From defecd64a3ac1dddf483b5d89bddeac2c85cd776 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Mon, 21 Jul 2025 09:40:25 -0700
Subject: [PATCH 01/45] kawa: init at 3.1.1

---
 pkgs/by-name/ka/kawa/package.nix | 72 ++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 pkgs/by-name/ka/kawa/package.nix

diff --git a/pkgs/by-name/ka/kawa/package.nix b/pkgs/by-name/ka/kawa/package.nix
new file mode 100644
index 000000000000..c7995bd23768
--- /dev/null
+++ b/pkgs/by-name/ka/kawa/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  jdk11,
+  ant,
+  makeWrapper,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kawa";
+  version = "3.1.1";
+
+  src = fetchurl {
+    url = "mirror://gnu/kawa/kawa-${finalAttrs.version}.tar.gz";
+    hash = "sha256-jJpQzWsQAVTJAb0ZCzrNL7g1PzNiLEos6Po5Kn8J4Bk=";
+  };
+
+  nativeBuildInputs = [
+    jdk11
+    ant
+    makeWrapper
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    ant -Denable-java-frontend=yes
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/java
+    cp lib/kawa.jar $out/share/java/kawa.jar
+
+    # Install info files
+    mkdir -p $out/share/info
+    cp doc/*.info* $out/share/info/
+
+    # Install man pages
+    mkdir -p $out/share/man/man1
+    cp doc/kawa.man $out/share/man/man1/kawa.1
+    cp doc/qexo.man $out/share/man/man1/qexo.1
+
+    mkdir -p $out/bin
+    makeWrapper ${jdk11}/bin/java $out/bin/kawa \
+      --add-flags "-Dkawa.home=$out -jar $out/share/java/kawa.jar"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Scheme implementation running on the Java platform";
+    longDescription = ''
+      Kawa is a general-purpose programming language that runs on the Java platform.
+      It aims to combine the benefits of dynamic scripting languages (less boiler-plate
+      code, fast and easy start-up, a REPL, no required compilation step) with the
+      benefits of traditional compiled languages (fast execution, static error detection,
+      modularity, zero-overhead Java platform integration).
+    '';
+    homepage = "https://www.gnu.org/software/kawa";
+    license = [
+      lib.licenses.mit
+      lib.licenses.gpl2Plus
+    ];
+    maintainers = with lib.maintainers; [ siraben ];
+    platforms = lib.platforms.unix;
+  };
+})

From c20d9c02ec03c312fae248f51b437c18476937c1 Mon Sep 17 00:00:00 2001
From: Jasi <normalc@posteo.net>
Date: Fri, 8 Aug 2025 23:30:32 -0400
Subject: [PATCH 02/45] virglrenderer: add normalcea as maintainer

---
 pkgs/by-name/vi/virglrenderer/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/vi/virglrenderer/package.nix b/pkgs/by-name/vi/virglrenderer/package.nix
index b7f7f9fd69c4..9bbd7582d6a7 100644
--- a/pkgs/by-name/vi/virglrenderer/package.nix
+++ b/pkgs/by-name/vi/virglrenderer/package.nix
@@ -76,6 +76,9 @@ stdenv.mkDerivation rec {
     homepage = "https://virgil3d.github.io/";
     license = licenses.mit;
     platforms = platforms.unix;
-    maintainers = [ maintainers.xeji ];
+    maintainers = [
+      maintainers.xeji
+      maintainers.normalcea
+    ];
   };
 }

From 4704387db26b048def40eec1bf1564df8b2964c5 Mon Sep 17 00:00:00 2001
From: Jasi <normalc@posteo.net>
Date: Sat, 9 Aug 2025 00:03:00 -0400
Subject: [PATCH 03/45] virglrenderer: update `meta` attributes

---
 pkgs/by-name/vi/virglrenderer/package.nix | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/vi/virglrenderer/package.nix b/pkgs/by-name/vi/virglrenderer/package.nix
index 9bbd7582d6a7..0456ca04ee1d 100644
--- a/pkgs/by-name/vi/virglrenderer/package.nix
+++ b/pkgs/by-name/vi/virglrenderer/package.nix
@@ -70,15 +70,14 @@ stdenv.mkDerivation rec {
     };
   };
 
-  meta = with lib; {
-    description = "Virtual 3D GPU library that allows a qemu guest to use the host GPU for accelerated 3D rendering";
-    mainProgram = "virgl_test_server";
-    homepage = "https://virgil3d.github.io/";
-    license = licenses.mit;
-    platforms = platforms.unix;
-    maintainers = [
-      maintainers.xeji
-      maintainers.normalcea
+  meta = {
+    description = "Virtual 3D GPU for use inside QEMU virtual machines";
+    homepage = "https://docs.mesa3d.org/drivers/virgl";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      normalcea
     ];
+    mainProgram = "virgl_test_server";
+    platforms = lib.platforms.unix;
   };
 }

From 4802caea57987e99fa7c53bea9520b4b418a2ca8 Mon Sep 17 00:00:00 2001
From: Jasi <normalc@posteo.net>
Date: Fri, 8 Aug 2025 23:18:17 -0400
Subject: [PATCH 04/45] virglrenderer: use `fetchFromGitLab`; use `finalAttrs`

---
 pkgs/by-name/vi/virglrenderer/package.nix | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/vi/virglrenderer/package.nix b/pkgs/by-name/vi/virglrenderer/package.nix
index 0456ca04ee1d..cebde9224bfd 100644
--- a/pkgs/by-name/vi/virglrenderer/package.nix
+++ b/pkgs/by-name/vi/virglrenderer/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
   meson,
   ninja,
   pkg-config,
@@ -17,16 +17,19 @@
   vulkanSupport ? stdenv.hostPlatform.isLinux,
   vulkan-headers,
   vulkan-loader,
-  gitUpdater,
+  nix-update-script,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "virglrenderer";
   version = "1.1.1";
 
-  src = fetchurl {
-    url = "https://gitlab.freedesktop.org/virgl/virglrenderer/-/archive/${version}/virglrenderer-${version}.tar.bz2";
-    hash = "sha256-D+SJqBL76z1nGBmcJ7Dzb41RvFxU2Ak6rVOwDRB94rM=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "virgl";
+    repo = "virglrenderer";
+    tag = finalAttrs.version;
+    hash = "sha256-ah6+AAf7B15rPMb4uO873wieT3+gf/5iGH+ZFoZKAAI=";
   };
 
   separateDebugInfo = true;
@@ -64,10 +67,7 @@ stdenv.mkDerivation rec {
   ];
 
   passthru = {
-    updateScript = gitUpdater {
-      url = "https://gitlab.freedesktop.org/virgl/virglrenderer.git";
-      rev-prefix = "virglrenderer-";
-    };
+    updateScript = nix-update-script { };
   };
 
   meta = {
@@ -80,4 +80,4 @@ stdenv.mkDerivation rec {
     mainProgram = "virgl_test_server";
     platforms = lib.platforms.unix;
   };
-}
+})

From accd401c6616d963ccbb42551ffb7d800e2aac98 Mon Sep 17 00:00:00 2001
From: Jasi <normalc@posteo.net>
Date: Fri, 8 Aug 2025 23:22:16 -0400
Subject: [PATCH 05/45] virglrenderer: refactor

---
 pkgs/by-name/vi/virglrenderer/package.nix | 49 +++++++++++++----------
 1 file changed, 28 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/vi/virglrenderer/package.nix b/pkgs/by-name/vi/virglrenderer/package.nix
index cebde9224bfd..046c23c10acc 100644
--- a/pkgs/by-name/vi/virglrenderer/package.nix
+++ b/pkgs/by-name/vi/virglrenderer/package.nix
@@ -11,13 +11,13 @@
   libX11,
   libdrm,
   libgbm,
-  nativeContextSupport ? stdenv.hostPlatform.isLinux,
-  vaapiSupport ? !stdenv.hostPlatform.isDarwin,
   libva,
-  vulkanSupport ? stdenv.hostPlatform.isLinux,
   vulkan-headers,
   vulkan-loader,
   nix-update-script,
+  vulkanSupport ? stdenv.hostPlatform.isLinux,
+  nativeContextSupport ? stdenv.hostPlatform.isLinux,
+  vaapiSupport ? !stdenv.hostPlatform.isDarwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -34,21 +34,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   separateDebugInfo = true;
 
-  buildInputs = [
-    libepoxy
-  ]
-  ++ lib.optionals vaapiSupport [ libva ]
-  ++ lib.optionals vulkanSupport [
-    vulkan-headers
-    vulkan-loader
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    libGLU
-    libX11
-    libdrm
-    libgbm
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
@@ -58,12 +43,34 @@ stdenv.mkDerivation (finalAttrs: {
     ]))
   ];
 
+  buildInputs = [
+    libepoxy
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    libGLU
+    libX11
+    libdrm
+    libgbm
+  ]
+  ++ lib.optionals vaapiSupport [
+    libva
+  ]
+  ++ lib.optionals vulkanSupport [
+    vulkan-headers
+    vulkan-loader
+  ];
+
   mesonFlags = [
     (lib.mesonBool "video" vaapiSupport)
     (lib.mesonBool "venus" vulkanSupport)
-  ]
-  ++ lib.optionals nativeContextSupport [
-    (lib.mesonOption "drm-renderers" "amdgpu-experimental,msm")
+    (lib.mesonOption "drm-renderers" (
+      lib.optionalString nativeContextSupport (
+        lib.concatStringsSep "," [
+          "amdgpu-experimental"
+          "msm"
+        ]
+      )
+    ))
   ];
 
   passthru = {

From 996181d3259cf1550779e2af9c762dba64e9deb9 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Mon, 18 Aug 2025 21:58:57 -0700
Subject: [PATCH 06/45] python3Packages.opencc: init at 1.1.9

---
 .../python-modules/opencc/default.nix         | 39 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 41 insertions(+)
 create mode 100644 pkgs/development/python-modules/opencc/default.nix

diff --git a/pkgs/development/python-modules/opencc/default.nix b/pkgs/development/python-modules/opencc/default.nix
new file mode 100644
index 000000000000..2a4c7fa01611
--- /dev/null
+++ b/pkgs/development/python-modules/opencc/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  cmake,
+  setuptools,
+  wheel,
+}:
+
+buildPythonPackage rec {
+  pname = "opencc";
+  version = "1.1.9";
+  format = "setuptools";
+
+  src = fetchPypi {
+    pname = "opencc";
+    inherit version;
+    hash = "sha256-itcig3MpUTAzkPrjOhztqYrJsDNoqPKRLtyTTXQHfko=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    setuptools
+    wheel
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  pythonImportsCheck = [
+    "opencc"
+  ];
+
+  meta = {
+    description = "Python bindings for OpenCC (Conversion between Traditional and Simplified Chinese)";
+    homepage = "https://github.com/BYVoid/OpenCC";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ siraben ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5566867bdfd2..f476d2b81a6b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10761,6 +10761,8 @@ self: super: with self; {
 
   opencamlib = callPackage ../development/python-modules/opencamlib { };
 
+  opencc = callPackage ../development/python-modules/opencc { };
+
   opencensus = callPackage ../development/python-modules/opencensus { };
 
   opencensus-context = callPackage ../development/python-modules/opencensus-context { };

From f91f2dcfbac3e2d4f3e8cbfcdd8abf7fea85ad25 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 19 Aug 2025 16:33:10 +0300
Subject: [PATCH 07/45] ibus: Fix cross `No package 'wayland-scanner' found`

The autoconf `PKG_CHECK_MODULES` macro and so on aren't made with cross
in mind, so there isn't an easy way to change them to use
PKG_CONFIG_FOR_BUILD.

