Merge staging-next into staging

2026-07-24 01:21:11 +00:00 · 2026-07-23 18:27:57 +00:00
parent aa9484a1aa 9ff109fb87
commit 05a86876bd
132 changed files with 1928 additions and 1890 deletions
--- a/doc/build-helpers/testers.chapter.md
+++ b/doc/build-helpers/testers.chapter.md
@@ -758,6 +758,7 @@ An attribute set of derivations which perform the tests during their build.
  - Output attribute `config` is the resulting evaluated services attrset (e.g., the value of the `system.services` option in NixOS).
    This attribute must be available even if `checkDrv` would fail.
  - Output attribute `checkDrv` is a representative derivation whose existence and buildability prove the eval is sound (e.g., `system.build.toplevel` in NixOS, but could perhaps be more specific in the case of another process manager integration).
+  - The generic tester only reads `config` and `checkDrv`. An integration may return additional attributes for its own integration-specific eval checks. Such extra attributes are optional.

 `mkTest` (function)

@@ -772,6 +773,14 @@ An attribute set of derivations which perform the tests during their build.
 : Path to a directory writable by service processes and readable by `testExe`.
  The integration must ensure this directory is available when the services and `testExe` run.

+`callReload` (function)
+
+: `path -> string`.
+  Given a service's name `path` (the list of service names from the top-level service down to the target sub-service, e.g. `[ "reload" "inner" ]`), returns a shell command that reloads that service.
+  The command is embedded in `testExe` and executed with sufficient privilege to reload the service (e.g. as root in the test VM).
+  There is no manager-agnostic reload command, so every integration must provide this; the integration joins the `path` per its own unit-naming convention (the suite does not assume one).
+  On NixOS the `path` dash-joins into the systemd unit name with a `.service` suffix, so the command is `systemctl reload ${lib.concatStringsSep "-" path}.service` (a top-level service is a single-element path `[ "svc" ]` -> `svc.service`; a nested sub-service `[ "parent" "child" ]` -> `parent-child.service`).
+
 :::{.example #ex-modularServiceCompliance-nixos}

 # NixOS invocation of the compliance suite
@@ -802,6 +811,7 @@ recurseIntoAttrs (
        config = machine.config.system.services;
        checkDrv = machine.config.system.build.toplevel;
      };
+    callReload = path: "systemctl reload ${lib.concatStringsSep "-" path}.service";
    mkTest =
      {
        name,
--- a/doc/hooks/pnpm.section.md
+++ b/doc/hooks/pnpm.section.md
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
-    fetcherversion = 4;
+    fetcherVersion = 4;
    hash = lib.fakeHash;
  };

@@ -123,7 +123,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
-    fetcherversion = 4;
+    fetcherVersion = 4;
    hash = lib.fakeHash;
  };

--- a/lib/services/service.nix
+++ b/lib/services/service.nix
@@ -7,10 +7,11 @@
 {
  lib,
  config,
+  options,
  ...
 }:
 let
-  inherit (lib) mkOption types;
+  inherit (lib) mkEnableOption mkOption types;
  pathOrStr = types.coercedTo types.path (x: "${x}") types.str;
 in
 {
@@ -40,7 +41,7 @@ in
      visible = "shallow";
    };
    process = {
-      argv = lib.mkOption {
+      argv = mkOption {
        type = types.listOf pathOrStr;
        example = lib.literalExpression ''[ (lib.getExe config.package) "--nobackground" ]'';
        description = ''
@@ -72,15 +73,12 @@ in
    };

    notificationProtocol = mkOption {
-      type = types.listOf (
-        types.enum [
-          "systemd"
-          "s6"
-        ]
-      );
-
-      default = [ ];
-      apply = v: lib.unique v;
+      type = types.submodule {
+        options = {
+          systemd = mkEnableOption "Whether the service supports systemd-notify.";
+          s6 = mkEnableOption "Whether the service supports s6-notify.";
+        };
+      };
      description = ''
        Notification protocol that this service supports with the underlying service manager.
      '';
@@ -90,13 +88,20 @@ in
  config = {
    assertions = [
      {
-        assertion = config.process.reloadSignal != null && config.process.reloadCommand != null;
+        # `reloadSignal` derives `reloadCommand` at `mkDefault` priority below, so a
+        # conflict only exists when the user *also* set `reloadCommand` explicitly.
+        # An explicit (non-`mkDefault`) definition has `defaultOverridePriority`.
+        assertion =
+          !(
+            config.process.reloadSignal != null
+            && options.process.reloadCommand.highestPrio <= lib.modules.defaultOverridePriority
+          );
        message = "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand.";
      }
    ];

-    process.reloadCommand = (lib.mkIf config.process.reloadSignal != null) (
-      lib.mkForce "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
+    process.reloadCommand = lib.mkIf (config.process.reloadSignal != null) (
+      lib.mkDefault "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
    );
  };
 }
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4691,6 +4691,12 @@
    githubId = 53847249;
    name = "Casey Avila";
  };
+  caspersonn = {
+    email = "lucakasper8@gmail.com";
+    github = "Caspersonn";
+    githubId = 96787412;
+    name = "Luca Kasper";
+  };
  cassandracomar = {
    name = "Cassandra Comar";
    github = "cassandracomar";
@@ -25000,6 +25006,12 @@
    githubId = 47582;
    name = "Samir Talwar";
  };
+  samiser = {
+    email = "nixos@me.samiser.xyz";
+    github = "samiser";
+    githubId = 32001364;
+    name = "Sam";
+  };
  samlich = {
    email = "nixos@samli.ch";
    github = "samlich";
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -24,6 +24,8 @@ let
    GRANIAN_HOST = cfg.address;
    GRANIAN_PORT = toString cfg.port;
    GRANIAN_WORKERS_KILL_TIMEOUT = "60";
+    # django-allauth uses python requests, which doesn't use the systems CA bundle by default: https://requests.readthedocs.io/en/latest/user/advanced/#ca-certificates
+    REQUESTS_CA_BUNDLE = config.security.pki.caBundle;
  }
  // lib.optionalAttrs (config.time.timeZone != null) {
    PAPERLESS_TIME_ZONE = config.time.timeZone;
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/enso-os.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/enso-os.nix
@@ -1,122 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-  dmcfg = config.services.xserver.displayManager;
-  ldmcfg = dmcfg.lightdm;
-  cfg = ldmcfg.greeters.enso;
-
-  theme = cfg.theme.package;
-  icons = cfg.iconTheme.package;
-  cursors = cfg.cursorTheme.package;
-
-  ensoGreeterConf = pkgs.writeText "lightdm-enso-os-greeter.conf" ''
-    [greeter]
-    default-wallpaper=${ldmcfg.background}
-    gtk-theme=${cfg.theme.name}
-    icon-theme=${cfg.iconTheme.name}
-    cursor-theme=${cfg.cursorTheme.name}
-    blur=${toString cfg.blur}
-    brightness=${toString cfg.brightness}
-    ${cfg.extraConfig}
-  '';
-in
-{
-  options = {
-    services.xserver.displayManager.lightdm.greeters.enso = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to enable enso-os-greeter as the lightdm greeter
-        '';
-      };
-
-      theme = {
-        package = mkPackageOption pkgs "gnome-themes-extra" { };
-        name = mkOption {
-          type = types.str;
-          default = "Adwaita";
-          description = ''
-            Name of the theme to use for the lightdm-enso-os-greeter
-          '';
-        };
-      };
-
-      iconTheme = {
-        package = mkPackageOption pkgs "papirus-icon-theme" { };
-        name = mkOption {
-          type = types.str;
-          default = "ePapirus";
-          description = ''
-            Name of the icon theme to use for the lightdm-enso-os-greeter
-          '';
-        };
-      };
-
-      cursorTheme = {
-        package = mkPackageOption pkgs "capitaine-cursors" { };
-        name = mkOption {
-          type = types.str;
-          default = "capitane-cursors";
-          description = ''
-            Name of the cursor theme to use for the lightdm-enso-os-greeter
-          '';
-        };
-      };
-
-      blur = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether or not to enable blur
-        '';
-      };
-
-      brightness = mkOption {
-        type = types.int;
-        default = 7;
-        description = ''
-          Brightness
-        '';
-      };
-
-      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
-        description = ''
-          Extra configuration that should be put in the greeter.conf
-          configuration file
-        '';
-      };
-    };
-  };
-
-  config = mkIf (ldmcfg.enable && cfg.enable) {
-    environment.etc."lightdm/greeter.conf".source = ensoGreeterConf;
-
-    environment.systemPackages = [
-      cursors
-      icons
-      theme
-    ];
-
-    services.xserver.displayManager.lightdm = {
-      greeter = mkDefault {
-        package = pkgs.lightdm-enso-os-greeter.xgreeters;
-        name = "pantheon-greeter";
-      };
-
-      greeters = {
-        gtk = {
-          enable = mkDefault false;
-        };
-      };
-    };
-  };
-}
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@@ -83,7 +83,6 @@ in
  imports = [
    ./lightdm-greeters/gtk.nix
    ./lightdm-greeters/mini.nix
-    ./lightdm-greeters/enso-os.nix
    ./lightdm-greeters/pantheon.nix
    ./lightdm-greeters/lomiri.nix
    ./lightdm-greeters/tiny.nix
@@ -107,6 +106,9 @@ in
        "user"
      ]
    )
+    (lib.mkRemovedOptionModule [ "services" "xserver" "displayManager" "lightdm" "greeters" "enso" ]
+      "services.xserver.displayManager.lightdm.greeters.enso has been removed following removal of the corresponding package."
+    )
  ];

  options = {
--- a/nixos/modules/system/service/systemd/service.nix
+++ b/nixos/modules/system/service/systemd/service.nix
@@ -126,33 +126,29 @@ in
        `%i` (instance), `%t` (runtime directory), and environment variables using
        `''${VAR}` syntax in your command line.

-        By default, it is either set to null or this is set to the escaped version of {option}`process.reloadCommand`
-        when specified to prevent systemd substitution. Set this option explicitly to enable
-        systemd's substitution features.
+        By default, it is set to {option}`process.reloadCommand` when specified, or an
+        empty string otherwise. Because {option}`process.reloadCommand` is already a
+        command line (not an argument list), it is used verbatim so that references
+        like `$MAINPID` are preserved.

        To extend {option}`process.reloadCommand` with systemd specifiers, you can append
-        to the escaped arguments:
+        to the command line:

        ```nix
        systemd.mainExecReload =
-          config.systemd.lib.escapeSystemdExecArgs config.process.reload + " --systemd-unit %n";
+          config.process.reloadCommand + " --systemd-unit %n";
        ```

        This pattern allows you to pass the unit name (or other systemd specifiers)
-        as additional arguments while keeping the base command from {option}`process.argv`
-        properly escaped.
+        as additional arguments.

        See {manpage}`systemd.service(5)` (section "COMMAND LINES") for details on
        variable substitution and {manpage}`systemd.unit(5)` (section "SPECIFIERS")
        for available specifiers like `%n`, `%i`, `%t`.
      '';
      type = types.nullOr types.str;
-      default =
-        if config.process.reloadCommand then
-          config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand
-        else
-          "";
-      defaultText = lib.literalExpression "config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand";
+      default = if config.process.reloadCommand != null then config.process.reloadCommand else "";
+      defaultText = lib.literalExpression "config.process.reloadCommand";
    };

    systemd.services = mkOption {
@@ -213,9 +209,7 @@ in
      wantedBy = lib.mkDefault [ "multi-user.target" ];
      serviceConfig = {
        ExecReload = config.systemd.mainExecReload;
-        Type = lib.mkDefault (
-          if (config.serviceManager.notificationProtocol == "systemd") then "notify" else "simple"
-        );
+        Type = lib.mkDefault (if config.notificationProtocol.systemd then "notify" else "simple");
        Restart = lib.mkDefault "always";
        RestartSec = lib.mkDefault "5";
        ExecStart = [
--- a/nixos/tests/system-services-compliance.nix
+++ b/nixos/tests/system-services-compliance.nix
@@ -7,6 +7,23 @@

 let
  sharedDir = "/tmp/modular-service-compliance";
+
+  inherit (pkgs) lib coreutils;
+
+  evalSystemServices =
+    services:
+    evalSystem (
+      { ... }:
+      {
+        system.services = services;
+        system.stateVersion = "25.05";
+        fileSystems."/" = {
+          device = "/test/dummy";
+          fsType = "auto";
+        };
+        boot.loader.grub.enable = false;
+      }
+    );
 in
 let
  suite = pkgs.testers.modularServiceCompliance {
@@ -15,23 +32,13 @@ let
    evalConfig =
      { services }:
      let
-        machine = evalSystem (
-          { ... }:
-          {
-            system.services = services;
-            system.stateVersion = "25.05";
-            fileSystems."/" = {
-              device = "/test/dummy";
-              fsType = "auto";
-            };
-            boot.loader.grub.enable = false;
-          }
-        );
+        machine = evalSystemServices services;
      in
      {
        config = machine.config.system.services;
        checkDrv = machine.config.system.build.toplevel;
      };
+    callReload = path: "systemctl reload ${lib.concatStringsSep "-" path}.service";
    mkTest =
      {
        name,
@@ -49,6 +56,80 @@ let
        meta.maintainers = with pkgs.lib.maintainers; [ roberth ];
      };
  };
+
+  # systemd-specific eval assertions. serviceConfig.Type/ExecReload only exist on
+  # the resolved host units, so a fresh eval is used per case.
+  systemdEvalTests =
+    let
+      defaultUnits =
+        (evalSystemServices {
+          service.process.argv = [ "${coreutils}/bin/true" ];
+        }).config.systemd.services;
+
+      notifyUnits =
+        (evalSystemServices {
+          service = {
+            process.argv = [ "${coreutils}/bin/true" ];
+            notificationProtocol.systemd = true;
+          };
+        }).config.systemd.services;
+
+      reloadUnits =
+        (evalSystemServices {
+          service = {
+            process.argv = [ "${coreutils}/bin/true" ];
+            process.reloadSignal = "HUP";
+          };
+        }).config.systemd.services;
+    in
+    {
+      testDefaultType = {
+        expr = defaultUnits.service.serviceConfig.Type;
+        expected = "simple";
+      };
+
+      testNotifyType = {
+        expr = notifyUnits.service.serviceConfig.Type;
+        expected = "notify";
+      };
+
+      testReloadExecReload = {
+        expr = reloadUnits.service.serviceConfig.ExecReload;
+        expected = "${coreutils}/bin/kill -HUP $MAINPID";
+      };
+    };
+
+  systemdEval = pkgs.stdenvNoCC.mkDerivation (finalAttrs: {
+    __structuredAttrs = true;
+    name = "system-services-compliance-systemd-eval-report";
+    passthru = {
+      tests = systemdEvalTests;
+      failures = lib.runTests finalAttrs.finalPackage.tests;
+    };
+    testResults = lib.mapAttrs (_: test: test.expr == test.expected) finalAttrs.finalPackage.tests;
+    buildCommand = ''
+      touch $out
+      for testName in "''${!testResults[@]}"; do
+        if [[ -n "''${testResults[$testName]}" ]]; then
+          echo "PASS  $testName"
+        else
+          echo "FAIL  $testName"
+        fi
+      done
+    ''
+    + lib.optionalString (lib.any (v: !v) (lib.attrValues finalAttrs.testResults)) ''
+      {
+        echo ""
+        echo "systemd-specific eval-level compliance failures:"
+        for testName in "''${!testResults[@]}"; do
+          if [[ -z "''${testResults[$testName]}" ]]; then
+            echo "- $testName"
+          fi
+        done
+      } >&2
+      exit 1
+    '';
+  });
 in

 # Please the callTest pattern.
@@ -64,4 +145,4 @@ pkgs.lib.mapAttrs (
      test = v;
      driver = v;
    }
-) suite
+) (suite // { systemd-eval = systemdEval; })
--- a/pkgs/applications/editors/vim/plugins/non-generated/fff-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/fff-nvim/default.nix
@@ -13,18 +13,18 @@
  writableTmpDirAsHomeHook,
 }:
 let
-  version = "0.10.0";
+  version = "0.10.1";
  src = fetchFromGitHub {
    owner = "dmtrKovalenko";
    repo = "fff";
    tag = "v${version}";
-    hash = "sha256-nrstsxOxHTeSKkqpvyxdzyypfHU6wZBQpvNnCfjh9s4=";
+    hash = "sha256-GGoy8ghA87vwHEc0fi97uiBrpRTAGk/QgqzKu8BBRXo=";
  };
  fff-nvim-lib = rustPlatform.buildRustPackage {
    pname = "fff-nvim-lib";
    inherit version src;

