From 6057da3eeab871ffb1af89e06707eca0ff4adff5 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sun, 25 Jan 2026 13:38:09 -0500
Subject: [PATCH 01/35] makeBinaryWrapper: fix passthru.extractCmd on darwin

On darwin, strings does not support -d. Regardless of darwin, the
generated extract script has `strings` without a full nix store path,
making it potentially impure.

The solution is to always pull `strings` from GNU toolchain, regardless
of the platform.

Note: this change should have no implications for darwin bootstrap
because `passthru.extractCmd` has very limited use in the tree,
basically only used when building Firefox, and is not evaluated
otherwise.

Note: previous attempt to resolve the issue was incorrect, effectively
doing nothing on Darwin, see #379014. (The
`targetPackages.gnuStdenv.cc.bintools.targetPrefix` was empty.)
---
 pkgs/by-name/ma/makeBinaryWrapper/package.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/makeBinaryWrapper/package.nix b/pkgs/by-name/ma/makeBinaryWrapper/package.nix
index 749851d547e2..fd51da369068 100644
--- a/pkgs/by-name/ma/makeBinaryWrapper/package.nix
+++ b/pkgs/by-name/ma/makeBinaryWrapper/package.nix
@@ -24,9 +24,13 @@ makeSetupHook {
 
   passthru = {
     # Extract the function call used to create a binary wrapper from its embedded docstring
-    extractCmd = writeShellScript "extract-binary-wrapper-cmd" ''
-      ${targetPackages.gnuStdenv.cc.bintools.targetPrefix}strings -dw "$1" | sed -n '/^makeCWrapper/,/^$/ p'
-    '';
+    extractCmd =
+      let
+        bintools = targetPackages.gnuStdenv.cc.bintools;
+      in
+      writeShellScript "extract-binary-wrapper-cmd" ''
+        ${lib.getExe' bintools "${bintools.targetPrefix}strings"} -dw "$1" | sed -n '/^makeCWrapper/,/^$/ p'
+      '';
 
     tests = tests.makeBinaryWrapper;
   };

From 27564cf6776b841608318ca4ba392aacea91c8e2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 17 Jul 2026 02:04:27 +0000
Subject: [PATCH 02/35] proton-pass: 1.38.0 -> 1.38.1

---
 pkgs/by-name/pr/proton-pass/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pr/proton-pass/package.nix b/pkgs/by-name/pr/proton-pass/package.nix
index e0a50c92611f..cbd1e9d19fb4 100644
--- a/pkgs/by-name/pr/proton-pass/package.nix
+++ b/pkgs/by-name/pr/proton-pass/package.nix
@@ -10,17 +10,17 @@
 }:
 let
   pname = "proton-pass";
-  version = "1.38.0";
+  version = "1.38.1";
 
   passthru = {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://proton.me/download/pass/linux/x64/proton-pass_${version}_amd64.deb";
-        hash = "sha256-6WYiqEJquq64b1fNv8HcQcT4/VCwtEkK4YrfAXDC6nY=";
+        hash = "sha256-0DQy8ITOlR88aJiR4zLCIukd5KZ2U4PVSjNBvU/A9L8=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://proton.me/download/pass/macos/ProtonPass_${version}.dmg";
-        hash = "sha256-CwdiHEqKnk+ELoavs1p6ND48e2rvEFBqbXQs79ihQ4M=";
+        hash = "sha256-lEc/tP84QU+WDTqLbUe5dMmYBLXaZZg8wmXSNgAOn7g=";
       };
     };
     updateScript = writeShellScript "update-proton-pass" ''

From 1d95bdfbe77231d69f9db531c0bf2ae811d7ce1a Mon Sep 17 00:00:00 2001
From: Aled Lorans <143277280+alorans@users.noreply.github.com>
Date: Sat, 18 Jul 2026 01:52:11 +1200
Subject: [PATCH 03/35] nixos-render-docs: fix escaping of inline javascript

---
 .../ni/nixos-render-docs/src/nixos_render_docs/manual.py        | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
index 9177b0ad5202..8e0f289f178f 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
@@ -375,6 +375,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
         # Without this the popover can still be closed by clicking outside of it
         # It handles auto-closing when the user clicks a href.
         close_menu_js = """
+            //<![CDATA[
             document.addEventListener("DOMContentLoaded", () => {
                 const nav = document.getElementById("manual-toc");
                 nav?.addEventListener("click", (e) => {
@@ -383,6 +384,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
                     }
                 });
             });
+            //]]>
         """
         header_content = ""
         if self._html_params.header:

From 38c7d77cef3f939c305e949ec296257a01c4ebff Mon Sep 17 00:00:00 2001
From: Ivan Petkov <ivanppetkov@gmail.com>
Date: Fri, 17 Jul 2026 20:23:38 -0700
Subject: [PATCH 04/35] photoprism: 251130-b3068414c -> 260601-a7d098548

---
 pkgs/by-name/ph/photoprism/backend.nix  |  2 +-
 pkgs/by-name/ph/photoprism/frontend.nix | 12 +++---------
 pkgs/by-name/ph/photoprism/package.nix  |  4 ++--
 3 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/ph/photoprism/backend.nix b/pkgs/by-name/ph/photoprism/backend.nix
index 199b59c61614..02632ec2fdb3 100644
--- a/pkgs/by-name/ph/photoprism/backend.nix
+++ b/pkgs/by-name/ph/photoprism/backend.nix
@@ -48,7 +48,7 @@ buildGoModule {
     substituteInPlace internal/commands/passwd.go --replace-fail '/bin/stty' "${coreutils}/bin/stty"
   '';
 
-  vendorHash = "sha256-nOytOKceVuRryixDxx791my0JkdLPfyYdK6dAUG4CQc=";
+  vendorHash = "sha256-mF07Lz61IIvUi4SLIMkMlKMH9zm6Zrp/KAdutl+mUzI=";
 
   subPackages = [ "cmd/photoprism" ];
 
diff --git a/pkgs/by-name/ph/photoprism/frontend.nix b/pkgs/by-name/ph/photoprism/frontend.nix
index f62a6cf3c792..14592d00d3d5 100644
--- a/pkgs/by-name/ph/photoprism/frontend.nix
+++ b/pkgs/by-name/ph/photoprism/frontend.nix
@@ -9,21 +9,15 @@ buildNpmPackage {
   inherit src version;
   pname = "photoprism-frontend";
 
-  postPatch = ''
-    cd frontend
-  '';
+  npmDepsHash = "sha256-HBzul2fyISwOqf8w92yt0friMnLhMmvKPm8yI2I3ngE=";
 