`"PKG_CONFIG_WAYLAND_SCANNER_WAYLAND_SCANNER=${lib.getBin buildPackages.wayland-scanner}/bin/wayland-scanner"` in `configureFlags` isn't necessary

`wayland-scanner` is still required in `nativeBuildInputs`, otherwise
there's an error `No rule to make target '/input-method-unstable-v1.xml', needed by 'input-method-unstable-v1-protocol.c'.  Stop.`
---
 pkgs/tools/inputmethods/ibus/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index e38289e360b1..0bf98202344f 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -196,6 +196,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxkbcommon
     wayland
     wayland-protocols
+    wayland-scanner # For cross, build uses $PKG_CONFIG to look for wayland-scanner
   ];
 
   enableParallelBuilding = true;

From ce81f5cb0f4b200295bde0879e18143640ae262e Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 19 Aug 2025 19:46:05 +0200
Subject: [PATCH 08/45] nixosTests.modular-service-etc: Refine a test assertion

Didn't make it into the PR, oops.
---
 nixos/tests/modular-service-etc/test.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/modular-service-etc/test.nix b/nixos/tests/modular-service-etc/test.nix
index 8011444e15e4..7eee2f332a75 100644
--- a/nixos/tests/modular-service-etc/test.nix
+++ b/nixos/tests/modular-service-etc/test.nix
@@ -147,8 +147,9 @@
     print(f"Before switch - webserver PID: {webserver_pid}, api PID: {api_pid}")
 
     # Switch to the specialisation with updated content
-    switch_output = server.succeed("/run/current-system/specialisation/updated/bin/switch-to-configuration test")
-    print(f"Switch output: {switch_output}")
+    # Capture both stdout and stderr, and show stderr in real-time for debugging
+    switch_output = server.succeed("/run/current-system/specialisation/updated/bin/switch-to-configuration test 2>&1 | tee /dev/stderr")
+    print(f"Switch output (stdout+stderr): {switch_output}")
 
     # Verify services are not mentioned in the switch output (indicating they weren't touched)
     assert "webserver.service" not in switch_output, f"webserver.service was mentioned in switch output: {switch_output}"

From d88b9464b06021f35e35c30f880a989af58b7f92 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 19 Aug 2025 22:22:12 +0200
Subject: [PATCH 09/45] system.services: Remove ambiguous, redundant pkgs
 module argument

Primary reasons: remove implicit dependencies and force uniformity.
See nixos/modules/system/service/README.md for detailed rationale.
---
 nixos/README-modular-services.md              |  6 +-
 .../manual/development/modular-services.md    |  4 +-
 nixos/modules/system/service/README.md        | 90 +++++++++++++++++++
 .../system/service/portable/config-data.nix   |  5 +-
 .../system/service/portable/service.nix       |  1 -
 .../modules/system/service/systemd/system.nix | 11 +--
 .../python-http-server.nix                    | 20 +----
 nixos/tests/modular-service-etc/test.nix      | 30 ++++++-
 nixos/tests/php/fpm-modular.nix               |  2 +
 pkgs/by-name/gh/ghostunnel/package.nix        |  8 +-
 pkgs/by-name/gh/ghostunnel/service.nix        | 10 ++-
 pkgs/development/interpreters/php/generic.nix |  8 +-
 pkgs/development/interpreters/php/service.nix | 20 +++--
 13 files changed, 174 insertions(+), 41 deletions(-)