-    cargoHash = "sha256-Nlf2Bxwe5KvZF0unpeK/mMFmv4NM+IKPpFOopXoNRxU=";
+    cargoHash = "sha256-sOE3Zrs/ZtOIusH0+OvR1Ew5sfQfse6eWSLPwDPVSU4=";

    cargoBuildFlags = [
      "-p"
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-nDKqXhU97h0iBPPFASaCSzEdi6H48IW1rn4iB9cD36Y=";
+          hash = "sha256-Y6MXjJBmhMzuQMwhkPLHK/vtciTdjsGvkEblH3ofju0=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-gIN2FE6ROma6v3vJX/Wi+OqFrq5/YV7kJXNMwGRw0Z8=";
+          hash = "sha256-8VvDtb+8SoLTRC7pXwH40amRurxTQgCmhdi0u7e5AfU=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-rb50iFTniwhY/iqsKBN4jfV4j+RxjLF126opVkReyGA=";
+          hash = "sha256-bqjEgsjY+zyG1g/KtkRNxAlazIpc+HwGWvsMQNnPI2M=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.217";
+      version = "2.1.218";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1375,8 +1375,8 @@ let
        mktplcRef = {
          name = "competitive-programming-helper";
          publisher = "DivyanshuAgrawal";
-          version = "2026.6.1780853884";
-          hash = "sha256-4nxH5qW3u3/9Vqf+QFs7l5BDusE5wcxxHiJFcPq/2EE=";
+          version = "2026.7.1784455023";
+          hash = "sha256-mUiQ+35R1HXC+23qYKRJwV61poEsyhY2NkDizU+QMx8=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/DivyanshuAgrawal.competitive-programming-helper/changelog";
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -837,7 +837,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "150.0.7871.128",
+    "version": "150.0.7871.181",
    "deps": {
      "depot_tools": {
        "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
@@ -849,16 +849,16 @@
        "hash": "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8="
      },
      "ungoogled-patches": {
-        "rev": "150.0.7871.128-1",
-        "hash": "sha256-GxSsGTC68IEMPt85RLBCVDT0dTl7ZVVPc8o4vxc50H8="
+        "rev": "150.0.7871.181-1",
+        "hash": "sha256-ifqEnOcvi49cFOYan8ShiwteXYnFrLPclrIBZiE1rGY="
      },
      "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "81891e5ca708047763816c778216799ef14c66cb",
-        "hash": "sha256-lGHZZ2xIih+TaH145CZwEwyXsM1ZQWwqXsIQjWQ/jvk=",
+        "rev": "24b04c927b23c39cf9c5227cc8dc6f64a744c8e9",
+        "hash": "sha256-F52wmxyNPEV26v8YgAz+MRhyEGyV7YUX+/wj95H4Lf0=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -928,8 +928,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "13e691adf3d4d3ebee2f7239731a07d3b9704956",
-        "hash": "sha256-fbjREn3D+quRRADGwR7V65BZt5b+1DgnsG4ZMhwGq6o="
+        "rev": "edae461ad2122a3a2be0b5d3d067472aa0e3329c",
+        "hash": "sha256-V4D7jAPJy4llbfJ6WmgCaqaH3TgkWIg5UtRAUaB9dE4="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -973,8 +973,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "01249a97332468dbdd6cf5edb8dd7bae77875de5",
-        "hash": "sha256-tzomo+GTec2zixxk61gtlma/sjcBImgbLMwA+mIp1LM="
+        "rev": "d089fc91e7e4881362463faf8efe9ae435e34660",
+        "hash": "sha256-ZcfSMBvdAdEJQv+qfwAe8EFHPAfPtuKLTIR5lDRKP3Q="
      },
      "src/third_party/dawn/third_party/glfw3/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1493,8 +1493,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "bee4c917220040e147f14964635ff92ce6c5a3f6",
-        "hash": "sha256-SWmoX+sNaw4KnlTBPt63uBSYfQavJejB3+Vlw/gtWX8="
+        "rev": "587c5b0f5a7b0260826a0c19094c2d952195066e",
+        "hash": "sha256-COvdvWVfafVhccLIj2dJzu62Rbyi3oDgORtjIGolCRo="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1663,8 +1663,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "2b2f69158528fdd9d86b778cfcc2d0a1c4f8c59f",
-        "hash": "sha256-bqzCZSpKdXgKv3O1I7ck1PEXCa/2jBT7hpBEKW0LgTA="
+        "rev": "49df3678d1b6a1511167b15a6b7499d3ab37a638",
+        "hash": "sha256-T9FWX3zuP1V7wvxeHgv2MEfRiwbJC0ElI3eazSYq3fs="
      },
      "src/agents/shared": {
        "url": "https://chromium.googlesource.com/chromium/agents.git",
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -19,7 +19,7 @@
  ocamlPackages_4_10,
  ocamlPackages_4_12,
  ocamlPackages_4_14,
-  ocamlPackages_5_4,
+  ocamlPackages_5_5,
  rocqPackages, # for versions >= 9.0 that are transition shims on top of Rocq
  ncurses,
  buildIde ? null, # default is true for Coq < 8.14 and false for Coq >= 8.14
@@ -76,6 +76,7 @@ let
    "9.1.0".sha256 = "sha256-+QL7I1/0BfT87n7lSaOmpHj2jJuDB4idWhAxwzvVQOE=";
    "9.1.1".sha256 = "sha256-aFsGsFzexyDnOVarHPKs35HjiV8uUCpeOKSl15wXZ4s=";
    "9.2.0".sha256 = "sha256-rVhv2GLImdVPgRwwTQ+wiWNtRUflMrES0ElIrdTIN1s=";
+    "9.3+rc1".sha256 = "sha256-vGJkRRzf8ur7i9IUpRA/sxVEQvZGnxfV/ex28Lt1kWw=";
  };
  releaseRev = v: "V${v}";
  fetched =
@@ -140,12 +141,15 @@ let
          case = lib.versions.range "8.7" "8.10";
          out = ocamlPackages_4_09;
        }
-      ] ocamlPackages_5_4;
+      ] ocamlPackages_5_5;
  ocamlNativeBuildInputs = [
    ocamlPackages.ocaml
    ocamlPackages.findlib
  ]
  ++ lib.optional (coqAtLeast "8.14") dune;
+  ocamlBuildInputs = [
+    ocamlPackages.findlib
+  ];
  ocamlPropagatedBuildInputs =
    [ ]
    ++ lib.optional (!coqAtLeast "8.10") ocamlPackages.camlp5
@@ -225,6 +229,7 @@ let
    buildInputs = [
      ncurses
    ]
+    ++ ocamlBuildInputs
    ++ lib.optionals buildIde (
      if coqAtLeast "8.10" then
        [
@@ -328,11 +333,18 @@ let
      platforms = lib.platforms.unix;
      mainProgram = if buildIde then "coqide" else "coqtop";
    };
+
+    # Things required by the CI
+    strictDeps = true;
+    __structuredAttrs = true;
  };
 in
 if coqAtLeast "8.21" then
  self.overrideAttrs (o: {
    # coq-core is now a shim for rocq
+    nativeBuildInputs = o.nativeBuildInputs ++ [
+      rocqPackages.rocq-core
+    ];
    propagatedBuildInputs = o.propagatedBuildInputs ++ [
      rocqPackages.rocq-core
    ];
--- a/pkgs/applications/science/logic/rocq-core/default.nix
+++ b/pkgs/applications/science/logic/rocq-core/default.nix
@@ -14,7 +14,7 @@
  dune,
  customOCamlPackages ? null,
  ocamlPackages_4_14,
-  ocamlPackages_5_4,
+  ocamlPackages_5_5,
  ncurses,
  csdp ? null,
  version,
@@ -29,6 +29,7 @@ let
    "9.1.0".sha256 = "sha256-+QL7I1/0BfT87n7lSaOmpHj2jJuDB4idWhAxwzvVQOE=";
    "9.1.1".sha256 = "sha256-aFsGsFzexyDnOVarHPKs35HjiV8uUCpeOKSl15wXZ4s=";
    "9.2.0".sha256 = "sha256-rVhv2GLImdVPgRwwTQ+wiWNtRUflMrES0ElIrdTIN1s=";
+    "9.3+rc1".sha256 = "sha256-vGJkRRzf8ur7i9IUpRA/sxVEQvZGnxfV/ex28Lt1kWw=";
  };
  releaseRev = v: "V${v}";
  fetched =
@@ -66,12 +67,15 @@ let
      in
      lib.switch rocq-version [
        (case (range "9.0" "9.1") ocamlPackages_4_14)
-      ] ocamlPackages_5_4;
+      ] ocamlPackages_5_5;
  ocamlNativeBuildInputs = [
    ocamlPackages.ocaml
    ocamlPackages.findlib
    dune
  ];
+  ocamlBuildInputs = [
+    ocamlPackages.findlib
+  ];
  ocamlPropagatedBuildInputs = [ ocamlPackages.zarith ];
  self = stdenv.mkDerivation {
    pname = "rocq";
@@ -130,7 +134,7 @@ let
    };

    nativeBuildInputs = [ pkg-config ] ++ ocamlNativeBuildInputs;
-    buildInputs = [ ncurses ];
+    buildInputs = [ ncurses ] ++ ocamlBuildInputs;

    propagatedBuildInputs = ocamlPropagatedBuildInputs;

@@ -196,6 +200,10 @@ let
      platforms = lib.platforms.unix;
      mainProgram = "rocq";
    };
+
+    # Things required by the CI
+    strictDeps = true;
+    __structuredAttrs = true;
  };
 in
 self
--- a/pkgs/build-support/testers/modular-service-compliance.nix
+++ b/pkgs/build-support/testers/modular-service-compliance.nix
@@ -15,6 +15,7 @@
  evalConfig,
  mkTest,
  sharedDir,
+  callReload,
  namePrefix ? "modular-service-compliance",
 }:

@@ -45,6 +46,11 @@ let
          ];
          warnings = [ "compliance child warning" ];
        };
+        # A sub-service exercising reload derivation from a reload signal.
+        services.reloadee = {
+          process.argv = [ "${coreutils}/bin/true" ];
+          process.reloadSignal = "HUP";
+        };
      };
    };
  };
@@ -65,7 +71,7 @@ let
      };

      testAssertions = {
-        expr = builtins.elem {
+        expr = lib.elem {
          assertion = true;
          message = "compliance test assertion";
        } c.assertions;
@@ -73,12 +79,12 @@ let
      };

      testWarnings = {
-        expr = builtins.elem "compliance test warning" c.warnings;
+        expr = lib.elem "compliance test warning" c.warnings;
        expected = true;
      };

      testSubServiceAssertions = {
-        expr = builtins.elem {
+        expr = lib.elem {
          assertion = true;
          message = "compliance child assertion";
        } c.services.child.assertions;
@@ -86,14 +92,58 @@ let
      };

      testSubServiceWarnings = {
-        expr = builtins.elem "compliance child warning" c.services.child.warnings;
+        expr = lib.elem "compliance child warning" c.services.child.warnings;
+        expected = true;
+      };
+
+      # The reload-conflict assertion must not fire (its `assertion` must hold) for a
+      # service that sets only reloadSignal (guards the inverted-assertion fix, and the
+      # priority-aware conflict detection: reloadSignal derives reloadCommand internally,
+      # which must not be mistaken for a user-set conflict).
+      testNoReloadConflict = {
+        expr = lib.any (
+          a:
+          a.message
+          == "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand."
+          && !a.assertion
+        ) c.services.reloadee.assertions;
+        expected = false;
+      };
+
+      # Setting process.reloadSignal derives process.reloadCommand
+      # (guards the misplaced-paren mkIf fix).
+      testReloadSignalDerivesCommand = {
+        expr = c.services.reloadee.process.reloadCommand;
+        expected = "${coreutils}/bin/kill -HUP $MAINPID";
+      };
+
+      # notificationProtocol submodule bools default to false.
+      testNotificationProtocolSystemdDefault = {
+        expr = c.notificationProtocol.systemd;
+        expected = false;
+      };
+
+      testNotificationProtocolS6Default = {
+        expr = c.notificationProtocol.s6;
+        expected = false;
+      };
+
+      # Setting both reloadSignal and reloadCommand explicitly is a genuine conflict,
+      # so the assertion must fire. Separate eval: checkDrv would fail on this.
+      testReloadConflictFires = {
+        expr = lib.any (
+          a:
+          a.message
+          == "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand."
+          && !a.assertion
+        ) conflictEval.config.conflict.assertions;
        expected = true;
      };

      # Separate eval for a failing assertion — checkDrv would fail here,
      # so we only access config.
      testFailingAssertionValue = {
-        expr = builtins.elem {
+        expr = lib.elem {
          assertion = false;
          message = "compliance failing assertion";
        } failingEval.config.failing.assertions;
@@ -101,6 +151,16 @@ let
      };
    };

+  conflictEval = evalConfig {
+    services = {
+      conflict = {
+        process.argv = [ "${coreutils}/bin/true" ];
+        process.reloadSignal = "HUP";
+        process.reloadCommand = "${coreutils}/bin/kill -HUP $MAINPID";
+      };
+    };
+  };
+
  failingEval = evalConfig {
    services = {
      failing = {
@@ -129,6 +189,24 @@ let
    exec "${coreutils}/bin/sleep" infinity
  '';

+  /**
+    A reloadable service script. Like `svc`, it namespaces a comms subdirectory
+    by its first argument and records the remaining arguments. It traps SIGHUP
+    and appends a marker line to `$dir/reloads` on each reload, then stays alive
+    as the trapping shell itself (no `exec`, so the trap and MAINPID are kept).
+  */
+  reloadableSvc = writeShellScript "${namePrefix}-reloadable-svc" ''
+    id="$1"; shift
+    dir="${sharedDir}/$id"
+    mkdir -p "$dir"
+    : > "$dir/reloads"
+    reload() { printf 'reloaded\n' >> "$dir/reloads"; }
+    trap reload HUP
+    echo "$$" > "$dir/pid"
+    printf '%s\n' "$@" > "$dir/args"
+    while true; do "${coreutils}/bin/sleep" 1; done
+  '';
+
  mkArgv =
    id: extraArgs:
    [
@@ -171,6 +249,27 @@ let
      inherit text;
    });

+  # The reload runtime test's service tree. The reloadable unit is the *sub*-service,
+  # so its name path `[ "reload" "inner" ]` handed to `callReload` exercises the
+  # integration's nested unit naming (NixOS dash-joins to `reload-inner.service`).
+  reloadServices = {
+    reload = {
+      # Parent must run something; a bare keep-alive is enough.
+      process.argv = [
+        reloadableSvc
+        "reload-parent"
+      ];
+      services.inner.process = {
+        argv = [
+          reloadableSvc
+          "reload-inner"
+        ];
+        # The script traps SIGHUP; reloadSignal derives the manager's reload command.
+        reloadSignal = "HUP";
+      };
+    };
+  };
+
 in
 {
  # Eval-level tests: config structure, evaluated in the integration's
@@ -186,9 +285,9 @@ in
    representative = evalResult.checkDrv;
    passthru = {
      tests = evalTestDefs;
-      failures = lib.runTests finalAttrs.passthru.tests;
+      failures = lib.runTests finalAttrs.finalPackage.tests;
    };
-    testResults = lib.mapAttrs (_: test: test.expr == test.expected) finalAttrs.passthru.tests;
+    testResults = lib.mapAttrs (_: test: test.expr == test.expected) finalAttrs.finalPackage.tests;
    buildCommand = ''
      touch $out
      for testName in "''${!testResults[@]}"; do
@@ -247,5 +346,26 @@ in
    '';
  };

