cb693409c 100644
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -274,7 +274,7 @@ def install_bootloader() -> None:
     profiles = [('system', get_gens())]
 
     for profile in get_profiles():
-        profiles += (profile, get_gens(profile))
+        profiles += [(profile, get_gens(profile))]
 
     timeout = config('timeout')
     editor_enabled = 'yes' if config('enableEditor') else 'no'

From b03642cd4ec38016d54ef6ba1980e64a35901ea9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 08:25:31 +0000
Subject: [PATCH 119/181] flutter_rust_bridge_codegen: 2.11.0 -> 2.11.1

---
 pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix b/pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix
index b734f677aa80..5106012acd4d 100644
--- a/pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix
+++ b/pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix
@@ -7,18 +7,18 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "flutter_rust_bridge_codegen";
-  version = "2.11.0";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "fzyzcjy";
     repo = "flutter_rust_bridge";
     rev = "v${version}";
-    hash = "sha256-vtdIbrVm9r8PiTYvhz4Ikj4e22jxqgEraH+YHlRS4O4=";
+    hash = "sha256-Us+LwT6tjBcTl2xclVsiLauSlIO8w+PiokpiDB+h1fI=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-TwnibHjMDZ3aj1EDNHd/AO7nNtSnY335P3vU4iyp4SY=";
+  cargoHash = "sha256-pxEwcLiRB95UBfXb+JgS8duEXiZUApH/C8Exus5TkfU=";
   cargoBuildFlags = "--package flutter_rust_bridge_codegen";
   cargoTestFlags = "--package flutter_rust_bridge_codegen";
 

From 98d9c88ab1088e7d08a8385451bbdb231c6daf0c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 08:28:40 +0000
Subject: [PATCH 120/181] ejsonkms: 0.2.5 -> 0.2.7

---
 pkgs/by-name/ej/ejsonkms/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ej/ejsonkms/package.nix b/pkgs/by-name/ej/ejsonkms/package.nix
index 5ad750655827..13a7281cee88 100644
--- a/pkgs/by-name/ej/ejsonkms/package.nix
+++ b/pkgs/by-name/ej/ejsonkms/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "ejsonkms";
-  version = "0.2.5";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "envato";
     repo = "ejsonkms";
     rev = "v${version}";
-    hash = "sha256-EcNvzkZmSASe+0UMixBe8qwZq1JN3zFvppdWu1LM46A=";
+    hash = "sha256-G2rUcAjFSXnkRaQiu3WK5WRwNeQ0vyxj1Ql+vaRUUeM=";
   };
 
-  vendorHash = "sha256-LS+iCTpE7+vXa25CTudNHLPRYSod4ozuErnoYWB9LNU=";
+  vendorHash = "sha256-ulocGcRnkWBLnkoimkxrppO2i9lowFChlMYl0+kVXCo=";
 
   ldflags = [
     "-X main.version=v${version}"

From 1ec0bdfd27aee0a141d05826520bb52fc660c76a Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 15 Jul 2025 09:32:13 +0100
Subject: [PATCH 121/181] rust-analyzer-unwrapped: 2025-07-07 -> 2025-07-14

Changes: https://github.com/rust-lang/rust-analyzer/releases/tag/2025-07-14
---
 pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
index 52d0be28d90f..fbc5a9333530 100644
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
@@ -12,15 +12,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2025-07-07";
+  version = "2025-07-14";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-6letdN1dn5pvUkArddMFxGHsAtprpCGJ98zTr7sAdfY=";
+  cargoHash = "sha256-bYJGlePqgcZ5ixdCJleJS0gjiKtiS1d2XJymhyUknas=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    hash = "sha256-YjyurHKMrUYKjnujSqjpFtHGYFCGr2Xpo1Xc1AYT1+M=";
+    hash = "sha256-EJcdxw3aXfP8Ex1Nm3s0awyH9egQvB2Gu+QEnJn2Sfg=";
   };
 
   cargoBuildFlags = [

From dc66864246446bcf81c786d107ba49c3576ec0f3 Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Tue, 15 Jul 2025 08:37:00 +0000
Subject: [PATCH 122/181] =?UTF-8?q?prometheus:=203.4.2=20=E2=86=92=203.5.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/pr/prometheus/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix
index c36fa8784160..5fd7e2bf8632 100644
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -33,7 +33,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "prometheus";
-  version = "3.4.2";
+  version = "3.5.0";
 
   outputs = [
     "out"
@@ -45,14 +45,14 @@ buildGoModule (finalAttrs: {
     owner = "prometheus";
     repo = "prometheus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/JeT8+I/jNE7O2YT9qfu7RF3xculPyR3rRrFQIG4YV4=";
+    hash = "sha256-QBmtJ+qBIwQzfJ7tx0P9/3kl6UaZou7qp8jrI+Qrcck=";
   };
 
-  vendorHash = "sha256-edR9vvSNexRR8EGEiSCIIYl3ndGckS8XuIWojPrq60U=";
+  vendorHash = "sha256-Svm+rH/cmS9mjiQHVucwKHy6ilw3mgySjRdC3ivw0YE=";
 
   webUiStatic = fetchurl {
     url = "https://github.com/prometheus/prometheus/releases/download/v${finalAttrs.version}/prometheus-web-ui-${finalAttrs.version}.tar.gz";
-    hash = "sha256-3aXP79aeA/qe99sVsJn0nNRggrzFWTmaRO3dBzOR6UU=";
+    hash = "sha256-j+wOQ8m2joXZ3/C6bO8pxroM/hntVLP/QhoWVmdLir4=";
   };
 
   excludedPackages = [

From db1be32524af94224b4c0f397ef988a98237e59a Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Tue, 15 Jul 2025 10:42:28 +0200
Subject: [PATCH 123/181] strongswan: fix build with gettext 0.25

---
 pkgs/by-name/st/strongswan/package.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkgs/by-name/st/strongswan/package.nix b/pkgs/by-name/st/strongswan/package.nix
index 48c8c18b5676..d4ecb9d68689 100644
--- a/pkgs/by-name/st/strongswan/package.nix
+++ b/pkgs/by-name/st/strongswan/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   pkg-config,
   autoreconfHook,
   perl,
@@ -86,6 +87,20 @@ stdenv.mkDerivation rec {
     ./ext_auth-path.patch
     ./firewall_defaults.patch
     ./updown-path.patch
+    # Fixes for gettext 0.25
+    (fetchpatch2 {
+      url = "https://github.com/strongswan/strongswan/commit/7ec0101250bf2ac3da7a576cbb4204fceb2ef10c.patch?full_index=1";
+      excludes = [ "scripts/test.sh" ];
+      hash = "sha256-ATd/oj6/1vrtZdwMs45rA2MGtH2viumyucVj0LZ8Nnc=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/strongswan/strongswan/commit/e8e5e2d4419a686c5a2c064648618ec281089b2e.patch?full_index=1";
+      hash = "sha256-p98LSX8jjsDK/GZTovj/salmQ8T+txEV3vKD+wTUvsM=";
+    })
+    (fetchpatch2 {
+      url = "https://github.com/strongswan/strongswan/commit/2b3a5172d89c513ed28d21bb406c1b4ef0ac787a.patch?full_index=1";
+      hash = "sha256-xqp2Lq4pp3Uu0nVC/fl4E5mpJqCNgyZXP2g/Y2wShhI=";
+    })
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''

From db3d89d2d263c87fa1f592fa83278a74fb36e2fe Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Tue, 15 Jul 2025 11:04:44 +0200
Subject: [PATCH 124/181] markdown-oxide: 0.25.3 -> 0.25.4

Changelog:
https://github.com/Feel-ix-343/markdown-oxide/releases/tag/v0.25.4
Diff:
https://github.com/Feel-ix-343/markdown-oxide/compare/v0.25.3...v0.25.4
---
 pkgs/by-name/ma/markdown-oxide/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/markdown-oxide/package.nix b/pkgs/by-name/ma/markdown-oxide/package.nix
index 981d271bf3f7..18e81ddf599d 100644
--- a/pkgs/by-name/ma/markdown-oxide/package.nix
+++ b/pkgs/by-name/ma/markdown-oxide/package.nix
@@ -5,17 +5,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "markdown-oxide";
-  version = "0.25.3";
+  version = "0.25.4";
 
   src = fetchFromGitHub {
     owner = "Feel-ix-343";
     repo = "markdown-oxide";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LBY7hLen6jhOBsOIl9f5rFVH66FbLbuYgLl1xtzTRQg=";
+    hash = "sha256-wS75Etj6NAMt/wlWB1yLGetM+OsgyeCo0dqHkrjUsQI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-VEYwLTWnFMO6qH9qsO4/oiNeIHgoEZAF+YjeVgFOESQ=";
+  cargoHash = "sha256-W+4WmWfqNuh3kmqE9X6CQ5/kTqMoUqyuIFCRiZa6Kc4=";
 
   meta = {
     description = "Markdown LSP server inspired by Obsidian";

From 060e5a81e8f4d98639d24c7846ef26977b9ade89 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 09:18:08 +0000
Subject: [PATCH 125/181] python3Packages.types-markdown: 3.8.0.20250415 ->
 3.8.0.20250708

---
 pkgs/development/python-modules/types-markdown/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/types-markdown/default.nix b/pkgs/development/python-modules/types-markdown/default.nix
index 410b83ddcef7..0a5073d4cc8a 100644
--- a/pkgs/development/python-modules/types-markdown/default.nix
+++ b/pkgs/development/python-modules/types-markdown/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "types-markdown";
-  version = "3.8.0.20250415";
+  version = "3.8.0.20250708";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_markdown";
     inherit version;
-    hash = "sha256-mKsTWH0Rd3adk+VVhtPclwR991vG43zkB0Zm9d1CEro=";
+    hash = "sha256-KGkCUf6QdX9amc1nHHlQK8LeB67y01/lQRfDsceZgEo=";
   };
 
   build-system = [ setuptools ];

From 2382c89f62ca939688bd9d45e13303477178c349 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 09:25:02 +0000
Subject: [PATCH 126/181] postgres-lsp: 0.8.1 -> 0.9.0

---
 pkgs/by-name/po/postgres-lsp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/po/postgres-lsp/package.nix b/pkgs/by-name/po/postgres-lsp/package.nix
index 6981031280a2..407592de904f 100644
--- a/pkgs/by-name/po/postgres-lsp/package.nix
+++ b/pkgs/by-name/po/postgres-lsp/package.nix
@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "postgres-lsp";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "supabase-community";
     repo = "postgres-language-server";
     tag = finalAttrs.version;
-    hash = "sha256-ckD2IoG4jHd+IppCpl6VJN8Z3Dj2iiR7Uv9uBTy823s=";
+    hash = "sha256-MdEI/3oqTIJ4anG6jXO4SEkb4VDulzD3Ql+TiFdCQa8=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-P5Q6VMy5DsMDA9r28lRH4MA8ZlXN0gRVe/ICeDfvBuQ=";
+  cargoHash = "sha256-vr84vwmDUpmyiX4TTTdR35Hjevi43+KgWxDhSbUKr+k=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook

From d59559f59e4eff542ae2942d1f852534968ec67a Mon Sep 17 00:00:00 2001
From: themadbit <marktanui75@gmail.com>
Date: Tue, 15 Jul 2025 12:06:33 +0300
Subject: [PATCH 127/181] holo-daemon: 0.7.0 -> 0.8.0

---
 pkgs/by-name/ho/holo-daemon/package.nix | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/ho/holo-daemon/package.nix b/pkgs/by-name/ho/holo-daemon/package.nix
index c704a02c5e59..c71f737c54f8 100644
--- a/pkgs/by-name/ho/holo-daemon/package.nix
+++ b/pkgs/by-name/ho/holo-daemon/package.nix
@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "holo-daemon";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "holo-routing";
     repo = "holo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wASY+binAflxaXjKdSfUXS8jgdEHjdIF3AOzjN/a1Fo=";
+    hash = "sha256-8cScq/6e9u3rDilnjT6mAbEudXybNj3YUicYiEgoCyE=";
   };
 
   passthru.updateScript = nix-update-script { };
 
-  cargoHash = "sha256-5X6a86V3Y9+KK0kGbS/ovelqXyLv15gQRFI7GhiYBjY=";
+  cargoHash = "sha256-YZ2c6W6CCqgyN+6i7Vh5fWLKw8L4pUqvq/tDO/Q/kf0=";
 
   # Use rust nightly features
   RUSTC_BOOTSTRAP = 1;
@@ -36,19 +36,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pcre2
   ];
 
-  # Might not be needed if latest nightly compiler version is used
-  preConfigure = ''
-    # Find all lib.rs and main.rs files and add required unstable features
-    # Add the feature flag at the top of the file if not present`
-    find . -name "lib.rs" -o -name "main.rs" | while read -r file; do
-      for feature in extract_if let_chains hash_extract_if; do
-        if ! grep -q "feature.*$feature" "$file"; then
-          sed -i "1i #![feature($feature)]" "$file"
-        fi
-      done
-    done
-  '';
-
   meta = {
     description = "`holo` daemon that provides the routing protocols, tools and policies";
     homepage = "https://github.com/holo-routing/holo";

From 390673060dda23aaddee016b5595e02f73b2b8af Mon Sep 17 00:00:00 2001
From: Renato Alves <alves.rjc@gmail.com>
Date: Tue, 15 Jul 2025 10:05:49 +0200
Subject: [PATCH 128/181] firefox_decrypt: 1.1.0 -> 1.1.1

Version specified 1.1.1 but commit pointed to 1.1.0.
Switching to fetching 'tag' to avoid version mismatch.
---
 pkgs/tools/security/firefox_decrypt/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/firefox_decrypt/default.nix b/pkgs/tools/security/firefox_decrypt/default.nix
index 5bc8dbe86aa0..8b4a1464b743 100644
--- a/pkgs/tools/security/firefox_decrypt/default.nix
+++ b/pkgs/tools/security/firefox_decrypt/default.nix
@@ -18,8 +18,8 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "unode";
     repo = pname;
-    rev = "0931c0484d7429f7d4de3a2f5b62b01b7924b49f";
-    hash = "sha256-9HbH8DvHzmlem0XnDbcrIsMQRBuf82cHObqpLzQxNZM=";
+    tag = "${version}";
+    hash = "sha256-HPjOUWusPXoSwwDvW32Uad4gFERvn79ee/WxeX6h3jY=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +42,9 @@ buildPythonApplication rec {
     description = "Tool to extract passwords from profiles of Mozilla Firefox and derivates";
     mainProgram = "firefox_decrypt";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ schnusch ];
+    maintainers = with maintainers; [
+      schnusch
+      unode
+    ];
   };
 }

From bc41a0ac770ad55f42e3e27d22d37ab3b6f59327 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 10:03:36 +0000
Subject: [PATCH 129/181] cubeb: 0-unstable-2025-06-16 -> 0-unstable-2025-07-10

---
 pkgs/by-name/cu/cubeb/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cu/cubeb/package.nix b/pkgs/by-name/cu/cubeb/package.nix
index aa63c0393cc5..8086302d1e23 100644
--- a/pkgs/by-name/cu/cubeb/package.nix
+++ b/pkgs/by-name/cu/cubeb/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cubeb";
-  version = "0-unstable-2025-06-16";
+  version = "0-unstable-2025-07-10";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cubeb";
-    rev = "566c73da47668ca85817108b749a13ac9c3f5a9d";
-    hash = "sha256-qYDsRhVBHLOVpWwtRNUtnZRZZq9Rot1pOn+4let6v6I=";
+    rev = "fa021607121360af7c171d881dc5bc8af7bb56eb";
+    hash = "sha256-6PUHUPybe3g5nexunAHsHLThFdvpnv+avks+C0oYih0=";
   };
 
   outputs = [

From 62a8751672e6fc4e514e2d5dc367404e43dd5a73 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Sun, 29 Jun 2025 16:57:08 +0200
Subject: [PATCH 130/181] rust: drop Firefox and Thunderbird from checklist

This hasn't been done for the last few releases, there haven't
been any problems, and documentation should match reality.  Last time
Thunderbird broke there was a patch for it that could be backported.
---
 pkgs/development/compilers/rust/1_88.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/compilers/rust/1_88.nix b/pkgs/development/compilers/rust/1_88.nix
index 2bf2a6c2875f..fef90efe0927 100644
--- a/pkgs/development/compilers/rust/1_88.nix
+++ b/pkgs/development/compilers/rust/1_88.nix
@@ -7,7 +7,6 @@
 # 2. The LLVM version used for building should match with rust upstream.
 #    Check the version number in the src/llvm-project git submodule in:
 #    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
 
 {
   stdenv,

From cdd1931ace63fb69056d7b1b978a5d866b981fe5 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 14 Jul 2025 10:34:25 +0200
Subject: [PATCH 131/181] ci/github-script: add gh dependency to dev shell

---
 ci/github-script/README.md | 2 +-
 ci/github-script/shell.nix | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/ci/github-script/README.md b/ci/github-script/README.md
index 8ffff0c40922..caf52eb5bba3 100644
--- a/ci/github-script/README.md
+++ b/ci/github-script/README.md
@@ -5,8 +5,8 @@ It provides a `nix-shell` environment to run and test these actions locally.
 
 To run any of the scripts locally:
 
-- Provide `gh` on `PATH` and make sure it's authenticated.
 - Enter `nix-shell` in `./ci/github-script`.
+- Ensure `gh` is authenticated.
 
 ## Labeler
 
diff --git a/ci/github-script/shell.nix b/ci/github-script/shell.nix
index dd84ba3ad73d..82f03de4b1a0 100644
--- a/ci/github-script/shell.nix
+++ b/ci/github-script/shell.nix
@@ -5,12 +5,14 @@
 
 pkgs.callPackage (
   {
-    mkShell,
+    gh,
     importNpmLock,
+    mkShell,
     nodejs,
   }:
   mkShell {
     packages = [
+      gh
       importNpmLock.hooks.linkNodeModulesHook
       nodejs
     ];

From 6dadf06afefc161761bc87c1dd643100b97a40b6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 10:37:38 +0000
Subject: [PATCH 132/181] moar: 1.32.2 -> 1.32.3

---
 pkgs/by-name/mo/moar/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mo/moar/package.nix b/pkgs/by-name/mo/moar/package.nix
index 0f0ec6a9b724..8e0fbb53e35c 100644
--- a/pkgs/by-name/mo/moar/package.nix
+++ b/pkgs/by-name/mo/moar/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "moar";
-  version = "1.32.2";
+  version = "1.32.3";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moar";
     rev = "v${version}";
-    hash = "sha256-iv5rvIf/4bRgaFUNnXvANEynNUVQv4twK21ZJhpxLXU=";
+    hash = "sha256-gN5fP+eG3pDyQxOjqFcB9RuTjO+uDMsYLKdtwBVIQdI=";
   };
 
   vendorHash = "sha256-eKL6R2Xmj6JOwXGuJJdSGwobEzDzZ0FUD8deO2d1unc=";

From 6b5d863322f9dc5a3d27012dd335f3abcc40051b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 10:54:23 +0000
Subject: [PATCH 133/181] python3Packages.rope: 1.13.0 -> 1.14.0

---
 pkgs/development/python-modules/rope/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/rope/default.nix b/pkgs/development/python-modules/rope/default.nix
index 27ac5a2c32c2..94ba8fafe514 100644
--- a/pkgs/development/python-modules/rope/default.nix
+++ b/pkgs/development/python-modules/rope/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "rope";
-  version = "1.13.0";
+  version = "1.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "python-rope";
     repo = "rope";
     tag = version;
-    hash = "sha256-g/fta5gW/xPs3VaVuLtikfLhqCKyy1AKRnOcOXjQ8bA=";
+    hash = "sha256-LcxpJhMtyk0kT759ape9zQzdwmL1321Spdbg9zuuXtI=";
   };
 
   build-system = [ setuptools ];
@@ -51,7 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python refactoring library";
     homepage = "https://github.com/python-rope/rope";
-    changelog = "https://github.com/python-rope/rope/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/python-rope/rope/blob/${src.tag}/CHANGELOG.md";
     license = licenses.gpl3Plus;
     maintainers = [ ];
   };

From 9f086440849df609fce12bcb64614d6e766c9a2e Mon Sep 17 00:00:00 2001
From: Minijackson <minijackson@riseup.net>
Date: Fri, 11 Jul 2025 14:02:13 +0200
Subject: [PATCH 134/181] python3Packages.drf-extra-fields: fix tests exclusion

The pytz failure doesn't depend on the Python version.
This fixes the netbox-document plugin on NixOS 25.05.
---
 .../drf-extra-fields/default.nix              | 22 ++++++++++---------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/drf-extra-fields/default.nix b/pkgs/development/python-modules/drf-extra-fields/default.nix
index 431ad99e0d19..9ffeddfab9bb 100644
--- a/pkgs/development/python-modules/drf-extra-fields/default.nix
+++ b/pkgs/development/python-modules/drf-extra-fields/default.nix
@@ -48,16 +48,18 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "drf_extra_fields" ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.13") [
-    # https://github.com/Hipo/drf-extra-fields/issues/210
-    "test_read_source_with_context"
-
-    # pytz causes the following tests to fail
-    "test_create"
-    "test_create_with_base64_prefix"
-    "test_create_with_webp_image"
-    "test_remove_with_empty_string"
-  ];
+  disabledTests =
+    [
+      # pytz causes the following tests to fail
+      "test_create"
+      "test_create_with_base64_prefix"
+      "test_create_with_webp_image"
+      "test_remove_with_empty_string"
+    ]
+    ++ lib.optionals (pythonAtLeast "3.13") [
+      # https://github.com/Hipo/drf-extra-fields/issues/210
+      "test_read_source_with_context"
+    ];
 
   meta = {
     description = "Extra Fields for Django Rest Framework";

From a2f4f883159cd05e7d515aec3a2c2333fb645844 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 15 Jul 2025 14:12:38 +0300
Subject: [PATCH 135/181] scripts/kde: handle missing hashes gracefully

---
 maintainers/scripts/kde/generate-sources.py | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/maintainers/scripts/kde/generate-sources.py b/maintainers/scripts/kde/generate-sources.py
index f251a737efd1..2966e7ef9675 100755
--- a/maintainers/scripts/kde/generate-sources.py
+++ b/maintainers/scripts/kde/generate-sources.py
@@ -2,6 +2,7 @@
 #!nix-shell -i python3 -p "python3.withPackages(ps: [ ps.beautifulsoup4 ps.click ps.httpx ps.jinja2 ps.packaging ps.pyyaml ])" nix-update
 import base64
 import binascii
+import hashlib
 import json
 import pathlib
 import subprocess
@@ -112,8 +113,17 @@ def main(pkgset: str, version: str, nixpkgs: pathlib.Path, sources_url: str | No
 
         url = urljoin(sources_url, link.attrs["href"])
 
-        hash = client.get(url + ".sha256").text.split(" ", maxsplit=1)[0]
-        assert hash
+        hash = client.get(url + ".sha256").text.strip()
+
+        if hash == "Hash type not supported":
+            print(f"{url} missing hash on CDN, downloading...")
+            hasher = hashlib.sha256()
+            with client.stream("GET", url, follow_redirects=True) as r:
+                for data in r.iter_bytes():
+                    hasher.update(data)
+            hash = hasher.hexdigest()
+        else:
+            hash = hash.split(" ", maxsplit=1)[0]
 
         if existing := results.get(project_name):
             old_version = existing["version"]

From e23f2526c5b99d9eb0d3fccef7c27b13a35ce1e3 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 15 Jul 2025 14:15:25 +0300
Subject: [PATCH 136/181] kdePackages: Plasma 6.4.2 -> 6.4.3

