Merge master into staging-nixos

2026-09-14 03:10:07 +00:00 · 2026-09-12 00:24:33 +00:00
parent 08c108de01 8415b0a839
commit 05f0171edc
99 changed files with 1198 additions and 253 deletions
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -157,6 +157,8 @@

 - `pdfium` is now built from source instead of packaging prebuilt binaries. `pdfium-binaries` has been renamed to `pdfium`, and `pdfium-binaries-v8` has been removed.

+- `iocaine` has been updated to `3.5.1`.
+
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.

 - `luaPackages.lrexlib-pcre` has been removed as part of the process to fully migrate from the end-of-life PRCE library to PCRE2. `luaPackages.lrexlib-pcre2` and multiple other versions of lrexlib can be used instead.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10411,7 +10411,7 @@
  };
  gibbert = {
    email = "gbjgms@gmail.com";
-    github = "zgibberish";
+    github = "2gibbert";
    githubId = 67570424;
    name = "gibbert";
  };
@@ -25336,6 +25336,14 @@
    github = "Ruixi-rebirth";
    githubId = 75824585;
  };
+  RumBugen = {
+    name = "Vladislav Wanner";
+    email = "vladislavwanner@gmail.com";
+    github = "RumBugen";
+    githubId = 43646118;
+    matrix = "@rumbugen:matrix.org";
+    keys = [ { fingerprint = "305D 2271 3C43 2E52 FB86  7C64 6107 6951 3194 1931"; } ];
+  };
  rumpelsepp = {
    name = "Stefan Tatschner";
    email = "stefan@rumpelsepp.org";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -62,6 +62,8 @@

 - [feishin](https://github.com/jeffvli/feishin), a modern self-hosted music player. Available as [services.feishin](#opt-services.feishin.enable).

+- [Aurral](https://aurral.org), a Lidarr companion for self-hosted music discovery. Available as [services.aurral](#opt-services.aurral.enable).
+
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.

 - [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
@@ -100,6 +102,8 @@

 - [vellum](https://github.com/greyxp1/vellum) is a live screen annotation overlay for Wayland. Available as [programs.vellum](#opt-programs.vellum.enable).

+- [iocaine](https://git.madhouse-project.org/iocaine/iocaine) is a defense mechanism against unwanted scrapers. Available as [services.iocaine](#opt-services.iocaine.enable).
+
 - [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).

 - [OO7](https://github.com/linux-credentials/oo7) is a desktop-agnostic Secret Service provider. Available as [services.oo7](#opt-services.oo7.enable)
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -855,6 +855,7 @@
  ./services/misc/anki-sync-server.nix
  ./services/misc/apache-kafka.nix
  ./services/misc/atuin.nix
+  ./services/misc/aurral.nix
  ./services/misc/autobrr.nix
  ./services/misc/autofs.nix
  ./services/misc/autorandr.nix
@@ -1282,6 +1283,7 @@
  ./services/networking/imaginary.nix
  ./services/networking/inadyn.nix
  ./services/networking/inspircd.nix
+  ./services/networking/iocaine.nix
  ./services/networking/iodine.nix
  ./services/networking/iperf3.nix
  ./services/networking/ircd-hybrid/default.nix
--- a/nixos/modules/services/misc/aurral.nix
+++ b/nixos/modules/services/misc/aurral.nix
@@ -0,0 +1,185 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.aurral;
+in
+{
+  options = {
+    services.aurral = {
+      enable = lib.mkEnableOption "Aurral is the Lidarr companion for self-hosted music discovery";
+
+      package = lib.mkPackageOption pkgs "aurral" { };
+
+      directories = lib.mkOption {
+        type = lib.types.listOf lib.types.externalPath;
+        default = [ ];
+        description = ''
+          Directories that Aurral needs access to. Other directories won't be visible by the app.
+          Environment variable `DOWNLOAD_FOLDER` is added automatically.
+          See BindPaths in {manpage}`systemd.exec(5)`.
+        '';
+      };
+
+      dataDir = lib.mkOption {
+        type = lib.types.externalPath;
+        default = "/var/lib/aurral";
+        description = ''
+          The directory where Aurral stores its stateful data.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 3001;
+        description = "Port number";
+      };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Open ports in the firewall for Aurral.
+        '';
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "aurral";
+        description = ''
+          User account under which Aurral runs.
+        '';
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "aurral";
+        description = ''
+          Group under which Aurral runs.
+        '';
+      };
+
+      environment = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        example = {
+          DOWNLOAD_FOLDER = "/media/downloads";
+          TRUST_PROXY = "true";
+        };
+        description = ''
+          Environment variables passed to the service.
+        '';
+      };
+
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          Environment file as defined in {manpage}`systemd.exec(5)` passed to the service.
+        '';
+      };
+
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.aurral = {
+      description = "Aurral";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = cfg.environment // {
+        AURRAL_DATA_DIR = cfg.dataDir;
+        PORT = toString cfg.port;
+      };
+
+      path = [ cfg.package ];
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = lib.getExe cfg.package;
+        Restart = "on-failure";
+        User = cfg.user;
+        Group = cfg.group;
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/aurral") "aurral";
+        WorkingDirectory = cfg.dataDir;
+        ReadWritePaths = "";
+        ProtectSystem = "strict";
+        BindPaths = [
+          cfg.dataDir
+        ]
+        ++ (lib.map (x: "-" + x) cfg.directories)
+        ++ lib.optional (cfg.environment ? DOWNLOAD_FOLDER) cfg.environment.DOWNLOAD_FOLDER;
+        BindReadOnlyPaths = [
+          builtins.storeDir
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
+          "-/etc/resolv.conf"
+        ]
+        ++ lib.optionals config.services.resolved.enable [
+          "/run/systemd/resolve/stub-resolv.conf"
+          "/run/systemd/resolve/resolv.conf"
+        ];
+        RestrictSUIDSGID = true;
+        CapabilityBoundingSet = "";
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        SocketBindDeny = "any";
+        SocketBindAllow = toString cfg.port;
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0007";
+        SystemCallArchitectures = "native";
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        DevicePolicy = "closed";
+        PrivateIPC = true;
+        PrivatePIDs = true;
+        ProtectClock = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectHostname = true;
+        RemoveIPC = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        MemoryDenyWriteExecute = false;
+      };
+
+      confinement.enable = true;
+    };
+
+    systemd.tmpfiles.settings."10-aurral" = lib.mkIf (cfg.environment ? DOWNLOAD_FOLDER) {
+      ${cfg.environment.DOWNLOAD_FOLDER}.d = {
+        inherit (cfg) user group;
+        mode = "0770";
+      };
+    };
+
+    users.users = lib.mkIf (cfg.user == "aurral") {
+      aurral = {
+        isSystemUser = true;
+        home = cfg.dataDir;
+        group = cfg.group;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "aurral") {
+      aurral = { };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+  };
+}
--- a/nixos/modules/services/networking/iocaine.nix
+++ b/nixos/modules/services/networking/iocaine.nix
@@ -0,0 +1,226 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    any
+    getExe
+    hasPrefix
+    mapAttrsToList
+    mkIf
+    literalExpression
+    mkEnableOption
+    mkMerge
+    mkOption
+    mkPackageOption
+    optional
+    optionals
+    ;
+
+  inherit (lib.types)
+    attrsOf
+    bool
+    listOf
+    nullOr
+    path
+    str
+    submodule
+    ;
+
+  cfg = config.services.iocaine;
+
+  jsonFormat = pkgs.formats.json { };
+
+  hasUDSbind = any (hasPrefix "/") (
+    mapAttrsToList (_server: cfg: cfg.bind) (cfg.settings.server or { })
+  );
+
+  ifHasSettings = optional (cfg.settings != null);
+
+  hasFirewall = cfg.settings.firewall.enable;
+
+  description = "iocaine, the deadliest poison known to AI";
+in
+{
+  options.services.iocaine = {
+    enable = mkEnableOption description;
+
+    package = mkPackageOption pkgs "iocaine" { };
+
+    environment = mkOption {
+      default = { };
+      type = attrsOf str;
+      description = "Environment variables for iocaine.";
+      example = literalExpression ''
+        {
+          RUST_LOG = "info";
+          RUST_BACKTRACE = "1";
+        }
+      '';
+    };
+
+    settings = mkOption {
+      type = nullOr (submodule {
+        freeformType = jsonFormat.type;
+
+        options = {
+          firewall.enable = mkOption {
+            default = false;
+            type = bool;
+            description = "Enables the firewall";
+            example = true;
+          };
+        };
+      });
+      default = null;
+      description = ''
+        The configuration for iocaine.
+        See [the configuration reference](https://iocaine.madhouse-project.org/documentation/3/configuration/)
+        for full documentation on the fields.
+      '';
+      example = literalExpression ''
+        {
+          server.default = {
+            bind = "localhost:2137";
+            mode = "http";
+            use.handler-from = "default";
+          };
+
+          handler.default = {
+            settings = {
+              "ai-robots-txt-path" = "/etc/iocaine/data/ai.robots.txt-robots.json";
+              sources = {
+                training-corpus = [
+                  "/data/corpus/1984.txt"
+                  "/data/corpus/brave-new-world.txt"
+                ];
+                wordlists = [ "/data/corpus/words.txt" ];
+              };
+            };
+          };
+        }
+      '';
+    };
+
+    extraSettingsPaths = mkOption {
+      type = listOf path;
+      default = [ ];
+      description = "Configuration paths to run iocaine with. Useful for secrets";
+      example = literalExpression ''
+        [
+          "/etc/iocaine/iocaine.json"
+          ./iocaine.json
+        ]
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.etc."iocaine/iocaine.json" = mkIf (cfg.settings != null) {
+      source = jsonFormat.generate "iocaine.json" cfg.settings;
+    };
+
+    systemd.services = mkMerge [
+      {
+        iocaine = {
+          inherit description;
+
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+
+          environment = {
+            HOME = "%S/home";
+          }
+          // cfg.environment;
+
+          restartTriggers =
+            (ifHasSettings config.environment.etc."iocaine/iocaine.json".source) ++ cfg.extraSettingsPaths;
+
+          stopIfChanged = false;
+
+          serviceConfig = {
+            Type = "notify";
+            ExecStart = toString (
+              [
+                (getExe cfg.package)
+              ]
+              ++ (map (path: "--config-path=${path}") (
+                (ifHasSettings "/etc/iocaine/iocaine.json") ++ cfg.extraSettingsPaths
+              ))
+              ++ [ "start" ]
+            );
+
+            Restart = "on-failure";
+            DynamicUser = true;
+            UMask = "0077";
+            LimitNOFILE = 524288;
+
+            StateDirectory = "iocaine";
+            WorkingDirectory = "%S/iocaine";
+            RuntimeDirectory = "iocaine";
+
+            ProtectSystem = "strict";
+            ProtectClock = true;
+            ProtectHostname = true;
+            ProtectProc = "invisible";
+            ProtectControlGroups = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectKernelLogs = true;
+            ProtectHome = true;
+
+            PrivateTmp = true;
+            PrivateDevices = true;
+            PrivateUsers = !hasFirewall;
+
+            SystemCallArchitectures = "native";
+            DevicePolicy = "closed";
+            LockPersonality = true;
+            MemoryDenyWriteExecute = false;
+            NoNewPrivileges = true;
+
+            RestrictAddressFamilies =
+              (optionals hasUDSbind [
+                "AF_INET"
+                "AF_INET6"
+                "AF_UNIX"
+              ])
+              ++ (optionals hasFirewall [ "AF_NETLINK" ]);
+
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            SystemCallFilter = [
+              "@system-service"
+              "~@privileged"
+              "~@resources"
+            ];
+
+            CapabilityBoundingSet = mkIf hasFirewall [ "CAP_NET_ADMIN" ];
+            AmbientCapabilities = mkIf hasFirewall [ "CAP_NET_ADMIN" ];
+          };
+        };
+      }
+
+      (
+        let
+          iocaineDep = {
+            requires = [ "iocaine.service" ];
+            after = [ "iocaine.service" ];
+            serviceConfig.SupplementaryGroups = [ "iocaine" ];
+          };
+        in
+        {
+          nginx = mkIf (config.services.nginx.enable && hasUDSbind) iocaineDep;
+          caddy = mkIf (config.services.caddy.enable && hasUDSbind) iocaineDep;
+        }
+      )
+    ];
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ poz ];
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -301,6 +301,7 @@ in
  audiobookshelf = runTest ./audiobookshelf.nix;
  audit = runTest ./audit.nix;
  audit-testsuite = runTest ./audit-testsuite.nix;
+  aurral = runTest ./aurral.nix;
  auth-mysql = runTest ./auth-mysql.nix;
  authelia = runTest ./authelia.nix;
  auto-cpufreq = runTest ./auto-cpufreq.nix;
@@ -860,6 +861,7 @@ in
  hibernate-systemd-stage-1 = handleTestOn [ "x86_64-linux" ] ./hibernate.nix {
    systemdStage1 = true;
  };
+  hickory-dns = runTest ./hickory-dns.nix;
  hister = runTest ./hister.nix;
  hitch = runTest ./hitch;
  hledger-web = runTest ./hledger-web.nix;
@@ -925,6 +927,7 @@ in
  inventree = runTest ./inventree.nix;
  invidious = runTest ./invidious.nix;
  invoiceplane = runTest ./invoiceplane.nix;
+  iocaine = runTest ./iocaine.nix;
  iodine = runTest ./iodine.nix;
  iosched = runTest ./iosched.nix;
  ipget = runTest ./ipget.nix;
--- a/nixos/tests/aurral.nix
+++ b/nixos/tests/aurral.nix
@@ -0,0 +1,29 @@
+{ lib, ... }:
+{
+  name = "aurral";
+  meta = with lib.maintainers; {
+    maintainers = [ hougo ];
+  };
+
+  nodes = {
+    machine =
+      { ... }:
+      {
+        services.aurral = {
+          enable = true;
+          environment = {
+            DOWNLOAD_FOLDER = "/var/lib/aurral-downloads";
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("aurral.service")
+    machine.wait_for_open_port(3001)
+
+    machine.succeed('curl --fail http://localhost:3001/api/health')
+  '';
+}
--- a/nixos/tests/hickory-dns.nix
+++ b/nixos/tests/hickory-dns.nix
@@ -0,0 +1,41 @@
+{ pkgs, ... }:
+{
+  name = "hickory-dns";
+
+  meta.maintainers = with pkgs.lib.maintainers; [ adamcstephens ];
+
+  containers.machine = {
+    environment.systemPackages = [ pkgs.doggo ];
+
+    services.hickory-dns = {
+      enable = true;
+      settings.zones = [
+        {
+          zone = "example.test";
+          file = pkgs.writeText "example.test.zone" ''
+            $ORIGIN example.test.
+            $TTL 3600
+            @ IN SOA ns.example.test. hostmaster.example.test. (1 3600 600 86400 3600)
+            @ IN NS ns.example.test.
+            ns IN A 127.0.0.1
+            www IN A 192.0.2.1
+          '';
+        }
+      ];
+    };
+  };
+
+  testScript = ''
+    import json
+
+    machine.start()
+    machine.wait_for_unit("hickory-dns.service")
+    machine.wait_for_open_port(53)
+
+    response = json.loads(machine.succeed("doggo @127.0.0.1 www.example.test. A --json"))
+    answers = response["responses"][0]["answers"]
+    assert [(answer["name"], answer["type"], answer["address"]) for answer in answers] == [
+        ("www.example.test.", "A", "192.0.2.1")
+    ], response
+  '';
+}
--- a/nixos/tests/iocaine.nix
+++ b/nixos/tests/iocaine.nix
@@ -0,0 +1,61 @@
+{ lib, ... }:
+{
+  name = "iocaine";
+  meta.maintainers = with lib.maintainers; [ poz ];
+
+  nodes = {
+    iocaine_default = {
+      services.iocaine = {
+        enable = true;
+      };
+    };
+
+    reverse_proxy_integration = {
+      services.iocaine = {
+        enable = true;
+        settings.server.main = {
+          bind = "/run/iocaine/iocaine.socket";
+          unix-socket-access = "group";
+          mode = "http";
+          use = {
+            handler-from = "default";
+          };
+        };
+        settings.handler.default = { };
+      };
+
+      services.caddy = {
+        enable = true;
+        globalConfig = ''
+          http_port 8080
+          https_port 8081
+        '';
+      };
+
+      services.nginx.enable = true;
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    iocaine_default.wait_for_unit("iocaine.service")
+    iocaine_default.fail("curl -s --show-error --fail http://127.0.0.1:42069/random-path/yes/")
+    iocaine_default.fail("curl -s --show-error --fail http://127.0.0.1:42069/ -A 'Googlebot'")
+    iocaine_default.succeed("curl -s --show-error --fail http://127.0.0.1:42069/a/path/very/deep/into/the/forest/ -A 'Perplexity'")
+    iocaine_default.fail("curl -s --show-error --fail http://127.0.0.1:42042/metrics")
+
+    reverse_proxy_integration.wait_for_unit("iocaine.service")
+    reverse_proxy_integration.wait_for_unit("caddy.service")
+    reverse_proxy_integration.wait_for_unit("nginx.service")
+    reverse_proxy_integration.stop_job("nginx")
+    reverse_proxy_integration.stop_job("caddy")
+    reverse_proxy_integration.stop_job("iocaine")
+    reverse_proxy_integration.start_job("nginx")
+    reverse_proxy_integration.succeed("systemctl is-active iocaine.service")
+    reverse_proxy_integration.stop_job("nginx")
+    reverse_proxy_integration.stop_job("iocaine")
+    reverse_proxy_integration.start_job("caddy")
+    reverse_proxy_integration.succeed("systemctl is-active iocaine.service")
+  '';
+}
--- a/pkgs/applications/editors/emacs/build-support/elpa2nix.el
+++ b/pkgs/applications/editors/emacs/build-support/elpa2nix.el
@@ -1,3 +1,5 @@
+;; -*- lexical-binding: t; -*-
+
 (require 'package)
 (package-initialize)