+  # Runtime reload: start a reloadable service, ask the integration to reload it,
+  # and assert the service observed the reload (recorded a SIGHUP marker).
+  reload = mkTest {
+    name = "${namePrefix}-reload";
+    services = reloadServices;
+    testExe = mkTestScript "reload" ''
+      ${waitAndCheck "reload-inner" [ ]}
+      ${callReload [
+        "reload"
+        "inner"
+      ]}
+      timeout=30; elapsed=0
+      while ! grep -qx "reloaded" "${sharedDir}/reload-inner/reloads" && [ "$elapsed" -lt "$timeout" ]; do
+        sleep 1; elapsed=$((elapsed + 1))
+      done
+      grep -qx "reloaded" "${sharedDir}/reload-inner/reloads" \
+        || { echo "reload: no reload recorded after ''${timeout}s"; cat "${sharedDir}/reload-inner/reloads"; exit 1; }
+      echo "reload: reload observed"
+    '';
+  };
+
  # See also the manual compliance items in doc/build-helpers/testers.chapter.md.
 }
--- a/pkgs/by-name/ap/apfel-llm/package.nix
+++ b/pkgs/by-name/ap/apfel-llm/package.nix
@@ -8,7 +8,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "apfel-llm";
-  version = "1.8.3";
+  version = "1.8.4";

  __structuredAttrs = true;
  strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
  # Building from source requires swift 6.3.0 while nixpkgs only has 5.10.1
  src = fetchurl {
    url = "https://github.com/Arthur-Ficial/apfel/releases/download/v${finalAttrs.version}/apfel-${finalAttrs.version}-arm64-macos.tar.gz";
-    hash = "sha256-1AA86f5+Poo5YCrtxT1rAPGBctQbNa5hdAZmI008/yU=";
+    hash = "sha256-farvPPo3VU2qUat+72qaiMpcd9LwFO7kqzGGKKtPwGE=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/ar/artalk/package.nix
+++ b/pkgs/by-name/ar/artalk/package.nix
@@ -3,7 +3,7 @@
  buildGoModule,
  fetchFromGitHub,
  nodejs,
-  pnpm_9,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  installShellFiles,
@@ -31,14 +31,14 @@ let
    nativeBuildInputs = [
      nodejs
      pnpmConfigHook
-      pnpm_9
+      pnpm_10
    ];

    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs) pname version src;
-      pnpm = pnpm_9;
-      fetcherVersion = 3;
-      hash = "sha256-HypDGYb0MRCIDBHY8pVgwFoZQWC8us44cunORZRk3RM=";
+      pnpm = pnpm_10;
+      fetcherVersion = 4;
+      hash = "sha256-RSz/bx8/BAqLZH3/yQ6/H/nnwGvcCg8EzIEJ4/xkQgQ=";
    };

    buildPhase = ''
--- a/pkgs/by-name/at/atuin/package.nix
+++ b/pkgs/by-name/at/atuin/package.nix
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "atuin";
-  version = "18.17.0";
+  version = "18.17.1";

  src = fetchFromGitHub {
    owner = "atuinsh";
    repo = "atuin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cciogPSlbfiC9U3Dv+IGyuRI9PU9X4LdlequCFiG/a0=";
+    hash = "sha256-9wfeAqtE6HLNvQHdGlLX6Kv1kakmojgY14RVW/WpOSs=";
  };

-  cargoHash = "sha256-QX1JupLZafRdMUZjl58iFjiPgLSTYZazRVyU88n5QP8=";
+  cargoHash = "sha256-l2TX8thT+MnWhrTyD4ryapJkDg43mb2IurGDnyk2b74=";

  # atuin's default features include 'check-updates', which do not make sense
  # for distribution builds. List all other default features.
--- a/pkgs/by-name/bl/blazesym-c/package.nix
+++ b/pkgs/by-name/bl/blazesym-c/package.nix
@@ -9,24 +9,27 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "blazesym-c";
-  version = "0.1.8";
+  version = "0.1.9";

  src = fetchFromGitHub {
    owner = "libbpf";
    repo = "blazesym";
    tag = "capi-v${finalAttrs.version}";
-    hash = "sha256-IdeY9FCGziYN9glnvQJu2oa5ogdXb6D9QcY2MRnq7vA=";
+    hash = "sha256-gaDNRVcoI6Nc1zWEwS49FhKPep4uI5560t3AaIRCYfw=";
  };

-  cargoHash = "sha256-fsvdhahTKxjrrH9z6m1k3cTkXfMUZXZNZlYRi3tgTlA=";
+  cargoHash = "sha256-ZLGtskOe38fBP8o8zIezzsNwY4Xwr7UnVrbx1KysEis=";

  cargoBuildFlags = [
    "--package"
    "blazesym-c"
  ];

-  nativeCheckInputs = [
+  nativeBuildInputs = [
    pkg-config
+  ];
+
+  buildInputs = [
    elfutils
    zlib
  ];
--- a/pkgs/by-name/bo/bolt-launcher/package.nix
+++ b/pkgs/by-name/bo/bolt-launcher/package.nix
@@ -136,7 +136,7 @@ buildFHSEnv {
      with pkgs;
      [
        gtk2-x11
-        openssl_1_1
+        # openssl_1_1
      ]
    );

@@ -166,5 +166,8 @@ buildFHSEnv {
    ];
    platforms = lib.platforms.linux;
    mainProgram = "bolt-launcher";
-  };
+  }
+  // (lib.optionalAttrs enableRS3 {
+    problems.broken.message = "OpenSSL 1.1 has been end of life since 2023 and will be removed soon.";
+  });
 }
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,20 +3,20 @@

 let
  pname = "brave";
-  version = "1.92.141";
+  version = "1.92.143";

  allArchives = {
    aarch64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-FVzXaVpyfX+GIVofy3NfpE8rOH+9LjQpdEoEWQV0DqI=";
+      hash = "sha256-IHBJm9uow2d/X4Z9e117aGdP1Y+3R1ApWu40sPtdbr8=";
    };
    x86_64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-A87vCTtcyuNMPLaLYDjgyIm85zwAXNc3Z4ImtC9Kjek=";
+      hash = "sha256-jaxNneurduBiw3jho5Fp7gXnBfSpLB5hlE06i/JK+ic=";
    };
    aarch64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-b4BmNt+c0CSrtS2n+30gdWrSsFOQSZnFAy2vWbGJz6g=";
+      hash = "sha256-EvfZgO8FAijof1Ml6gqSOyRndL8KYFdT0MNmVmuxAnU=";
    };
  };

--- a/pkgs/by-name/bu/buildah-unwrapped/package.nix
+++ b/pkgs/by-name/bu/buildah-unwrapped/package.nix
@@ -18,13 +18,13 @@

 buildGoModule (finalAttrs: {
  pname = "buildah";
-  version = "1.44.0";
+  version = "1.44.1";

  src = fetchFromGitHub {
    owner = "podman-container-tools";
    repo = "buildah";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/Rv5la54ikmP4qVT19tg0sv0kM+xpQO6w9XU1PpGFk4=";
+    hash = "sha256-EGoH+PvePNw7I28Vq1kH9W0x4lYuUTSa1Rd+fEE8fkc=";
  };

  outputs = [
--- a/pkgs/by-name/ca/cargo-expand/package.nix
+++ b/pkgs/by-name/ca/cargo-expand/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-expand";
-  version = "1.0.123";
+  version = "1.0.124";

  src = fetchFromGitHub {
    owner = "dtolnay";
    repo = "cargo-expand";
    tag = finalAttrs.version;
-    hash = "sha256-vd63DpKLZpE+fIdfy4gp9PDSSLICPXZdrjk7hMB9L0A=";
+    hash = "sha256-deGIcij3Tczsqc0HTBGUbncdUXKP+FGj5R+2fevQULA=";
  };

-  cargoHash = "sha256-mLpihgQ5PNRE72xWRHgcA8KxujR7Pi4bGnwahOQJ4qo=";
+  cargoHash = "sha256-MYaKNoz8h5bt0/Z+8PwLKZDvIWUUCfsvB5vibMaDmf4=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.217",
-  "commit": "9963b018d22c3e6659c99e135e687870301b5c67",
-  "buildDate": "2026-07-21T18:45:36Z",
+  "version": "2.1.218",
+  "commit": "bce61b433bc397ce68686368abd12f545b0a013a",
+  "buildDate": "2026-07-22T18:42:19Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "5840c777fd47115e9ca276e165563c6e121e7c7e2b4d86598e0025f8cc37de56",
-      "size": 250456784
+      "checksum": "71abaff59312c9a9b6a1d818365048b42e4e95cc521a823660eded3e0880d9b7",
+      "size": 255069680
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "8387a6fd44edfd40d7e74c5fdc3270a15f5e6b1b58c7c6fee560e70d3d1943da",
-      "size": 259908496
+      "checksum": "9862b74a083e8a4ed572f99cbd4895185e0dd5a0a601affb0fb8e43d8d1f40e6",
+      "size": 264548368
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "40c53507ac669c1d438366c19760c22f52748a06e50e0fc0e353d2cb73425597",
-      "size": 265337760
+      "checksum": "295fd30481bd03b38450fdec2a6e25bb6472c2074f04b0c4a566cd5988f230bf",
+      "size": 269990816
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "2630fc5dc6db61bc03f86b95daf47766e5ed5b61873f7bb7cfea764c5ac5a9ba",
-      "size": 268573680
+      "checksum": "e12071751a9336b8af1012c103358ff04ac18f9aaff4a738cff7ba5cdfaf63f2",
+      "size": 273177584
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "e219a631e194e71bccbea2f81f5678c75f745aa6e7a74e8a407610c906d1299b",
-      "size": 258585960
+      "checksum": "efcaae48f8f537a0e9a47b4317a5f8c184706c99ddd8ca0a9a21391e2a766ef8",
+      "size": 263239016
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "7c44188927edbf7b918b41bc7a284292359b1ad556b7802db0148adb4b395732",
-      "size": 263197264
+      "checksum": "62986293277153f5db97404cf7e3e96de136f02c28f79ccd5c7bc99766224db4",
+      "size": 267801168
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "6e4a3a4679f381178a90cf741de9ce924a3274304b09277695ac3a679628ca17",
-      "size": 259460768
+      "checksum": "81fcf59bb7abb558aedc6f2361f4723b3d757d28e799962d88b18b4520df66ca",
+      "size": 263931552
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "f0128e1a50b8d7dec5bb4dbdff0ef622f617e798df61ebb009ed3f03d2afe613",
-      "size": 253836448
+      "checksum": "a7959fd87feb9557d56f4e5752f7ed1ddf405f3bea91b2571bf93af636efd193",
+      "size": 258307232
    }
  },
  "sdkCompat": {
@@ -67,7 +67,8 @@
      "0.3.207",
      "0.3.208",
      "0.3.209",
-      "0.3.215"
+      "0.3.215",
+      "0.3.217"
    ],
    "harnessSchema": 1
  }
--- a/pkgs/by-name/cl/cliamp/package.nix
+++ b/pkgs/by-name/cl/cliamp/package.nix
@@ -16,16 +16,16 @@

 buildGoModule (finalAttrs: {
  pname = "cliamp";
-  version = "1.57.1";
+  version = "1.61.0";

  src = fetchFromGitHub {
    owner = "bjarneo";
    repo = "cliamp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wRXF2bnl3xFJtuESJX2UVSsPwl4xo6E+k7nIdtzCULo=";
+    hash = "sha256-BbyaZw+OvC6rb60Z2whhHj2iKow/ZJJ8VzuwPX7bHIE=";
  };

-  vendorHash = "sha256-A2Ygc1a9e2flZzaNAEXvr8Ui1cE89TxBfUNALmDzIo0=";
+  vendorHash = "sha256-KYjP6qEINdSlcDSEMKxMwDfXzuQPAQSe4oZh+o4PrFs=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/co/code-cursor/sources.json
+++ b/pkgs/by-name/co/code-cursor/sources.json
@@ -1,18 +1,18 @@
 {
-  "version": "3.12.17",
+  "version": "3.12.30",
  "vscodeVersion": "1.128.0",
  "sources": {
    "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/0fb762053c34788bb7760d5673f8a6d4c8589d52/linux/x64/Cursor-3.12.17-x86_64.AppImage",
-      "hash": "sha256-Fu00p0vaLNOl9wbGgtseLwhseXxmIQMyyhlNF7VZ+qM="
+      "url": "https://downloads.cursor.com/production/63a2996a10d9e476b6c28e951dd7691d9c0cf480/linux/x64/Cursor-3.12.30-x86_64.AppImage",
+      "hash": "sha256-7gyF8YtWLjFOjAxhqip2fVxTbaBj/4FtLsjw2JpTOD8="
    },
    "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/0fb762053c34788bb7760d5673f8a6d4c8589d52/linux/arm64/Cursor-3.12.17-aarch64.AppImage",
-      "hash": "sha256-/r6lFrSq7aSefGvOWqLw/YmyUy3VocaWRyOUHoHuSeM="
+      "url": "https://downloads.cursor.com/production/63a2996a10d9e476b6c28e951dd7691d9c0cf480/linux/arm64/Cursor-3.12.30-aarch64.AppImage",
+      "hash": "sha256-UKPf2q4py0pN5FlgdwGbTEKA52T7iJpM63z2kemz9h8="
    },
    "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/0fb762053c34788bb7760d5673f8a6d4c8589d52/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-WaUBglq+Jqa1Cn0sx62ccbBSKhYiBz1u1PjdHxcfQKE="
+      "url": "https://downloads.cursor.com/production/63a2996a10d9e476b6c28e951dd7691d9c0cf480/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-uxAWl5wJISEbGSv7yHys29NZDquLe7z6wMNb61HC/7g="
    }
  }
 }
--- a/pkgs/by-name/co/conduktor/package.nix
+++ b/pkgs/by-name/co/conduktor/package.nix
@@ -1,89 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchzip,
-  jdk11,
-  openjfx17,
-  gtk3,
-  glib,
-  pango,
-  cairo,
-  gdk-pixbuf,
-  libxtst,
-  makeBinaryWrapper,
-  makeDesktopItem,
-  copyDesktopItems,
-}:
-
-let
-  openjfx_jdk = openjfx17.override { withWebKit = true; };
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "conduktor";
-  version = "2.24.9";
-
-  src = fetchzip {
-    url = "https://github.com/conduktor/builds/releases/download/v${finalAttrs.version}/Conduktor-linux-${finalAttrs.version}.zip";
-    hash = "sha256-c9QjlKPZpeJi5YTq4gm+sg7my4EP0LI95AfGguF4ork=";
-  };
-
-  nativeBuildInputs = [
-    makeBinaryWrapper
-    copyDesktopItems
-  ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      type = "Application";
-      name = "conduktor";
-      desktopName = "Conduktor";
-      genericName = finalAttrs.meta.description;
-      exec = "conduktor";
-      icon = fetchurl {
-        url = "https://github.com/conduktor/builds/raw/v${finalAttrs.version}/.github/resources/Conduktor.png";
-        hash = "sha256-mk4c9ecookRb7gR56cedIWfPfQy2uGF+ZbX6NI90KI0=";
-      };
-      comment = "A beautiful and fully-featured desktop client for Apache Kafka";
-    })
-  ];
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r . $out
-    wrapProgram $out/bin/conduktor \
-      --set JAVA_HOME ${jdk11.home} \
-      --set LD_LIBRARY_PATH ${
-        lib.makeLibraryPath [
-          openjfx_jdk
-          gtk3
-          gtk3
-          glib
-          pango
-          cairo
-          gdk-pixbuf
-          libxtst
-        ]
-      } \
-       --add-flags "--module-path ${openjfx_jdk}/lib --add-modules=javafx.controls,javafx.fxml"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Apache Kafka Desktop Client";
-    longDescription = ''
-      Conduktor is a GUI over the Kafka ecosystem, to make the development
-      and management of Apache Kafka clusters as easy as possible.
-    '';
-    homepage = "https://www.conduktor.io/";
-    changelog = "https://www.conduktor.io/changelog/#${finalAttrs.version}";
-    license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ trobert ];
-    platforms = lib.platforms.linux;
-  };
-})
--- a/pkgs/by-name/cr/crosvm/package.nix
+++ b/pkgs/by-name/cr/crosvm/package.nix
@@ -21,12 +21,12 @@

 rustPlatform.buildRustPackage {
  pname = "crosvm";
-  version = "0-unstable-2026-07-06";
+  version = "0-unstable-2026-07-15";

  src = fetchgit {
    url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "1378aabfc63333547e87b788a8204511da243166";
-    hash = "sha256-7cfiXOPlNHLIVHBW+y7WnYgdcxErtJeLBxPey/3uA1w=";
+    rev = "ffbf0df34699f9670db015962bac83d0d417d7e7";
+    hash = "sha256-4z1TXMGOvOMUAED1gluugHPF4mBigjDioxnFneQOIS8=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/ct/ctx7/package.nix
+++ b/pkgs/by-name/ct/ctx7/package.nix
@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ctx7";
-  version = "0.5.4";
+  version = "0.5.5";