-  npmDepsHash = "sha256-RjPTtIm1BhyeQLUN9mWI+sXakNju4up0FbrdwZzkTS0=";
-
-  # Some dependencies are fetched from git repositories
-  forceGitDeps = true;
-  makeCacheWritable = true;
+  npmWorkspace = "frontend";
 
   installPhase = ''
     runHook preInstall
 
     mkdir $out
-    cp -r ../assets $out/
+    cp -r assets $out/
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ph/photoprism/package.nix b/pkgs/by-name/ph/photoprism/package.nix
index 646062501c4e..7b63054de7d6 100644
--- a/pkgs/by-name/ph/photoprism/package.nix
+++ b/pkgs/by-name/ph/photoprism/package.nix
@@ -17,14 +17,14 @@
 }:
 
 let
-  version = "251130-b3068414c";
+  version = "260601-a7d098548";
   pname = "photoprism";
 
   src = fetchFromGitHub {
     owner = "photoprism";
     repo = "photoprism";
     rev = version;
-    hash = "sha256-8yg5CtvBtSKRaOUj9f+Db7rruXIVuF2cR50vZ+WUU6A=";
+    hash = "sha256-6zE9bqHFF9ifcqbvA0yjSF69+BA/M2U6ABnPta4dpl4=";
   };
 
   backend = callPackage ./backend.nix { inherit src version; };

From f9420fcd14f603376af87f82d9b864ef605d60cf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Jul 2026 02:15:01 +0000
Subject: [PATCH 05/35] godot: 4.7-stable -> 4.7.1-stable

---
 pkgs/development/tools/godot/4.7/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/tools/godot/4.7/default.nix b/pkgs/development/tools/godot/4.7/default.nix
index 81ccf416ba37..3d411ed36a14 100644
--- a/pkgs/development/tools/godot/4.7/default.nix
+++ b/pkgs/development/tools/godot/4.7/default.nix
@@ -1,11 +1,11 @@
 {
-  version = "4.7-stable";
-  hash = "sha256-ur9bQ6DTUxeTRqFITAgjpyoOEHgYnjEAQY3sSNNtr0c=";
+  version = "4.7.1-stable";
+  hash = "sha256-3JzJuFbicIJ4AiEVxh5t1/q9mjxwFXZvTAfEBdrIzsc=";
   default = {
-    exportTemplatesHash = "sha256-lxRFncBxkHwPPV8X1gj69p582iEzH8XTnEUD/6Tpnuw=";
+    exportTemplatesHash = "sha256-hkCdtiALb4/TIwmJwtIAKFHz3Ris8R1726/d9aDdD3I=";
   };
   mono = {
-    exportTemplatesHash = "sha256-TAKguZrZxbwkPC55RoYo2z34k1DZ24/JlZiPadEm4Gk=";
+    exportTemplatesHash = "sha256-75pwi+UezZdM19zNyv16GHDaPT4cJMByvbuYGMen22M=";
     nugetDeps = ./deps.json;
   };
 }

From 77710794c36f12f8a99ded1abc16fdb759abf5f5 Mon Sep 17 00:00:00 2001
From: Andrew Zah <zah@andrewzah.com>
Date: Sun, 19 Jul 2026 12:37:32 +0900
Subject: [PATCH 06/35] xz: mv to pkgs/by-name

---
 .../compression/xz/default.nix => by-name/xz/xz/package.nix}    | 0
 pkgs/top-level/all-packages.nix                                 | 2 --
 2 files changed, 2 deletions(-)
 rename pkgs/{tools/compression/xz/default.nix => by-name/xz/xz/package.nix} (100%)

diff --git a/pkgs/tools/compression/xz/default.nix b/pkgs/by-name/xz/xz/package.nix
similarity index 100%
rename from pkgs/tools/compression/xz/default.nix
rename to pkgs/by-name/xz/xz/package.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 80118b0bb715..65d75af377aa 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2505,8 +2505,6 @@ with pkgs;
 
   liquidctl = with python3Packages; toPythonApplication liquidctl;
 
-  xz = callPackage ../tools/compression/xz { };
-
   madlang = haskell.lib.compose.justStaticExecutables haskellPackages.madlang;
 
   man = man-db;

From 1637a80ddfdd25126af6c883b5eb53629df14027 Mon Sep 17 00:00:00 2001
From: Andrew Zah <zah@andrewzah.com>
Date: Sun, 19 Jul 2026 12:41:53 +0900
Subject: [PATCH 07/35] xz: add andrewzah as maintainer

---
 pkgs/by-name/xz/xz/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/xz/xz/package.nix b/pkgs/by-name/xz/xz/package.nix
index d57a98eb4e20..371962669c56 100644
--- a/pkgs/by-name/xz/xz/package.nix
+++ b/pkgs/by-name/xz/xz/package.nix
@@ -94,6 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
       create 30 % smaller output than gzip and 15 % smaller output than
       bzip2.
     '';
+    maintainers = with lib.maintainers; [ andrewzah ];
     license = with lib.licenses; [
       gpl2Plus
       lgpl21Plus

From 0e97cfc886a81539eea9deb9d4d277f086d68e67 Mon Sep 17 00:00:00 2001
From: RoGreat <roguegreat@gmail.com>
Date: Tue, 2 Jun 2026 20:34:04 -0500
Subject: [PATCH 08/35] yad: 14.1 -> 15.0

---
 pkgs/by-name/ya/yad/gettext-0.25.patch | 18 ------------
 pkgs/by-name/ya/yad/package.nix        | 39 +++++++++++++++-----------
 2 files changed, 22 insertions(+), 35 deletions(-)
 delete mode 100644 pkgs/by-name/ya/yad/gettext-0.25.patch