---
 pkgs/kde/generated/sources/plasma.json | 414 ++++++++++++-------------
 1 file changed, 207 insertions(+), 207 deletions(-)

diff --git a/pkgs/kde/generated/sources/plasma.json b/pkgs/kde/generated/sources/plasma.json
index b955a9b6aa59..8b266ee27c9b 100644
--- a/pkgs/kde/generated/sources/plasma.json
+++ b/pkgs/kde/generated/sources/plasma.json
@@ -1,347 +1,347 @@
 {
   "aurorae": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/aurorae-6.4.2.tar.xz",
-    "hash": "sha256-nYjOtnMItAk8aisnEz6Aj5dM+XMUR/rO9y7hO19CTVE="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/aurorae-6.4.3.tar.xz",
+    "hash": "sha256-pTMhyYqBgf5ek89ch76qxgkYwygN3Zg0JjBt+ucAlE8="
   },
   "bluedevil": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/bluedevil-6.4.2.tar.xz",
-    "hash": "sha256-JTvWMwWrK3Y5H+ynIfc1trrmxcE3mRZLjKoJ+/o6DgY="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/bluedevil-6.4.3.tar.xz",
+    "hash": "sha256-J2DbvT7nhc5JPTn49icvR52xhAdqbjDx9GRq+9jKMx0="
   },
   "breeze": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/breeze-6.4.2.tar.xz",
-    "hash": "sha256-RgerRR0NFfDQgVJD0H/V9XCZhffrK+8b9MoWkbRwqrU="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/breeze-6.4.3.tar.xz",
+    "hash": "sha256-AXotrfgDoMLRZ0ifW6TSoAEfxY/PGMXnb6b8IvSET78="
   },
   "breeze-grub": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/breeze-grub-6.4.2.tar.xz",
-    "hash": "sha256-kqyaSHIcRgVBajz+LxVvE1e47YDliZq0jTe0X17roCU="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/breeze-grub-6.4.3.tar.xz",
+    "hash": "sha256-TwGrZLiijF2jmRXq8D1vt8APFTugcbt2c8HbsEFvueo="
   },
   "breeze-gtk": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/breeze-gtk-6.4.2.tar.xz",
-    "hash": "sha256-SOW1KpUXZGGlO9U7P+lRPEycJxVcrW+IMMeLzEA8to0="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/breeze-gtk-6.4.3.tar.xz",
+    "hash": "sha256-25GtKkYllrxxXTCRsJ6Gx52gBgoTxqDeGwMk7wYO6AM="
   },
   "breeze-plymouth": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/breeze-plymouth-6.4.2.tar.xz",
-    "hash": "sha256-/V6zHc9mCS2kgceXyHKGWQcAA961ldyVxP6jvf9K3T4="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/breeze-plymouth-6.4.3.tar.xz",
+    "hash": "sha256-BE6qpzIkxyY0Sz1ZksfSilgNxIHAZdogN4KiD9qV3D8="
   },
   "discover": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/discover-6.4.2.tar.xz",
-    "hash": "sha256-8d21G83ZgV3CIsAtKZQkkk2lQbOpGiy/lye9GyDb1RU="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/discover-6.4.3.tar.xz",
+    "hash": "sha256-wt2COKqoyAGhLG8p1w8kRnutWSCcX8j66Xy7usRd3hA="
   },
   "drkonqi": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/drkonqi-6.4.2.tar.xz",
-    "hash": "sha256-xYlgsRuheAqPOTMgJRcmJJSkDHPQQeu/5tdsFBdAbJ0="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/drkonqi-6.4.3.tar.xz",
+    "hash": "sha256-OtmLG8xkIO1BVGQK+MsvRByndMrz2ajk2KufVTYJ+0M="
   },
   "flatpak-kcm": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/flatpak-kcm-6.4.2.tar.xz",
-    "hash": "sha256-FA48nX/qzO76aQHFXchyKBr5t81YzzZlU4kVB9RXnAQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/flatpak-kcm-6.4.3.tar.xz",
+    "hash": "sha256-K4VHWf0RJeRwYc2tOqFk4/7IvBAdS209H6LUkHdNITk="
   },
   "kactivitymanagerd": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kactivitymanagerd-6.4.2.tar.xz",
-    "hash": "sha256-GraFQCR7IHrhS+Rkd7YEqOj/A9qwB+n84WDSMP6DtsM="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kactivitymanagerd-6.4.3.tar.xz",
+    "hash": "sha256-6esrBjv8Rp1GWor73w7HagQQyj9o92ZsULUBIxW2pos="
   },
   "kde-cli-tools": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kde-cli-tools-6.4.2.tar.xz",
-    "hash": "sha256-9iJhUETVIxqayTNJalCbRaZ54vT3arlUHa8ZoP7c76o="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kde-cli-tools-6.4.3.tar.xz",
+    "hash": "sha256-1UzEL4yVXvgyKXZlWh7QA8yiS0LBqPUXvBwnzhevbig="
   },
   "kde-gtk-config": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kde-gtk-config-6.4.2.tar.xz",
-    "hash": "sha256-b6XWoEX0eRaRm9wY8eJxR2PwXmIOtaJjqMqU1weVIVQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kde-gtk-config-6.4.3.tar.xz",
+    "hash": "sha256-IvciU7yAG7F1e31Wqza7J5waElXviIytyVDFslWbWRI="
   },
   "kdecoration": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kdecoration-6.4.2.tar.xz",
-    "hash": "sha256-16vnPcCTBFPxl7egIvwZPNESwlSvKccvMWq/517nXzM="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kdecoration-6.4.3.tar.xz",
+    "hash": "sha256-vQ+ZvfSHqFnaixIn40QyWa0o6Q8RC9OnvOzDhv3teCQ="
   },
   "kdeplasma-addons": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kdeplasma-addons-6.4.2.tar.xz",
-    "hash": "sha256-3d+FtyjfgE6jngJFLjVc7RlrGjXrjp2dcbdH+JzBZsE="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kdeplasma-addons-6.4.3.tar.xz",
+    "hash": "sha256-fa2Rdv7pn06V9lc6qxgybu/2dCYJ6HObm1nC6fKq0Zs="
   },
   "kgamma": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kgamma-6.4.2.tar.xz",
-    "hash": "sha256-/4JZiLpURND+5uM4xkPX0x230fNb4txizmf27oAcjxs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kgamma-6.4.3.tar.xz",
+    "hash": "sha256-2F+G9v2bAXM5ViO1GKQGCVHBD3UGxWG5mYGOgZsT7A4="
   },
   "kglobalacceld": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kglobalacceld-6.4.2.tar.xz",
-    "hash": "sha256-n3yiUzquPVzROJX0euB7/bpBZa8BzKpGDWRbPE0qUeQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kglobalacceld-6.4.3.tar.xz",
+    "hash": "sha256-ppx4fhsTOtXpnz+D0aGVch8n5SAMxgzbpw2NwDrMQ3g="
   },
   "kinfocenter": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kinfocenter-6.4.2.tar.xz",
-    "hash": "sha256-HSX/7XkEvbeuTS/1bUFztIoVOEy5cKeKFFEnhm3Rmdo="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kinfocenter-6.4.3.tar.xz",
+    "hash": "sha256-TV9JlHB3KnS08in2dv63rv0S7CstNkWLhIPY3KOkink="
   },
   "kmenuedit": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kmenuedit-6.4.2.tar.xz",
-    "hash": "sha256-oA/YUDAP8IsXvZpS7Bno9pgiNE79oXc06GVaHL6qNSs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kmenuedit-6.4.3.tar.xz",
+    "hash": "sha256-lPsm7/zhhSQKiPgrv3VqaztvCi0FVlKcSien9iqnnIk="
   },
   "kpipewire": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kpipewire-6.4.2.tar.xz",
-    "hash": "sha256-1Z+L6VTSOsS58+0ovMWiLoquvq31HCg0SZt2lMqQzhw="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kpipewire-6.4.3.tar.xz",
+    "hash": "sha256-GGbZZs5hu4PtHUXcwNsai6kZcXYmgTaKM1fYZDj6lkI="
   },
   "krdp": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/krdp-6.4.2.tar.xz",
-    "hash": "sha256-7PKlFzfhYOmo57hVcqLAAKk8e1k4spyVkRiasGJKC7Y="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/krdp-6.4.3.tar.xz",
+    "hash": "sha256-sElQOTYg8Us1INxnboFjKjGI+S5Q2oTd4z8AgcWHt4c="
   },
   "kscreen": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kscreen-6.4.2.tar.xz",
-    "hash": "sha256-dxpsShfDTbdii6tY7m0Zd9WO7iik05T7nsIIz3nnaBk="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kscreen-6.4.3.tar.xz",
+    "hash": "sha256-N+9wMqITYpPP7OtB+u/1Jd6AxxGc2MhUEWuLMA76YKk="
   },
   "kscreenlocker": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kscreenlocker-6.4.2.tar.xz",
-    "hash": "sha256-7yvIwvHw33XGd3jEIIpe4CwFRjVu+DUt0f/e6GcoPMQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kscreenlocker-6.4.3.tar.xz",
+    "hash": "sha256-NEEXRCb9GFJMpZ+iJG+e6Zwx3sD9ieqnlwXmoy0dysM="
   },
   "ksshaskpass": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/ksshaskpass-6.4.2.tar.xz",
-    "hash": "sha256-bvOBEjnC7FBYWfbEg5J9bWmln72NbaQbOFqXfCMe//w="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/ksshaskpass-6.4.3.tar.xz",
+    "hash": "sha256-ll+JoBqpHAftW4rtK+NSH4jpiyLhJ3hG8SRAyXYLrxA="
   },
   "ksystemstats": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/ksystemstats-6.4.2.tar.xz",
-    "hash": "sha256-UWE07MisRse88JnVfYiJ6FbMzxo2EnWg0yxmzS9lwSQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/ksystemstats-6.4.3.tar.xz",
+    "hash": "sha256-DRvbUY/XI1VREPjcTtm1CbA7Jn5AzC1wlYevLEzo2gw="
   },
   "kwallet-pam": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwallet-pam-6.4.2.tar.xz",
-    "hash": "sha256-/FV4roYNdM52lc8LVhpyvPRzBjZpTY3r/BDIXpcpauk="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwallet-pam-6.4.3.tar.xz",
+    "hash": "sha256-CBUcoD57io52lpJ+Oq3DCVz0gIF0jJg3mNrDWrX9DN4="
   },
   "kwayland": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwayland-6.4.2.tar.xz",
-    "hash": "sha256-go3ZwewydyFYPW8EpEE/CPb/2TUMUd4WmGNZqnDICNc="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwayland-6.4.3.tar.xz",
+    "hash": "sha256-/1B9PENUB7ODHq0epj9t6mx3i6ah9bRYldX+xvXB+YI="
   },
   "kwayland-integration": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwayland-integration-6.4.2.tar.xz",
-    "hash": "sha256-P8Xp+/SqnXM0KeI+VBd6mYOj7SohH6IKGfUA1c/dJjc="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwayland-integration-6.4.3.tar.xz",
+    "hash": "sha256-m68hNOLTLp1NQXiU+mORH6lLyoYZjvjhbkYdWYm24tA="
   },
   "kwin": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwin-6.4.2.tar.xz",
-    "hash": "sha256-HLAMYDuwENRQ4IvidDlBi+ZZlA6IWpCsTi9bxhrjtxs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwin-6.4.3.tar.xz",
+    "hash": "sha256-oTVoyRjsp4A+tEo6J3i4YO3D8Ds2eXhRxPOu7tS1Aqg="
   },
   "kwin-x11": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwin-x11-6.4.2.tar.xz",
-    "hash": "sha256-bt+yBKGrmvmRvwV643bBJZUXDVkdCAFnS7pkFI1FLCM="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwin-x11-6.4.3.tar.xz",
+    "hash": "sha256-TytgGTlnwkoGe53agtWfgR9WY/V4PVngNCT8AoHM0Yg="
   },
   "kwrited": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/kwrited-6.4.2.tar.xz",
-    "hash": "sha256-25fcbeRcNfwUY6kQe/0lYnUk3nwcAEQ0US2naWvPmWE="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/kwrited-6.4.3.tar.xz",
+    "hash": "sha256-/hRLXtQnDL1F9xGHuXDkxOPgA1wa/EBxmxyGK4rbCYs="
   },
   "layer-shell-qt": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/layer-shell-qt-6.4.2.tar.xz",
-    "hash": "sha256-e+rQL1BufB763GFYjMUujtL6Rnyhg0hcO3KAwIpaYxI="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/layer-shell-qt-6.4.3.tar.xz",
+    "hash": "sha256-M+ZOwM0tnpVHw8P6qcTWogBr9oH6w2FRH0QbUfnd23w="
   },
   "libkscreen": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/libkscreen-6.4.2.tar.xz",
-    "hash": "sha256-c9+69sQ3pcHQH3aLTxQAcNBH+P7DBkQqzZOrVIN+wao="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/libkscreen-6.4.3.tar.xz",
+    "hash": "sha256-ol8GBBEGUshH4ADt5v3p8nfrOIUO3qvePjpB0uuBsGs="
   },
   "libksysguard": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/libksysguard-6.4.2.tar.xz",
-    "hash": "sha256-5XHYTNsLpcPePCabNKJ2aylMUjNwuiy3jW9OUqO7R9k="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/libksysguard-6.4.3.tar.xz",
+    "hash": "sha256-V6NTMV/SCw5GbuOZ2Oxq+ee1dDKDEfqHF3MSZ763MuI="
   },
   "libplasma": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/libplasma-6.4.2.tar.xz",
-    "hash": "sha256-qbtVMubvswgzx2teLg+xzhquVAvraBO2kWPSC5bVYKw="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/libplasma-6.4.3.tar.xz",
+    "hash": "sha256-9QjOztMqEURi5eMRlWAO5EChohuOt3uiADPPuJK7DMg="
   },
   "milou": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/milou-6.4.2.tar.xz",
-    "hash": "sha256-smV6I1WaG/+FqzC2svXS4anBSZ7Qrwla2oOthby1paY="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/milou-6.4.3.tar.xz",
+    "hash": "sha256-1nnJW2KuuBSb02ivHYMf7nnrqqw+5HnaZ8RQ6A/TX/E="
   },
   "ocean-sound-theme": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/ocean-sound-theme-6.4.2.tar.xz",
-    "hash": "sha256-0bRaGlY/iK6lHMH2PjpREghMvNHwOEOU64qNkcXIpGY="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/ocean-sound-theme-6.4.3.tar.xz",
+    "hash": "sha256-s/ggACbvS+YCN5XbPZr/Lk+GrHXVH8AjPqJpumVChDI="
   },
   "oxygen": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/oxygen-6.4.2.tar.xz",
-    "hash": "sha256-i70B4P5cAKMcyT+3u588rfgOn+iwzkQtupJOEQL2f/o="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/oxygen-6.4.3.tar.xz",
+    "hash": "sha256-f+VdNdt+GsAZushbVdUCbc+ZwfS78Y5a7zinW8Adz2g="
   },
   "oxygen-sounds": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/oxygen-sounds-6.4.2.tar.xz",
-    "hash": "sha256-EFCF+0JnJxQoDq9gzLL5/eVOj+81aGdKvnCwiXKPT30="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/oxygen-sounds-6.4.3.tar.xz",
+    "hash": "sha256-RAVm+ahMnOkOBLVhq5eQmDi1Gcg/fe61dNBckzuvLis="
   },
   "plasma-activities": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-activities-6.4.2.tar.xz",
-    "hash": "sha256-u8oDrGpqcZWLRCbVdexoI5klzT7Ry6W9Fxt+e4YFqNs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-activities-6.4.3.tar.xz",
+    "hash": "sha256-HI3KdGYC3vrNSVua5jfBcA075+fjzF1Jml/WaaC5jvA="
   },
   "plasma-activities-stats": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-activities-stats-6.4.2.tar.xz",
-    "hash": "sha256-xon1HSnwtlqRPm10ZIQ0fVFt+aFy8sUee8hcrecqjno="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-activities-stats-6.4.3.tar.xz",
+    "hash": "sha256-mRAC49qbWWm5WDzRaQUKI6rL4C8tfUqxoZ9b18crO2s="
   },
   "plasma-browser-integration": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-browser-integration-6.4.2.tar.xz",
-    "hash": "sha256-y4W5WagRCb8qqC91gpsOGDPJtMBriBnDBPfKXjIPFUs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-browser-integration-6.4.3.tar.xz",
+    "hash": "sha256-WMznF6tOw66UGL4F6GfCyD0jKG0dxo8mUM6hizF5q8s="
   },
   "plasma-desktop": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-desktop-6.4.2.tar.xz",
-    "hash": "sha256-MpaRuS82jCIRRgRlDjnbkcY4cMgMDAjoU8agQNvTCoQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-desktop-6.4.3.tar.xz",
+    "hash": "sha256-GQo/VY9rP6khZMPyaecP/R6YHjUt1xikOkywByRapSU="
   },
   "plasma-dialer": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-dialer-6.4.2.tar.xz",
-    "hash": "sha256-l9UkW9yylvJCXNJ3NK/EYWpi6VYKwqEnv+WVxbfFJXs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-dialer-6.4.3.tar.xz",
+    "hash": "sha256-p960P1UuPAecHl3RT+xfbrcuVQJPI6Kbe8LQE9PCM+o="
   },
   "plasma-disks": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-disks-6.4.2.tar.xz",
-    "hash": "sha256-cZvMFQpGJSsO8WT5CVELOMYusNsRrxYVbB0CbzNGWtk="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-disks-6.4.3.tar.xz",
+    "hash": "sha256-vW5jR1ZCr+ciKGLXLUVM2cpsfzkfSBwrFFwqt5NGwhM="
   },
   "plasma-firewall": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-firewall-6.4.2.tar.xz",
-    "hash": "sha256-cRXcGHF16e2KIvbbh2ZiE9jlyV2mbErjdxorvxy4VJs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-firewall-6.4.3.tar.xz",
+    "hash": "sha256-vHgAR7ZWarEjgnWwLBIOKnRUIiy0XEf8spYAMIaDxow="
   },
   "plasma-integration": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-integration-6.4.2.tar.xz",
-    "hash": "sha256-8LVs4ErhEXzA8ipypgAWT9IUiiW3553AxMUH+ImQpcw="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-integration-6.4.3.tar.xz",
+    "hash": "sha256-cfPmQ9e38z/C5HOFBCTc+wDDJY1/4uJxoDJiEzMoi9c="
   },
   "plasma-mobile": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-mobile-6.4.2.tar.xz",
-    "hash": "sha256-p5O7SWV+40IhLQuCCOz+6uyArVzZZA2fBBQi6fkcn2A="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-mobile-6.4.3.tar.xz",
+    "hash": "sha256-4089dZ3kh+QOWQAQ69Fsx0CBHNFd4AEfp3xBcq+WHfM="
   },
   "plasma-nano": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-nano-6.4.2.tar.xz",
-    "hash": "sha256-HqL2PEcuL+2bwgun0Om7MIDBToMCn/htFwaIopjwqCM="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-nano-6.4.3.tar.xz",
+    "hash": "sha256-CnxbV63/Wu93yJHoiDqwLFQ6/IYKueK1745VBnZTilY="
   },
   "plasma-nm": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-nm-6.4.2.tar.xz",
-    "hash": "sha256-eG+s60HArZEuBcVHgO2TMcQBlwf7EdzZBPGBOi/Wh2k="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-nm-6.4.3.tar.xz",
+    "hash": "sha256-Z8OOPApU6QrhI3mRFCuSBkY9Q8Lq2O313Vu3oWpGoT4="
   },
   "plasma-pa": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-pa-6.4.2.tar.xz",
-    "hash": "sha256-V9cdQErXnobcEB4o5+g7j0xtvYJb4dsi8pr4Gi2izUU="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-pa-6.4.3.tar.xz",
+    "hash": "sha256-aw49OrRpz4b8GNIR/L9BJRqjOjAUoyt37EGQX9L6TiE="
   },
   "plasma-sdk": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-sdk-6.4.2.tar.xz",
-    "hash": "sha256-5/DiYmnWxPI5LYWhtoWY7dH9TAcRZbeiWklv2+WgOeE="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-sdk-6.4.3.tar.xz",
+    "hash": "sha256-m3zjZFmz8s2Ru+CUGto+uzjv8BSZOcWdqy0LDTkowGQ="
   },
   "plasma-systemmonitor": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-systemmonitor-6.4.2.tar.xz",
-    "hash": "sha256-pIZhYNvcVvp7hfSOYyZDuC1tNmdMdU+Zafzq3W8+pTg="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-systemmonitor-6.4.3.tar.xz",
+    "hash": "sha256-aFbjmSZVJjMu6TifvPgZ09B6DqLtRWfVRa4IjkiV0jA="
   },
   "plasma-thunderbolt": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-thunderbolt-6.4.2.tar.xz",
-    "hash": "sha256-cNjE7N+ibccva7ZEctbcVRPKlPCCPYJpT/7sntWrOhY="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-thunderbolt-6.4.3.tar.xz",
+    "hash": "sha256-aYn51hqotPoh2iPeALIxZO0VN1mG0nFgGRqQtawTP1I="
   },
   "plasma-vault": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-vault-6.4.2.tar.xz",
-    "hash": "sha256-vSk0YVkv57EkPPpFyH9bGRlrMN1/ADvlTzi2pIG/UZY="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-vault-6.4.3.tar.xz",
+    "hash": "sha256-uXkOHGYGUFBDzQxfWJYP5d4dGgT1OazjuYbZbUcDTsc="
   },
   "plasma-welcome": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-welcome-6.4.2.tar.xz",
-    "hash": "sha256-bVfIrkRYph+2BXSwF1sup2bQ8oIhQiGU7xA8D7fsfIQ="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-welcome-6.4.3.tar.xz",
+    "hash": "sha256-1xzWOZ91n6T8+jD1CKRgqzfSq0+9zd+aLn8rWrhwtGM="
   },
   "plasma-workspace": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-workspace-6.4.2.tar.xz",
-    "hash": "sha256-7WV7457JvB1OW6TF5xe0q2g90nvs7Prvbn4gn3cbSFA="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-workspace-6.4.3.tar.xz",
+    "hash": "sha256-clTyhakeyAKwYSp62yQtmDYqzN/4ZvwShbtluASN7bg="
   },
   "plasma-workspace-wallpapers": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma-workspace-wallpapers-6.4.2.tar.xz",
-    "hash": "sha256-06iVlvN2HWJ2wMvCaPerjrcjhhgvjTVovpvDy3bBm38="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma-workspace-wallpapers-6.4.3.tar.xz",
+    "hash": "sha256-9dIdq7VO20SDtXihp+foLw5x/K2XS+8kQSE01NQ6ycQ="
   },
   "plasma5support": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plasma5support-6.4.2.tar.xz",
-    "hash": "sha256-JKB87/CDpqei2bQVKBJUkFBiPENO9zGRCZYwhaEUrvI="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plasma5support-6.4.3.tar.xz",
+    "hash": "sha256-Homok10Y2YqPy+Av80d0iThbtCqATlQ7uyTwQ/XNjPY="
   },
   "plymouth-kcm": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/plymouth-kcm-6.4.2.tar.xz",
-    "hash": "sha256-3GQyiAKa9btFixXYPW0M/VwAzqajRUj+g6UsM9wrOpI="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/plymouth-kcm-6.4.3.tar.xz",
+    "hash": "sha256-ONxaWan+fXX6gAr6V604RF89n608obsGbm5GSDj6fg8="
   },
   "polkit-kde-agent-1": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/polkit-kde-agent-1-6.4.2.tar.xz",
-    "hash": "sha256-Kq+ua00EgBjDmPSaFf+YchmDGu4i/sVNCPIHhjQXD5o="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/polkit-kde-agent-1-6.4.3.tar.xz",
+    "hash": "sha256-InMbD6Aun9y9WSajxThhAPIKzXoCY5ZyFlebCERWguc="
   },
   "powerdevil": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/powerdevil-6.4.2.tar.xz",
-    "hash": "sha256-y/ifJe/Iy4fEfFLrV1eBsjajU3lvcxcqQ7iNRBZixsU="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/powerdevil-6.4.3.tar.xz",
+    "hash": "sha256-wkfQxBSQXeCfHAEzAoSB+w8ez6JtiTcqzvr/qxUFK9Y="
   },
   "print-manager": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/print-manager-6.4.2.tar.xz",
-    "hash": "sha256-brk+AAZa3hcTf/a0ruxIhltRSbz8Jff5xZPfTRoWaL0="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/print-manager-6.4.3.tar.xz",
+    "hash": "sha256-/f1/42htk351wopMuQG5P0+iiWd+8uypSlDYNVOjLTQ="
   },
   "qqc2-breeze-style": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/qqc2-breeze-style-6.4.2.tar.xz",
-    "hash": "sha256-NuBbGyJ7W2WbiwuIbcNN/sIbCZJb707D5x7ygyXG7Ik="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/qqc2-breeze-style-6.4.3.tar.xz",
+    "hash": "sha256-PGytdAsDEzpwheQ30MsWrOq94oDFXAIrAnLvRNPTI6A="
   },
   "sddm-kcm": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/sddm-kcm-6.4.2.tar.xz",
-    "hash": "sha256-988F3cfix2M72eKaX92vpuCGB9ayA0dpqPSXTIuoR88="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/sddm-kcm-6.4.3.tar.xz",
+    "hash": "sha256-UxQSOsVTiPcBViFjm42DZ8yCns7yU1aIkpjWvlSPjPY="
   },
   "spacebar": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/spacebar-6.4.2.tar.xz",
-    "hash": "sha256-l9lAg3wc5aPXRM/q2jOTXblqjHrP+ALt0y+7r9Eei2E="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/spacebar-6.4.3.tar.xz",
+    "hash": "sha256-9Rwm4KtPadbXJ2iPVh2AdeAOLSlYGosKnDoED/4JynE="
   },
   "spectacle": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/spectacle-6.4.2.tar.xz",
-    "hash": "sha256-GLHQt+JmgGZuuGorCQjDbZ4XpJizUpRNibkBGDkg4Ms="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/spectacle-6.4.3.tar.xz",
+    "hash": "sha256-mYb8CR+ROj8OFSC9izoz6cF04D9ItLKvMZK9ijG7Kdg="
   },
   "systemsettings": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/systemsettings-6.4.2.tar.xz",
-    "hash": "sha256-vFZoCu1tpn3qAmoLxgV0w/Olz6s5kxMZI7aY0oEC1gs="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/systemsettings-6.4.3.tar.xz",
+    "hash": "sha256-zBzc1xDz9f0kJIbtypTXGT1F20F4A+1imsdifrIwVVY="
   },
   "wacomtablet": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/wacomtablet-6.4.2.tar.xz",
-    "hash": "sha256-R+aPq/fLHjyXAqxhsaYJvPn4PEgJxD0Et23ln2ih9Nc="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/wacomtablet-6.4.3.tar.xz",
+    "hash": "sha256-NT1D9an3qwRcHwGKvVSt3GOPsJTuxTdfH/YxaRkDM5g="
   },
   "xdg-desktop-portal-kde": {
-    "version": "6.4.2",
-    "url": "mirror://kde/stable/plasma/6.4.2/xdg-desktop-portal-kde-6.4.2.tar.xz",
-    "hash": "sha256-K2dIB9KnhJN6C87wJxOVrYWjVHUlO6nxirotdtgzClM="
+    "version": "6.4.3",
+    "url": "mirror://kde/stable/plasma/6.4.3/xdg-desktop-portal-kde-6.4.3.tar.xz",
+    "hash": "sha256-P+xx4AWr6Ds9WTp0vDMEwXjWBYg/47d/kVxkz0XB/Cc="
   }
 }
\ No newline at end of file