  __structuredAttrs = true;
  strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "upstash";
    repo = "context7";
    tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-yyz4UraRm1JR/C7J2ib0nBU6zsNpKCWIWduTu7OlebM=";
+    hash = "sha256-Ea281W/CT/TfFNFMKV7xQzXnMo/25mCAB/Gs9ofyUU4=";
  };

  nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-S+TCwe4FJHjSLTUL/cPh+eRtWx/z7REUyfMNT0BgK7k=";
+    hash = "sha256-F1A0y4uZczVqzce0FfugCaU5Y2qqMZQXy7T6oqlgkbA=";
  };

  buildPhase = ''
--- a/pkgs/by-name/cu/cutter/package.nix
+++ b/pkgs/by-name/cu/cutter/package.nix
@@ -1,7 +1,6 @@
 {
  lib,
  fetchFromGitHub,
-  fetchpatch2,
  stdenv,
  # for passthru.plugins
  pkgs,
@@ -19,24 +18,16 @@
 let
  cutter = stdenv.mkDerivation rec {
    pname = "cutter";
-    version = "2.4.1";
+    version = "2.5.0";

    src = fetchFromGitHub {
      owner = "rizinorg";
      repo = "cutter";
      rev = "v${version}";
-      hash = "sha256-fNOznaFzWJ4Dve9U1+E4xPaznnyxae2jHNaBCdJzDyQ=";
+      hash = "sha256-dnVbtAp7TorPQx4qdK43L2pXMcnWvOYjhRC3MJBrAmM=";
      fetchSubmodules = true;
    };

-    patches = [
-      (fetchpatch2 {
-        name = "fix-shiboken6-type-index-case.patch";
-        url = "https://github.com/rizinorg/cutter/commit/07fea9c772dc573588dc2e5771f0740ee1883738.patch?full_index=1";
-        hash = "sha256-/C/s+Ui5F7MCxbzbChQ5Tv/oUHUQxXmk9xOnNI80xwQ=";
-      })
-    ];
-
    nativeBuildInputs = [
      cmake
      pkg-config
--- a/pkgs/by-name/ea/earlybird/package.nix
+++ b/pkgs/by-name/ea/earlybird/package.nix
@@ -14,13 +14,13 @@

 buildGoModule (finalAttrs: {
  pname = "earlybird";
-  version = "4.6.0";
+  version = "4.6.1";

  src = fetchFromGitHub {
    owner = "americanexpress";
    repo = "earlybird";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-P8kA9MJA+2jtVOYLBu0oG9xTUTGCtiX4R+4ecmXDAAw=";
+    hash = "sha256-Wjvg0+IQHIB5wFwY+4grTOagk5fHMf6YlIB83Jv/ZwE=";
  };

  vendorHash = "sha256-pQ8gSDHsdDT/cgvRB0OSqnMZz2W5vAzFBzph0xksC2o=";
--- a/pkgs/by-name/et/etherpad-lite/package.nix
+++ b/pkgs/by-name/et/etherpad-lite/package.nix
@@ -3,7 +3,7 @@
  stdenv,
  fetchFromGitHub,
  nix-update-script,
-  pnpm_9,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  makeWrapper,
@@ -30,14 +30,14 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-2nKpmGxC+KVg0oF0BsswS9L84QxzpRF7NvKyqyQ7WJM=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-scJhcZDyqUVdKv/EQvB5+EJN/SvMw220+QOcTUxTFJQ=";
  };

  nativeBuildInputs = [
    pnpmConfigHook
-    pnpm_9
+    pnpm_10
    makeWrapper
  ];

@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
    makeWrapper ${lib.getExe nodejs} $out/bin/etherpad-lite \
      --inherit-argv0 \
      --add-flags "--require tsx/cjs $out/lib/etherpad-lite/node_modules/ep_etherpad-lite/node/server.ts" \
-      --suffix PATH : "${lib.makeBinPath [ pnpm_9 ]}" \
+      --suffix PATH : "${lib.makeBinPath [ pnpm_10 ]}" \
      --set NODE_PATH "$out/lib/node_modules:$out/lib/etherpad-lite/node_modules/ep_etherpad-lite/node_modules" \
      --set-default NODE_ENV production
    find $out/lib -xtype l -delete
--- a/pkgs/by-name/ex/exim/package.nix
+++ b/pkgs/by-name/ex/exim/package.nix
@@ -39,11 +39,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "exim";
-  version = "4.99.4";
+  version = "4.99.5";

  src = fetchurl {
    url = "https://ftp.exim.org/pub/exim/exim4/exim-${finalAttrs.version}.tar.xz";
-    hash = "sha256-h/84gVcA37HuTrfo26eRbfenVZBTVNLQ+qGuF5DE/Z0=";
+    hash = "sha256-wtL4Ctx8cdQk/YKkZlXqotfZtMoud4g+upB2lHt+5ic=";
  };

  enableParallelBuilding = true;
--- a/pkgs/by-name/fa/faas-cli/package.nix
+++ b/pkgs/by-name/fa/faas-cli/package.nix
@@ -24,13 +24,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "faas-cli";
-  version = "0.18.10";
+  version = "0.18.11";

  src = fetchFromGitHub {
    owner = "openfaas";
    repo = "faas-cli";
    rev = finalAttrs.version;
-    sha256 = "sha256-MctMhuaXJpm25VKqlhaAPG2QzSDQ//Ei8B1lRCKdz68=";
+    sha256 = "sha256-4bfp9nM6cAglx9mNzjQZ4uo6nJNWI9Q9g9zIdkev9FM=";
  };

  vendorHash = null;
--- a/pkgs/by-name/fi/firezone-server/package.nix
+++ b/pkgs/by-name/fi/firezone-server/package.nix
@@ -4,7 +4,7 @@
  fetchFromGitHub,
  beam27Packages,
  gitMinimal,
-  pnpm_9,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  nodejs,
@@ -34,10 +34,10 @@ beam27Packages.mixRelease rec {

  pnpmDeps = fetchPnpmDeps {
    inherit pname version;
-    pnpm = pnpm_9;
+    pnpm = pnpm_10;
    src = "${src}/apps/web/assets";
-    fetcherVersion = 3;
-    hash = "sha256-tB0y3T/dZBe8BHz7AV913zQ4oQu7VLyqHCnzBycNg18=";
+    fetcherVersion = 4;
+    hash = "sha256-Uq6dAYYWT8G6upYcNEzVc8Gb2HUj8SaWRD0/w0quaRE=";
  };
  pnpmRoot = "apps/web/assets";

@@ -63,7 +63,7 @@ beam27Packages.mixRelease rec {

  nativeBuildInputs = [
    pnpmConfigHook
-    pnpm_9
+    pnpm_10
    nodejs
  ];

--- a/pkgs/by-name/fr/frankenphp/package.nix
+++ b/pkgs/by-name/fr/frankenphp/package.nix
@@ -30,13 +30,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "frankenphp";
-  version = "1.12.4";
+  version = "1.12.5";

  src = fetchFromGitHub {
    owner = "php";
    repo = "frankenphp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DzncOAhdDyc5qOipMI8OPss0WciAQIam6GmaUoe8mR8=";
+    hash = "sha256-1f+3w9x6P1euUZr4hC4jOkgEJEbS/MJ11u+chGShCno=";
  };

  sourceRoot = "${finalAttrs.src.name}/caddy";
@@ -44,7 +44,7 @@ buildGoModule (finalAttrs: {
  # frankenphp requires C code that would be removed with `go mod tidy`
  # https://github.com/golang/go/issues/26366
  proxyVendor = true;
-  vendorHash = "sha256-XY5a8pd5vJ/ouZMASzVqPoeXVfPbnEVDJFKkVNQF+2M=";
+  vendorHash = "sha256-d6ZTi1Ihu011eKVdHMiW9oSdPB4SYpDHMFxH65XLGac=";

  buildInputs = [
    phpUnwrapped
--- a/pkgs/by-name/fr/freetube/package.nix
+++ b/pkgs/by-name/fr/freetube/package.nix
@@ -22,13 +22,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "freetube";
-  version = "0.25.0";
+  version = "0.25.1";

  src = fetchFromGitHub {
    owner = "FreeTubeApp";
    repo = "FreeTube";
    tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-oXa+3BXLVDTaLUzt0imgTtZ4/NywibFzul/y0wymnWk=";
+    hash = "sha256-CQiwAoOJoAZpcDIwqcOfUAvJHLWTdj8fIInlR3qyjg8=";
  };

  __structuredAttrs = true;
@@ -57,7 +57,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-xHlxmeMtMd9/ImheeMH1K22MC0zmIzzgAHXzK+tLnQc=";
+    hash = "sha256-NWCgUjBuSeEl65mmAeJzOyIxCi2ha0Nr5qjOQq+CtMQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gi/gitea-actions-runner/package.nix
+++ b/pkgs/by-name/gi/gitea-actions-runner/package.nix
@@ -9,17 +9,17 @@

 buildGoModule (finalAttrs: {
  pname = "gitea-actions-runner";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchFromGitea {
    domain = "gitea.com";
    owner = "gitea";
    repo = "runner";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-jkK61OZgbMDHD5yxrpyP1BWCVzDiR79dVaC5ItS99BU=";
+    hash = "sha256-aiba7Tdyyy8aDzJq62zOWNkEZE+twIxReW7clbIoVTI=";
  };

-  vendorHash = "sha256-5K0vL0CDYgL/Ud7i4um3mz887Er4qmuhCd9dt5zyUHA=";
+  vendorHash = "sha256-Zpq/G/SZ959SRUIMGo2votFv4DzB46OmPmZwFoae3gU=";

  # Tests require network access (artifactcache tests try to determine outbound IP)
  doCheck = false;
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -6,7 +6,7 @@

 buildGo125Module rec {
  pname = "gitlab-container-registry";
-  version = "4.39.0";
+  version = "4.40.2";
  rev = "v${version}-gitlab";

  # nixpkgs-update: no auto update
@@ -14,10 +14,10 @@ buildGo125Module rec {
    owner = "gitlab-org";
    repo = "container-registry";
    inherit rev;
-    hash = "sha256-7dGKV2Pc3OPdM4OZqYjp3B9/s6DHtPvrqcWnWb3wHYw=";
+    hash = "sha256-k94uEM2VoOtdFRXWm6CDmeRt8LMXSNegRGes3ZKPg0I=";
  };

-  vendorHash = "sha256-s08LsgYZTRJm0sWkbEUsmTYGkfb/5PJl9o9ozY1KOms=";
+  vendorHash = "sha256-MD98JYwTo/t5/E7clIlUfjmv8t7nDPpVElbuYDRjMMc=";

  excludedPackages = [
    "devvm/*"
--- a/pkgs/by-name/go/godotpcktool/package.nix
+++ b/pkgs/by-name/go/godotpcktool/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "godotpcktool";
-  version = "2.2";
+  version = "2.3";

  src = fetchFromGitHub {
    owner = "hhyyrylainen";
    repo = "GodotPckTool";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-H0v432PyKscazR9PN5d+MmYZ8ND497m3RHmWpw16UY4=";
+    hash = "sha256-v8etiUKVxSgVSB3ARqdLgbp3SEC12xBf0HXDl1RJRug=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/he/headlamp-frontend/package.nix
+++ b/pkgs/by-name/he/headlamp-frontend/package.nix
@@ -12,7 +12,7 @@ buildNpmPackage {

  sourceRoot = "${headlamp-server.src.name}/frontend";

-  npmDepsHash = "sha256-73xc/GK1Cvz67D6ftYVRe5GARNgG5qD86CGK6uhoyWA=";
+  npmDepsHash = "sha256-v8aMlOk2JD2DzcUMWTK+2QP44n1Nl0LQPcIry7W51vg=";

  postPatch = ''
    chmod -R u+w ../app
--- a/pkgs/by-name/he/headlamp-server/package.nix
+++ b/pkgs/by-name/he/headlamp-server/package.nix
@@ -2,11 +2,13 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  nix-update,
+  writeShellScript,
 }:

 buildGoModule rec {
  pname = "headlamp-server";
-  version = "0.42.0";
+  version = "0.43.0";

  strictDeps = true;
  __structuredAttrs = true;
@@ -15,12 +17,12 @@ buildGoModule rec {
    owner = "kubernetes-sigs";
    repo = "headlamp";
    tag = "v${version}";
-    hash = "sha256-SBPSh6dsKvMw1C80THri0mNPoTMgcrjONk455S/g9v0=";
+    hash = "sha256-6TGKBKR0WR4Xv7lGCgMFVG/nc19oMOP5cJcgT0bw6Ag=";
  };

  modRoot = "backend";

-  vendorHash = "sha256-dBU053QtUEMWjzkOEHzELH3j7PJOKuoBZCVZFmZ5z7E=";
+  vendorHash = "sha256-U0H1Dj38ajRGFqcWszveWckxenaKa4nrPg81GyIpS0U=";

  # Don't embed frontend - Electron serves it directly. This also prevents
  # the server from auto-opening a browser window.
@@ -38,6 +40,14 @@ buildGoModule rec {
    mv $out/bin/cmd $out/bin/headlamp-server
  '';

+  # headlamp-frontend and headlamp inherit src (and version) from here, update their hashes aswell
+  passthru.updateScript = writeShellScript "headlamp-update" ''
+    set -euo pipefail
+    ${lib.getExe nix-update} headlamp-server
+    ${lib.getExe nix-update} --version=skip --no-src headlamp-frontend
+    ${lib.getExe nix-update} --version=skip --no-src headlamp
+  '';
+
  meta = {
    description = "An easy-to-use and extensible Kubernetes web UI";
    homepage = "https://headlamp.dev";
--- a/pkgs/by-name/he/headlamp/package.nix
+++ b/pkgs/by-name/he/headlamp/package.nix
@@ -17,7 +17,7 @@ buildNpmPackage {

  sourceRoot = "${headlamp-server.src.name}/app";

-  npmDepsHash = "sha256-k7rABbEmYY24k/obKm1GZUnM0Udjtyv2bhrVEvc0ebc=";
+  npmDepsHash = "sha256-gZr+ni3dmrjqHDwoFxgGM0/Kf3R1Qy2SZetLtGtDY+0=";

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

--- a/pkgs/by-name/he/herdr/package.nix
+++ b/pkgs/by-name/he/herdr/package.nix
@@ -12,7 +12,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "herdr";
-  version = "0.7.4";
+  version = "0.7.5";

  __structuredAttrs = true;

@@ -20,16 +20,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "ogulcancelik";
    repo = "herdr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dBOQYLFitJ+E3XNz44Ag3CIrBxFj16CmVPp7qil0ssg=";
+    hash = "sha256-3BA8eredGku+vsL2Af7sUf43QiArR5XTHNrI+X11vFM=";
  };