diff --git a/pkgs/by-name/ya/yad/gettext-0.25.patch b/pkgs/by-name/ya/yad/gettext-0.25.patch
deleted file mode 100644
index 02f551459ef9..000000000000
--- a/pkgs/by-name/ya/yad/gettext-0.25.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index 20a4e42..921ba18 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -8,9 +8,13 @@ AC_PREREQ([2.59])
- 
- AC_CONFIG_HEADERS([config.h])
- AC_CONFIG_SRCDIR([src])
-+AC_CONFIG_MACRO_DIRS([m4])
- 
- AM_MAINTAINER_MODE
- 
-+AM_GNU_GETTEXT_VERSION([0.25])
-+AM_GNU_GETTEXT([external])
-+
- IT_PROG_INTLTOOL([0.40.0])
- 
- AC_PROG_CC
diff --git a/pkgs/by-name/ya/yad/package.nix b/pkgs/by-name/ya/yad/package.nix
index 1eb72440e0b2..39fff868cf82 100644
--- a/pkgs/by-name/ya/yad/package.nix
+++ b/pkgs/by-name/ya/yad/package.nix
@@ -3,44 +3,53 @@
   stdenv,
   fetchFromGitHub,
   pkg-config,
-  intltool,
   autoreconfHook,
   wrapGAppsHook3,
+  gettext,
+  gspell,
   gtk3,
-  hicolor-icon-theme,
+  gtksourceview,
+  libappindicator-gtk3,
   netpbm,
+  webkitgtk_4_1,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yad";
-  version = "14.1";
+  version = "15.0";
 
   src = fetchFromGitHub {
     owner = "v1cont";
     repo = "yad";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Y7bp20fkNdSgBcSV1kPEpWEP7ASwZcScVRaPauwI72M=";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-z+t4eG8yXhfs4GfLFDaaOCAxrr5MIoFD6BKF8vr59IY=";
   };
 
-  # FIXME: remove when gettext is fixed
-  patches = [ ./gettext-0.25.patch ];
-
   configureFlags = [
-    "--enable-icon-browser"
-    "--with-gtk=gtk3"
     "--with-rgb=${placeholder "out"}/share/yad/rgb.txt"
+    "--enable-html"
+    "--enable-tray"
+    "--enable-appindicator"
+    "--enable-spell"
+    "--enable-sourceview"
+    "--enable-deprecated"
+    "--enable-tools"
+    "--enable-icon-browser"
   ];
 
   buildInputs = [
+    gspell
     gtk3
-    hicolor-icon-theme
+    gtksourceview
+    libappindicator-gtk3
+    webkitgtk_4_1
   ];
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
-    intltool
     wrapGAppsHook3
+    gettext
   ];
 
   postPatch = ''
@@ -51,10 +60,6 @@ stdenv.mkDerivation (finalAttrs: {
     install -Dm644 ${netpbm.out}/share/netpbm/misc/rgb.txt $out/share/yad/rgb.txt
   '';
 
-  postAutoreconf = ''
-    intltoolize
-  '';
-
   meta = {
     homepage = "https://github.com/v1cont/yad";
     description = "GUI dialog tool for shell scripts";
@@ -66,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     license = lib.licenses.gpl3;
     mainProgram = "yad";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ RoGreat ];
     platforms = with lib.platforms; linux;
   };
 })

From ccc306cc0f97d353cd2c1b4edd77e1eb87198b01 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Jul 2026 11:16:51 +0000
Subject: [PATCH 09/35] gotip: 0.6.4 -> 0.9.0

---
 pkgs/by-name/go/gotip/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/gotip/package.nix b/pkgs/by-name/go/gotip/package.nix
index 92a8bc90b03d..e22811e695fa 100644
--- a/pkgs/by-name/go/gotip/package.nix
+++ b/pkgs/by-name/go/gotip/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gotip";
-  version = "0.6.4";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "lusingander";
     repo = "gotip";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CgTznW4SwKrJ4Q7dIo2ebn51G13nP36tv8n2G9T+MZ0=";
+    hash = "sha256-W4N6O7cAUIFytjHIqbe7qSmuPHIpyhecw7bLyIP/LRU=";
   };
 
-  vendorHash = "sha256-Sj7JzyWviGxp10O1zGONN49TXtwquXYJ1KoijIVcyj0=";
+  vendorHash = "sha256-fQ/rx7gyBcQ3nE/eiCJgtjZCa50iZAuodIZjaRG/mjE=";
 
   ldflags = [
     "-s"

From 3a82facb52e81b1f70ce20938c6e3364a6e71de2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Jul 2026 17:12:52 +0000
Subject: [PATCH 10/35] temporal-ui-server: 2.52.0 -> 2.52.1

---
 pkgs/by-name/te/temporal-ui-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/te/temporal-ui-server/package.nix b/pkgs/by-name/te/temporal-ui-server/package.nix
index f8659de2dc3c..59a9490f1c4f 100644
--- a/pkgs/by-name/te/temporal-ui-server/package.nix
+++ b/pkgs/by-name/te/temporal-ui-server/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "temporal-ui-server";
-  version = "2.52.0";
+  version = "2.52.1";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "ui-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5WGE4igWVkWwxy5k8x+X4roDX1glaW+x67UGkoiSWwM=";
+    hash = "sha256-Z6lDqzDDzyHh2ZLf1paqUT9f6+ioR0qnVhX4/QFa9D0=";
   };
 
   vendorHash = "sha256-E9pg16YJRDahBmiHwQY3r8kA+vBfza7KdFYqdw+qBSY=";

From 721021f3d265515f78dbf07884ade0e002b58e14 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Jul 2026 17:57:56 +0000
Subject: [PATCH 11/35] xfstests: 2026.05.17 -> 2026.06.21

---
 pkgs/by-name/xf/xfstests/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xf/xfstests/package.nix b/pkgs/by-name/xf/xfstests/package.nix
index 6e18aa424a10..7bb4b239f07b 100644
--- a/pkgs/by-name/xf/xfstests/package.nix
+++ b/pkgs/by-name/xf/xfstests/package.nix
@@ -38,11 +38,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xfstests";
-  version = "2026.05.17";
+  version = "2026.06.21";
 
   src = fetchzip {
     url = "https://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git/snapshot/xfstests-dev-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-vfK4PcPdd1121lcjhjP63RyS6YdFfgZ6Nsauv02b1S8=";
+    hash = "sha256-hngS9Hnsz9XKQ42yh6mcXHiTOzL+Zk9hRpai7e2tU0E=";
   };
 
   nativeBuildInputs = [

From d8a385f207374f57d5b59811e94fda208105e295 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 20 Jul 2026 00:29:41 +0000
Subject: [PATCH 12/35] linuxPackages.tt-kmd: 2.7.0 -> 2.10.0

---
 pkgs/os-specific/linux/tt-kmd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/tt-kmd/default.nix b/pkgs/os-specific/linux/tt-kmd/default.nix
index 1e3923f6f787..ebe56b8bf6f9 100644
--- a/pkgs/os-specific/linux/tt-kmd/default.nix
+++ b/pkgs/os-specific/linux/tt-kmd/default.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "tt-kmd";
-  version = "2.7.0";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "tenstorrent";
     repo = "tt-kmd";
     tag = "ttkmd-${finalAttrs.version}";
-    hash = "sha256-+4Wqj91EsPthKQXajiDd9Y77oTp9BNqCgFCQrTAp6ag=";
+    hash = "sha256-CMZk1q/ybrpNEr8XoCtMsV5127bYKsUXl0ZitImIaPY=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;

