Merge master into staging-nixos

2026-06-05 21:03:40 +00:00 · 2026-06-01 19:40:02 +00:00
parent 439204f05d 5c0939a607
commit 09c3691947
127 changed files with 2201 additions and 745 deletions
--- a/README.md
+++ b/README.md
@@ -47,9 +47,9 @@ Here are some of the main ones:
 Nixpkgs and NixOS are built and tested by our continuous integration system, [Hydra](https://hydra.nixos.org/).

 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 25.11 release](https://hydra.nixos.org/jobset/nixos/release-25.11)
+* [Continuous package builds for the NixOS 26.05 release](https://hydra.nixos.org/jobset/nixos/release-26.05)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 25.11 release](https://hydra.nixos.org/job/nixos/release-25.11/tested#tabs-constituents)
+* [Tests for the NixOS 26.05 release](https://hydra.nixos.org/job/nixos/release-26.05/tested#tabs-constituents)

 Artifacts successfully built with Hydra are published to cache at https://cache.nixos.org/.
 When successful build and test criteria are met, the Nixpkgs expressions are distributed via [Nix channels](https://nix.dev/manual/nix/stable/command-ref/nix-channel.html).
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -13,6 +13,7 @@
  - If you use LUKS disk encryption, ensure that `fileSystems."/".device` is set to `"/dev/mapper/<name>"`, where `<name>` matches the name in your `boot.initrd.luks.devices.<name>` definition, to avoid systemd timing out while prompting for a passphrase. If you have a more complex setup, e.g. with LVM on top of LUKS, you may need to add `"x-systemd.device-timeout=infinity"` to `fileSystems."/".options` instead. If you need to disable the timeout before you can boot into the system, pass `systemd.default_device_timeout_sec=infinity` on the kernel command line.
  - The `cryptsetup-askpass` program is not available; use `systemctl default` instead, which will prompt for passphrases as necessary. If you pipe password responses into SSH over stdin, use `ssh -o RequestTTY=force` to ensure `systemctl default` gets a TTY to prompt on.
  - Many kernel parameters have been replaced with native systemd versions; see [](#sec-boot-problems).
+  - `/dev/root` is not available with the systemd stage 1. In the old scripted stage 1, `/dev/root` was a symlink created by the init script from the `root=` kernel command line. With systemd stage 1, this symlink is not provided. If your configuration uses `/dev/root` in `fileSystems`, replace it with a stable device path such as `/dev/disk/by-label/...`, `/dev/disk/by-uuid/...`, or the appropriate `/dev/mapper/...` path.

 - The system.nix file has been added as an alternative entry point to configuration.nix (and flake.nix) that allows configuring NixOS without using `nix-channel`.
  This file must evaluate to a NixOS system derivation or an attribute set of such derivations, in which case the attribute to build has to be selected with the `--attr` option of `nixos-rebuild` or `nixos-install`.
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@@ -5,7 +5,12 @@
  ...
 }:
 let
-  inherit (lib) mkOption types literalMD;
+  inherit (lib)
+    mkOption
+    types
+    literalExpression
+    literalMD
+    ;

  inherit (config) sshBackdoor;

@@ -117,9 +122,10 @@ in
 {
  options = {
    pythonTestDriverPackage = mkOption {
-      description = "Package containing the python NixOS test driver implemetnation";
+      description = "Package containing the python NixOS test driver implementation";
      type = types.package;
      default = hostPkgs.nixos-test-driver;
+      defaultText = literalExpression "hostPkgs.nixos-test-driver";
      readOnly = true;
    };

--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -787,9 +787,10 @@ in
      options = [ "mode=0755" ];
    };

-    # Note that /dev/root is a symlink to the actual root device
-    # specified on the kernel command line, created in the stage 1
-    # init script.
+    # With systemd stage 1, the ISO is identified by its volume label.
+    # With the scripted stage 1, /dev/root is a symlink to the actual
+    # root device specified on the kernel command line, created by the
+    # stage 1 init script.
    "/iso" = lib.mkImageMediaOverride {
      device =
        if config.boot.initrd.systemd.enable then
--- a/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
+++ b/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
@@ -189,11 +189,15 @@ let
                        [ "--docker-image ${service.dockerImage}" ]
                        ++ optional service.dockerDisableCache "--docker-disable-cache"
                        ++ optional service.dockerPrivileged "--docker-privileged"
+                        ++ optional service.dockerServicesPrivileged "--docker-services_privileged true"
                        ++ optional (service.dockerPullPolicy != null) "--docker-pull-policy ${service.dockerPullPolicy}"
                        ++ map (v: "--docker-volumes ${escapeShellArg v}") service.dockerVolumes
                        ++ map (v: "--docker-extra-hosts ${escapeShellArg v}") service.dockerExtraHosts
                        ++ map (v: "--docker-allowed-images ${escapeShellArg v}") service.dockerAllowedImages
                        ++ map (v: "--docker-allowed-services ${escapeShellArg v}") service.dockerAllowedServices
+                        ++ map (
+                          v: "--docker-allowed-privileged-services ${escapeShellArg v}"
+                        ) service.dockerAllowedPrivilegedServices
                      )
                    )
                  )
@@ -521,6 +525,13 @@ in
                Give extended privileges to container.
              '';
            };
+            dockerServicesPrivileged = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Give extended privileges to services.
+              '';
+            };
            dockerExtraHosts = mkOption {
              type = types.listOf types.str;
              default = [ ];
@@ -554,6 +565,19 @@ in
                Whitelist allowed services.
              '';
            };
+            dockerAllowedPrivilegedServices = mkOption {
+              type = types.listOf types.str;
+              default = [ ];
+              example = [
+                "docker.io/library/docker:*-dind-rootless"
+                "docker.io/library/docker:dind-rootless"
+                "docker:*-dind-rootless"
+                "docker:dind-rootless"
+              ];
+              description = ''
+                Whitelist allowed privileged services.
+              '';
+            };
            preGetSourcesScript = mkOption {
              type = types.nullOr (types.either types.str types.path);
              default = null;
--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@@ -40,11 +40,27 @@ let
        '';
        serial = lib.mkOption {
          type = lib.types.nullOr lib.types.path;
-          description = "Path to serial port this printer is connected to. Derived from `service.klipper.settings` by default.";
+          description = "Path to serial port this mcu is connected to. Derived from `service.klipper.settings` by default.";
          defaultText = lib.literalExpression "config.services.klipper.settings.<name>.serial";
          default =
            if lib.hasAttrByPath [ "${mcu}" "serial" ] cfg.settings then cfg.settings."${mcu}".serial else null;
        };
+        canbus_uuid = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          description = "CAN bus uuid of this mcu. Derived from `service.klipper.settings` by default.";
+          defaultText = lib.literalExpression "config.services.klipper.settings.<name>.canbus_uuid";
+          default =
+            if lib.hasAttrByPath [ "${mcu}" "canbus_uuid" ] cfg.settings then
+              cfg.settings."${mcu}".canbus_uuid
+            else
+              null;
+        };
+        canbusNetwork = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          description = "CAN bus network this mcu is connected to. Defaults to can0 if canbus_uuid is set.";
+          defaultText = lib.literalExpression ''if canbus_uuid != null then "can0" else null'';
+          default = if subcfg.canbus_uuid != null then "can0" else null;
+        };
        configFile = lib.mkOption {
          type = lib.types.path;
          description = "Path to firmware config which is generated using `klipper-genconf`";
@@ -78,6 +94,8 @@ let
              klipper-firmware = subcfg.package;
              mcu = lib.strings.sanitizeDerivationName mcu;
              flashDevice = subcfg.serial;
+              canbusDevice = subcfg.canbus_uuid;
+              canbusNetwork = subcfg.canbusNetwork;
              firmwareConfig = subcfg.configFile;
            }
          else
@@ -224,12 +242,15 @@ in
      }
    ]
    ++ lib.mapAttrsToList (mcu: firmware: {
-      assertion = firmware.enableKlipperFlash -> firmware.serial != null;
+      assertion =
+        firmware.enableKlipperFlash -> (firmware.serial != null || firmware.canbus_uuid != null);
      message = ''
-        Unable to determine the serial connection for services.klipper.firmwares."${mcu}". Please set one of the following:
+        Unable to determine the serial or canbus connection for services.klipper.firmwares."${mcu}". Please set one of the following:

          - services.klipper.firmwares."${mcu}".serial
+          - services.klipper.firmwares."${mcu}".canbus_uuid
          - services.klipper.settings."${mcu}".serial
+          - services.klipper.settings."${mcu}".canbus_uuid
      '';
    }) cfg.firmwares;

@@ -308,7 +329,6 @@ in

    environment.systemPackages =
      let
-        default = a: b: if a != null then a else b;
        genconf = pkgs.klipper-genconf.override {
          klipper = cfg.package;
        };
--- a/nixos/modules/services/security/jitterentropy-rngd.nix
+++ b/nixos/modules/services/security/jitterentropy-rngd.nix
@@ -26,6 +26,11 @@ in
      default = false;
      description = "Force SP800-90B mode for entropy reading";
    };
+    memlockLimit = lib.mkOption {
+      type = lib.types.str;
+      default = "2M";
+      description = "Set limit for lockable memory with mlock";
+    };
    verbose = lib.mkOption {
      type = lib.types.bool;
      default = false;
@@ -56,6 +61,12 @@ in
          # use service from package with our configured args
          "${cfg.package}/bin/jitterentropy-rngd ${args}"
        ];
+        LimitMEMLOCK = [
+          # clear old setting from built-in service file
+          ""
+          # use service from package with our configured limit
+          "${cfg.memlockLimit}"
+        ];
      };
    };

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -153,6 +153,7 @@ in
    console-log = runTest ./nixos-test-driver/console-log.nix;
    containers = runTest ./nixos-test-driver/containers.nix;
    skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
+    options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };
    driver-timeout =
      pkgs.runCommand "ensure-timeout-induced-failure"
        {
--- a/nixos/tests/nixos-test-driver/options-doc-regression.nix
+++ b/nixos/tests/nixos-test-driver/options-doc-regression.nix
@@ -0,0 +1,58 @@
+# Regression test for the `pythonTestDriverPackage` option's default value
+# leaking a `hostPkgs` reference into the NixOS manual build.
+#
+# `pythonTestDriverPackage` (added in d95261b435c4, "nixos-test-driver: Make
+# overridable") uses `default = hostPkgs.nixos-test-driver`. Without a
+# `defaultText`, the options-doc renderer force-evaluates that default when
+# building `options.json` for the NixOS manual. `hostPkgs` is only defined in
+# the VM testing framework, so evaluating its default from a regular NixOS
+# system configuration throws:
+#
+#   error: The option `hostPkgs' was accessed but has no value defined.
+#
+# In practice the bug only surfaces when `pkgs` ends up depending on
+# `config` — e.g. when `nixpkgs.config.packageOverrides` is wrapped in
+# `lib.mkIf`. Otherwise `nixos/doc/manual/default.nix`'s fallback
+# `config.hostPkgs = pkgs` rescue holds. With the dependency, that rescue
+# creates a cycle and the original `hostPkgs` error surfaces.
+#
+# The test builds a minimal system whose `pkgs` depends on `config`, and
+# asserts the toplevel (which includes `nixos-manual-html`) evaluates.
+
+{
+  pkgs,
+  ...
+}:
+let
+  evalConfig = import ../../lib/eval-config.nix;
+
+  nixos = evalConfig {
+    system = null;
+    modules = [
+      (
+        { lib, ... }:
+        {
+          system.stateVersion = "25.05";
+          fileSystems."/" = {
+            device = "/dev/null";
+            fsType = "none";
+          };
+          boot.loader.grub.device = "nodev";
+          nixpkgs.hostPlatform = pkgs.stdenv.hostPlatform.system;
+
+          # This is the trigger: wrapping `packageOverrides` in `mkIf` makes
+          # the `pkgs` module argument depend on `config`, which defeats the
+          # `config.hostPkgs = pkgs` rescue in `nixos/doc/manual/default.nix`.
+          nixpkgs.config.packageOverrides = lib.mkIf false (_: { });
+        }
+      )
+    ];
+  };
+in
+pkgs.runCommand "nixos-test-driver-options-doc-regression"
+  {
+    toplevel = nixos.config.system.build.toplevel.drvPath;
+  }
+  ''
+    echo "$toplevel" > $out
+  ''
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@@ -6,12 +6,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "kakoune-unwrapped";
-  version = "2026.04.12";
+  version = "2026.05.21";
  src = fetchFromGitHub {
    repo = "kakoune";
    owner = "mawww";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-m8q1+TooDREbQD848ciHxeHwMajmlmhAhCqGmdbThIU=";
+    hash = "sha256-4nhhvq871mgbpKYhAAVkIi2+MaO1jlt3d3lIXNGkh6I=";
  };

  makeFlags = [
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2014,8 +2014,8 @@ let
        mktplcRef = {
          name = "gleam";
          publisher = "gleam";
-          version = "2.12.1";
-          hash = "sha256-zU/iwaJ6ShEHYq7OeM6+RF/RVIx6SmJJKxtebN/tSGI=";
+          version = "2.12.2";
+          hash = "sha256-41HgkDcgyStJtyeE0x1H9rFOZ18imcKF7XQixDOmurE=";
        };
        meta = {
          description = "Support for the Gleam programming language";
--- a/pkgs/applications/editors/vscode/update-vscodium.sh
+++ b/pkgs/applications/editors/vscode/update-vscodium.sh
@@ -5,9 +5,11 @@ set -eou pipefail