-  cargoHash = "sha256-XHzZy2tKLbMQy4POmXowUcGf77ZPunG/oQ3P2wOoVls=";
+  cargoHash = "sha256-lWnc0Ka0hp7bbm+dkKKj22Dbk+Cwrld86romXs3lzBs=";

  zigDeps = zig_0_15.fetchDeps {
    inherit (finalAttrs) pname version;
    src = "${finalAttrs.src}/vendor/libghostty-vt";
    fetchAll = true;
-    hash = "sha256-pgGu8+NwvFcj6SrN4VaTHLeHdA7QY731ctyrHZwgFAc=";
+    hash = "sha256-PnM+hZIlLyQwK8vJgd/Bhjt1lNIz06T8FahwliRmMrY=";
  };

  nativeBuildInputs = [
@@ -77,7 +77,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://herdr.dev";
    changelog = "https://github.com/ogulcancelik/herdr/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.agpl3Plus;
-    maintainers = with lib.maintainers; [ kevinpita ];
+    maintainers = with lib.maintainers; [
+      kevinpita
+      faukah
+    ];
    mainProgram = "herdr";
    platforms = lib.platforms.unix;
  };
--- a/pkgs/by-name/hy/hyprmag/package.nix
+++ b/pkgs/by-name/hy/hyprmag/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  cmake,
+  pkg-config,
+  wayland-scanner,
+  cairo,
+  libGL,
+  libjpeg,
+  libxkbcommon,
+  pango,
+  wayland,
+  wayland-protocols,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "hyprmag";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "SIMULATAN";
+    repo = "hyprmag";
+    tag = finalAttrs.version;
+    hash = "sha256-IHYxQeCcPH2XoRyTgFEi+HVlWGVAnaTdS0Jf96H9PNU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    cairo
+    libGL
+    libjpeg
+    libxkbcommon
+    pango
+    wayland
+    wayland-protocols
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "wlroots-compatible Wayland screen magnifier, based on hyprpicker";
+    homepage = "https://github.com/SIMULATAN/hyprmag";
+    changelog = "https://github.com/SIMULATAN/hyprmag/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ samiser ];
+    mainProgram = "hyprmag";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/hy/hyprmagnifier/package.nix
+++ b/pkgs/by-name/hy/hyprmagnifier/package.nix
@@ -1,60 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  pkg-config,
-  wayland,
-  wayland-protocols,
-  wayland-scanner,
-  hyprwayland-scanner,
-  libxkbcommon,
-  pango,
-  libjpeg,
-  hyprutils,
-  nix-update-script,
-}:
-
-stdenv.mkDerivation {
-  pname = "hyprmagnifier";
-  version = "0.0.1-unstable-2025-05-16";
-
-  src = fetchFromGitHub {
-    owner = "st0rmbtw";
-    repo = "hyprmagnifier";
-    rev = "ce05ed35a1a7f9df976be7ee604d291ddad9c91c";
-    hash = "sha256-vsQnL3R7lPKsUlDQKXirWMj/3qI377g7PkKlN+eVDTI=";
-  };
-
-  strictDeps = true;
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    hyprwayland-scanner
-  ];
-
-  buildInputs = [
-    wayland
-    wayland-protocols
-    wayland-scanner
-    hyprwayland-scanner
-    libxkbcommon
-    pango
-    libjpeg
-    hyprutils
-  ];
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "wlroots-compatible Wayland magnifier that does not suck";
-    homepage = "https://github.com/st0rmbtw/hyprmagnifier";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [
-      matthewcroughan
-    ];
-    mainProgram = "hyprmagnifier";
-    platforms = lib.platforms.all;
-  };
-}
--- a/pkgs/by-name/i3/i3-rounded/package.nix
+++ b/pkgs/by-name/i3/i3-rounded/package.nix
@@ -2,21 +2,24 @@
  fetchFromGitHub,
  lib,
  i3,
-  pcre,
+  pcre2,
 }:

+let
+  version = "4.21.1";
+in
 i3.overrideAttrs (oldAttrs: {
  pname = "i3-rounded";
-  version = "4.21.1";
+  inherit version;

  src = fetchFromGitHub {
    owner = "LinoBigatti";
    repo = "i3-rounded";
-    rev = "524c9f7b50f8c540b2ae3480b242c30d8775f98e";
-    hash = "sha256-lceeP+WZtBLNSDqcNn18MROLtBwj+nXufDs55IMO9Xg=";
+    rev = "v${version}";
+    hash = "sha256-KMpejS89Hg6Mrm94HTNA9mV/6Leu1yo2W1CsD6vGDRo=";
  };

-  buildInputs = oldAttrs.buildInputs ++ [ pcre ];
+  buildInputs = oldAttrs.buildInputs ++ [ pcre2 ];

  # Some tests are failing.
  doCheck = false;
--- a/pkgs/by-name/io/io/package.nix
+++ b/pkgs/by-name/io/io/package.nix
@@ -21,7 +21,6 @@
  libxml2,
  libglut,
  libsamplerate,
-  pcre,
  libevent,
  libedit,
  yajl,
@@ -81,7 +80,6 @@ stdenv.mkDerivation {
    libxml2
    libglut
    libsamplerate
-    pcre
    libevent
    libedit
    yajl
--- a/pkgs/by-name/ji/jiratui/package.nix
+++ b/pkgs/by-name/ji/jiratui/package.nix
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "jiratui";
-  version = "1.3.0";
+  version = "1.10.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "whyisdifficult";
    repo = "jiratui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-b5bSMPnqHqpeFDl501gSun7G38OlhV/IMNMYXQT+j/4=";
+    hash = "sha256-yXVc3evYK3lbiLwn09M++lZfbb5F9bXSR5ge6Pfgs6w=";
  };

  postPatch = ''
@@ -32,19 +32,28 @@ python3Packages.buildPythonApplication (finalAttrs: {
      click
      gitpython
      httpx
-      pyaml
+      marklas
+      puremagic
      pydantic-settings
      python-dateutil
      python-json-logger
-      python-magic
+      pyyaml
      textual
+      textual-autocomplete
      textual-image
+      urllib3
      xdg-base-dirs
    ]
    ++ textual.optional-dependencies.syntax;

  pythonRelaxDeps = [
    "click"
+    "marklas"
+    # upstream wants puremagic >= 2.2.0 but only uses puremagic.magic_string,
+    # which is compatible with 1.x; drop once puremagic >= 2.2.0 lands
+    "puremagic"
+    "pydantic-settings"
+    "python-json-logger"
  ];

  pythonImportsCheck = [
--- a/pkgs/by-name/kc/kcl/package.nix
+++ b/pkgs/by-name/kc/kcl/package.nix
@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "kcl";
-  version = "0.12.4";
+  version = "0.12.7";

  src = fetchFromGitHub {
    owner = "kcl-lang";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-jtAfFwgtIP2sJRH4RcGTgVn/S5yvA15q3u2xeWus/8s=";
+    hash = "sha256-HPydO/gBJkMsqR3Eb3ymKprm5x7tr9//IKT052hiDNA=";
  };

-  vendorHash = "sha256-aKXfVDu3uTEeSzs4nVWQMUj+HaVkzk+iTr+lti+Yb6E=";
+  vendorHash = "sha256-46qLRdB0epfZPuvNVYaLIAiTkI9kbAS6OM9OYC8cmmE=";

  subPackages = [ "cmd/kcl" ];

--- a/pkgs/by-name/ke/kermit-terminal/package.nix
+++ b/pkgs/by-name/ke/kermit-terminal/package.nix
@@ -4,7 +4,6 @@
  fetchFromGitHub,
  cmake,
  gtk3,
-  pcre,
  pkg-config,
  vte,
  nixosTests,
@@ -33,7 +32,6 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    gtk3
-    pcre
    vte
  ];

--- a/pkgs/by-name/kp/kphotoalbum/package.nix
+++ b/pkgs/by-name/kp/kphotoalbum/package.nix
@@ -2,6 +2,7 @@
  stdenv,
  fetchurl,
  lib,
+  cmake,
  exiv2,
  ffmpeg,
  libvlc,
@@ -26,6 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  nativeBuildInputs = [
+    cmake
    kdePackages.extra-cmake-modules
    kdePackages.wrapQtAppsHook
  ];
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libdeltachat";
-  version = "2.55.0";
+  version = "2.56.0";

  src = fetchFromGitHub {
    owner = "chatmail";
    repo = "core";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Iy0VeWfD0GXdQiGZbn95p9SJ4MUSYBwsYLnI5NvgUl4=";
+    hash = "sha256-qdkCv3MooW2tieg6ivJHjh7uTVzWcwDM3aV5u2rIqOw=";
  };

  patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
  cargoDeps = rustPlatform.fetchCargoVendor {
    pname = "chatmail-core";
    inherit (finalAttrs) version src;
-    hash = "sha256-BfvLWldH4gbnB/ehywB40Ho1IZB/Kv5szmtMTVRsvqk=";
+    hash = "sha256-tETJAlwRmKgC1BRFtqQe2PNqpsGKaYeAfKA4kFog5+8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/libgaminggear/package.nix
+++ b/pkgs/by-name/li/libgaminggear/package.nix
@@ -9,7 +9,6 @@
  gtk2,
  libcanberra,
  libnotify,
-  pcre,
  sqlite,
  libxdmcp,
  libpthread-stubs,
@@ -48,7 +47,6 @@ stdenv.mkDerivation (finalAttrs: {
    gtk2
    libcanberra
    libnotify
-    pcre
    sqlite
    libxdmcp
    libpthread-stubs
--- a/pkgs/by-name/li/libghostty-vt/deps.nix
+++ b/pkgs/by-name/li/libghostty-vt/deps.nix
@@ -192,11 +192,11 @@ linkFarm name [
    };
  }
  {
-    name = "N-V-__8AAL6FAwBDPampKgDjoxlJYDIn2jv0VaINS4W6CXJN";
+    name = "N-V-__8AALZGBAAS5NLVH-c8eC-6VtCdcH-9nUvVfUSkWS__";
    path = fetchZigArtifact {
      name = "iterm2_themes";
-      url = "https://deps.files.ghostty.org/ghostty-themes-release-20260323-152405-a2c7b60.tgz";
-      hash = "sha256-fWgXdUXh2/dNZqERzEu9hz4xyy4nl+GUjLMpUMrsRnA=";
+      url = "https://deps.files.ghostty.org/ghostty-themes-release-20260713-155359-c3968b3.tgz";
+      hash = "sha256-FLMES+9no8uDUjlzvRbTqg+wCW3dHg7Lo5FtFNbWfyA=";
      unpack = false;
    };
  }
--- a/pkgs/by-name/li/libghostty-vt/package.nix
+++ b/pkgs/by-name/li/libghostty-vt/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "libghostty-vt";
-  version = "0.1.0-unstable-2026-05-03";
+  version = "0.1.0-unstable-2026-07-20";

  src = fetchFromGitHub {
    owner = "ghostty-org";
    repo = "ghostty";
-    rev = "1547dd667ab6d1f4ebcdc7282adc54c95752ee67";
-    hash = "sha256-dZFc+8az7BUIs8+v45XqNnY5G6oXEwVfVVHZQuATSGQ=";
+    rev = "88b4cd047fa627cdca6781bc7e7dc8b75a2cecb9";
+    hash = "sha256-298x90knBUWX5GHGXh2SKsAKvStjU2ri9UgOGoF79/8=";
  };

  # Zig's build runner computes relative paths from `cwd` to the build directory.
--- a/pkgs/by-name/li/libsidplayfp/package.nix
+++ b/pkgs/by-name/li/libsidplayfp/package.nix
@@ -106,7 +106,6 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/libsidplayfp/libsidplayfp/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [
-      ramkromberg
      OPNA2608
    ];
    platforms = lib.platforms.all;
--- a/pkgs/by-name/li/libssc/package.nix
+++ b/pkgs/by-name/li/libssc/package.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libssc";
-  version = "0.2.2";
+  version = "0.4.4";

  src = fetchFromCodeberg {
    owner = "DylanVanAssche";
    repo = "libssc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vc3phLAURKXAVD/o4uiGkBtJ3wsbLEfkwygMltEhqug=";
+    hash = "sha256-C9A0NtkGztSJQIkv4diGAPhZMUiIUszRNYif2yZL8nI=";
  };

  buildInputs = [
--- a/pkgs/by-name/li/lightdm-enso-os-greeter/fix-paths.patch
+++ b/pkgs/by-name/li/lightdm-enso-os-greeter/fix-paths.patch
@@ -1,33 +0,0 @@
-diff --git a/greeter/CMakeLists.txt b/greeter/CMakeLists.txt
-index 57aebb0..11c4ca7 100644
--- a/greeter/CMakeLists.txt
-+++ b/greeter/CMakeLists.txt
-@@ -1,6 +1,6 @@
- project (greeter)
-cmake_minimum_required (VERSION 2.8)
-cmake_policy (VERSION 2.8)
-+cmake_minimum_required (VERSION 3.10)
-+cmake_policy (VERSION 3.10)
- 
- enable_testing ()
- 
-@@ -9,7 +9,6 @@ list (APPEND CMAKE_MODULE_PATH ${CMAKE_SOURCE_DIR}/cmake)
- set (CONF_DIR "/etc/lightdm")
- set (DATADIR "${CMAKE_INSTALL_PREFIX}/share")
- set (PKGDATADIR "${DATADIR}/enso/greeter")
-set (CMAKE_INSTALL_PREFIX /usr)
- set (VERSION "1.0.6")
- 
- 
-@@ -94,9 +93,9 @@ glib_compile_resources (GLIB_RESOURCES_CSS SOURCE data/css.gresource.xml)
- add_executable (pantheon-greeter ${VALA_C} ${GLIB_RESOURCES_CSS})
- target_link_libraries(pantheon-greeter m)
- 
-install (TARGETS pantheon-greeter RUNTIME DESTINATION sbin)
-+install (TARGETS pantheon-greeter RUNTIME DESTINATION bin)
- install (FILES ${CMAKE_CURRENT_SOURCE_DIR}/data/pantheon-greeter.desktop DESTINATION share/xgreeters)
-install (FILES ${CMAKE_CURRENT_SOURCE_DIR}/data/greeter.conf DESTINATION ${CONF_DIR})
-+install (FILES ${CMAKE_CURRENT_SOURCE_DIR}/data/greeter.conf DESTINATION etc/lightdm)
- install (FILES ${CMAKE_CURRENT_SOURCE_DIR}/data/fingerprint.svg DESTINATION ${PKGDATADIR})
- install (FILES ${CMAKE_CURRENT_SOURCE_DIR}/data/power.svg DESTINATION ${PKGDATADIR})
- install (FILES ${CMAKE_CURRENT_SOURCE_DIR}/data/checked.svg DESTINATION ${PKGDATADIR})
--- a/pkgs/by-name/li/lightdm-enso-os-greeter/package.nix
+++ b/pkgs/by-name/li/lightdm-enso-os-greeter/package.nix
@@ -1,97 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pkg-config,
-  linkFarm,
-  lightdm-enso-os-greeter,
-  dbus,
-  pcre,
-  libepoxy,
-  libxdmcp,
-  libx11,
-  libpthread-stubs,
-  at-spi2-core,
-  libxklavier,
-  libxkbcommon,
-  gtk3,
-  vala,
-  cmake,
-  libgee,
-  lightdm,
-  gdk-pixbuf,
-  clutter-gtk,
-  wrapGAppsHook3,
-  librsvg,
-}:
-
-stdenv.mkDerivation {
-  pname = "lightdm-enso-os-greeter";
-  version = "0.2.1";
-
-  src = fetchFromGitHub {
-    owner = "nick92";
-    repo = "Enso-OS";
-    rev = "ed48330bfd986072bd82ac542ed8f8a7365c6427";
-    sha256 = "sha256-v79J5KyjeJ99ifN7nK/B+J7f292qDAEHsmsHLAMKVYY=";
-  };
-
-  patches = [
-    ./fix-paths.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    vala
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    dbus
-    gtk3
-    pcre
-    libepoxy
-    libgee
-    libx11
-    lightdm
-    libxdmcp
-    gdk-pixbuf
-    clutter-gtk
-    libxklavier
-    at-spi2-core
-    libxkbcommon
-    libpthread-stubs
-    librsvg
-  ];
-
-  preConfigure = ''
-    cd greeter
-  '';
-
-  passthru.xgreeters = linkFarm "enso-os-greeter-xgreeters" [
-    {
-      path = "${lightdm-enso-os-greeter}/share/xgreeters/pantheon-greeter.desktop";
-      name = "pantheon-greeter.desktop";
-    }
-  ];
-
-  postFixup = ''
-    substituteInPlace $out/share/xgreeters/pantheon-greeter.desktop \
-      --replace "pantheon-greeter" "$out/bin/pantheon-greeter"
-  '';
-
-  meta = {
-    description = ''
-      A fork of pantheon greeter that positions elements in a central and
-      vertigal manner and adds a blur effect to the background
-    '';
-    mainProgram = "pantheon-greeter";
-    homepage = "https://github.com/nick92/Enso-OS";
-    platforms = lib.platforms.linux;
-    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [
-      eadwu
-    ];
-  };
-}
--- a/pkgs/by-name/li/listmonk/package.nix
+++ b/pkgs/by-name/li/listmonk/package.nix
@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
    owner = "knadh";
    repo = "listmonk";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-eora/+zJf60trmANEqAhYAQXfEMifyw5gLPKcqBW46w=";
+    hash = "sha256-yLOs1vhTV/0zzq/2Rk5rJ3/1z+kE5xaYODM5NO06F6U=";
  };