From 65820f16603b4b0aebad2ccb9599472925410477 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 11:16:14 +0000
Subject: [PATCH 137/181] candy-icons: 0-unstable-2025-06-23 ->
 0-unstable-2025-07-10

---
 pkgs/by-name/ca/candy-icons/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/candy-icons/package.nix b/pkgs/by-name/ca/candy-icons/package.nix
index 2dcfe0af6b93..82ecfad4ef58 100644
--- a/pkgs/by-name/ca/candy-icons/package.nix
+++ b/pkgs/by-name/ca/candy-icons/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "candy-icons";
-  version = "0-unstable-2025-06-23";
+  version = "0-unstable-2025-07-10";
 
   src = fetchFromGitHub {
     owner = "EliverLara";
     repo = "candy-icons";
-    rev = "29976b2036490599753766f869f83e9346d8cf8e";
-    hash = "sha256-UxuW9cRGmKS2t8ik2tMAQHU0Xj+W5WhWuBxnLkkPnoE=";
+    rev = "475c5b27d34e6bde3ed11e985a727bd7ec9f155a";
+    hash = "sha256-XU10gw0WYWnzyzbzJlg2oNCksLY/Tt1CJGo0Nu4FLnM=";
   };
 
   nativeBuildInputs = [ gtk3 ];

From 71aabd66802ca4e96a3cdc6ef2d6faa389c4eba9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 10:56:50 +0000
Subject: [PATCH 138/181] postgresqlPackages.pg_net: 0.18.0 -> 0.19.1

---
 pkgs/servers/sql/postgresql/ext/pg_net.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/pg_net.nix b/pkgs/servers/sql/postgresql/ext/pg_net.nix
index c754b7104f43..d0c55edced2e 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_net.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_net.nix
@@ -8,21 +8,17 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_net";
-  version = "0.18.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "pg_net";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MXZewz6vb1ZEGMzbk/x0VtBDH2GxnwYWsy3EjJnas2U=";
+    hash = "sha256-Sy2PG1zCB6tNbcMNMWvl/Fe2Zu1stvEIqGrLsRF09GY=";
   };
 
   buildInputs = [ curl ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optional (lib.versionAtLeast postgresql.version "18") "-Wno-error=missing-variable-declarations"
-  );
-
   meta = {
     description = "Async networking for Postgres";
     homepage = "https://github.com/supabase/pg_net";

From f894e98541221eda9c4ed16426da7734cbd8afc8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 05:21:03 +0000
Subject: [PATCH 139/181] aquamarine: 0.8.0 -> 0.9.1

---
 pkgs/by-name/aq/aquamarine/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/aq/aquamarine/package.nix b/pkgs/by-name/aq/aquamarine/package.nix
index 015e4066e22d..f39c3b8176e7 100644
--- a/pkgs/by-name/aq/aquamarine/package.nix
+++ b/pkgs/by-name/aq/aquamarine/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
-  version = "0.8.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "aquamarine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ybpV2+yNExdHnMhhhmtxqgBCgI+nRr8gi/D+VVb9lQY=";
+    hash = "sha256-1bxH4zW/mnEh7ySsByZBRpANUG/Ym8kgorawYI70z7A=";
   };
 
   nativeBuildInputs = [

From 767976b43db6fca7c68275f5240fd0f2bd23c5a4 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Tue, 15 Jul 2025 13:37:15 +0200
Subject: [PATCH 140/181] aws-c-common: Mark big-endian platforms as
 unsupported

---
 pkgs/by-name/aw/aws-c-common/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/aw/aws-c-common/package.nix b/pkgs/by-name/aw/aws-c-common/package.nix
index 2c33c7f38b49..10f0884243b6 100644
--- a/pkgs/by-name/aw/aws-c-common/package.nix
+++ b/pkgs/by-name/aw/aws-c-common/package.nix
@@ -56,6 +56,8 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/awslabs/aws-c-common";
     license = licenses.asl20;
     platforms = platforms.unix;
+    # https://github.com/awslabs/aws-c-common/issues/1175
+    badPlatforms = platforms.bigEndian;
     maintainers = with maintainers; [
       orivej
       r-burns

From 8ff28f4d7870b5fdcb0d8a4c460d73f8f8968a78 Mon Sep 17 00:00:00 2001
From: Kevin Cox <kevincox@kevincox.ca>
Date: Mon, 30 Dec 2024 12:07:04 -0500
Subject: [PATCH 141/181] sparkleshare: Remove

The project has been unmaintained for a while now and has started failing to build.

Abandonment notice from the maintainer: https://github.com/hbons/SparkleShare/issues/2006

It has been a good run but it is time to say goodbye. Thanks to hbons for all of the work over the years. It looks like there is a good chance of a fork living on but it will take time to see how that shakes out. So for now let's just remove the package.
---
 .../manual/release-notes/rl-2511.section.md   |   2 +
 pkgs/by-name/ow/owncloud-client/package.nix   |   2 -
 pkgs/by-name/sp/sparkleshare/package.nix      | 101 ------------------
 3 files changed, 2 insertions(+), 103 deletions(-)
 delete mode 100644 pkgs/by-name/sp/sparkleshare/package.nix

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 8bc294c5c8e5..4b0a2c4395d1 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -131,3 +131,5 @@
 - [](#opt-services.gnome.gnome-keyring.enable) does not ship with an SSH agent anymore, as this is now handled by the `gcr_4` package instead of `gnome-keyring`. A new module has been added to support this, under [](#opt-services.gnome.gcr-ssh-agent.enable) (its default value has been set to [](#opt-services.gnome.gnome-keyring.enable) to ensure a smooth transition). See the [relevant upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67) for more details.
 
 - The `nettools` package (ifconfig, arp, mii-tool, netstat, route) is not installed by default anymore. The suite is unmaintained and users should migrate to `iproute2` and `ethtool` instead.
+
+- `sparkleshare` has been removed as it no longer builds and has been abandoned upstream.
diff --git a/pkgs/by-name/ow/owncloud-client/package.nix b/pkgs/by-name/ow/owncloud-client/package.nix
index 3ee82ec6f1cc..5d380ca54a42 100644
--- a/pkgs/by-name/ow/owncloud-client/package.nix
+++ b/pkgs/by-name/ow/owncloud-client/package.nix
@@ -15,7 +15,6 @@
   kdsingleapplication,
   ## darwin only
   libinotify-kqueue,
-  sparkleshare,
 }:
 
 stdenv.mkDerivation rec {
@@ -49,7 +48,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libinotify-kqueue
-      sparkleshare
     ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/sp/sparkleshare/package.nix b/pkgs/by-name/sp/sparkleshare/package.nix
deleted file mode 100644
index 62606d12dc97..000000000000
--- a/pkgs/by-name/sp/sparkleshare/package.nix
+++ /dev/null
@@ -1,101 +0,0 @@
-{
-  appindicator-sharp,
-  bash,
-  coreutils,
-  fetchFromGitHub,
-  git,
-  git-lfs,
-  glib,
-  gtk-sharp-3_0,
-  lib,
-  makeWrapper,
-  meson,
-  mono,
-  ninja,
-  notify-sharp,
-  openssh,
-  openssl,
-  pkg-config,
-  stdenv,
-  symlinkJoin,
-  webkit2-sharp,
-  xdg-utils,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "sparkleshare";
-  version = "3.38";
-
-  src = fetchFromGitHub {
-    owner = "hbons";
-    repo = "SparkleShare";
-    rev = version;
-    sha256 = "1a9csflmj96iyr1l0mdm3ziv1bljfcjnzm9xb2y4qqk7ha2p6fbq";
-  };
-
-  nativeBuildInputs = [
-    makeWrapper
-    meson
-    mono
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    appindicator-sharp
-    gtk-sharp-3_0
-    notify-sharp
-    webkit2-sharp
-  ];
-
-  patchPhase = ''
-    # SparkleShare's default desktop file falls back to flatpak.
-    sed -i -e "s_^Exec=.*_Exec=$out/bin/sparkleshare_" SparkleShare/Linux/SparkleShare.Autostart.desktop
-
-    # Nix will manage the icon cache.
-    echo '#!/bin/sh' >scripts/post-install.sh
-  '';
-
-  postInstall = ''
-    wrapProgram $out/bin/sparkleshare \
-        --set PATH ${
-          symlinkJoin {
-            name = "mono-path";
-            paths = [
-              bash
-              coreutils
-              git
-              git-lfs
-              glib
-              mono
-              openssh
-              openssl
-              xdg-utils
-            ];
-          }
-        }/bin \
-        --set MONO_GAC_PREFIX ${
-          lib.concatStringsSep ":" [
-            appindicator-sharp
-            gtk-sharp-3_0
-            webkit2-sharp
-          ]
-        } \
-        --set LD_LIBRARY_PATH ${
-          lib.makeLibraryPath [
-            appindicator-sharp
-            gtk-sharp-3_0.gtk3
-            webkit2-sharp
-            webkit2-sharp.webkitgtk
-          ]
-        }
-  '';
-
-  meta = {
-    description = "Share and collaborate by syncing with any Git repository instantly. Linux, macOS, and Windows";
-    homepage = "https://sparkleshare.org";
-    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ kevincox ];
-    mainProgram = "sparkleshare";
-  };
-}

From 2423327073c1659f96029f2c38f564044b673c4b Mon Sep 17 00:00:00 2001
From: Moritz Vogel <moritzv7@gmail.com>
Date: Tue, 15 Jul 2025 14:31:47 +0200
Subject: [PATCH 142/181] proxmoxer: disable flaky test

---
 pkgs/development/python-modules/proxmoxer/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/proxmoxer/default.nix b/pkgs/development/python-modules/proxmoxer/default.nix
index 2b3abbe28352..8bd6804fd9ce 100644
--- a/pkgs/development/python-modules/proxmoxer/default.nix
+++ b/pkgs/development/python-modules/proxmoxer/default.nix
@@ -46,6 +46,9 @@ buildPythonPackage rec {
   disabledTests = [
     # Tests require openssh_wrapper which is outdated and not available
     "test_repr_openssh"
+
+    # Test fails randomly
+    "test_timeout"
   ];
 
   pythonImportsCheck = [ "proxmoxer" ];

From 3f8526153283cd417c17066b169a2e6a371a505d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 12:44:32 +0000
Subject: [PATCH 143/181] erofs-utils: 1.8.9 -> 1.8.10

---
 pkgs/by-name/er/erofs-utils/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/er/erofs-utils/package.nix b/pkgs/by-name/er/erofs-utils/package.nix
index c89e8071a707..8b3d5c2a3a8c 100644
--- a/pkgs/by-name/er/erofs-utils/package.nix
+++ b/pkgs/by-name/er/erofs-utils/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "erofs-utils";
-  version = "1.8.9";
+  version = "1.8.10";
   outputs = [
     "out"
     "man"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${finalAttrs.version}.tar.gz";
-    hash = "sha256-FFpvf+SUGBTTAJnDVoRI03yBnM0DD8W/vKqyETTmF24=";
+    hash = "sha256-BetO3r4R3szm7LNOmNL4DIzSg8Lyln2Lp+/VhBhXBRQ=";
   };
 
   nativeBuildInputs = [

From c7801e49b128a5b004a9363134c8b201a58ed2f5 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Tue, 15 Jul 2025 14:45:49 +0200
Subject: [PATCH 144/181] nix: Only enable AWS when aws-c-common is available
 on the platform

---
 pkgs/tools/package-management/nix/common-autoconf.nix | 6 +++++-
 pkgs/tools/package-management/nix/common-meson.nix    | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/package-management/nix/common-autoconf.nix b/pkgs/tools/package-management/nix/common-autoconf.nix
index 4ad05d61d01b..a6e758467596 100644
--- a/pkgs/tools/package-management/nix/common-autoconf.nix
+++ b/pkgs/tools/package-management/nix/common-autoconf.nix
@@ -72,7 +72,11 @@ in
   xz,
   enableDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
   enableStatic ? stdenv.hostPlatform.isStatic,
-  withAWS ? !enableStatic && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
+  withAWS ?
+    lib.meta.availableOn stdenv.hostPlatform aws-c-common
+    && !enableStatic
+    && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
+  aws-c-common,
   aws-sdk-cpp,
   withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
   libseccomp,
diff --git a/pkgs/tools/package-management/nix/common-meson.nix b/pkgs/tools/package-management/nix/common-meson.nix
index 1e2bb73aef41..50e5c9fd060d 100644
--- a/pkgs/tools/package-management/nix/common-meson.nix
+++ b/pkgs/tools/package-management/nix/common-meson.nix
@@ -63,7 +63,11 @@ assert (hash == null) -> (src != null);
   xz,
   enableDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
   enableStatic ? stdenv.hostPlatform.isStatic,
-  withAWS ? !enableStatic && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
+  withAWS ?
+    lib.meta.availableOn stdenv.hostPlatform aws-c-common
+    && !enableStatic
+    && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
+  aws-c-common,
   aws-sdk-cpp,
   withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
   libseccomp,

From 5476187ffeb29440a10bd912e95686289c5a3e01 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 12:46:25 +0000
Subject: [PATCH 145/181] tlsx: 1.1.9 -> 1.2.0

---
 pkgs/by-name/tl/tlsx/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tl/tlsx/package.nix b/pkgs/by-name/tl/tlsx/package.nix
index 94cf073b1dd3..0da6965982fd 100644
--- a/pkgs/by-name/tl/tlsx/package.nix
+++ b/pkgs/by-name/tl/tlsx/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "tlsx";
-  version = "1.1.9";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "tlsx";
     tag = "v${version}";
-    hash = "sha256-u83hPmmiXH7SGCyINkHFrjNDLanwJLf0o9ZyceQeSg0=";
+    hash = "sha256-5ffJ7UzIP3qZoEAxJFGce5BaWHnkqtPnQOHpuJmQC50=";
   };
 
-  vendorHash = "sha256-NF05vVLBRlWQpmTfrNEjnvH7kZMhgY73xmSgTZ8FGmo=";
+  vendorHash = "sha256-hSCzpvciuI8zJgD2xgWTK+UiVthXgrPl6AeU/7QLg4c=";
 
   ldflags = [
     "-s"

From c3a86691ba8aebe32cedbfc72e3b738f2bf93a1f Mon Sep 17 00:00:00 2001
From: Yarny0 <41838844+Yarny0@users.noreply.github.com>
Date: Tue, 15 Jul 2025 15:01:07 +0200
Subject: [PATCH 146/181] zoom-us: drop `extraPreBwrapCmds` (`QT_PLUGIN_PATH` &
 `LANG`)

References/History:

* `unset LANG` was introduced in
  69ec89cd7a7a264fd55c6f1e8321d14ade9171df
  https://github.com/NixOS/nixpkgs/pull/410244
  for version 6.4.10.*,
  to restore the visually broken settings dialog.
  It seems no longer necessary as of version 6.5.1, cf.
  https://github.com/NixOS/nixpkgs/pull/419757#pullrequestreview-2959221263

* `unset QT_PLUGIN_PATH` was introduced in
  b747aa0f9fd6363975e90a82210275a12bfbb696
  https://github.com/NixOS/nixpkgs/pull/116355
  for version 5.5.7938.0228,
  to fix the display of the "Participants" list.
  In recent versions, it ensured that the avatar icons
  of persons (conference and team chat "Participants")
  are displayed correctly.
  It seems no longer necessary as of version 6.5.3.*, cf.
  https://github.com/NixOS/nixpkgs/pull/422532#pullrequestreview-2989636069
---
 pkgs/by-name/zo/zoom-us/package.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index 3c82cb82ff13..1e5ed8f386d8 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -245,10 +245,6 @@ let
     version = versions.${system} or throwSystem;
 
     targetPkgs = pkgs: (linuxGetDependencies pkgs) ++ [ unpacked ];
-    extraPreBwrapCmds = ''
-      unset QT_PLUGIN_PATH
-      unset LANG  # would break settings dialog on non-"en_XX" locales
-    '';
     extraBwrapArgs = [ "--ro-bind ${unpacked}/opt /opt" ];
     runScript = "/opt/zoom/ZoomLauncher";
 

From 1b1cb045a4e2f5f830488b5119707a83a2aa328b Mon Sep 17 00:00:00 2001
From: Yarny0 <41838844+Yarny0@users.noreply.github.com>
Date: Tue, 15 Jul 2025 15:01:12 +0200
Subject: [PATCH 147/181] zoom-us: maintainers := philiptaron & ryan2yin &
 yarny

---
 pkgs/by-name/zo/zoom-us/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index 1e5ed8f386d8..318eae02bd6c 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -152,8 +152,9 @@ let
       license = lib.licenses.unfree;
       platforms = builtins.attrNames srcs;
       maintainers = with lib.maintainers; [
-        danbst
-        tadfisher
+        philiptaron
+        ryan4yin
+        yarny
       ];
       mainProgram = "zoom";
     };

From e9d0c4af416f8a1847d87c80d62d72204879ce7e Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Tue, 15 Jul 2025 15:09:00 +0200
Subject: [PATCH 148/181] doc: adjust pnpm.fetchDeps parameter order