--- a/pkgs/applications/editors/emacs/build-support/melpa2nix.el
+++ b/pkgs/applications/editors/emacs/build-support/melpa2nix.el
@@ -1,3 +1,5 @@
+;; -*- lexical-binding: t; -*-
+
 (require 'package-recipe)
 (require 'package-build)

--- a/pkgs/applications/editors/emacs/build-support/mk-wrapper-subdirs.el
+++ b/pkgs/applications/editors/emacs/build-support/mk-wrapper-subdirs.el
@@ -1,3 +1,5 @@
+;; -*- lexical-binding: t; -*-
+
 (defmacro mk-subdirs-expr (path)
  `(setq load-path
         (delete-dups (append '(,path)
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1190,8 +1190,8 @@ let
        mktplcRef = {
          publisher = "DanielSanMedium";
          name = "dscodegpt";
-          version = "3.24.57";
-          hash = "sha256-iZZlZqghFRBtAOGZz1DV5bW0n41DpJKB865plQ5rXoY=";
+          version = "3.24.67";
+          hash = "sha256-ynB3xPun4swOhvVLmNpIAue7VmfabKUzR0RCqOgpyYY=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1242,8 +1242,8 @@ let
        mktplcRef = {
          name = "databricks";
          publisher = "databricks";
-          version = "2.15.0";
-          hash = "sha256-IkzkKEmcbRI0RD72NFgE38oDKxrFe+rYozkUmOc3SBM=";
+          version = "2.17.1";
+          hash = "sha256-UWvn9Gy31/9HSKD+OCfpoE4BSGyReC4pv+4sH7higTU=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
@@ -1792,8 +1792,8 @@ let
        mktplcRef = {
          name = "foam-vscode";
          publisher = "foam";
-          version = "0.44.5";
-          hash = "sha256-MiQ1Ze0vW0JCfmKVFe6eAWBbHhZqDKtRhhiQMkBgRe4=";
+          version = "0.44.6";
+          hash = "sha256-9OAQIXdFqV3pLFmixB2ES8Ti/qK3uPk6yMRs9Y+w4aI=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -3877,8 +3877,8 @@ let
        mktplcRef = {
          name = "prisma";
          publisher = "Prisma";
-          version = "31.11.0";
-          hash = "sha256-vvHr5jZ2lccO93O82OKnRF4wyVv3n/H3nKJIqZdIjlY=";
+          version = "31.12.8";
+          hash = "sha256-3XJu7g8NnevBZiJ90iogqR2QMIgnCQ/HFII98RG8arI=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/Prisma.prisma/changelog";
@@ -4045,8 +4045,8 @@ let
          publisher = "rocq-prover";
          name = "vsrocq";
          # When updating the version here, also update the language server vsrocq-language-server
-          version = "2.4.3";
-          hash = "sha256-o9rsSDCDYRWZQBMDA7DtWay50tBI76kw7H7CivrZpKo=";
+          version = "2.5.0";
+          hash = "sha256-05YrIKtZRmEjs+QSzsCyIxajRmSLgoCkNUDti+w97Fw=";
        };
        meta = {
          description = "VsRocq is an extension for Visual Studio Code with support for the Rocq Prover";
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-dev";
    publisher = "saoudrizwan";
-    version = "4.1.16";
-    hash = "sha256-ZsKIpyn2ZZzrfxAR8HAjNFMVQ5UdnH7bYaO7AdUCTKc=";
+    version = "4.1.17";
+    hash = "sha256-godUcnRN7Uo2DiLHJrthAZYuzwoXiqjv6Epcfqco0vU=";
  };

  meta = {
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "helm-diff";
-  version = "3.15.12";
+  version = "3.15.13";

  src = fetchFromGitHub {
    owner = "databus23";
    repo = "helm-diff";
    rev = "v${version}";
-    hash = "sha256-cMW+crPNyMyS04LlnCbSOhDLGW1SPmoTYeyBif3tl+0=";
+    hash = "sha256-/Wu8OszNOhv1I7NA9vvwO0IB957sxnh8NGzo3cEjE/s=";
  };

-  vendorHash = "sha256-GWeQveyp04QODNuUFUysUraPwR1iJybgMfNmm99k4sc=";
+  vendorHash = "sha256-lzR/vuXJgoo2VpVeV/mLTmBi9LJepGA/uxtCg3KK9LI=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -36,13 +36,13 @@
    "vendorHash": "sha256-TXeJPVyb3+t1wJyHXNbmy6iPrPTG47bedHB0UyEUv98="
  },
  "akamai_akamai": {
-    "hash": "sha256-XGTdfOUr3Nb2vV49aGZThuae/n9KrM3NZ8A0P/LrSXg=",
+    "hash": "sha256-ui8w8z9kROptw0tCvtT645bbNJV/BRd10aVomwhl+hI=",
    "homepage": "https://registry.terraform.io/providers/akamai/akamai",
    "owner": "akamai",
    "repo": "terraform-provider-akamai",
-    "rev": "v10.4.0",
+    "rev": "v11.0.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DTPaRkNWitoriOE0G+RctMIHAdSPK4wq410a+XxLnOY="
+    "vendorHash": "sha256-d9hJUjHczxy2/3bOmEYjTxKDIRc6Cox4sr5k40ZHWFE="
  },
  "aliyun_alicloud": {
    "hash": "sha256-caOnwD9wXa533I2kUpcbMwAJUUcSzyZNY4LIgJQjdc0=",
@@ -137,13 +137,13 @@
    "vendorHash": "sha256-TLNHhSyMw0rKFtd9EChg7zSGoxe57rh36nAPqu1j8w8="
  },
  "buildkite_buildkite": {
-    "hash": "sha256-Hq2I9/Fnery1CUWdOTu2hJQ0EwYN+Dw8yPb4mZsuYzU=",
+    "hash": "sha256-sqtC0Wkme+90jKdJCTVuOxkzeWnt/uQ8/y/d5bJoL/w=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v1.39.1",
+    "rev": "v1.39.2",
    "spdx": "MIT",
-    "vendorHash": "sha256-QmtHr/zjSoqpiRepLjzMN+QLPUccaIXQPrLYHihm2/o="
+    "vendorHash": "sha256-VvihinrizplJmIyXyLsvYjj0uwS06xTH5SiTZlTdYWE="
  },
  "camptocamp_pass": {
    "hash": "sha256-GQ2g7VyK+eeBqW3LMR4U0gMYsvQnG3y+KEKKkvnmfsk=",
@@ -346,13 +346,13 @@
    "vendorHash": "sha256-fP6brpY/wRI1Yjgapzi+FfOci65gxWeOZulXbGdilrE="
  },
  "dnsimple_dnsimple": {
-    "hash": "sha256-YkoBGPcNKBeAHWcsRldHSsZ/hvWngCiySjK5zzI9jNE=",
+    "hash": "sha256-eprmwEPBGYCCoic4Y2nClxaGjXAD5AFdmuvRUzdnAG8=",
    "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
    "owner": "dnsimple",
    "repo": "terraform-provider-dnsimple",
-    "rev": "v2.2.0",
+    "rev": "v2.2.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-SuwDjQMgzcnNsBf/wXZvys6VINgnFeaWcV7jIMbNXo8="
+    "vendorHash": "sha256-Co7Rbjxi3cUglxVx7O3cXTA4r0SUUMv/EWHid5K+ILM="
  },
  "dnsmadeeasy_dme": {
    "hash": "sha256-JH9YcM9Fvd1x0BJpLUZCm6a9hZZxySrkFVLP89FO3fU=",
@@ -733,11 +733,11 @@
    "vendorHash": "sha256-s9tdthUzIdisP0XB9V+HGlWgZCXnOodz9Atu/XyDKf4="
  },
  "huaweicloud_huaweicloud": {
-    "hash": "sha256-ncTEM+7zS5P2fhXcB0wa8NatbJg9g2XHm2FGWqp6jx8=",
+    "hash": "sha256-r4SwNOQ2P9IdxAvPnIuJEolXfhI/GKSPUZ+yjBS7pKA=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.97.2",
+    "rev": "v1.98.2",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/by-name/_7/_7zz/package.nix
+++ b/pkgs/by-name/_7/_7zz/package.nix
@@ -122,6 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
  outputs = [
    "out"
    "doc"
+    "lib"
  ];