diff --git a/nixos/README-modular-services.md b/nixos/README-modular-services.md
index 6bb5c83626f5..f6e933173b2c 100644
--- a/nixos/README-modular-services.md
+++ b/nixos/README-modular-services.md
@@ -51,6 +51,10 @@ A [`_class`](https://nixos.org/manual/nixpkgs/unstable/#module-system-lib-evalMo
 Provide it as the first attribute in the module:
 
 ```nix
+# Non-module dependencies (`importApply`)
+{ writeScript, runtimeShell }:
+
+# Service module
 { lib, config, ... }:
 {
   _class = "service";
@@ -87,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru = {
     services = {
       default = {
-        imports = [ ./service.nix ];
+        imports = [ (lib.modules.importApply ./service.nix { inherit pkgs; }) ];
         example.package = finalAttrs.finalPackage;
         # ...
       };
diff --git a/nixos/doc/manual/development/modular-services.md b/nixos/doc/manual/development/modular-services.md
index 963da8f32b0b..c616b51fa933 100644
--- a/nixos/doc/manual/development/modular-services.md
+++ b/nixos/doc/manual/development/modular-services.md
@@ -85,7 +85,9 @@ Moving their logic into separate Nix files may still be beneficial for the effic
 
 ## Writing and Reviewing a Modular Service {#modular-service-review}
 
-Refer to the contributor documentation in [`nixos/README-modular-services.md`](https://github.com/NixOS/nixpkgs/blob/master/nixos/README-modular-services.md).
+A typical service module consists of the following:
+
+For more details, refer to the contributor documentation in [`nixos/README-modular-services.md`](https://github.com/NixOS/nixpkgs/blob/master/nixos/README-modular-services.md).
 
 ## Portable Service Options {#modular-service-options-portable}
 
diff --git a/nixos/modules/system/service/README.md b/nixos/modules/system/service/README.md
index 667abb511f52..fa4d0204611e 100644
--- a/nixos/modules/system/service/README.md
+++ b/nixos/modules/system/service/README.md
@@ -53,3 +53,93 @@ Many services implement automatic reloading or reloading on e.g. `SIGUSR1`, but
 
 - **Simple attribute structure**: Unlike `environment.etc`, `configData` uses a simpler structure with just `enable`, `name`, `text`, `source`, and `path` attributes. Complex ownership options were omitted for simplicity and portability.
   Per-service user creation is still TBD.
+
+## No `pkgs` module argument
+
+The modular service infrastructure avoids exposing `pkgs` as a module argument to service modules. Instead, derivations and builder functions are provided through lexical closure, making dependency relationships explicit and avoiding uncertainty about where dependencies come from.
+
+### Benefits
+
+- **Explicit dependencies**: Services declare what they need rather than implicitly depending on `pkgs`
+- **No interference**: Service modules can be reused in different contexts without assuming a specific `pkgs` instance. An unexpected `pkgs` version is not a failure mode anymore.
+- **Clarity**: With fewer ways to do things, there's no ambiguity about where dependencies come from (from the module, not the OS or service manager)
+
+### Implementation
+
+- **Portable layer**: Service modules in `portable/` do not receive `pkgs` as a module argument. Any required derivations must be provided by the caller.
+
+- **Systemd integration**: The `systemd/system.nix` module imports `config-data.nix` as a function, providing `pkgs` in lexical closure:
+  ```nix
+  (import ../portable/config-data.nix { inherit pkgs; })
+  ```
+
+- **Service modules**:
+  1. Should explicitly declare their package dependencies as options rather than using `pkgs` defaults:
+    ```nix
+    {
+      # Bad: uses pkgs module argument
+      foo.package = mkOption {
+        default = pkgs.python3;
+        # ...
+      };
+    }
+    ```
+
+    ```nix
+    {
+      # Good: caller provides the package
+      foo.package = mkOption {
+        type = types.package;
+        description = "Python package to use";
+        defaultText = lib.literalMD "The package that provided this module.";
+      };
+    }
+    ```
+
+  2. `passthru.services` can still provide a complete module using the package's lexical scope, making the module truly self-contained:
+
+    **Package (`package.nix`):**
+    ```nix
+    {
+      lib,
+      writeScript,
+      runtimeShell,
+    # ... other dependencies
+    }:
+    stdenv.mkDerivation (finalAttrs: {
+      # ... package definition
+
+      passthru.services.default = {
+        imports = [
+          (lib.modules.importApply ./service.nix {
+            inherit writeScript runtimeShell;
+          })
+        ];
+        someService.package = finalAttrs.finalPackage;
+      };
+    })
+    ```
+
+    **Service module (`service.nix`):**
+    ```nix
+    # Non-module dependencies (importApply)
+    { writeScript, runtimeShell }:
+
+    # Service module
+    {
+      lib,
+      config,
+      options,
+      ...
+    }:
+    {
+      # Service definition using writeScript, runtimeShell from lexical scope
+      process.argv = [
+        (writeScript "wrapper" ''
+          #!${runtimeShell}
+          # ... wrapper logic
+        '')
+        # ... other args
+      ];
+    }
+    ```
diff --git a/nixos/modules/system/service/portable/config-data.nix b/nixos/modules/system/service/portable/config-data.nix
index 84c4d53452a9..63f570140b55 100644
--- a/nixos/modules/system/service/portable/config-data.nix
+++ b/nixos/modules/system/service/portable/config-data.nix
@@ -1,10 +1,13 @@
 # Tests in: ../../../../tests/modular-service-etc/test.nix
+
+# Non-modular context provided by the modular services integration.
+{ pkgs }:
+
 # Configuration data support for portable services
 # This module provides configData for services, enabling configuration reloading
 # without terminating and restarting the service process.
 {
   lib,
-  pkgs,
   ...
 }:
 let
diff --git a/nixos/modules/system/service/portable/service.nix b/nixos/modules/system/service/portable/service.nix
index 339a99d7a856..9b9bce4082f2 100644
--- a/nixos/modules/system/service/portable/service.nix
+++ b/nixos/modules/system/service/portable/service.nix
@@ -11,7 +11,6 @@ in
   _class = "service";
   imports = [
     ../../../misc/assertions.nix
-    ./config-data.nix
   ];
   options = {
     services = mkOption {
diff --git a/nixos/modules/system/service/systemd/system.nix b/nixos/modules/system/service/systemd/system.nix
index 139eb8398751..978c59222e9c 100644
--- a/nixos/modules/system/service/systemd/system.nix
+++ b/nixos/modules/system/service/systemd/system.nix
@@ -73,16 +73,16 @@ in
           modules = [
             ./service.nix
             ./config-data-path.nix
+            (lib.modules.importApply ../portable/config-data.nix { inherit pkgs; })
 
-            # TODO: Consider removing pkgs. Service modules can provide their own
-            #       dependencies.
             {
               # Extend portable services option
               options.services = lib.mkOption {
                 type = types.attrsOf (
                   types.submoduleWith {
-                    specialArgs.pkgs = pkgs;
-                    modules = [ ];
+                    modules = [
+                      (lib.modules.importApply ../portable/config-data.nix { inherit pkgs; })
+                    ];
                   }
                 );
               };
@@ -90,9 +90,6 @@ in
           ];
           specialArgs = {
             # perhaps: features."systemd" = { };
-            # TODO: Consider removing pkgs. Service modules can provide their own
-            #       dependencies.
-            inherit pkgs;
             systemdPackage = config.systemd.package;
           };
         }
diff --git a/nixos/tests/modular-service-etc/python-http-server.nix b/nixos/tests/modular-service-etc/python-http-server.nix
index 539354c66de1..72315831ba94 100644
--- a/nixos/tests/modular-service-etc/python-http-server.nix
+++ b/nixos/tests/modular-service-etc/python-http-server.nix
@@ -3,7 +3,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 let
@@ -16,7 +15,6 @@ in
     python-http-server = {
       package = mkOption {
         type = types.package;
-        default = pkgs.python3;
         description = "Python package to use for the web server";
       };
 
@@ -46,21 +44,9 @@ in
     ];
 
     configData = {
-      # This should probably just be {} if we were to put this module in production.
-      "webroot" = lib.mkDefault {
-        source = pkgs.runCommand "default-webroot" { } ''
-          mkdir -p $out
-          cat > $out/index.html << 'EOF'
-          <!DOCTYPE html>
-          <html>
-          <head><title>Python Web Server</title></head>
-          <body>
-            <h1>Welcome to the Python Web Server</h1>
-            <p>Serving from port ${toString config.python-http-server.port}</p>
-          </body>
-          </html>
-          EOF
-        '';
+      "webroot" = {
+        # Enable only if directory is set to use this path
+        enable = lib.mkDefault (config.python-http-server.directory == config.configData."webroot".path);
       };
     };
   };
diff --git a/nixos/tests/modular-service-etc/test.nix b/nixos/tests/modular-service-etc/test.nix
index 7eee2f332a75..66e682871194 100644
--- a/nixos/tests/modular-service-etc/test.nix
+++ b/nixos/tests/modular-service-etc/test.nix
@@ -12,18 +12,44 @@
   nodes = {
     server =
       { pkgs, ... }:
+      let
+        # Normally the package services.default attribute combines this, but we
+        # don't have that, because this is not a production service. Should it be?
+        python-http-server = {
+          imports = [ ./python-http-server.nix ];
+          python-http-server.package = pkgs.python3;
+        };
+      in
       {
         system.services.webserver = {
           # The python web server is simple enough that it doesn't need a reload signal.
           # Other services may need to receive a signal in order to re-read what's in `configData`.
-          imports = [ ./python-http-server.nix ];
+          imports = [ python-http-server ];
           python-http-server = {
             port = 8080;
           };
 
+          configData = {
+            "webroot" = {
+              source = pkgs.runCommand "webroot" { } ''
+                mkdir -p $out
+                cat > $out/index.html << 'EOF'
+                <!DOCTYPE html>
+                <html>
+                <head><title>Python Web Server</title></head>
+                <body>
+                  <h1>Welcome to the Python Web Server</h1>
+                  <p>Serving from port 8080</p>
+                </body>
+                </html>
+                EOF
+              '';
+            };
+          };
+
           # Add a sub-service
           services.api = {
-            imports = [ ./python-http-server.nix ];
+            imports = [ python-http-server ];
             python-http-server = {
               port = 8081;
             };
diff --git a/nixos/tests/php/fpm-modular.nix b/nixos/tests/php/fpm-modular.nix
index cd95bbd7e098..360e664963cf 100644
--- a/nixos/tests/php/fpm-modular.nix
+++ b/nixos/tests/php/fpm-modular.nix
@@ -1,3 +1,5 @@
+# Run with:
+#   nix-build -A nixosTests.php.fpm-modular
 { lib, php, ... }:
 {
   name = "php-${php.version}-fpm-modular-nginx-test";
diff --git a/pkgs/by-name/gh/ghostunnel/package.nix b/pkgs/by-name/gh/ghostunnel/package.nix
index a057dd263d39..ed4cc9f9c7a5 100644
--- a/pkgs/by-name/gh/ghostunnel/package.nix
+++ b/pkgs/by-name/gh/ghostunnel/package.nix
@@ -7,6 +7,8 @@
   ghostunnel,
   apple-sdk_12,
   darwinMinVersionHook,
+  writeScript,
+  runtimeShell,
 }:
 
 buildGoModule rec {
@@ -41,7 +43,11 @@ buildGoModule rec {
   };
 
   passthru.services.default = {
-    imports = [ ./service.nix ];
+    imports = [
+      (lib.modules.importApply ./service.nix {
+        inherit writeScript runtimeShell;
+      })
+    ];
     ghostunnel.package = ghostunnel; # FIXME: finalAttrs.finalPackage
   };
 
diff --git a/pkgs/by-name/gh/ghostunnel/service.nix b/pkgs/by-name/gh/ghostunnel/service.nix
index 485ce30fc8e0..4fb7db2c3150 100644
--- a/pkgs/by-name/gh/ghostunnel/service.nix
+++ b/pkgs/by-name/gh/ghostunnel/service.nix
@@ -1,8 +1,11 @@
+# Non-module dependencies (`importApply`)
+{ writeScript, runtimeShell }:
+
+# Service module
 {
   lib,
   config,
   options,
-  pkgs,
   ...
 }:
 let
@@ -25,6 +28,7 @@ in
     ghostunnel = {
       package = mkOption {
         description = "Package to use for ghostunnel";
+        defaultText = "The ghostunnel package that provided this module.";
         type = types.package;
       };
 
@@ -191,8 +195,8 @@ in
             cfg.cacert
           ])
           (
-            pkgs.writeScript "load-credentials" ''
-              #!${pkgs.runtimeShell}
+            writeScript "load-credentials" ''
+              #!${runtimeShell}
               exec $@ ${
                 concatStringsSep " " (
                   optional (cfg.keystore != null) "--keystore=$CREDENTIALS_DIRECTORY/keystore"
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index 22e8b68e8b05..fd95f37dba32 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -32,6 +32,8 @@ let
       common-updater-scripts,
       curl,
       jq,
+      coreutils,
+      formats,
 
       version,
       phpSrc ? null,
@@ -390,7 +392,11 @@ let