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 doc/languages-frameworks/javascript.section.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 166e0d4c7266..9dd2af41957e 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -443,8 +443,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "...";
     fetcherVersion = 2;
+    hash = "...";
   };
 })
 ```
@@ -568,8 +568,8 @@ This is the version of the output of `pnpm.fetchDeps`, if you haven't set it alr
   # ...
   pnpmDeps = pnpm.fetchDeps {
     # ...
-    hash = "..."; # you can use your already set hash here
     fetcherVersion = 1;
+    hash = "..."; # you can use your already set hash here
   };
 }
 ```
@@ -581,8 +581,8 @@ After upgrading to a newer `fetcherVersion`, you need to regenerate the hash:
   # ...
   pnpmDeps = pnpm.fetchDeps {
     # ...
-    hash = "..."; # clear this hash and generate a new one
     fetcherVersion = 2;
+    hash = "..."; # clear this hash and generate a new one
   };
 }
 ```

From a8c9a2aa3e2a3fe0762b4b08b12b0f398b2d57b5 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Mon, 14 Jul 2025 19:22:45 +0200
Subject: [PATCH 149/181] treewide: adjust pnpm.fetchDeps parameter order

It is more common to specify hash as the last attribute of fetcher
function args. Let's move fetcherVersion right above hash for all
occurrences.

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/applications/audio/youtube-music/default.nix             | 2 +-
 pkgs/by-name/ao/aonsoku/package.nix                           | 2 +-
 pkgs/by-name/ap/apache-answer/package.nix                     | 2 +-
 pkgs/by-name/ar/artalk/package.nix                            | 2 +-
 pkgs/by-name/as/astro-language-server/package.nix             | 2 +-
 pkgs/by-name/au/autobrr/package.nix                           | 2 +-
 pkgs/by-name/au/autoprefixer/package.nix                      | 2 +-
 pkgs/by-name/ba/backrest/package.nix                          | 2 +-
 pkgs/by-name/ba/bash-language-server/package.nix              | 2 +-
 pkgs/by-name/bu/bumpp/package.nix                             | 2 +-
 pkgs/by-name/ca/cargo-tauri/test-app.nix                      | 2 +-
 pkgs/by-name/cd/cdxgen/package.nix                            | 2 +-
 pkgs/by-name/cl/clash-verge-rev/unwrapped.nix                 | 2 +-
 pkgs/by-name/co/concurrently/package.nix                      | 2 +-
 pkgs/by-name/da/daed/package.nix                              | 2 +-
 pkgs/by-name/de/deltachat-desktop/package.nix                 | 2 +-
 pkgs/by-name/do/dorion/package.nix                            | 2 +-
 pkgs/by-name/em/emmet-language-server/package.nix             | 2 +-
 pkgs/by-name/en/en-croissant/package.nix                      | 2 +-
 pkgs/by-name/eq/equibop/package.nix                           | 2 +-
 pkgs/by-name/eq/equicord/package.nix                          | 2 +-
 pkgs/by-name/et/etherpad-lite/package.nix                     | 2 +-
 pkgs/by-name/fe/fedistar/package.nix                          | 2 +-
 pkgs/by-name/fi/filebrowser/package.nix                       | 2 +-
 pkgs/by-name/fi/firezone-gui-client/package.nix               | 2 +-
 pkgs/by-name/fi/firezone-server/package.nix                   | 2 +-
 pkgs/by-name/fl/flood/package.nix                             | 2 +-
 pkgs/by-name/fo/follow/package.nix                            | 2 +-
 pkgs/by-name/fr/froide/package.nix                            | 2 +-
 pkgs/by-name/gi/gitbutler/package.nix                         | 2 +-
 pkgs/by-name/gi/gitify/package.nix                            | 2 +-
 pkgs/by-name/go/goofcord/package.nix                          | 2 +-
 pkgs/by-name/gu/gui-for-clash/package.nix                     | 2 +-
 pkgs/by-name/gu/gui-for-singbox/package.nix                   | 2 +-
 pkgs/by-name/he/heroic-unwrapped/package.nix                  | 2 +-
 pkgs/by-name/ho/homebox/package.nix                           | 2 +-
 pkgs/by-name/ho/homepage-dashboard/package.nix                | 2 +-
 pkgs/by-name/ho/homer/package.nix                             | 2 +-
 pkgs/by-name/it/it-tools/package.nix                          | 2 +-
 pkgs/by-name/je/jellyseerr/package.nix                        | 2 +-
 pkgs/by-name/ka/karakeep/package.nix                          | 2 +-
 pkgs/by-name/le/legcord/package.nix                           | 2 +-
 pkgs/by-name/me/memos/package.nix                             | 2 +-
 pkgs/by-name/me/metacubexd/package.nix                        | 2 +-
 pkgs/by-name/mi/misskey/package.nix                           | 2 +-
 pkgs/by-name/mo/modrinth-app-unwrapped/package.nix            | 2 +-
 pkgs/by-name/mo/moonfire-nvr/package.nix                      | 2 +-
 pkgs/by-name/mo/moonlight/package.nix                         | 2 +-
 pkgs/by-name/n8/n8n/package.nix                               | 2 +-
 pkgs/by-name/ni/ni/package.nix                                | 2 +-
 pkgs/by-name/oc/ocis/package.nix                              | 2 +-
 pkgs/by-name/oc/ocis/web.nix                                  | 2 +-
 pkgs/by-name/op/opencloud/idp-web.nix                         | 2 +-
 pkgs/by-name/op/opencloud/web.nix                             | 2 +-
 pkgs/by-name/op/openlist/frontend.nix                         | 2 +-
 pkgs/by-name/ov/overlayed/package.nix                         | 2 +-
 pkgs/by-name/pa/paperless-ngx/package.nix                     | 2 +-
 pkgs/by-name/pa/parca/package.nix                             | 2 +-
 pkgs/by-name/pd/pds/package.nix                               | 2 +-
 pkgs/by-name/pg/pgrok/package.nix                             | 2 +-
 pkgs/by-name/pi/piped/package.nix                             | 2 +-
 pkgs/by-name/po/podman-desktop/package.nix                    | 2 +-
 pkgs/by-name/po/porn-vault/package.nix                        | 2 +-
 pkgs/by-name/po/pot/package.nix                               | 2 +-
 pkgs/by-name/pr/prisma/package.nix                            | 2 +-
 pkgs/by-name/qu/quantframe/package.nix                        | 2 +-
 pkgs/by-name/re/readest/package.nix                           | 2 +-
 pkgs/by-name/re/renovate/package.nix                          | 2 +-
 pkgs/by-name/rm/rmfakecloud/package.nix                       | 2 +-
 pkgs/by-name/rq/rquickshare/package.nix                       | 2 +-
 pkgs/by-name/rs/rsshub/package.nix                            | 2 +-
 pkgs/by-name/sa/satisfactorymodmanager/package.nix            | 2 +-
 pkgs/by-name/sh/shadcn/package.nix                            | 2 +-
 pkgs/by-name/sh/sharkey/package.nix                           | 2 +-
 pkgs/by-name/si/signal-desktop/package.nix                    | 4 ++--
 pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix           | 2 +-
 pkgs/by-name/si/siyuan/package.nix                            | 2 +-
 pkgs/by-name/sk/sketchybar-app-font/package.nix               | 2 +-
 pkgs/by-name/sl/slimevr/package.nix                           | 2 +-
 pkgs/by-name/sp/splayer/package.nix                           | 2 +-
 pkgs/by-name/st/stylelint-lsp/package.nix                     | 2 +-
 pkgs/by-name/su/surrealist/package.nix                        | 2 +-
 pkgs/by-name/sy/synchrony/package.nix                         | 2 +-
 pkgs/by-name/sy/syncyomi/package.nix                          | 2 +-
 pkgs/by-name/ta/tabby-agent/package.nix                       | 2 +-
 pkgs/by-name/ta/tailwindcss-language-server/package.nix       | 2 +-
 pkgs/by-name/ta/taler-wallet-core/package.nix                 | 2 +-
 pkgs/by-name/ta/taze/package.nix                              | 2 +-
 pkgs/by-name/te/teleport/package.nix                          | 2 +-
 pkgs/by-name/ts/tsx/package.nix                               | 2 +-
 pkgs/by-name/ty/typespec/package.nix                          | 2 +-
 pkgs/by-name/ve/vencord/package.nix                           | 2 +-
 pkgs/by-name/vi/vikunja/package.nix                           | 2 +-
 pkgs/by-name/vo/voicevox/package.nix                          | 2 +-
 pkgs/by-name/vt/vtsls/package.nix                             | 2 +-
 pkgs/by-name/we/wealthfolio/package.nix                       | 2 +-
 pkgs/by-name/wo/wox/package.nix                               | 2 +-
 pkgs/by-name/wr/wrangler/package.nix                          | 2 +-
 pkgs/by-name/za/zammad/package.nix                            | 2 +-
 pkgs/by-name/za/zashboard/package.nix                         | 2 +-
 pkgs/by-name/ze/zenn-cli/package.nix                          | 2 +-
 pkgs/by-name/zi/zigbee2mqtt_2/package.nix                     | 2 +-
 pkgs/by-name/zi/zipline/package.nix                           | 2 +-
 .../python-modules/django-filingcabinet/default.nix           | 2 +-
 pkgs/development/python-modules/gradio/default.nix            | 2 +-
 pkgs/servers/authelia/web.nix                                 | 2 +-
 .../custom-lovelace-modules/custom-sidebar/package.nix        | 2 +-
 pkgs/servers/web-apps/discourse/default.nix                   | 2 +-
 pkgs/servers/web-apps/lemmy/ui.nix                            | 2 +-
 109 files changed, 110 insertions(+), 110 deletions(-)

diff --git a/pkgs/applications/audio/youtube-music/default.nix b/pkgs/applications/audio/youtube-music/default.nix
index c89793a26ee0..05834c063e22 100644
--- a/pkgs/applications/audio/youtube-music/default.nix
+++ b/pkgs/applications/audio/youtube-music/default.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-xIQyTetHU37gTxCcQp4VCqzGdIfVQGy/aORCVba6YQ0=";
     fetcherVersion = 1;
+    hash = "sha256-xIQyTetHU37gTxCcQp4VCqzGdIfVQGy/aORCVba6YQ0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ao/aonsoku/package.nix b/pkgs/by-name/ao/aonsoku/package.nix
index b58573ad4aee..38bdf6850e86 100644
--- a/pkgs/by-name/ao/aonsoku/package.nix
+++ b/pkgs/by-name/ao/aonsoku/package.nix
@@ -27,8 +27,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # lockfileVersion: '6.0' need old pnpm
   pnpmDeps = pnpm_8.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-h1rcM+H2c0lk7bpGeQT5ue9bQIggrCFHkj4o7KxnH08=";
     fetcherVersion = 1;
+    hash = "sha256-h1rcM+H2c0lk7bpGeQT5ue9bQIggrCFHkj4o7KxnH08=";
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/ap/apache-answer/package.nix b/pkgs/by-name/ap/apache-answer/package.nix
index 5e657cf8f680..a3d0fa6fc285 100644
--- a/pkgs/by-name/ap/apache-answer/package.nix
+++ b/pkgs/by-name/ap/apache-answer/package.nix
@@ -28,8 +28,8 @@ buildGoModule rec {
     pnpmDeps = pnpm_9.fetchDeps {
       inherit src version pname;
       sourceRoot = "${src.name}/ui";
-      hash = "sha256-/se6IWeHdazqS7PzOpgtT4IxCJ1WptqBzZ/BdmGb4BA=";
       fetcherVersion = 1;
+      hash = "sha256-/se6IWeHdazqS7PzOpgtT4IxCJ1WptqBzZ/BdmGb4BA=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/ar/artalk/package.nix b/pkgs/by-name/ar/artalk/package.nix
index d0d94f2afa1c..407c76243483 100644
--- a/pkgs/by-name/ar/artalk/package.nix
+++ b/pkgs/by-name/ar/artalk/package.nix
@@ -33,8 +33,8 @@ let
 
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
-      hash = "sha256-QIfadS2gNPtH006O86EndY/Hx2ml2FoKfUXJF5qoluw=";
       fetcherVersion = 1;
+      hash = "sha256-QIfadS2gNPtH006O86EndY/Hx2ml2FoKfUXJF5qoluw=";
     };
 
     buildPhase = ''
diff --git a/pkgs/by-name/as/astro-language-server/package.nix b/pkgs/by-name/as/astro-language-server/package.nix
index c1d467284a0e..5ee70c8e2206 100644
--- a/pkgs/by-name/as/astro-language-server/package.nix
+++ b/pkgs/by-name/as/astro-language-server/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
       pnpmWorkspaces
       prePnpmInstall
       ;
-    hash = "sha256-tlpk+wbLjJqt37lu67p2A2RZAR1ZfnZFiYoqIQwvWPQ=";
     fetcherVersion = 1;
+    hash = "sha256-tlpk+wbLjJqt37lu67p2A2RZAR1ZfnZFiYoqIQwvWPQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/autobrr/package.nix b/pkgs/by-name/au/autobrr/package.nix
index b545937a1ddc..9f49e3e6f408 100644
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@@ -40,8 +40,8 @@ let
         src
         sourceRoot
         ;
-      hash = "sha256-TbdRJqLdNI7wchUsx2Kw1LlDyv50XlCiKyn6rhZyN1U=";
       fetcherVersion = 1;
+      hash = "sha256-TbdRJqLdNI7wchUsx2Kw1LlDyv50XlCiKyn6rhZyN1U=";
     };
 
     postBuild = ''
diff --git a/pkgs/by-name/au/autoprefixer/package.nix b/pkgs/by-name/au/autoprefixer/package.nix
index 31662f322b7e..7d98e6bf4b19 100644
--- a/pkgs/by-name/au/autoprefixer/package.nix
+++ b/pkgs/by-name/au/autoprefixer/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-zb/BwL//i0oly5HEXN20E3RzZXdaOn+G2yIWRas3PB4=";
     fetcherVersion = 1;
+    hash = "sha256-zb/BwL//i0oly5HEXN20E3RzZXdaOn+G2yIWRas3PB4=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ba/backrest/package.nix b/pkgs/by-name/ba/backrest/package.nix
index 55f1a97532d8..66c51c3bdf91 100644
--- a/pkgs/by-name/ba/backrest/package.nix
+++ b/pkgs/by-name/ba/backrest/package.nix
@@ -33,8 +33,8 @@ let
 
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
-      hash = "sha256-q7VMQb/FRT953yT2cyGMxUPp8p8XkA9mvqGI7S7Eifg=";
       fetcherVersion = 1;
+      hash = "sha256-q7VMQb/FRT953yT2cyGMxUPp8p8XkA9mvqGI7S7Eifg=";
     };
 
     buildPhase = ''
diff --git a/pkgs/by-name/ba/bash-language-server/package.nix b/pkgs/by-name/ba/bash-language-server/package.nix
index f03d0195e32c..ab6279ea88ba 100644
--- a/pkgs/by-name/ba/bash-language-server/package.nix
+++ b/pkgs/by-name/ba/bash-language-server/package.nix
@@ -28,8 +28,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       src
       pnpmWorkspaces
       ;
-    hash = "sha256-NvyqPv5OKgZi3hW98Da8LhsYatmrzrPX8kLOfLr+BrI=";
     fetcherVersion = 1;
+    hash = "sha256-NvyqPv5OKgZi3hW98Da8LhsYatmrzrPX8kLOfLr+BrI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bu/bumpp/package.nix b/pkgs/by-name/bu/bumpp/package.nix
index 3b05d5a65df2..4eda9b885e5d 100644
--- a/pkgs/by-name/bu/bumpp/package.nix
+++ b/pkgs/by-name/bu/bumpp/package.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-duxpym1DlJM4q5j0wmrubYiAHQ3cDEFfeD9Gyic6mbI=";
     fetcherVersion = 1;
+    hash = "sha256-duxpym1DlJM4q5j0wmrubYiAHQ3cDEFfeD9Gyic6mbI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/cargo-tauri/test-app.nix b/pkgs/by-name/ca/cargo-tauri/test-app.nix
index af0c230af635..67d17cece65c 100644
--- a/pkgs/by-name/ca/cargo-tauri/test-app.nix
+++ b/pkgs/by-name/ca/cargo-tauri/test-app.nix
@@ -34,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       ;
 
-    hash = "sha256-plANa/+9YEQ4ipgdQ7QzPyxgz6eDCBhO7qFlxK6Ab58=";
     fetcherVersion = 1;
+    hash = "sha256-plANa/+9YEQ4ipgdQ7QzPyxgz6eDCBhO7qFlxK6Ab58=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cd/cdxgen/package.nix b/pkgs/by-name/cd/cdxgen/package.nix
index 3fa6ec4c0a45..7baf4185d643 100644
--- a/pkgs/by-name/cd/cdxgen/package.nix
+++ b/pkgs/by-name/cd/cdxgen/package.nix
@@ -37,8 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-7NrDYd4H0cPQs8w4lWlB0BhqcYZVo6/9zf0ujPjBzsE=";
     fetcherVersion = 1;
+    hash = "sha256-7NrDYd4H0cPQs8w4lWlB0BhqcYZVo6/9zf0ujPjBzsE=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
index 42c311251c50..e434d832d736 100644
--- a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
@@ -37,8 +37,8 @@ rustPlatform.buildRustPackage {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = pnpm-hash;
     fetcherVersion = 1;
+    hash = pnpm-hash;
   };
 
   env = {
diff --git a/pkgs/by-name/co/concurrently/package.nix b/pkgs/by-name/co/concurrently/package.nix
index b89146d333c9..cdf9061c726b 100644
--- a/pkgs/by-name/co/concurrently/package.nix
+++ b/pkgs/by-name/co/concurrently/package.nix
@@ -29,8 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    hash = "sha256-F1teWIABkK0mqZcK3RdGNKmexI/C59QWSrrD1jYbHt0=";
     fetcherVersion = 1;
+    hash = "sha256-F1teWIABkK0mqZcK3RdGNKmexI/C59QWSrrD1jYbHt0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/da/daed/package.nix b/pkgs/by-name/da/daed/package.nix
index 618a7d85a16f..a6ebfd9ee257 100644
--- a/pkgs/by-name/da/daed/package.nix
+++ b/pkgs/by-name/da/daed/package.nix
@@ -27,8 +27,8 @@ let
 
     pnpmDeps = pnpm_9.fetchDeps {
       inherit pname version src;
-      hash = "sha256-+yLpSbDzr1OV/bmUUg6drOvK1ok3cBd+RRV7Qrrlp+Q=";
       fetcherVersion = 1;
+      hash = "sha256-+yLpSbDzr1OV/bmUUg6drOvK1ok3cBd+RRV7Qrrlp+Q=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/de/deltachat-desktop/package.nix b/pkgs/by-name/de/deltachat-desktop/package.nix
index 0f5992cd0bcb..ee3c55ae5a74 100644
--- a/pkgs/by-name/de/deltachat-desktop/package.nix
+++ b/pkgs/by-name/de/deltachat-desktop/package.nix
@@ -48,8 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-PBCmyNmlH88y5s7+8WHcei8SP3Q0lIAAnAQn9uaFxLc=";
     fetcherVersion = 1;
+    hash = "sha256-PBCmyNmlH88y5s7+8WHcei8SP3Q0lIAAnAQn9uaFxLc=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/do/dorion/package.nix b/pkgs/by-name/do/dorion/package.nix
index f8e3dba5d29b..99bc6259bfe8 100644
--- a/pkgs/by-name/do/dorion/package.nix
+++ b/pkgs/by-name/do/dorion/package.nix
@@ -59,8 +59,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-xBonUzA4+1zbViEsKap6CaG6ZRldW1LjNYIB+FmVRFs=";
     fetcherVersion = 1;
+    hash = "sha256-xBonUzA4+1zbViEsKap6CaG6ZRldW1LjNYIB+FmVRFs=";
   };
 
   # CMake (webkit extension)
diff --git a/pkgs/by-name/em/emmet-language-server/package.nix b/pkgs/by-name/em/emmet-language-server/package.nix
index dc2a8a8cff46..0a1c7bd9d69e 100644
--- a/pkgs/by-name/em/emmet-language-server/package.nix
+++ b/pkgs/by-name/em/emmet-language-server/package.nix
@@ -20,8 +20,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-hh5PEtmSHPs6QBgwWHS0laGU21e82JckIP3mB/P9/vE=";
     fetcherVersion = 1;
+    hash = "sha256-hh5PEtmSHPs6QBgwWHS0laGU21e82JckIP3mB/P9/vE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/en/en-croissant/package.nix b/pkgs/by-name/en/en-croissant/package.nix
index 86d89a85933e..a35536ad30f1 100644
--- a/pkgs/by-name/en/en-croissant/package.nix
+++ b/pkgs/by-name/en/en-croissant/package.nix
@@ -30,8 +30,8 @@ rustPlatform.buildRustPackage rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-hvWXSegUWJvwCU5NLb2vqnl+FIWpCLxw96s9NUIgJTI=";
     fetcherVersion = 1;
+    hash = "sha256-hvWXSegUWJvwCU5NLb2vqnl+FIWpCLxw96s9NUIgJTI=";
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/eq/equibop/package.nix b/pkgs/by-name/eq/equibop/package.nix
index 4da34c82565b..b52c61d53b76 100644
--- a/pkgs/by-name/eq/equibop/package.nix
+++ b/pkgs/by-name/eq/equibop/package.nix
@@ -39,8 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    hash = "sha256-laTyxRh54x3iopGVgoFtcgaV7R6IKux1O/+tzGEy0Fg=";
     fetcherVersion = 1;
+    hash = "sha256-laTyxRh54x3iopGVgoFtcgaV7R6IKux1O/+tzGEy0Fg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/eq/equicord/package.nix b/pkgs/by-name/eq/equicord/package.nix
index e0c5734b2ad5..11bf8e6e4226 100644
--- a/pkgs/by-name/eq/equicord/package.nix
+++ b/pkgs/by-name/eq/equicord/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-fjfzBy1Z7AUKA53yjjCQ6yasHc5QMaOBtXtXA5fNK5s=";
     fetcherVersion = 1;
+    hash = "sha256-fjfzBy1Z7AUKA53yjjCQ6yasHc5QMaOBtXtXA5fNK5s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/et/etherpad-lite/package.nix b/pkgs/by-name/et/etherpad-lite/package.nix
index cfccafa873c6..0d6e7dbb3e7e 100644
--- a/pkgs/by-name/et/etherpad-lite/package.nix
+++ b/pkgs/by-name/et/etherpad-lite/package.nix
@@ -31,8 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-n7LolizpKng7zzccytYoCwJ7uGQbMagsgYPDuq0mdxU=";
     fetcherVersion = 1;
+    hash = "sha256-n7LolizpKng7zzccytYoCwJ7uGQbMagsgYPDuq0mdxU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fe/fedistar/package.nix b/pkgs/by-name/fe/fedistar/package.nix
index ad1b4f3cce96..ba8866e2da0a 100644
--- a/pkgs/by-name/fe/fedistar/package.nix
+++ b/pkgs/by-name/fe/fedistar/package.nix
@@ -38,8 +38,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-xXVsjAXmrsOp+mXrYAxSKz4vX5JApLZ+Rh6hrYlnJDI=";
     fetcherVersion = 1;
+    hash = "sha256-xXVsjAXmrsOp+mXrYAxSKz4vX5JApLZ+Rh6hrYlnJDI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fi/filebrowser/package.nix b/pkgs/by-name/fi/filebrowser/package.nix
index e84c9dcd3c8b..5e4eaa2bfdab 100644
--- a/pkgs/by-name/fi/filebrowser/package.nix
+++ b/pkgs/by-name/fi/filebrowser/package.nix
@@ -37,8 +37,8 @@ let
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname version src;
       sourceRoot = "${src.name}/frontend";
-      hash = "sha256-vLOtVeGFeHXgQglvKsih4lj1uIs6wipwfo374viIq4I=";
       fetcherVersion = 1;
+      hash = "sha256-vLOtVeGFeHXgQglvKsih4lj1uIs6wipwfo374viIq4I=";
     };
 
     installPhase = ''
diff --git a/pkgs/by-name/fi/firezone-gui-client/package.nix b/pkgs/by-name/fi/firezone-gui-client/package.nix
index d586e1f9cfc4..9a95968f46dc 100644
--- a/pkgs/by-name/fi/firezone-gui-client/package.nix
+++ b/pkgs/by-name/fi/firezone-gui-client/package.nix
@@ -40,8 +40,8 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit pname version;
       src = "${src}/rust/gui-client";
-      hash = "sha256-ttbTYBuUv0vyiYzrFATF4x/zngsRXjuLPfL3qW2HEe4=";
       fetcherVersion = 1;
+      hash = "sha256-ttbTYBuUv0vyiYzrFATF4x/zngsRXjuLPfL3qW2HEe4=";
     };
     pnpmRoot = "rust/gui-client";
 
diff --git a/pkgs/by-name/fi/firezone-server/package.nix b/pkgs/by-name/fi/firezone-server/package.nix
index 549c272590b8..d1f835531a88 100644