 latestVersion=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/VSCodium/vscodium/releases/latest | jq -r ".tag_name")
 currentVersion=$(nix-instantiate --eval -E "with import ./. {}; vscodium.version or (lib.getVersion vscodium)" | tr -d '"')
+latestUpstream=$(curl -sL "https://raw.githubusercontent.com/VSCodium/vscodium/refs/tags/$latestVersion/upstream/stable.json" | jq -r ".tag")

 echo "latest  version: $latestVersion"
 echo "current version: $currentVersion"
+echo "latest upstream version: $latestUpstream"

 if [[ "$latestVersion" == "$currentVersion" ]]; then
    echo "package is up-to-date"
@@ -25,3 +27,5 @@ for i in \
    hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url "https://github.com/VSCodium/vscodium/releases/download/$latestVersion/VSCodium-$2-$latestVersion.$3"))
    update-source-version vscodium $latestVersion $hash --system=$1 --ignore-same-version
 done
+
+update-source-version vscodium $latestUpstream --version-key=vscodeVersion --ignore-same-version --ignore-same-hash
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -44,6 +44,7 @@ buildVscode rec {
  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
  version = "1.116.02821";
+  vscodeVersion = "1.116.0";
  pname = "vscodium";

  executableName = "codium";
--- a/pkgs/applications/science/logic/hol_light/0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch
+++ b/pkgs/applications/science/logic/hol_light/0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch
@@ -0,0 +1,22 @@
+From: "Matthias J. Kannwischer" <matthias@zerorisc.com>
+Date: Sat, 30 May 2026 16:37:44 +0800
+Subject: pa_j: accept camlp5 8.05 for OCaml 5.4
+
+Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>
+---
+ pa_j/chooser.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/pa_j/chooser.sh b/pa_j/chooser.sh
+index 5ec8d00..de5c8c8 100755
+--- a/pa_j/chooser.sh
+++ b/pa_j/chooser.sh
+@@ -20,7 +20,7 @@ CAMLP5_FULL_VERSION=`camlp5 -v 2>&1 | cut -f3 -d' ' | cut -f1-3 -d'.' | cut -f1
+ 
+ if test ${OCAML_BINARY_VERSION} = "3.0"
+ then echo "pa_j_${OCAML_VERSION}.ml"
+-elif test ${CAMLP5_FULL_VERSION} = "8.04.00"
+elif test ${CAMLP5_BINARY_VERSION} = "8.04" -o ${CAMLP5_BINARY_VERSION} = "8.05"
+ then
+   if test ${OCAML_BINARY_VERSION} = "5.4"
+   then echo "pa_j_5.4_8.04.00.ml"
--- a/pkgs/applications/science/logic/hol_light/0002-link-findlib-into-ocaml-hol.patch
+++ b/pkgs/applications/science/logic/hol_light/0002-link-findlib-into-ocaml-hol.patch
@@ -0,0 +1,12 @@
+diff --git a/Makefile b/Makefile
+--- a/Makefile
+++ b/Makefile
+@@ -128,7 +128,7 @@
+ hol.sh: pa_j.cmo ${HOLSRC} bignum.cmo hol_loader.cmo update_database.ml
+ 	if [ `uname` = "Linux" ] || [ `uname` = "Darwin" ] ; then \
+ 		if [ ${OCAML_UNARY_VERSION} = "5" ] || [ ${OCAML_VERSION} = "4.14" ] ; then \
+-			ocamlfind ocamlmktop -package zarith -o ocaml-hol zarith.cma bignum.cmo hol_loader.cmo ; \
+			ocamlfind ocamlmktop -package zarith,findlib -o ocaml-hol zarith.cma bignum.cmo hol_loader.cmo ; \
+ 			sed "s^__DIR__^`pwd`^g; s^__USE_MODULE__^$(HOLLIGHT_USE_MODULE)^g" hol_4.14.sh > hol.sh ; \
+ 		else \
+ 			ocamlmktop -o ocaml-hol nums.cma bignum.cmo hol_loader.cmo ; \
--- a/pkgs/applications/science/logic/hol_light/0004-Fix-compilation-with-camlp5-7.11.patch
+++ b/pkgs/applications/science/logic/hol_light/0004-Fix-compilation-with-camlp5-7.11.patch
@@ -1,66 +0,0 @@
-From: Stephane Glondu <steph@glondu.net>
-Date: Wed, 12 Feb 2020 05:42:32 +0100
-Subject: Fix compilation with camlp5 7.11
-
---
- pa_j_4.xx_7.xx.ml | 17 +++++++++++------
- 1 file changed, 11 insertions(+), 6 deletions(-)
-
-diff --git a/pa_j_4.xx_7.xx.ml b/pa_j_4.xx_7.xx.ml
-index 4f7ed60..e834058 100755
--- a/pa_j/pa_j_4.xx_7.xx.ml
-+++ b/pa_j/pa_j_4.xx_7.xx.ml
-@@ -410,9 +410,10 @@ and reloc_module_type floc sh =
-     | MtApp loc x1 x2 →
-         let loc = floc loc in
-         MtApp loc (self x1) (self x2)
-    | MtFun loc x1 x2 x3 →
-+    | MtFun loc x x3 →
-         let loc = floc loc in
-        MtFun loc x1 (self x2) (self x3)
-+        let x = vala_map (option_map (fun (x1, x2) -> (x1, self x2))) x in
-+        MtFun loc x (self x3)
-     | MtLid loc x1 →
-         let loc = floc loc in
-         MtLid loc x1
-@@ -507,9 +508,10 @@ and reloc_module_expr floc sh =
-     | MeApp loc x1 x2 →
-         let loc = floc loc in
-         MeApp loc (self x1) (self x2)
-    | MeFun loc x1 x2 x3 →
-+    | MeFun loc x x3 →
-         let loc = floc loc in
-        MeFun loc x1 (reloc_module_type floc sh x2) (self x3)
-+        let x = vala_map (option_map (fun (x1, x2) -> (x1, reloc_module_type floc sh x2))) x in
-+        MeFun loc x (self x3)
-     | MeStr loc x1 →
-         let loc = floc loc in
-         MeStr loc (vala_map (List.map (reloc_str_item floc sh)) x1)
-@@ -2007,7 +2009,7 @@ EXTEND
-       | -> <:vala< [] >> ] ]
-   ;
-   mod_binding:
-    [ [ i = V UIDENT; me = mod_fun_binding -> (i, me) ] ]
-+    [ [ i = V uidopt "uidopt"; me = mod_fun_binding -> (i, me) ] ]
-   ;
-   mod_fun_binding:
-     [ RIGHTA
-@@ -2070,7 +2072,7 @@ EXTEND
-           <:sig_item< value $lid:i$ : $t$ >> ] ]
-   ;
-   mod_decl_binding:
-    [ [ i = V UIDENT; mt = module_declaration -> (i, mt) ] ]
-+    [ [ i = V uidopt "uidopt"; mt = module_declaration -> (i, mt) ] ]
-   ;
-   module_declaration:
-     [ RIGHTA
-@@ -2092,6 +2094,9 @@ EXTEND
-       | "module"; i = V mod_ident ""; ":="; me = module_expr ->
-           <:with_constr< module $_:i$ := $me$ >> ] ]
-   ;
-+  uidopt:
-+    [ [ m = V UIDENT -> Some m ] ]
-+  ;
-   (* Core expressions *)
-   expr:
-     [ "top" RIGHTA
--- a/pkgs/applications/science/logic/hol_light/default.nix
+++ b/pkgs/applications/science/logic/hol_light/default.nix
@@ -1,61 +1,51 @@
 {
  lib,
  stdenv,
-  runtimeShell,
  fetchFromGitHub,
+  makeBinaryWrapper,
+  writeText,
  ocaml,
  findlib,
-  num,
  zarith,
  camlp5,
  camlp-streams,
+  fmt,
  pcre2,
+  ledit,
  bash,
 }:

 let
-  use_zarith = lib.versionAtLeast ocaml.version "4.14";
-  load_num =
-    if use_zarith then
-      ''
-        -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/zarith \
-        -I ${zarith}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
-        -I ${pcre2}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
-      ''
-    else
-      lib.optionalString (num != null) ''
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/num \
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/top-num \
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/stublibs
-      '';
-
-  start_script = ''
-    #!${runtimeShell}
-    cd $out/lib/hol_light
-    export OCAMLPATH="''${OCAMLPATH-}''${OCAMLPATH:+:}${camlp5}/lib/ocaml/${ocaml.version}/site-lib/"
-    exec ${ocaml}/bin/ocaml \
-      -I \`${camlp5}/bin/camlp5 -where\` \
-      ${load_num} \
-      -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib/ \
-      -I ${camlp-streams}/lib/ocaml/${ocaml.version}/site-lib/camlp-streams camlp_streams.cma \
-      -init make.ml
-  '';
+  ocamlPath = lib.makeSearchPath "/lib/ocaml/${ocaml.version}/site-lib" [
+    camlp5
+    camlp-streams
+    fmt
+    pcre2
+    zarith
+  ];
+  stublibsPath = lib.makeSearchPath "/lib/ocaml/${ocaml.version}/site-lib/stublibs" [
+    zarith
+    pcre2
+  ];
 in

 stdenv.mkDerivation {
  pname = "hol_light";
-  version = "unstable-2024-07-07";
+  version = "0-unstable-2026-05-19";

  src = fetchFromGitHub {
    owner = "jrh13";
    repo = "hol-light";
-    rev = "16b184e30e7e3fe9add7d1ee93242323ed2e1726";
-    hash = "sha256-V0OtsmX5pa+CH3ZXmNG3juXwXZ5+A0k13eMCAfaRziQ=";
+    rev = "9b510bc76da4cecf6e509be44d327c9236ec273f";
+    hash = "sha256-QaTDrGHpHvEde2AK/SD7eM+bAC9vN5o+dQqW1oau1Yo=";
  };

-  patches = [ ./0004-Fix-compilation-with-camlp5-7.11.patch ];
-
-  buildInputs = [ bash ];
+  patches = [
+    # Accept camlp5 8.05 in the pa_j chooser; submitted upstream.
+    ./0001-pa_j-accept-camlp5-8.05-for-OCaml-5.4.patch
+    # Link findlib into ocaml-hol so `#use "topfind"` works in the sandbox.
+    ./0002-link-findlib-into-ocaml-hol.patch
+  ];

  strictDeps = true;

@@ -63,28 +53,77 @@ stdenv.mkDerivation {
    ocaml
    findlib
    camlp5
+    makeBinaryWrapper
+  ];
+  buildInputs = [
+    bash
+    ocaml
+    findlib
+    camlp5
+    ledit
  ];
  propagatedBuildInputs = [
    camlp-streams
+    fmt
    pcre2
-    (if use_zarith then zarith else num)
+    zarith
  ];

+  setupHook = writeText "hol-light-setup-hook.sh" ''
+    addHolLight () {
+      if test -d "''$1/lib/hol_light"; then
+        export HOLLIGHT_DIR="''$1/lib/hol_light"
+      fi
+    }
+    addEnvHooks "$targetOffset" addHolLight
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    patchShebangs .
+    HOLLIGHT_USE_MODULE=1 make hol.sh
+    HOLLIGHT_USE_MODULE=1 make
+    runHook postBuild
+  '';
+
  installPhase = ''
-    mkdir -p "$out/lib/hol_light" "$out/bin"
-    cp -a  . $out/lib/hol_light
-    echo "${start_script}" > "$out/bin/hol_light"
-    chmod a+x "$out/bin/hol_light"
+    runHook preInstall
+    mkdir -p "$out/lib/hol_light"
+    cp -a . "$out/lib/hol_light"
+    # The Makefile bakes the build directory into hol.sh; regenerate it
+    # pointing at the install location.
+    sed "s^__DIR__^$out/lib/hol_light^g; s^__USE_MODULE__^1^g" hol_4.14.sh \
+      > "$out/lib/hol_light/hol.sh"
+    chmod +x "$out/lib/hol_light/hol.sh"
+    # Add the findlib site-lib so the toplevel can `#use "topfind"`.
+    substituteInPlace "$out/lib/hol_light/hol.sh" \
+      --replace-fail '-init ''${HOL_ML_PATH} -I ''${HOLLIGHT_DIR}' \
+        '-init ''${HOL_ML_PATH} -I ''${HOLLIGHT_DIR} -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib'
+    makeWrapper "$out/lib/hol_light/hol.sh" "$out/bin/hol_light" \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          ocaml
+          findlib
+          camlp5
+          ledit
+        ]
+      } \
+      --set OCAMLPATH "${ocamlPath}" \
+      --prefix CAML_LD_LIBRARY_PATH : "${stublibsPath}"
+    ln -s hol_light "$out/bin/hol.sh"
+    runHook postInstall
  '';

  meta = {
    description = "Interactive theorem prover based on Higher-Order Logic";
    homepage = "http://www.cl.cam.ac.uk/~jrh13/hol-light/";
+    mainProgram = "hol_light";
    license = lib.licenses.bsd2;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [
      thoughtpolice
      vbgl
+      mkannwischer
    ];
  };
 }
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-dynamic-cursors.nix
@@ -7,13 +7,13 @@

 mkHyprlandPlugin {
  pluginName = "hypr-dynamic-cursors";
-  version = "0-unstable-2026-03-09";
+  version = "0-unstable-2026-05-29";