  setupHook = ./setup-hook.sh;
@@ -130,12 +131,19 @@ stdenv.mkDerivation (finalAttrs: {

  preBuild = "cd CPP/7zip/Bundles/Alone2";

+  postBuild = ''
+    make $makeFlags -j $NIX_BUILD_CORES -C ../Format7zF -f ../../cmpl_gcc.mak
+  '';
+
  installPhase = ''
    runHook preInstall

    install -Dm555 -t $out/bin b/*/7zz${stdenv.hostPlatform.extensions.executable}
    install -Dm444 -t $out/share/doc/7zz ../../../../DOC/*.txt

+    mkdir -p $lib/lib
+    install -Dm555 -t $lib/lib ../Format7zF/b/g/*
+
    runHook postInstall
  '';

--- a/pkgs/by-name/ap/api-linter/package.nix
+++ b/pkgs/by-name/ap/api-linter/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "api-linter";
-  version = "2.3.1";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "googleapis";
    repo = "api-linter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xks5oKfJSMV4MbPFrYGWv82XeBLYbGgXF4r4kbFX93Q=";
+    hash = "sha256-r1OTgsLaEZPQd7P3E7BY0YYIr93Cmeo6gH4Z24LXP3Q=";
  };

-  vendorHash = "sha256-wPySRFqm396YRqEUZNMkA19SxqBNApwr8hm0PRA5cO0=";
+  vendorHash = "sha256-L1R0XvEn1pGy/EC/ivoUOGsyGrT5bRUkMLrGpI4VNyY=";

  subPackages = [ "cmd/api-linter" ];

--- a/pkgs/by-name/as/asn/package.nix
+++ b/pkgs/by-name/as/asn/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "asn";
-  version = "0.81.1";
+  version = "0.82.0";

  src = fetchFromGitHub {
    owner = "nitefood";
    repo = "asn";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-V3C/jzCnhqOCmUU7X89x/3CKkMwkKvY6dAXAHqx2K1M=";
+    hash = "sha256-mB01NtiM1DZ830DykQeKrbqZC46IlOFyV5DVNf108bA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/au/aurral/package.json.patch
+++ b/pkgs/by-name/au/aurral/package.json.patch
@@ -0,0 +1,15 @@
+diff --git a/package.json b/package.json
+index 5e1328e5..0f289597 100644
+--- a/package.json
+++ b/package.json
+@@ -4,9 +4,7 @@
+   "description": "Aurral artist request manager",
+   "private": true,
+   "type": "module",
+-  "engines": {
+-    "node": "22.23.x"
+-  },
+  "files": ["backend/*", "frontend/dist/*", "lib/*"],
+   "workspaces": [
+     "backend",
+     "frontend"
--- a/pkgs/by-name/au/aurral/package.nix
+++ b/pkgs/by-name/au/aurral/package.nix
@@ -0,0 +1,114 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  nodejs_26,
+  sqlite,
+  ffmpeg,
+  yt-dlp,
+  jemalloc,
+  runtimeShell,
+  makeFontsConf,
+  noto-fonts-color-emoji,
+  dejavu_fonts,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "aurral";
+  version = "2.8.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "lklynet";
+    repo = "aurral";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Ceo5CHIGa+98XFLazqmAyAV64rzDYqB0gvJ95AKwfUk=";
+  };
+
+  # Specifies files to package leveraging npm & nix hooks. Not used by upstream.
+  # Remove engine constraint not matching upstream dockerfile.
+  patches = [
+    ./package.json.patch
+  ];
+
+  npmDepsHash = "sha256-Qa/TcKzMEY/w8FWKMiHUeqVB9cMxxWtEwF30y0nndkg=";
+
+  nodejs = nodejs_26;
+
+  env.VITE_APP_VERSION = finalAttrs.version;
+
+  npmInstallFlags = [
+    "--include=optional"
+    "--include-workspace-root=false"
+  ];
+
+  npmBuildFlags = [ "--workspace=frontend" ];
+
+  npmPruneFlags = [
+    "--workspace=backend"
+    "--include=optional"
+    "--include-workspace-root=false"
+  ];
+
+  postInstall = ''
+    mkdir $out/bin
+    cat > $out/bin/aurral <<EOL
+    #!${runtimeShell} -e
+    export LD_PRELOAD=${lib.getLib jemalloc}/lib/libjemalloc.so
+    export LD_LIBRARY_PATH=${
+      lib.makeLibraryPath [
+        sqlite
+      ]
+    }
+    export PATH=${
+      lib.makeBinPath [
+        finalAttrs.nodejs
+        ffmpeg
+        yt-dlp
+      ]
+    }\''${PATH:+:}\$PATH
+    export FONTCONFIG_FILE=${
+      makeFontsConf {
+        fontDirectories = [
+          noto-fonts-color-emoji
+          dejavu_fonts
+        ];
+      }
+    }
+    export APP_VERSION=${finalAttrs.version}
+    export NODE_ENV=production
+    case "\$1" in
+        resetAdminPassword)
+        exec node $out/lib/node_modules/aurral/backend/scripts/resetAdminPassword.js "\$@"
+        ;;
+        server|"")
+        exec node $out/lib/node_modules/aurral/backend/server.js
+        ;;
+        -h|--help|*)
+        echo "Usage: (server|resetAdminPassword)"
+        echo
+        echo "We recommend using it in the service namespace. Example:"
+        echo "sudo nsenter -t \\\$(systemctl show --property MainPID --value aurral.service) -a -e -S follow -G follow aurral resetAdminPassword -g"
+        ;;
+    esac
+    EOL
+    chmod +x $out/bin/aurral
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Aurral is the Lidarr companion for self-hosted music discovery";
+    mainProgram = "aurral";
+    homepage = "https://aurral.org";
+    changelog = "https://github.com/lklynet/aurral/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    platforms = lib.intersectLists lib.platforms.linux (lib.platforms.x86_64 ++ lib.platforms.aarch64);
+    maintainers = with lib.maintainers; [
+      hougo
+      staticdev
+    ];
+  };
+})
--- a/pkgs/by-name/ca/cadabra2/package.nix
+++ b/pkgs/by-name/ca/cadabra2/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch2,

  cmake,
  pkg-config,
@@ -51,6 +52,18 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-Pbk9SmJ64CZ+yxMj53JpxULBQye2ETDi8xNKw38cC9k=";
  };

+  patches = [
+    # Backport a MicroTeX fix for fontconfig >= 2.18.
+    # Remove once cadabra2 updates its MicroTeX submodule to 7944eb4 or later.
+    (fetchpatch2 {
+      name = "microtex-fix-recent-fontconfig-build.patch";
+      url = "https://github.com/kpeeters/MicroTeX/commit/7944eb496dec1b7ff8af4c13e0cfee279eea30b8.patch?full_index=1";
+      extraPrefix = "submodules/microtex/";
+      stripLen = 1;
+      hash = "sha256-mobQF8uZGF1bdddYoyAxrZ4XhbMwUuK8kLwjmVrZZh0=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace CMakeLists.txt \
      --replace-fail 'MESSAGE(FATAL_ERROR "Building with -DPACKAGING_MODE=ON also requires -DCMAKE_INSTALL_PREFIX=/usr")' ""
--- a/pkgs/by-name/ca/cargo-leptos/package.nix
+++ b/pkgs/by-name/ca/cargo-leptos/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-leptos";
-  version = "0.3.7";
+  version = "0.3.8";

  src = fetchFromGitHub {
    owner = "leptos-rs";
    repo = "cargo-leptos";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-w1kd/eOjNHYAramUvHdgj0ogFqgHDQ1P+ItKTTLL9hU=";
+    hash = "sha256-SP/jnyUU+mqwL9dpfEi8ZM1/O6LGyMYoQ5puU51aMIw=";
  };

-  cargoHash = "sha256-p0mku5B9RtU0E7ny1Izhr2diBLgDH8HR2/B92MvBfws=";
+  cargoHash = "sha256-mvximFXCtpEDBVhlwcY1zVeQXahgjWPuRmmv52z1Vv0=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/ce/centrifugo/package.nix
+++ b/pkgs/by-name/ce/centrifugo/package.nix
@@ -16,16 +16,16 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "centrifugo";
-  version = "6.9.3";
+  version = "6.9.4";

  src = fetchFromGitHub {
    owner = "centrifugal";
    repo = "centrifugo";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-VGD2sOcnEnUC4p3sNGBf231/N98lyLKWvTTBu9JAqqI=";
+    hash = "sha256-5m2f7BB50AGrdMBCizQg3suEGPRzQr4NqI9v2JWy/78=";
  };

-  vendorHash = "sha256-DeimAevGCOlu74bgZdOE4/SCbTo3TXS12CqZRhk94/s=";
+  vendorHash = "sha256-DkuwByvpoJ17P84mKddDttALksHVO2sUVA3MI37kSOc=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/co/cobra-cli/package.nix
+++ b/pkgs/by-name/co/cobra-cli/package.nix
@@ -57,7 +57,7 @@ buildGoModule (finalAttrs: {
    description = "Cobra CLI tool to generate applications and commands";
    mainProgram = "cobra-cli";
    homepage = "https://github.com/spf13/cobra-cli/";
-    changelog = "https://github.com/spf13/cobra-cli/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/spf13/cobra-cli/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.afl20;
    maintainers = [ lib.maintainers.ivankovnatsky ];
  };
--- a/pkgs/by-name/co/consul-template/package.nix
+++ b/pkgs/by-name/co/consul-template/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "consul-template";
-  version = "0.42.1";
+  version = "0.43.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "consul-template";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-J/dUlF7FBo+WLMA6ff0WlqD1oqsmPI2W8ebW1eNTUX4=";
+    hash = "sha256-54+MHi6ZmcDcHk1Swwt+25ZQOLPRytgZ8oDdlXsGVKo=";
  };

-  vendorHash = "sha256-wmbv/YrjRweTsaA/3mXKx2L8yNdoSRXRVyEcaraJ/nw=";
+  vendorHash = "sha256-TffXWuVQKzaxwXozpdPJhwnBi9fmtolTZDPBsbVrOLY=";