From 4533e25c3357b7585e506ee37204a5604a7ebe50 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Mon, 20 Jul 2026 03:01:32 -0500
Subject: [PATCH 13/35] =?UTF-8?q?yaziPlugins.clipboard:=200-unstable-2026-?=
 =?UTF-8?q?07-14=20=E2=86=92=200-unstable-2026-07-19?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Compare: https://github.com/XYenon/clipboard.yazi/compare/4533c7f1b16196ad32749e35344bdc82a624871b...d4d19ea45836f279c0b99e1d234fe5ce4a154e4b
---
 pkgs/by-name/ya/yazi/plugins/clipboard/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ya/yazi/plugins/clipboard/default.nix b/pkgs/by-name/ya/yazi/plugins/clipboard/default.nix
index 3b4a38a4b0a8..7480109f824c 100644
--- a/pkgs/by-name/ya/yazi/plugins/clipboard/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/clipboard/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "clipboard.yazi";
-  version = "0-unstable-2026-07-14";
+  version = "0-unstable-2026-07-19";
 
   src = fetchFromGitHub {
     owner = "XYenon";
     repo = "clipboard.yazi";
-    rev = "4533c7f1b16196ad32749e35344bdc82a624871b";
-    hash = "sha256-lThDO1b9iq+N6x/F9fKEWlNPpgJBTfxpY2xjyZF22mM=";
+    rev = "d4d19ea45836f279c0b99e1d234fe5ce4a154e4b";
+    hash = "sha256-fawprH1+WysMcERWdCtgWulSHo4Pmu3eLLHbnKwvkIM=";
   };
 
   meta = {

From b484fe553ee068f44da9865c5f2101cd65559457 Mon Sep 17 00:00:00 2001
From: klea <klea@iwnp.org>
Date: Mon, 20 Jul 2026 11:10:48 +0000
Subject: [PATCH 14/35] sleek-grub-theme: unstable-2024-08-11 ->
 0-unstable-2025-05-21

- Conform to the version scheme. (#541820)
- Upgrade to newest commit, the older version would have been 0-unstable-2024-08-11.
---
 pkgs/by-name/sl/sleek-grub-theme/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sl/sleek-grub-theme/package.nix b/pkgs/by-name/sl/sleek-grub-theme/package.nix
index e7ae9353fbb4..33db59ef3c61 100644
--- a/pkgs/by-name/sl/sleek-grub-theme/package.nix
+++ b/pkgs/by-name/sl/sleek-grub-theme/package.nix
@@ -15,13 +15,13 @@ assert builtins.elem withStyle [
 
 stdenv.mkDerivation {
   pname = "sleek-grub-theme";
-  version = "unstable-2024-08-11";
+  version = "0-unstable-2025-05-21";
 
   src = fetchFromGitHub {
     owner = "sandesh236";
     repo = "sleek--themes";
-    rev = "0c47e645ccc2d72aa165e9d994f9d09f58de9f6d";
-    hash = "sha256-H4s4CSR8DaH8RT9w40hkguNNcC0U8gHKS2FLt+FApeA=";
+    rev = "e103aa4cd655be6a38dbab37b1911c6ed9ef7765";
+    hash = "sha256-E3DSOZlszBRy2F172L7ZSSsDlkk3n9jGXl4hRWv2WF8=";
   };
 
   installPhase = ''

From 1331def142fc8293fbc855d0fc354b05a655f2f1 Mon Sep 17 00:00:00 2001
From: Nicholas Malcolm <bubylou@pm.me>
Date: Mon, 20 Jul 2026 12:36:56 -0400
Subject: [PATCH 15/35] =?UTF-8?q?vintagestory:=201.22.3=20=E2=86=92=201.22?=
 =?UTF-8?q?.4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/vi/vintagestory/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vi/vintagestory/package.nix b/pkgs/by-name/vi/vintagestory/package.nix
index c8828798bbbb..ec8b5d38fb15 100644
--- a/pkgs/by-name/vi/vintagestory/package.nix
+++ b/pkgs/by-name/vi/vintagestory/package.nix
@@ -27,11 +27,11 @@ assert waylandSupport -> libxkbcommon != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vintagestory";
-  version = "1.22.3";
+  version = "1.22.4";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${finalAttrs.version}.tar.gz";
-    hash = "sha256-sa4Pj1DwT6W6LJCAYznmbyqPtMUTaLSNTkXS1imQp04=";
+    hash = "sha256-6efnjDUXMweOzN1mnkwVyQzQjs1QlFHBss1qb62Z2o0=";
   };
 
   __structuredAttrs = true;

From cf8fb002dc0c1da06c4218222eebf476c551f033 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 20 Jul 2026 13:03:39 -0700
Subject: [PATCH 16/35] libdeltachat: 2.53.0 -> 2.55.0

Diff: https://github.com/chatmail/core/compare/v2.53.0...v2.55.0

Changelog: https://github.com/chatmail/core/blob/v2.55.0/CHANGELOG.md
---
 pkgs/by-name/li/libdeltachat/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libdeltachat/package.nix b/pkgs/by-name/li/libdeltachat/package.nix
index 4769f157fa89..70a5fde765ef 100644
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdeltachat";
-  version = "2.53.0";
+  version = "2.55.0";
 
   src = fetchFromGitHub {
     owner = "chatmail";
     repo = "core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W2Yh5+6MaJ47GqJioGKge2J3RetGGTcl+0YxPPlSdDo=";
+    hash = "sha256-Iy0VeWfD0GXdQiGZbn95p9SJ4MUSYBwsYLnI5NvgUl4=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.fetchCargoVendor {
     pname = "chatmail-core";
     inherit (finalAttrs) version src;
-    hash = "sha256-aoPc5XvjwwuA9aOTvIOpTm15wozC9glJGqn3vPqsJF4=";
+    hash = "sha256-BfvLWldH4gbnB/ehywB40Ho1IZB/Kv5szmtMTVRsvqk=";
   };
 
   nativeBuildInputs = [

From 5bea568ef16f673a1cb59cb91ddc99fb20a4c1fb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 20 Jul 2026 22:11:39 +0000
Subject: [PATCH 17/35] snip: 0.20.0 -> 0.22.0