  src = fetchFromGitHub {
    owner = "VirtCode";
    repo = "hypr-dynamic-cursors";
-    rev = "57e14edd0ae265b01828e466e287e96eb1e84dd3";
-    hash = "sha256-hHMMP4h9VvacDLb8lkI6gZcUnhDbEt+GP2RLLL2s2C4=";
+    rev = "1de08deb7d495124ce88b342fecc7e7542d0672f";
+    hash = "sha256-Ck9dFUfj/zDSab16CzsGWEMNeSNDhhDOB0JWeHzVvjk=";
  };

  dontUseCmakeConfigure = true;
--- a/pkgs/by-name/ag/agkozak-zsh-prompt/package.nix
+++ b/pkgs/by-name/ag/agkozak-zsh-prompt/package.nix
@@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "agkozak-zsh-prompt";
-  version = "3.11.4";
+  version = "3.11.5";

  src = fetchFromGitHub {
    owner = "agkozak";
    repo = "agkozak-zsh-prompt";
    tag = "v${version}";
-    sha256 = "sha256-FC9LIZaS6fV20qq6cJC/xQvfsM3DHXatVleH7yBgoNg=";
+    sha256 = "sha256-C9lyOm2+RVLOUSO5Vz013uTobnN+SBE1Jm8GuJZ7T7U=";
  };

  strictDeps = true;
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -11,13 +11,13 @@

 buildGoModule (finalAttrs: {
  pname = "apko";
-  version = "1.2.13";
+  version = "1.2.14";

  src = fetchFromGitHub {
    owner = "chainguard-dev";
    repo = "apko";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-T074IzGgs0mDX4u5L96Xa0bGwpCLVYu3hNrN/7JzF1U=";
+    hash = "sha256-+yvQK6mrDT9MOeJsEJp4maycz6jpyAnGkc4QddaCbDo=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
      find "$out" -name .git -print0 | xargs -0 rm -rf
    '';
  };
-  vendorHash = "sha256-Sq++amIZ5jdi/D499A8JRkr7yYPHkMXjU2yHOE8p3h4=";
+  vendorHash = "sha256-ITxeRtPJmLEqD8BundfWdQO10XGHaElL2vpYFSM24pQ=";

  excludedPackages = [
    "internal/gen-jsonschema"
--- a/pkgs/by-name/au/audacious-bare/package.nix
+++ b/pkgs/by-name/au/audacious-bare/package.nix
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "audacious";
-  version = "4.5.1";
+  version = "4.6";

  src = fetchFromGitHub {
    owner = "audacious-media-player";
    repo = "audacious";
    rev = "${pname}-${version}";
-    hash = "sha256-1+RyGMUrotFdNCNpxzKpXGafKn9kNtzEyRVefUmJexU=";
+    hash = "sha256-TKzsAroCbeTI2dJdAWJYI/0ocroc1L8CC8ciepfEVMc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ci/circumflex/package.nix
+++ b/pkgs/by-name/ci/circumflex/package.nix
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "circumflex";
-  version = "4.1.1";
+  version = "4.3";

  src = fetchFromGitHub {
    owner = "bensadeh";
    repo = "circumflex";
    tag = finalAttrs.version;
-    hash = "sha256-2eCxk5FynwKt0T9cseesre+dumy5K5uZZAt++R+aTxw=";
+    hash = "sha256-VyUJ7qiaodLTdfGyh3/tLGfNVZCAxImxOuz4ztaaqtg=";
  };

-  vendorHash = "sha256-in6yPiT/SqRaw6hFF2gCmBwGcJ315Qej3HuM7TF5MaE=";
+  vendorHash = "sha256-4YL0N8wA8igveYfeL4uZDY5YD1InW0iD3WWq1E/vIJs=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -124,6 +124,10 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optional cursesUI ncurses
    ++ lib.optional qt5UI qtbase;

+  # bootstrap is not autoconf and rejects --enable-static/--disable-shared
+  # FIXME: rebuild avoidance, drop optionalDrvAttr in staging
+  dontAddStaticConfigureFlags = lib.optionalDrvAttr stdenv.hostPlatform.isStatic true;
+
  preConfigure = ''
    substituteInPlace Modules/Platform/UnixPaths.cmake \
      --subst-var-by libc_bin ${lib.getBin stdenv.cc.libc} \
@@ -131,6 +135,10 @@ stdenv.mkDerivation (finalAttrs: {
      --subst-var-by libc_lib ${lib.getLib stdenv.cc.libc}
    # CC_FOR_BUILD and CXX_FOR_BUILD are used to bootstrap cmake
    configureFlags="--parallel=''${NIX_BUILD_CORES:-1} CC=$CC_FOR_BUILD CXX=$CXX_FOR_BUILD $configureFlags $cmakeFlags"
+  ''
+  + lib.optionalString (stdenv.hostPlatform.isStatic && useSharedLibraries) ''
+    # FindLibArchive ignores libarchive.pc's Libs.private
+    export NIX_LDFLAGS+=" $($PKG_CONFIG --static --libs-only-l libarchive)"
  '';

  # The configuration script is not autoconf-based, although being similar;
@@ -175,6 +183,11 @@ stdenv.mkDerivation (finalAttrs: {

    (lib.cmakeBool "CMAKE_USE_OPENSSL" useOpenSSL)
    (lib.cmakeBool "BUILD_CursesDialog" cursesUI)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isStatic [
+    # kwsys's DynamicLoader test is inimical to -static
+    # doCheck is off anyway so just skip building tests
+    (lib.cmakeBool "BUILD_TESTING" false)
  ];

  # make install attempts to use the just-built cmake
--- a/pkgs/by-name/co/collabora-desktop/package.nix
+++ b/pkgs/by-name/co/collabora-desktop/package.nix
@@ -13,7 +13,6 @@
  pam,
  pango,
  pixman,
-  pkgs,
  pkg-config,
  poco,
  python3,
@@ -47,6 +46,10 @@ stdenv.mkDerivation (finalAttrs: {

    patchShebangs browser/util/*.py coolwsd-systemplate-setup scripts/*
    substituteInPlace configure.ac --replace-fail '/usr/bin/env python3' python3
+
+    # workaround for QtWebEngine crash when loading 'cell' cursor
+    substituteInPlace browser/css/spreadsheet.css \
+      --replace-warn "cursor: cell" "cursor: crosshair"
  '';

  nativeBuildInputs = [
--- a/pkgs/by-name/cu/cubeb/package.nix
+++ b/pkgs/by-name/cu/cubeb/package.nix
@@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cubeb";
-  version = "0-unstable-2026-05-06";
+  version = "0-unstable-2026-05-27";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "cubeb";
-    rev = "6ad18e2b523a2c721ee1ed8ad0940521a19f5f84";
-    hash = "sha256-Q+UepE/mNIKBvltLKr1RGmuP7ulVd5sxHwaVCeb0BzM=";
+    rev = "7e6ad0ce1bf7b9deb9d360ff23bdfd22118cc536";
+    hash = "sha256-ZGyf/z+tpdwx5VcLkTVF59E86rYPWe/RbNj/kptN++0=";
  };

  outputs = [
--- a/pkgs/by-name/dd/ddns-go/package.nix
+++ b/pkgs/by-name/dd/ddns-go/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "ddns-go";
-  version = "6.17.0";
+  version = "6.17.1";

  src = fetchFromGitHub {
    owner = "jeessy2";
    repo = "ddns-go";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-si1+L523iXBhH/Jo7zm0M/zT5d/hrZvDTYS4WMaFdSQ=";
+    hash = "sha256-F5QErTVE4wjNMyJHSQN3MFTiTLdgy5ADf+UUZ8acF14=";
  };

-  vendorHash = "sha256-MbITJ2MxyTNE6LS9rQZ10IVgQuXpmbPf5HQgoy2OuOc=";
+  vendorHash = "sha256-3jIWxjjPeEj02OQkXLvcqLJH+PjuEtL2zhfUAOtQJio=";

  ldflags = [
    "-X main.version=${finalAttrs.version}"
--- a/pkgs/by-name/dn/dnslookup/package.nix
+++ b/pkgs/by-name/dn/dnslookup/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "dnslookup";
-  version = "1.11.2";
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "ameshkov";
    repo = "dnslookup";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jN1JBqCZPoLbdododPRRRGfZugyesWb1Xt+np/xXK6U=";
+    hash = "sha256-RxplKQ21mskowAoMpgl4OVRyO7y89XS9CDcFd0RZVIg=";
  };

-  vendorHash = "sha256-FFVxqnFwYsoPt2wCmMpxxe+YkSg6ry71XbFd463uXn4=";
+  vendorHash = "sha256-DSicC/NbLOku7kYw1Ketur5qGk3Nh66Kj3NZoP7X524=";

  meta = {
    changelog = "https://github.com/ameshkov/dnslookup/releases/tag/v${finalAttrs.version}";
--- a/pkgs/by-name/do/dosage/package.nix
+++ b/pkgs/by-name/do/dosage/package.nix
@@ -7,11 +7,11 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "dosage";
-  version = "3.2";
+  version = "3.3";

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    sha256 = "sha256-MHikoqbsQ2WkDi+S+1fhHuJy/cwzHu6PVy/JfALNJUI=";
+    sha256 = "sha256-hkk8JCR1cWrYJFOlSfZkGtSHvPQcQ9O+0MMLfq9x0us=";
  };

  pyproject = true;
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "fabric-ai";
-  version = "1.4.452";
+  version = "1.4.453";

  src = fetchFromGitHub {
    owner = "danielmiessler";
    repo = "fabric";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2O/g0DC0ptxzEzXA1NYZWfdnUeIVFuLWNyw1uct2XyM=";
+    hash = "sha256-+q68ee4oCSJ7zR2XFaJChHkJoalUUZwebWVV823eAmc=";
  };

-  vendorHash = "sha256-oSHrn2Oad6XuIFjrqeC4NGC/rasCu+49xADY15YNSbc=";
+  vendorHash = "sha256-XJ6JlvEY1L7/w+e8QJEXcB9VzueNEFg1GPn75+zQaYA=";

  # Fabric introduced plugin tests that fail in the nix build sandbox.
  doCheck = false;
--- a/pkgs/by-name/fa/fastcov/package.nix
+++ b/pkgs/by-name/fa/fastcov/package.nix
@@ -9,14 +9,14 @@

 python3Packages.buildPythonPackage rec {
  pname = "fastcov";
-  version = "1.16";
+  version = "1.17";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "RPGillespie6";
    repo = "fastcov";
    tag = "v${version}";
-    hash = "sha256-frpX0b8jqKfsxQrts5XkOkjgKlmi7p1r/+Mu7Dl4mm8=";
+    hash = "sha256-2WrgLNC3FU4b8DdcoK3rk0+JBiv60JmlBktg0tMx6CM=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/ge/geeqie/package.nix
+++ b/pkgs/by-name/ge/geeqie/package.nix
@@ -33,30 +33,23 @@
  zenity,
  libnotify,
  wrapGAppsHook3,
-  fetchpatch,
  doxygen,
  nix-update-script,
+  openexr,
+  cfitsio,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "geeqie";
-  version = "2.5";
+  version = "2.7";

  src = fetchFromGitHub {
    owner = "BestImageViewer";
    repo = "geeqie";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-k2FXj2ZKZzB5XpCcWzEv7Q1ozATfU3221XKcOFdWOGU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yCY9ltm21cD3NnC2hDZ3O+2UZYgop4TLHC0djPF3Lo0=";
  };

-  patches = [
-    # Remove changelog from menu
-    (fetchpatch {
-      url = "https://salsa.debian.org/debian/geeqie/-/raw/debian/master/debian/patches/Remove-changelog-from-menu-item.patch";
-      hash = "sha256-0awKKTLg/gUZhmwluVbHCOqssog9SneFOaUtG89q0go=";
-    })
-  ];
-
  postPatch = ''
    patchShebangs .
  '';
@@ -91,6 +84,8 @@ stdenv.mkDerivation (finalAttrs: {
    gspell
    libtiff
    libwebp
+    openexr
+    cfitsio
  ];

  postInstall = ''
@@ -179,6 +174,7 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.gpl2Plus;

    homepage = "https://www.geeqie.org/";
+    changelog = "https://github.com/BestImageViewer/geeqie/blob/${finalAttrs.src.tag}/NEWS";

    maintainers = with lib.maintainers; [
      pSub
--- a/pkgs/by-name/gi/git-pkgs/package.nix
+++ b/pkgs/by-name/gi/git-pkgs/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
  pname = "git-pkgs";
-  version = "0.16.1";
+  version = "0.16.2";

  src = fetchFromGitHub {
    owner = "git-pkgs";
    repo = "git-pkgs";
    tag = "v${version}";
-    hash = "sha256-biKDEvhV0CLoZxUgby7EH4kv0WZlQKHzPnjz5KarXK0=";
+    hash = "sha256-6AhA4CG4q6ujM3JSz5aUXvVG7vC5mL8DGiF4dO2kU3k=";
  };

-  vendorHash = "sha256-mBSoIsclotqBTBivHdpC33X2lBBIX/LlLJxKe03mHqo=";
+  vendorHash = "sha256-uram6wb0nTxVDy8PQa3R4os620S/XuDcTZkMhwNhd3A=";

  subPackages = [ "." ];