             inherit ztsSupport;
 
             services.default = {
-              imports = [ ./service.nix ];
+              imports = [
+                (lib.modules.importApply ./service.nix {
+                  inherit formats coreutils;
+                })
+              ];
               php-fpm.package = lib.mkDefault finalAttrs.finalPackage;
             };
           };
diff --git a/pkgs/development/interpreters/php/service.nix b/pkgs/development/interpreters/php/service.nix
index 50fcbb649800..06b1247c5e20 100644
--- a/pkgs/development/interpreters/php/service.nix
+++ b/pkgs/development/interpreters/php/service.nix
@@ -1,13 +1,18 @@
+# Tests in: nixos/tests/php/fpm-modular.nix
+
+# Non-module dependencies (importApply)
+{ formats, coreutils }:
+
+# Service module
 {
   options,
   config,
-  pkgs,
   lib,
   ...
 }:
 let
   cfg = config.php-fpm;
-  format = pkgs.formats.iniWithGlobalSection { };
+  format = formats.iniWithGlobalSection { };
   configFile = format.generate "php-fpm.conf" {
     globalSection = lib.filterAttrs (_: v: !lib.isAttrs v) cfg.settings;
     sections = lib.filterAttrs (_: lib.isAttrs) cfg.settings;
@@ -76,8 +81,11 @@ in
   _class = "service";
 
   options.php-fpm = {
-    package = lib.mkPackageOption pkgs "php" {
-      example = ''
+    package = lib.mkOption {
+      type = lib.types.package;
+      description = "PHP package to use for php-fpm";
+      defaultText = lib.literalMD ''The PHP package that provided this module.'';
+      example = lib.literalExpression ''
         php.buildEnv {
           extensions =
             { all, ... }:
@@ -163,7 +171,7 @@ in
 
       serviceConfig = {
         Type = "notify";
-        ExecReload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID";
+        ExecReload = "${coreutils}/bin/kill -USR2 $MAINPID";
         RuntimeDirectory = "php-fpm";
         RuntimeDirectoryPreserve = true;
         Restart = "always";
@@ -175,7 +183,7 @@ in
 
     finit.service = {
       conditions = [ "service/syslogd/ready" ];
-      reload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID";
+      reload = "${coreutils}/bin/kill -USR2 $MAINPID";
       notify = "systemd";
     };
   };

From 90162e8113546e3d16f1b8dead39f3ba7fee6c43 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 20 Aug 2025 11:34:52 +0200
Subject: [PATCH 10/45] nixos/service/portable: Provide an entrypoint function

... and tidy up in various small ways.

This should help a bit to make more clear the separation between
the portable parts and the systemd system service parts.
---
 nixos/doc/manual/default.nix                  | 12 ++++-
 nixos/modules/system/service/portable/lib.nix | 46 ++++++++++++++++++-
 .../system/service/portable/service.nix       |  9 +++-
 .../system/service/systemd/service.nix        |  4 +-
 .../modules/system/service/systemd/system.nix | 41 ++++++-----------
 5 files changed, 81 insertions(+), 31 deletions(-)

diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index 33a2e250f0a3..b552986f526b 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -25,6 +25,7 @@ let
     escapeShellArg
     concatMapStringsSep
     sourceFilesBySuffices
+    modules
     ;
 
   common = import ./common.nix;
@@ -129,7 +130,16 @@ let
   '';
 
   portableServiceOptions = buildPackages.nixosOptionsDoc {
-    inherit (evalModules { modules = [ ../../modules/system/service/portable/service.nix ]; }) options;
+    inherit
+      (evalModules {
+        modules = [
+          (modules.importApply ../../modules/system/service/portable/service.nix {
+            pkgs = throw "nixos docs / portableServiceOptions: Do not reference pkgs in docs";
+          })
+        ];
+      })
+      options
+      ;
     inherit revision warningsAreErrors;
     transformOptions =
       opt:
diff --git a/nixos/modules/system/service/portable/lib.nix b/nixos/modules/system/service/portable/lib.nix
index 0529f81f8561..88db80f91494 100644
--- a/nixos/modules/system/service/portable/lib.nix
+++ b/nixos/modules/system/service/portable/lib.nix
@@ -1,6 +1,11 @@
 { lib, ... }:
 let
-  inherit (lib) concatLists mapAttrsToList showOption;
+  inherit (lib)
+    concatLists
+    mapAttrsToList
+    showOption
+    types
+    ;
 in
 rec {
   flattenMapServicesConfigToList =
@@ -30,4 +35,43 @@ rec {
       assertion = ass.assertion;
     }) config.assertions
   );
+
+  /**
+    This is the entrypoint for the portable part of modular services.
+
+    It provides the various options that are consumed by service manager implementations.
+
+    # Inputs
+
+    `serviceManagerPkgs`: A Nixpkgs instance which will be used for built-in logic such as converting `configData.<path>.text` to a store path.
+
+    `extraRootModules`: Modules to be loaded into the "root" service submodule, but not into its sub-`services`. That's the modules' own responsibility.
+
+    `extraRootSpecialArgs`: Fixed module arguments that are provided in a similar manner to `extraRootModules`.
+
+    # Output
+
+    An attribute set.
+
+    `serviceSubmodule`: a Module System option type which is a `submodule` with the portable modules and this function's inputs loaded into it.
+  */
+  configure =
+    {
+      serviceManagerPkgs,
+      extraRootModules ? [ ],
+      extraRootSpecialArgs ? { },
+    }:
+    let
+      modules = [
+        (lib.modules.importApply ./service.nix { pkgs = serviceManagerPkgs; })
+      ];
+      serviceSubmodule = types.submoduleWith {
+        class = "service";
+        modules = modules ++ extraRootModules;
+        specialArgs = extraRootSpecialArgs;
+      };
+    in
+    {
+      inherit serviceSubmodule;
+    };
 }
diff --git a/nixos/modules/system/service/portable/service.nix b/nixos/modules/system/service/portable/service.nix
index 9b9bce4082f2..3295a6e3bb44 100644
--- a/nixos/modules/system/service/portable/service.nix
+++ b/nixos/modules/system/service/portable/service.nix
@@ -1,3 +1,9 @@
+# Non-module arguments
+# These are separate from the module arguments to avoid implicit dependencies.
+# This makes service modules self-contains, allowing mixing of Nixpkgs versions.
+{ pkgs }:
+
+# The module
 {
   lib,
   ...
@@ -11,13 +17,14 @@ in
   _class = "service";
   imports = [
     ../../../misc/assertions.nix
+    (lib.modules.importApply ./config-data.nix { inherit pkgs; })
   ];
   options = {
     services = mkOption {
       type = types.attrsOf (
         types.submoduleWith {
           modules = [
-            ./service.nix
+            (lib.modules.importApply ./service.nix { inherit pkgs; })
           ];
         }
       );
diff --git a/nixos/modules/system/service/systemd/service.nix b/nixos/modules/system/service/systemd/service.nix
index 9ba9bb7bf3f2..30c2335b81e3 100644
--- a/nixos/modules/system/service/systemd/service.nix
+++ b/nixos/modules/system/service/systemd/service.nix
@@ -52,8 +52,8 @@ let
 
 in
 {
+  _class = "service";
   imports = [
-    ../portable/service.nix
     (lib.mkAliasOptionModule [ "systemd" "service" ] [ "systemd" "services" "" ])
     (lib.mkAliasOptionModule [ "systemd" "socket" ] [ "systemd" "sockets" "" ])
   ];
@@ -101,6 +101,8 @@ in
           };
         }
       );
+      # Rendered by the portable docs instead.
+      visible = false;
     };
   };
   config = {
diff --git a/nixos/modules/system/service/systemd/system.nix b/nixos/modules/system/service/systemd/system.nix
index 978c59222e9c..3405072089e1 100644
--- a/nixos/modules/system/service/systemd/system.nix
+++ b/nixos/modules/system/service/systemd/system.nix
@@ -59,41 +59,28 @@ let
     // concatMapAttrs (
       subServiceName: subService: makeUnits unitType (dash prefix subServiceName) subService
     ) service.services;
+
+  modularServiceConfiguration = portable-lib.configure {
+    serviceManagerPkgs = pkgs;
+    extraRootModules = [
+      ./service.nix
+      ./config-data-path.nix
+    ];
+    extraRootSpecialArgs = {
+      systemdPackage = config.systemd.package;
+    };
+  };
 in
 {
+  _class = "nixos";
+
   # First half of the magic: mix systemd logic into the otherwise abstract services
   options = {
     system.services = mkOption {
       description = ''
         A collection of NixOS [modular services](https://nixos.org/manual/nixos/unstable/#modular-services) that are configured as systemd services.
       '';
-      type = types.attrsOf (
-        types.submoduleWith {
-          class = "service";
-          modules = [
-            ./service.nix
-            ./config-data-path.nix
-            (lib.modules.importApply ../portable/config-data.nix { inherit pkgs; })
-
-            {
-              # Extend portable services option
-              options.services = lib.mkOption {
-                type = types.attrsOf (
-                  types.submoduleWith {
-                    modules = [
-                      (lib.modules.importApply ../portable/config-data.nix { inherit pkgs; })
-                    ];
-                  }
-                );
-              };
-            }
-          ];
-          specialArgs = {
-            # perhaps: features."systemd" = { };
-            systemdPackage = config.systemd.package;
-          };
-        }
-      );
+      type = types.attrsOf modularServiceConfiguration.serviceSubmodule;
       default = { };
       visible = "shallow";
     };

From 8a7e4f589a52eac93a60f13b4a4a07efc78b9d2b Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 20 Aug 2025 11:50:42 +0200
Subject: [PATCH 11/45] nixos/portable/test.nix: Fix test

---
 .../modules/system/service/portable/test.nix  | 26 ++++++++++++-------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/nixos/modules/system/service/portable/test.nix b/nixos/modules/system/service/portable/test.nix
index 5f78208dc4eb..f1d508805870 100644
--- a/nixos/modules/system/service/portable/test.nix
+++ b/nixos/modules/system/service/portable/test.nix
@@ -7,6 +7,12 @@ let
 
   portable-lib = import ./lib.nix { inherit lib; };
 
+  configured = portable-lib.configure {
+    serviceManagerPkgs = throw "do not use pkgs in this test";
+    extraRootModules = [ ];
+    extraRootSpecialArgs = { };
+  };
+
   dummyPkg =
     name:
     derivation {
@@ -79,23 +85,25 @@ let
     modules = [
       {
         options.services = mkOption {
-          type = types.attrsOf (
-            types.submoduleWith {
-              class = "service";
-              modules = [
-                ./service.nix
-              ];
-            }
-          );
+          type = types.attrsOf configured.serviceSubmodule;
         };
       }
       exampleConfig
     ];
   };
 
+  filterEval =
+    config:
+    lib.optionalAttrs (config ? process) {
+      inherit (config) assertions warnings process;
+    }
+    // {
+      services = lib.mapAttrs (k: filterEval) config.services;
+    };
+
   test =
     assert
-      exampleEval.config == {
+      filterEval exampleEval.config == {
         services = {
           service1 = {
             process = {

From a9d5b9c660eebc54346913f0238db2fc63c8429b Mon Sep 17 00:00:00 2001
From: Martin Joerg <martin.joerg@gmail.com>
Date: Sat, 23 Aug 2025 18:24:01 +0000
Subject: [PATCH 12/45] osm-gps-map: fix build

---
 pkgs/by-name/os/osm-gps-map/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/os/osm-gps-map/package.nix b/pkgs/by-name/os/osm-gps-map/package.nix
index ac31cbf184fb..39d4926eef6e 100644
--- a/pkgs/by-name/os/osm-gps-map/package.nix
+++ b/pkgs/by-name/os/osm-gps-map/package.nix
@@ -7,6 +7,8 @@
   gnome-common,
   gtk3,
   gobject-introspection,
+  autoreconfHook,
+  gtk-doc,
   pkg-config,
   lib,
   stdenv,
@@ -50,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
+    autoreconfHook
+    gtk-doc
     pkg-config
     gobject-introspection
     gnome-common

From 38a6bd63b4aa45a6e79a46bf9243d1be86d187fa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 23 Aug 2025 18:29:36 +0000
Subject: [PATCH 13/45] mise: 2025.8.10 -> 2025.8.20

---
 pkgs/by-name/mi/mise/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index a560370d678f..456d08a7d981 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -21,16 +21,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2025.8.10";
+  version = "2025.8.20";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-ycYB/XuaTwGmXzh59cxt5KC1v0gqoTB67MMmpCsR6o8=";
+    hash = "sha256-zjb0ND6U/fe/1h+0LdTDYLIpsSPTvGhWOhFOb4vmiT0=";
   };
 
-  cargoHash = "sha256-9YHW8jO+K1YZjmfN+KxctConrvp6yYODnRoSwIFxryU=";
+  cargoHash = "sha256-kebXsDAtQjEtAVCD76n5/A9hB1Sj+ww9MoHcfm/ucBs=";
 
   nativeBuildInputs = [
     installShellFiles

From 801fad36ce3d08cb1b8300e79e3a8d77270a6c3f Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sun, 24 Aug 2025 13:22:21 +0200
Subject: [PATCH 14/45] zstd: set meta.pkgConfigModules

I've chosen to use zstd from the pkgs fix point for the pkg-config test
instead of using finalAttrs.finalPackage because this is effectively
also done for all the other tests (they test bindings from the pkgs fix
point which get their zstd from the pkgs fix point).
---
 pkgs/tools/compression/zstd/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 98c0dcfb6713..ebca23a792bc 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -24,6 +24,8 @@
   curl,
   python3Packages,
   haskellPackages,
+  testers,
+  zstd,
 }:
 
 stdenv.mkDerivation rec {