---
 pkgs/by-name/sn/snip/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sn/snip/package.nix b/pkgs/by-name/sn/snip/package.nix
index 6091c029014a..f890bd12d9f1 100644
--- a/pkgs/by-name/sn/snip/package.nix
+++ b/pkgs/by-name/sn/snip/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "snip";
-  version = "0.20.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "edouard-claude";
     repo = "snip";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u6Jc9U4tb5Y/evtWR/Nw535xVh09ChcKN0Dm+l3bjvA=";
+    hash = "sha256-y88ZHg29Z/QBZk8YWXp287Rel7DpPESYAlbqt5hj1nc=";
   };
 
   vendorHash = "sha256-2MxFZqjNuLzcuu+bsLyOyHIakCxh7j0FUx8LsjZRhrY=";

From 2f591b3d0ce59040e58014330c53c5022f15d21a Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Tue, 21 Jul 2026 00:49:49 +0200
Subject: [PATCH 18/35] python3Packages.evdev: enable tests

---
 pkgs/development/python-modules/evdev/default.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/evdev/default.nix b/pkgs/development/python-modules/evdev/default.nix
index 7606b61fd07b..5f84e3b3259e 100644
--- a/pkgs/development/python-modules/evdev/default.nix
+++ b/pkgs/development/python-modules/evdev/default.nix
@@ -4,6 +4,7 @@
   fetchPypi,
   linuxHeaders,
   setuptools,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -25,10 +26,17 @@ buildPythonPackage rec {
 
   buildInputs = [ linuxHeaders ];
 
-  doCheck = false;
-
   pythonImportsCheck = [ "evdev" ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # tries to open /dev/uinput
+    "tests/test_uinput.py"
+  ];
+
   meta = {
     description = "Provides bindings to the generic input event interface in Linux";
     homepage = "https://python-evdev.readthedocs.io/";

From adff968646ae4f2269cfb3fcabcc84102ae326c3 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Tue, 21 Jul 2026 00:50:24 +0200
Subject: [PATCH 19/35] python3Packages.evdev: use finalAttrs

---
 pkgs/development/python-modules/evdev/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/evdev/default.nix b/pkgs/development/python-modules/evdev/default.nix
index 5f84e3b3259e..d88b2ba733bc 100644
--- a/pkgs/development/python-modules/evdev/default.nix
+++ b/pkgs/development/python-modules/evdev/default.nix
@@ -7,13 +7,13 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "evdev";
   version = "1.9.3";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-LBQOAayEN3WPoj/lyHE5dBJGH0LUIaogJB3I/oz8y8k=";
   };
 
@@ -40,9 +40,9 @@ buildPythonPackage rec {
   meta = {
     description = "Provides bindings to the generic input event interface in Linux";
     homepage = "https://python-evdev.readthedocs.io/";
-    changelog = "https://github.com/gvalkov/python-evdev/blob/v${version}/docs/changelog.rst";
+    changelog = "https://github.com/gvalkov/python-evdev/blob/v${finalAttrs.version}/docs/changelog.rst";
     license = lib.licenses.bsd3;
     maintainers = [ ];
     platforms = lib.platforms.linux;
   };
-}
+})

From 2f40c640329cc63a180b2490784cd6901cad98ee Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Tue, 21 Jul 2026 01:05:25 +0200
Subject: [PATCH 20/35] python3Packages.expiring-dict: enable tests

---
 pkgs/development/python-modules/expiring-dict/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/expiring-dict/default.nix b/pkgs/development/python-modules/expiring-dict/default.nix
index ce39c7151918..a34e9d821930 100644
--- a/pkgs/development/python-modules/expiring-dict/default.nix
+++ b/pkgs/development/python-modules/expiring-dict/default.nix
@@ -4,6 +4,7 @@
   fetchPypi,
   setuptools,
   sortedcontainers,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -23,6 +24,8 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "expiring_dict" ];
 
+  nativeCheckInputs = [ pytestCheckHook ];
+
   meta = {
     description = "Python dict with TTL support for auto-expiring caches";
     homepage = "https://github.com/dparker2/py-expiring-dict";

From cd096fe274476e562cfc820f4a4be84adf274a0c Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Tue, 21 Jul 2026 01:05:53 +0200
Subject: [PATCH 21/35] python3Packages.expiring-dict: use finalAttrs

---
 pkgs/development/python-modules/expiring-dict/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/expiring-dict/default.nix b/pkgs/development/python-modules/expiring-dict/default.nix
index a34e9d821930..5da8b3aff24f 100644
--- a/pkgs/development/python-modules/expiring-dict/default.nix
+++ b/pkgs/development/python-modules/expiring-dict/default.nix
@@ -7,14 +7,14 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "expiring-dict";
   version = "1.1.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "expiring_dict";
-    inherit version;
+    inherit (finalAttrs) version;
     hash = "sha256-yoy4AjBOrlszoj7EwZAZthCt/aUMvEyb+jrVws04djE=";
   };
 
@@ -32,4 +32,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})

From a675a23d9dc8ccfc61a26abc779b9d1bbca87b3f Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Tue, 21 Jul 2026 01:11:33 +0200
Subject: [PATCH 22/35] python3Packages.extras: migrate to pyproject

---
 pkgs/development/python-modules/extras/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/extras/default.nix b/pkgs/development/python-modules/extras/default.nix
index d73a0c050ea7..42693161bad6 100644
--- a/pkgs/development/python-modules/extras/default.nix
+++ b/pkgs/development/python-modules/extras/default.nix
@@ -2,18 +2,21 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "extras";
   version = "1.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "132e36de10b9c91d5d4cc620160a476e0468a88f16c9431817a6729611a81b4e";
   };
 
+  build-system = [ setuptools ];
+
   # error: invalid command 'test'
   doCheck = false;
 

From 40a34c7ed42de1975f5ef48923031041f6407ff6 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Tue, 21 Jul 2026 01:12:48 +0200
Subject: [PATCH 23/35] python3Packages.extras: use finalAttrs

---
 pkgs/development/python-modules/extras/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/extras/default.nix b/pkgs/development/python-modules/extras/default.nix
index 42693161bad6..eea0fcc57049 100644
--- a/pkgs/development/python-modules/extras/default.nix
+++ b/pkgs/development/python-modules/extras/default.nix
@@ -5,14 +5,14 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "extras";
   version = "1.0.0";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "132e36de10b9c91d5d4cc620160a476e0468a88f16c9431817a6729611a81b4e";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-Ey423hC5yR1dTMYgFgpHbgRoqI8WyUMYF6ZylhGoG04=";
   };
 
   build-system = [ setuptools ];
@@ -25,4 +25,4 @@ buildPythonPackage rec {
     homepage = "https://github.com/testing-cabal/extras";
     license = lib.licenses.mit;
   };
-}
+})