--- a/pkgs/by-name/gl/glaze/package.nix
+++ b/pkgs/by-name/gl/glaze/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "glaze";
-  version = "7.7.0";
+  version = "7.7.1";

  src = fetchFromGitHub {
    owner = "stephenberry";
    repo = "glaze";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CxuNDOjdF6zYs0zRptqNJgfQondUSaN1AZanksG4U8s=";
+    hash = "sha256-CfN2mv1s+yv2HvRLBZhHUHBNfsgRzTT7USNYkkahh8M=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/gm/gmobile/package.nix
+++ b/pkgs/by-name/gm/gmobile/package.nix
@@ -13,11 +13,12 @@
  udevCheckHook,
  vala,
  nix-update-script,
+  fetchpatch2,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "gmobile";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
@@ -25,9 +26,17 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "Phosh";
    repo = "gmobile";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-zAF/9FQwpb6xiKRqfhWI/3lBwiDOEDu+TNkIJpEdbYY=";
+    hash = "sha256-RXkH+48WzACgNcIROlSTSO4l/ujWVHJDG+Xtk4k7Rdw=";
  };

+  patches = [
+    (fetchpatch2 {
+      name = "dont-set-libexecdir.patch";
+      url = "https://gitlab.gnome.org/World/Phosh/gmobile/-/commit/b085e13898edddf31b6da8c8fc4119bb2cb59c38.patch";
+      hash = "sha256-S3S1FORPC8czFx0ivLVOUhamStaJsKd6oXnh1jbdr3Y=";
+    })
+  ];
+
  nativeBuildInputs = [
    gtk-doc
    meson
--- a/pkgs/by-name/gr/grpc-health-probe/package.nix
+++ b/pkgs/by-name/gr/grpc-health-probe/package.nix
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "grpc-health-probe";
-  version = "0.4.50";
+  version = "0.4.51";

  src = fetchFromGitHub {
    owner = "grpc-ecosystem";
    repo = "grpc-health-probe";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-gNQJeAeQTNhvtA7hP+9nS6MGnhwoayNub2o5S/oKWHU=";
+    hash = "sha256-F8vwgygsJNcQqDcw4QQ0BmAEH1t83Ri9NBsXj7bcpqU=";
  };

  tags = [
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
    "-X main.versionTag=${finalAttrs.version}"
  ];

-  vendorHash = "sha256-72nRpe4FIclZDpYw56UewFJRU2NBbuQ0M8HKYwqJU34=";
+  vendorHash = "sha256-KZNoXWay/fegj6q075s40VvqtbA0ADrPKJ3VkQ/6os0=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/gs/gsoap/package.nix
+++ b/pkgs/by-name/gs/gsoap/package.nix
@@ -13,17 +13,16 @@
 }:

 let
-  majorVersion = "2.8";
  isCross = stdenv.hostPlatform != stdenv.buildPlatform;

 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gsoap";
-  version = "${majorVersion}.108";
+  version = "2.8.142";

  src = fetchurl {
-    url = "mirror://sourceforge/project/gsoap2/gsoap-${majorVersion}/gsoap_${finalAttrs.version}.zip";
-    sha256 = "0x58bwlclk7frv03kg8bp0pm7zl784samvbzskrnr7dl5v866nvl";
+    url = "mirror://sourceforge/gsoap2/gsoap_${finalAttrs.version}.zip";
+    hash = "sha256-bXGWvWWR7Cl3R0xoHjUbSjPrXC1kyeLmcnsATzMLN1I=";
  };

  buildInputs = [
@@ -40,11 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
  # Parallel building doesn't work as of 2.8.49
  enableParallelBuilding = false;

-  # Future versions of automake require subdir-objects if the source is structured this way
-  # As of 2.8.49 (maybe earlier) this is needed to silence warnings
  prePatch = ''
-    substituteInPlace configure.ac \
-      --replace 'AM_INIT_AUTOMAKE([foreign])' 'AM_INIT_AUTOMAKE([foreign subdir-objects])'
    ${lib.optionalString isCross ''
      substituteInPlace gsoap/wsdl/Makefile.am \
        --replace-fail 'SOAP=$(top_builddir)/gsoap/src/soapcpp2$(EXEEXT)' 'SOAP=${lib.getExe' buildPackages.gsoap "soapcpp2"}'
--- a/pkgs/by-name/gt/gtk-sharp-3_0/builder.sh
+++ b/pkgs/by-name/gt/gtk-sharp-3_0/builder.sh
@@ -1,9 +0,0 @@
-genericBuild
-
-# !!! hack
-export ALL_INPUTS="$out $pkgs"
-
-find $out -name "*.dll.config" | while read configFile; do
-    echo "modifying config file $configFile"
-    $monoDLLFixer "$configFile"
-done
--- a/pkgs/by-name/gt/gtk-sharp-3_0/package.nix
+++ b/pkgs/by-name/gt/gtk-sharp-3_0/package.nix
@@ -1,63 +1,62 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchFromGitHub,
  fetchpatch,
+  meson,
+  ninja,
  pkg-config,
  mono,
  glib,
  pango,
  gtk3,
-  libxml2,
-  monoDLLFixer,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "gtk-sharp";
-  version = "2.99.3";
+  version = "3.22.2";

-  builder = ./builder.sh;
-  src = fetchurl {
-    url = "mirror://gnome/sources/gtk-sharp/${lib.versions.majorMinor finalAttrs.version}/gtk-sharp-${finalAttrs.version}.tar.xz";
-    sha256 = "18n3l9zcldyvn4lwi8izd62307mkhz873039nl6awrv285qzah34";
+  src = fetchFromGitHub {
+    owner = "GLibSharp";
+    repo = "GtkSharp";
+    tag = finalAttrs.version;
+    hash = "sha256-I15XpW2NotOK1gExCNgJOHd6QVGW9mGkWfeHfJGdLwI=";
  };

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  mesonFlags = [
+    "-Dinstall=true"
+  ];
+
  buildInputs = [
    mono
    glib
    pango
    gtk3
-    libxml2
-  ];
-
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
-
-  patches = [
-    # Fixes MONO_PROFILE_ENTER_LEAVE undeclared when compiling against newer versions of mono.
-    # @see https://github.com/mono/gtk-sharp/pull/266
-    (fetchpatch {
-      name = "MONO_PROFILE_ENTER_LEAVE.patch";
-      url = "https://github.com/mono/gtk-sharp/commit/401df51bc461de93c1a78b6a7a0d5adc63cf186c.patch";
-      sha256 = "0hrkcr5a7wkixnyp60v4d6j3arsb63h54rd30lc5ajfjb3p92kcf";
-    })
-    # @see https://github.com/mono/gtk-sharp/pull/263
-    (fetchpatch {
-      name = "disambiguate_Gtk.Range.patch";
-      url = "https://github.com/mono/gtk-sharp/commit/a00552ad68ae349e89e440dca21b86dbd6bccd30.patch";
-      sha256 = "1ylplr9g9x7ybsgrydsgr6p3g7w6i46yng1hnl3afgn4vj45rag2";
-    })
  ];

  dontStrip = true;

-  inherit monoDLLFixer;
+  patches = [
+    (fetchpatch {
+      name = "fix-unknown-variable-gdk_api_includes.patch";
+      url = "https://github.com/GLibSharp/GtkSharp/commit/a1ffef907e06303bbd2787ced5c82a8bf6a7eef1.patch";
+      hash = "sha256-w3BbnEU6ye9WsNBNiELbbGOkXYsE3SACopRF0Dbfr3k=";
+    })
+  ];

  passthru = {
    inherit gtk3;
  };

  meta = {
+    homepage = "https://github.com/GLibSharp/GtkSharp";
+    license = lib.licenses.lgpl2Only;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/he/heroic/package.nix
+++ b/pkgs/by-name/he/heroic/package.nix
@@ -3,6 +3,7 @@
  heroic-unwrapped,
  extraPkgs ? pkgs: [ ],
  extraLibraries ? pkgs: [ ],
+  extraEnv ? { },
 }:

 steam.buildRuntimeEnv {
@@ -12,7 +13,7 @@ steam.buildRuntimeEnv {
  runScript = "heroic";

  extraPkgs = pkgs: [ heroic-unwrapped ] ++ extraPkgs pkgs;
-  inherit extraLibraries;
+  inherit extraLibraries extraEnv;

  extraInstallCommands = ''
    mkdir -p $out/share
--- a/pkgs/by-name/i3/i3/package.nix
+++ b/pkgs/by-name/i3/i3/package.nix
@@ -39,13 +39,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "i3";
-  version = "4.24";
+  version = "4.25.1";

  src = fetchFromGitHub {
    owner = "i3";
    repo = "i3";
    tag = finalAttrs.version;
-    hash = "sha256-2tuhfB/SMN+osCBfZtw/yDPhNNEhBH4Qo6dexpqVWYk=";
+    hash = "sha256-gXm0jzRAHXnjEfmUtlB+Pr/ZNNuZVRk6KWBCxRNDneU=";
  };

  nativeBuildInputs = [
@@ -91,13 +91,6 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = ''
    patchShebangs .
-
-    # This testcase generates a Perl executable file with a shebang, and
-    # patchShebangs can't replace a shebang in the middle of a file.
-    if [ -f testcases/t/318-i3-dmenu-desktop.t ]; then
-      substituteInPlace testcases/t/318-i3-dmenu-desktop.t \
-        --replace-fail "#!/usr/bin/env perl" "#!${lib.getExe perl}"
-    fi
  '';

  # xvfb-run is available only on Linux
--- a/pkgs/by-name/ic/iceauth/package.nix
+++ b/pkgs/by-name/ic/iceauth/package.nix
@@ -11,7 +11,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "iceauth";
-  version = "1.0.10";
+  version = "1.0.11";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "app";
    repo = "iceauth";
    tag = "iceauth-${finalAttrs.version}";
-    hash = "sha256-XAk+hffmX02/0wJlXZVSY325I1AyiJ6AozJizsv39Mg=";
+    hash = "sha256-HuC5q5kFek2v+Rzp+TgSRnl6Dr4eKtSl7SuSwfFvOdM=";
  };

  strictDeps = true;
--- a/pkgs/by-name/in/incus/package.nix
+++ b/pkgs/by-name/in/incus/package.nix
@@ -2,7 +2,13 @@ import ./generic.nix {
  hash = "sha256-g0YnvPMwk7WpYCl5VbRtHKVYoLlrk6QYhRaRRqulVQM=";
  version = "7.1.0";
  vendorHash = "sha256-VqvDrjdBTblqEOY/HtoKXGRAdoTJpSWxkmgJNNPw6eQ=";
-  patches = [ ];
+  patches = fetchpatch2: [
+    (fetchpatch2 {
+      name = "lxc-fix-environment-quoting.patch";
+      url = "https://github.com/lxc/incus/commit/a1276cdb57297245496ac8c1db76b90d1fcebd3b.patch?full_index=1";
+      hash = "sha256-NqEMYcDYx18KbqShKxmaK1o08c8/X4O87zXclQ36Ors=";
+    })
+  ];
  nixUpdateExtraArgs = [
    "--override-filename=pkgs/by-name/in/incus/package.nix"
  ];
--- a/pkgs/by-name/in/infat/package.nix
+++ b/pkgs/by-name/in/infat/package.nix
@@ -7,20 +7,24 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "infat";
-  version = "3.0.3";
+  version = "3.1.2";

  src = fetchFromGitHub {
    owner = "philocalyst";
    repo = "infat";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-M0A9/rjw5aX4yfkEzkczLcvMpMuVTV5u1eyKhlM7nNk=";
+    hash = "sha256-/lZqI6E6mGQLtc3bmDH1NhnmVYa4sLjMJaYga33vLmI=";
  };

-  cargoHash = "sha256-8WE9TiZX1QWenjEQF/uhzJ8Gqbggt8B9EZ+1tzWq72Q=";
+  cargoHash = "sha256-XPwhwJNHou5fJZ94RpbOlWUPQjw45PNmYCRzmukrFYo=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  versionCheckProgramArg = "--version";
-  doInstallCheck = true;
+  # The v3.1.2 tag ships infat-cli/Cargo.toml with version = "3.1.1", so the
+  # built binary reports "infat-cli 3.1.1" and versionCheckHook fails. Disable
+  # the check until upstream aligns the crate version with the release tag.
+  # https://github.com/philocalyst/infat/blob/v3.1.2/infat-cli/Cargo.toml
+  doInstallCheck = false;

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/ji/jitterentropy-rngd/package.nix
+++ b/pkgs/by-name/ji/jitterentropy-rngd/package.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [
    # Allow the systemd service to mlock the daemon's entropy buffer.
    (fetchpatch {
-      url = "https://github.com/smuellerDD/jitterentropy-rngd/compare/v1.3.1...61ad2e7c83b95402536b90b52eabe20ce60cfbd7.patch";
-      hash = "sha256-Twg59vrqJGF0bH4pkIewbReCjabOFuqq+MtCnwjO9lw=";
+      url = "https://github.com/smuellerDD/jitterentropy-rngd/compare/v1.3.1...cee0c7a035e9564d161053012c6ea36b2ce27383.patch";
+      hash = "sha256-zwcY9z9EikrhxZa39p4+gl+/EeZ4sAKaItQfrL1DFSo=";
    })
  ];