  vendorHash = "sha256-t4l8872bniTmNIW4ias1gImURJgrR6htXkncqfrJ+AU=";
--- a/pkgs/by-name/ma/mailspring/bump-yauzl.patch
+++ b/pkgs/by-name/ma/mailspring/bump-yauzl.patch
@@ -1,217 +0,0 @@
-diff --git a/app/package-lock.json b/app/package-lock.json
-index 9b5b874..bc446b7 100644
--- a/app/package-lock.json
-+++ b/app/package-lock.json
-@@ -570,16 +570,6 @@
-         "ieee754": "^1.1.13"
-       }
-     },
-    "node_modules/buffer-crc32": {
-      "version": "0.2.13",
-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
-      "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": "*"
-      }
-    },
-     "node_modules/buffer-from": {
-       "version": "1.1.2",
-       "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-@@ -1581,16 +1571,6 @@
-       "license": "MIT",
-       "peer": true
-     },
-    "node_modules/fd-slicer": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
-      "integrity": "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "pend": "~1.2.0"
-      }
-    },
-     "node_modules/file-uri-to-path": {
-       "version": "1.0.0",
-       "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
-@@ -4575,14 +4555,16 @@
-       }
-     },
-     "node_modules/yauzl": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
-      "integrity": "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==",
-+      "version": "3.4.0",
-+      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz",
-+      "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==",
-       "license": "MIT",
-       "peer": true,
-       "dependencies": {
-        "buffer-crc32": "~0.2.3",
-        "fd-slicer": "~1.1.0"
-+        "pend": "~1.2.0"
-+      },
-+      "engines": {
-+        "node": ">=12"
-       }
-     }
-   }
-diff --git a/app/package.json b/app/package.json
-index 115cf61..436527d 100644
--- a/app/package.json
-+++ b/app/package.json
-@@ -77,7 +77,9 @@
-     "@types/react": "^17.0.0",
-     "@types/react-dom": "^17.0.0"
-   },
-  "overrides": {},
-+  "overrides": {
-+    "yauzl": "^3.3.1"
-+  },
-   "optionalDependencies": {
-     "windows-focus-assist": "^1.4.0"
-   }
-diff --git a/package-lock.json b/package-lock.json
-index fdc0d9d..31a4b5f 100644
--- a/package-lock.json
-+++ b/package-lock.json
-@@ -1893,14 +1893,6 @@
-       "integrity": "sha512-TEM2iMIEQdJ2yjPJoSIsldnleVaAk1oW3DBVUykyOLsEsFmEc9kn+SFFPz+gl54KQNxlDnAwCXosOS9Okx2xAg==",
-       "license": "MIT"
-     },
-    "node_modules/buffer-crc32": {
-      "version": "0.2.13",
-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
-      "integrity": "sha1-DTM+PwDqxQqhRUq9MO+MKl2ackI=",
-      "engines": {
-        "node": "*"
-      }
-    },
-     "node_modules/buffer-fill": {
-       "version": "1.0.0",
-       "resolved": "https://registry.npmjs.org/buffer-fill/-/buffer-fill-1.0.0.tgz",
-@@ -3446,14 +3438,6 @@
-         "reusify": "^1.0.4"
-       }
-     },
-    "node_modules/fd-slicer": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
-      "integrity": "sha1-JcfInLH5B3+IkbvmHY85Dq4lbx4=",
-      "dependencies": {
-        "pend": "~1.2.0"
-      }
-    },
-     "node_modules/file-entry-cache": {
-       "version": "6.0.1",
-       "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
-@@ -5582,7 +5566,8 @@
-     "node_modules/pend": {
-       "version": "1.2.0",
-       "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
-      "integrity": "sha1-elfrVQpng/kRUzH89GY9XI4AelA="
-+      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==",
-+      "license": "MIT"
-     },
-     "node_modules/picomatch": {
-       "version": "2.3.2",
-@@ -7403,12 +7388,15 @@
-       }
-     },
-     "node_modules/yauzl": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
-      "integrity": "sha1-x+sXyT4RLLEIb6bY5R+wZnt5pfk=",
-+      "version": "3.4.0",
-+      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz",
-+      "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==",
-+      "license": "MIT",
-       "dependencies": {
-        "buffer-crc32": "~0.2.3",
-        "fd-slicer": "~1.1.0"
-+        "pend": "~1.2.0"
-+      },
-+      "engines": {
-+        "node": ">=12"
-       }
-     },
-     "node_modules/yocto-queue": {
-@@ -8663,11 +8651,6 @@
-       "resolved": "https://registry.npmjs.org/buffer-alloc-unsafe/-/buffer-alloc-unsafe-1.1.0.tgz",
-       "integrity": "sha512-TEM2iMIEQdJ2yjPJoSIsldnleVaAk1oW3DBVUykyOLsEsFmEc9kn+SFFPz+gl54KQNxlDnAwCXosOS9Okx2xAg=="
-     },
-    "buffer-crc32": {
-      "version": "0.2.13",
-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
-      "integrity": "sha1-DTM+PwDqxQqhRUq9MO+MKl2ackI="
-    },
-     "buffer-fill": {
-       "version": "1.0.0",
-       "resolved": "https://registry.npmjs.org/buffer-fill/-/buffer-fill-1.0.0.tgz",
-@@ -9692,7 +9675,7 @@
-         "@types/yauzl": "^2.9.1",
-         "debug": "^4.1.1",
-         "get-stream": "^5.1.0",
-        "yauzl": "^2.10.0"
-+        "yauzl": "^3.3.1"
-       },
-       "dependencies": {
-         "get-stream": {
-@@ -9745,14 +9728,6 @@
-         "reusify": "^1.0.4"
-       }
-     },
-    "fd-slicer": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
-      "integrity": "sha1-JcfInLH5B3+IkbvmHY85Dq4lbx4=",
-      "requires": {
-        "pend": "~1.2.0"
-      }
-    },
-     "file-entry-cache": {
-       "version": "6.0.1",
-       "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
-@@ -11158,7 +11133,7 @@
-     "pend": {
-       "version": "1.2.0",
-       "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
-      "integrity": "sha1-elfrVQpng/kRUzH89GY9XI4AelA="
-+      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg=="
-     },
-     "picomatch": {
-       "version": "2.3.2",
-@@ -12389,12 +12364,11 @@
-       "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw=="
-     },
-     "yauzl": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
-      "integrity": "sha1-x+sXyT4RLLEIb6bY5R+wZnt5pfk=",
-+      "version": "3.4.0",
-+      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz",
-+      "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==",
-       "requires": {
-        "buffer-crc32": "~0.2.3",
-        "fd-slicer": "~1.1.0"
-+        "pend": "~1.2.0"
-       }
-     },
-     "yocto-queue": {
-diff --git a/package.json b/package.json
-index 58a4e93..f065078 100644
--- a/package.json
-+++ b/package.json
-@@ -82,5 +82,8 @@
-     "test:e2e": "npx playwright test --config playwright/playwright.config.ts",
-     "tsc-watch": "tsc -w -p ./app --noEmit",
-     "build": "node app/build/build.js"
-+  },
-+  "overrides": {
-+    "yauzl": "^3.3.1"
-   }
-}
-\ No newline at end of file
-+}
--- a/pkgs/by-name/ma/mailspring/package.nix
+++ b/pkgs/by-name/ma/mailspring/package.nix
@@ -5,6 +5,7 @@
  callPackage,
  fetchFromGitHub,

+  actool,
  makeBinaryWrapper,
  pkg-config,
  wrapGAppsHook3,
@@ -17,19 +18,17 @@
  commandLineArgs ? "",
 }:
 let
-  version = "1.22.0";
+  version = "1.23.0";

  src = fetchFromGitHub {
    owner = "Foundry376";
    repo = "Mailspring";
    tag = version;
-    hash = "sha256-32d0WIWqCsZlvuT+RDa3EYxkwTxWzQyLIfASiDfZnL8=";
+    hash = "sha256-GbY3lov3MT8c8LehEifzOH28VAYpBWDbwXrqEfFfwJg=";
    fetchSubmodules = true;
  };

  patches = [
-    # zip extraction fails on newer nodejs versions without this fix
-    ./bump-yauzl.patch
    ./remove-rpm-deb-and-macos-package-generation.patch
  ];

@@ -41,7 +40,7 @@ let
    pname = "mailspring-app";
    inherit version src patches;
    postPatch = "cd app"; # we don't use sourceRoot so that we don't have to make the patch relative to it
-    npmDepsHash = "sha256-/caWmbN4Sl3DVPLXSaXrCHEyRsk/p3FwDqSZ7lfNgUk=";
+    npmDepsHash = "sha256-JkjtC4WT3cBsVlmrfO5WAxU1Xe3vXbxuNBDs2Q7fEck=";
    dontNpmBuild = true;
    env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

@@ -67,13 +66,16 @@ buildNpmPackage (finalAttrs: {
  pname = "mailspring";
  inherit version src patches;

-  npmDepsHash = "sha256-nHKFuTdk3qbAiSHksSo++mc8TMasspuym7MYxjuTTHI=";
+  npmDepsHash = "sha256-0cg/DT0MUbfzTq5hejH7auSk77M9Md7FWzidov8iyA4=";

  nativeBuildInputs = [
    makeBinaryWrapper
    pkg-config
    wrapGAppsHook3
    zip
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    actool
  ];

  npmFlags = [ "--ignore-scripts" ];
@@ -133,7 +135,7 @@ buildNpmPackage (finalAttrs: {
      cp -r app/dist/*/resources $out/share/mailspring

      install -Dm444 app/dist/Mailspring.desktop $out/share/applications/Mailspring.desktop
-      install -Dm444 app/dist/mailspring.appdata.xml $out/share/metainfo/mailspring.appdata.xml
+      install -Dm444 app/dist/mailspring.metainfo.xml $out/share/metainfo/mailspring.metainfo.xml

      for size in 16 32 64 128 256 512; do
        install -Dm444 app/build/resources/linux/icons/$size.png \
--- a/pkgs/by-name/ma/mailspring/remove-rpm-deb-and-macos-package-generation.patch
+++ b/pkgs/by-name/ma/mailspring/remove-rpm-deb-and-macos-package-generation.patch
@@ -1,6 +1,6 @@
-From 420f1f58734dbc7305f46b4d8089b461b79321b0 Mon Sep 17 00:00:00 2001
+From e1210102ab3f7bff24d9dfa38ad87b3fe04d0f5e Mon Sep 17 00:00:00 2001
 From: wrench-exile-legacy <user@wrench-exile-legacy.site>
-Date: Mon, 6 Jul 2026 22:40:30 +0100
+Date: Wed, 22 Jul 2026 10:38:53 +0100
 Subject: [PATCH] remove rpm, deb and macos package generation

 ---
@@ -8,10 +8,10 @@ Subject: [PATCH] remove rpm, deb and macos package generation
 1 file changed, 17 deletions(-)

 diff --git a/app/build/build.js b/app/build/build.js
-index 6d90aa5b2..ffec9cf8b 100644
+index 2e90d5624..d07244d75 100644
 --- a/app/build/build.js
 +++ b/app/build/build.js
-@@ -373,12 +373,6 @@ async function createMacZip() {
+@@ -365,12 +365,6 @@ async function createMacZip() {
   }
   const arch = process.env.OVERRIDE_TO_INTEL ? 'x64' : process.arch;
   const cwd = path.join(outputDir, `Mailspring-darwin-${arch}`);
@@ -24,8 +24,8 @@ index 6d90aa5b2..ffec9cf8b 100644
 }
 
 function writeFromTemplate(filePath, data) {
-@@ -422,11 +416,6 @@ async function createDebInstaller() {
-   writeFromTemplate(path.join(linuxAssetsDir, 'mailspring.appdata.xml.in'), data);
+@@ -415,11 +409,6 @@ async function createDebInstaller() {
+   writeFromTemplate(path.join(linuxAssetsDir, 'mailspring.metainfo.xml.in'), data);
 
   const icon = path.join(appDir, 'build', 'resources', 'linux', 'icons', '512.png');
 -  await spawn({
@@ -36,10 +36,10 @@ index 6d90aa5b2..ffec9cf8b 100644
 }
 
 async function createRpmInstaller() {
-@@ -452,12 +441,6 @@ async function createRpmInstaller() {
+@@ -446,12 +435,6 @@ async function createRpmInstaller() {
   writeFromTemplate(path.join(linuxAssetsDir, 'redhat', 'mailspring.spec.in'), templateData);
   writeFromTemplate(path.join(linuxAssetsDir, 'Mailspring.desktop.in'), templateData);
-   writeFromTemplate(path.join(linuxAssetsDir, 'mailspring.appdata.xml.in'), templateData);
+   writeFromTemplate(path.join(linuxAssetsDir, 'mailspring.metainfo.xml.in'), templateData);
 -
 -  await spawn({
 -    cmd: path.join(appDir, 'script', 'mkrpm'),
--- a/pkgs/by-name/n8/n8n-nodes-evolution-api/package.nix
+++ b/pkgs/by-name/n8/n8n-nodes-evolution-api/package.nix
@@ -4,7 +4,7 @@
  fetchFromGitHub,
  fetchPnpmDeps,
  nodejs,
-  pnpm_9,
+  pnpm_10,
  pnpmConfigHook,
  nix-update-script,
  n8n,
@@ -24,14 +24,14 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    nodejs
    pnpmConfigHook
-    pnpm_9
+    pnpm_10
  ];

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-hMjWFjDhc61HGkQOG/q2EU8pPShUhtHSTe+6wUAa5M4=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-jAHeQHUPUzC4NiKl/h7i8UwStyzw2tCKs42ZkeGZVSw=";
  };

  buildPhase = ''
--- a/pkgs/by-name/ne/netproc/package.nix
+++ b/pkgs/by-name/ne/netproc/package.nix
@@ -3,23 +3,26 @@
  stdenv,
  fetchFromGitHub,
  ncurses,
+  nix-update-script,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "netproc";
-  version = "0.6.6";
+  version = "0.6.7";

  src = fetchFromGitHub {
    owner = "berghetti";
    repo = "netproc";
    rev = finalAttrs.version;
-    hash = "sha256-OQWlFwCga33rTseLeO8rAd+pkLHbSNf3YI5OSwrdIyk=";
+    hash = "sha256-EqCyh0WNz7B2B1SFgFQT2MFk8+OVPsy5n3EFt64HJ+E=";
  };

  buildInputs = [ ncurses ];

  installFlags = [ "prefix=$(out)" ];

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Tool to monitor network traffic based on processes";
    homepage = "https://github.com/berghetti/netproc";
--- a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
+++ b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
@@ -32,11 +32,11 @@
 }:
 let
  pname = "nextcloud-talk-desktop";
-  version = "2.1.1"; # Ensure both hashes (Linux and Darwin) are updated!
+  version = "2.2.1"; # Ensure both hashes (Linux and Darwin) are updated!

  hashes = {
-    linux = "sha256-s6+p21KLoDvcQz0EgV7WYIwYc9JolZpqkxZ8iIol8Yg=";
-    darwin = "sha256-rp6+bYb3Y8yEXYUY+cuDo7Lw6cq/EUnPjLIqscKeULc=";
+    linux = "sha256-AhNHPejdnGmL55/mHGKkDaGWl2fm7uufX4JaB5VSBos=";
+    darwin = "sha256-TkLAydkedLbi6vqd3kvQNkVnXGSHfF6xTBF3PCOgJ6I=";
  };

  # Only x86_64-linux is supported with Darwin support being universal
@@ -62,7 +62,7 @@ let
  meta = {
    description = "Nextcloud Talk Desktop Client";
    homepage = "https://github.com/nextcloud/talk-desktop";
-    changelog = "https://github.com/nextcloud/talk-desktop/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/nextcloud/talk-desktop/blob/v${version}/CHANGELOG.md";
    license = lib.licenses.agpl3Only;
    maintainers = with lib.maintainers; [ kashw2 ];
    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
--- a/pkgs/by-name/ni/nix-unit/package.nix
+++ b/pkgs/by-name/ni/nix-unit/package.nix
@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "nix-unit";
-  version = "2.35.0";
+  version = "2.35.1";

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "nix-unit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-eXyZw2ddCKT5xMY8SDnV6lkr61zvSc7CNJeJSAjKqN4=";
+    hash = "sha256-jZ6YOb5L7FShPUcq63qDKT3W83mVzAaM2y1V4CLcdq8=";
  };

  buildInputs = [
--- a/pkgs/by-name/nu/nu-lint/package.nix
+++ b/pkgs/by-name/nu/nu-lint/package.nix
@@ -8,13 +8,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nu-lint";
-  version = "1.2.1";
+  version = "1.3.0";

  src = fetchFromCodeberg {
    owner = "wvhulle";
    repo = "nu-lint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5YR1Cn9/psNswLVYtDZGmvoP9AwBANa0sPHN4eqcRhQ=";
+    hash = "sha256-QkOJFjqZtAo4GqZ/khbx0MZQDB0Hh8S3H9r4ln5AxqM=";
  };

  cargoHash = "sha256-FA9C7Li4wtXvI8+jDTmdFjqsop6cvGNPByRpOfvQPzw=";
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -16,7 +16,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "opencode";
-  version = "1.18.3";
+  version = "1.18.4";