  # consul-template tests depend on vault and consul services running to
  # execute tests so we skip them here
--- a/pkgs/by-name/cr/crowdsec/package.nix
+++ b/pkgs/by-name/cr/crowdsec/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "crowdsec";
-  version = "1.8.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "crowdsecurity";
    repo = "crowdsec";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/LhA2CxLde7eVUs7yU+KYd5txLlmH/zB2g2S1Jo83fU=";
+    hash = "sha256-gyKqMUnAjfg3eAb7Z27qv6AgSxNo8Z7zIhXTUpkD5i4=";
  };

  vendorHash = "sha256-899kCO6wbiNe1NHmtew3ksQXI51LjdlLo5XAplsHUQQ=";
--- a/pkgs/by-name/de/dexter/package.nix
+++ b/pkgs/by-name/de/dexter/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "dexter";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "remoteoss";
    repo = "dexter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VrKLi92fCkAL6C5dvydXuwOCp3dYXsDJSGk9rkHv1t8=";
+    hash = "sha256-4LAcV29ypn56UDt8RN+UdwR1ZMlGUixj+rwALo9a84g=";
  };

  vendorHash = "sha256-1mJ4HdDCsZl/g8F+L+NrW2ACuiHe2aSheJO/1XfKAb4=";
--- a/pkgs/by-name/em/empire-compiler/package.nix
+++ b/pkgs/by-name/em/empire-compiler/package.nix
@@ -9,13 +9,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "empire-compiler";
-  version = "2.0.0";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "bc-security";
    repo = "empire-compiler";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hquqUEQHdID+2dTWiSkMjcYi4wc6KlSllAD9vUzdH10=";
+    hash = "sha256-k0y7pk79Az4lyXAcFP260T8WgCJSfxfaAtgsytC3wBw=";
  };

  dotnet-sdk = dotnetCorePackages.sdk_10_0;
--- a/pkgs/by-name/fa/far2l/package.nix
+++ b/pkgs/by-name/fa/far2l/package.nix
@@ -7,7 +7,6 @@
  cmake,
  ninja,
  pkg-config,
-  m4,
  perl,
  bash,
  xdg-utils,
@@ -16,8 +15,11 @@
  gzip,
  bzip2,
  gnutar,
-  p7zip,
+  _7zz,
  xz,
+  nix-update-script,
+
+  # Backend options
  withTTYX ? true,
  libx11,
  withGUI ? true,
@@ -25,13 +27,13 @@
  withUCD ? true,
  libuchardet,

-  # Plugins
+  # Plugins (all are enabled by default)
  withColorer ? true,
  spdlog,
  libxml2,
  withMultiArc ? true,
  libarchive,
-  pcre,
+
  withNetRocks ? true,
  openssl,
  libssh,
@@ -42,57 +44,57 @@
  python3Packages,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "far2l";
-  version = "2.9.0";
+  version = "2.9.0-unstable-06-09-2026";

  src = fetchFromGitHub {
    owner = "elfmz";
    repo = "far2l";
-    tag = "v_${version}";
-    hash = "sha256-9mSi3gqZ2jpgUawD3Jr2Pmn1shLpySuFCh4iOZe7CO8=";
+    rev = "1d45c50547f4459c13f3613cb89b09bf8d6139b1";
+    hash = "sha256-/AxtL7L6YYKFrtdsUXiBQ1ljuqCBymkdajeMB2xlVrM=";
  };

  nativeBuildInputs = [
    cmake
    ninja
    pkg-config
-    m4
    perl
    makeWrapper
  ];

-  buildInputs =
-    lib.optional withTTYX libx11
-    ++ lib.optional withGUI wxwidgets_3_2
-    ++ lib.optional withUCD libuchardet
-    ++ lib.optionals withColorer [
-      spdlog
-      libxml2
+  buildInputs = [
+    bash
+  ]
+  ++ lib.optional withTTYX libx11
+  ++ lib.optional withGUI wxwidgets_3_2
+  ++ lib.optional withUCD libuchardet
+  ++ lib.optionals withColorer [
+    spdlog
+    libxml2
+  ]
+  ++ lib.optionals withMultiArc [
+    libarchive
+  ]
+  ++ lib.optionals withNetRocks [
+    openssl
+    libssh
+    libnfs
+    neon
+  ]
+  ++ lib.optional (withNetRocks && !stdenv.hostPlatform.isDarwin) samba # broken on darwin
+  ++ lib.optionals withPython (
+    with python3Packages;
+    [
+      python
+      cffi
+      debugpy
+      pcpp
    ]
-    ++ lib.optionals withMultiArc [
-      libarchive
-      pcre
-    ]
-    ++ lib.optionals withNetRocks [
-      openssl
-      libssh
-      libnfs
-      neon
-    ]
-    ++ lib.optional (withNetRocks && !stdenv.hostPlatform.isDarwin) samba # broken on darwin
-    ++ lib.optionals withPython (
-      with python3Packages;
-      [
-        python
-        cffi
-        debugpy
-        pcpp
-      ]
-    );
+  );

  postPatch = ''
-    patchShebangs python/src/prebuild.sh
+    chmod +x far2l/bootstrap/*.sh
    patchShebangs far2l/bootstrap/view.sh
  '';

@@ -111,9 +113,9 @@ stdenv.mkDerivation rec {
  ];

  runtimeDeps = [
+    bash
    unzip
    zip
-    p7zip
    xz
    gzip
    bzip2
@@ -122,15 +124,23 @@ stdenv.mkDerivation rec {

  postInstall = ''
    wrapProgram $out/bin/far2l \
-      --prefix PATH : ${lib.makeBinPath runtimeDeps} \
+      --prefix PATH : ${lib.makeBinPath finalAttrs.runtimeDeps} \
      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
+    # Link 7z plugin
+    echo "Linking 7z libraries..."
+    mkdir -p $out/lib/far2l/Plugins/arclite/plug/
+    for file in ${_7zz.lib}/lib/*; do
+      ln -sf "$file" "$out/lib/far2l/Plugins/arclite/plug/"
+    done
  '';

+  passthru.updateScript = nix-update-script { extraArgs = "--version=branch=master"; };
+
  meta = {
-    description = "Linux port of FAR Manager v2, a program for managing files and archives in Windows operating systems";
+    description = "Linux port of FAR Manager v2 with enhanced plugin support";
    homepage = "https://github.com/elfmz/far2l";
    license = lib.licenses.gpl2Only;
    maintainers = with lib.maintainers; [ smakarov ];
    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/by-name/ff/ffmpegthumbnailer/package.nix
+++ b/pkgs/by-name/ff/ffmpegthumbnailer/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  postInstall = ''
-    substituteInPlace $out/share/thumbnailers/ffmpegthumbnailer.thumbnailer \
+    substituteInPlace $out/share/thumbnailers/ffmpegthumbnailer{,-audio}.thumbnailer \
      --replace-fail '=ffmpegthumbnailer' "=$out/bin/ffmpegthumbnailer"
  '';

--- a/pkgs/by-name/gc/gcsfuse/package.nix
+++ b/pkgs/by-name/gc/gcsfuse/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "gcsfuse";
-  version = "3.11.3";
+  version = "3.11.4";

  src = fetchFromGitHub {
    owner = "googlecloudplatform";
    repo = "gcsfuse";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kysgRTHFGLC5Hjcs/i+Xx2zVhjBkv5WbKXFBVejRxlQ=";
+    hash = "sha256-k12Gi1fBsxd1P3iL7/5CwUfOpap4ienUY4dvubjL2MI=";
  };

-  vendorHash = "sha256-AyJPjX8vLk4jfIVur/+dM1cArh+OSh2v3w4FnfH26cM=";
+  vendorHash = "sha256-ATV2KYKWbxCYUzF+GFmaNYcGlVhyB+xDpgMEvT1sPEI=";

  subPackages = [
    "."
--- a/pkgs/by-name/gr/grcov/package.nix
+++ b/pkgs/by-name/gr/grcov/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "grcov";
-  version = "0.10.7";
+  version = "0.10.8";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "grcov";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-64c8byxQDEE9eRS+YAd9BaGSjGm+cl2XTAy3l3Utrws=";
+    hash = "sha256-P9JOd2Dw3MDQ6Kr9m85JiqQScYdJzEVPtIfTOAc21rs=";
  };

-  cargoHash = "sha256-JTIYfAatMg9L597pRLywgCQmQO9sbuq/En0wNUx8QUo=";
+  cargoHash = "sha256-HZXH4sirjaZmHUiVr9A3ZnyqPoMaDTJnMD54/iUYQtg=";

  # tests do not find grcov path correctly
  checkFlags =
--- a/pkgs/by-name/gu/gum/package.nix
+++ b/pkgs/by-name/gu/gum/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "gum";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "gum";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-M1eLi/Jc8QCc6Mai3Nc42MXRnl5ucafQMiOFL3kLoz4=";
+    hash = "sha256-EwLh86TMCmopS8cKwpmYR/7Iq7buXGwnk8ORB1BFisk=";
  };

-  vendorHash = "sha256-gvTQQOkCVIyKE27dgeQAPM4ZBV2XZnjRtqmEwPbY3Gc=";
+  vendorHash = "sha256-e18NSh+dhX4MoinZDqEDM73FaOqTM5CsSO6Lw196HNU=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/hi/hickory-dns/package.nix
+++ b/pkgs/by-name/hi/hickory-dns/package.nix
@@ -3,22 +3,23 @@
  fetchFromGitHub,
  lib,
  nix-update-script,
+  nixosTests,
  rustPlatform,
  versionCheckHook,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "hickory-dns";
-  version = "0.26.2";
+  version = "0.26.3";

  src = fetchFromGitHub {
    owner = "hickory-dns";
    repo = "hickory-dns";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qwyMfjo3LTyvxwRlQ/4Odc3yZsSuA4cn7zj/KLCfRSs=";
+    hash = "sha256-zm8qMYqdDEZjtNC9arMzCAxPpBRRRwiHsb3lsP/cHIg=";
  };

-  cargoHash = "sha256-TsawTK+MaQ8isxa+/lROTgnA2u26XKjZCtRFUKLRbrw=";
+  cargoHash = "sha256-u6Uf9lhrFgWfzIXZ3DIPk2JdDTdd1qBTkqUgmSspR9c=";

  buildFeatures = [
    "blocklist"
@@ -80,7 +81,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
    substituteInPlace crates/resolver/src/lib.rs --replace-fail '//! ```rust' '//! ```rust,no_run'
  '';

-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    tests = {
+      inherit (nixosTests) hickory-dns;
+    };
+    updateScript = nix-update-script { };
+  };

  meta = {
    description = "Rust based DNS client, server, and resolver";
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@@ -1,7 +1,7 @@
 {
  stdenv,
  lib,
-  buildGoModule,
+  buildGo127Module,
  fetchFromGitHub,
  installShellFiles,
  buildPackages,
@@ -9,18 +9,18 @@
  nix-update-script,
 }:

-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
  pname = "hugo";
-  version = "0.165.0";
+  version = "0.166.0";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xxBBvhNp/4IUtIPfiFaZhCnXPhnHZ0NP4R/gda9a6Ic=";
+    hash = "sha256-IzkwqfoqIscUI3EboIE3zHd0CsEUfa9JnoQ4yk6oIOg=";
  };