--- a/pkgs/by-name/jo/joe/package.nix
+++ b/pkgs/by-name/jo/joe/package.nix
@@ -6,11 +6,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "joe";
-  version = "4.7";
+  version = "4.8";

  src = fetchurl {
    url = "mirror://sourceforge/joe-editor/joe-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-cSsjqDo3V6k9K0p2Mludq7pVTBgrIJ0mdVN8Jyhn/Lo=";
+    sha256 = "sha256-aZWyjuINzbvLWkWkwRBkLcltZ3SK6idFDHTNtN0HzCA=";
  };

  patches = [ ./macos-fix.patch ];
--- a/pkgs/by-name/jo/john/package.nix
+++ b/pkgs/by-name/jo/john/package.nix
@@ -26,13 +26,13 @@

 stdenv.mkDerivation {
  pname = "john";
-  version = "1.9.0-Jumbo-1-unstable-2026-04-13";
+  version = "1.9.0-Jumbo-1-unstable-2026-05-31";

  src = fetchFromGitHub {
    owner = "openwall";
    repo = "john";
-    rev = "f514ece8ec4ae5e38ad75aaa322eac86d73dcd76";
-    hash = "sha256-zO1/KUJe3LvYCGlwVpNg5uDwPRD0ql/7anErb7tywC0=";
+    rev = "776889036312637dd97584da68af196e2a2c93ea";
+    hash = "sha256-JRQN5NJMCvRDjzXql06Pqy7xEwA8peMCeB4nCedhAvE=";
  };

  patches = lib.optionals withOpenCL [
--- a/pkgs/by-name/li/libkrunfw/package.nix
+++ b/pkgs/by-name/li/libkrunfw/package.nix
@@ -19,6 +19,12 @@ assert lib.elem variant [
  "tdx"
 ];

+let
+  kernelSrc = fetchurl {
+    url = "mirror://kernel/linux/kernel/v6.x/linux-6.12.76.tar.xz";
+    hash = "sha256-u7Q+g0xG5r1JpcKPIuZ5qTdENATh9lMgTUskkp862JY=";
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "libkrunfw" + lib.optionalString (variant != null) "-${variant}";
  version = "5.3.0";
@@ -30,14 +36,9 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-fhG/bP1HzmhyU2N+wnr1074WEGsD9RdTUUBhYUFpWlA=";
  };

-  kernelSrc = fetchurl {
-    url = "mirror://kernel/linux/kernel/v6.x/linux-6.12.76.tar.xz";
-    hash = "sha256-u7Q+g0xG5r1JpcKPIuZ5qTdENATh9lMgTUskkp862JY=";
-  };
-
  postPatch = ''
    substituteInPlace Makefile \
-      --replace 'curl $(KERNEL_REMOTE) -o $(KERNEL_TARBALL)' 'ln -s $(kernelSrc) $(KERNEL_TARBALL)'
+      --replace-fail 'curl $(KERNEL_REMOTE) -o $(KERNEL_TARBALL)' 'ln -s ${kernelSrc} $(KERNEL_TARBALL)'
  '';

  nativeBuildInputs = [
--- a/pkgs/by-name/md/mdbook-plugins/package.nix
+++ b/pkgs/by-name/md/mdbook-plugins/package.nix
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mdbook-plugins";
-  version = "0.3.4";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "RustForWeb";
    repo = "mdbook-plugins";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-28Olgft2IQvvJEQ9oqj5o96MT8rILUESQiTOtpc2xLw=";
+    hash = "sha256-qV2ECcvhuLB4bvI7UYpnUr8MlOA0USyb1QrUxR+LXOM=";
  };

-  cargoHash = "sha256-5Mok7E85DKmo0NIdUZJhinLCWKk+G0tIBKcTy71kUxk=";
+  cargoHash = "sha256-Fhk4dtdOES+72/OBvhe/9WRk5sNzEuw3np84u13pEQ0=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ms/msgpack-c/package.nix
+++ b/pkgs/by-name/ms/msgpack-c/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "msgpack-c";
-  version = "6.1.0";
+  version = "7.0.0";

  src = fetchFromGitHub {
    owner = "msgpack";
    repo = "msgpack-c";
    tag = "c-${finalAttrs.version}";
-    hash = "sha256-yL1+6w9l1Ccgrh8WXqvHv2yrb9QH+TrHIAFLXGoVuT0=";
+    hash = "sha256-mCVczuKsLGQsOjGQLt0aBW4++GMEkuCHzGifAJk5C54=";
  };

  strictDeps = true;
--- a/pkgs/by-name/mu/music-assistant/package.nix
+++ b/pkgs/by-name/mu/music-assistant/package.nix
@@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  python3,
+  python3Packages,
  fetchFromGitHub,
  ffmpeg_7-headless,
  nixosTests,
@@ -10,34 +10,33 @@
 }:

 let
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      music-assistant-frontend = self.callPackage ./frontend.nix { };
+  pythonPackages = python3Packages.overrideScope (
+    prev: final: {
+      music-assistant-frontend = prev.callPackage ./frontend.nix { };

-      music-assistant-models = super.music-assistant-models.overridePythonAttrs (oldAttrs: {
+      music-assistant-models = final.music-assistant-models.overridePythonAttrs (oldAttrs: {
        version = "1.1.115";

        src = oldAttrs.src.override {
          hash = "sha256-oEXL0B8JNH4PcltpES375ov7QGs+gtYKlMGr1B7BlKY=";
        };
      });
-    };
-  };
+    }
+  );

  providerPackages = (import ./providers.nix).providers;
  providerNames = lib.attrNames providerPackages;
  providerDependencies = lib.concatMap (
-    provider: (providerPackages.${provider} python.pkgs)
+    provider: (providerPackages.${provider} pythonPackages)
  ) providers;

-  pythonPath = python.pkgs.makePythonPath providerDependencies;
+  pythonPath = pythonPackages.makePythonPath providerDependencies;
 in

 assert
  (lib.elem "ariacast" providers) -> throw "music-assistant: ariacast has not been packaged, yet.";

-python.pkgs.buildPythonApplication rec {
+pythonPackages.buildPythonApplication rec {
  pname = "music-assistant";
  version = "2.8.7";
  pyproject = true;
@@ -99,7 +98,7 @@ python.pkgs.buildPythonApplication rec {
    fi
  '';

-  build-system = with python.pkgs; [
+  build-system = with pythonPackages; [
    setuptools
  ];

@@ -118,7 +117,7 @@ python.pkgs.buildPythonApplication rec {
  ];

  dependencies =
-    with python.pkgs;
+    with pythonPackages;
    [
      # Only packages required in pyproject.toml
      aiodns
@@ -162,7 +161,7 @@ python.pkgs.buildPythonApplication rec {
    ++ gql.optional-dependencies.all
    ++ pyjwt.optional-dependencies.crypto;

-  optional-dependencies = with python.pkgs; {
+  optional-dependencies = with pythonPackages; {
    # Required subset of optional-dependencies in pyproject.toml
    test = [
      pytest-aiohttp
@@ -172,7 +171,7 @@ python.pkgs.buildPythonApplication rec {
  };

  nativeCheckInputs =
-    with python.pkgs;
+    with pythonPackages;
    [
      pytestCheckHook
    ]
@@ -206,7 +205,7 @@ python.pkgs.buildPythonApplication rec {

  passthru = {
    inherit
-      python
+      pythonPackages
      pythonPath
      providerPackages
      providerNames
--- a/pkgs/by-name/ne/nexttrace/package.nix
+++ b/pkgs/by-name/ne/nexttrace/package.nix
@@ -7,15 +7,15 @@

 buildGoModule (finalAttrs: {
  pname = "nexttrace";
-  version = "1.6.5";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "nxtrace";
    repo = "NTrace-core";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-PpCWTak14Y2zZBYOtCHEjNtvrXo6JOAo/ddYrJZMou8=";
+    sha256 = "sha256-5J0P+HlfSt6wd/q7L/+6h7auQQBJkaA1NO053w32S8Y=";
  };
-  vendorHash = "sha256-8evslWY5EgZT5ah63t6UmREUgkuY8aYwdsox4xxyKiA=";
+  vendorHash = "sha256-9g0OZczhIhM96eYFyAMxajpIkRgNUkn6QUZtl3O/xSM=";

  buildInputs = [ libpcap ];

--- a/pkgs/by-name/ni/nixl/package.nix
+++ b/pkgs/by-name/ni/nixl/package.nix
@@ -36,7 +36,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "nixl";
-  version = "1.1.0";
+  version = "1.2.0";

  __structuredAttrs = true;
  strictDeps = true;
@@ -45,7 +45,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    owner = "ai-dynamo";
    repo = "nixl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lzR+haBtRPUJ9VE1AcPndp3CPtW7KCI3nNPeVIGyR0U=";
+    hash = "sha256-viyoFc8g0B8kXW2umd7vdAAu+XMk0CJwQEGw+ll3AJ4=";
  };

  postPatch =
--- a/pkgs/by-name/om/omnictl/package.nix
+++ b/pkgs/by-name/om/omnictl/package.nix
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "omnictl";
-  version = "1.7.3";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "omni";
    rev = "v${version}";
-    hash = "sha256-c2dYVXYH12YAvfxiCA1Rl/9y/FD7fMBEBQvvc4TmBYA=";
+    hash = "sha256-8oTLe4ZGXqL62h+AbjjKv/SmDd9cMvFO3k/0K3VdrNI=";
  };

-  vendorHash = "sha256-QstTh4deaanljpFm6zEkm6ykGhUeTjK3Az9w8JROiWY=";
+  vendorHash = "sha256-yO9b26bXCg5pSXX65vQf/8YII/92sDjGJMK40zu/3s8=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/op/opengrok/package.nix
+++ b/pkgs/by-name/op/opengrok/package.nix
@@ -8,12 +8,12 @@

 stdenv.mkDerivation rec {
  pname = "opengrok";
-  version = "1.14.12";
+  version = "1.14.13";

  # binary distribution
  src = fetchurl {
    url = "https://github.com/oracle/opengrok/releases/download/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-D67KpbmuqInnfymNc9QvreTVjZmzNuxoswD/ZxTlHx8=";
+    hash = "sha256-x15bXlAplJSv/nB3Spe7W2F7TxDM48MKulFgZ2LnIX0=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/op/opl3bankeditor/package.nix
+++ b/pkgs/by-name/op/opl3bankeditor/package.nix
@@ -12,14 +12,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "opl3bankeditor";
-  version = "1.5.1-unstable-2026-05-04";
+  version = "1.5.1-unstable-2026-05-23";

  src = fetchFromGitHub {
    owner = "Wohlstand";
    repo = "opl3bankeditor";
-    rev = "0155632a595897cb679c9f9c8575cee3eff2123d";
+    rev = "e347a35c3a29d5512b4b5c18f4e569e35238bc9f";
    fetchSubmodules = true;
-    hash = "sha256-OEcfqvvEACo270kNfli/mdf/JO45XOp9QXOmKQQTpos=";
+    hash = "sha256-FOIHsIbX5WweKFIqu5zRJQD6wn5R74OVx2jQs42oGYk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pa/pacemaker/package.nix
+++ b/pkgs/by-name/pa/pacemaker/package.nix
@@ -7,9 +7,13 @@
  bzip2,
  corosync,
  dbus,
+  docbook_xsl,
  fetchFromGitHub,
+  getopt,
+  gettext,
  glib,
  gnutls,
+  help2man,
  libqb,
  libtool,
  libuuid,
@@ -19,6 +23,7 @@
  pkg-config,
  python3,
  nixosTests,
+  versionCheckHook,

  # Pacemaker is compiled twice, once with forOCF = true to extract its
  # OCF definitions for use in the ocf-resource-agents derivation, then
@@ -26,6 +31,7 @@
  # as the OCF_ROOT.
  forOCF ? false,
  ocf-resource-agents,
+  withManpages ? !forOCF,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -35,32 +41,54 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "ClusterLabs";
    repo = "pacemaker";
-    rev = "Pacemaker-${finalAttrs.version}";
-    sha256 = "sha256-23YkNzqiimLy/KjO+hxVQQ4rUhSEhn5Oc2jUJO/VRo0=";
+    tag = "Pacemaker-${finalAttrs.version}";
+    hash = "sha256-23YkNzqiimLy/KjO+hxVQQ4rUhSEhn5Oc2jUJO/VRo0=";
  };

+  outputs = [ "out" ] ++ lib.optionals withManpages [ "man" ];
+
  nativeBuildInputs = [
    autoconf
    automake
+    gettext
+    getopt
    libtool
    pkg-config
+    python3
+  ]
+  ++ lib.optionals withManpages [
+    # If we don't supply the dependencies the manpage build will be silently skipped
+    help2man # for tool man pages (see mk/man.mk)
+    libxml2 # for other man pages (xmllint)
+    libxslt # for other man pages (xsltproc)
  ];

  buildInputs = [
    bash
    bzip2
    corosync
-    dbus.dev
+    dbus
    glib
    gnutls
    libqb
+    libtool
    libuuid
-    libxml2.dev
-    libxslt.dev
+    libxml2
+    libxslt
    pam
-    python3
  ];

+  strictDeps = true;
+
+  # If we do this unconditionally the build will fail because it sees a valid MANPAGE_XSLT
+  # but required executables are not available.
+  postPatch = lib.optionalString withManpages ''
+    # Avoid the use of xmlcatalog to resolve stylesheet for manpages, but set the path directly
+    substituteInPlace configure.ac \
+      --replace-fail 'MANPAGE_XSLT=""' 'MANPAGE_XSLT="${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl"' \
+      --replace-fail 'AS_IF([test x"''${XSLTPROC}" != x""],' 'AS_IF([false],'
+  '';
+
  preConfigure = ''
    ./autogen.sh --prefix="$out"
  '';
@@ -87,11 +115,21 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