@@ -126,6 +128,7 @@ stdenv.mkDerivation rec {
       python-zstd = python3Packages.zstd;
       haskell-zstd = haskellPackages.zstd;
       haskell-hs-zstd = haskellPackages.hs-zstd;
+      pkg-config = testers.hasPkgConfigModules { package = zstd; };
     };
   };
 
@@ -146,5 +149,6 @@ stdenv.mkDerivation rec {
     mainProgram = "zstd";
     platforms = platforms.all;
     maintainers = with maintainers; [ orivej ];
+    pkgConfigModules = [ "libzstd" ];
   };
 }

From e17a4719a967e856428eab1537cf511152f5e59a Mon Sep 17 00:00:00 2001
From: YoshiRulz <OSSYoshiRulz+git@gmail.com>
Date: Tue, 26 Aug 2025 04:16:00 +1000
Subject: [PATCH 15/45] lib.toList: fix typo in docs

---
 lib/lists.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/lists.nix b/lib/lists.nix
index 226e264176a0..3d324e545dd4 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -829,7 +829,7 @@ rec {
     toList [ 1 2 ]
     => [ 1 2 ]
     toList "hi"
-    => [ "hi "]
+    => [ "hi" ]
     ```
 
     :::

From c74e5ffb6526ac1b4870504921b9ba9362189a17 Mon Sep 17 00:00:00 2001
From: Luna Nova <git@lunnova.dev>
Date: Sun, 24 Aug 2025 08:08:00 -0700
Subject: [PATCH 16/45] python3Packages.triton: always support ROCm

ROCm packages are a runtime only dep for triton. triton-llvm always supports AMD GPU targets,
so we can reduce how many different builds of triton are needed by teaching triton to better search
for libamdhip64.so and ld.lld.
---
 doc/release-notes/rl-2511.section.md          |  2 +
 .../python-modules/torch/source/default.nix   |  8 +--
 ...river-short-circuit-before-ldconfig.patch} | 14 -----
 .../triton/0005-amd-search-env-paths.patch    | 60 +++++++++++++++++++
 .../python-modules/triton/default.nix         | 55 ++++++++++++++++-
 5 files changed, 115 insertions(+), 24 deletions(-)
 rename pkgs/development/python-modules/triton/{0002-nvidia-amd-driver-short-circuit-before-ldconfig.patch => 0002-nvidia-driver-short-circuit-before-ldconfig.patch} (53%)
 create mode 100644 pkgs/development/python-modules/triton/0005-amd-search-env-paths.patch

diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 1b956d41d37f..b5576f39dcb3 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -68,6 +68,8 @@
   The binary name remains `webfontkitgenerator`.
   The `webfontkitgenerator` package is an alias to `webfont-bundler`.
 
+- `python3Packages.triton` no longer takes an `enableRocm` argument and supports ROCm in all build configurations via runtime binding. In most cases no action will be needed. If triton is unable to find the HIP SDK add `rocmPackages.clr` as a build input or set the environment variable `HIP_PATH="${rocmPackages.clr}"`.
+
 - `inspircd` has been updated to the v4 release series. Please refer to the upstream documentation for [general information](https://docs.inspircd.org/4/overview/#v4-overview) and a list of [breaking changes](https://docs.inspircd.org/4/breaking-changes/).
 
 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.
diff --git a/pkgs/development/python-modules/torch/source/default.nix b/pkgs/development/python-modules/torch/source/default.nix
index 014c01adca4d..ccd0ac5c6956 100644
--- a/pkgs/development/python-modules/torch/source/default.nix
+++ b/pkgs/development/python-modules/torch/source/default.nix
@@ -72,13 +72,7 @@
   #          (dependencies without cuda support).
   #          Instead we should rely on overlays and nixpkgsFun.
   # (@SomeoneSerge)
-  _tritonEffective ?
-    if cudaSupport then
-      triton-cuda
-    else if rocmSupport then
-      rocmPackages.triton
-    else
-      triton,
+  _tritonEffective ? if cudaSupport then triton-cuda else triton,
   triton-cuda,
 
   # Disable MKLDNN on aarch64-darwin, it negatively impacts performance,
diff --git a/pkgs/development/python-modules/triton/0002-nvidia-amd-driver-short-circuit-before-ldconfig.patch b/pkgs/development/python-modules/triton/0002-nvidia-driver-short-circuit-before-ldconfig.patch
similarity index 53%
rename from pkgs/development/python-modules/triton/0002-nvidia-amd-driver-short-circuit-before-ldconfig.patch
rename to pkgs/development/python-modules/triton/0002-nvidia-driver-short-circuit-before-ldconfig.patch
index 9600680567ce..13077545d7ef 100644
--- a/pkgs/development/python-modules/triton/0002-nvidia-amd-driver-short-circuit-before-ldconfig.patch
+++ b/pkgs/development/python-modules/triton/0002-nvidia-driver-short-circuit-before-ldconfig.patch
@@ -1,17 +1,3 @@
-diff --git a/third_party/amd/backend/driver.py b/third_party/amd/backend/driver.py
-index ca712f904..0961d2dda 100644
---- a/third_party/amd/backend/driver.py
-+++ b/third_party/amd/backend/driver.py
-@@ -79,6 +79,9 @@ def _get_path_to_hip_runtime_dylib():
-             return mmapped_path
-         raise RuntimeError(f"memory mapped '{mmapped_path}' in process does not point to a valid {lib_name}")
- 
-+    if os.path.isdir("@libhipDir@"):
-+        return ["@libhipDir@"]
-+
-     paths = []
- 
-     import site
 diff --git a/third_party/nvidia/backend/driver.py b/third_party/nvidia/backend/driver.py
 index d088ec092..625de2db8 100644
 --- a/third_party/nvidia/backend/driver.py
diff --git a/pkgs/development/python-modules/triton/0005-amd-search-env-paths.patch b/pkgs/development/python-modules/triton/0005-amd-search-env-paths.patch
new file mode 100644
index 000000000000..8f46c826c2fd
--- /dev/null
+++ b/pkgs/development/python-modules/triton/0005-amd-search-env-paths.patch
@@ -0,0 +1,60 @@
+From 9e4e58b647c17c5fa098c8a74e221f88d3cb1a43 Mon Sep 17 00:00:00 2001
+From: Luna Nova <git@lunnova.dev>
+Date: Sun, 24 Aug 2025 07:41:30 -0700
+Subject: [PATCH] [AMD] Search HIP_PATH, hipconfig, and ROCM_PATH for
+ libamdhip64
+
+Search for libamdhip64 from HIP_PATH env var, hipconfig --path output,
+and ROCM_PATH before looking in system-wide ldconfig or /opt/rocm.
+
+The system-wide ROCm path isn't guaranteed to be where the ROCm
+install we're building against is located, so follow typical ROCm
+lib behavior and look under env paths first.
+
+This is especially important for non-FHS distros like NixOS
+where /opt/rocm never exists, but may be useful in more
+typical distros if multiple ROCm installs are present
+to ensure the right libamdhip64.so is picked up.
+---
+ third_party/amd/backend/driver.py | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/third_party/amd/backend/driver.py b/third_party/amd/backend/driver.py
+index af8e1a5c8097..57b0f7388c60 100644
+--- a/third_party/amd/backend/driver.py
++++ b/third_party/amd/backend/driver.py
+@@ -110,6 +110,34 @@ def _get_path_to_hip_runtime_dylib():
+                 return f
+             paths.append(f)
+ 
++    # HIP_PATH should point to HIP SDK root if set
++    env_hip_path = os.getenv("HIP_PATH")
++    if env_hip_path:
++        hip_lib_path = os.path.join(env_hip_path, "lib", lib_name)
++        if os.path.exists(hip_lib_path):
++            return hip_lib_path
++        paths.append(hip_lib_path)
++
++    # if available, `hipconfig --path` prints the HIP SDK root
++    try:
++        hip_root = subprocess.check_output(["hipconfig", "--path"]).decode().strip()
++        if hip_root:
++            hip_lib_path = os.path.join(hip_root, "lib", lib_name)
++            if os.path.exists(hip_lib_path):
++                return hip_lib_path
++            paths.append(hip_lib_path)
++    except (subprocess.CalledProcessError, FileNotFoundError):
++        # hipconfig may not be available
++        pass
++
++    # ROCm lib dir based on env var
++    env_rocm_path = os.getenv("ROCM_PATH")
++    if env_rocm_path:
++        rocm_lib_path = os.path.join(env_rocm_path, "lib", lib_name)
++        if os.path.exists(rocm_lib_path):
++            return rocm_lib_path
++        paths.append(rocm_lib_path)
++
+     # Afterwards try to search the loader dynamic library resolution paths.
+     libs = subprocess.check_output(["/sbin/ldconfig", "-p"]).decode(errors="ignore")
+     # each line looks like the following:
diff --git a/pkgs/development/python-modules/triton/default.nix b/pkgs/development/python-modules/triton/default.nix
index ab0db19f9bca..c22016654700 100644
--- a/pkgs/development/python-modules/triton/default.nix
+++ b/pkgs/development/python-modules/triton/default.nix
@@ -23,7 +23,7 @@
   torchWithRocm,
   zlib,
   cudaSupport ? config.cudaSupport,
-  rocmSupport ? config.rocmSupport,
+  runCommand,
   rocmPackages,
   triton,
 }:
@@ -45,11 +45,12 @@ buildPythonPackage rec {
     (replaceVars ./0001-_build-allow-extra-cc-flags.patch {
       ccCmdExtraFlags = "-Wl,-rpath,${addDriverRunpath.driverLink}/lib";
     })
-    (replaceVars ./0002-nvidia-amd-driver-short-circuit-before-ldconfig.patch {
-      libhipDir = if rocmSupport then "${lib.getLib rocmPackages.clr}/lib" else null;
+    (replaceVars ./0002-nvidia-driver-short-circuit-before-ldconfig.patch {
       libcudaStubsDir =
         if cudaSupport then "${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs" else null;
     })
+    # Upstream PR: https://github.com/triton-lang/triton/pull/7959
+    ./0005-amd-search-env-paths.patch
   ]
   ++ lib.optionals cudaSupport [
     (replaceVars ./0003-nvidia-cudart-a-systempath.patch {
@@ -81,6 +82,13 @@ buildPythonPackage rec {
       substituteInPlace cmake/AddTritonUnitTest.cmake \
         --replace-fail "include(\''${PROJECT_SOURCE_DIR}/unittest/googletest.cmake)" ""\
         --replace-fail "include(GoogleTest)" "find_package(GTest REQUIRED)"
+    ''
+    # Don't use FHS path for ROCm LLD
+    # Remove this after `[AMD] Use lld library API #7548` makes it into a release
+    + ''
+      substituteInPlace third_party/amd/backend/compiler.py \
+        --replace-fail 'lld = Path("/opt/rocm/llvm/bin/ld.lld")' \
+        "import os;lld = Path(os.getenv('HIP_PATH', '/opt/rocm/')"' + "/llvm/bin/ld.lld")'
     '';
 
   build-system = [ setuptools ];
@@ -205,6 +213,47 @@ buildPythonPackage rec {
     # Ultimately, torch is our test suite:
     inherit torchWithRocm;
 
+    # Test that _get_path_to_hip_runtime_dylib works when ROCm is available at runtime
+    rocm-libamdhip64-path =
+      runCommand "triton-rocm-libamdhip64-path-test"
+        {
+          buildInputs = [
+            triton
+            python
+            rocmPackages.clr
+          ];
+        }
+        ''
+          python -c "
+          import os
+          import triton
+          path = triton.backends.amd.driver._get_path_to_hip_runtime_dylib()
+          print(f'libamdhip64 path: {path}')
+          assert os.path.exists(path)
+          " && touch $out
+        '';
+
+    # Test that path_to_rocm_lld works when ROCm is available at runtime
+    # Remove this after `[AMD] Use lld library API #7548` makes it into a release
+    rocm-lld-path =
+      runCommand "triton-rocm-lld-test"
+        {
+          buildInputs = [
+            triton
+            python
+            rocmPackages.clr
+          ];
+        }
+        ''
+          python -c "
+          import os
+          import triton
+          path = triton.backends.backends['amd'].compiler.path_to_rocm_lld()
+          print(f'ROCm LLD path: {path}')
+          assert os.path.exists(path)
+          " && touch $out
+        '';
+
     # Test as `nix run -f "<nixpkgs>" python3Packages.triton.tests.axpy-cuda`
     # or, using `programs.nix-required-mounts`, as `nix build -f "<nixpkgs>" python3Packages.triton.tests.axpy-cuda.gpuCheck`
     axpy-cuda =

From 5f54847b0e101929eed58439cd9ab7eafccb9327 Mon Sep 17 00:00:00 2001
From: Luna Nova <git@lunnova.dev>
Date: Sun, 24 Aug 2025 08:08:18 -0700
Subject: [PATCH 17/45] rocmPackages.triton: remove in favor of
 python3Packages.triton

---
 doc/release-notes/rl-2511.section.md          |  2 +
 pkgs/development/rocm-modules/6/default.nix   | 19 ++-----
 .../rocm-modules/6/triton/default.nix         | 56 -------------------
 3 files changed, 6 insertions(+), 71 deletions(-)
 delete mode 100644 pkgs/development/rocm-modules/6/triton/default.nix

diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index b5576f39dcb3..4179f71d42a0 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -93,6 +93,8 @@
 
 - `privatebin` has been updated to `2.0.0`. This release changes configuration defaults including switching the template and removing legacy features. See the [v2.0.0 changelog entry](https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.0) for details on how to upgrade.
 
+- `rocmPackages.triton` has been removed in favor of `python3Packages.triton`.
+
 - `go-mockery` has been updated to v3. For migration instructions see the [upstream documentation](https://vektra.github.io/mockery/latest/v3/). If v2 is still required `go-mockery_v2` has been added but will be removed on or before 2029-12-31 in-line with it's [upstream support lifecycle](https://vektra.github.io/mockery/
 
 - [private-gpt](https://github.com/zylon-ai/private-gpt) service has been removed by lack of maintenance upstream.
diff --git a/pkgs/development/rocm-modules/6/default.nix b/pkgs/development/rocm-modules/6/default.nix
index 47588fd29446..a113ce0925ac 100644
--- a/pkgs/development/rocm-modules/6/default.nix
+++ b/pkgs/development/rocm-modules/6/default.nix
@@ -264,21 +264,6 @@ let
       );
       mpi = self.openmpi;
 
-      triton-llvm = triton-llvm.overrideAttrs {
-        src = fetchFromGitHub {
-          owner = "llvm";