--- a/pkgs/by-name/fi/firezone-server/package.nix
+++ b/pkgs/by-name/fi/firezone-server/package.nix
@@ -34,8 +34,8 @@ beamPackages.mixRelease rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version;
     src = "${src}/apps/web/assets";
-    hash = "sha256-ejyBppFtKeyVhAWmssglbpLleOnbw9d4B+iM5Vtx47A=";
     fetcherVersion = 1;
+    hash = "sha256-ejyBppFtKeyVhAWmssglbpLleOnbw9d4B+iM5Vtx47A=";
   };
   pnpmRoot = "apps/web/assets";
 
diff --git a/pkgs/by-name/fl/flood/package.nix b/pkgs/by-name/fl/flood/package.nix
index 8d561a278e23..263a20088c4b 100644
--- a/pkgs/by-name/fl/flood/package.nix
+++ b/pkgs/by-name/fl/flood/package.nix
@@ -22,8 +22,8 @@ buildNpmPackage rec {
   npmDeps = pnpmDeps;
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-E2VxRcOMLvvCQb9gCAGcBTsly571zh/HWM6Q1Zd2eVw=";
     fetcherVersion = 1;
+    hash = "sha256-E2VxRcOMLvvCQb9gCAGcBTsly571zh/HWM6Q1Zd2eVw=";
   };
 
   passthru = {
diff --git a/pkgs/by-name/fo/follow/package.nix b/pkgs/by-name/fo/follow/package.nix
index 2cbb1401ccb0..4d8459936084 100644
--- a/pkgs/by-name/fo/follow/package.nix
+++ b/pkgs/by-name/fo/follow/package.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-xNGLYzEz1G5sZSqmji+ItJ9D1vvZcwkkygnDeuypcIM=";
     fetcherVersion = 1;
+    hash = "sha256-xNGLYzEz1G5sZSqmji+ItJ9D1vvZcwkkygnDeuypcIM=";
   };
 
   env = {
diff --git a/pkgs/by-name/fr/froide/package.nix b/pkgs/by-name/fr/froide/package.nix
index b602b385a771..0219d4da8462 100644
--- a/pkgs/by-name/fr/froide/package.nix
+++ b/pkgs/by-name/fr/froide/package.nix
@@ -118,8 +118,8 @@ python.pkgs.buildPythonApplication rec {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-g7YX2fVXGmb3Qq9NNCb294bk4/0khcIZVSskYbE8Mdw=";
     fetcherVersion = 1;
+    hash = "sha256-g7YX2fVXGmb3Qq9NNCb294bk4/0khcIZVSskYbE8Mdw=";
   };
 
   postBuild = ''
diff --git a/pkgs/by-name/gi/gitbutler/package.nix b/pkgs/by-name/gi/gitbutler/package.nix
index b6741c04df1e..ba50b5ef3b25 100644
--- a/pkgs/by-name/gi/gitbutler/package.nix
+++ b/pkgs/by-name/gi/gitbutler/package.nix
@@ -64,8 +64,8 @@ rustPlatform.buildRustPackage rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-5NtfstUuIYyntt09Mu9GAFAOImfO6VMmJ7g15kvGaLE=";
     fetcherVersion = 1;
+    hash = "sha256-5NtfstUuIYyntt09Mu9GAFAOImfO6VMmJ7g15kvGaLE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/gitify/package.nix b/pkgs/by-name/gi/gitify/package.nix
index 48333f8312e1..6347600790f3 100644
--- a/pkgs/by-name/gi/gitify/package.nix
+++ b/pkgs/by-name/gi/gitify/package.nix
@@ -33,8 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-eIvqZ9a+foYH+jXuqGz1m/4C+0Xq8mTvm7ZajKeOw58=";
     fetcherVersion = 1;
+    hash = "sha256-eIvqZ9a+foYH+jXuqGz1m/4C+0Xq8mTvm7ZajKeOw58=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
diff --git a/pkgs/by-name/go/goofcord/package.nix b/pkgs/by-name/go/goofcord/package.nix
index 168a77c346a7..7e238de22f17 100644
--- a/pkgs/by-name/go/goofcord/package.nix
+++ b/pkgs/by-name/go/goofcord/package.nix
@@ -42,8 +42,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm'.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-8dSyU9arSvISc2kDWbg/CP6L4sZjZi/Zv7TZN4ONOjQ=";
     fetcherVersion = 1;
+    hash = "sha256-8dSyU9arSvISc2kDWbg/CP6L4sZjZi/Zv7TZN4ONOjQ=";
   };
 
   env = {
diff --git a/pkgs/by-name/gu/gui-for-clash/package.nix b/pkgs/by-name/gu/gui-for-clash/package.nix
index 0831f4c4d86f..a62b2a436281 100644
--- a/pkgs/by-name/gu/gui-for-clash/package.nix
+++ b/pkgs/by-name/gu/gui-for-clash/package.nix
@@ -43,8 +43,8 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/frontend";
-      hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
       fetcherVersion = 1;
+      hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
     };
 
     sourceRoot = "${finalAttrs.src.name}/frontend";
diff --git a/pkgs/by-name/gu/gui-for-singbox/package.nix b/pkgs/by-name/gu/gui-for-singbox/package.nix
index fae5157c6005..9dcde1a8f007 100644
--- a/pkgs/by-name/gu/gui-for-singbox/package.nix
+++ b/pkgs/by-name/gu/gui-for-singbox/package.nix
@@ -45,8 +45,8 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/frontend";
-      hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
       fetcherVersion = 1;
+      hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
     };
 
     sourceRoot = "${finalAttrs.src.name}/frontend";
diff --git a/pkgs/by-name/he/heroic-unwrapped/package.nix b/pkgs/by-name/he/heroic-unwrapped/package.nix
index d5dca60dbe20..466de55844c3 100644
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@@ -33,8 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-9WCIdQ91IU8pfq6kpbmmn6APBTNwpCi9ovgRuWYUad8=";
     fetcherVersion = 1;
+    hash = "sha256-9WCIdQ91IU8pfq6kpbmmn6APBTNwpCi9ovgRuWYUad8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ho/homebox/package.nix b/pkgs/by-name/ho/homebox/package.nix
index d2e40a060116..d3f0be14dfa1 100644
--- a/pkgs/by-name/ho/homebox/package.nix
+++ b/pkgs/by-name/ho/homebox/package.nix
@@ -38,8 +38,8 @@ buildGo123Module {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version;
     src = "${src}/frontend";
-    hash = "sha256-6Q+tIY5dl5jCQyv1F8btLdJg0oEUGs0Wyu/joVdVhf8=";
     fetcherVersion = 1;
+    hash = "sha256-6Q+tIY5dl5jCQyv1F8btLdJg0oEUGs0Wyu/joVdVhf8=";
   };
   pnpmRoot = "../frontend";
 
diff --git a/pkgs/by-name/ho/homepage-dashboard/package.nix b/pkgs/by-name/ho/homepage-dashboard/package.nix
index 95e0091061b4..e3dd75595a7b 100644
--- a/pkgs/by-name/ho/homepage-dashboard/package.nix
+++ b/pkgs/by-name/ho/homepage-dashboard/package.nix
@@ -50,8 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    hash = "sha256-aPkXHKG3vDsfYqYx9q9+2wZhuFqmPcXdoBqOfAvW9oA=";
     fetcherVersion = 1;
+    hash = "sha256-aPkXHKG3vDsfYqYx9q9+2wZhuFqmPcXdoBqOfAvW9oA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ho/homer/package.nix b/pkgs/by-name/ho/homer/package.nix
index 0eb47d64454f..e00c2327054e 100644
--- a/pkgs/by-name/ho/homer/package.nix
+++ b/pkgs/by-name/ho/homer/package.nix
@@ -25,8 +25,8 @@ stdenvNoCC.mkDerivation rec {
       src
       patches
       ;
-    hash = "sha256-y1R+rlaOtFOHHAgEHPBl40536U10Ft0iUSfGcfXS08Y=";
     fetcherVersion = 1;
+    hash = "sha256-y1R+rlaOtFOHHAgEHPBl40536U10Ft0iUSfGcfXS08Y=";
   };
 
   # Enables specifying a custom Sass compiler binary path via `SASS_EMBEDDED_BIN_PATH` environment variable.
diff --git a/pkgs/by-name/it/it-tools/package.nix b/pkgs/by-name/it/it-tools/package.nix
index 7c8bb989875a..de26c725090e 100644
--- a/pkgs/by-name/it/it-tools/package.nix
+++ b/pkgs/by-name/it/it-tools/package.nix
@@ -23,8 +23,8 @@ stdenv.mkDerivation rec {
 
   pnpmDeps = pnpm_8.fetchDeps {
     inherit pname version src;
-    hash = "sha256-m1eXBE5rakcq8NGnPC9clAAvNJQrN5RuSQ94zfgGZxw=";
     fetcherVersion = 1;
+    hash = "sha256-m1eXBE5rakcq8NGnPC9clAAvNJQrN5RuSQ94zfgGZxw=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/je/jellyseerr/package.nix b/pkgs/by-name/je/jellyseerr/package.nix
index 25804ba2c1ce..7351676250ce 100644
--- a/pkgs/by-name/je/jellyseerr/package.nix
+++ b/pkgs/by-name/je/jellyseerr/package.nix
@@ -28,8 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Ym16jPHMHKmojMQOuMamDsW/u+oP1UhbCP5dooTUzFQ=";
     fetcherVersion = 1;
+    hash = "sha256-Ym16jPHMHKmojMQOuMamDsW/u+oP1UhbCP5dooTUzFQ=";
   };
 
   buildInputs = [ sqlite ];
diff --git a/pkgs/by-name/ka/karakeep/package.nix b/pkgs/by-name/ka/karakeep/package.nix
index 1d63fdab3e5b..d901f1ad09e2 100644
--- a/pkgs/by-name/ka/karakeep/package.nix
+++ b/pkgs/by-name/ka/karakeep/package.nix
@@ -53,8 +53,8 @@ stdenv.mkDerivation (finalAttrs: {
       '';
     };
 
-    hash = "sha256-yf8A0oZ0Y4A5k7gfinIU02Lbqp/ygyvIBlldS0pv5+0=";
     fetcherVersion = 1;
+    hash = "sha256-yf8A0oZ0Y4A5k7gfinIU02Lbqp/ygyvIBlldS0pv5+0=";
   };
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/le/legcord/package.nix b/pkgs/by-name/le/legcord/package.nix
index e6568dc948c5..8ad3d679fd84 100644
--- a/pkgs/by-name/le/legcord/package.nix
+++ b/pkgs/by-name/le/legcord/package.nix
@@ -44,8 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-nobOORfhwlGEvNt+MfDKd3rXor6tJHDulz5oD1BGY4I=";
     fetcherVersion = 1;
+    hash = "sha256-nobOORfhwlGEvNt+MfDKd3rXor6tJHDulz5oD1BGY4I=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/me/memos/package.nix b/pkgs/by-name/me/memos/package.nix
index 97e48f88b0d9..517824d22319 100644
--- a/pkgs/by-name/me/memos/package.nix
+++ b/pkgs/by-name/me/memos/package.nix
@@ -61,8 +61,8 @@ let
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/web";
-      hash = "sha256-AyQYY1vtBB6DTcieC7nw5aOOVuwESJSDs8qU6PGyaTw=";
       fetcherVersion = 1;
+      hash = "sha256-AyQYY1vtBB6DTcieC7nw5aOOVuwESJSDs8qU6PGyaTw=";
     };
     pnpmRoot = "web";
     nativeBuildInputs = [
diff --git a/pkgs/by-name/me/metacubexd/package.nix b/pkgs/by-name/me/metacubexd/package.nix
index 9ebf3530a5e9..00c766368b23 100644
--- a/pkgs/by-name/me/metacubexd/package.nix
+++ b/pkgs/by-name/me/metacubexd/package.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Ct/YLnpZb0YBXVaghd5W1bmDcjVRladwQNRoLagHgJo=";
     fetcherVersion = 1;
+    hash = "sha256-Ct/YLnpZb0YBXVaghd5W1bmDcjVRladwQNRoLagHgJo=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/mi/misskey/package.nix b/pkgs/by-name/mi/misskey/package.nix
index 24eedc13aa62..e840b4491f51 100644
--- a/pkgs/by-name/mi/misskey/package.nix
+++ b/pkgs/by-name/mi/misskey/package.nix
@@ -37,8 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
   # https://nixos.org/manual/nixpkgs/unstable/#javascript-pnpm
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-T8LwpEjeWNmkIo3Dn1BCFHBsTzA/Dt6/pk/NMtvT0N4=";
     fetcherVersion = 1;
+    hash = "sha256-T8LwpEjeWNmkIo3Dn1BCFHBsTzA/Dt6/pk/NMtvT0N4=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
index 747b703ae64c..5f7a5f0cb9c9 100644
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@@ -36,8 +36,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Q6e942R+3+511qFe4oehxdquw1TgaWMyOGOmP3me54o=";
     fetcherVersion = 1;
+    hash = "sha256-Q6e942R+3+511qFe4oehxdquw1TgaWMyOGOmP3me54o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mo/moonfire-nvr/package.nix b/pkgs/by-name/mo/moonfire-nvr/package.nix
index f28324dac034..b661f9a1f07e 100644
--- a/pkgs/by-name/mo/moonfire-nvr/package.nix
+++ b/pkgs/by-name/mo/moonfire-nvr/package.nix
@@ -32,8 +32,8 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/ui";
-      hash = "sha256-7fMhUFlV5lz+A9VG8IdWoc49C2CTdLYQlEgBSBqJvtw=";
       fetcherVersion = 1;
+      hash = "sha256-7fMhUFlV5lz+A9VG8IdWoc49C2CTdLYQlEgBSBqJvtw=";
     };
     installPhase = ''
       runHook preInstall
diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index 12e4a6d63dab..ea7d0ad147f9 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     buildInputs = [ nodejs_22 ];
 
-    hash = "sha256-vrSfrAnLc30kba+8VOPawdp8KaQVUhsD6mUq+YdAJTY=";
     fetcherVersion = 1;
+    hash = "sha256-vrSfrAnLc30kba+8VOPawdp8KaQVUhsD6mUq+YdAJTY=";
   };
 
   env = {
diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 591307ed01be..046afbd33c40 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -28,8 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-HzJej2Mt110n+1KX0wzuAn6j69zQOzI42EGxQB6PYbc=";
     fetcherVersion = 1;
+    hash = "sha256-HzJej2Mt110n+1KX0wzuAn6j69zQOzI42EGxQB6PYbc=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/ni/ni/package.nix b/pkgs/by-name/ni/ni/package.nix
index c943ebba7215..7f2bf48eaa9f 100644
--- a/pkgs/by-name/ni/ni/package.nix
+++ b/pkgs/by-name/ni/ni/package.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-gDBjAwut217mdbWyk/dSU4JOkoRbOk4Czlb/lXhWqRU=";
     fetcherVersion = 1;
+    hash = "sha256-gDBjAwut217mdbWyk/dSU4JOkoRbOk4Czlb/lXhWqRU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/oc/ocis/package.nix b/pkgs/by-name/oc/ocis/package.nix
index a03c50f4734f..c00d6bb28f4c 100644
--- a/pkgs/by-name/oc/ocis/package.nix
+++ b/pkgs/by-name/oc/ocis/package.nix
@@ -50,8 +50,8 @@ buildGoModule rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     sourceRoot = "${src.name}/services/idp";
-    hash = "sha256-gNlN+u/bobnTsXrsOmkDcWs67D/trH3inT5AVQs3Brs=";
     fetcherVersion = 1;
+    hash = "sha256-gNlN+u/bobnTsXrsOmkDcWs67D/trH3inT5AVQs3Brs=";
   };
   pnpmRoot = "services/idp";
 
diff --git a/pkgs/by-name/oc/ocis/web.nix b/pkgs/by-name/oc/ocis/web.nix
index 14b407470371..73ae19b50409 100644
--- a/pkgs/by-name/oc/ocis/web.nix
+++ b/pkgs/by-name/oc/ocis/web.nix
@@ -36,8 +36,8 @@ stdenvNoCC.mkDerivation rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-3Erva6srdkX1YQ727trx34Ufx524nz19MUyaDQToz6M=";
     fetcherVersion = 1;
+    hash = "sha256-3Erva6srdkX1YQ727trx34Ufx524nz19MUyaDQToz6M=";
   };
 
   meta = {
diff --git a/pkgs/by-name/op/opencloud/idp-web.nix b/pkgs/by-name/op/opencloud/idp-web.nix
index 0671d2dddee0..bd481954f09d 100644
--- a/pkgs/by-name/op/opencloud/idp-web.nix
+++ b/pkgs/by-name/op/opencloud/idp-web.nix
@@ -16,8 +16,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
-    hash = "sha256-NW7HK2B9h5JprK3JcIGi/OHcyoa5VTs/P0s3BZr+4FU=";
     fetcherVersion = 1;
+    hash = "sha256-NW7HK2B9h5JprK3JcIGi/OHcyoa5VTs/P0s3BZr+4FU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
index 296fd81f55fb..3b2ab9c9661d 100644
--- a/pkgs/by-name/op/opencloud/web.nix
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -20,8 +20,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-vxZxwbJByTk45GDD2FNphMMdeLlF8uxyrlc9x42crNA=";
     fetcherVersion = 1;
+    hash = "sha256-vxZxwbJByTk45GDD2FNphMMdeLlF8uxyrlc9x42crNA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/openlist/frontend.nix b/pkgs/by-name/op/openlist/frontend.nix
index 28a8aff7ea19..6f0ac2f559c4 100644
--- a/pkgs/by-name/op/openlist/frontend.nix
+++ b/pkgs/by-name/op/openlist/frontend.nix
@@ -32,8 +32,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-PTZ+Vhg3hNnORnulkzuVg6TF/jY0PvUWYja9z7S4GdM=";
     fetcherVersion = 1;
+    hash = "sha256-PTZ+Vhg3hNnORnulkzuVg6TF/jY0PvUWYja9z7S4GdM=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/ov/overlayed/package.nix b/pkgs/by-name/ov/overlayed/package.nix
index 8aa00be38990..48068c6454c4 100644
--- a/pkgs/by-name/ov/overlayed/package.nix
+++ b/pkgs/by-name/ov/overlayed/package.nix
@@ -35,8 +35,8 @@ rustPlatform.buildRustPackage rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-+yyxoodcDfqJ2pkosd6sMk77/71RDsGthedo1Oigwto=";
     fetcherVersion = 1;
+    hash = "sha256-+yyxoodcDfqJ2pkosd6sMk77/71RDsGthedo1Oigwto=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index e3a29e4f5e05..dd50cf82562e 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -69,8 +69,8 @@ let
 
       pnpmDeps = pnpm.fetchDeps {
         inherit pname version src;
-        hash = "sha256-VtYYwpMXPAC3g1OESnw3dzLTwiGqJBQcicFZskEucok=";
         fetcherVersion = 1;
+        hash = "sha256-VtYYwpMXPAC3g1OESnw3dzLTwiGqJBQcicFZskEucok=";
       };
 
       nativeBuildInputs =
diff --git a/pkgs/by-name/pa/parca/package.nix b/pkgs/by-name/pa/parca/package.nix
index 7a32df1ea4f0..ef36a0be3aa5 100644
--- a/pkgs/by-name/pa/parca/package.nix
+++ b/pkgs/by-name/pa/parca/package.nix
@@ -24,8 +24,8 @@ let
 
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname src version;
-      hash = "sha256-gczEkCU9xESn9T1eVOmGAufh+24mOsYCMO6f5tcbdmQ=";
       fetcherVersion = 1;
+      hash = "sha256-gczEkCU9xESn9T1eVOmGAufh+24mOsYCMO6f5tcbdmQ=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/pd/pds/package.nix b/pkgs/by-name/pd/pds/package.nix
index 5fdc7aaea121..efc4fdf95d0f 100644
--- a/pkgs/by-name/pd/pds/package.nix
+++ b/pkgs/by-name/pd/pds/package.nix
@@ -50,8 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-KyHa7pZaCgyqzivI0Y7E6Y4yBRllYdYLnk1s0o0dyHY=";
     fetcherVersion = 1;
+    hash = "sha256-KyHa7pZaCgyqzivI0Y7E6Y4yBRllYdYLnk1s0o0dyHY=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/pg/pgrok/package.nix b/pkgs/by-name/pg/pgrok/package.nix
index 7dc9a44a034f..cff0a849af48 100644
--- a/pkgs/by-name/pg/pgrok/package.nix
+++ b/pkgs/by-name/pg/pgrok/package.nix
@@ -33,8 +33,8 @@ buildGoModule {
 
   env.pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-o6wxO8EGRmhcYggJnfxDkH+nbt+isc8bfHji8Hu9YKg=";
     fetcherVersion = 1;
+    hash = "sha256-o6wxO8EGRmhcYggJnfxDkH+nbt+isc8bfHji8Hu9YKg=";
   };
 
   vendorHash = "sha256-nIxsG1O5RG+PDSWBcUWpk+4aFq2cYaxpkgOoDqLjY90=";
diff --git a/pkgs/by-name/pi/piped/package.nix b/pkgs/by-name/pi/piped/package.nix
index 374063af3be6..8bb53c6754c7 100644
--- a/pkgs/by-name/pi/piped/package.nix
+++ b/pkgs/by-name/pi/piped/package.nix
@@ -28,8 +28,8 @@ buildNpmPackage rec {
   npmDeps = pnpmDeps;
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-WtZfRZFRV9I1iBlAoV69GGFjdiQhTSBG/iiEadPVcys=";
     fetcherVersion = 1;
+    hash = "sha256-WtZfRZFRV9I1iBlAoV69GGFjdiQhTSBG/iiEadPVcys=";
   };
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index 2a84d1d207e2..d201751f4847 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -60,8 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-8lNmCLfuAkXK1Du4iYYasRTozZf0HoAttf8Dfc6Jglw=";
     fetcherVersion = 1;
+    hash = "sha256-8lNmCLfuAkXK1Du4iYYasRTozZf0HoAttf8Dfc6Jglw=";
   };
 
   patches = [
diff --git a/pkgs/by-name/po/porn-vault/package.nix b/pkgs/by-name/po/porn-vault/package.nix
index 7dd5e251116c..fb0a58df550f 100644
--- a/pkgs/by-name/po/porn-vault/package.nix
+++ b/pkgs/by-name/po/porn-vault/package.nix
@@ -51,8 +51,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Xr9tRiP1hW+aFs9FnPvPkeJ0/LtJI57cjWY5bZQaRTQ=";
     fetcherVersion = 1;
+    hash = "sha256-Xr9tRiP1hW+aFs9FnPvPkeJ0/LtJI57cjWY5bZQaRTQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/pot/package.nix b/pkgs/by-name/po/pot/package.nix
index 5a1c84fba77c..a31500b0f309 100644
--- a/pkgs/by-name/po/pot/package.nix
+++ b/pkgs/by-name/po/pot/package.nix
@@ -41,8 +41,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-iYQNGRWqXYBU+WIH/Xm8qndgOQ6RKYCtAyi93kb7xrQ=";
     fetcherVersion = 1;
+    hash = "sha256-iYQNGRWqXYBU+WIH/Xm8qndgOQ6RKYCtAyi93kb7xrQ=";
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/pr/prisma/package.nix b/pkgs/by-name/pr/prisma/package.nix
index 3bcae8fba8be..cecab11fc8b2 100644
--- a/pkgs/by-name/pr/prisma/package.nix
+++ b/pkgs/by-name/pr/prisma/package.nix
@@ -32,8 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-dhEpn0oaqZqeiRMfcSiaqhud/RsKd6Wm5RR5iyQp1I8=";
     fetcherVersion = 1;
+    hash = "sha256-dhEpn0oaqZqeiRMfcSiaqhud/RsKd6Wm5RR5iyQp1I8=";
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/qu/quantframe/package.nix b/pkgs/by-name/qu/quantframe/package.nix
index 6a622cb21655..a6a70280fb89 100644
--- a/pkgs/by-name/qu/quantframe/package.nix
+++ b/pkgs/by-name/qu/quantframe/package.nix
@@ -41,8 +41,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-3IHwwbl1aH3Pzh9xq2Jfev9hj6/LXZaVaIJOPbgsquE=";
     fetcherVersion = 1;
+    hash = "sha256-3IHwwbl1aH3Pzh9xq2Jfev9hj6/LXZaVaIJOPbgsquE=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index 3639341555ac..c57caf5b135d 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -39,8 +39,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-lez75n3dIM4efpP+qPuDteCfMnC6wPD+L2173iJbTZM=";
     fetcherVersion = 1;
+    hash = "sha256-lez75n3dIM4efpP+qPuDteCfMnC6wPD+L2173iJbTZM=";
   };
 
   pnpmRoot = "../..";
diff --git a/pkgs/by-name/re/renovate/package.nix b/pkgs/by-name/re/renovate/package.nix
index daff959eeca6..02cce1cf0d22 100644
--- a/pkgs/by-name/re/renovate/package.nix
+++ b/pkgs/by-name/re/renovate/package.nix
@@ -39,8 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-XOlFJFFyzbx8Bg92HXhVFFCI51j2GUK7+LJKfqVOQyU=";
     fetcherVersion = 1;
+    hash = "sha256-XOlFJFFyzbx8Bg92HXhVFFCI51j2GUK7+LJKfqVOQyU=";
   };
 
   env.COREPACK_ENABLE_STRICT = 0;
diff --git a/pkgs/by-name/rm/rmfakecloud/package.nix b/pkgs/by-name/rm/rmfakecloud/package.nix
index da58d05dbad6..44a994a66945 100644
--- a/pkgs/by-name/rm/rmfakecloud/package.nix
+++ b/pkgs/by-name/rm/rmfakecloud/package.nix
@@ -28,8 +28,8 @@ buildGoModule rec {
     inherit pname version src;
     sourceRoot = "${src.name}/ui";
     pnpmLock = "${src}/ui/pnpm-lock.yaml";
-    hash = "sha256-VNmCT4um2W2ii8jAm+KjQSjixYEKoZkw7CeRwErff/o=";
     fetcherVersion = 1;
+    hash = "sha256-VNmCT4um2W2ii8jAm+KjQSjixYEKoZkw7CeRwErff/o=";
   };
   preBuild = lib.optionals enableWebui ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart
diff --git a/pkgs/by-name/rq/rquickshare/package.nix b/pkgs/by-name/rq/rquickshare/package.nix
index a1fcb7c53e1d..855afe4e3a81 100644
--- a/pkgs/by-name/rq/rquickshare/package.nix
+++ b/pkgs/by-name/rq/rquickshare/package.nix
@@ -64,8 +64,8 @@ rustPlatform.buildRustPackage rec {
       patches
       ;
     postPatch = "cd ${pnpmRoot}";
-    hash = app-type-either "sha256-V46V/VPwCKEe3sAp8zK0UUU5YigqgYh1GIOorqIAiNE=" "sha256-8QRigYNtxirXidFFnTzA6rP0+L64M/iakPqe2lZKegs=";
     fetcherVersion = 1;
+    hash = app-type-either "sha256-V46V/VPwCKEe3sAp8zK0UUU5YigqgYh1GIOorqIAiNE=" "sha256-8QRigYNtxirXidFFnTzA6rP0+L64M/iakPqe2lZKegs=";
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/rs/rsshub/package.nix b/pkgs/by-name/rs/rsshub/package.nix
index d9121ef6d829..e47927a02a74 100644
--- a/pkgs/by-name/rs/rsshub/package.nix