-  postInstall = ''
-    # pacemaker's install linking requires a weirdly nested hierarchy
-    mv $out$out/* $out
-    rm -r $out/nix
-  '';
+  # pacemaker's install linking requires a weirdly nested hierarchy
+  postInstall =
+    lib.optionalString withManpages ''
+      mkdir -p $man
+      mv $out$man/* $man
+    ''
+    + ''
+      mv $out$out/* $out
+      rm -r $out/nix
+    '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = [ "${placeholder "out"}/sbin/pacemakerd" ];
+  versionCheckProgramArg = "--version";

  passthru.tests = {
    inherit (nixosTests) pacemaker;
--- a/pkgs/applications/misc/peaclock/default.nix
+++ b/pkgs/applications/misc/peaclock/default.nix
@@ -1,21 +1,21 @@
 {
  lib,
-  stdenv,
+  gccStdenv,
  fetchFromGitHub,
  cmake,
  libpthread-stubs,
  icu,
 }:

-stdenv.mkDerivation rec {
+gccStdenv.mkDerivation (finalAttrs: {
  pname = "peaclock";
  version = "0.4.3";

  src = fetchFromGitHub {
    owner = "octobanana";
    repo = "peaclock";
-    rev = version;
-    sha256 = "1582vgslhpgbvcd7ipgf1d1razrvgpq1f93q069yr2bbk6xn8i16";
+    tag = finalAttrs.version;
+    hash = "sha256-JkRku5lrieyTAXgkF/B9O3+VQwvu3Xga2+tdSPXbApU=";
  };

  nativeBuildInputs = [ cmake ];
@@ -32,4 +32,4 @@ stdenv.mkDerivation rec {
    maintainers = with lib.maintainers; [ djanatyn ];
    mainProgram = "peaclock";
  };
-}
+})
--- a/pkgs/by-name/ph/phpantom-lsp/package.nix
+++ b/pkgs/by-name/ph/phpantom-lsp/package.nix
@@ -11,14 +11,14 @@ let
  stubsSrc = fetchFromGitHub {
    owner = "JetBrains";
    repo = "phpstorm-stubs";
-    rev = "3327932472f512d2eb9e122b19702b335083fd9d";
-    hash = "sha256-WN5DAvaw4FfHBl2AqSo1OcEthUm3lOpikdB78qy3cyY=";
+    rev = "517b9ad1adaf2c5453c00ec2fbb02d192a4a9b6c";
+    hash = "sha256-IDWAuy301avfTF/E7Mby2JQQtIr/gnN5flZ3uctUpus=";
  };
 in

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "phpantom-lsp";
-  version = "0.7.0";
+  version = "0.8.0";

  __structuredAttrs = true;

@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "AJenbo";
    repo = "phpantom_lsp";
    tag = finalAttrs.version;
-    hash = "sha256-ZmtOdoxXkwn2IDg7RyQ9KG0RNz5mrGDMcESfcOSR3Ig=";
+    hash = "sha256-00NAiPm3qqxyS1u1GPpJlgnBlUjDx9VmjK6oOwH8kcU=";
  };

  postPatch = ''
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      > stubs/jetbrains/phpstorm-stubs/.commit
  '';

-  cargoHash = "sha256-pXP4qItYgmUXVx9XwMdS6WLVc5lP7P4VX9+0TbhYrUc=";
+  cargoHash = "sha256-FyMI8Kb3QUD8Jui9k7vayMcQC+KWL8sZi3A05NPbXsg=";

  checkFlags = [
    "--test"
--- a/pkgs/by-name/pl/plover/package.nix
+++ b/pkgs/by-name/pl/plover/package.nix
@@ -3,7 +3,7 @@
  config,
  python3Packages,
  # For aliases
-  plover,
+  plover_4,
 }:
 python3Packages.toPythonApplication python3Packages.plover
 # Aliases to now-dropped plover.stable and plover.dev
@@ -11,7 +11,8 @@ python3Packages.toPythonApplication python3Packages.plover
 # TODO(@ShamrockLee): remove after Nixpkgs 25.11 EOL
 // lib.optionalAttrs (config.allowAliases && !(lib.oldestSupportedReleaseIsAtLeast 2605)) {
  dev =
-    lib.throwIf (lib.oldestSupportedReleaseIsAtLeast 2511) "plover.dev was renamed. Use plover instead."
-      plover; # Added 2026-04-26
+    lib.throwIf (lib.oldestSupportedReleaseIsAtLeast 2511)
+      "plover.dev was renamed. Use plover, plover_5, or plover_4 instead."
+      plover_4; # Added 2026-05-07
  stable = throw "plover.stable was renamed. Use plover instead."; # Added 2022-06-05; updated 2026-04-26
 }
--- a/pkgs/by-name/qm/qmediathekview/package.nix
+++ b/pkgs/by-name/qm/qmediathekview/package.nix
@@ -4,19 +4,32 @@
  fetchFromGitHub,
  boost,
  xz,
+  cargo,
  pkg-config,
-  libsForQt5,
+  qt6Packages,
+  rustPlatform,
+  sqlite,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "QMediathekView";
-  version = "0.2.1";
+  version = "0.2.3";

  src = fetchFromGitHub {
    owner = "adamreichold";
    repo = "QMediathekView";
    tag = "v${finalAttrs.version}";
-    sha256 = "0i9hac9alaajbra3lx23m0iiq6ww4is00lpbzg5x70agjrwj0nd6";
+    hash = "sha256-miqCzNTqbZwPuy6P911wlf5TF1lECzNW/02/edK8XaU=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      cargoRoot
+      ;
+    hash = "sha256-89ogtmtJRgMoPOjyW+OGoptKE8VP9lUhbsB5vrdP7zQ=";
  };

  postPatch = ''
@@ -25,17 +38,24 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  buildInputs = [
-    libsForQt5.qtbase
+    qt6Packages.qtbase
+    sqlite
    xz
    boost
  ];

  nativeBuildInputs = [
-    libsForQt5.qmake
+    qt6Packages.qmake
+    cargo
    pkg-config
-    libsForQt5.wrapQtAppsHook
+    qt6Packages.wrapQtAppsHook
+    rustPlatform.cargoSetupHook
  ];

+  cargoRoot = "internals";
+
+  env.HOST_AR = lib.getExe' stdenv.cc.bintools.bintools "ar";
+
  installFlags = [ "INSTALL_ROOT=$(out)" ];

  meta = {
--- a/pkgs/by-name/qt/qtox/package.nix
+++ b/pkgs/by-name/qt/qtox/package.nix
@@ -17,7 +17,6 @@
  libopus,
  libvpx,
  openal,
-  pcre,
  qrencode,
  qt6,
  sqlcipher,
@@ -47,7 +46,6 @@ stdenv.mkDerivation (finalAttrs: {
    libsodium
    libvpx
    openal
-    pcre
    qrencode
    qt6.qtbase
    qt6.qtsvg
--- a/pkgs/by-name/ra/rabtap/package.nix
+++ b/pkgs/by-name/ra/rabtap/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "rabtap";
-  version = "1.44.1";
+  version = "1.45.0";

  src = fetchFromGitHub {
    owner = "jandelgado";
    repo = "rabtap";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-mW2O8/22zbA3/wpYkQHCI0z8EEL0Wyud2TD5vNUJrNI=";
+    sha256 = "sha256-1cNwNqbvF+i5GgzRD3RyFesGjA4/kJWFotPjJC+r/7g=";
  };

-  vendorHash = "sha256-Yi4vH3UMOE//p3H9iCR5RY3SjjR0mu2sBRx8WK57Dq8=";
+  vendorHash = "sha256-fp605VqspavEFQESP7yY6VG80ZpV6h33uhj2hoQiDKk=";

  ldflags = [
    "-X main.BuildVersion=v${finalAttrs.version}"
--- a/pkgs/by-name/ra/ralphex/package.nix
+++ b/pkgs/by-name/ra/ralphex/package.nix
@@ -9,7 +9,7 @@

 buildGoModule (finalAttrs: {
  pname = "ralphex";
-  version = "1.3.2";
+  version = "1.4.0";

  __structuredAttrs = true;

@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
    owner = "umputun";
    repo = "ralphex";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4+U2m6dPH4u5RCt1eIeR1PMU90hDD13mmu+2bXnF7D0=";
+    hash = "sha256-IIGZ4uJRm4eYZW0Ezxuis1unEPUs8jUaKIcNyaUBCMg=";
  };

  vendorHash = null;
--- a/pkgs/by-name/rt/rtk/package.nix
+++ b/pkgs/by-name/rt/rtk/package.nix
@@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rtk";
-  version = "0.41.0";
+  version = "0.42.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "rtk-ai";
    repo = "rtk";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-C8ns53qLpBdb5osdX68UBGMqM2Rs5UJyfal/iDns6a4=";
+    hash = "sha256-ZCDVS/AFljljMac+cAzQztYPQgvQrcEhKIHHRhkMsv8=";
  };

-  cargoHash = "sha256-gDkXAiW8ajEpsEBb7KT9MO5fPEWyUqS+2ak34cipPdc=";
+  cargoHash = "sha256-CFhKBzJc2/+gZDfHq7wxBWEbtHV8EF3OYa+t1b9aL8k=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/sf/sftpgo/package.nix
+++ b/pkgs/by-name/sf/sftpgo/package.nix
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "sftpgo";
-  version = "2.7.1";
+  version = "2.7.3";

  src = fetchFromGitHub {
    owner = "drakkan";
    repo = "sftpgo";
    tag = "v${version}";
-    hash = "sha256-y5Khka7r1Mostg8qPdTlSOieO+x7AdvJFIefILT97OI=";
+    hash = "sha256-6VCm9rbC63UE5yUaY0JVe+Mf3thK+ZDhSOzzIvI1vzA=";
  };

-  vendorHash = "sha256-yIrI0yN+htfC+yORILt8oB+iu2UYWxxL6tzb4dzxtD0=";
+  vendorHash = "sha256-EB5Vyn08yZGl9HVaLAhgkJw/iuY07scd689my9aEimY=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch
+++ b/pkgs/by-name/sk/skypilot/0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch
@@ -0,0 +1,31 @@
+From 6a2202baf3edff90aea6b66996a8e11e4e7c133e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ak=E1=B9=A3aya=20=C5=9Ar=C4=ABniv=C4=81san?=
+ <akssri@vakra.xyz>
+Date: Wed, 13 May 2026 13:31:19 +0530
+Subject: [PATCH] Fix --docker flag default for Click >= 8.2 compatibility
+
+Click 8.2 changed flag_value option handling: default=False is no longer
+normalised to None before the 'is None' guard. Change to default=None so
+sky launch works with Click >= 8.2 (e.g. nixpkgs).
+
+Upstream constrains click<8.2; this makes the code robust to newer versions.
+---
+ sky/client/cli/command.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sky/client/cli/command.py b/sky/client/cli/command.py
+index 6ee1102d0..15a5057d6 100644
+--- a/sky/client/cli/command.py
+++ b/sky/client/cli/command.py
+@@ -1072,7 +1072,7 @@ def _handle_infra_cloud_region_zone_options(infra: Optional[str],
+ @click.option('--docker',
+               'backend_name',
+               flag_value=backends.LocalDockerBackend.NAME,
+-              default=False,
+              default=None,
+               hidden=True,
+               help=('(Deprecated) Local docker support is deprecated. '
+                     'To run locally, create a local Kubernetes cluster with '
+-- 
+2.53.0
+
--- a/pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch
+++ b/pkgs/by-name/sk/skypilot/0002-Fix-websocket-proxy-call-script-directly-as-executable.patch
@@ -0,0 +1,37 @@
+diff --git a/sky/client/cli/command.py b/sky/client/cli/command.py
+index 15a5057d6..5417cad9f 100644
+--- a/sky/client/cli/command.py
+++ b/sky/client/cli/command.py
+@@ -203,7 +203,6 @@ def _get_cluster_records_and_set_ssh_config(
+             escaped_key_path = shlex.quote(
+                 (cluster_utils.SSHConfigHelper.generate_local_key_file(
+                     handle.cluster_name, credentials)))
+-            escaped_executable_path = shlex.quote(sys.executable)
+             escaped_websocket_proxy_path = shlex.quote(
+                 f'{directory_utils.get_sky_dir()}/templates/websocket_proxy.py')
+             # Instead of directly use websocket_proxy.py, we add an
+@@ -220,8 +219,7 @@ def _get_cluster_records_and_set_ssh_config(
+                 # TODO(zhwu): write the template to a temp file, don't use
+                 # the one in skypilot repo, to avoid changing the file when
+                 # updating skypilot.
+-                f'\"{escaped_executable_path} '
+-                f'{escaped_websocket_proxy_path} '
+                f'\"{escaped_websocket_proxy_path} '
+                 f'{server_common.get_server_url()} '
+                 f'{handle.cluster_name} '
+                 f'kubernetes-pod-ssh-proxy\"')
+@@ -229,13 +227,11 @@ def _get_cluster_records_and_set_ssh_config(
+         elif isinstance(handle.launched_resources.cloud, clouds.Slurm):
+             # Replace the proxy command to proxy through the SkyPilot API
+             # server with websocket.
+-            escaped_executable_path = shlex.quote(sys.executable)
+             escaped_websocket_proxy_path = shlex.quote(
+                 f'{directory_utils.get_sky_dir()}/templates/websocket_proxy.py')
+             # %w is a placeholder for the node index, substituted per-node
+             # in cluster_utils.SSHConfigHelper.add_cluster().
+-            proxy_command = (f'{escaped_executable_path} '
+-                             f'{escaped_websocket_proxy_path} '
+            proxy_command = (f'{escaped_websocket_proxy_path} '
+                              f'{server_common.get_server_url()} '
+                              f'{handle.cluster_name} '
+                              f'slurm-job-ssh-proxy %w')
--- a/pkgs/by-name/sk/skypilot/package.nix
+++ b/pkgs/by-name/sk/skypilot/package.nix
@@ -35,6 +35,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
  pyproject = true;
  pythonRelaxDeps = true;