-  vendorHash = "sha256-k9e8lthkDzewLHRSZmiAQxsatOKUFrlNOJ4FnAb2uqk=";
+  vendorHash = "sha256-lqhBX8lmDHHCgjqdyQ6lAl6yHOZR0j04QJi5OkB5VKA=";

  checkFlags =
    let
@@ -73,7 +73,7 @@ buildGoModule (finalAttrs: {
    versionCheckHook
  ];
  doInstallCheck = true;
-  versionCheckProgram = "${placeholder "out"}/bin/hugo";
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
  versionCheckProgramArg = "version";

  passthru.updateScript = nix-update-script { };
--- a/pkgs/by-name/in/inkycap/package.nix
+++ b/pkgs/by-name/in/inkycap/package.nix
@@ -0,0 +1,135 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromForgejo,
+  buildNpmPackage,
+  cargo-tauri,
+  glib-networking,
+  gst_all_1,
+  libayatana-appindicator,
+  libsecret,
+  nodejs,
+  perl,
+  pkg-config,
+  tinymist,
+  webkitgtk_4_1,
+  wrapGAppsHook4,
+}:
+
+let
+  version = "26.9.6";
+  src = fetchFromForgejo {
+    domain = "codefloe.com";
+    owner = "InkyCap";
+    repo = "app";
+    tag = "v${version}";
+    hash = "sha256-X4KjRHUDYx0C61gBa5vr9i1u0DOZok1AUTwe6srVhy4=";
+  };
+  changelog = "https://codefloe.com/InkyCap/app/releases/tag/v${version}";
+  homepage = "http://inkycap.org/";
+  license = lib.licenses.liliq-p-11;
+  maintainers = with lib.maintainers; [ luker ];
+
+  # from TINYMIST_VERSION in scripts/download-tinymist.sh.
+  # developer says it should work with newer version, but no guarantees.
+  requiredTinymistVersion = "0.15.2";
+
+  frontend = buildNpmPackage (finalAttrs: {
+    pname = "inkycap-frontend";
+    inherit version src;
+
+    npmDepsHash = "sha256-vXf4W3U5EIzqHRdUkIy1z+0+umMbR1AflQ31pJCo37M=";
+
+    # The npm hook installs with `npm ci --ignore-scripts`, so the
+    # postinstall script (patch-package) never runs. Apply the patches
+    # from patches/ explicitly, before the bundle.
+    preBuild = ''
+      ./node_modules/.bin/patch-package
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      cp -r dist $out
+      runHook postInstall
+    '';
+
+    meta = {
+      inherit
+        changelog
+        homepage
+        license
+        maintainers
+        ;
+      description = "Frontend assets for InkyCap";
+    };
+  });
+in
+assert (builtins.compareVersions requiredTinymistVersion tinymist.version) <= 0;
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "inkycap";
+  inherit version src;
+
+  __structuredAttrs = true;
+
+  cargoRoot = "src-tauri";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src cargoRoot;
+    hash = "sha256-NHlLURI2O2W28gAWGZd6Hx7lWOXn8LNeoiubReRA5Bo=";
+  };
+  buildAndTestSubdir = "src-tauri";
+
+  nativeBuildInputs = [
+    cargo-tauri.hook
+    pkg-config
+    perl
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    glib-networking
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-libav
+    libayatana-appindicator
+    libsecret
+    webkitgtk_4_1
+  ];
+
+  postPatch = ''
+    # Tauri expects sidecars as binaries/<name>-<triple>.
+    # make sure nixpkgs version and package version are synchronized
+    install -Dm755 ${tinymist}/bin/tinymist \
+      "src-tauri/binaries/inkycap-tinymist-${stdenv.hostPlatform.rust.rustcTargetSpec}"
+
+    cp -r ${frontend} dist
+
+    # The frontend is already built; drop beforeBuildCommand so the
+    # tauri CLI does not re-run `npm run build`
+    substituteInPlace src-tauri/tauri.conf.json \
+      --replace-fail '"beforeBuildCommand": "npm run build"' "" \
+      --replace-fail '"beforeDevCommand": "npm run dev",' '"beforeDevCommand": "npm run dev"'
+  '';
+
+  doCheck = false;
+
+  meta = {
+    inherit
+      changelog
+      homepage
+      license
+      maintainers
+      ;
+    description = "Personal knowledge management (PKM) tool that uses Typst markup";
+    longDescription = ''
+      InkyCap is a personal knowledge management tool that helps you explore
+      ideas and write. Tailored for academic workflows, research, writing,
+      task and date awareness; InkyCap provides flexible ways to organize
+      your information.
+    '';
+    platforms = lib.platforms.linux;
+    mainProgram = "inkycap";
+  };
+})
--- a/pkgs/by-name/io/iocaine/package.nix
+++ b/pkgs/by-name/io/iocaine/package.nix
@@ -1,32 +1,48 @@
 {
-  stdenv,
  lib,
-  rustPlatform,
  fetchFromGitea,
+  nftables,
+  nixosTests,
+  pkg-config,
+  rustPlatform,
+  ...
 }:
-
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "iocaine";
-  version = "2.5.1";
+  version = "3.5.1";

  src = fetchFromGitea {
    domain = "git.madhouse-project.org";
    owner = "iocaine";
    repo = "iocaine";
    tag = "iocaine-${finalAttrs.version}";
-    hash = "sha256-213QLpGBKSsT9r8O27PyMom5+OGPz0VtRBevxswISZA=";
+    hash = "sha256-FkIgrptTiYZwHBa6blFeB4HrgTpMREbW004hKpcAKx0=";
  };

-  cargoHash = "sha256-EgPGDlJX/m+v3f/tGIO+saGHoYrtiWLZuMlXEvsgnxE=";
+  cargoHash = "sha256-GHveoZ19VaQie9D9i+yoKevB/cnxKd7GLnNOZcAqtJ0=";
+
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    nftables
+  ];
+
+  passthru = {
+    tests = { inherit (nixosTests) iocaine; };
+  };

  meta = {
    description = "Deadliest poison known to AI";
    homepage = "https://iocaine.madhouse-project.org/";
    changelog = "https://git.madhouse-project.org/iocaine/iocaine/src/tag/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ sugar700 ];
    mainProgram = "iocaine";
-    # Lacking OS access to fix, and upstream doesn't support macOS.
-    broken = stdenv.hostPlatform.isDarwin;
  };
 })
--- a/pkgs/by-name/ja/jabcode/package.nix
+++ b/pkgs/by-name/ja/jabcode/package.nix
@@ -17,7 +17,7 @@ let
 in
 stdenv.mkDerivation {
  pname = "jabcode-${subproject}";
-  version = "unstable-2022-06-17";
+  version = "0-unstable-2022-06-17";
  src = fetchFromGitHub {
    repo = "jabcode";
    owner = "jabcode";
--- a/pkgs/by-name/ku/kubelogin-oidc/package.nix
+++ b/pkgs/by-name/ku/kubelogin-oidc/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "kubelogin";
-  version = "1.36.3";
+  version = "1.36.4";

  src = fetchFromGitHub {
    owner = "int128";
    repo = "kubelogin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VgsUQcFUbtZSZuar7K/ErJRsJZ0GvyIEixGGhF+hLnY=";
+    hash = "sha256-z0tHU+ZBxaE6VkACvYeQwkQ5CC2C4w+A41Xl24HLE8E=";
  };

  subPackages = [ "." ];
@@ -24,7 +24,7 @@ buildGoModule (finalAttrs: {
    "-X main.version=v${finalAttrs.version}"
  ];

-  vendorHash = "sha256-29D31EKO2Y6TXj607Tf3O5dGBHyrMyXoC5tWEKqvbbA=";
+  vendorHash = "sha256-LDAzmzcTcxCANgMLqQaDeJiGy+U93xhCIBiEs0mJ9aQ=";

  # test all packages
  preCheck = ''
--- a/pkgs/by-name/li/libretroPackages/cores/pcsx-rearmed.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/pcsx-rearmed.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "pcsx-rearmed";
-  version = "0-unstable-2026-08-27";
+  version = "0-unstable-2026-09-05";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "pcsx_rearmed";
-    rev = "ba61a4fdee1f789e8012f205f1b63826667644fa";
-    hash = "sha256-9PpQiEn+IyteazYXOo9DhcbJh+pguWlYmDLIvLqYI6w=";
+    rev = "8625c395a24411f8c77e69802b516df9c613a712";
+    hash = "sha256-Kup3qx3/ylAEO7lwjdesLkOclcqJN8UMeB5OFIaax5c=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/li/libretroPackages/cores/prosystem.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/prosystem.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "prosystem";
-  version = "0-unstable-2026-06-04";
+  version = "0-unstable-2026-08-22";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "prosystem-libretro";
-    rev = "363b6dfbd3e240762e022c2b4897b4fe55722be3";
-    hash = "sha256-5KNxBCZq4BfBo5pF4tBzJNNyatrVQH4kmXmcyQcIPSY=";
+    rev = "8a88014287c7a01cd568067e5a557d0a2b2a051f";
+    hash = "sha256-xvfx/bypYiPal92v4m7xBRtnlKzYYtDXyRFebJpAVQQ=";
  };

  makefile = "Makefile";
--- a/pkgs/by-name/ls/lstk/package.nix
+++ b/pkgs/by-name/ls/lstk/package.nix
@@ -7,7 +7,7 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "lstk";
-  version = "0.22.2";
+  version = "1.0.1";

  __structuredAttrs = true;

@@ -15,10 +15,10 @@ buildGoModule (finalAttrs: {
    owner = "localstack";
    repo = "lstk";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-Yy3LmKih91bXsa2wbBgGGNP6VhYBSD/3FFeU6WN15ek=";
+    sha256 = "sha256-QXc/VVejMgf3UdSmy6Xl6zZud+559/l4RFYc16zlNBw=";
  };

-  vendorHash = "sha256-wA59wFUoNW4NqAUI2MAGyF2g4vhX4++vlSAqwuXK4U4=";
+  vendorHash = "sha256-AQ2hQ1PYqd0gFBr0Bhxe7F6RxoC9QVsoNmBWxWbMSuw=";

  excludedPackages = "test/integration";

--- a/pkgs/by-name/ma/mackup/package.nix
+++ b/pkgs/by-name/ma/mackup/package.nix
@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "mackup";
-  version = "0.11.1";
+  version = "0.11.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "lra";
    repo = "mackup";
    rev = "${finalAttrs.version}";
-    hash = "sha256-qr/+Ot2mGRn/uZ2h6mOoNKS0Oeik0mBgpV2Kt3Lc6yg=";
+    hash = "sha256-+pdeG3uoNC3LCTyxWnBZ8U1pDIMKpws/Y62VrLtNghY=";
  };

  postPatch = ''
--- a/pkgs/by-name/ma/martin/package.nix
+++ b/pkgs/by-name/ma/martin/package.nix
@@ -47,18 +47,18 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "martin";
-  version = "1.14.0";
+  version = "1.16.1";

  src = fetchFromGitHub {
    owner = "maplibre";
    repo = "martin";
    tag = "martin-v${finalAttrs.version}";
-    hash = "sha256-XvGBLs6jIvVWtfjiwu7GHpflnAW5D3j6FjzP+AIpsvQ=";
+    hash = "sha256-VFBdFTquqTOJQUl3m3pu5sPD8z7kvuQMclKcOhC5qGc=";
  };

  patches = [ ./dont-build-webui.patch ];

-  cargoHash = "sha256-2xAdqSZmbsTpO9lfDuyk2v6mtTwxSgtwhx3R8VMQ3lA=";
+  cargoHash = "sha256-p5sAkmMTirMdmXnVb2aqGKhPYpX/uluvzq0uw4W1Bt8=";

  webui = buildNpmPackage {
    pname = "martin-ui";
@@ -72,7 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      ln -sf ${finalAttrs.src}/demo/frontend/public/favicon.ico public/_/assets/favicon.ico
    '';

-    npmDepsHash = "sha256-cK/glIbXuGsXuCbGSMqVGh8vkIOPNbm6BoDMTc/TSWg=";
+    npmDepsHash = "sha256-ngYv8qtpUEiseE//tDauzvTzWJxyN2QMYvyV6ObsSvc=";

    buildPhase = ''
      runHook preBuild
--- a/pkgs/by-name/me/memtree/package.nix
+++ b/pkgs/by-name/me/memtree/package.nix
@@ -46,5 +46,6 @@ python3Packages.buildPythonApplication {
    maintainers = with lib.maintainers; [ nicoo ];
    mainProgram = "memtree";
    platforms = lib.platforms.linux;
+    license = lib.licenses.isc;
  };
 }
--- a/pkgs/by-name/me/metapac/package.nix
+++ b/pkgs/by-name/me/metapac/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "metapac";
-  version = "0.10.1";
+  version = "0.10.2";

  src = fetchFromGitHub {
    owner = "ripytide";
    repo = "metapac";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6Nw4CUTx0/KcHHguRrUH6Sa+DZhPJqdsTEeVBb0eEqw=";
+    hash = "sha256-VVDN+s6UNoLM5QywHGcSMVcgFFgnuJcCcCNm/KJ9wqQ=";
  };

-  cargoHash = "sha256-hUd9qWXXErOyJV0mjmkMUb8KPuUhp1XI3GNYwpt1Xow=";
+  cargoHash = "sha256-ze1oOYD8gUS4mlW/+VFfyzdo7rd10uKFmt3JhUsA32o=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
--- a/pkgs/by-name/mi/miracle-wm/package.nix
+++ b/pkgs/by-name/mi/miracle-wm/package.nix
@@ -2,6 +2,7 @@
  stdenv,
  lib,
  fetchFromGitHub,
+  fetchpatch,
  gitUpdater,
  nixosTests,
  boost,
@@ -45,7 +46,21 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-htFgvXYgxQXV2U3F+tXEoaTb0udc2H1aHsIg5E8nRL8=";
  };