  __structuredAttrs = true;
  strictDeps = true;
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "anomalyco";
    repo = "opencode";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Wdkzms59oHw3M/Em2RH7BPhZME8AtLmtNFSnsUxO1V4=";
+    hash = "sha256-tGMO5JktINO8kXAHFQftn+JCrzwvpmNipTa8V0aIfNI=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@@ -78,7 +78,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    # NOTE: Required else we get errors that our fixed-output derivation references store paths
    dontFixup = true;

-    outputHash = "sha256-1NUtprMH8GnSUqQ+mHQSC+JLU7lwzHe6XXYHe129WmE=";
+    outputHash = "sha256-jMZSDlqNObSmWJZ0Xn0IwfYC2+mBbRYorfgD5Y2sHWs=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
--- a/pkgs/by-name/ov/overlayed/package.nix
+++ b/pkgs/by-name/ov/overlayed/package.nix
@@ -8,7 +8,7 @@
  moreutils,
  nodejs,
  pkg-config,
-  pnpm_9,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,

@@ -35,9 +35,9 @@ rustPlatform.buildRustPackage (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-KJZuucXB7BEMnqPmgytveG/IBEzq4mgMo9ZJHPe/gVs=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-DkVV5Dz5UV/xMuteSXWgSko3e8t8u1Saq1X1UxaaZFA=";
  };

  nativeBuildInputs = [
@@ -47,7 +47,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    nodejs
    pkg-config
    pnpmConfigHook
-    pnpm_9
+    pnpm_10
  ];

  buildInputs = [
--- a/pkgs/by-name/pa/parca/package.nix
+++ b/pkgs/by-name/pa/parca/package.nix
@@ -4,7 +4,7 @@
  fetchFromGitHub,
  lib,
  nodejs,
-  pnpm_9,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  stdenv,
@@ -26,16 +26,16 @@ let

    pnpmDeps = fetchPnpmDeps {
      inherit (finalAttrs) pname src version;
-      pnpm = pnpm_9;
-      fetcherVersion = 3;
-      hash = "sha256-zHdMwJyeafzbIlp+Fhh1khcUVrLsoUg6ViSGm/ByGAA=";
+      pnpm = pnpm_10;
+      fetcherVersion = 4;
+      hash = "sha256-cd9sA01DTXsrKm4enFeS3zmn3w4A5N7QXhtZ0wcpNss=";
    };

    nativeBuildInputs = [
      faketty
      nodejs
      pnpmConfigHook
-      pnpm_9
+      pnpm_10
    ];

    # faketty is required to work around a bug in nx.
--- a/pkgs/by-name/pa/parca/update.sh
+++ b/pkgs/by-name/pa/parca/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl jq git pnpm_9
+#!nix-shell -I nixpkgs=./. -i bash -p curl jq git pnpm_10
 # shellcheck shell=bash
 set -euo pipefail
 nixpkgs="$(pwd)"
--- a/pkgs/by-name/pe/peertube/package.nix
+++ b/pkgs/by-name/pe/peertube/package.nix
@@ -21,7 +21,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "peertube";
-  version = "8.2.2";
+  version = "8.2.3";

  __structuredAttrs = true;
  strictDeps = true;
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "Chocobozzz";
    repo = "PeerTube";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-huyuaCWJ3w1KHCcQFjH2ZcofPjqwjLpLt+dg6auD/dQ=";
+    hash = "sha256-w+mSFr+uobq1TtqfewRmakGMYlEjwLs0k39mWHMbq+Q=";
  };

  outputs = [
@@ -170,6 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    license = lib.licenses.agpl3Plus;
    homepage = "https://joinpeertube.org/";
+    changelog = "https://github.com/Chocobozzz/PeerTube/blob/${finalAttrs.src.rev}/CHANGELOG.md";
    platforms = [
      "x86_64-linux"
      "aarch64-linux"
--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -2,6 +2,7 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
+  fetchurl,
  nix-update-script,
  versionCheckHook,
  writableTmpDirAsHomeHook,
@@ -12,16 +13,34 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "pi-coding-agent";
-  version = "0.80.10";
+  version = "0.81.1";

  src = fetchFromGitHub {
    owner = "earendil-works";
    repo = "pi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Vs/ndHYzFyfN4CjPV2zMYblLXe9IuM13UrPJI1VsZEQ=";
+    hash = "sha256-xo3uoR7HceOCL3wqoMcacOe8WXP1o7ReAXne5t6Hgao=";
  };

-  npmDepsHash = "sha256-XGvDNH+eilsgc0Z7ITqbitB/9RVc+WuDfCcr1pibNqk=";
+  npmDepsHash = "sha256-lzKQZbnITzgV9koucsMno6f61ubBLYUcwQEXtak1r1s=";
+
+  # The provider model catalog (packages/ai/src/providers/data/) is generated by
+  # a network fetch (models.dev plus provider APIs) and is gitignored upstream,
+  # so it is absent from the source tarball. Restore it from the matching
+  # published @earendil-works/pi-ai npm package, which ships the hydrated catalog
+  # under dist/providers/data/. Bump this hash alongside version.
+  modelData = fetchurl {
+    url = "https://registry.npmjs.org/@earendil-works/pi-ai/-/pi-ai-${finalAttrs.version}.tgz";
+    hash = "sha256-x53MD5DU370ZdNoz36P+OWZjGVpoM5sfVcEU2/ckDy8=";
+  };
+
+  preConfigure = ''
+    mkdir -p packages/ai/src/providers/data
+    tar --extract --gzip --file=${finalAttrs.modelData} \
+      --directory=packages/ai/src/providers/data \
+      --strip-components=4 \
+      package/dist/providers/data
+  '';

  npmWorkspace = "packages/coding-agent";

@@ -34,8 +53,8 @@ buildNpmPackage (finalAttrs: {

  # Build workspace dependencies in order, then the coding-agent.
  # We invoke tsgo directly for workspace deps to skip pi-ai's
-  # generate-models script which requires network access
-  # (models.generated.ts is committed to the repo).
+  # generate-models script, which requires network access; the model
+  # catalog it would produce is supplied via modelData above.
  buildPhase = ''
    runHook preBuild

@@ -96,13 +115,18 @@ buildNpmPackage (finalAttrs: {
  versionCheckProgram = "${placeholder "out"}/bin/pi";
  versionCheckProgramArg = "--version";

-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--custom-dep"
+      "modelData"
+    ];
+  };

  meta = {
    description = "Coding agent CLI with read, bash, edit, write tools and session management";
    homepage = "https://pi.dev/";
    downloadPage = "https://www.npmjs.com/package/@earendil-works/pi-coding-agent";
-    changelog = "https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md";
+    changelog = "https://github.com/earendil-works/pi/blob/v${finalAttrs.version}/packages/coding-agent/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      munksgaard
--- a/pkgs/by-name/pr/proton-pass-cli/package.nix
+++ b/pkgs/by-name/pr/proton-pass-cli/package.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Command-line interface for managing your Proton Pass vaults, items, and secrets";
    homepage = "https://github.com/protonpass/pass-cli";
-    license = lib.licenses.unfree;
+    license = lib.licenses.gpl3Plus;
    mainProgram = "pass-cli";
    maintainers = with lib.maintainers; [ delafthi ];
    platforms = lib.attrNames finalAttrs.passthru.sources;
--- a/pkgs/by-name/rc/rcon/package.nix
+++ b/pkgs/by-name/rc/rcon/package.nix
@@ -7,7 +7,6 @@
  glib,
  libbsd,
  check,
-  pcre,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -30,7 +29,6 @@ stdenv.mkDerivation (finalAttrs: {
    glib
    libbsd
    check
-    pcre
  ];

  postPatch = ''
--- a/pkgs/by-name/re/reaper/package.nix
+++ b/pkgs/by-name/re/reaper/package.nix
@@ -13,7 +13,7 @@
  lame,
  libxml2_13,
  libjack2,
-  ffmpeg_4-headless,
+  ffmpeg-headless,
  vlc,
  xdg-utils,
  xdotool,
@@ -120,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
              curl
              lame
              libxml2_13
-              ffmpeg_4-headless
+              ffmpeg-headless
              vlc
              xdotool
              stdenv.cc.cc
--- a/pkgs/by-name/re/render-cli/package.nix
+++ b/pkgs/by-name/re/render-cli/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "render-cli";
-  version = "2.21.0";
+  version = "2.22.0";

  src = fetchFromGitHub {
    owner = "render-oss";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-f5Knj3yirUHjQ9+4wxJYRwrsSpvb1lvQbnxaRlHUC6s=";
+    hash = "sha256-xFzpyF4uUopjAYmCKe3lUKFo9xGXuJDpQi7+1fHsM68=";
  };

-  vendorHash = "sha256-ywUuD8ZtfPAtVcHOrEIuXBncqWENTb++Spc4cp2LUOM=";
+  vendorHash = "sha256-cQ7JZYJe/ZcrOXwCz3X9ySmLS78uJeGpf29Ope/OyF0=";

  # Tests require network access
  doCheck = false;
--- a/pkgs/by-name/ri/rizin/jsdec.nix
+++ b/pkgs/by-name/ri/rizin/jsdec.nix
@@ -10,7 +10,7 @@
 }:

 let
-  version = "0.8.0";
+  version = "0.9.0";

  libquickjs = fetchFromGitHub {
    owner = "quickjs-ng";
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "rizinorg";
    repo = "jsdec";
    rev = "v${version}";
-    hash = "sha256-Xc8FMKSGdjrp288u49R6YC0xiynwHeoZe2P/UqnfsFU=";
+    hash = "sha256-9FNsFPQf3GyREXsagWDHctfne28lct6dPH8vKvF8kpY=";
  };

  postUnpack = ''
--- a/pkgs/by-name/ri/rizin/package.nix
+++ b/pkgs/by-name/ri/rizin/package.nix
@@ -30,11 +30,11 @@
 let
  rizin = stdenv.mkDerivation rec {
    pname = "rizin";
-    version = "0.8.2";
+    version = "0.9.1";

    src = fetchurl {
      url = "https://github.com/rizinorg/rizin/releases/download/v${version}/rizin-src-v${version}.tar.xz";
-      hash = "sha256-FjDKUrroby/zfrIgaZ/IL5UbWxgIDt+j9Q3TalJsLZU=";
+      hash = "sha256-esHNfaynr92nQuFUeLH3R/wfgT5Jb+5xg50eEJ5UPco=";
    };

    mesonFlags = [
--- a/pkgs/by-name/ri/rizin/rz-ghidra.nix
+++ b/pkgs/by-name/ri/rizin/rz-ghidra.nix
@@ -11,17 +11,18 @@
  enableCutterPlugin ? true,
  cutter,
  qt6,
+  zlib,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "rz-ghidra";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "rizinorg";
    repo = "rz-ghidra";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-uI0EnuHAuyrXYKDijh5Tg/WcQ/5yyZnW3d5MMHZxnqA=";
+    hash = "sha256-R9wPmt2WoK4wlTXb0JUX+0Fk8JQgGagb8vZQmjxLXn8=";
    fetchSubmodules = true;
  };

@@ -30,6 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
    openssl
    pugixml
    rizin
+    zlib
  ]
  ++ lib.optionals enableCutterPlugin [
    cutter
--- a/pkgs/by-name/sa/sayonara/package.nix
+++ b/pkgs/by-name/sa/sayonara/package.nix
@@ -7,7 +7,6 @@
  lib,
  libpulseaudio,
  ninja,
-  pcre,
  pkg-config,
  taglib,
  zlib,
@@ -43,7 +42,6 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    libpulseaudio
-    pcre
    libsForQt5.qtbase
    taglib
    zlib
--- a/pkgs/by-name/sc/scalafmt/package.nix
+++ b/pkgs/by-name/sc/scalafmt/package.nix
@@ -9,7 +9,7 @@

 let
  baseName = "scalafmt";
-  version = "3.11.1";
+  version = "3.11.4";
  deps = stdenv.mkDerivation {
    name = "${baseName}-deps-${version}";
    buildCommand = ''
@@ -19,7 +19,7 @@ let
      cp $(< deps) $out/share/java/
    '';
    outputHashMode = "recursive";
-    outputHash = "sha256-EgkXDCbgn7OmH1e/us6lyNiei/qZMzFn/1Qh4LiraBo=";
+    outputHash = "sha256-CWgdxQH2DZ9Il2elQOLgC2+TzP6cIqmcCHUZcQuCSEg=";
  };
 in
 stdenv.mkDerivation {
--- a/pkgs/by-name/se/seamonkey/package.nix
+++ b/pkgs/by-name/se/seamonkey/package.nix
@@ -3,7 +3,6 @@
  stdenv,
  fetchurl,
  gtk3,
-  gtk2,
  gdk-pixbuf,
  dbus-glib,
  libx11,
@@ -44,7 +43,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    gtk2
    gtk3
    gdk-pixbuf
    dbus-glib
--- a/pkgs/by-name/se/secretspec/package.nix
+++ b/pkgs/by-name/se/secretspec/package.nix
@@ -9,14 +9,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "secretspec";
-  version = "0.14.0";
+  version = "0.16.0";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-PlI2+cQbP/CfilYX2fJnQv8yw4euxvqYT0XqlYsU0QI=";
+    hash = "sha256-YiKud3dfw6QmZbKVCY9FD5vrxJs9bE6++BvEeaDUiEs=";
  };

-  cargoHash = "sha256-UfeVqZaH04Ucu+FgXX2bqgqiHJNpN3OIN0lKhWFn1j0=";
+  cargoHash = "sha256-tXZ1KUjZWgddh8wD3oyeZWDe5XqdknyEQ0eu4LXPrf0=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ dbus ];
--- a/pkgs/by-name/sh/shelfmark/package.nix
+++ b/pkgs/by-name/sh/shelfmark/package.nix
@@ -37,13 +37,13 @@ let
    apprise
  ];

-  version = "1.3.3";
+  version = "1.3.4";

  src = fetchFromGitHub {
    owner = "calibrain";
    repo = "shelfmark";
    tag = "v${version}";
-    hash = "sha256-uRuSFWjEnJp3cMx4IeM9akpj+l/36/jgIRavoan9iAU=";
+    hash = "sha256-Pf+CdZZdIJVcJaUD43hZL6qRsY9oFmroTdN0it5BxfM=";
  };

  frontend = buildNpmPackage (finalAttrs: {
@@ -52,7 +52,7 @@ let

    sourceRoot = "${finalAttrs.src.name}/src/frontend";

-    npmDepsHash = "sha256-oqEUiHOHx78+plHUnsOtdv0S3ZhaHr0CAb7kA0VbG/k=";
+    npmDepsHash = "sha256-e2iF6YNV11/l4BmnNrB6OGj8PGv+mrQk3wynm/NAUvU=";

    installPhase = ''
      runHook preInstall
--- a/pkgs/by-name/sk/skimpdf/package.nix
+++ b/pkgs/by-name/sk/skimpdf/package.nix
@@ -3,6 +3,7 @@
  lib,
  undmg,
  fetchurl,
+  makeWrapper,
 }:
 stdenv.mkDerivation rec {
  pname = "Skim";
@@ -14,14 +15,20 @@ stdenv.mkDerivation rec {
    hash = "sha256-0IfdLeH6RPxf4OZWnNltN7tvvZWbWDQaMCmazd4UUi4=";
  };

-  nativeBuildInputs = [ undmg ];
+  nativeBuildInputs = [
+    undmg
+    makeWrapper
+  ];

  sourceRoot = ".";

  installPhase = ''
    runHook preInstall
-    mkdir -p $out/Applications
+    mkdir -p $out/Applications $out/bin
    cp -R Skim.app $out/Applications
+    for app in displayline skimnotes skimpdf; do
+      makeWrapper $out/Applications/Skim.app/Contents/SharedSupport/$app $out/bin/$app
+    done
    runHook postInstall
  '';