+  patches = [
+    ./0001-Fix-docker-flag-default-for-Click-8.2-compatibility.patch
+    ./0002-Fix-websocket-proxy-call-script-directly-as-executable.patch
+  ];
+
  nativeBuildInputs = [
    writableTmpDirAsHomeHook
  ];
@@ -217,6 +222,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
    cp -r ${dashboard}/* $out/${python3Packages.python.sitePackages}/sky/dashboard/out/
  '';

+  postFixup = ''
+    chmod +x $out/${python3Packages.python.sitePackages}/sky/templates/websocket_proxy.py
+    wrapPythonProgramsIn "$out/${python3Packages.python.sitePackages}/sky/templates" "$out ''${pythonPath[*]}"
+  '';
+
  # Excluding the tests as it fails with error:
  # Message: 'Config loaded from /build/source/examples/admin_policy/restful_policy.yaml:\nadmin_policy: http://localhost:8080\n'
  #Arguments: ()
--- a/pkgs/by-name/sp/spruce/package.nix
+++ b/pkgs/by-name/sp/spruce/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "spruce";
-  version = "1.35.4";
+  version = "1.35.5";

  src = fetchFromGitHub {
    owner = "geofffranks";
    repo = "spruce";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Ulto2lYkCs/dGFDqnqU8RLxNhFY9vwl0b6E0HFeuX0I=";
+    hash = "sha256-VMHtIjg0Fact1gupE0GeZNHX0Tk34rpS6/M8Yiyeuhk=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ss/sshfs-fuse/common.nix
+++ b/pkgs/by-name/ss/sshfs-fuse/common.nix
@@ -1,93 +0,0 @@
-{
-  version,
-  hash,
-  platforms,
-  patches ? [ ],
-}:
-
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  meson,
-  pkg-config,
-  ninja,
-  docutils,
-  makeWrapper,
-  fuse3,
-  macfuse-stubs,
-  glib,
-  which,
-  python3Packages,
-  openssh,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "sshfs-fuse";
-  inherit version;
-
-  src = fetchFromGitHub {
-    owner = "libfuse";
-    repo = "sshfs";
-    tag = "sshfs-${finalAttrs.version}";
-    inherit hash;
-  };
-
-  inherit patches;
-
-  nativeBuildInputs = [
-    meson
-    pkg-config
-    ninja
-    docutils
-    makeWrapper
-  ];
-  buildInputs = [
-    fuse3
-    glib
-  ];
-  nativeCheckInputs = [
-    which
-    python3Packages.pytest
-  ];
-
-  env.NIX_CFLAGS_COMPILE = lib.optionalString (
-    stdenv.hostPlatform.system == "i686-linux"
-  ) "-D_FILE_OFFSET_BITS=64";
-
-  postInstall = ''
-    mkdir -p $out/sbin
-    ln -sf $out/bin/sshfs $out/sbin/mount.sshfs
-  ''
-  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    wrapProgram $out/bin/sshfs --prefix PATH : "${openssh}/bin"
-  '';
-
-  outputs = [
-    "out"
-    "man"
-  ];
-
-  # doCheck = true;
-  checkPhase = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    # The tests need fusermount:
-    mkdir bin
-    cp ${fuse3}/bin/fusermount3 bin/fusermount
-    export PATH=bin:$PATH
-    # Can't access /dev/fuse within the sandbox: "FUSE kernel module does not seem to be loaded"
-    substituteInPlace test/util.py --replace "/dev/fuse" "/dev/null"
-    # TODO: "fusermount executable not setuid, and we are not root"
-    # We should probably use a VM test instead
-    ${python3Packages.python.interpreter} -m pytest test/
-  '';
-
-  meta = {
-    inherit platforms;
-    description = "FUSE-based filesystem that allows remote filesystems to be mounted over SSH";
-    longDescription = macfuse-stubs.warning;
-    homepage = "https://github.com/libfuse/sshfs";
-    license = lib.licenses.gpl2Plus;
-    mainProgram = "sshfs";
-    maintainers = [ ];
-  };
-})
--- a/pkgs/by-name/ss/sshfs-fuse/package.nix
+++ b/pkgs/by-name/ss/sshfs-fuse/package.nix
@@ -1,14 +1,85 @@
 {
  lib,
-  callPackage,
-  fetchpatch,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  pkg-config,
+  ninja,
+  docutils,
+  makeWrapper,
+  fuse3,
+  macfuse-stubs,
+  glib,
+  which,
+  python3Packages,
+  openssh,
 }:

-let
-  mkSSHFS = args: callPackage (import ./common.nix args) { };
-in
-mkSSHFS {
-  version = "3.7.5";
-  hash = "sha256-6SFjYYWx+p9tZQ670nbjbPtH/QvCAGCB0YwkaQbKIqA=";
-  platforms = lib.platforms.darwin ++ lib.platforms.linux;
-}
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sshfs-fuse";
+  version = "3.7.6";
+
+  src = fetchFromGitHub {
+    owner = "libfuse";
+    repo = "sshfs";
+    tag = "sshfs-${finalAttrs.version}";
+    hash = "sha256-BT9qttXyryliR2kV1xVYvcwJhB6gkGf7IEwrTB38SvI=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+    docutils
+    makeWrapper
+  ];
+  buildInputs = [
+    fuse3
+    glib
+  ];
+  nativeCheckInputs = [
+    which
+    python3Packages.pytest
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (
+    stdenv.hostPlatform.system == "i686-linux"
+  ) "-D_FILE_OFFSET_BITS=64";
+
+  postInstall = ''
+    mkdir -p $out/sbin
+    ln -sf $out/bin/sshfs $out/sbin/mount.sshfs
+  ''
+  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+    wrapProgram $out/bin/sshfs --prefix PATH : "${openssh}/bin"
+  '';
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  # doCheck = true;
+  checkPhase = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+    # The tests need fusermount:
+    mkdir bin
+    cp ${fuse3}/bin/fusermount3 bin/fusermount
+    export PATH=bin:$PATH
+    # Can't access /dev/fuse within the sandbox: "FUSE kernel module does not seem to be loaded"
+    substituteInPlace test/util.py --replace "/dev/fuse" "/dev/null"
+    # TODO: "fusermount executable not setuid, and we are not root"
+    # We should probably use a VM test instead
+    ${python3Packages.python.interpreter} -m pytest test/
+  '';
+
+  meta = {
+    changelog = "https://github.com/libfuse/sshfs/blob/${finalAttrs.src.tag}/ChangeLog.rst";
+    description = "FUSE-based filesystem that allows remote filesystems to be mounted over SSH";
+    longDescription = macfuse-stubs.warning;
+    homepage = "https://github.com/libfuse/sshfs";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.darwin ++ lib.platforms.linux;
+    mainProgram = "sshfs";
+    maintainers = [ ];
+  };
+})
--- a/pkgs/by-name/st/steelix/package.nix
+++ b/pkgs/by-name/st/steelix/package.nix
@@ -9,13 +9,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "steelix";
-  version = "0-unstable-2026-05-09";
+  version = "0-unstable-2026-05-21";

  src = fetchFromGitHub {
    owner = "mattwparas";
    repo = "helix";
-    rev = "47b4664ac868b334c9cb914d6b6bfa2045249d13";
-    hash = "sha256-+090DLPNNsDoYpAEgH9r5+8n0jQSbL7/5ThUJIT2yGg=";
+    rev = "4d86612df48447088ef4190bf503fd54a7562aa9";
+    hash = "sha256-qAUODNxHM9K6CrRCFgfBcbqzRd+YHiWn9fEfmIzrohA=";
  };

  cargoHash = "sha256-6bu8sIM4So3AbnHHYbh8uu+rEB4IjMQjDgh7/AkLQs0=";
--- a/pkgs/by-name/ti/timr-tui/package.nix
+++ b/pkgs/by-name/ti/timr-tui/package.nix
@@ -14,16 +14,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "timr-tui";
-  version = "1.8.1";
+  version = "1.9.0";

  src = fetchFromGitHub {
    owner = "sectore";
    repo = "timr-tui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9HaKBrW0MkNzDErEIINztLyGpN4mkGF5RpmXohgbK6A=";
+    hash = "sha256-MEDqrP/wlFHMkXFUwn+VQu8gEjc40xI5xcetG/VqSic=";
  };

-  cargoHash = "sha256-J6Zi8oEAsbxMQe+oCk9T6Ic1hPdNXI9iFmn4Z0d0lFE=";
+  cargoHash = "sha256-lQw6p0+uph2P4OdQq2Mz3EHc9o8RcH3SjYPzGvPn2tk=";

  # Enable upstream "sound" feature when requested
  buildFeatures = lib.optionals enableSound [ "sound" ];
--- a/pkgs/by-name/tl/tldx/package.nix
+++ b/pkgs/by-name/tl/tldx/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "tldx";
-  version = "1.3.4";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "brandonyoungdev";
    repo = "tldx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yKC/omwFG4equAlBHz25Wx+X/06N0x4vdNchiWSfZZQ=";
+    hash = "sha256-SN5uGIzC6a+cPSnrfL+1A+3NIQR6gbILFv7X9L8g/N8=";
  };

-  vendorHash = "sha256-FVcTTfOf1eAiR6Iys1uesZWpVrnMTGX7zS1MdeXDoQM=";
+  vendorHash = "sha256-IVxhgsw36/fNVV0Kn7aBza3htPzK09l84qBg3FBtOo0=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/to/tor/package.nix
+++ b/pkgs/by-name/to/tor/package.nix
@@ -46,11 +46,11 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "tor";
-  version = "0.4.9.8";
+  version = "0.4.9.9";

  src = fetchurl {
    url = "https://dist.torproject.org/tor-${finalAttrs.version}.tar.gz";
-    hash = "sha256-rB85Ti3Sqwh30n2Sj9DZ6GZi/jymr9/7n9m28PltBd4=";
+    hash = "sha256-vXW6f9aPYHx4Bvz3AVajAKqSbprWml5WqOZBT1In6DM=";
  };

  outputs = [
--- a/pkgs/by-name/ve/versatiles/package.nix
+++ b/pkgs/by-name/ve/versatiles/package.nix
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "versatiles";
-  version = "4.1.2";
+  version = "4.1.4";

  src = fetchFromGitHub {
    owner = "versatiles-org";
    repo = "versatiles-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kWUosTubAD/qk6xEGKUiLrw4mrAaOwwuQ3r+UeLsEJU=";
+    hash = "sha256-rM+ybYQTajF0YZoyJPKgc8wtJe5TWqMv8TeGBO/HC/E=";
  };

-  cargoHash = "sha256-rTVk8c00b94x6wEIDLvwadCQ/DXSFOPWcKYFSI9YI64=";
+  cargoHash = "sha256-PJ6tUd9ppSkv0FOWppR9RCc2TBbd1kr7ArasuFVx3OY=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/vi/virglrenderer/package.nix
+++ b/pkgs/by-name/vi/virglrenderer/package.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
  mesonFlags = [
    (lib.mesonBool "video" vaapiSupport)
    (lib.mesonBool "venus" vulkanSupport)
+    (lib.mesonBool "vulkan-dload" false)
    (lib.mesonOption "drm-renderers" (
      lib.optionalString nativeContextSupport (
        lib.concatStringsSep "," (
--- a/pkgs/by-name/wa/wasm-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-tools/package.nix
@@ -6,20 +6,20 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wasm-tools";
-  version = "1.250.0";
+  version = "1.251.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wasm-tools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YzALjnjsEHGufpTPV7XHVvNL3xU727eJoE6db9KjStc=";
+    hash = "sha256-U02BnWiC6u7QPA2sCYC+BIgsjRbpjQFNK3tNAi/Td5Q=";
    fetchSubmodules = true;
  };

  # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
  auditable = false;

-  cargoHash = "sha256-rHoLTljDw4mzZBrpSO600TN/DVr3JKPvYVdT1vC7ynw=";
+  cargoHash = "sha256-YXG6V8eBZm1NNvADhB71pkI05UcfkVW7t6N7kTH/I5Q=";
  cargoBuildFlags = [
    "--package"
    "wasm-tools"
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -10,13 +10,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "werf";
-  version = "2.68.2";
+  version = "2.69.0";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-961fPVffLh11QaJJYXIkXZiS+gNLqDKzImZw7DtFzgw=";
+    hash = "sha256-pSWrHbstEHvN9Kzql6naZ7HVxuH76xM5v2UMDY5QZ74=";
  };

  proxyVendor = true;
--- a/pkgs/by-name/wk/wkg/package.nix
+++ b/pkgs/by-name/wk/wkg/package.nix
@@ -8,15 +8,15 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wkg";
-  version = "0.15.0";
+  version = "0.15.1";
  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wasm-pkg-tools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G576caJ9oeYDFDIOP75mfkw6/JsxYyfDsVlFhb0RbIE=";
+    hash = "sha256-xWwhRqo/rRa+VPe2RqoZf77pf3YjqCdbOG8axme9oW4=";
  };