-          repo = "llvm-project";
-          # make sure this matches triton llvm rel branch hash for now
-          # https://github.com/triton-lang/triton/blob/release/3.2.x/cmake/llvm-hash.txt
-          rev = "86b69c31642e98f8357df62c09d118ad1da4e16a";
-          hash = "sha256-W/mQwaLGx6/rIBjdzUTIbWrvGjdh7m4s15f70fQ1/hE=";
-        };
-        pname = "triton-llvm-rocm";
-        patches = [ ]; # FIXME: https://github.com/llvm/llvm-project//commit/84837e3cc1cf17ed71580e3ea38299ed2bfaa5f6.patch doesn't apply, may need to rebase
-      };
-
-      triton = pyPackages.callPackage ./triton { rocmPackages = self; };
-
       ## Meta ##
       # Emulate common ROCm meta layout
       # These are mainly for users. I strongly suggest NOT using these in nixpkgs derivations
@@ -454,6 +439,10 @@ let
       };
     }
     // lib.optionalAttrs config.allowAliases {
+      triton = throw ''
+        'rocmPackages.triton' has been removed. Please use python3Packages.triton
+      ''; # Added 2025-08-24
+
       rocm-thunk = throw ''
         'rocm-thunk' has been removed. It's now part of the ROCm runtime.
       ''; # Added 2025-3-16
diff --git a/pkgs/development/rocm-modules/6/triton/default.nix b/pkgs/development/rocm-modules/6/triton/default.nix
deleted file mode 100644
index 8dc20629a219..000000000000
--- a/pkgs/development/rocm-modules/6/triton/default.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{
-  triton-no-cuda,
-  rocmPackages,
-  fetchFromGitHub,
-}:
-(triton-no-cuda.override (_old: {
-  inherit rocmPackages;
-  rocmSupport = true;
-  stdenv = rocmPackages.llvm.rocmClangStdenv;
-  llvm = rocmPackages.triton-llvm;
-})).overridePythonAttrs
-  (old: {
-    doCheck = false;
-    stdenv = rocmPackages.llvm.rocmClangStdenv;
-    version = "3.2.0";
-    src = fetchFromGitHub {
-      owner = "triton-lang";
-      repo = "triton";
-      rev = "9641643da6c52000c807b5eeed05edaec4402a67"; # "release/3.2.x";
-      hash = "sha256-V1lpARwOLn28ZHfjiWR/JJWGw3MB34c+gz6Tq1GOVfo=";
-    };
-    buildInputs = old.buildInputs ++ [
-      rocmPackages.clr
-    ];
-    dontStrip = true;
-    env = old.env // {
-      CXXFLAGS = "-O3 -I${rocmPackages.clr}/include -I/build/source/third_party/triton/third_party/nvidia/backend/include";
-      TRITON_OFFLINE_BUILD = 1;
-    };
-    patches = [ ];
-    postPatch = ''
-      # Remove nvidia backend so we don't depend on unfree nvidia headers
-      # when we only want to target ROCm
-      rm -rf third_party/nvidia
-      substituteInPlace CMakeLists.txt \
-        --replace-fail "add_subdirectory(test)" ""
-      sed -i '/nvidia\|NVGPU\|registerConvertTritonGPUToLLVMPass\|mlir::test::/Id' bin/RegisterTritonDialects.h
-      sed -i '/TritonTestAnalysis/Id' bin/CMakeLists.txt
-      substituteInPlace python/setup.py \
-        --replace-fail 'backends = [*BackendInstaller.copy(["nvidia", "amd"]), *BackendInstaller.copy_externals()]' \
-        'backends = [*BackendInstaller.copy(["amd"]), *BackendInstaller.copy_externals()]'
-      find . -type f -exec sed -i 's|[<]cupti.h[>]|"cupti.h"|g' {} +
-      find . -type f -exec sed -i 's|[<]cuda.h[>]|"cuda.h"|g' {} +
-      # remove any downloads
-      substituteInPlace python/setup.py \
-        --replace-fail "[get_json_package_info()]" "[]"\
-        --replace-fail "[get_llvm_package_info()]" "[]"\
-        --replace-fail "curr_version != version" "False"
-      # Don't fetch googletest
-      substituteInPlace cmake/AddTritonUnitTest.cmake \
-        --replace-fail 'include(''${PROJECT_SOURCE_DIR}/unittest/googletest.cmake)' "" \
-        --replace-fail "include(GoogleTest)" "find_package(GTest REQUIRED)"
-      substituteInPlace third_party/amd/backend/compiler.py \
-        --replace-fail '"/opt/rocm/llvm/bin/ld.lld"' "os.environ['ROCM_PATH']"' + "/llvm/bin/ld.lld"'
-    '';
-  })

From fc53730d948e41d1bd31ac628331cee905f90881 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 26 Aug 2025 02:18:53 +0000
Subject: [PATCH 18/45] telepresence2: 2.23.6 -> 2.24.0

---
 pkgs/by-name/te/telepresence2/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/telepresence2/package.nix b/pkgs/by-name/te/telepresence2/package.nix
index fdc464c23f5e..ca8947c1879a 100644
--- a/pkgs/by-name/te/telepresence2/package.nix
+++ b/pkgs/by-name/te/telepresence2/package.nix
@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.23.6";
+  version = "2.24.0";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    hash = "sha256-bo98R5uWOg219JF5czUd3XPznyXpphQMJtsgF5xJFqE=";
+    hash = "sha256-aqL2AjDscN6o9WKur3ed5SU3XQJy6hAu/QUD7Fh/0pE=";
   };
 
   propagatedBuildInputs = [
@@ -51,7 +51,7 @@ buildGoModule rec {
     export CGO_ENABLED=0
   '';
 
-  vendorHash = "sha256-DAbPgLt0CGdbfDmMXZDyjStyeb4A1dPCNiJMH1NUAUg=";
+  vendorHash = "sha256-ncMquDrlkcf71voCbxadOM+EKO/7olMEAf5FOFoxrvA=";
 
   ldflags = [
     "-s"

From 0b388762f2ce0b771f463b4db34243e2c91c804c Mon Sep 17 00:00:00 2001
From: Jack Rosenberg <github@jackr.eu>
Date: Tue, 26 Aug 2025 20:13:09 +0200
Subject: [PATCH 19/45] fosrl-pangolin: 1.9.0 -> 1.9.1

---
 pkgs/by-name/fo/fosrl-pangolin/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fo/fosrl-pangolin/package.nix b/pkgs/by-name/fo/fosrl-pangolin/package.nix
index 50ca8ad15e5c..c2289acd3683 100644
--- a/pkgs/by-name/fo/fosrl-pangolin/package.nix
+++ b/pkgs/by-name/fo/fosrl-pangolin/package.nix
@@ -28,13 +28,13 @@ in
 
 buildNpmPackage (finalAttrs: {
   pname = "pangolin";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "pangolin";
     tag = finalAttrs.version;
-    hash = "sha256-X8Jvk/1gDj4cqXP3vlsrhWEM5lR42FsQ0HaSNeNxTXg=";
+    hash = "sha256-r0/HtRWdlDV749yT2pMnKqQKKYm6FPpcy3eul6M8iDQ=";
   };
 
   npmDepsHash = "sha256-OygskQhveT9CiymOOd5gx+aR9v3nMUZj72k/om3IF/c=";

From 533668c73a63bc7d0c81c646d5beebe29b75fa1e Mon Sep 17 00:00:00 2001
From: Roosembert Palacios <roosemberth@posteo.ch>
Date: Tue, 26 Aug 2025 22:20:30 +0200
Subject: [PATCH 20/45] git-annex: Remove myself as a maintainer

I can not spend time to maintain this package.

Signed-off-by: Roosembert Palacios <roosemberth@posteo.ch>
---
 .../haskell-modules/configuration-hackage2nix/main.yaml         | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
index beeb87c5306f..f9a27aca8843 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -435,8 +435,6 @@ package-maintainers:
     - hercules-ci-cnix-store
     - inline-c
     - inline-c-cpp
-  roosemberth:
-    - git-annex
   rvl:
     - taffybar
     - arbtt

From a979b67c367998a533b239eac7f6b289d40607d4 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 26 Aug 2025 22:24:32 +0200
Subject: [PATCH 21/45] python3Packages.pyocd: fix

---
 .../python-modules/pyocd/default.nix          | 27 ++++++++-----------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/python-modules/pyocd/default.nix b/pkgs/development/python-modules/pyocd/default.nix
index a6ba9cd6c745..b5d53d11cf9e 100644
--- a/pkgs/development/python-modules/pyocd/default.nix
+++ b/pkgs/development/python-modules/pyocd/default.nix
@@ -1,8 +1,13 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
+
+  # build-system
+  setuptools-scm,
+
+  # dependencies
   capstone,
   cmsis-pack-manager,
   colorama,
@@ -17,10 +22,10 @@
   pylink-square,
   pyusb,
   pyyaml,
-  setuptools-scm,
   typing-extensions,
-  stdenv,
   hidapi,
+
+  # tests
   pytestCheckHook,
 }:
 
@@ -36,16 +41,6 @@ buildPythonPackage rec {
     hash = "sha256-4fdVcTNH125e74S3mA/quuDun17ntGCazX6CV+obUGc=";
   };
 
-  patches = [
-    # https://github.com/pyocd/pyOCD/pull/1332
-    # merged into develop
-    (fetchpatch {
-      name = "libusb-package-optional.patch";
-      url = "https://github.com/pyocd/pyOCD/commit/0b980cf253e3714dd2eaf0bddeb7172d14089649.patch";
-      hash = "sha256-B2+50VntcQELeakJbCeJdgI1iBU+h2NkXqba+LRYa/0=";
-    })
-  ];
-
   pythonRelaxDeps = [ "capstone" ];
   pythonRemoveDeps = [ "libusb-package" ];
 
@@ -80,13 +75,13 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/pyocd/pyOCD/releases/tag/${src.tag}";
     description = "Python library for programming and debugging Arm Cortex-M microcontrollers";
     downloadPage = "https://github.com/pyocd/pyOCD";
     homepage = "https://pyocd.io";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       frogamic
       sbruder
     ];

From fa927b3abc3c172b8750620674f4c59224b03015 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 26 Aug 2025 23:32:16 +0200
Subject: [PATCH 22/45] python3Packages.spsdk-pyocd: relax pyocd dependency

---
 pkgs/development/python-modules/spsdk-pyocd/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/spsdk-pyocd/default.nix b/pkgs/development/python-modules/spsdk-pyocd/default.nix
index bd10411161e5..ef16cf229f66 100644
--- a/pkgs/development/python-modules/spsdk-pyocd/default.nix
+++ b/pkgs/development/python-modules/spsdk-pyocd/default.nix
@@ -35,6 +35,10 @@ buildPythonPackage rec {
     setuptools
   ];
 
+  pythonRelaxDeps = [
+    "pyocd"
+  ];
+
   dependencies = [
     pyocd
   ];

From 215fb0a9ea0542f2fcfd6e8abe1bd578b19ecd35 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 26 Aug 2025 23:32:29 +0200
Subject: [PATCH 23/45] python3Packages.spsdk: fix

---
 pkgs/development/python-modules/spsdk/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/spsdk/default.nix b/pkgs/development/python-modules/spsdk/default.nix
index edc8c5e9eeb0..066c52c0a030 100644
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@@ -39,6 +39,7 @@
   x690,
 
   # tests
+  cookiecutter,
   ipykernel,
   pytest-notebook,
   pytestCheckHook,
@@ -95,6 +96,7 @@ buildPythonPackage rec {
     click-command-tree
     click-option-group
     colorama
+    cookiecutter
     crcmod
     cryptography
     deepmerge
@@ -122,6 +124,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "spsdk" ];
 
   nativeCheckInputs = [
+    cookiecutter
     ipykernel
     pytest-notebook
     pytestCheckHook
@@ -134,6 +137,9 @@ buildPythonPackage rec {
   disabledTests = [
     # Missing rotk private key
     "test_general_notebooks"
+
+    # Attempts to access /run
+    "test_nxpimage_famode_export_cli"
   ];
 
   meta = {

From 708992a460a172ac0d304be81c765a4b6442f510 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Wed, 27 Aug 2025 00:36:03 +0300
Subject: [PATCH 24/45] bootspec: add update script

---
 pkgs/by-name/bo/bootspec/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/bo/bootspec/package.nix b/pkgs/by-name/bo/bootspec/package.nix
index e3f1b8c598a0..caea01c53b9f 100644
--- a/pkgs/by-name/bo/bootspec/package.nix
+++ b/pkgs/by-name/bo/bootspec/package.nix
@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  nix-update-script,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "bootspec";
@@ -16,6 +17,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-fKbF5SyI0UlZTWsygdE8BGWuOoNSU4jx+CGdJoJFhZs=";
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Implementation of RFC-0125's datatype and synthesis tooling";
     homepage = "https://github.com/DeterminateSystems/bootspec";

From 9571c47326a3162b59b7c1b45ad21f79a0764021 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Tue, 26 Aug 2025 21:40:49 +0000
Subject: [PATCH 25/45] bootspec: 1.0.1 -> 1.1.0

---
 pkgs/by-name/bo/bootspec/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bo/bootspec/package.nix b/pkgs/by-name/bo/bootspec/package.nix
index caea01c53b9f..307733da90f4 100644
--- a/pkgs/by-name/bo/bootspec/package.nix
+++ b/pkgs/by-name/bo/bootspec/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "bootspec";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "DeterminateSystems";
     repo = "bootspec";
     rev = "v${version}";
-    hash = "sha256-0MO+SqG7Gjq+fmMJkIFvaKsfTmC7z3lGfi7bbBv7iBE=";
+    hash = "sha256-WDEaTxj5iT8tvasd6gnMhRgNoEdDi9Wi4ke8sVtNpt8=";
   };
 
-  cargoHash = "sha256-fKbF5SyI0UlZTWsygdE8BGWuOoNSU4jx+CGdJoJFhZs=";
+  cargoHash = "sha256-ZJKoL1vYfAG1rpCcE1jRm7Yj2dhooJ6iQ91c6EGF83E=";
 
   passthru.updateScript = nix-update-script { };
 

From 5ca34e9009012dee388cf21f0d7c4ab4527b7f95 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <fabian@affolter-engineering.ch>
Date: Tue, 26 Aug 2025 23:42:15 +0200
Subject: [PATCH 26/45] python313Packages.pytouchlinesl: 0.4.0 -> 0.5.0

Diff: https://github.com/jnsgruk/pytouchlinesl/compare/0.4.0...0.5.0

Changelog: https://github.com/jnsgruk/pytouchlinesl/releases/tag/0.5.0
---
 pkgs/development/python-modules/pytouchlinesl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytouchlinesl/default.nix b/pkgs/development/python-modules/pytouchlinesl/default.nix
index a89fd6cdb810..5928ee5203ef 100644
--- a/pkgs/development/python-modules/pytouchlinesl/default.nix
+++ b/pkgs/development/python-modules/pytouchlinesl/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pytouchlinesl";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "jnsgruk";
     repo = "pytouchlinesl";
     tag = version;
-    hash = "sha256-hrC5cBtAU9P9VaRIoUKDx5x4KwUN6mO/JwEZrsnYB0s=";
+    hash = "sha256-R5XgH8A9P5KcjQL/f+E189A+iRVUIbWsmyRrnfV43v4=";
   };
 
   build-system = [ setuptools ];

From 4635e6fd36d6e85f6a293e51aff2e15ae52d74d8 Mon Sep 17 00:00:00 2001
From: Matteo Pacini <m+github@matteopacini.me>
Date: Tue, 26 Aug 2025 23:48:37 +0100
Subject: [PATCH 27/45] _86Box: fixed missing libgcrypt dep for VNC renderer

---