From 9d499eb9c263d7083fe46cc271c8d6b6cac28266 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Tue, 21 Jul 2026 01:13:22 +0200
Subject: [PATCH 24/35] python3Packages.extras: enable tests

---
 pkgs/development/python-modules/extras/default.nix | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/extras/default.nix b/pkgs/development/python-modules/extras/default.nix
index eea0fcc57049..a7fd5bbdb958 100644
--- a/pkgs/development/python-modules/extras/default.nix
+++ b/pkgs/development/python-modules/extras/default.nix
@@ -3,6 +3,8 @@
   buildPythonPackage,
   fetchPypi,
   setuptools,
+  pytestCheckHook,
+  testtools,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -17,8 +19,15 @@ buildPythonPackage (finalAttrs: {
 
   build-system = [ setuptools ];
 
-  # error: invalid command 'test'
-  doCheck = false;
+  preCheck = ''
+    substituteInPlace extras/tests/test_extras.py \
+        --replace-fail "assertEquals(" "assertEqual("
+  '';
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    testtools
+  ];
 
   meta = {
     description = "Useful extra bits for Python - things that should be in the standard library";

From 5bb1c78d316ac745bd756bcb2e482545d420e929 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 21 Jul 2026 00:51:54 +0000
Subject: [PATCH 25/35] telegraf: 1.39.1 -> 1.39.2

---
 pkgs/by-name/te/telegraf/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/telegraf/package.nix b/pkgs/by-name/te/telegraf/package.nix
index aa06af6acefe..ad9aad2305e5 100644
--- a/pkgs/by-name/te/telegraf/package.nix
+++ b/pkgs/by-name/te/telegraf/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "telegraf";
-  version = "1.39.1";
+  version = "1.39.2";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-B9Xy02oYSYcU0IBOZes9tof/04TLvLybOU/nLLaFORk=";
+    hash = "sha256-yWWjlCAc5xJh4IwszVRTGIM5DMXKHyfAHEa1jSVi/mk=";
   };
 
-  vendorHash = "sha256-9o0Tt6OZnoNO8iSLYmn1SMkQmZzC19uNmfHSkEqWzmA=";
+  vendorHash = "sha256-j/yGDEXNOrMAq4ArMjqTxZHfvQZkjmDpZQ3LAUe8BJ0=";
   proxyVendor = true;
 
   ldflags = [

From c59c91caaca0a6c26e781343095adf28b76529cc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 21 Jul 2026 00:52:30 +0000
Subject: [PATCH 26/35] monkeys-audio: 13.18 -> 13.19

---
 pkgs/by-name/mo/monkeys-audio/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mo/monkeys-audio/package.nix b/pkgs/by-name/mo/monkeys-audio/package.nix
index caf9993a825b..696a05b02521 100644
--- a/pkgs/by-name/mo/monkeys-audio/package.nix
+++ b/pkgs/by-name/mo/monkeys-audio/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "13.18";
+  version = "13.19";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-zNEEJSHdr89lsLGBIL2lXixSCk0Wj1kgT0GKpph5jXY=";
+    hash = "sha256-i2FNQB6ZMt2ZnWjVr3UDSqxHav/MAKuDwC+h+gXW/Ik=";
     stripRoot = false;
   };
 

From 328e46f2d512c281fa139e52981228793605120d Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 18 Dec 2025 00:39:53 -0500
Subject: [PATCH 27/35] ramalama: wrap all deps when withPodman==false, except
 podman

Before the change, ramalama erroneously excluded all deps from
wrapProgram if withPodman was false. Now only podman inclusion in the
closure is controlled by withPodman argument; other deps are always
included.
---
 pkgs/by-name/ra/ramalama/package.nix | 30 ++++++++++++++--------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/pkgs/by-name/ra/ramalama/package.nix b/pkgs/by-name/ra/ramalama/package.nix
index 57743980dedf..9a3c24fca2dc 100644
--- a/pkgs/by-name/ra/ramalama/package.nix
+++ b/pkgs/by-name/ra/ramalama/package.nix
@@ -50,21 +50,21 @@ python3Packages.buildPythonApplication (finalAttrs: {
     make docs
   '';
 
-  postInstall = lib.optionalString withPodman ''
-    wrapProgram $out/bin/ramalama \
-      --prefix PATH : ${
-        lib.makeBinPath (
-          [
-            llama-cpp-vulkan
-            podman
-          ]
-          ++ (with python3Packages; [
-            huggingface-hub
-            mlx-lm
-          ])
-        )
-      }
-  '';
+  postInstall =
+    let
+      binPackages = [
+        llama-cpp-vulkan
+      ]
+      ++ (with python3Packages; [
+        huggingface-hub
+        mlx-lm
+      ])
+      ++ lib.optional withPodman podman;
+    in
+    ''
+      wrapProgram $out/bin/ramalama \
+        --prefix PATH : ${lib.makeBinPath binPackages}
+    '';
 
   pythonImportsCheck = [
     "ramalama"

From 76ea999e3c57ae0f8be72c42d335d53fbcfda72d Mon Sep 17 00:00:00 2001
From: Melody Kelly <melody@melody.blue>
Date: Tue, 21 Jul 2026 10:38:48 +1000
Subject: [PATCH 28/35] trilium-{desktop,server}: 0.103.0 -> 0.104.0

https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0

Breaking changes:
- Backend scripting is now disabled by default
- SQL console access is disabled by default
- The Desktop application has been hardened against potential RCE attacks
- The desktop application now no longer opens its port on the local
  network by default
- OMPL v1 export was dropped from this release
---
 nixos/doc/manual/release-notes/rl-2611.section.md |  2 ++
 pkgs/by-name/tr/trilium-desktop/package.nix       | 12 ++++++------
 pkgs/by-name/tr/trilium-server/package.nix        |  6 +++---
 3 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 15365b49c57e..848ec7504431 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -154,3 +154,5 @@
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=26.05, `pkgs.nextcloud33` will be installed by default.
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=25.11, `pkgs.nextcloud32` will be installed by default.
   - Please note that Nextcloud prohibits skipping major versions while upgrading. You can upgrade to specific versions by declaring `services.nextcloud.package = pkgs.nextcloud33;`.
+
+  - `trilium-desktop` and `trilium-server` have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. [See upstream release note for details](https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0).
diff --git a/pkgs/by-name/tr/trilium-desktop/package.nix b/pkgs/by-name/tr/trilium-desktop/package.nix
index 822f813f1a50..b18355cac248 100644
--- a/pkgs/by-name/tr/trilium-desktop/package.nix
+++ b/pkgs/by-name/tr/trilium-desktop/package.nix
@@ -5,7 +5,7 @@
   fetchurl,
   makeBinaryWrapper,
   # use specific electron since it has to load a compiled module
-  electron_41,
+  electron_42,
   autoPatchelfHook,
   makeDesktopItem,
   copyDesktopItems,
@@ -15,7 +15,7 @@
 