+  patches = [
+    # Mir 2.29 compat, remove when version > 0.10.1
+    (fetchpatch {
+      name = "0001-miracle-wm-remove-legacy-mir-optional-usage.patch";
+      url = "https://github.com/miracle-wm-org/miracle-wm/commit/a4d7b21e0d25667cd270d7ff52f8dccc2a217796.patch";
+      hash = "sha256-XBbYSuXUOS9Gbs/LwxbbTAVsFuH8xLj8VhoCAjmCDfQ=";
+    })
+  ];
+
+  # Mir 2.29 compat, remove when version > 0.10.1 (97a40cd8879898062b2cf7b5d1f5252ffc3b8dce is more than just a compat change)
  postPatch = ''
+    substituteInPlace src/policy.{cpp,h} \
+      --replace-fail 'handle_raise_window' 'handle_activate_window'
+  ''
+  + ''
    substituteInPlace CMakeLists.txt \
      --replace-fail 'DESTINATION lib' 'DESTINATION ''${CMAKE_INSTALL_LIBDIR}' \
      --replace-fail '-march=native' '# -march=native'
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@@ -31,13 +31,13 @@ in

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "modrinth-app-unwrapped";
-  version = "0.19.1";
+  version = "0.20.2";

  src = fetchFromGitHub {
    owner = "modrinth";
    repo = "code";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-71Irrg5rAAil82z3ezPOI/SpqbdrPpWNZTk4zn9FNU0=";
+    hash = "sha256-PAoRh9McFvX3+F3KdwXoDbgTsrQEnhGIvA0XWCAKn2A=";
  };

  patches = [
@@ -67,7 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '1.0.0-local' '${finalAttrs.version}'
  '';

-  cargoHash = "sha256-7Kl3sQe+A/68yjzX5F9o60x2JehETn7blMScKIr/f9U=";
+  cargoHash = "sha256-HQYHggmfKlzhgKoP/lnC8wlcUc5BQ8sAjgaKuTUZZus=";

  mitmCache = gradle.fetchDeps {
    inherit (finalAttrs) pname;
@@ -78,7 +78,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-I1tFnuMlKn+67drRN1ZajA6j5b21yn+mAxWguWB885Q=";
+    hash = "sha256-A8mxLcpBX82iZkC66XhdziOvzLxEALEdFw3MBoLLNoo=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mu/music-assistant-desktop/package.nix
+++ b/pkgs/by-name/mu/music-assistant-desktop/package.nix
@@ -33,13 +33,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "music-assistant-desktop";
-  version = "0.6.5";
+  version = "0.6.8";

  src = fetchFromGitHub {
    owner = "music-assistant";
    repo = "desktop-app";
    tag = finalAttrs.version;
-    hash = "sha256-zTghc35CSazSfG2SvoigH+3qF7LcwpzrE5FP90I1gq0=";
+    hash = "sha256-oK6yl3no4OZmAz9F2lGtNLtMi8AK8yWp5DpcMT1HvWw=";
  };

  patches = [
@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  cargoRoot = "src-tauri";
  buildAndTestSubdir = finalAttrs.cargoRoot;

-  cargoHash = "sha256-18ZS8lmPMCTZU/UAg9gk6I7Ele2XbWCqf9O0L9xxwzE=";
+  cargoHash = "sha256-4gyxKLg+8OACYzRt1pM3COMGeyTx8gyihdjnxZzIIk8=";

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -4,7 +4,7 @@
  nixosTests,
  fetchFromGitHub,
  nodejs,
-  pnpm_10,
+  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
  python3,
@@ -27,25 +27,25 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "n8n";
-  version = "2.36.7";
+  version = "2.37.10";

  src = fetchFromGitHub {
    owner = "n8n-io";
    repo = "n8n";
    tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-g0cIcvs3HMypQ0Y52R27GUGH03r6U4p0htLHUh5CIOA=";
+    hash = "sha256-cEWwXiyBLiZ8MgH5OKe0+hgd9ooYZTDQIuS4Dq0nKos=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
+    pnpm = pnpm_11;
    fetcherVersion = 4;
-    hash = "sha256-bzYKeZ5ruIef62FnCG0mtnT9ssn/EETmUqGCA8GhkxQ=";
+    hash = "sha256-T1axKjZT1I8NjXFV8hAKSYa+zCl/Fpyzz2DGM+cmkLQ=";
  };

  nativeBuildInputs = [
    pnpmConfigHook
-    pnpm_10
+    pnpm_11
    python3 # required to build sqlite3 bindings
    node-gyp # required to build sqlite3 bindings
    makeWrapper
@@ -88,7 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
    rm node_modules/.modules.yaml
    rm packages/nodes-base/dist/types/nodes.json

-    CI=true pnpm --ignore-scripts prune --prod
+    CI=true pnpm --ignore-scripts prune --prod -w
    find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
    rm -rf node_modules/.pnpm/{typescript*,prettier*}
    shopt -s globstar
--- a/pkgs/by-name/na/nar-serve/package.nix
+++ b/pkgs/by-name/na/nar-serve/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "nar-serve";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "numtide";
    repo = "nar-serve";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-C9MBCN/ResbYjmRkT65m8XnNbquoZ0PC/zx/Y7QFXkA=";
+    hash = "sha256-72gY3V9XLi+qZWDH3ARR2DLEYC3cszYkAVBBBRTNcrM=";
  };

-  vendorHash = "sha256-BP14jmOZ2MCugeTgbDR8wSZ8sRWt4QUWrH3+e2FBgqU=";
+  vendorHash = "sha256-sms5yAbbc6PN02DFFRTktjaryDF/h+3b14BC+ZwMBOA=";

  doCheck = false;

--- a/pkgs/by-name/nu/nufmt/package.nix
+++ b/pkgs/by-name/nu/nufmt/package.nix
@@ -7,13 +7,13 @@
 }:
 rustPlatform.buildRustPackage {
  pname = "nufmt";
-  version = "0-unstable-2026-08-12";
+  version = "0-unstable-2026-09-03";

  src = fetchFromGitHub {
    owner = "nushell";
    repo = "nufmt";
-    rev = "7cfd3b7eacf5a9feb22777230e3076038f2e9e8d";
-    hash = "sha256-v490Rlrih2R1zyGlHbOWzOFn5UTNb6Wx3v7LKLxXahY=";
+    rev = "08f332ba7abe915575dd0588e7a528a774906b92";
+    hash = "sha256-klrQf+myTOUt4NwyF7T/8e01O1+fe7UeNgd6pQBE14g=";
  };

  nativeBuildInputs = [
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage {

  cargoHash = "sha256-Fb2A9DcYCIdSWrFg4MqkZJ6ev4VQ/VwrBtZoJLEBOHc=";

-  # NOTE: Patch follows similar intention upstream https://github.com/nushell/nufmt/commit/7cfd3b7eacf5a9feb22777230e3076038f2e9e8d
+  # NOTE: Patch follows similar intention upstream https://github.com/nushell/nufmt/commit/074930a23bc89a5f720a0d46ac2853f3153817c2
  postPatch = ''
    substituteInPlace tests/ground_truth.rs --replace-fail \
      '        let path = PathBuf::from(target_dir).join("debug").join(exe_name);' \
--- a/pkgs/by-name/ox/oxigraph/package.nix
+++ b/pkgs/by-name/ox/oxigraph/package.nix
@@ -14,17 +14,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "oxigraph";
-  version = "0.5.10";
+  version = "0.5.11";

  src = fetchFromGitHub {
    owner = "oxigraph";
    repo = "oxigraph";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2mThlPqjUJ3FuqzGRTfrN8af1NupSgdbWomyL5aMJTA=";
+    hash = "sha256-eeLs92CqiijIrBwGGNmyDvAGVZASyT33XOX3/G90yAA=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-iDt9wHJr6PMXGuCvLJqK9bRb3Y5gjuuSYdPhQofeJFQ=";
+  cargoHash = "sha256-2+GTh77DDlCJGWRWUPZhSgD5l5VPu/N3JJ/4FaNUpUc=";

  nativeBuildInputs = [
    rustPlatform.bindgenHook
--- a/pkgs/by-name/po/poedit/package.nix
+++ b/pkgs/by-name/po/poedit/package.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://www.poedit.net/";
    license = lib.licenses.mit;
    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ dasj19 ];
+    maintainers = with lib.maintainers; [ RumBugen ];
    # configure: error: GTK+ build of wxWidgets is required
    broken = stdenv.hostPlatform.isDarwin;
  };
--- a/pkgs/by-name/ri/rime-moegirl/package.nix
+++ b/pkgs/by-name/ri/rime-moegirl/package.nix
@@ -5,10 +5,10 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "rime-moegirl";
-  version = "20260812";
+  version = "20260911";
  src = fetchurl {
    url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict.yaml";
-    hash = "sha256-WDbIdQdBX03NsPxFrs9N166CGDplDN15MOHmY+MuOiQ=";
+    hash = "sha256-FhFH9wfUab5/X2DyRzWqwr+geCE84ijmfVloEOM1Lg0=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/sa/saucectl/package.nix
+++ b/pkgs/by-name/sa/saucectl/package.nix
@@ -2,12 +2,16 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  versionCheckHook,
 }:

 buildGoModule (finalAttrs: {
  pname = "saucectl";
  version = "0.214.0";

+  __darwinAllowLocalNetworking = true;
+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "saucelabs";
    repo = "saucectl";
@@ -24,6 +28,9 @@ buildGoModule (finalAttrs: {

  checkFlags = [ "-skip=^TestNewRequestWithContext$" ];

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
  meta = {
    description = "Command line interface for the Sauce Labs platform";
    changelog = "https://github.com/saucelabs/saucectl/releases/tag/v${finalAttrs.version}";
--- a/pkgs/by-name/se/setbfree/package.nix
+++ b/pkgs/by-name/se/setbfree/package.nix
@@ -15,7 +15,7 @@
  nix-update-script,
 }:
 let
-  version = "0.8.16";
+  version = "0.8.17";
 in
 stdenv.mkDerivation {
  pname = "setbfree";
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
    owner = "pantherb";
    repo = "setBfree";
    rev = "v${version}";
-    hash = "sha256-bfmCNoTINFEqGKsnef8+gS8PGTAuogyikL9HzpMjKaI=";
+    hash = "sha256-MjbgN0WIZtoFjEtjYa0MkTtaub/oNSxQ0i8EedBbTGA=";
  };

  postPatch = ''
--- a/pkgs/by-name/st/stackwhere/package.nix
+++ b/pkgs/by-name/st/stackwhere/package.nix
@@ -8,7 +8,7 @@

 buildGoModule (finalAttrs: {
  pname = "stackwhere";
-  version = "0.3.2";
+  version = "0.4.0";

  __structuredAttrs = true;
  __darwinAllowLocalNetworking = true;
@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
    owner = "cilium";
    repo = "stackwhere";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-g1CnWA8WNRHaGXMm+Ksi3AnkFJCy9/bjQbhYjrOlu1M=";
+    hash = "sha256-Ofg0ibDG7QI5eESvKl1U8SNq8567aSo79/Iiuj2UaoM=";
  };

  vendorHash = "sha256-J2X1uTkRtmdmo8Fxxql6Nu84F6MarWHFTopavUPL+RU=";
--- a/pkgs/tools/system/testdisk/default.nix
+++ b/pkgs/tools/system/testdisk/default.nix
@@ -5,7 +5,6 @@
  ncurses,
  libuuid,
  pkg-config,
-  wrapQtAppsHook,
  libjpeg,
  zlib,
  libewf-legacy,
@@ -14,16 +13,12 @@
  enableExtFs ? !stdenv.hostPlatform.isDarwin,
  e2fsprogs ? null,
  enableQt ? false,
-  qtbase ? null,
-  qttools ? null,
-  qwt ? null,
+  qt5,
+  libsForQt5,
 }:

 assert enableNtfs -> ntfs3g != null;
 assert enableExtFs -> e2fsprogs != null;
-assert enableQt -> qtbase != null;
-assert enableQt -> qttools != null;
-assert enableQt -> qwt != null;

 stdenv.mkDerivation rec {
  pname = "testdisk";
@@ -50,15 +45,15 @@ stdenv.mkDerivation rec {
  ++ lib.optional enableNtfs ntfs3g
  ++ lib.optional enableExtFs e2fsprogs
  ++ lib.optionals enableQt [
-    qtbase
-    qttools
-    qwt
+    qt5.qtbase
+    qt5.qttools
+    libsForQt5.qwt
  ];

  nativeBuildInputs = [
    pkg-config
  ]
-  ++ lib.optional enableQt wrapQtAppsHook;
+  ++ lib.optional enableQt qt5.wrapQtAppsHook;

  env.NIX_CFLAGS_COMPILE = "-Wno-unused";