+++ b/pkgs/by-name/rs/rsshub/package.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-7qh6YZbIH/kHVssDZxHY7X8bytrnMcUq0MiJzWZYItc=";
     fetcherVersion = 1;
+    hash = "sha256-7qh6YZbIH/kHVssDZxHY7X8bytrnMcUq0MiJzWZYItc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sa/satisfactorymodmanager/package.nix b/pkgs/by-name/sa/satisfactorymodmanager/package.nix
index bdb1fa77f346..248a1b3fe428 100644
--- a/pkgs/by-name/sa/satisfactorymodmanager/package.nix
+++ b/pkgs/by-name/sa/satisfactorymodmanager/package.nix
@@ -55,8 +55,8 @@ buildGoModule rec {
     pnpmDeps = pnpm_8.fetchDeps {
       inherit pname version src;
       sourceRoot = "${src.name}/frontend";
-      hash = "sha256-OP+3zsNlvqLFwvm2cnBd2bj2Kc3EghQZE3hpotoqqrQ=";
       fetcherVersion = 1;
+      hash = "sha256-OP+3zsNlvqLFwvm2cnBd2bj2Kc3EghQZE3hpotoqqrQ=";
     };
 
     pnpmRoot = "frontend";
diff --git a/pkgs/by-name/sh/shadcn/package.nix b/pkgs/by-name/sh/shadcn/package.nix
index 02f73aace615..bece7c8a189c 100644
--- a/pkgs/by-name/sh/shadcn/package.nix
+++ b/pkgs/by-name/sh/shadcn/package.nix
@@ -28,8 +28,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       src
       pnpmWorkspaces
       ;
-    hash = "sha256-/80LJm65ZRqyfhsNqGl83bsI2wjgVkvrA6Ij4v8rtoQ=";
     fetcherVersion = 1;
+    hash = "sha256-/80LJm65ZRqyfhsNqGl83bsI2wjgVkvrA6Ij4v8rtoQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sh/sharkey/package.nix b/pkgs/by-name/sh/sharkey/package.nix
index c3572f5e278c..babb5feb38d7 100644
--- a/pkgs/by-name/sh/sharkey/package.nix
+++ b/pkgs/by-name/sh/sharkey/package.nix
@@ -34,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-S8LxawbtguFOEZyYbS1FQWw/TcRm4Z6mG7dUhfXbf1c=";
     fetcherVersion = 1;
+    hash = "sha256-S8LxawbtguFOEZyYbS1FQWw/TcRm4Z6mG7dUhfXbf1c=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index a0a2fcc0baeb..86ec124538fb 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -68,8 +68,8 @@ let
 
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname src version;
-      hash = "sha256-cT7Ixl/V/mesPHvJUsG63Y/wXwKjbjkjdjP3S7uEOa0=";
       fetcherVersion = 1;
+      hash = "sha256-cT7Ixl/V/mesPHvJUsG63Y/wXwKjbjkjdjP3S7uEOa0=";
     };
 
     strictDeps = true;
@@ -119,12 +119,12 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
+    fetcherVersion = 1;
     hash =
       if withAppleEmojis then
         "sha256-ry7s9fbKx4e1LR8DlI2LIJY9GQrxmU7JQt+3apJGw/M="
       else
         "sha256-AkrfugpNvk4KgesRLQbso8p5b96Dg174R9/xuP4JtJg=";
-    fetcherVersion = 1;
   };
 
   env = {
diff --git a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
index 14f9e1866e55..a71e8dffdb56 100644
--- a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
@@ -22,8 +22,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-regaYG+SDvIgdnHQVR1GG1A1FSBXpzFfLuyTEdMt1kQ=";
     fetcherVersion = 1;
+    hash = "sha256-regaYG+SDvIgdnHQVR1GG1A1FSBXpzFfLuyTEdMt1kQ=";
   };
 
   cargoRoot = "deps/extension";
diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index dc85f15bd48b..bc33bcaf5758 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -96,8 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
       sourceRoot
       postPatch
       ;
-    hash = "sha256-eSf4mpKBm1G4K9+V6VXEiPrIVQMyru7o9BGVIUycQaQ=";
     fetcherVersion = 1;
+    hash = "sha256-eSf4mpKBm1G4K9+V6VXEiPrIVQMyru7o9BGVIUycQaQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";
diff --git a/pkgs/by-name/sk/sketchybar-app-font/package.nix b/pkgs/by-name/sk/sketchybar-app-font/package.nix
index 481d59136084..4bf819c1cbd5 100644
--- a/pkgs/by-name/sk/sketchybar-app-font/package.nix
+++ b/pkgs/by-name/sk/sketchybar-app-font/package.nix
@@ -20,8 +20,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-NGAgueJ+cuK/csjdf94KNklu+Xf91BHoWKVgEctX6eA=";
     fetcherVersion = 1;
+    hash = "sha256-NGAgueJ+cuK/csjdf94KNklu+Xf91BHoWKVgEctX6eA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sl/slimevr/package.nix b/pkgs/by-name/sl/slimevr/package.nix
index 2d82414032bf..2c6daec2e1ef 100644
--- a/pkgs/by-name/sl/slimevr/package.nix
+++ b/pkgs/by-name/sl/slimevr/package.nix
@@ -39,8 +39,8 @@ rustPlatform.buildRustPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     pname = "${pname}-pnpm-deps";
     inherit version src;
-    hash = "sha256-lh5IKdBXuH9GZFUTrzaQFDWCEYj0UJhKwCdPmsiwfCs=";
     fetcherVersion = 1;
+    hash = "sha256-lh5IKdBXuH9GZFUTrzaQFDWCEYj0UJhKwCdPmsiwfCs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/splayer/package.nix b/pkgs/by-name/sp/splayer/package.nix
index 9e405aaacbc0..f7213eb5bd83 100644
--- a/pkgs/by-name/sp/splayer/package.nix
+++ b/pkgs/by-name/sp/splayer/package.nix
@@ -26,8 +26,8 @@ stdenv.mkDerivation (final: {
 
   pnpmDeps = final.pnpm.fetchDeps {
     inherit (final) pname version src;
-    hash = "sha256-mC1iJtkZpTd2Vte5DLI3ntZ7vSO5Gka2qOk7ihQd3Gs=";
     fetcherVersion = 1;
+    hash = "sha256-mC1iJtkZpTd2Vte5DLI3ntZ7vSO5Gka2qOk7ihQd3Gs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/stylelint-lsp/package.nix b/pkgs/by-name/st/stylelint-lsp/package.nix
index 06fb4c4d3d24..6fc0ac292506 100644
--- a/pkgs/by-name/st/stylelint-lsp/package.nix
+++ b/pkgs/by-name/st/stylelint-lsp/package.nix
@@ -28,8 +28,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-PVA6sXbiuxqvi9u3sPoeVIJSSpSbFQHQQnTFO3w31WE=";
     fetcherVersion = 1;
+    hash = "sha256-PVA6sXbiuxqvi9u3sPoeVIJSSpSbFQHQQnTFO3w31WE=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/su/surrealist/package.nix b/pkgs/by-name/su/surrealist/package.nix
index 87df89375c41..3ebb574901be 100644
--- a/pkgs/by-name/su/surrealist/package.nix
+++ b/pkgs/by-name/su/surrealist/package.nix
@@ -66,8 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-oreeV9g16/F7JGLApi0Uq+vTqNhIg7Lg1Z4k00RUOYI=";
     fetcherVersion = 1;
+    hash = "sha256-oreeV9g16/F7JGLApi0Uq+vTqNhIg7Lg1Z4k00RUOYI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sy/synchrony/package.nix b/pkgs/by-name/sy/synchrony/package.nix
index bae597725037..21ed6c385e09 100644
--- a/pkgs/by-name/sy/synchrony/package.nix
+++ b/pkgs/by-name/sy/synchrony/package.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-+hS4UK7sncCxv6o5Yl72AeY+LSGLnUTnKosAYB6QsP0=";
     fetcherVersion = 1;
+    hash = "sha256-+hS4UK7sncCxv6o5Yl72AeY+LSGLnUTnKosAYB6QsP0=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/sy/syncyomi/package.nix b/pkgs/by-name/sy/syncyomi/package.nix
index b3944784c853..21a7e6bc5211 100644
--- a/pkgs/by-name/sy/syncyomi/package.nix
+++ b/pkgs/by-name/sy/syncyomi/package.nix
@@ -33,8 +33,8 @@ buildGoModule rec {
         src
         sourceRoot
         ;
-      hash = "sha256-edcZIqshnvM3jJpZWIR/UncI0VCMLq26h/n3VvV/384=";
       fetcherVersion = 1;
+      hash = "sha256-edcZIqshnvM3jJpZWIR/UncI0VCMLq26h/n3VvV/384=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/tabby-agent/package.nix b/pkgs/by-name/ta/tabby-agent/package.nix
index 271e4dd38cab..ea316cd13f0e 100644
--- a/pkgs/by-name/ta/tabby-agent/package.nix
+++ b/pkgs/by-name/ta/tabby-agent/package.nix
@@ -48,8 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-SiJJxRzmKQxqw3UESN7q+3qkU1nK+7z6K5RpIMRRces=";
     fetcherVersion = 1;
+    hash = "sha256-SiJJxRzmKQxqw3UESN7q+3qkU1nK+7z6K5RpIMRRces=";
   };
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/by-name/ta/tailwindcss-language-server/package.nix b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
index c543ed0803c9..1d769564d0bc 100644
--- a/pkgs/by-name/ta/tailwindcss-language-server/package.nix
+++ b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       pnpmWorkspaces
       ;
-    hash = "sha256-SUEq20gZCiTDkFuNgMc5McHBPgW++8P9Q1MJb7a7pY8=";
     fetcherVersion = 1;
+    hash = "sha256-SUEq20gZCiTDkFuNgMc5McHBPgW++8P9Q1MJb7a7pY8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/taler-wallet-core/package.nix b/pkgs/by-name/ta/taler-wallet-core/package.nix
index eb86a73f1a0c..313bd567b98b 100644
--- a/pkgs/by-name/ta/taler-wallet-core/package.nix
+++ b/pkgs/by-name/ta/taler-wallet-core/package.nix
@@ -56,8 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-pLe5smsXdzSBgz/OYNO5FVEI2L6y/p+jMxEkzqUaX34=";
     fetcherVersion = 1;
+    hash = "sha256-pLe5smsXdzSBgz/OYNO5FVEI2L6y/p+jMxEkzqUaX34=";
   };
 
   buildInputs = [ nodejs_20 ];
diff --git a/pkgs/by-name/ta/taze/package.nix b/pkgs/by-name/ta/taze/package.nix
index 76c9b8b8560b..a4bd2fe26c45 100644
--- a/pkgs/by-name/ta/taze/package.nix
+++ b/pkgs/by-name/ta/taze/package.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-aUMV2REINp5LDcj1s8bgQAj/4508UEewu+ebD+JT0+M=";
     fetcherVersion = 1;
+    hash = "sha256-aUMV2REINp5LDcj1s8bgQAj/4508UEewu+ebD+JT0+M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/teleport/package.nix b/pkgs/by-name/te/teleport/package.nix
index 4b3667ba21e3..0058ebc0b571 100644
--- a/pkgs/by-name/te/teleport/package.nix
+++ b/pkgs/by-name/te/teleport/package.nix
@@ -73,8 +73,8 @@ let
 
     pnpmDeps = pnpm_10.fetchDeps {
       inherit src pname version;
-      hash = pnpmHash;
       fetcherVersion = 1;
+      hash = pnpmHash;
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/ts/tsx/package.nix b/pkgs/by-name/ts/tsx/package.nix
index 43e081b470d2..faa25ee6f5a1 100644
--- a/pkgs/by-name/ts/tsx/package.nix
+++ b/pkgs/by-name/ts/tsx/package.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-57KDZ9cHb7uqnypC0auIltmYMmIhs4PWyf0HTRWEFiU=";
     fetcherVersion = 1;
+    hash = "sha256-57KDZ9cHb7uqnypC0auIltmYMmIhs4PWyf0HTRWEFiU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ty/typespec/package.nix b/pkgs/by-name/ty/typespec/package.nix
index d78bc9ebd677..df0d3ca91eb9 100644
--- a/pkgs/by-name/ty/typespec/package.nix
+++ b/pkgs/by-name/ty/typespec/package.nix
@@ -38,8 +38,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       pnpmWorkspaces
       postPatch
       ;
-    hash = "sha256-9RQZ2ycu78W3Ie6MLpo6x7Sa/iYsUdq5bYed56mOPxs=";
     fetcherVersion = 1;
+    hash = "sha256-9RQZ2ycu78W3Ie6MLpo6x7Sa/iYsUdq5bYed56mOPxs=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 440ebab7b0c6..bd467cd0a099 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname src;
-    hash = "sha256-hO6QKRr4jTfesRDAEGcpFeJmGTGLGMw6EgIvD23DNzw=";
     fetcherVersion = 1;
+    hash = "sha256-hO6QKRr4jTfesRDAEGcpFeJmGTGLGMw6EgIvD23DNzw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vi/vikunja/package.nix b/pkgs/by-name/vi/vikunja/package.nix
index c703e6eca8f9..89200906e53b 100644
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -36,8 +36,8 @@ let
         src
         sourceRoot
         ;
-      hash = "sha256-94ZlywOZYmW/NsvE0dtEA81MeBWGUrJsBXTUauuOmZM=";
       fetcherVersion = 1;
+      hash = "sha256-94ZlywOZYmW/NsvE0dtEA81MeBWGUrJsBXTUauuOmZM=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/vo/voicevox/package.nix b/pkgs/by-name/vo/voicevox/package.nix
index 9b373173828d..dde014b43e85 100644
--- a/pkgs/by-name/vo/voicevox/package.nix
+++ b/pkgs/by-name/vo/voicevox/package.nix
@@ -64,8 +64,8 @@ stdenv.mkDerivation (finalAttrs: {
       moreutils
     ];
 
-    hash = "sha256-RKgqFmHQnjHS7yeUIbH9awpNozDOCCHplc/bmfxmMyg=";
     fetcherVersion = 1;
+    hash = "sha256-RKgqFmHQnjHS7yeUIbH9awpNozDOCCHplc/bmfxmMyg=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/vt/vtsls/package.nix b/pkgs/by-name/vt/vtsls/package.nix
index 4aba8fa0a226..851fdbc30491 100644
--- a/pkgs/by-name/vt/vtsls/package.nix
+++ b/pkgs/by-name/vt/vtsls/package.nix
@@ -40,8 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       version
       ;
-    hash = "sha256-SdqeTYRH60CyU522+nBo0uCDnzxDP48eWBAtGTL/pqg=";
     fetcherVersion = 1;
+    hash = "sha256-SdqeTYRH60CyU522+nBo0uCDnzxDP48eWBAtGTL/pqg=";
   };
 
   # Patches to get submodule sha from file instead of 'git submodule status'
diff --git a/pkgs/by-name/we/wealthfolio/package.nix b/pkgs/by-name/we/wealthfolio/package.nix
index 42bfe5434ca1..31b6c06ef864 100644
--- a/pkgs/by-name/we/wealthfolio/package.nix
+++ b/pkgs/by-name/we/wealthfolio/package.nix
@@ -29,8 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) src pname version;
-    hash = "sha256-KupqObdNrnWbbt9C4NNmgmQCfJ2O4FjJBwGy6XQhhHg=";
     fetcherVersion = 1;
+    hash = "sha256-KupqObdNrnWbbt9C4NNmgmQCfJ2O4FjJBwGy6XQhhHg=";
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/wo/wox/package.nix b/pkgs/by-name/wo/wox/package.nix
index cb5987089024..f06e7652d6aa 100644
--- a/pkgs/by-name/wo/wox/package.nix
+++ b/pkgs/by-name/wo/wox/package.nix
@@ -74,8 +74,8 @@ let
         src
         sourceRoot
         ;
-      hash = "sha256-4Xj6doUHFoZSwel+cPnr2m3rfvlxNmQCppm5gXGIEtU=";
       fetcherVersion = 1;
+      hash = "sha256-4Xj6doUHFoZSwel+cPnr2m3rfvlxNmQCppm5gXGIEtU=";
     };
 
     buildPhase = ''
diff --git a/pkgs/by-name/wr/wrangler/package.nix b/pkgs/by-name/wr/wrangler/package.nix
index d1cf0d4f75bb..01cc0714480b 100644
--- a/pkgs/by-name/wr/wrangler/package.nix
+++ b/pkgs/by-name/wr/wrangler/package.nix
@@ -33,8 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       postPatch
       ;
-    hash = "sha256-r3QswmqP6CNufnsFM0KeKojm/HjHogrfYO/TdL3SrmA=";
     fetcherVersion = 1;
+    hash = "sha256-r3QswmqP6CNufnsFM0KeKojm/HjHogrfYO/TdL3SrmA=";
   };
   # pnpm packageManager version in workers-sdk root package.json may not match nixpkgs
   postPatch = ''
diff --git a/pkgs/by-name/za/zammad/package.nix b/pkgs/by-name/za/zammad/package.nix
index 16d9dd41c465..062c8842d1e1 100644
--- a/pkgs/by-name/za/zammad/package.nix
+++ b/pkgs/by-name/za/zammad/package.nix
@@ -81,8 +81,8 @@ stdenvNoCC.mkDerivation {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname src;
 
-    hash = "sha256-mfdzb/LXQYL8kaQpWi9wD3OOroOOonDlJrhy9Dwl1no";
     fetcherVersion = 1;
+    hash = "sha256-mfdzb/LXQYL8kaQpWi9wD3OOroOOonDlJrhy9Dwl1no";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/za/zashboard/package.nix b/pkgs/by-name/za/zashboard/package.nix
index 99921816e3eb..3b4b13a362fb 100644
--- a/pkgs/by-name/za/zashboard/package.nix
+++ b/pkgs/by-name/za/zashboard/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-aiSZS6FEs7kqGXxC9Tx6Rngv3qrPMi5gOuh5Z3/oZyc=";
     fetcherVersion = 1;
+    hash = "sha256-aiSZS6FEs7kqGXxC9Tx6Rngv3qrPMi5gOuh5Z3/oZyc=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/ze/zenn-cli/package.nix b/pkgs/by-name/ze/zenn-cli/package.nix
index 9f1a07298756..092748bd6de7 100644
--- a/pkgs/by-name/ze/zenn-cli/package.nix
+++ b/pkgs/by-name/ze/zenn-cli/package.nix
@@ -56,8 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-AjdXclrNl1AHJ4LXq9I5Rk6KGyDaWXW187o2uLwRy/o=";
     fetcherVersion = 1;
+    hash = "sha256-AjdXclrNl1AHJ4LXq9I5Rk6KGyDaWXW187o2uLwRy/o=";
   };
 
   preBuild =
diff --git a/pkgs/by-name/zi/zigbee2mqtt_2/package.nix b/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
index eb0c4c21d2b5..4320ede7126d 100644
--- a/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
@@ -27,8 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-OPfs9WiUehKPaAqqgMOiIELoCPVBFYpNKeesfmA8Db0=";
     fetcherVersion = 1;
+    hash = "sha256-OPfs9WiUehKPaAqqgMOiIELoCPVBFYpNKeesfmA8Db0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zi/zipline/package.nix b/pkgs/by-name/zi/zipline/package.nix
index a44a9b099dc8..fb9d95826bfd 100644
--- a/pkgs/by-name/zi/zipline/package.nix
+++ b/pkgs/by-name/zi/zipline/package.nix
@@ -43,8 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-kIneqtLPZ29PzluKUGO4XbQYHbNddu0kTfoP4C22k7U=";
     fetcherVersion = 1;
+    hash = "sha256-kIneqtLPZ29PzluKUGO4XbQYHbNddu0kTfoP4C22k7U=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/django-filingcabinet/default.nix b/pkgs/development/python-modules/django-filingcabinet/default.nix
index 19c27bc950ec..8e9e8b46d6e0 100644
--- a/pkgs/development/python-modules/django-filingcabinet/default.nix
+++ b/pkgs/development/python-modules/django-filingcabinet/default.nix
@@ -94,8 +94,8 @@ buildPythonPackage rec {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-kvLV/pCX/wQHG0ttrjSro7/CoQ5K1T0aFChafQOwvNw=";
     fetcherVersion = 1;
+    hash = "sha256-kvLV/pCX/wQHG0ttrjSro7/CoQ5K1T0aFChafQOwvNw=";
   };
 
   postBuild = ''
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 42068d644a01..354bb0cd06c1 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -85,8 +85,8 @@ buildPythonPackage rec {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-h3ulPik0Uf8X687Se3J7h3+8jYzwXtbO6obsO27zyfA=";
     fetcherVersion = 1;
+    hash = "sha256-h3ulPik0Uf8X687Se3J7h3+8jYzwXtbO6obsO27zyfA=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/servers/authelia/web.nix b/pkgs/servers/authelia/web.nix
index 3c4e0ae2ca72..fcad0e1de466 100644
--- a/pkgs/servers/authelia/web.nix
+++ b/pkgs/servers/authelia/web.nix
@@ -31,8 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = pnpmDepsHash;
     fetcherVersion = 1;
+    hash = pnpmDepsHash;
   };
 
   postPatch = ''
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
index 5e7304ea9f13..118b04924f90 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
@@ -19,8 +19,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-ZWh2R6wr7FH2RfoFAE81Kl+wHnUeNjUbFG3KIk8ZN3g=";
     fetcherVersion = 1;
+    hash = "sha256-ZWh2R6wr7FH2RfoFAE81Kl+wHnUeNjUbFG3KIk8ZN3g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index 20ed0a5ef44f..a5d3d0489359 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -233,8 +233,8 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       pname = "discourse-assets";
       inherit version src;
-      hash = "sha256-WyRBnuKCl5NJLtqy3HK/sJcrpMkh0PjbasGPNDV6+7Y=";
       fetcherVersion = 1;
+      hash = "sha256-WyRBnuKCl5NJLtqy3HK/sJcrpMkh0PjbasGPNDV6+7Y=";
     };
 
     nativeBuildInputs = runtimeDeps ++ [
diff --git a/pkgs/servers/web-apps/lemmy/ui.nix b/pkgs/servers/web-apps/lemmy/ui.nix
index eecf875e3728..85ce59d44ab6 100644
--- a/pkgs/servers/web-apps/lemmy/ui.nix
+++ b/pkgs/servers/web-apps/lemmy/ui.nix
@@ -42,8 +42,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   extraBuildInputs = [ libsass ];
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = pinData.uiPNPMDepsHash;
     fetcherVersion = 1;
+    hash = pinData.uiPNPMDepsHash;
   };
 
   buildPhase = ''

From bc888e4649f14390428fc448cc71631af600c72a Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Mon, 14 Jul 2025 19:27:18 +0200
Subject: [PATCH 150/181] pnpm.fetchDeps: add fetcherVersion to passthru

This way we should be able to write tooling to automatically upgrade
this version in the future.

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/development/tools/pnpm/fetch-deps/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 164feec97923..399683e25850 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -139,6 +139,7 @@ in
           '';
 
           passthru = {
+            inherit fetcherVersion;
             serve = callPackage ./serve.nix {
               pnpm = args.pnpm or pnpm';
               pnpmDeps = finalAttrs.finalPackage;

From fa36e9a879a88ce73eafe89d692cb85f8c40f403 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 15 Jul 2025 20:32:28 +0800
Subject: [PATCH 151/181] firewalld: fix build with gettext 0.25

---
 pkgs/by-name/fi/firewalld/gettext-0.25.patch | 14 ++++++++++++++
 pkgs/by-name/fi/firewalld/package.nix        |  2 ++
 2 files changed, 16 insertions(+)
 create mode 100644 pkgs/by-name/fi/firewalld/gettext-0.25.patch

diff --git a/pkgs/by-name/fi/firewalld/gettext-0.25.patch b/pkgs/by-name/fi/firewalld/gettext-0.25.patch
new file mode 100644
index 000000000000..0205e1914d52
--- /dev/null
+++ b/pkgs/by-name/fi/firewalld/gettext-0.25.patch
@@ -0,0 +1,14 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -152,8 +152,10 @@
+ AC_SUBST([GETTEXT_PACKAGE], '[PKG_NAME]')
+ AC_DEFINE_UNQUOTED([GETTEXT_PACKAGE], ["$GETTEXT_PACKAGE"],)
+ 
++AM_GNU_GETTEXT_VERSION([0.22.5])
++AM_GNU_GETTEXT([external])
++
+ IT_PROG_INTLTOOL([0.35.0], [no-xml])
+-AM_PO_SUBDIRS
+ 
+ AC_CONFIG_COMMANDS([xsl-cleanup],,[rm -f doc/xml/transform-*.xsl])
+ 
diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 51ee769c84ac..630b85bf35bf 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -57,6 +57,8 @@ stdenv.mkDerivation rec {
     ./add-config-path-env-var.patch
     ./respect-xml-catalog-files-var.patch
     ./specify-localedir.patch
+
+    ./gettext-0.25.patch
   ];
 
   postPatch =

From e3c4aaba22ec102921421005b934ac3460351790 Mon Sep 17 00:00:00 2001
From: Gliczy <129636582+Gliczy@users.noreply.github.com>
Date: Tue, 15 Jul 2025 15:38:58 +0200
Subject: [PATCH 152/181] vencord: 1.12.4 -> 1.12.6

---
 pkgs/by-name/ve/vencord/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index bd467cd0a099..e6caf3bfa3de 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -14,19 +14,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.12.4";
+  version = "1.12.6";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-x5tbLoNGBT3tS+QXn0piFMM8+uqoQt8gfQJap1TyLmQ=";
+    hash = "sha256-7JT8BMKUhIwYMkIwr2mD8IQLDpldcDtAKh6R1tbAKMw=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname src;
-    fetcherVersion = 1;
-    hash = "sha256-hO6QKRr4jTfesRDAEGcpFeJmGTGLGMw6EgIvD23DNzw=";
+    fetcherVersion = 2;
+    hash = "sha256-JP9HOaP3DG+2F89tC77JZFD0ls35u/MzxNmvMCbBo9Y=";
   };
 
   nativeBuildInputs = [

From ca166dbf30d333a4b1c3695c29697815186f27c4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 13:39:21 +0000