-  cargoHash = "sha256-3sf6fyLaiB/w6PF6CzO7p9ZHdBTLAzqIHEhT4COY/4A=";
+  cargoHash = "sha256-L0KYEnmvTUI6GreuEDf6QzNkTHzsLo/U27RrSwF5sA4=";

  # A large number of tests require Internet access in order to function.
  doCheck = false;
--- a/pkgs/by-name/zu/zuban/package.nix
+++ b/pkgs/by-name/zu/zuban/package.nix
@@ -9,13 +9,13 @@
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zuban";

-  version = "0.7.2";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "zubanls";
    repo = "zuban";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KCQOJ2NyWohbfW6fdG7F+borxUEXOy1IRB/jlc1wrc0=";
+    hash = "sha256-/m66vCXutOBMXMJfulJ9nFeqRWVJCIrHVJiICOvs/+A=";
    fetchSubmodules = true;
  };

@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  buildAndTestSubdir = "crates/zuban";

-  cargoHash = "sha256-r8ezvIkd4R3rFdoKr+KKHKnLWl1/Vl3Ch9GdKhVflMo=";
+  cargoHash = "sha256-mT8QG4pI96gTgFFZN49Yi7Ax90ulPM8pA0tdB/fdSuM=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix
+++ b/pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix
@@ -291,7 +291,7 @@
    };

    # No changes from 13.1 to 13.2
-    # https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    # https://docs.nvidia.com/cuda/archive/13.2.0/cuda-installation-guide-linux/index.html#host-compiler-support-policy
    "13.2" = {
      clang = {
        maxMajorVersion = "21";
@@ -302,5 +302,18 @@
        minMajorVersion = "6";
      };
    };
+
+    # No changes from 13.2 to 13.3
+    # https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    "13.3" = {
+      clang = {
+        maxMajorVersion = "21";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "15";
+        minMajorVersion = "6";
+      };
+    };
  };
 }
--- a/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_13.3.0.json
+++ b/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_13.3.0.json
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -294,6 +294,12 @@ self: super:

    warp = overrideCabal (drv: {
      __darwinAllowLocalNetworking = true;
+      # These fail in darwin sandbox with:
+      #   Network.SendFile.MacOS.sendloopHeader: permission denied (Operation not permitted)
+      testFlags = drv.testFlags or [ ] ++ [
+        "--skip=/Response/range requests/"
+        "--skip=/Response/partial files/"
+      ];
    }) super.warp;

    ghcjs-dom-hello = overrideCabal (drv: {
--- a/pkgs/development/libraries/aspell/aspell-with-dicts.nix
+++ b/pkgs/development/libraries/aspell/aspell-with-dicts.nix
@@ -30,7 +30,7 @@ buildEnv {
    pushd "${aspell}/bin"
    for prg in *; do
      if [ -f "$prg" ]; then
-        makeWrapper "${aspell}/bin/$prg" "$out/bin/$prg" --set ASPELL_CONF "dict-dir $out/lib/aspell; data-dir $out/share/aspell"
+        makeWrapper "${aspell}/bin/$prg" "$out/bin/$prg" --set ASPELL_CONF "dict-dir $out/lib/aspell; data-dir $out/lib/aspell"
      fi
    done
    popd
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -460,14 +460,6 @@ stdenv.mkDerivation (
          hash = "sha256-ulB5BujAkoRJ8VHou64Th3E94z6m+l6v9DpG7/9nYsM=";
        })
      ]
-      ++ optionals (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2") [
-        (fetchpatch2 {
-          # this can be removed post 6.1
-          name = "fix_build_failure_due_to_PropertyKey_EncoderID";
-          url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/cb049d377f54f6b747667a93e4b719380c3e9475";
-          hash = "sha256-sxRXKKgUak5vsQTiV7ge8vp+N22CdTIvuczNgVRP72c=";
-        })
-      ]
      ++ optionals (lib.versionOlder version "7.1.1") [
        (fetchpatch2 {
          name = "texinfo-7.1.patch";
--- a/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
+++ b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "qtstyleplugin-kvantum${lib.optionalString isQt5 "5"}";
-  version = "1.1.7";
+  version = "1.1.8";

  src = fetchFromGitHub {
    owner = "tsujan";
    repo = "Kvantum";
    rev = "V${finalAttrs.version}";
-    hash = "sha256-S/oIkr0C4fj78ih8Tm6pKxlREEMLeF5Va7+3jC6bK3c=";
+    hash = "sha256-Ki3AAcKKuPNARXH6kMsxA2JfouNPJIQkXjTE+7+vgq4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/facedancer/default.nix
+++ b/pkgs/development/python-modules/facedancer/default.nix
@@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "facedancer";
-  version = "3.1.2";
+  version = "3.1.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "greatscottgadgets";
    repo = "facedancer";
    tag = version;
-    hash = "sha256-CJU+ltQ+bWBK5AGS2WMR5RMx4UblknrCAMZyIAG/1bQ=";
+    hash = "sha256-kWXO3q4KpMZNgZvVEw3yhKQ7eLzaVQ/4y+GQcd7Hd8U=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/httpcore2/default.nix
+++ b/pkgs/development/python-modules/httpcore2/default.nix
@@ -9,8 +9,8 @@
  uv-dynamic-versioning,

  # dependencies
-  certifi,
  h11,
+  truststore,

  # optional dependencies
  h2,
@@ -29,14 +29,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "httpcore2";
-  version = "2.2.0";
+  version = "2.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "httpx2";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RdoMDF5XVOkb4JCmytdF0JmBfTUcHuM1N+SD8r+RNiU=";
+    hash = "sha256-cW6meHx6VBMz5r/lXCKKK7Sq4e2nk+n1A5YTNtR2kB4=";
  };

  postPatch = ''
@@ -50,8 +50,8 @@ buildPythonPackage (finalAttrs: {
  ];

  dependencies = [
-    certifi
    h11
+    truststore
  ];

  optional-dependencies = {
--- a/pkgs/development/python-modules/httpx2/default.nix
+++ b/pkgs/development/python-modules/httpx2/default.nix
@@ -40,14 +40,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "httpx2";
-  version = "2.2.0";
+  version = "2.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "httpx2";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RdoMDF5XVOkb4JCmytdF0JmBfTUcHuM1N+SD8r+RNiU=";
+    hash = "sha256-cW6meHx6VBMz5r/lXCKKK7Sq4e2nk+n1A5YTNtR2kB4=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/icalendar-searcher/default.nix
+++ b/pkgs/development/python-modules/icalendar-searcher/default.nix
@@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "icalendar-searcher";
-  version = "1.0.5";
+  version = "1.0.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "python-caldav";
    repo = "icalendar-searcher";
    tag = "v${version}";
-    hash = "sha256-x11gdW6FuSCktMGtPxTg39C98J0/0C7F07jIHN0ewbY=";
+    hash = "sha256-HkiKy38B5+i6Lb+0Teu/YqvrE1gqy/x3u1GRUWAHNes=";
  };

  build-system = [
--- a/pkgs/development/python-modules/lizard/default.nix
+++ b/pkgs/development/python-modules/lizard/default.nix
@@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "lizard";
-  version = "1.22.1";
+  version = "1.22.2";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "terryyin";
    repo = "lizard";
    tag = version;
-    hash = "sha256-k4HrecW6577GaxEGlkKNtqrHP1cSWOvWN32EUNeOuSg=";
+    hash = "sha256-Gh7ufW8A3FiQMCppwl2SIeOie9O/kl3wYxV4kW4raDQ=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/proton-vpn-local-agent/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-local-agent/default.nix
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "proton-vpn-local-agent";
-  version = "1.6.1";
+  version = "1.6.2";
  pyproject = false;
  withDistOutput = false;

@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "ProtonVPN";
    repo = "local-agent-rs";
    rev = version;
-    hash = "sha256-QELvjPJhS8nsQqNucwhMjbwDVg2YiESuhSB1XCN0o90=";
+    hash = "sha256-VmZ8nsKqP8jyNe7Rl+PHsXhsjgchq3rKmTtAqFEe7yM=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
@@ -29,7 +29,7 @@ buildPythonPackage rec {
      src
      sourceRoot
      ;
-    hash = "sha256-28WEWWI29EYADq/z7C01LxaeBJw8oWiF24iLpduJZ5w=";
+    hash = "sha256-MOCLMQ8mqv8Q3I3bIS0ynfpPmrULMA+80RHZBeu7r5s=";
  };

  sourceRoot = "${src.name}/python-proton-vpn-local-agent";
--- a/pkgs/development/python-modules/qpageview/default.nix
+++ b/pkgs/development/python-modules/qpageview/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "qpageview";
-  version = "1.0.4";
+  version = "1.0.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "frescobaldi";
    repo = "qpageview";
    tag = "v${version}";
-    hash = "sha256-PqoYxSYOsR/tsV3NZmxCtK1fKQuo8WUJZVBSNRjVNLw=";
+    hash = "sha256-oXZr35ZD+cFEgRNojpiW14xceGC9taMNTFvXHmyyeFg=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/ripser/default.nix
+++ b/pkgs/development/python-modules/ripser/default.nix
@@ -20,14 +20,14 @@

 buildPythonPackage rec {
  pname = "ripser";
-  version = "0.6.14";
+  version = "0.6.15";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "scikit-tda";
    repo = "ripser.py";
    tag = "v${version}";
-    hash = "sha256-p47vhrG8+B226/no4PD7+XFNccbNJvi45Luwu287ygI=";
+    hash = "sha256-zzqyTVhoL8l/fN0nnkzmyxNG4t1s9z0ZueKkc/NO5FA=";
  };

  build-system = [
--- a/pkgs/development/python-modules/ucsmsdk/default.nix
+++ b/pkgs/development/python-modules/ucsmsdk/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "ucsmsdk";
-  version = "0.9.25";
+  version = "0.9.26";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "CiscoUcs";
    repo = "ucsmsdk";
    tag = "v${version}";
-    hash = "sha256-hpGWaBlzfb5rcmgnmVQFGGH5T/EJRdilIH4Q83Ml8XQ=";
+    hash = "sha256-PX9SoUhFp0XlEXaKKEh1TA7+gNCUj+t0jOR5hgosu9c=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/ufo2ft/default.nix
+++ b/pkgs/development/python-modules/ufo2ft/default.nix
@@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "ufo2ft";
-  version = "3.7.2";
+  version = "3.8.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "googlefonts";
    repo = "ufo2ft";
    tag = "v${version}";
-    hash = "sha256-g8nPtIGUiUVV0exddKGBRbLhO/XW+5bBNlYXRDlkIZM=";
+    hash = "sha256-Y9QyirOYbZ7fNivsb2N/hNlzr5FZqyscN9m1G8x1icE=";
  };

  build-system = [
--- a/pkgs/development/python-modules/yara-x/default.nix
+++ b/pkgs/development/python-modules/yara-x/default.nix
@@ -9,21 +9,21 @@

 buildPythonPackage rec {
  pname = "yara-x";
-  version = "1.16.0";
+  version = "1.17.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "VirusTotal";
    repo = "yara-x";
    tag = "v${version}";
-    hash = "sha256-n/AhEKlQmjbTtPncal6NDn7BcXb4HfnkuJctvDjW2V0=";
+    hash = "sha256-8P3fNLENfoGD+FMeCXX8UwoMzI92JkjV/f3G7d+Li3Y=";
  };

  buildAndTestSubdir = "py";

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname src version;
-    hash = "sha256-MbMjrrPN1ctlYoE6R5p8g354OOmu4NplcGwSm3IcHRI=";
+    hash = "sha256-ifXe0LKEYMzCo0FIg2E5mCQRUCOlu3nvK2XN/3GM9bk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/yaramod/default.nix
+++ b/pkgs/development/python-modules/yaramod/default.nix
@@ -21,14 +21,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
  pname = "yaramod";
-  version = "4.6.0";
+  version = "4.7.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "avast";
    repo = "yaramod";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2XI7lGfoMHimtuQ29I1cFtV4OgfvR3Qcvh/FhA0yeBw=";
+    hash = "sha256-AtRHwJGaEnvOMno8/LjoSg8wCRxd1oyYKgmklW0jp5o=";
  };

  postPatch = ''
--- a/pkgs/development/tools/ocaml/camlp5/default.nix
+++ b/pkgs/development/tools/ocaml/camlp5/default.nix
@@ -8,6 +8,7 @@
  makeWrapper,
  rresult,
  bos,
+  fmt,
  pcre2,
  re,
  camlp-streams,
@@ -52,12 +53,15 @@ stdenv.mkDerivation (

    buildInputs = lib.optionals recent [
      bos
-      pcre2
      re
      rresult
    ];

-    propagatedBuildInputs = lib.optional recent camlp-streams;
+    propagatedBuildInputs = lib.optionals recent [
+      camlp-streams
+      pcre2
+      fmt
+    ];

    strictDeps = true;

--- a/Show More
+++ b/Show More