 let
   pname = "trilium-desktop";
-  version = "0.103.0";
+  version = "0.104.0";
 
   triliumSource = os: arch: hash: {
     url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-v${version}-${os}-${arch}.zip";
@@ -26,9 +26,9 @@ let
   darwinSource = triliumSource "macos";
 
   # exposed like this for update.sh
-  x86_64-linux.hash = "sha256-1d6nYhj83LWzglkWoOtAj6lNPkik1qXY5lVpr1iG7No=";
-  aarch64-linux.hash = "sha256-LQMNgj1Ml8gShlPS0qgD/a+Fw4SjvvHrw6XAcSLN7q4=";
-  aarch64-darwin.hash = "sha256-dMlgJgDuxZH1jnvLalmgDUMVCdWQ8AviGt86aeMbGVY=";
+  x86_64-linux.hash = "sha256-VVYBXjKBo5GNKrIiSjvLw3Md26NEO2Fgot2421PDr0k=";
+  aarch64-linux.hash = "sha256-iHFzCiqNajETgJm4jk6NdrCybM1SG9qThBwEaGJMeqM=";
+  aarch64-darwin.hash = "sha256-zVV7lJhl/DNDfvbyCCdTSeDvhyzQLF8pxfnr2QYKeas=";
 
   sources = {
     x86_64-linux = linuxSource "x64" x86_64-linux.hash;
@@ -109,7 +109,7 @@ let
       asar pack $tmp/ $out/share/trilium/resources/app.asar
       rm -rf $tmp
 
-      makeWrapper ${lib.getExe electron_41} $out/bin/trilium \
+      makeWrapper ${lib.getExe electron_42} $out/bin/trilium \
         "''${gappsWrapperArgs[@]}" \
         --set-default ELECTRON_IS_DEV 0 \
         --add-flags $out/share/trilium/resources/app.asar
diff --git a/pkgs/by-name/tr/trilium-server/package.nix b/pkgs/by-name/tr/trilium-server/package.nix
index 02b27fca73c2..2e9e0558309a 100644
--- a/pkgs/by-name/tr/trilium-server/package.nix
+++ b/pkgs/by-name/tr/trilium-server/package.nix
@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "0.103.0";
+  version = "0.104.0";
 
   serverSource_x64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-x64.tar.xz";
-  serverSource_x64.hash = "sha256-+PmlEevacif9xP8y7KrMMCwMQ0jGmT9yVhMrQ1SYG58=";
+  serverSource_x64.hash = "sha256-lrZL0c9ijvjYUQlN6BN1BhHR2KacFG6h6KzIlkIKLGk=";
   serverSource_arm64.url = "https://github.com/TriliumNext/Trilium/releases/download/v${version}/TriliumNotes-Server-v${version}-linux-arm64.tar.xz";
-  serverSource_arm64.hash = "sha256-RjnHCvVIR/ExZ9lC8ukGr2M8X1Hnj5ZeVMmQHUvZTKY=";
+  serverSource_arm64.hash = "sha256-EgqYA7IBSt9tZ12MgktIKhJ9/ww/prTCE5Z7enMUk7Q=";
 
   serverSource =
     if stdenv.hostPlatform.isx86_64 then

From d05d3a794806f0f3923e3cf71e3718d518945681 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 21 Jul 2026 01:43:52 +0000
Subject: [PATCH 29/35] stalwart-vandelay: 1.0.5 -> 1.0.6

---
 pkgs/by-name/st/stalwart-vandelay/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/stalwart-vandelay/package.nix b/pkgs/by-name/st/stalwart-vandelay/package.nix
index 7b9e4fc45efa..5b00794ce326 100644
--- a/pkgs/by-name/st/stalwart-vandelay/package.nix
+++ b/pkgs/by-name/st/stalwart-vandelay/package.nix
@@ -8,14 +8,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vandelay";
-  version = "1.0.5";
+  version = "1.0.6";
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "vandelay";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ePOh2lJWJvZ5sV8KQ4n9A5pV7UhDBkN+RQ37LLoMm+o=";
+    hash = "sha256-Eg4kQncwCHpFzCZBp2OK4yUsBsYXwf1pQ+USHwmU9Ro=";
   };
-  cargoHash = "sha256-KlAarYv8Vzp0bpR2jhC4bG0iVyG5YPGvsa8GHRsscJg=";
+  cargoHash = "sha256-+v0xgVliX/sDDDMCzWMVDnBDoJK9a2xaIkMJwEIO6ks=";
   __structuredAttrs = true;
   __darwinAllowLocalNetworking = true;
   # called `Result::unwrap()` on an `Err` value: Tls("rustls platform verifier: unexpected error: No CA certificates were loaded from the system")

From 139a7642831e156dfaadc62c37146c473dcfab8b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 21 Jul 2026 01:51:13 +0000
Subject: [PATCH 30/35] inputplumber: 0.77.7 -> 0.78.0

---
 pkgs/by-name/in/inputplumber/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/in/inputplumber/package.nix b/pkgs/by-name/in/inputplumber/package.nix
index c3a792134167..e2f821f1ddc1 100644
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "inputplumber";
-  version = "0.77.7";
+  version = "0.78.0";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LECHrL+yopymcdpuEZUFvNX1QI30Z+mOtMYP7fnMpBM=";
+    hash = "sha256-wa05/gStEbXUZLvokY1N4k4f4/cPm2Kolbf+AF479lU=";
   };
 
-  cargoHash = "sha256-1g4nHBu9LUMMr0bPkD4LCEFyyIc+GdhIWu+hlyGH3IM=";
+  cargoHash = "sha256-lScpMua5czwmnz/+fz+UrgZSWHwRNP7zB317xJS+6gs=";
 
   nativeBuildInputs = [
     pkg-config

From 85d32c6e5f70c9fa243b2578731d5bf082e7de62 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Tue, 21 Jul 2026 12:08:28 +1000
Subject: [PATCH 31/35] Revert "sketchybar: fix darwin build"