 pkgs/by-name/_8/_86Box/package.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/_8/_86Box/package.nix b/pkgs/by-name/_8/_86Box/package.nix
index a0f912d7c547..6b0421956a16 100644
--- a/pkgs/by-name/_8/_86Box/package.nix
+++ b/pkgs/by-name/_8/_86Box/package.nix
@@ -28,6 +28,7 @@
   libvorbis,
   libopus,
   libmpg123,
+  libgcrypt,
 
   enableDynarec ? with stdenv.hostPlatform; isx86 || isAarch,
   enableNewDynarec ? enableDynarec && stdenv.hostPlatform.isAarch,
@@ -87,7 +88,10 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
   ++ lib.optional enableWayland wayland
-  ++ lib.optional enableVncRenderer libvncserver;
+  ++ lib.optionals enableVncRenderer [
+    libvncserver
+    libgcrypt
+  ];
 
   cmakeFlags =
     lib.optional stdenv.hostPlatform.isDarwin "-DCMAKE_MACOSX_BUNDLE=OFF"

From c2b6da1f0c1d3f1a45b68cb90b267cc326b2c34b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 Aug 2025 00:05:36 +0000
Subject: [PATCH 28/45] qgis: 3.44.1 -> 3.44.2

---
 pkgs/applications/gis/qgis/unwrapped.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index 0ba4654bea51..90ad45152c03 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -82,14 +82,14 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.44.1";
+  version = "3.44.2";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-WUXYjMCq95S5GHcn3pR45kpP3Us1HG4sS+EmjCBYOrM=";
+    hash = "sha256-ERaox5jqB7E/W0W6NnipHx1qfY2+FTHYf3r2l1KRkC0=";
   };
 
   passthru = {

From 4924630a347776020a283669bea497092b2ea148 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 Aug 2025 00:32:31 +0000
Subject: [PATCH 29/45] pay-respects: 0.7.8 -> 0.7.9

---
 pkgs/by-name/pa/pay-respects/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pa/pay-respects/package.nix b/pkgs/by-name/pa/pay-respects/package.nix
index f7c297063410..f2b82e49b3ff 100644
--- a/pkgs/by-name/pa/pay-respects/package.nix
+++ b/pkgs/by-name/pa/pay-respects/package.nix
@@ -6,17 +6,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pay-respects";
-  version = "0.7.8";
+  version = "0.7.9";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "iff";
     repo = "pay-respects";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-73uGxcJCWUVwr1ddNjZTRJwx8OfnAPwtp80v1xpUEhA=";
+    hash = "sha256-qKej29kM0Kq5RRHo+lu9cGeTjnjUvpmIqSxq5yHuCKc=";
   };
 
-  cargoHash = "sha256-VSv0BpIICkYyCIfGDfK7wfKQssWF13hCh6IW375CI/c=";
+  cargoHash = "sha256-2MEbUBTZ/zsPLhHTnQCrWQManqUQ3V3xta5NT9gu38A=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

From ea856ead4d4d45832ddc38a4721f77f184f6e9cd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 Aug 2025 00:50:29 +0000
Subject: [PATCH 30/45] xed-editor: 3.8.3 -> 3.8.4

---
 pkgs/by-name/xe/xed-editor/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xe/xed-editor/package.nix b/pkgs/by-name/xe/xed-editor/package.nix
index 2c7f8c774074..bc87c6c0775e 100644
--- a/pkgs/by-name/xe/xed-editor/package.nix
+++ b/pkgs/by-name/xe/xed-editor/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xed-editor";
-  version = "3.8.3";
+  version = "3.8.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xed";
     rev = version;
-    hash = "sha256-bNnxQOYDBS/pNaBwvmrt/VAya/m7t5H40lJkFevufUE=";
+    hash = "sha256-pI9gjAA5dn0QwZKGungQ1xpQJmnfCxmqWR0VBEQ5v84=";
   };
 
   patches = [

From 6a62f04641fb61887665c6348017da4a86f05374 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 Aug 2025 01:00:41 +0000
Subject: [PATCH 31/45] xviewer: 3.4.11 -> 3.4.12

---
 pkgs/by-name/xv/xviewer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xv/xviewer/package.nix b/pkgs/by-name/xv/xviewer/package.nix
index 76b440e69ce7..40f5c9275929 100644
--- a/pkgs/by-name/xv/xviewer/package.nix
+++ b/pkgs/by-name/xv/xviewer/package.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xviewer";
-  version = "3.4.11";
+  version = "3.4.12";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xviewer";
     rev = version;
-    hash = "sha256-fW+hhHJ4i3u0vtbvaQWliIZSLI1WCFhR5CvVZL6Vy8U=";
+    hash = "sha256-WvA8T6r9DtlpOZLMEOILO6/0Am3bhCLM8FnwXvALjS8=";
   };
 
   nativeBuildInputs = [

From eca97313c15caaeb884f983343101a2f615b44ce Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Sun, 17 Aug 2025 21:43:01 -0400
Subject: [PATCH 32/45] libopaque: init at 1.0.1

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/li/libopaque/package.nix | 52 +++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 pkgs/by-name/li/libopaque/package.nix

diff --git a/pkgs/by-name/li/libopaque/package.nix b/pkgs/by-name/li/libopaque/package.nix
new file mode 100644
index 000000000000..81ee5e4174c9
--- /dev/null
+++ b/pkgs/by-name/li/libopaque/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  libsodium,
+  liboprf,
+  testers,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libopaque";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "stef";
+    repo = "libopaque";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VVD4489yWAJTWLGrpXYe8or5QjDnAuQ9/tzlNJJu/lo=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  strictDeps = true;
+
+  buildInputs = [
+    libsodium
+    liboprf
+  ];
+
+  postInstall = ''
+    mkdir -p ${placeholder "out"}/lib/pkgconfig
+    cp ../libopaque.pc ${placeholder "out"}/lib/pkgconfig/
+  '';
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Implementation of the OPAQUE protocol with support for threshold variants";
+    homepage = "https://github.com/stef/libopaque/";
+    changelog = "https://github.com/stef/libopaque/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.lgpl3Plus;
+    teams = [ lib.teams.ngi ];
+    platforms = lib.platforms.unix;
+    pkgConfigModules = [ "libopaque" ];
+  };
+})

From a2ef3073a10ed1baca775c88630f441a9c437cf8 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Tue, 26 Aug 2025 23:18:48 -0400
Subject: [PATCH 33/45] python3Packages.opaque: init at 1.0.1

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 .../python-modules/opaque/default.nix         | 53 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 55 insertions(+)
 create mode 100644 pkgs/development/python-modules/opaque/default.nix

diff --git a/pkgs/development/python-modules/opaque/default.nix b/pkgs/development/python-modules/opaque/default.nix
new file mode 100644
index 000000000000..7c9996dcf2e1
--- /dev/null
+++ b/pkgs/development/python-modules/opaque/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  libopaque,
+  setuptools,
+  pysodium,
+  python,
+}:
+
+buildPythonPackage rec {
+  pname = "opaque";
+  pyproject = true;
+
+  inherit (libopaque)
+    version
+    src
+    ;
+
+  sourceRoot = "${src.name}/python";
+
+  postPatch =
+    let
+      soext = stdenv.hostPlatform.extensions.sharedLibrary;
+    in
+    ''
+      substituteInPlace ./opaque/__init__.py --replace-fail \
+        "ctypes.util.find_library('opaque') or ctypes.util.find_library('libopaque')" "'${lib.getLib libopaque}/lib/libopaque${soext}'"
+    '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [ pysodium ];
+
+  pythonImportsCheck = [ "opaque" ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    ${python.interpreter} test/simple.py
+
+    runHook postCheck
+  '';
+
+  meta = {
+    inherit (libopaque.meta)
+      description
+      homepage
+      license
+      teams
+      ;
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 57f028e1f2fe..9ab9a5102c6c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10775,6 +10775,8 @@ self: super: with self; {
 
   oocsi = callPackage ../development/python-modules/oocsi { };
 
+  opaque = callPackage ../development/python-modules/opaque { };
+
   opcua-widgets = callPackage ../development/python-modules/opcua-widgets { };
 
   open-clip-torch = callPackage ../development/python-modules/open-clip-torch { };

From cdaa17daf93be426c8b9d8ac7c04b539a7f991c7 Mon Sep 17 00:00:00 2001
From: Brian McGillion <bmg.avoin@gmail.com>
Date: Wed, 27 Aug 2025 08:43:22 +0400
Subject: [PATCH 34/45] python3Packages.fastmcp: 2.11.1 -> 2.11.3

bump to the latest version

Signed-off-by: Brian McGillion <bmg.avoin@gmail.com>
---
 pkgs/development/python-modules/fastmcp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fastmcp/default.nix b/pkgs/development/python-modules/fastmcp/default.nix
index 418fdfef0075..66e50ff28f96 100644
--- a/pkgs/development/python-modules/fastmcp/default.nix
+++ b/pkgs/development/python-modules/fastmcp/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "fastmcp";
-  version = "2.11.1";
+  version = "2.11.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jlowin";
     repo = "fastmcp";
     tag = "v${version}";
-    hash = "sha256-Y71AJdWcRBDbq63p+lcQplqutz2UTQ3f+pTyhcolpuw=";
+    hash = "sha256-jIXrMyNnyPE2DUgg+sxT6LD4dTmKQglh4cFuaw179Z0=";
   };
 
   postPatch = ''

From 59348e17ce76547946026053a4098c36ec714079 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 Aug 2025 05:44:18 +0000
Subject: [PATCH 35/45] python3Packages.osc: 1.9.1 -> 1.19.1

---
 pkgs/development/python-modules/osc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/osc/default.nix b/pkgs/development/python-modules/osc/default.nix
index 7eadbf1a8313..51beca1710b6 100644
--- a/pkgs/development/python-modules/osc/default.nix
+++ b/pkgs/development/python-modules/osc/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "osc";
-  version = "1.9.1";
+  version = "1.19.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "osc";
     rev = version;
-    hash = "sha256-03EDarU7rmsiE96IYHXFuPtD8nWur0qwj8NDzSj8OX0=";
+    hash = "sha256-klPO873FwQOf4DCTuDd86vmGLI4ep9xgS6c+HasJv0Q=";
   };
 
   buildInputs = [ bashInteractive ]; # needed for bash-completion helper

From 8c5be5fa96578af1cde95dea47e676d9cb2b00e3 Mon Sep 17 00:00:00 2001
From: Brian McGillion <bmg.avoin@gmail.com>
Date: Wed, 27 Aug 2025 07:48:25 +0400
Subject: [PATCH 36/45] python3Packages.fastmcp: fix broken build

Missing required dependency and some new tests are failing.

Signed-off-by: Brian McGillion <bmg.avoin@gmail.com>
---
 .../python-modules/fastmcp/default.nix        | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/fastmcp/default.nix b/pkgs/development/python-modules/fastmcp/default.nix
index 66e50ff28f96..efe66eb37b1b 100644
--- a/pkgs/development/python-modules/fastmcp/default.nix
+++ b/pkgs/development/python-modules/fastmcp/default.nix
@@ -14,6 +14,7 @@
   exceptiongroup,
   httpx,
   mcp,
+  openapi-core,
   openapi-pydantic,
   pydantic,
   pyperclip,
@@ -57,6 +58,7 @@ buildPythonPackage rec {
     exceptiongroup
     httpx
     mcp
+    openapi-core
     openapi-pydantic
     pyperclip
     python-dotenv
@@ -87,6 +89,10 @@ buildPythonPackage rec {
     "test_keep_alive_starts_new_session_if_manually_closed"
     "test_keep_alive_maintains_session_if_reentered"
     "test_close_session_and_try_to_use_client_raises_error"
+    "test_run_mcp_config"
+    "test_uv_transport"
+    "test_uv_transport_module"
+    "test_github_api_schema_performance"
 
     # RuntimeError: Client failed to connect: Timed out while waiting for response
     "test_timeout"
@@ -94,20 +100,25 @@ buildPythonPackage rec {
 
     # assert 0 == 2
     "test_multi_client"
+    "test_canonical_multi_client_with_transforms"
 
     # fastmcp.exceptions.ToolError: Unknown tool
     "test_multi_client_with_logging"
     "test_multi_client_with_elicitation"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # RuntimeError: Server failed to start after 10 attempts
+    "test_unauthorized_access"
   ];
 
   disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
     # RuntimeError: Server failed to start after 10 attempts
-    "tests/auth/providers/test_bearer.py"
-    "tests/auth/test_oauth_client.py"
-    "tests/client/test_openapi.py"
+    "tests/client/auth/test_oauth_client.py"
+    "tests/client/test_openapi_experimental.py"
+    "tests/client/test_openapi_legacy.py"
     "tests/client/test_sse.py"
     "tests/client/test_streamable_http.py"
-    "tests/server/http/test_http_dependencies.py"
+    "tests/server/auth/test_jwt_provider.py"
     "tests/server/http/test_http_dependencies.py"
   ];
 

From 2fe569a0ac53b9c0d5378c28f37566f4fc7bc0e4 Mon Sep 17 00:00:00 2001
From: Markus Hauck <markus1189@gmail.com>
Date: Wed, 27 Aug 2025 08:27:11 +0200
Subject: [PATCH 37/45] claude-code: 1.0.92 -> 1.0.93

Changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

- Windows: Add alt + v shortcut for pasting images from clipboard
---
 pkgs/by-name/cl/claude-code/package-lock.json | 8 ++++----
 pkgs/by-name/cl/claude-code/package.nix       | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index 51b53deb0420..5ad1b80c6379 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -6,13 +6,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.92"
+        "@anthropic-ai/claude-code": "^1.0.93"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.92",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.92.tgz",
-      "integrity": "sha512-/XuwJqAvXwIGf9WeZOxHI6qQsAGzxhrRc3hyQdvwW6cU5iviTmrxWasksPbJMvFt6KQoAUU6XHs78XyYmBpOXQ==",
+      "version": "1.0.93",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.93.tgz",
+      "integrity": "sha512-HSrbuYVu4k1dwoj/IYsXEVSoMWDPujy2D4zl9BMt4Zt0kwUwZch0nHpTyQ0C+YeHMN7hHbViz0bw6spg0a5GgQ==",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 30135b447218..d75cbc98cbbe 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.92";