--- a/pkgs/by-name/sq/sqlite-jdbc/package.nix
+++ b/pkgs/by-name/sq/sqlite-jdbc/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
    description = "Library for accessing and creating SQLite database files in Java";
    license = lib.licenses.asl20;
    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ jraygauthier ];
  };
 }
--- a/pkgs/by-name/st/stylelint-lsp/package.nix
+++ b/pkgs/by-name/st/stylelint-lsp/package.nix
@@ -1,48 +1,44 @@
 {
  fetchFromGitHub,
  lib,
-  nodejs,
-  pnpm_9,
+  nodejs-slim,
+  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
+  pnpmBuildHook,
  stdenvNoCC,
  nix-update-script,
+  runCommand,
+  stylelint-lsp,
 }:
+let
+  pnpm = pnpm_11;
+in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "stylelint-lsp";
-  version = "2.0.1";
+  version = "2.0.1-unstable-2026-07-19";

  src = fetchFromGitHub {
    owner = "bmatcuk";
    repo = "stylelint-lsp";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-LUX/H7yY8Dl44vgpf7vOgtMdY7h//m5BAfrK5RRH9DM=";
+    rev = "0362a26ffaf1879b9ec02e2a52a11792a2d4f8d4";
+    hash = "sha256-qRc67tvgncERh6FDJdydN6aL/a5bVSsQQir3KPp1cFk=";
  };

-  buildInputs = [
-    nodejs
-  ];
-
  nativeBuildInputs = [
+    nodejs-slim
    pnpmConfigHook
-    pnpm_9
+    pnpmBuildHook
+    pnpm
  ];

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-qzUvA00ujnIibQAONOPlp5BsXcwQb/gQvOPp83hMT5A=";
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-EuCvuErydwe2LGG62VHcZtN/51Gv1uhhBN3/sEiqzME=";
  };

-  buildPhase = ''
-    runHook preBuild
-
-    pnpm build
-
-    runHook postBuild
-  '';
-
  preInstall = ''
    # remove unnecessary files
    CI=true pnpm --ignore-scripts prune --prod
@@ -57,13 +53,34 @@ stdenvNoCC.mkDerivation (finalAttrs: {

    mkdir -p $out/{bin,lib/stylelint-lsp}
    mv {dist,node_modules} $out/lib/stylelint-lsp
+
    chmod a+x $out/lib/stylelint-lsp/dist/index.js
+    patchShebangs $out/lib/stylelint-lsp/dist/index.js
    ln -s $out/lib/stylelint-lsp/dist/index.js $out/bin/stylelint-lsp

    runHook postInstall
  '';

-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [ "--version=branch" ];
+    };
+
+    tests.smoke = runCommand "stylelint-lsp-smoke-test" { } ''
+      INIT_REQUEST='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"processId":null,"rootUri":"file:///tmp","workspaceFolders":[{"uri":"file:///tmp","name":"test"}],"capabilities":{}}}'
+      CONTENT_LENGTH=''${#INIT_REQUEST}
+
+      RESPONSE=$(
+        {
+          printf "Content-Length: %d\r\n\r\n%s" "$CONTENT_LENGTH" "$INIT_REQUEST"
+          sleep 1
+        } | timeout 3  ${lib.getExe stylelint-lsp} --stdio 2>&1 | head -c 1000
+      ) || true
+
+      echo "$RESPONSE" | grep -q '"capabilities"'
+      touch $out
+    '';
+  };

  meta = {
    description = "Stylelint Language Server";
--- a/pkgs/by-name/sy/synergy/package.nix
+++ b/pkgs/by-name/sy/synergy/package.nix
@@ -6,7 +6,6 @@

  cmake,
  openssl,
-  pcre,
  util-linux,
  libselinux,
  libsepol,
@@ -69,7 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    libsForQt5.qttools # Used for translations even when not building the GUI
    openssl
-    pcre
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    util-linux
--- a/pkgs/by-name/ti/tiscamera/package.nix
+++ b/pkgs/by-name/ti/tiscamera/package.nix
@@ -14,7 +14,6 @@
  libuuid,
  libzip,
  orc,
-  pcre,
  zstd,
  glib,
  gobject-introspection,
@@ -78,7 +77,6 @@ stdenv.mkDerivation (finalAttrs: {
    libuuid
    libzip
    orc
-    pcre
    zstd
    glib
    gst_all_1.gstreamer
--- a/pkgs/by-name/tr/trurl/package.nix
+++ b/pkgs/by-name/tr/trurl/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
      url = "https://github.com/curl/trurl/commit/f22a2c45956f35702e437fb83ac05376f1956ec5.patch";
      hash = "sha256-7CkUs5tMk77WKc7SlgE2NslHtU5cViKSGhHj3IBlpWo=";
    })
-    # https://github.com/curl/trurl/pull/441
+    # https://github.com/curl/trurl/pull/441 + fix for more tests
    ./tests-uppercase-hex.patch
  ];

@@ -64,7 +64,10 @@ stdenv.mkDerivation rec {
    homepage = "https://curl.se/trurl";
    changelog = "https://github.com/curl/trurl/releases/tag/trurl-${version}";
    license = lib.licenses.curl;
-    maintainers = with lib.maintainers; [ christoph-heiss ];
+    maintainers = with lib.maintainers; [
+      christoph-heiss
+      diogotcorreia
+    ];
    platforms = lib.platforms.all;
    mainProgram = "trurl";
  };
--- a/pkgs/by-name/tr/trurl/tests-uppercase-hex.patch
+++ b/pkgs/by-name/tr/trurl/tests-uppercase-hex.patch
@@ -1,6 +1,36 @@
+diff --git a/tests.json b/tests.json
+index 891271c..c8606b0 100644
 --- a/tests.json
 +++ b/tests.json
-@@ -749,6 +749,7 @@
+@@ -473,12 +473,27 @@
+                 "https://example.com/#%2e%61%13%Fa"
+             ]
+         },
+        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "https://example.com/#.a%13%fa\n",
+             "stderr": "",
+             "returncode": 0
+         }
+     },
+    {
+        "input": {
+            "arguments": [
+                "--url",
+                "https://example.com/#%2e%61%13%Fa"
+            ]
+        },
+        "required": ["uppercase-hex"],
+        "expected": {
+            "stdout": "https://example.com/#.a%13%FA\n",
+            "stderr": "",
+            "returncode": 0
+        }
+    },
+     {
+         "input": {
+             "arguments": [
+@@ -749,12 +764,29 @@
                 "query=user=me"
             ]
         },
@@ -8,10 +38,15 @@
         "expected": {
             "stdout": "https://curl.se/hello?user%3dme\n",
             "stderr": "",
-@@ -761,6 +762,22 @@
-                 "--url",
-                 "https://curl.se/hello",
-                 "--set",
+             "returncode": 0
+         }
+     },
+    {
+        "input": {
+            "arguments": [
+                "--url",
+                "https://curl.se/hello",
+                "--set",
 +                "query=user=me"
 +            ]
 +        },
@@ -22,16 +57,10 @@
 +            "returncode": 0
 +        }
 +    },
-+    {
-+        "input": {
-+            "arguments": [
-+                "--url",
-+                "https://curl.se/hello",
-+                "--set",
-                 "fragment= hello"
-             ]
-         },
-@@ -2132,6 +2149,7 @@
+     {
+         "input": {
+             "arguments": [
+@@ -2132,12 +2164,33 @@
                 "query:=a&b&a%26b"
             ]
         },
@@ -39,10 +68,12 @@
         "expected": {
             "stdout": "http://localhost/ABC%5c%5c?a&b&a%26b\n",
             "returncode": 0,
-@@ -2141,6 +2159,26 @@
-     {
-         "input": {
-             "arguments": [
+             "stderr": ""
+         }
+     },
+    {
+        "input": {
+            "arguments": [
 +                "-s",
 +                "scheme:=http",
 +                "-s",
@@ -60,13 +91,37 @@
 +            "stderr": ""
 +        }
 +    },
+     {
+         "input": {
+             "arguments": [
+@@ -2811,12 +2864,26 @@
+                 "https://example.com/one/t%61o/%2F%42/"
+             ]
+         },
+        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "https://example.com/one/tao/%2fB/\n",
+             "stderr": "",
+             "returncode": 0
+         }
+     },
 +    {
 +        "input": {
 +            "arguments": [
-                 "-g",
-                 "{query:b}\\t{query-all:a}\\n{:query:b}\\t{:query-all:a}",
-                 "https://example.org/foo?a=1&b=%23&a=%26#hello"
-@@ -2825,11 +2863,27 @@
+                "https://example.com/one/t%61o/%2F%42/"
+            ]
+        },
+        "required": ["uppercase-hex"],
+        "expected": {
+            "stdout": "https://example.com/one/tao/%2FB/\n",
+            "stderr": "",
+            "returncode": 0
+        }
+    },
+     {
+         "input": {
+             "arguments": [
+@@ -2825,12 +2892,28 @@
                 "path=%61"
             ]
         },
@@ -76,7 +131,7 @@
             "stderr": "",
             "returncode": 0
         }
-+    },
+     },
 +    {
 +        "input": {
 +            "arguments": [
@@ -91,6 +146,115 @@
 +            "stderr": "",
 +            "returncode": 0
 +        }
-     },
+    },
     {
         "input": {
+             "arguments": [
+@@ -2991,36 +3074,78 @@
+                 "http://example.com/?a=%5D"
+             ]
+         },
+        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "http://example.com/?a=%5d\n",
+             "stderr": "",
+             "returncode": 0
+         }
+     },
+    {
+        "input": {
+            "arguments": [
+                "http://example.com/?a=%5D"
+            ]
+        },
+        "required": ["uppercase-hex"],
+        "expected": {
+            "stdout": "http://example.com/?a=%5D\n",
+            "stderr": "",
+            "returncode": 0
+        }
+    },
+     {
+         "input": {
+             "arguments": [
+                 "http://example.com/?a=%5D&b=%5D"
+             ]
+         },
+        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "http://example.com/?a=%5d&b=%5d\n",
+             "stderr": "",
+             "returncode": 0
+         }
+     },
+    {
+        "input": {
+            "arguments": [
+                "http://example.com/?a=%5D&b=%5D"
+            ]
+        },
+        "required": ["uppercase-hex"],
+        "expected": {
+            "stdout": "http://example.com/?a=%5D&b=%5D\n",
+            "stderr": "",
+            "returncode": 0
+        }
+    },
+     {
+         "input": {
+             "arguments": [
+                 "sftp://us%65r:pwd;giraffe@odd"
+             ]
+         },
+        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "sftp://user:pwd%3bgiraffe@odd/\n",
+             "stderr": "",
+             "returncode": 0
+         }
+     },
+    {
+        "input": {
+            "arguments": [
+                "sftp://us%65r:pwd;giraffe@odd"
+            ]
+        },
+        "required": ["uppercase-hex"],
+        "expected": {
+            "stdout": "sftp://user:pwd%3Bgiraffe@odd/\n",
+            "stderr": "",
+            "returncode": 0
+        }
+    },
+     {
+         "input": {
+             "arguments": [
+@@ -3055,12 +3180,28 @@
+                 "[:password]"
+             ]
+         },
+        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "pwd%3bgiraffe\n",
+             "stderr": "",
+             "returncode": 0
+         }
+     },
+    {
+        "input": {
+            "arguments": [
+                "sftp://us%65r:pwd;giraffe@odd",
+                "--get",
+                "[:password]"
+            ]
+        },
+        "required": ["uppercase-hex"],
+        "expected": {
+            "stdout": "pwd%3Bgiraffe\n",
+            "stderr": "",
+            "returncode": 0
+        }
+    },
+     {
+         "input": {
+             "arguments": [
--- a/pkgs/by-name/up/upsun/versions.json
+++ b/pkgs/by-name/up/upsun/versions.json
@@ -1,19 +1,19 @@
 {
-  "version": "5.10.7",
+  "version": "5.10.8",
  "darwin-amd64": {
-    "hash": "sha256-EczhSmIDcG7K8L+BtOOHRT1cmvsB86IvkSWa3A5bwjk=",
-    "url": "https://github.com/upsun/cli/releases/download/v5.10.7/upsun_5.10.7_darwin_all.tar.gz"
+    "hash": "sha256-8M7L9GAwaSpFg6VHI4T5CI2oBE2Z8It3Pt2Wr76Z+is=",
+    "url": "https://github.com/upsun/cli/releases/download/v5.10.8/upsun_5.10.8_darwin_all.tar.gz"
  },
  "darwin-arm64": {
-    "hash": "sha256-EczhSmIDcG7K8L+BtOOHRT1cmvsB86IvkSWa3A5bwjk=",
-    "url": "https://github.com/upsun/cli/releases/download/v5.10.7/upsun_5.10.7_darwin_all.tar.gz"
+    "hash": "sha256-8M7L9GAwaSpFg6VHI4T5CI2oBE2Z8It3Pt2Wr76Z+is=",
+    "url": "https://github.com/upsun/cli/releases/download/v5.10.8/upsun_5.10.8_darwin_all.tar.gz"
  },
  "linux-amd64": {
-    "hash": "sha256-SF9GkeQlh9jdONO24zQ7LC6419txRXyl+x4q0Gfvntk=",
-    "url": "https://github.com/upsun/cli/releases/download/v5.10.7/upsun_5.10.7_linux_amd64.tar.gz"
+    "hash": "sha256-ymKZVLavGiGarDvdzYvxCVTHqPm2YPR5bJqQTQddiPw=",
+    "url": "https://github.com/upsun/cli/releases/download/v5.10.8/upsun_5.10.8_linux_amd64.tar.gz"
  },
  "linux-arm64": {
-    "hash": "sha256-F8YfXhTd0fU75InxLgZ02hrLrx3ELDhkRpRvYNrRGu4=",
-    "url": "https://github.com/upsun/cli/releases/download/v5.10.7/upsun_5.10.7_linux_arm64.tar.gz"
+    "hash": "sha256-Fe4oSes/i3LdRP5bzI/d3gA2QtsfCO0dVswVoNMQXCs=",
+    "url": "https://github.com/upsun/cli/releases/download/v5.10.8/upsun_5.10.8_linux_arm64.tar.gz"
  }
 }
--- a/pkgs/by-name/va/valkey/package.nix
+++ b/pkgs/by-name/va/valkey/package.nix
@@ -10,6 +10,7 @@
  which,
  ps,
  getconf,
+  python3Packages,
  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
  systemd,
  # dependency ordering is broken at the moment when building with openssl
@@ -113,6 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
    tests = {
      redis = nixosTests.redis;
      unitTests = finalAttrs.finalPackage.overrideAttrs { doCheck = true; };
+      valkey-python = python3Packages.valkey;
    };
    serverBin = "valkey-server";
  };
--- a/pkgs/by-name/wi/wit-bindgen/package.nix
+++ b/pkgs/by-name/wi/wit-bindgen/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wit-bindgen";
-  version = "0.59.0";
+  version = "0.60.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wit-bindgen";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-m5P8OmaB2vPkZPU8IhIFSHmyjIhdTGb23xwoU/d7j38=";
+    hash = "sha256-/48oa9Jby6Bp7aVHgU1DLSXeH52RG0wB7nvqbMf7uOg=";
  };

-  cargoHash = "sha256-nIgOnM+Z+KaL9TpjhxvNKZjfzQ+12tWzAynaig24Vzg=";
+  cargoHash = "sha256-Cp8tNqk7sc3dqcAmaF3byCCzZc1i4Qk8d7eJ8v2SbIY=";

  # Some tests fail because they need network access to install the `wasm32-unknown-unknown` target.
  # However, GitHub Actions ensures a proper build.
--- a/pkgs/by-name/wo/wordlists/package.nix
+++ b/pkgs/by-name/wo/wordlists/package.nix
@@ -38,7 +38,8 @@ let

 in
 symlinkJoin {
-  name = "wordlists";
+  pname = "wordlists";
+  version = lib.trivial.release;

  paths = [
    wordlistsCollection
--- a/pkgs/by-name/x1/x11spice/package.nix
+++ b/pkgs/by-name/x1/x11spice/package.nix
@@ -7,7 +7,7 @@
  libxcb-util,
  util-macros,
  libxcb,
-  gtk2,
+  gtk3,
  spice,
  spice-protocol,
 }:
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
    libxcb
    libxcb-util
    util-macros
-    gtk2
+    gtk3
    spice
    spice-protocol
  ];
--- a/Show More
+++ b/Show More