Subject: [PATCH 153/181] google-chrome: 138.0.7204.92 -> 138.0.7204.100

---
 pkgs/by-name/go/google-chrome/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 6b997ece78f5..27dd1eab9d8c 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -171,11 +171,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "138.0.7204.92";
+    version = "138.0.7204.100";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-9HaUIvJEw6PqinEnpam/Dh5+6XPJ2ou+j8Jfhc7nd/E=";
+      hash = "sha256-H22aDTMvbUsbBWasGjCP1dUKmYzD9/6TIzfBpahAnA8=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -276,11 +276,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "138.0.7204.93";
+    version = "138.0.7204.101";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/k3cs4pgesvh4zq3jml7x52esia_138.0.7204.93/GoogleChrome-138.0.7204.93.dmg";
-      hash = "sha256-IEcwjrtNMMSjwNCrINjXRbnSI0Uf2JKtA+KwvQc5Fhc=";
+      url = "http://dl.google.com/release2/chrome/h7v73czgelyzwk2xfcs2gkpkwm_138.0.7204.101/GoogleChrome-138.0.7204.101.dmg";
+      hash = "sha256-gG20H5QsVmnfRi+Zo+OiLTLlPP2cLp6W+JaJoRE0QtI=";
     };
 
     dontPatch = true;

From 7d692b1c1df0797094ebd7a5dd9148eb8f5049bd Mon Sep 17 00:00:00 2001
From: cinereal <cinereal@riseup.net>
Date: Wed, 28 May 2025 14:58:59 +0200
Subject: [PATCH 154/181] drf-pydantic: init at 2.7.1

Apply suggestions from code review

Co-authored-by: Yohann Boniface <edhyjox@gmail.com>

Update pkgs/development/python-modules/drf-pydantic/default.nix

Co-authored-by: Martin Weinelt <mweinelt@users.noreply.github.com>

Update pkgs/development/python-modules/drf-pydantic/default.nix

Co-authored-by: Martin Weinelt <mweinelt@users.noreply.github.com>
---
 .../python-modules/drf-pydantic/default.nix   | 45 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/development/python-modules/drf-pydantic/default.nix

diff --git a/pkgs/development/python-modules/drf-pydantic/default.nix b/pkgs/development/python-modules/drf-pydantic/default.nix
new file mode 100644
index 000000000000..c9c9d90eb247
--- /dev/null
+++ b/pkgs/development/python-modules/drf-pydantic/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  django,
+  pydantic,
+  hatchling,
+  djangorestframework,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "drf-pydantic";
+  version = "2.7.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "georgebv";
+    repo = "drf-pydantic";
+    tag = "v${version}";
+    hash = "sha256-ABtSoxj/+HHq4hj4Yb6bEiyOl00TCO/9tvBzhv6afxM=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    django
+    pydantic
+    djangorestframework
+  ];
+
+  nativeChecksInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    changelog = "https://github.com/georgebv/drf-pydantic/releases/tag/${src.tag}";
+    description = "Use pydantic with the Django REST framework";
+    homepage = "https://github.com/georgebv/drf-pydantic";
+    maintainers = [ maintainers.kiara ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 946865d79763..86cadaed9737 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4310,6 +4310,8 @@ self: super: with self; {
 
   drf-orjson-renderer = callPackage ../development/python-modules/drf-orjson-renderer { };
 
+  drf-pydantic = callPackage ../development/python-modules/drf-pydantic { };
+
   drf-spectacular = callPackage ../development/python-modules/drf-spectacular { };
 
   drf-spectacular-sidecar = callPackage ../development/python-modules/drf-spectacular-sidecar { };

From 609e3538e9681d6a78e63be1f069c2c0e5cab0ea Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 14:25:57 +0000
Subject: [PATCH 155/181] teams-for-linux: 2.0.18 -> 2.1.0

---
 pkgs/by-name/te/teams-for-linux/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index be118252e32d..ed2565320017 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -16,16 +16,16 @@
 
 buildNpmPackage rec {
   pname = "teams-for-linux";
-  version = "2.0.18";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     tag = "v${version}";
-    hash = "sha256-44K76pNJ0SRKAF8QdHYSi5htQpbP6YNNg6vDkzaeqaI=";
+    hash = "sha256-lISDy721e3bfWMl56DlIxVKN2bW8Yonc5XSVL072OQk=";
   };
 
-  npmDepsHash = "sha256-ShEqO6nL2YK2wdHGEcKff0fJsd9N9LI0VfhFe6FQ2gw=";
+  npmDepsHash = "sha256-QcjXJcEIi/sUJLUF+wMqhXyLYPgjZKK6n4ngyvrH9NA=";
 
   nativeBuildInputs = [
     makeWrapper

From 3fec656207cf9b346bc48db2e533935720039a2a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 14:27:05 +0000
Subject: [PATCH 156/181] python3Packages.sqlmap: 1.9.6 -> 1.9.7

---
 pkgs/development/python-modules/sqlmap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sqlmap/default.nix b/pkgs/development/python-modules/sqlmap/default.nix
index 7de7eb2564f3..ba87c81b4ac6 100644
--- a/pkgs/development/python-modules/sqlmap/default.nix
+++ b/pkgs/development/python-modules/sqlmap/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.9.6";
+  version = "1.9.7";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/uzLkxqSVKjSYmFeDMo7EzcLbxGXGHlkg0ufhPRsGpY=";
+    hash = "sha256-E2cb/hp7sg56S9By3AT3BGnqQSVlQzRV3wEW+uuJozI=";
   };
 
   postPatch = ''

From 023913eb2afa3414a4bfcec7987de6d25a6d45b8 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Tue, 15 Jul 2025 09:48:34 -0500
Subject: [PATCH 157/181] teams-for-linux: electron_35 -> electron_37

Was bumped to 36 in 2.0.16, but also bumped to 37 in most recent
release.

Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
---
 pkgs/by-name/te/teams-for-linux/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index ed2565320017..e085cfb1220a 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -5,7 +5,7 @@
   fetchFromGitHub,
   alsa-utils,
   copyDesktopItems,
-  electron_35,
+  electron_37,
   makeDesktopItem,
   makeWrapper,
   nix-update-script,
@@ -46,7 +46,7 @@ buildNpmPackage rec {
     ''
       runHook preBuild
 
-      cp -r ${electron_35.dist} electron-dist
+      cp -r ${electron_37.dist} electron-dist
       chmod -R u+w electron-dist
     ''
     # Electron builder complains about symlink in electron-dist
@@ -61,7 +61,7 @@ buildNpmPackage rec {
           -c.npmRebuild=true \
           -c.asarUnpack="**/*.node" \
           -c.electronDist=electron-dist \
-          -c.electronVersion=${electron_35.version}
+          -c.electronVersion=${electron_37.version}
 
       runHook postBuild
     '';
@@ -83,7 +83,7 @@ buildNpmPackage rec {
       popd
 
       # Linux needs 'aplay' for notification sounds
-      makeWrapper '${lib.getExe electron_35}' "$out/bin/teams-for-linux" \
+      makeWrapper '${lib.getExe electron_37}' "$out/bin/teams-for-linux" \
         --prefix PATH : ${
           lib.makeBinPath [
             alsa-utils

From 7881e1458bb948cb54ee3fa4b867ba590d066849 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 14:53:04 +0000
Subject: [PATCH 158/181] python3Packages.dvclive: 3.48.2 -> 3.48.3

---
 pkgs/development/python-modules/dvclive/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/dvclive/default.nix b/pkgs/development/python-modules/dvclive/default.nix
index 90c541c09e8b..def78905451a 100644
--- a/pkgs/development/python-modules/dvclive/default.nix
+++ b/pkgs/development/python-modules/dvclive/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "dvclive";
-  version = "3.48.2";
+  version = "3.48.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvclive";
     tag = version;
-    hash = "sha256-KwS5426EU0vym2fDbtIH4bmlSLKWLfZRRxXE+bEmGfc=";
+    hash = "sha256-peT7L4SpCtjOVr4qaLyFtqEIiqAnEaTMfYxu02L9q2s=";
   };
 
   build-system = [ setuptools-scm ];
@@ -115,7 +115,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for logging machine learning metrics and other metadata in simple file formats";
     homepage = "https://github.com/iterative/dvclive";
-    changelog = "https://github.com/iterative/dvclive/releases/tag/${version}";
+    changelog = "https://github.com/iterative/dvclive/releases/tag/${src.tag}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };

From e5330889da3c9e26de8478f1758f0170ca92761a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Camille=20Favier?= <n@monade.li>
Date: Mon, 14 Jul 2025 12:05:30 +0200
Subject: [PATCH 159/181] xfce.thunar: Expose unwrapped derivation

This exposes the unwrapped derivation as `xfce.thunar-unwrapped`,
allowing it to be patched.
---
 pkgs/desktops/xfce/core/thunar/default.nix | 115 +++++++++------------
 pkgs/desktops/xfce/core/thunar/wrapper.nix |  88 +++++++++-------
 pkgs/desktops/xfce/default.nix             |   8 +-
 3 files changed, 100 insertions(+), 111 deletions(-)

diff --git a/pkgs/desktops/xfce/core/thunar/default.nix b/pkgs/desktops/xfce/core/thunar/default.nix
index 4673cf878abe..e2889789564e 100644
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@@ -16,82 +16,63 @@
   pcre2,
   xfce4-panel,
   xfconf,
-  makeWrapper,
-  symlinkJoin,
-  thunarPlugins ? [ ],
   withIntrospection ? false,
-  buildPackages,
   gobject-introspection,
 }:
 
-let
-  unwrapped = mkXfceDerivation {
-    category = "xfce";
-    pname = "thunar";
-    version = "4.20.3";
+mkXfceDerivation {
+  category = "xfce";
+  pname = "thunar";
+  version = "4.20.3";
 
-    sha256 = "sha256-YOh7tuCja9F2VvzX+QqsKHJfebXWbhLqvcraq6PBOGo=";
+  sha256 = "sha256-YOh7tuCja9F2VvzX+QqsKHJfebXWbhLqvcraq6PBOGo=";
 
-    nativeBuildInputs =
-      [
-        docbook_xsl
-        libxslt
-      ]
-      ++ lib.optionals withIntrospection [
-        gobject-introspection
-      ];
-
-    buildInputs = [
-      exo
-      gdk-pixbuf
-      gtk3
-      libX11
-      libexif # image properties page
-      libgudev
-      libnotify
-      libxfce4ui
-      libxfce4util
-      pcre2 # search & replace renamer
-      xfce4-panel # trash panel applet plugin
-      xfconf
+  nativeBuildInputs =
+    [
+      docbook_xsl
+      libxslt
+    ]
+    ++ lib.optionals withIntrospection [
+      gobject-introspection
     ];
 
-    configureFlags = [ "--with-custom-thunarx-dirs-enabled" ];
+  buildInputs = [
+    exo
+    gdk-pixbuf
+    gtk3
+    libX11
+    libexif # image properties page
+    libgudev
+    libnotify
+    libxfce4ui
+    libxfce4util
+    pcre2 # search & replace renamer
+    xfce4-panel # trash panel applet plugin
+    xfconf
+  ];
 
-    # the desktop file … is in an insecure location»
-    # which pops up when invoking desktop files that are
-    # symlinks to the /nix/store
-    #
-    # this error was added by this commit:
-    # https://github.com/xfce-mirror/thunar/commit/1ec8ff89ec5a3314fcd6a57f1475654ddecc9875
-    postPatch = ''
-      sed -i -e 's|thunar_dialogs_show_insecure_program (parent, _(".*"), file, exec)|1|' thunar/thunar-file.c
-    '';
+  configureFlags = [ "--with-custom-thunarx-dirs-enabled" ];
 
-    preFixup = ''
-      gappsWrapperArgs+=(
-        # https://github.com/NixOS/nixpkgs/issues/329688
-        --prefix PATH : ${lib.makeBinPath [ exo ]}
-      )
-    '';
+  # the desktop file … is in an insecure location»
+  # which pops up when invoking desktop files that are
+  # symlinks to the /nix/store
+  #
+  # this error was added by this commit:
+  # https://github.com/xfce-mirror/thunar/commit/1ec8ff89ec5a3314fcd6a57f1475654ddecc9875
+  postPatch = ''
+    sed -i -e 's|thunar_dialogs_show_insecure_program (parent, _(".*"), file, exec)|1|' thunar/thunar-file.c
+  '';
 
-    meta = with lib; {
-      description = "Xfce file manager";
-      mainProgram = "thunar";
-      teams = [ teams.xfce ];
-    };
+  preFixup = ''
+    gappsWrapperArgs+=(
+      # https://github.com/NixOS/nixpkgs/issues/329688
+      --prefix PATH : ${lib.makeBinPath [ exo ]}
+    )
+  '';
+
+  meta = with lib; {
+    description = "Xfce file manager";
+    mainProgram = "thunar";
+    teams = [ teams.xfce ];
   };
-
-in
-if thunarPlugins == [ ] then
-  unwrapped
-else
-  import ./wrapper.nix {
-    inherit
-      makeWrapper
-      symlinkJoin
-      thunarPlugins
-      lib
-      ;
-    thunar = unwrapped;
-  }
+}
diff --git a/pkgs/desktops/xfce/core/thunar/wrapper.nix b/pkgs/desktops/xfce/core/thunar/wrapper.nix
index e4b3cec39d84..009710ea353e 100644
--- a/pkgs/desktops/xfce/core/thunar/wrapper.nix
+++ b/pkgs/desktops/xfce/core/thunar/wrapper.nix
@@ -2,53 +2,61 @@
   lib,
   makeWrapper,
   symlinkJoin,
-  thunar,
-  thunarPlugins,
+  thunar-unwrapped,
+  thunarPlugins ? [ ],
 }:
 
-symlinkJoin {
-  name = "thunar-with-plugins-${thunar.version}";
+let
+  thunar = thunar-unwrapped;
+in
 
-  paths = [ thunar ] ++ thunarPlugins;
+if thunarPlugins == [ ] then
+  thunar
 
-  nativeBuildInputs = [ makeWrapper ];
+else
+  symlinkJoin {
+    name = "thunar-with-plugins-${thunar.version}";
 
-  postBuild = ''
-    wrapProgram "$out/bin/thunar" \
-      --set "THUNARX_DIRS" "$out/lib/thunarx-3"
+    paths = [ thunar ] ++ thunarPlugins;
 
-    wrapProgram "$out/bin/thunar-settings" \
-      --set "THUNARX_DIRS" "$out/lib/thunarx-3"
+    nativeBuildInputs = [ makeWrapper ];
 
-    # NOTE: we need to remove the folder symlink itself and create
-    # a new folder before trying to substitute any file below.
-    rm -f "$out/lib/systemd/user"
-    mkdir -p "$out/lib/systemd/user"
+    postBuild = ''
+      wrapProgram "$out/bin/thunar" \
+        --set "THUNARX_DIRS" "$out/lib/thunarx-3"
 
-    # point to wrapped binary in all service files
-    for file in "lib/systemd/user/thunar.service" \
-      "share/dbus-1/services/org.xfce.FileManager.service" \
-      "share/dbus-1/services/org.xfce.Thunar.FileManager1.service" \
-      "share/dbus-1/services/org.xfce.Thunar.service"
-    do
-      rm -f "$out/$file"
-      substitute "${thunar}/$file" "$out/$file" \
-        --replace "${thunar}" "$out"
-    done
-  '';
+      wrapProgram "$out/bin/thunar-settings" \
+        --set "THUNARX_DIRS" "$out/lib/thunarx-3"
 
-  meta = with lib; {
-    inherit (thunar.meta)
-      homepage
-      license
-      platforms
-      teams
-      ;
+      # NOTE: we need to remove the folder symlink itself and create
+      # a new folder before trying to substitute any file below.
+      rm -f "$out/lib/systemd/user"
+      mkdir -p "$out/lib/systemd/user"
 
-    description =
-      thunar.meta.description
-      +
-        optionalString (0 != length thunarPlugins)
-          " (with plugins: ${concatStringsSep ", " (map (x: x.name) thunarPlugins)})";
-  };
-}
+      # point to wrapped binary in all service files
+      for file in "lib/systemd/user/thunar.service" \
+        "share/dbus-1/services/org.xfce.FileManager.service" \
+        "share/dbus-1/services/org.xfce.Thunar.FileManager1.service" \
+        "share/dbus-1/services/org.xfce.Thunar.service"
+      do
+        rm -f "$out/$file"
+        substitute "${thunar}/$file" "$out/$file" \
+          --replace "${thunar}" "$out"
+      done
+    '';
+
+    meta = with lib; {
+      inherit (thunar.meta)
+        homepage
+        license
+        platforms
+        teams
+        ;
+
+      description =
+        thunar.meta.description
+        +
+          optionalString (0 != length thunarPlugins)
+            " (with plugins: ${concatStringsSep ", " (map (x: x.name) thunarPlugins)})";
+    };
+  }
diff --git a/pkgs/desktops/xfce/default.nix b/pkgs/desktops/xfce/default.nix
index 2a907a4ba39c..bdd3a9aadc84 100644
--- a/pkgs/desktops/xfce/default.nix
+++ b/pkgs/desktops/xfce/default.nix
@@ -33,9 +33,9 @@ makeScopeWithSplicing' {
 
       libxfce4windowing = callPackage ./core/libxfce4windowing { };
 
-      thunar = callPackage ./core/thunar {
-        thunarPlugins = [ ];
-      };
+      thunar-unwrapped = callPackage ./core/thunar { };
+
+      thunar = callPackage ./core/thunar/wrapper.nix { };
 
       thunar-volman = callPackage ./core/thunar-volman { };
 
@@ -169,7 +169,7 @@ makeScopeWithSplicing' {
 
       xinitrc = self.xfce4-session.xinitrc; # added 2019-11-04
 
-      thunar-bare = self.thunar.override { thunarPlugins = [ ]; }; # added 2019-11-04
+      thunar-bare = self.thunar-unwrapped; # added 2019-11-04
 
       xfce4-datetime-plugin = throw ''
         xfce4-datetime-plugin has been removed: this plugin has been merged into the xfce4-panel's built-in clock

From 0489ebad35fa2a8b52b43ee42a862da6519f90ae Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Tue, 15 Jul 2025 18:11:45 +0300
Subject: [PATCH 160/181] libtins: force C++17 for gtest

---
 .../{0001-force-cpp-14.patch => 0001-force-cpp-17.patch}  | 4 ++--
 pkgs/by-name/li/libtins/package.nix                       | 8 +++++---
 2 files changed, 7 insertions(+), 5 deletions(-)
 rename pkgs/by-name/li/libtins/{0001-force-cpp-14.patch => 0001-force-cpp-17.patch} (87%)

diff --git a/pkgs/by-name/li/libtins/0001-force-cpp-14.patch b/pkgs/by-name/li/libtins/0001-force-cpp-17.patch
similarity index 87%
rename from pkgs/by-name/li/libtins/0001-force-cpp-14.patch
rename to pkgs/by-name/li/libtins/0001-force-cpp-17.patch
index 3426713a07e3..0c80cafa201c 100644
--- a/pkgs/by-name/li/libtins/0001-force-cpp-14.patch
+++ b/pkgs/by-name/li/libtins/0001-force-cpp-17.patch
@@ -1,4 +1,4 @@
-This change bypasses all the code that attempts to see which C++11 features are enabled in your specific C++11 compiler.  C++14 is required for gtest 1.13+.
+This change bypasses all the code that attempts to see which C++11 features are enabled in your specific C++11 compiler.  C++17 is required for gtest 1.17+.
 diff --git a/CMakeLists.txt b/CMakeLists.txt
 index 902233e676ee..49ac8a1010a4 100644
 --- a/CMakeLists.txt
@@ -20,7 +20,7 @@ index 902233e676ee..49ac8a1010a4 100644
 -    ENDIF()
 +    SET(TINS_HAVE_CXX11 ON)
 +    MESSAGE(STATUS "Using C++11 features")
-+    SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++14")
++    SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++17")
  ELSE(LIBTINS_ENABLE_CXX11)
      MESSAGE(
          WARNING
diff --git a/pkgs/by-name/li/libtins/package.nix b/pkgs/by-name/li/libtins/package.nix
index 00c7a33339f3..3653b7671d78 100644
--- a/pkgs/by-name/li/libtins/package.nix
+++ b/pkgs/by-name/li/libtins/package.nix
@@ -21,9 +21,11 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    # Required for gtest 1.13+, see also upstream report at:
-    # https://github.com/mfontanini/libtins/issues/529
-    ./0001-force-cpp-14.patch
+    # Required for gtest 1.17+:
+    # https://github.com/NixOS/nixpkgs/issues/425358
+    # See also an upstream report for gtest 1.13+ and C++14:
+    # https://github.com/mfontanini/libtins/issues/
+    ./0001-force-cpp-17.patch
   ];
 
   postPatch = ''

From 025e4689208688088209828f3bfc4ff2bcf7c321 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Tue, 15 Jul 2025 23:11:36 +0800
Subject: [PATCH 161/181] nixosTests.xfce: Test programs.thunar.plugins option

---
 nixos/tests/xfce.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/tests/xfce.nix b/nixos/tests/xfce.nix
index 03921491c7b6..0b88fb18870f 100644
--- a/nixos/tests/xfce.nix
+++ b/nixos/tests/xfce.nix
@@ -19,6 +19,8 @@
 
       services.xserver.desktopManager.xfce.enable = true;
       environment.systemPackages = [ pkgs.xfce.xfce4-whiskermenu-plugin ];
+
+      programs.thunar.plugins = [ pkgs.xfce.thunar-archive-plugin ];
     };
 
   enableOCR = true;

From 72b05b1d59fc099f0366dc998fe6bbf82e2ea1d2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 15:30:45 +0000
Subject: [PATCH 162/181] pyprland: 2.4.5 -> 2.4.6

---
 pkgs/by-name/py/pyprland/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/py/pyprland/package.nix b/pkgs/by-name/py/pyprland/package.nix
index 08ddc3341f28..730da05985ee 100644
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyprland";
-  version = "2.4.5";
+  version = "2.4.6";
   format = "pyproject";
 
   disabled = python3Packages.pythonOlder "3.10";
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication rec {
     owner = "hyprland-community";
     repo = "pyprland";
     tag = version;
-    hash = "sha256-s93zuBS2jpGLTKKGvna1Zc+ph6A6kemgfkl8j7uSdKY=";
+    hash = "sha256-OH+BTPw574FykVYWG6TIOpSPeYB39UxyMy/gzMDw0z4=";
   };
 
   nativeBuildInputs = with python3Packages; [ poetry-core ];

From 79626a49aabeabfa356533c9c30f41411884ed8f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 15:37:22 +0000
Subject: [PATCH 163/181] opentofu: 1.10.2 -> 1.10.3

---
 pkgs/by-name/op/opentofu/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/opentofu/package.nix b/pkgs/by-name/op/opentofu/package.nix
index 883363ebbf2a..f91885db49f4 100644
--- a/pkgs/by-name/op/opentofu/package.nix
+++ b/pkgs/by-name/op/opentofu/package.nix
@@ -15,13 +15,13 @@
 let
   package = buildGoModule rec {
     pname = "opentofu";
-    version = "1.10.2";
+    version = "1.10.3";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       tag = "v${version}";
-      hash = "sha256-kRIj6M5/HfuzYrFV9ygyZsbVrHqvmqPo40XLcsNg7fU=";
+      hash = "sha256-2Z2PM1ahkvwtrkfTkVF6wSyk/BI17Ys8CIlB1Xd+fhI=";
     };
 
     vendorHash = "sha256-npMGiUIDhp4n7nKMWeyq+TDggU1xm5RzQrGOxvzWcnI=";

From 429566090d3152e206c7f59a6df30c55990157b1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 15:51:28 +0000
Subject: [PATCH 164/181] fabric-ai: 1.4.231 -> 1.4.247

---
 pkgs/by-name/fa/fabric-ai/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix
index f1f48a86384f..764d08a7433d 100644
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "fabric-ai";