This reverts commit 174bd66b7677fa2dae76e6c3c4047125f5f35bb5.
---
 pkgs/by-name/sk/sketchybar/package.nix | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/pkgs/by-name/sk/sketchybar/package.nix b/pkgs/by-name/sk/sketchybar/package.nix
index 139b02922412..df0ae0a33d14 100644
--- a/pkgs/by-name/sk/sketchybar/package.nix
+++ b/pkgs/by-name/sk/sketchybar/package.nix
@@ -5,7 +5,6 @@
   nix-update-script,
   apple-sdk_15,
   versionCheckHook,
-  llvmPackages,
 }:
 
 let
@@ -22,20 +21,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-5tyc/yYzdV/3JTtujuj7le/14XkC7TlN/nZg7tOZsNg=";
   };
 
-  nativeBuildInputs = [
-    # TODO: Remove once #536365 reaches this branch
-    llvmPackages.lld
-  ];
-
   buildInputs = [
     apple-sdk_15
   ];
 
   makeFlags = [ "arm64" ];
 
-  # TODO: Remove once #536365 reaches this branch
-  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
-
   installPhase = ''
     runHook preInstall
 

From 1ee98495a485c42f85b148d2f23bed0d010a49c1 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Tue, 21 Jul 2026 12:08:38 +1000
Subject: [PATCH 32/35] Revert "vfkit: use lld to avoid trap during linking"

This reverts commit 559ebc0633af55d278e4d7f6730c01d9e6ee27c2.
---
 pkgs/by-name/vf/vfkit/package.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/by-name/vf/vfkit/package.nix b/pkgs/by-name/vf/vfkit/package.nix
index dbe208e8b563..0acbe47ce0cf 100644
--- a/pkgs/by-name/vf/vfkit/package.nix
+++ b/pkgs/by-name/vf/vfkit/package.nix
@@ -5,7 +5,6 @@
   darwin,
   fetchFromGitHub,
   fetchpatch2,
-  llvmPackages,
   nix-update-script,
   testers,
   vfkit,
@@ -34,17 +33,12 @@ buildGoModule rec {
 
   nativeBuildInputs = [
     darwin.sigtool
-    # TODO: Remove this when NixOS/nixpkgs#536365 reaches master.
-    llvmPackages.lld
   ];
 
   buildInputs = [
     apple-sdk_15
   ];
 
-  # TODO: Remove this when NixOS/nixpkgs#536365 reaches master.
-  env.NIX_CFLAGS_LINK = "-fuse-ld=${lib.getExe' llvmPackages.lld "ld64.lld"}";
-
   postFixup = ''
     codesign --entitlements vf.entitlements -f -s - $out/bin/vfkit
   '';

From 018df009f10aec269120e3319cd46b198162646e Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Tue, 21 Jul 2026 12:10:36 +1000
Subject: [PATCH 33/35] concord-tui: remove ld64 hardening workaround

partial revert of 2f852c210864ef1483e4d3f813d05016d7b17b11
---
 pkgs/by-name/co/concord-tui/package.nix | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/pkgs/by-name/co/concord-tui/package.nix b/pkgs/by-name/co/concord-tui/package.nix
index f2ea41311f2e..4b074f9052d5 100644
--- a/pkgs/by-name/co/concord-tui/package.nix
+++ b/pkgs/by-name/co/concord-tui/package.nix
@@ -7,8 +7,6 @@
   opus,
   lib,
   stdenv,
-  # TODO: Clean up on `staging`
-  lld,
   nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -33,21 +31,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeBuildInputs = [
     pkg-config
     cmake
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    lld
   ];
 
   __darwinAllowLocalNetworking = true;
 
   __structuredAttrs = true;
 
-  # TODO: Clean up on `staging`
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=${lib.getExe' lld "ld64.lld"}";
-  };
-
   passthru.updateScript = nix-update-script { };
 
   meta = {

From 116c1e3081983f65e7e39ba9097b77d22b56a897 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 21 Jul 2026 05:07:58 +0000
Subject: [PATCH 34/35] sgt-puzzles: 20260523.7ad37c6 -> 20260720.3c36322

---
 pkgs/by-name/sg/sgt-puzzles/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sg/sgt-puzzles/package.nix b/pkgs/by-name/sg/sgt-puzzles/package.nix
index d4af4eb46e9c..6bc1e154cf20 100644
--- a/pkgs/by-name/sg/sgt-puzzles/package.nix
+++ b/pkgs/by-name/sg/sgt-puzzles/package.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sgt-puzzles";
-  version = "20260523.7ad37c6";
+  version = "20260720.3c36322";
 
   src = fetchurl {
     url = "https://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Pcl8wCXrnjQ68jMpZMhWcvKiHanqk1efMbzGbjOHupc=";
+    hash = "sha256-z0OuMD8IXEp7TAcR4xKXVanGiev78+pVvyc9lgIiOAY=";
   };
 
   sgt-puzzles-menu = fetchurl {

From 21768dd0d39313c3df9b1cbc3f2ebe643eb1d67e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 21 Jul 2026 05:47:20 +0000
Subject: [PATCH 35/35] terraform-providers.launchdarkly_launchdarkly: 2.30.0
 -> 2.30.1

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index cb5ee223836e..9817fed4c45a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -842,13 +842,13 @@
     "vendorHash": "sha256-EAv8EeNn0PJ3BElmg6sKkd/LXNe0lFjEIjHuZRG3CoQ="
   },
   "launchdarkly_launchdarkly": {
-    "hash": "sha256-PgAK0BUTSyW4CXssQkENohnhtd2O5GPuFVvSDcHWjQ8=",
+    "hash": "sha256-xQhWB5gUO10v7KXXHci3gvXlI/hg7JXsn9bYxHVGJwc=",
     "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
     "owner": "launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.30.0",
+    "rev": "v2.30.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OgKOjLwDQxJiv+VWdOzjMcUDPu9LOuhyTRyLyM39vLM="
+    "vendorHash": "sha256-9RisIZUblqqylMW6Bz6ehpwRUXyvTdicuhEGI+n5G3Y="
   },
   "linode_linode": {
     "hash": "sha256-N/SVZ1ajNRT53zxdYBT6Hd/wwAuKhEre0QSZUYbkwGA=",