--- a/pkgs/by-name/tz/tzf-rs/package.nix
+++ b/pkgs/by-name/tz/tzf-rs/package.nix
@@ -6,7 +6,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tzf-rs";
-  version = "1.3.7";
+  version = "2.0.0";

  __structuredAttrs = true;

@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "ringsaturn";
    repo = "tzf-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YFDoNlBLeFqv2aGa4Wbd9CwDAz6FOd+8OjSksGzzzlI=";
+    hash = "sha256-t/LleWuSu8czVhs0GqvgmoL8u0A6t7hcuNKDkKAy0Hc=";
  };

  buildFeatures = [
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "export-geojson"
  ];

-  cargoHash = "sha256-FehvfC5cvmTjMqUR0nTkcUDC/IK+e5S/snKMI9OBJaM=";
+  cargoHash = "sha256-FpoXDbCufkm4FrqZHINZkJ79TA6vGDRaerousVY7HcA=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/ub/ubridge/package.nix
+++ b/pkgs/by-name/ub/ubridge/package.nix
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ubridge";
-  version = "1.2.1";
+  version = "1.2.3";

  src = fetchFromGitHub {
    owner = "GNS3";
    repo = "ubridge";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1dPHolK7eJimqolntBZK5k6e4CykeuvbU48iN3RN4bw=";
+    hash = "sha256-d/5E3JRel5/DGsowg10YxRX7JzcmuwtdP3Jo38GjwEc=";
  };

  postPatch = ''
--- a/pkgs/by-name/va/vals/package.nix
+++ b/pkgs/by-name/va/vals/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "vals";
-  version = "0.46.0";
+  version = "0.46.1";

  src = fetchFromGitHub {
    rev = "v${finalAttrs.version}";
    owner = "helmfile";
    repo = "vals";
-    sha256 = "sha256-aDFCJaAhZNxo/E++/yFeqeTttvmT4FHhcFzSV6Mn2ck=";
+    sha256 = "sha256-WLtr2KllSbCwHmepsW8IrTQ3mzgyS2QOmqteZTaePDA=";
  };

-  vendorHash = "sha256-eVoKsXFtvfGU3XUH+U9PKPYGCDNyGGrj8F0EANonkuY=";
+  vendorHash = "sha256-iaYbTVrtyOfudEQ9eejFfkr+3oZ9jPRg6Xm5Yyyqda8=";

  proxyVendor = true;

--- a/pkgs/by-name/ve/verapdf/package.nix
+++ b/pkgs/by-name/ve/verapdf/package.nix
@@ -100,9 +100,8 @@ maven.buildMavenPackage rec {
    changelog = "https://github.com/veraPDF/veraPDF-library/blob/${src.tag}/RELEASENOTES.md";
    description = "Command line and GUI industry supported PDF/A and PDF/UA Validation";
    homepage = "https://github.com/veraPDF/veraPDF-apps";
-    license = [
+    license = lib.licenses.OR [
      lib.licenses.gpl3Plus
-      # or
      lib.licenses.mpl20
    ];
    maintainers = [
--- a/pkgs/by-name/vi/virter/package.nix
+++ b/pkgs/by-name/vi/virter/package.nix
@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "virter";
-  version = "1.3.0";
+  version = "1.3.2";

  src = fetchFromGitHub {
    owner = "LINBIT";
    repo = "virter";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-i0PDZo1vRatOiBdGLhEAy9KIt+bNp94JASKf8HTkhMg=";
+    hash = "sha256-/8fsYadyXUM9N/rDKsv1dNnfngKGC1LyJkSja8Cue0I=";
  };

-  vendorHash = "sha256-XOMxe+pG4OB15l+TKuYR2tJPPcPbsnipxHlnDH0XukA=";
+  vendorHash = "sha256-3zl9y8MITJGw3wBhCQgvFcq7hxsSTtUAD0w2B+aSIyM=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/wa/wasmer/package.nix
+++ b/pkgs/by-name/wa/wasmer/package.nix
@@ -61,7 +61,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "wasmer";
-  version = "7.4.0";
+  version = "7.4.1";

  __structuredAttrs = true;
  strictDeps = true;
@@ -70,13 +70,13 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "wasmerio";
    repo = "wasmer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-IfrwkJQEOHxXS/Ly/rn4xus7CROc9vv3MNDIHhzU7hU=";
+    hash = "sha256-W84XhGPLwnsWvyP5gRKznNpBMgTWtbQ1XNhN/2M/qp4=";
    fetchSubmodules = true;
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-xIgF+RkbIcxv2Q8+Hy242X9BitVZq3QQ81SN2WbQ75w=";
+    hash = "sha256-KBTIhL7P9H9RGziz+42lssYAyG9fYvwjEZAXWommN8w=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/wa/wayland-proxy-virtwl/package.nix
+++ b/pkgs/by-name/wa/wayland-proxy-virtwl/package.nix
@@ -9,13 +9,13 @@

 ocamlPackages.buildDunePackage {
  pname = "wayland-proxy-virtwl";
-  version = "0-unstable-2026-08-22";
+  version = "0-unstable-2026-09-04";

  src = fetchFromGitHub {
    owner = "talex5";
    repo = "wayland-proxy-virtwl";
-    rev = "3d092ebcaaa07ce56c47d05039be2ff8d7721486";
-    sha256 = "sha256-9FB/euTCGaxMF7lVs+KYkH1NiSmpo+TmWiv/waw6KXg=";
+    rev = "aa515e518a9e0de117d3b77b7e9db91aea7dcfbc";
+    sha256 = "sha256-VIm6jr9SfACtCQjrmELy64wECpuTjxQ3WlTQBL64rXI=";
  };

  minimalOCamlVersion = "5.0";
--- a/pkgs/by-name/xa/xan/package.nix
+++ b/pkgs/by-name/xa/xan/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "xan";
-  version = "0.60.0";
+  version = "0.61.0";

  src = fetchFromGitHub {
    owner = "medialab";
    repo = "xan";
    tag = finalAttrs.version;
-    hash = "sha256-CexefTLr8K6rNtXE8dog0cA4OlRa/uReK1HJrx471+4=";
+    hash = "sha256-Z8sEwoM0RdUqN4rlc8PP1D5046405UqtBD7RU+ybKlU=";
  };

-  cargoHash = "sha256-WGva0hf0eB/4VUPsNQZJnAW2uWctsVLqSsYkuoreMog=";
+  cargoHash = "sha256-dw8KlbCTK+K8okT88CbZieM/BmFDAKmGClirazRMEuI=";

  # FIXME: tests fail and I do not have the time to investigate. Temporarily disable
  # tests so that we can manually run and test the package for packaging purposes.
--- a/pkgs/by-name/ze/zeno/package.nix
+++ b/pkgs/by-name/ze/zeno/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "zeno";
-  version = "2.0.26";
+  version = "2.0.27";

  src = fetchFromGitHub {
    owner = "internetarchive";
    repo = "Zeno";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DuiAQKG25qFiGCAyZF9IonOGE/IZyDbowI/ZYdoQqIg=";
+    hash = "sha256-TxizytoXeZmgKUkLOqWUHSA7rNCAW43FQlC5KpbLe50=";
  };

-  vendorHash = "sha256-BBPhbJT99b/rPyrGrEKAWs3/YRGVFBMOMiC1FzbIlLI=";
+  vendorHash = "sha256-SgC8wZr2BHGXT2Oul3/YqX0H9XMpFBaA6GCQPfRkxY4=";

  env.CGO_ENABLED = true;
  ldFlags = [
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -443,5 +443,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = if enableGplPlugins then lib.licenses.gpl2Plus else lib.licenses.lgpl2Plus;
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
  };
 })
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -240,5 +240,6 @@ stdenv.mkDerivation (finalAttrs: {
    );
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
  };
 })
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -146,6 +146,26 @@ stdenv.mkDerivation (finalAttrs: {
      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
    };
    updateScript = directoryListingUpdater { odd-unstable = true; };
+
+    # From around version 1.12.0 on, there is a single CPE identifier for all of GStreamer.
+    # FIXME: Should gst-plugins-rs follow the main GStreamer versioning or its own deviating version?
+    gstreamerCpeParts =
+      let
+        commonGstreamerVersion = finalAttrs.version;
+      in
+      version:
+      lib.warnIf (version != commonGstreamerVersion)
+        ''
+          Detected mismatch between common GStreamer version (${commonGstreamerVersion}) and version used for gstreamerCpeParts (${version}).
+          Note that GStreamer uses a common CPE identifier for its components.
+          Having a deviating version is unusual, but may occur e.g. if overriding a subset of GStreamer libraries.
+        ''
+        (
+          lib.meta.cpeFullVersionWithVendor "gstreamer" version
+          // {
+            product = "gstreamer";
+          }
+        );
  };

  meta = {
@@ -159,5 +179,6 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [
      tmarkus
    ];
+    identifiers.cpeParts = finalAttrs.passthru.gstreamerCpeParts finalAttrs.version;
  };
 })
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -132,5 +132,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.lgpl2Plus;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
  };
 })
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -14,6 +14,8 @@
  flex,
  gettext,
  gobject-introspection,
+  # for passthru.gstreamerCpeParts
+  gstreamer,
  # Checks meson.is_cross_build(), so even canExecute isn't enough.
  enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
  hotdoc,
@@ -93,5 +95,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.lgpl2Plus;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
  };
 })
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -61,6 +61,8 @@
  wavpack,
  glib,
  openssl,
+  # for passthru.gstreamerCpeParts
+  gstreamer,
  # Checks meson.is_cross_build(), so even canExecute isn't enough.
  enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
  hotdoc,
@@ -306,5 +308,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.lgpl2Plus;
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
  };
 })
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -75,5 +75,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.lgpl2Plus;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
  };
 })
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -10,6 +10,8 @@
  gobject-introspection,
  gst-plugins-base,
  gst-plugins-bad,
+  # only for passthru.gstreamerCpeParts
+  gstreamer,
  # Checks meson.is_cross_build(), so even canExecute isn't enough.
  enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
  hotdoc,
@@ -82,6 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
      A library on top of GStreamer for building an RTSP server.
    '';
    license = lib.licenses.lgpl2Plus;
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ bkchr ];
  };
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -17,6 +17,8 @@
  libintl,
  lib,
  enableGplPlugins ? true,
+  # only for passthru.gstreamerCpeParts
+  gstreamer,
  # Checks meson.is_cross_build(), so even canExecute isn't enough.
  enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
  hotdoc,
@@ -122,6 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
      like. The code might be widely known to present patent problems.
    '';
    license = if enableGplPlugins then lib.licenses.gpl2Plus else lib.licenses.lgpl2Plus;
+    identifiers.cpeParts = gstreamer.passthru.gstreamerCpeParts finalAttrs.version;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ tmarkus ];
  };
--- a/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix
+++ b/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix
@@ -16,21 +16,25 @@

 buildPythonPackage rec {
  pname = "bgutil-ytdlp-pot-provider";
-  version = "1.3.1";
+  version = "2.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Brainicism";
    repo = "bgutil-ytdlp-pot-provider";
    tag = version;
-    hash = "sha256-dhpataQ1HSCRPnm4k3K/NMaQPQdNrx8C4q855l7kbbQ=";
+    hash = "sha256-mmcRzTLzdjI/zHArUMPkhQ4uKmYhabiG7RpvH4IBxjc=";
  };