-  version = "1.4.231";
+  version = "1.4.247";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${version}";
-    hash = "sha256-V/ryS0EB8izLsU0ggmAkdq3oFnR2h16ZF1JTJT/GMwY=";
+    hash = "sha256-s1FlQIbHSCWUR9f3qWfYHOLYmG8GwJb3SAu6d9DAH1Q=";
   };
 
-  vendorHash = "sha256-g2nMyrmDkb14siqiAMcis1bRijTsJ2KDtaK3FHCofx0=";
+  vendorHash = "sha256-/3+4oeKl+GQPmYt3yBt77ATm55pALa+62mC6lktSTiw=";
 
   # Fabric introduced plugin tests that fail in the nix build sandbox.
   doCheck = false;

From b31d47282dbd6ddc4993327dcd9447e6e3db1d78 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 16:04:02 +0000
Subject: [PATCH 165/181] mtail: 3.2.5 -> 3.2.7

---
 pkgs/by-name/mt/mtail/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mt/mtail/package.nix b/pkgs/by-name/mt/mtail/package.nix
index c47c61f2055f..2ae645bc2eb2 100644
--- a/pkgs/by-name/mt/mtail/package.nix
+++ b/pkgs/by-name/mt/mtail/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "mtail";
-  version = "3.2.5";
+  version = "3.2.7";
 
   src = fetchFromGitHub {
     owner = "jaqx0r";
     repo = "mtail";
     rev = "v${version}";
-    hash = "sha256-T81eLshaHqbLj4X0feWJE+VEWItmOxcVCQX04zl3jeA=";
+    hash = "sha256-rQ4Psm3sdKIIvmulPjE2DvRtf/HlriacWT6xEvm504U=";
   };
 
-  vendorHash = "sha256-Q3Fj73sQAmZQ9OF5hI0t1iPkY8u189PZ4LlzW34NQx0=";
+  vendorHash = "sha256-KZOcmZGv1kI9eDhQdtQeQ3ITyEw9vEDPz4RAz30pP9s=";
 
   nativeBuildInputs = [
     gotools # goyacc

From dafd0cf5690607735121f2d63adcb07df9a49704 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 16:09:29 +0000
Subject: [PATCH 166/181] frigate: 0.15.1 -> 0.15.2

---
 pkgs/by-name/fr/frigate/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/frigate/package.nix b/pkgs/by-name/fr/frigate/package.nix
index 8e7178f285b0..5b8024232b6c 100644
--- a/pkgs/by-name/fr/frigate/package.nix
+++ b/pkgs/by-name/fr/frigate/package.nix
@@ -12,14 +12,14 @@
 }:
 
 let
-  version = "0.15.1";
+  version = "0.15.2";
 
   src = fetchFromGitHub {
     name = "frigate-${version}-source";
     owner = "blakeblackshear";
     repo = "frigate";
     tag = "v${version}";
-    hash = "sha256-rnsc2VXaypIPVtYQHTGe9lg7PuAyjfjz4aeATmFzp5s=";
+    hash = "sha256-YJFtMVCTtp8h9a9RmkcoZSQ+nIKb5o/4JVynVslkx78=";
   };
 
   frigate-web = callPackage ./web.nix {

From 94ef1a18579236d73c8e3f31022da2e9c01581aa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 16:12:40 +0000
Subject: [PATCH 167/181] gh-f: 1.2.1 -> 1.3.0

---
 pkgs/by-name/gh/gh-f/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gh/gh-f/package.nix b/pkgs/by-name/gh/gh-f/package.nix
index c479a1f875d5..d90ede5caa7e 100644
--- a/pkgs/by-name/gh/gh-f/package.nix
+++ b/pkgs/by-name/gh/gh-f/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "gh-f";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "gennaro-tedesco";
     repo = "gh-f";
     rev = "v${version}";
-    hash = "sha256-62FVFW2KLdH0uonIf3OVBFMGLcCteMjydaLAjWtxwUo=";
+    hash = "sha256-CW6iAI5IomJoMuPBFq/3owhZJbcruKtOqoxzsh+FNVw=";
   };
 
   nativeBuildInputs = [

From 9bb0048bfac973edf2554e95a409ac02e6bca270 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 16:29:23 +0000
Subject: [PATCH 168/181] python3Packages.oelint-parser: 8.1.1 -> 8.2.2

---
 pkgs/development/python-modules/oelint-parser/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index e448ccbd306a..0acf6101ea62 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "8.1.1";
+  version = "8.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-parser";
     tag = version;
-    hash = "sha256-XjKtZky/i6KxS81tMbEsSe/caQ/GsEXEGO3pt6uEBq8=";
+    hash = "sha256-KrN7xJhb2EWRBxzl6GY+kW86oLVnzxdLYRSS9F9F/EY=";
   };
 
   pythonRelaxDeps = [ "regex" ];

From 59ceacb7349a8242c68536e0dda440f49f11bfcd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 16:55:07 +0000
Subject: [PATCH 169/181] uftrace: 0.18 -> 0.18.1

---
 pkgs/by-name/uf/uftrace/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/uf/uftrace/package.nix b/pkgs/by-name/uf/uftrace/package.nix
index 7224d7b5fc97..3a052d100d91 100644
--- a/pkgs/by-name/uf/uftrace/package.nix
+++ b/pkgs/by-name/uf/uftrace/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "uftrace";
-  version = "0.18";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "namhyung";
     repo = "uftrace";
     rev = "v${version}";
-    sha256 = "sha256-TgGeeZtrhGlQxQp0y6D8SMjRJ9YITzWdaWxblKfcvzU=";
+    sha256 = "sha256-9fVBV23gVN1kSkdqBlWV0oEIj6ew6yVO4edUTTHV5H0=";
   };
 
   nativeBuildInputs = [

From 5c11b8a19e14be0fdad683e9f1fb3034c9a588e8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 10 Jun 2025 06:51:11 +0000
Subject: [PATCH 170/181] zziplib: 0.13.79 -> 0.13.80

---
 pkgs/by-name/zz/zziplib/package.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/zz/zziplib/package.nix b/pkgs/by-name/zz/zziplib/package.nix
index effdb4b4bd4e..14e17d1b4b9b 100644
--- a/pkgs/by-name/zz/zziplib/package.nix
+++ b/pkgs/by-name/zz/zziplib/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zziplib";
-  version = "0.13.79";
+  version = "0.13.80";
 
   src = fetchFromGitHub {
     owner = "gdraheim";
     repo = "zziplib";
-    rev = "v${version}";
-    hash = "sha256-PUG6MAglYJXJzQMWM7KfLFbHG3bva7FyaP+HdCsRnZQ=";
+    tag = "v${version}";
+    hash = "sha256-vvPcQBRk1iIPNk5qI7N0Nv9JWndVfFH6oGxyr9ZIt0g=";
   };
 
   nativeBuildInputs = [
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
     xmlto
     zip
   ];
+
   buildInputs = [
     zlib
   ];
@@ -50,7 +51,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://github.com/gdraheim/zziplib";
-    changelog = "https://github.com/gdraheim/zziplib/blob/${version}/ChangeLog";
+    changelog = "https://github.com/gdraheim/zziplib/blob/v${version}/ChangeLog";
     description = "Library to extract data from files archived in a zip file";
     longDescription = ''
       The zziplib library is intentionally lightweight, it offers the ability to

From dba9b2cb9c73110b5603e209a187f8617a8c9966 Mon Sep 17 00:00:00 2001
From: matthewcroughan <matt@croughan.sh>
Date: Tue, 15 Jul 2025 19:05:57 +0100
Subject: [PATCH 171/181] nixos/kryoflux: fix typo programs.kryoflux ->
 hardware.kryoflux

---
 nixos/modules/hardware/kryoflux.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/hardware/kryoflux.nix b/nixos/modules/hardware/kryoflux.nix
index fc46f2d0bbf4..3e3110e5773a 100644
--- a/nixos/modules/hardware/kryoflux.nix
+++ b/nixos/modules/hardware/kryoflux.nix
@@ -6,11 +6,11 @@
 }:
 
 let
-  cfg = config.programs.kryoflux;
+  cfg = config.hardware.kryoflux;
 
 in
 {
-  options.programs.kryoflux = {
+  options.hardware.kryoflux = {
     enable = lib.mkOption {
       type = lib.types.bool;
       default = false;

From af9b49edab7bb92b319ff459c9ed52bd4a45f1ec Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 1 Mar 2025 22:45:57 +0100
Subject: [PATCH 172/181] tests.srcOnly: Add test cases for equivalences in the
 interface

---
 pkgs/build-support/src-only/tests.nix | 78 ++++++++++++++++++++++-----
 1 file changed, 64 insertions(+), 14 deletions(-)

diff --git a/pkgs/build-support/src-only/tests.nix b/pkgs/build-support/src-only/tests.nix
index 7ea7c23621be..51f5b4c96181 100644
--- a/pkgs/build-support/src-only/tests.nix
+++ b/pkgs/build-support/src-only/tests.nix
@@ -1,28 +1,78 @@
 {
   runCommand,
   srcOnly,
+  hello,
   emptyDirectory,
   glibc,
+  stdenv,
+  testers,
 }:
 
 let
   emptySrc = srcOnly emptyDirectory;
   glibcSrc = srcOnly glibc;
+
+  # It can be invoked in a number of ways. Let's make sure they're equivalent.
+  glibcSrcDrvAttrs = srcOnly glibc.drvAttrs;
+  # glibcSrcFreeform = # ???;
+  helloSrc = srcOnly hello;
+  helloSrcDrvAttrs = srcOnly hello.drvAttrs;
+
+  # The srcOnly <drv> invocation leaks a lot of attrs into the srcOnly derivation,
+  # so for comparing with the freeform invocation, we need to make a selection.
+  # Otherwise, we'll be comparing against whatever attribute the fancy hello drv
+  # has.
+  helloDrvSimple = stdenv.mkDerivation {
+    inherit (hello)
+      name
+      pname
+      version
+      src
+      patches
+      ;
+  };
+  helloDrvSimpleSrc = srcOnly helloDrvSimple;
+  helloDrvSimpleSrcFreeform = srcOnly {
+    inherit (helloDrvSimple)
+      name
+      pname
+      version
+      src
+      patches
+      stdenv
+      ;
+  };
+
 in
 
-runCommand "srcOnly-tests" { } ''
-  # Test that emptySrc is empty
-  if [ -n "$(ls -A ${emptySrc})" ]; then
-    echo "emptySrc is not empty"
-    exit 1
-  fi
+runCommand "srcOnly-tests"
+  {
+    moreTests = [
+      (testers.testEqualDerivation "glibcSrcDrvAttrs == glibcSrc" glibcSrcDrvAttrs glibcSrc)
+      # (testers.testEqualDerivation
+      #   "glibcSrcFreeform == glibcSrc"
+      #   glibcSrcFreeform
+      #   glibcSrc)
+      (testers.testEqualDerivation "helloSrcDrvAttrs == helloSrc" helloSrcDrvAttrs helloSrc)
+      (testers.testEqualDerivation "helloDrvSimpleSrcFreeform == helloDrvSimpleSrc"
+        helloDrvSimpleSrcFreeform
+        helloDrvSimpleSrc
+      )
+    ];
+  }
+  ''
+    # Test that emptySrc is empty
+    if [ -n "$(ls -A ${emptySrc})" ]; then
+      echo "emptySrc is not empty"
+      exit 1
+    fi
 
-  # Test that glibcSrc is not empty
-  if [ -z "$(ls -A ${glibcSrc})" ]; then
-    echo "glibcSrc is empty"
-    exit 1
-  fi
+    # Test that glibcSrc is not empty
+    if [ -z "$(ls -A ${glibcSrc})" ]; then
+      echo "glibcSrc is empty"
+      exit 1
+    fi
 
-  # Make $out exist to avoid build failure
-  mkdir -p $out
-''
+    # Make $out exist to avoid build failure
+    mkdir -p $out
+  ''

From d93bb6f46ab4e33732f403a4f0aaff45ac020237 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 5 Apr 2025 18:45:26 +0200
Subject: [PATCH 173/181] tests.srcOnly: Use zlib instead of glibc

This makes the test more portable, as glibc does not evaluate on
all platforms.
Unfortunately the test fails on darwin for an unrelated reason.
__impureHostDeps values were duplicated.
---
 pkgs/build-support/src-only/tests.nix | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/build-support/src-only/tests.nix b/pkgs/build-support/src-only/tests.nix
index 51f5b4c96181..d00a2060703e 100644
--- a/pkgs/build-support/src-only/tests.nix
+++ b/pkgs/build-support/src-only/tests.nix
@@ -3,18 +3,18 @@
   srcOnly,
   hello,
   emptyDirectory,
-  glibc,
+  zlib,
   stdenv,
   testers,
 }:
 
 let
   emptySrc = srcOnly emptyDirectory;
-  glibcSrc = srcOnly glibc;
+  zlibSrc = srcOnly zlib;
 
   # It can be invoked in a number of ways. Let's make sure they're equivalent.
-  glibcSrcDrvAttrs = srcOnly glibc.drvAttrs;
-  # glibcSrcFreeform = # ???;
+  zlibSrcDrvAttrs = srcOnly zlib.drvAttrs;
+  # zlibSrcFreeform = # ???;
   helloSrc = srcOnly hello;
   helloSrcDrvAttrs = srcOnly hello.drvAttrs;
 
@@ -48,11 +48,11 @@ in
 runCommand "srcOnly-tests"
   {
     moreTests = [
-      (testers.testEqualDerivation "glibcSrcDrvAttrs == glibcSrc" glibcSrcDrvAttrs glibcSrc)
+      (testers.testEqualDerivation "zlibSrcDrvAttrs == zlibSrc" zlibSrcDrvAttrs zlibSrc)
       # (testers.testEqualDerivation
-      #   "glibcSrcFreeform == glibcSrc"
-      #   glibcSrcFreeform
-      #   glibcSrc)
+      #   "zlibSrcFreeform == zlibSrc"
+      #   zlibSrcFreeform
+      #   zlibSrc)
       (testers.testEqualDerivation "helloSrcDrvAttrs == helloSrc" helloSrcDrvAttrs helloSrc)
       (testers.testEqualDerivation "helloDrvSimpleSrcFreeform == helloDrvSimpleSrc"
         helloDrvSimpleSrcFreeform
@@ -67,9 +67,9 @@ runCommand "srcOnly-tests"
       exit 1
     fi
 
-    # Test that glibcSrc is not empty
-    if [ -z "$(ls -A ${glibcSrc})" ]; then
-      echo "glibcSrc is empty"
+    # Test that zlibSrc is not empty
+    if [ -z "$(ls -A ${zlibSrc})" ]; then
+      echo "zlibSrc is empty"
       exit 1
     fi
 

From 966fc630ddfae521af2fc9f5575a78275145827d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 5 Apr 2025 18:54:01 +0200
Subject: [PATCH 174/181] tests.srcOnly: Work around duplication of attr on
 darwin

---
 pkgs/build-support/src-only/tests.nix | 31 ++++++++++++++++++---------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/pkgs/build-support/src-only/tests.nix b/pkgs/build-support/src-only/tests.nix
index d00a2060703e..f739715e717d 100644
--- a/pkgs/build-support/src-only/tests.nix
+++ b/pkgs/build-support/src-only/tests.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   runCommand,
   srcOnly,
   hello,
@@ -32,16 +33,26 @@ let
       ;
   };
   helloDrvSimpleSrc = srcOnly helloDrvSimple;
-  helloDrvSimpleSrcFreeform = srcOnly {
-    inherit (helloDrvSimple)
-      name
-      pname
-      version
-      src
-      patches
-      stdenv
-      ;
-  };
+  helloDrvSimpleSrcFreeform = srcOnly (
+    {
+      inherit (helloDrvSimple)
+        name
+        pname
+        version
+        src
+        patches
+        stdenv
+        ;
+    }
+    # __impureHostDeps get duplicated in helloDrvSimpleSrc (on darwin)
+    # This is harmless, but fails the test for what is arguably an
+    # unrelated non-problem, so we just work around it here.
+    # The inclusion of __impureHostDeps really shouldn't be required,
+    # and should be removed from this test.
+    // lib.optionalAttrs (helloDrvSimple ? __impureHostDeps) {
+      inherit (helloDrvSimple) __impureHostDeps;
+    }
+  );
 
 in
 

From b8536c602f90bb2b770b5f90f9b6300c19c5ba59 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Tue, 15 Jul 2025 21:31:41 +0200
Subject: [PATCH 175/181] helix: 25.01.1 -> 25.07

Changelog: https://github.com/helix-editor/helix/blob/master/CHANGELOG.md#2507-2025-07-15
Highlights: https://helix-editor.com/news/release-25-07-highlights/
---
 pkgs/by-name/he/helix/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/he/helix/package.nix b/pkgs/by-name/he/helix/package.nix
index f5f9cc80a68a..09f89cd3a8f0 100644
--- a/pkgs/by-name/he/helix/package.nix
+++ b/pkgs/by-name/he/helix/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "helix";
-  version = "25.01.1";
+  version = "25.07";
 
   # This release tarball includes source code for the tree-sitter grammars,
   # which is not ordinarily part of the repository.
   src = fetchzip {
     url = "https://github.com/helix-editor/helix/releases/download/${version}/helix-${version}-source.tar.xz";
-    hash = "sha256-rN2eK+AoyDH+tL3yxTRQQQYHf0PoYK84FgrRwm/Wfjk=";
+    hash = "sha256-UbvIbrDNUmcAvqVM98CPlBhjAc5BAyIUpp9+BXGmdfA=";
     stripRoot = false;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-JZwURUMUnwc3tzAsN7NJCE8106c/4VgZtHHA3e/BsXs=";
+  cargoHash = "sha256-++zslB4s5/TOjxqeOFZAsYUu7acPxQw/xMnlYgTf5GU=";
 
   nativeBuildInputs = [
     git

From ed74f025156f1e4c57664607324dcd58a94d21a4 Mon Sep 17 00:00:00 2001
From: Brian McGee <brian@bmcgee.ie>
Date: Tue, 15 Jul 2025 19:17:51 +0100
Subject: [PATCH 176/181] nixos-facter: 0.4.0 -> 0.4.1

Co-authored-by: Pol Dellaiera <pol.dellaiera@protonmail.com>
---
 pkgs/by-name/ni/nixos-facter/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-facter/package.nix b/pkgs/by-name/ni/nixos-facter/package.nix
index f762d2f78a22..8c519a65256f 100644
--- a/pkgs/by-name/ni/nixos-facter/package.nix
+++ b/pkgs/by-name/ni/nixos-facter/package.nix
@@ -23,13 +23,13 @@ let
 in
 buildGoModule rec {
   pname = "nixos-facter";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "nixos-facter";
-    rev = "v${version}";
-    hash = "sha256-SuD6FTyCGT+H5uEPkPmBSI00R87weAoO5xZHPJElSu8=";
+    tag = "v${version}";
+    hash = "sha256-4kER7CyFvMKVpKxCYHuf9fkkYVzVK9AWpF55cBNzPc0=";
   };
 
   vendorHash = "sha256-A7ZuY8Gc/a0Y8O6UG2WHWxptHstJOxi4n9F8TY6zqiw=";

From ac000d58a62196c95673271c9459802281b5e493 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 14 Jul 2025 20:27:22 +0100
Subject: [PATCH 177/181] xloadimage: fix patch application

Without the change patches fail to apply as `$patches` contain compressed
tarball: https://hydra.nixos.org/build/300549687

    applying patch /nix/store/q5k4nisc8dix97imsxlsj6m9pmkjjfcs-xloadimage_4.1-25.debian.tar.xz
    patch: **** patch line 1 contains NUL byte

With `patch-2.8` it will become an error.
---
 pkgs/by-name/xl/xloadimage/package.nix | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/xl/xloadimage/package.nix b/pkgs/by-name/xl/xloadimage/package.nix
index 6a94e3ba6ae8..1f29e514dec3 100644
--- a/pkgs/by-name/xl/xloadimage/package.nix
+++ b/pkgs/by-name/xl/xloadimage/package.nix
@@ -2,9 +2,11 @@
   lib,
   stdenv,
   fetchurl,
+  fetchzip,
   libX11,
   libXt,
   autoreconfHook,
+  quilt,
 
   libjpeg ? null,
   libpng ? null,
@@ -20,23 +22,30 @@ assert withPngSupport -> libpng != null;
 assert withTiffSupport -> libtiff != null;
 
 let
+  version = "4.1";
   deb_patch = "25";
+  debian_patches = fetchzip {
+    url = "mirror://debian/pool/main/x/xloadimage/xloadimage_${version}-${deb_patch}.debian.tar.xz";
+    hash = "sha256-5FbkiYjI8ASUyi1DTFiAcJ9y2z1sEKrNNyKoqnca30I=";
+  };
 in
 stdenv.mkDerivation rec {
-  version = "4.1";
   pname = "xloadimage";
+  inherit version;
 
   src = fetchurl {
     url = "mirror://debian/pool/main/x/xloadimage/xloadimage_${version}.orig.tar.gz";
     sha256 = "1i7miyvk5ydhi6yi8593vapavhwxcwciir8wg9d2dcyg9pccf2s0";
   };
 
-  patches = fetchurl {
-    url = "mirror://debian/pool/main/x/xloadimage/xloadimage_${version}-${deb_patch}.debian.tar.xz";
-    sha256 = "17k518vrdrya5c9dqhpmm4g0h2vlkq1iy87sg2ngzygypbli1xvn";
-  };
+  postPatch = ''
+    QUILT_PATCHES=${debian_patches}/patches quilt push -a
+  '';
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+    quilt
+  ];
 
   buildInputs =
     [

From 9ac1f1812b524074dd479bc40396a0700ecf078b Mon Sep 17 00:00:00 2001
From: Gliczy <129636582+Gliczy@users.noreply.github.com>
Date: Thu, 3 Jul 2025 19:49:46 +0200
Subject: [PATCH 178/181] vencord: add myself as maintainer

---
 pkgs/by-name/ve/vencord/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index e6caf3bfa3de..3bb9de8cb72f 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -83,6 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       donteatoreo
       FlafyDev
+      Gliczy
       NotAShelf
       Scrumplex
     ];

From 08238dfea5af214af627900bd9e7aa96dbfcf8a8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 20:46:08 +0000
Subject: [PATCH 179/181] libretro-shaders-slang: 0-unstable-2025-07-03 ->
 0-unstable-2025-07-13

---
 pkgs/by-name/li/libretro-shaders-slang/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libretro-shaders-slang/package.nix b/pkgs/by-name/li/libretro-shaders-slang/package.nix
index 004488565f04..93b159a5b162 100644
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-07-13";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "5c2c28f79716968381f71b3470ee0064762d7c6f";
-    hash = "sha256-L+jTTZA2qg/PlZtI0G0rzLk5is6cUFiTfy2RTcry5vA=";
+    rev = "82d91f7daf81a41ece49644d2a26b2a40228be61";
+    hash = "sha256-zRtn+Fc1sw3Uja5vJ5/1IRPr/xG5O0wIKflHr96tu3I=";
   };
 
   dontConfigure = true;

From ba8fd8b12413706dc48cdf5118dc8977f0ab9eae Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 21:45:34 +0000
Subject: [PATCH 180/181] andcli: 2.2.0 -> 2.3.0

---
 pkgs/by-name/an/andcli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/an/andcli/package.nix b/pkgs/by-name/an/andcli/package.nix
index c1c1a1e49b69..66b91e63f9f5 100644
--- a/pkgs/by-name/an/andcli/package.nix
+++ b/pkgs/by-name/an/andcli/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "andcli";
-  version = "2.2.0";
+  version = "2.3.0";
 
   subPackages = [ "cmd/andcli" ];
 
@@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
     owner = "tjblackheart";
     repo = "andcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wAatlCckSpa/BE4UVR/L6SkVmNyW2/cl//JOy62EaLc=";
+    hash = "sha256-umV0oJ4sySnZzrIpRuTP/fT8a9nhkC1shVEfVVRpEyI=";
   };
 
-  vendorHash = "sha256-/rmx9g7OfsZXr3zb1UfR1qLxdV2/ELzc/wXn0fJRzbE=";
+  vendorHash = "sha256-lzmkNxQUqktnl2Rpjgoa2yvAuGiMtVGNhiuF40how4o=";
 
   ldflags = [
     "-s"

From 12d4ca9bc82c4d35a403c4f721dde49445ec9e5c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Jul 2025 23:13:55 +0000
Subject: [PATCH 181/181] olympus-unwrapped: 25.06.28.03 -> 25.07.12.01

---
 pkgs/by-name/ol/olympus-unwrapped/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ol/olympus-unwrapped/package.nix b/pkgs/by-name/ol/olympus-unwrapped/package.nix
index 8153c5cec67b..b1125c5cbdd7 100644
--- a/pkgs/by-name/ol/olympus-unwrapped/package.nix
+++ b/pkgs/by-name/ol/olympus-unwrapped/package.nix
@@ -31,9 +31,9 @@ let
 
   phome = "$out/lib/olympus";
   # The following variables are to be updated by the update script.
-  version = "25.06.28.03";
-  buildId = "4925"; # IMPORTANT: This line is matched with regex in update.sh.
-  rev = "1671a4e90da4f8cd565712ed5344bd4e01cf29a1";
+  version = "25.07.12.01";
+  buildId = "4934"; # IMPORTANT: This line is matched with regex in update.sh.
+  rev = "17634d29b91b737580c878ba96f73bd077fbfba0";
 in
 buildDotnetModule {
   pname = "olympus-unwrapped";
@@ -44,7 +44,7 @@ buildDotnetModule {
     owner = "EverestAPI";
     repo = "Olympus";
     fetchSubmodules = true; # Required. See upstream's README.
-    hash = "sha256-TgtokrUt15k7SxjPcIFIbv2QL+hgB0cIZYb3oG/l/GI=";
+    hash = "sha256-Z6OWO6WCHhmmGI8dF23yiLNBy11Mutu941jY/0pxIkQ=";
   };
 
   nativeBuildInputs = [