+  version = "1.0.93";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-xW+oI91wL+DFaOHw5M84QJktuE9HXb031pGbrNcrpPQ=";
+    hash = "sha256-vEUty4HRPSkFpT94bxMWcLj0nFe34AeQEZ0WsCXuy10=";
   };
 
-  npmDepsHash = "sha256-rrMskQkWKz+B5dqJ8gHgBxO20OdgE3d53TJWDxeJGbo=";
+  npmDepsHash = "sha256-JL0GPIhpyTQonKsyMR5zN8LaPfX3KkEfQbMR1Z7gTFE=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

From d7c3923fcf269c000a40705a4aa9ad5bf1fb5e04 Mon Sep 17 00:00:00 2001
From: wrvsrx <wrvsrx@outlook.com>
Date: Tue, 26 Aug 2025 16:02:51 +0800
Subject: [PATCH 38/45] python3Packages.vdirsyncer: fix test

---
 .../python-modules/vdirsyncer/default.nix           | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/python-modules/vdirsyncer/default.nix b/pkgs/development/python-modules/vdirsyncer/default.nix
index b93b03108767..fa3e4b67be06 100644
--- a/pkgs/development/python-modules/vdirsyncer/default.nix
+++ b/pkgs/development/python-modules/vdirsyncer/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  fetchpatch,
   pythonOlder,
   click,
   click-log,
@@ -38,6 +39,18 @@ buildPythonPackage rec {
     hash = "sha256-5DeFH+uYXew1RGVPj5z23RCbCwP34ZlWCGYDCS/+so8=";
   };
 
+  patches = [
+    (
+      # Fix event_loop missing
+      # TODO: remove it after vdirsyncer release 0.19.4
+      fetchpatch {
+        # https://github.com/pimutils/vdirsyncer/pull/1185
+        url = "https://github.com/pimutils/vdirsyncer/commit/164559ad7a95ed795ce4ae8d9b287bd27704742d.patch";
+        hash = "sha256-nUGvkBnHr8nVPpBuhQ5GjaRs3QSxokdZUEIsOrQ+lpo=";
+      }
+    )
+  ];
+
   nativeBuildInputs = [
     setuptools
     setuptools-scm

From 2a5867b16340016dce72b7739cc0b405494c314b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 Aug 2025 08:07:07 +0000
Subject: [PATCH 39/45] libretro.mupen64plus: 0-unstable-2025-07-29 ->
 0-unstable-2025-08-20

---
 pkgs/applications/emulators/libretro/cores/mupen64plus.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/mupen64plus.nix b/pkgs/applications/emulators/libretro/cores/mupen64plus.nix
index 48b54825b65a..d87f69b41040 100644
--- a/pkgs/applications/emulators/libretro/cores/mupen64plus.nix
+++ b/pkgs/applications/emulators/libretro/cores/mupen64plus.nix
@@ -12,13 +12,13 @@
 }:
 mkLibretroCore {
   core = "mupen64plus-next";
-  version = "0-unstable-2025-07-29";
+  version = "0-unstable-2025-08-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mupen64plus-libretro-nx";
-    rev = "2d923939db32aad01e633010fac71f860c943a6d";
-    hash = "sha256-HNhGVXTeCECqOdyluPq6aYWuA612H+PCJ65XoN9WJXU=";
+    rev = "222acbd3f98391458a047874d0372fe78e14fe94";
+    hash = "sha256-esssh/0nxNUDW/eMDQbWEdcSPuqLjnKLkK4mKN17HjQ=";
   };
 
   # Fix for GCC 14

From 3667188250b7e5c7d8ffe3ee378c00ff900a83d9 Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Fri, 22 Aug 2025 21:57:57 +0800
Subject: [PATCH 40/45] open-webui: 0.6.22 -> 0.6.25

Diff: https://github.com/open-webui/open-webui/compare/v0.6.22...v0.6.25

Changelog: https://github.com/open-webui/open-webui/blob/v0.6.25/CHANGELOG.md
---
 pkgs/by-name/op/open-webui/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 6fb4a2175a6b..0ac600275fd2 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -9,13 +9,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.6.22";
+  version = "0.6.25";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-SX2uLmDZu1TW45A6F5mSXVtSqv5rbNKuVw8sWj8tEb4=";
+    hash = "sha256-XB3cwxtcOVoAwGJroZuPT8XwaCo3wpkn2KIEuuXMeu4=";
   };
 
   frontend = buildNpmPackage rec {
@@ -32,7 +32,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-mMnDYMy1/7gW6XVaWVct9BuxDP78XX5u46lGBWjUvOQ=";
+    npmDepsHash = "sha256-WL1kdXn7uAaBEwWiIJzzisMZ1uiaOVtFViWK/kW6lsY=";
 
     # See https://github.com/open-webui/open-webui/issues/15880
     npmFlags = [

From 8337fead5e0b4852fe4c7d14128427d314a56547 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 27 Aug 2025 10:41:56 +0200
Subject: [PATCH 41/45] python3Packages.ray: 2.48.0 -> 2.49.0

Diff: https://github.com/ray-project/ray/compare/ray-2.48.0...ray-2.49.0

Changelog: https://github.com/ray-project/ray/releases/tag/ray-2.49.0
---
 .../python-modules/ray/default.nix            | 34 +++++++++----------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index 8fa0894ed863..ac5a6306611e 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -64,7 +64,7 @@
 
 let
   pname = "ray";
-  version = "2.48.0";
+  version = "2.49.0";
 in
 buildPythonPackage rec {
   inherit pname version;
@@ -85,28 +85,28 @@ buildPythonPackage rec {
       # Results are in ./ray-hashes.nix
       hashes = {
         x86_64-linux = {
-          cp310 = "sha256-ZJ7ZRC3C05E1xZO2zww46DVRcLkmcjZat6PLyVjEJjQ=";
-          cp311 = "sha256-RtS0KlhJLex5yq0tViNEaJpPmagoruqBGgzSzWU1U+8=";
-          cp312 = "sha256-pC7TtkD0tZmj/IBnyD7mBJfA8D0HDXp98Co4j6F6VGs=";
-          cp313 = "sha256-JeS3n8yPhJ1y2xrMTwPzcAjFwLdF32PYowzTVna2VF4=";
+          cp310 = "sha256-bFQKbfqOWC4HJQV8E3JFzNP6DWl7R2SFMxdvWoqzCjA=";
+          cp311 = "sha256-Ja5MII3Hi0plPDEcsmuTx0QB5nYqGTztX6uqkQqBfYE=";
+          cp312 = "sha256-lShdI6MDsXTQcKaz6ocj6dq/B6QUegHLkzHV6t+MoLI=";
+          cp313 = "sha256-42mZ1Pgx8vIcqPtWnwWY+4DKjawPiDbErHXM2ltVi/s=";
         };
         aarch64-linux = {
-          cp310 = "sha256-+CCVC8RNewAMIjNC9cgAycCOf9iVJCARJTiOohHKrRo=";
-          cp311 = "sha256-JKcPQW7AvhS5dfFgBEgFzLSMxrxQ3mMpg+uPCo4WaCs=";
-          cp312 = "sha256-8c8z0mAxb5L3dVgYXxw2/DVQbXbuf9/tn1tw+cS9un8=";
-          cp313 = "sha256-Yi5rzbeNmAQNh76pTmXQu2zMCuG0MpTGvWn1Qr8o4JI=";
+          cp310 = "sha256-jFWnpGKgzese1Y+jYQ9S46KEzk4MVVZjWb0RWKloP0Q=";
+          cp311 = "sha256-KnXS/YvKsahQkeow5ZMsXiiXxxIq4j+SH0+v7sIsOCg=";
+          cp312 = "sha256-NjVn9WES86FRjs2NDjoM5PBTcFzI9NQ+kzyvafs1lxw=";
+          cp313 = "sha256-/Wu+DBhvHWpJ31NTKyGSH9Bf+ZPLVG9mW3GAmGIPY8U=";
         };
         x86_64-darwin = {
-          cp310 = "sha256-M72kdTrQrNK1JMkVgInUNIbNRMxZ/pcEZkNbwpaP3i0=";
-          cp311 = "sha256-uUUA/i0X5JH+LpvUo79i3yF+IajyhFAzw1PU0uokD3M=";
-          cp312 = "sha256-Wm9XEm6sndMoYongfpHoewVHkvlpi298yriLYkgWtUI=";
-          cp313 = "sha256-V0K3KlFK/l1g9BMwIAzVCDduFsZQ9pYuYjN6pILWoMY=";
+          cp310 = "sha256-6Qjm97RkKdJvRZRXlFgpiETRpIXCiM/liRT6eilP06Q=";
+          cp311 = "sha256-5CpBh6kOiXr7lVF8uKpPwMJHGL1Ci97AsmCqLRjs5sg=";
+          cp312 = "sha256-FvsQ5YuuSDECZ16Cnq0afQpHjcVfmf8GuDKnicogi6k=";
+          cp313 = "sha256-LhOphUj78ujX8JY8YK/1HZtT01naDO9QoHGpUMT85Uo=";
         };
         aarch64-darwin = {
-          cp310 = "sha256-bKK5zkWtNgy+KZaYL7Imkez+ZVPsj5eiVIKV8PlqrHg=";
-          cp311 = "sha256-S5uSrCljX1Ve80E0fZpj2/ArfZRjRyOa88CeNkvEXPg=";
-          cp312 = "sha256-jeeZ87CJb0jTBtXkoE/GA3oIxJXUX5x5k1NE5Wk+PPg=";
-          cp313 = "sha256-p6bYMNncWui7FW/N6aGtq39O2wBPA5GKck2IXs64Jk0=";
+          cp310 = "sha256-seRUvxTQCGfaXslF4L4IfWhFfyQbqmClDLccBBosTfw=";
+          cp311 = "sha256-VKipsP5qnLFagvNxwufWhCD540/+OKi+PD3UvlQFHGY=";
+          cp312 = "sha256-+UOpwq4EljaxJqGUBH/fkQEGCpmF0dthSxeycGH46fM=";
+          cp313 = "sha256-9CDvy2n6ZDAf8su3YR10rwEguu6OhAhtjzuV6BVTD5M=";
         };
       };
     in

From 60847523e1c4435f075a86dd548c5c10e38f4e79 Mon Sep 17 00:00:00 2001
From: Gregor Grigorjan <gregor.grigorjan@gamesglobal.com>
Date: Wed, 6 Aug 2025 17:20:48 +0300
Subject: [PATCH 42/45] terraform-providers.neon: init at 0.9.0

---
 .../cluster/terraform-providers/providers.json           | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index ffae95c46000..e645a9d87ce7 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -866,6 +866,15 @@
     "spdx": "Apache-2.0",
     "vendorHash": null
   },
+  "neon": {
+    "hash": "sha256-D1KWC2D4OLMUSWKzQmiZaDrATCv4SEUWwk6SK/o1U5M=",
+    "homepage": "https://registry.terraform.io/providers/kislerdm/neon",
+    "owner": "kislerdm",
+    "repo": "terraform-provider-neon",
+    "rev": "v0.9.0",
+    "spdx": "MPL-2.0",
+    "vendorHash": "sha256-8WY2iEOFOwx7zDMps5cctxzv1stRseS/OUaHkMDuBYs="
+  },
   "netlify": {
     "hash": "sha256-7U+hHN/6GqcbI1gX7L01YqVjlUgvdfhgpXvLF2lwbkA=",
     "homepage": "https://registry.terraform.io/providers/AegirHealth/netlify",

From 7131ca1889df066bead73ed19b70a56ea1913560 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 27 Aug 2025 10:55:01 +0200
Subject: [PATCH 43/45] python3Packages.pyiceberg: fix

---
 pkgs/development/python-modules/pyiceberg/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/pyiceberg/default.nix b/pkgs/development/python-modules/pyiceberg/default.nix
index 40020a675727..61956f9fd36d 100644
--- a/pkgs/development/python-modules/pyiceberg/default.nix
+++ b/pkgs/development/python-modules/pyiceberg/default.nix
@@ -84,6 +84,7 @@ buildPythonPackage rec {
   env.CIBUILDWHEEL = "1";
 
   pythonRelaxDeps = [
+    "cachetools"
     "rich"
   ];
 

From df04943b7baa1293e66863f2cdee794a7abcd327 Mon Sep 17 00:00:00 2001
From: mmfallacy <31348500+mmfallacy@users.noreply.github.com>
Date: Wed, 27 Aug 2025 16:39:07 +0800
Subject: [PATCH 44/45] vimPlugins.live-preview-nvim: init at 2025-08-17
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- vimPlugins: add live-preview-nvim overrides
- Update pkgs/applications/editors/vim/plugins/overrides.nix
- chore: fmt

Co-authored-by: Gaétan Lepage <33058747+GaetanLepage@users.noreply.github.com>
---
 .../editors/vim/plugins/generated.nix            | 13 +++++++++++++
 .../editors/vim/plugins/overrides.nix            | 16 ++++++++++++++++
 .../editors/vim/plugins/vim-plugin-names         |  1 +
 3 files changed, 30 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 58f4d38bf28f..1815d565762d 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -7496,6 +7496,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  live-preview-nvim = buildVimPlugin {
+    pname = "live-preview.nvim";
+    version = "2025-08-17";
+    src = fetchFromGitHub {
+      owner = "brianhuster";
+      repo = "live-preview.nvim";
+      rev = "5890c4f7cb81a432fd5f3b960167757f1b4d4702";
+      sha256 = "0gr68xmx9ph74pqnlpbfx9kj5bh7yg3qh0jni98z2nmkzfvg4qcx";
+    };
+    meta.homepage = "https://github.com/brianhuster/live-preview.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   live-rename-nvim = buildVimPlugin {
     pname = "live-rename.nvim";
     version = "2025-06-23";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index a319de91ea6c..cea9ccf904a8 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1794,6 +1794,22 @@ in
     dependencies = [ self.litee-nvim ];
   };
 
+  live-preview-nvim = super.live-preview-nvim.overrideAttrs {
+    checkInputs = with self; [
+      fzf-lua
+      mini-pick
+      snacks-nvim
+      telescope-nvim
+    ];
+
+    nvimSkipModules = [
+      # Ignore livepreview._spec as it fails nvimRequireCheck.
+      # This file runs tests on require which unfortunately fails as it attempts to require the base plugin. See https://github.com/brianhuster/live-preview.nvim/blob/5890c4f7cb81a432fd5f3b960167757f1b4d4702/lua/livepreview/_spec.lua#L25
+      "livepreview._spec"
+    ];
+    meta.license = lib.licenses.gpl3Only;
+  };
+
   lspcontainers-nvim = super.lspcontainers-nvim.overrideAttrs {
     dependencies = [ self.nvim-lspconfig ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 954c16213677..68358bfffc45 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -575,6 +575,7 @@ https://github.com/ldelossa/litee-filetree.nvim/,,
 https://github.com/ldelossa/litee-symboltree.nvim/,,
 https://github.com/ldelossa/litee.nvim/,,
 https://github.com/smjonas/live-command.nvim/,HEAD,
+https://github.com/brianhuster/live-preview.nvim/,HEAD,
 https://github.com/saecki/live-rename.nvim/,HEAD,
 https://github.com/azratul/live-share.nvim/,HEAD,
 https://github.com/ggml-org/llama.vim/,HEAD,

From 55889b45d5336b79332c25cf327f44ebe1ced552 Mon Sep 17 00:00:00 2001
From: Ali Caglayan <alizter@gmail.com>
Date: Tue, 19 Aug 2025 12:50:59 +0300
Subject: [PATCH 45/45] dune_3: 3.19.1 -> 3.20.1

Signed-off-by: Ali Caglayan <alizter@gmail.com>
---
 pkgs/development/ocaml-modules/dune-rpc/default.nix | 4 ++--
 pkgs/development/tools/ocaml/dune/3.nix             | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/ocaml-modules/dune-rpc/default.nix b/pkgs/development/ocaml-modules/dune-rpc/default.nix
index 2814f4e8f5da..d5031728eda5 100644
--- a/pkgs/development/ocaml-modules/dune-rpc/default.nix
+++ b/pkgs/development/ocaml-modules/dune-rpc/default.nix
@@ -4,8 +4,8 @@
   dune_3,
   csexp,
   stdune,
+  ocamlc-loc,
   ordering,
-  pp,
   xdg,
   dyn,
 }:
@@ -21,8 +21,8 @@ buildDunePackage {
   propagatedBuildInputs = [
     csexp
     stdune
+    ocamlc-loc
     ordering
-    pp
     xdg
     dyn
   ];
diff --git a/pkgs/development/tools/ocaml/dune/3.nix b/pkgs/development/tools/ocaml/dune/3.nix
index 059beb6372c6..c4dfd1374338 100644
--- a/pkgs/development/tools/ocaml/dune/3.nix
+++ b/pkgs/development/tools/ocaml/dune/3.nix
@@ -14,11 +14,11 @@ else
 
   stdenv.mkDerivation rec {
     pname = "dune";
-    version = "3.19.1";
+    version = "3.20.1";
 
     src = fetchurl {
       url = "https://github.com/ocaml/dune/releases/download/${version}/dune-${version}.tbz";
-      hash = "sha256-oQOG+YDNqUF9FGVGa+1Q3SrvnJO50GoPf+7tsKFUEVg=";
+      hash = "sha256-8I6V3igo6JHWiQbkQwtRFwMihSB7W8aE/F1FZS6zDgo=";
     };
 
     nativeBuildInputs = [