+  postPatch = ''
+    cp README.md plugin/README.md
+  '';
+
  npmDeps = fetchNpmDeps {
    name = "${pname}-${version}-npm-deps";
    src = src + "/server";
-    npmDepsFetcherVersion = 2;
-    hash = "sha256-Qwwi6W+Oeu6ZeLmZP5vEfAKOJyivbULR5mlk7tcVIE8=";
+    npmDepsFetcherVersion = 3;
+    hash = "sha256-1yrRJQ53v4LxzEsc6VODrKgzCdELyMCVfwyCLZSzWek=";
  };

  npmRoot = "server";
--- a/pkgs/development/python-modules/diskcache/default.nix
+++ b/pkgs/development/python-modules/diskcache/default.nix
@@ -3,24 +3,29 @@
  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  pytest-cov-stub,
  pytest-django,
  pytest-xdist,
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "diskcache";
  version = "5.6.3";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "grantjenks";
    repo = "python-diskcache";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-1cDpdf+rLaG14TDd1wEHAiYXb69NFTFeOHD1Ib1oOVY=";
  };

+  build-system = [ setuptools ];
+
  nativeCheckInputs = [
    pytest-cov-stub
    pytest-django
@@ -48,4 +53,4 @@ buildPythonPackage rec {
    license = lib.licenses.asl20;
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/development/python-modules/lifx-async/default.nix
+++ b/pkgs/development/python-modules/lifx-async/default.nix
@@ -15,14 +15,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "lifx-async";
-  version = "5.4.9";
+  version = "5.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Djelibeybi";
    repo = "lifx-async";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DWclqWrCoUfFC2gu1CbrqHxx4BFP1jV597c4llq2B5A=";
+    hash = "sha256-MFXWleTbyrmw29s/s4j3ypRbL6g5/ibImrhuu25i8OA=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/nidaqmx/default.nix
+++ b/pkgs/development/python-modules/nidaqmx/default.nix
@@ -23,14 +23,14 @@

 buildPythonPackage rec {
  pname = "nidaqmx";
-  version = "1.4.0";
+  version = "1.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ni";
    repo = "nidaqmx-python";
    tag = version;
-    hash = "sha256-Khydb14+yJKWYcO4pROfbainXw3bHceXK5Gc9GCIYNo=";
+    hash = "sha256-dxSHaqNTzzMcUk/wtMtxmiHMpoL8f2T3p/h37tw/5AA=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "nomadnet";
-  version = "1.4.2";
+  version = "1.4.3";
  pyproject = true;

  __structuredAttrs = true;

  src = fetchPypi {
    inherit (finalAttrs) version pname;
-    hash = "sha256-d3fueyrzCpB66c4CZiH6AyIEFZq75Vu/TA9QTW3xnZE=";
+    hash = "sha256-wla7XviN+j3kW2+gKiry4OMTt7DDTJxRA5XwQYl2KZ0=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -13,14 +13,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "oelint-parser";
-  version = "8.12.1";
+  version = "8.12.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "priv-kweihmann";
    repo = "oelint-parser";
    tag = finalAttrs.version;
-    hash = "sha256-UY8KqItX8kj3eS3peP8okBR8i81MisMSffbhSPaqBM0=";
+    hash = "sha256-8GnbfMX9RedPgvDHkzejkPVSEfhdKAryPRJIT+hNCxk=";
  };

  pythonRelaxDeps = [ "regex" ];
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -29,14 +29,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "posthog";
-  version = "7.45.1";
+  version = "7.52.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PostHog";
    repo = "posthog-python";
    tag = "posthog-v${finalAttrs.version}";
-    hash = "sha256-UZqfNc8u0sG6G0YCzKeoWfwKIASgtmsKRJISjyGyULw=";
+    hash = "sha256-EIH8CQgbnpbkMupyyxRR5+ZTiKiBBRtTyFQfbEABHV4=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pydle/default.nix
+++ b/pkgs/development/python-modules/pydle/default.nix
@@ -11,13 +11,13 @@

 buildPythonPackage rec {
  pname = "pydle";
-  version = "1.1.0";
+  version = "1.2.0";
  pyproject = true;
  src = fetchFromCodeberg {
    owner = "shiz";
    repo = "pydle";
    tag = "v${version}";
-    hash = "sha256-LxlE0JVKgwDcPB7QuKkmfBWG33pDzG0F9qaL88xF8r4=";
+    hash = "sha256-460oY68PSmmgXq4bLOr8SB9RiMy3wc5EwEV7s5AKePY=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
+++ b/pkgs/development/python-modules/python-mpv-jsonipc/default.nix
@@ -7,14 +7,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "python-mpv-jsonipc";
-  version = "1.3.0";
+  version = "1.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "iwalton3";
    repo = "python-mpv-jsonipc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-i21Pzaidoi2MLb6Le9pA37IRy804MeC0yVV4KONb3mk=";
+    hash = "sha256-fSZ2xPWkdkXubSvgT0pGEvTtnQepBkfYHRVlCGoH6Tg=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pytorch-lightning/default.nix
+++ b/pkgs/development/python-modules/pytorch-lightning/default.nix
@@ -24,7 +24,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "pytorch-lightning";
-  version = "2.6.5";
+  version = "2.6.6";
  pyproject = true;
  __structuredAttrs = true;

@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
    owner = "Lightning-AI";
    repo = "pytorch-lightning";
    tag = finalAttrs.version;
-    hash = "sha256-j29UvQbm+R/uDqwj3kZrXw5YSbUPlJWZUT8RUPc4QyY=";
+    hash = "sha256-VKEd9Psj4DdOSdIXqwbmLl23FJWrQJEr9b34+t//c9w=";
  };

  env.PACKAGE_NAME = "pytorch";
--- a/pkgs/development/python-modules/rembg/default.nix
+++ b/pkgs/development/python-modules/rembg/default.nix
@@ -46,14 +46,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
  pname = "rembg";
-  version = "2.0.83";
+  version = "2.0.84";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "danielgatis";
    repo = "rembg";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VqjZKo8fYhqgVzrwGnLDiUWu/gtxhQ3QyKBgOm1R+g4=";
+    hash = "sha256-iY5ajSCMYiEZ34/WFkMV9pKw1o6sHawIa4iyQiUg8+E=";
  };

  env.POETRY_DYNAMIC_VERSIONING_BYPASS = finalAttrs.version;
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "rns";
-  version = "1.5.3";
+  version = "1.5.4";
  pyproject = true;
  __structuredAttrs = true;

  src = fetchPypi {
    pname = "rns";
    version = finalAttrs.version;
-    hash = "sha256-2WjnzyHyPHkmF8coh6w8WMeI9k8jAPvmA0ZqAQpjYDk=";
+    hash = "sha256-V4UI7wje33wQn3OkRQZcqJxQpjxqac7XsUftIDkc6xU=";
  };

  patches = [
--- a/pkgs/development/python-modules/svgpathtools/default.nix
+++ b/pkgs/development/python-modules/svgpathtools/default.nix
@@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "svgpathtools";
-  version = "1.7.4";
+  version = "1.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mathandy";
    repo = "svgpathtools";
    tag = "v${version}";
-    hash = "sha256-kuVEP4iVwFIiSON1CxbsmExu2ioKEhQXDeEpqULI0Rk=";
+    hash = "sha256-m+sjXVSF1gUksbq09DQvazn3IxadX9YJXqw3kTRO7Ac=";
  };

  build-system = [
--- a/pkgs/development/python-modules/yoto-api/default.nix
+++ b/pkgs/development/python-modules/yoto-api/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "yoto-api";
-  version = "4.3.4";
+  version = "4.4.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cdnninja";
    repo = "yoto_api";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cZbcRuw1AI1Xv9awfOJxMdsMuBVIWPUnjEJqhLNzf0s=";
+    hash = "sha256-q5wukMVqtOPKSEi6QOwNf/MpililTY8BebuNM0sSGas=";
  };

  build-system = [ setuptools ];
--- a/pkgs/os-specific/linux/r8168/default.nix
+++ b/pkgs/os-specific/linux/r8168/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
  name = "${pname}-${version}-${kernel.version}";
  pname = "r8168";
  # on update please verify that the source matches the realtek version
-  version = "8.056.02";
+  version = "8.057.00";

  # This is a mirror. The original website[1] doesn't allow non-interactive
  # downloads, instead emailing you a download link.
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
    owner = "mtorromeo";
    repo = "r8168";
    rev = version;
-    sha256 = "sha256-KKfI03RrD+34+KSxwTwDkeB4sGFNY/tU/YbfrfVkTp8=";
+    sha256 = "sha256-KymQThzYKpcgCjKX3ZQ2RAWNga2d0EaWXVQmHzw8hmA=";
  };

  hardeningDisable = [ "pic" ];
--- a/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/llm_intents/package.nix
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent (finalAttrs: {
  owner = "skye-harris";
  domain = "llm_intents";
-  version = "1.10.0";
+  version = "1.10.2";

  src = fetchFromGitHub {
    inherit (finalAttrs) owner;
    repo = "llm_intents";
    tag = finalAttrs.version;
-    hash = "sha256-RsQEdEhUOyJJBcDtlPYEBzmF4SiXPCF/NSpvg73x5iE=";
+    hash = "sha256-R92E4/89EapxlxQdlKbvuHg9CcVgvNXGpcDr7tvr46E=";
  };

  dependencies = [
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
@@ -6,16 +6,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "custom-brand-icons";
-  version = "2026.08.5";
+  version = "2026.09.0";

  src = fetchFromGitHub {
    owner = "elax46";
    repo = "custom-brand-icons";
    tag = finalAttrs.version;
-    hash = "sha256-rHcZjNpil2YcV2A+Cqz/V22pMfL8eJvlrbQK+Tk9HbE=";
+    hash = "sha256-khX+OqeAN45kFAhMOOq3k4N/FtkS//p+1LaskDL3so8=";
  };

-  npmDepsHash = "sha256-+Kn2WQ1MQMKTJ0He/k9NxUpoac9sB61zWRt2wha6c7g=";
+  npmDepsHash = "sha256-SP7tmazutPJWx8Pj9NU30ErNARvsnizONNek8q3DCR4=";

  buildPhase = ''
    runHook preBuild
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/hourly-weather/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/hourly-weather/package.nix
@@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "hourly-weather";
-  version = "7.0.0";
+  version = "7.1.0";

  src = fetchFromGitHub {
    owner = "decompil3d";
    repo = "lovelace-hourly-weather";
    rev = version;
-    hash = "sha256-sy21so7D5IbbiEnt1mAKFhxVJDzMWjOIhSOpGRRyMXk=";
+    hash = "sha256-oxC4w8Ieoz2fwqBalPI2jXBlebmEw3+7DFN2ocmVo1s=";
  };

-  npmDepsHash = "sha256-ZB/M8SO6Dw523CMKSAisoy5y4r1AouKXLY7Z1lgK4jU=";
+  npmDepsHash = "sha256-m/hXymkNJl6IvGWMLnhVc9i5bDc09+Vzt9kuLY20cpI=";

  env.CYPRESS_INSTALL_BINARY = "0";

--- a/pkgs/servers/mir/default.nix
+++ b/pkgs/servers/mir/default.nix
@@ -5,9 +5,9 @@ let
 in
 {
  mir = common {
-    version = "2.28.0";
-    hash = "sha256-sSxV20loRXQfGWMI1zAzrAwww00bc/BQqJaFB8whH5E=";
-    cargoHash = "sha256-AHB4OYP2kU47EsutOxYa693pMLgyXuF1p+mLXg2cIGs=";
+    version = "2.29.0";
+    hash = "sha256-jh8Qgr/5Ht0eioLH9ES4M+jZr3RLKHg2YJXX5XzzwEA=";
+    cargoHash = "sha256-VQpLjoKlaoYaSfVVNjxDGJXSlIri4RwETaQJf8faqHQ=";
  };

  mir_2_15 = common {
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2957,8 +2957,6 @@ with pkgs;
    callPackage ../development/tools/continuous-integration/woodpecker/server.nix
      { };

-  testdisk = libsForQt5.callPackage ../tools/system/testdisk { };
-
  testdisk-qt = testdisk.override { enableQt = true; };

  tweet-hs = haskell.lib.compose.justStaticExecutables haskellPackages.tweet-hs;