Merge master into staging-next

2026-08-25 17:55:21 +00:00 · 2026-08-13 06:31:07 +00:00
parent 61672789be da997b4d6a
commit 177fd9247c
67 changed files with 1954 additions and 996 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11285,11 +11285,6 @@
    githubId = 58676303;
    name = "hhydraa";
  };
-  hibiday = {
-    name = "Katsumi Takeuchi";
-    github = "hibiday";
-    githubId = 137286929;
-  };
  higebu = {
    name = "Yuya Kusakabe";
    email = "yuya.kusakabe@gmail.com";
@@ -23878,6 +23873,12 @@
      { fingerprint = "01D7 5486 3A6D 64EA AC77 0D26 FBF1 9A98 2CCE 0048"; }
    ];
  };
+  recutita = {
+    name = "Katsumi Takeuchi";
+    email = "contact@recutita.com";
+    github = "recutita";
+    githubId = 137286929;
+  };
  redfish64 = {
    email = "engler@gmail.com";
    github = "redfish64";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -28,6 +28,10 @@
  firewall, is available through
  [services.portmaster](#opt-services.portmaster.enable).

+- [btrfs-heatmap](https://github.com/knorrie/btrfs-heatmap), setcap wrapper for `btrfs-heatmap` package, a visualizer of how a btrfs filesystem is using the underlying disk space of the block devices. Available as [programs.btrfs-heatmap](#opt-programs.btrfs-heatmap.enable)
+
+- [compsize](https://github.com/kilobyte/compsize), setcap wrapper for `compsize` package, a cli utility to to inspect compression type/ratio on BTRFS filesystems. Available as [programs.compsize](#opt-programs.compsize.enable)
+
 - [tranquil](https://tangled.org/tranquil.farm/tranquil-pds) is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as [services.tranquil-pds](#opt-services.tranquil-pds.enable).

 - [Moonlight Qt](https://moonlight-stream.org/), a client for playing your PC games on almost any device. Available as [programs.moonlight-qt](#opt-programs.moonlight-qt.enable).
@@ -86,6 +90,8 @@

 - [Entropy](https://github.com/ergohaven/entropy), a configurator for programmable keyboards and input devices running Vial-QMK/RMK firmware. Available as [programs.entropy](#opt-programs.entropy.enable).

+- [Kvrocks](https://kvrocks.apache.org/), a distributed key value NoSQL database compatible with the Redis protocol. Available as [services.kvrocks](#opt-services.kvrocks.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -120,6 +126,8 @@

 - Rustical migrates from `settings.http.host` and `settings.http.port` to `settings.http.bind` to support UNIX domain sockets as well as TCP sockets in one setting.

+- The `jetty_11` package has been removed as it reached end of life. Use `jetty_12` instead.
+
 - The Mullvad VPN service now has a separate toggle to enable the Mullvad VPN graphical user interface. If you have previously used Mullvad on a desktop by setting `services.mullvad-vpn.package` to `pkgs.mullvad-vpn`, you should now **unset that option**, and enable `services.mullvad-vpn.gui.enable`. The VPN will not work if `services.mullvad-vpn.package` is set to `pkgs.mullvad-vpn`, as `pkgs.mullvad-vpn` no longer contains the Mullvad Daemon; please ensure that `services.mullvad-vpn.package` is set to `pkgs.mullvad`, regardless if you plan to enable the graphical user interface or not.

 - A number of options for `services.llama-cpp` have been removed in favor of the structured [](#opt-services.llama-cpp.settings) option, attributes from which are used as arguments to `llama-server` executable, you can see all available options by running `llama-server --help`. Configuring model presets using Nix attribute set via `services.llama-cpp.modelsPreset` is no longer supported, please use `services.llama-cpp.settings.models-preset` with a path to an INI file containing desired options.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -185,6 +185,7 @@
  ./programs/bcc.nix
  ./programs/benchexec.nix
  ./programs/browserpass.nix
+  ./programs/btrfs-heatmap.nix
  ./programs/calls.nix
  ./programs/captive-browser.nix
  ./programs/ccache.nix
@@ -196,6 +197,7 @@
  ./programs/cnping.nix
  ./programs/comma.nix
  ./programs/command-not-found/command-not-found.nix
+  ./programs/compsize.nix
  ./programs/coolercontrol.nix
  ./programs/corefreq.nix
  ./programs/cpu-energy-meter.nix
@@ -549,6 +551,7 @@
  ./services/databases/hbase-standalone.nix
  ./services/databases/influxdb2.nix
  ./services/databases/influxdb.nix
+  ./services/databases/kvrocks.nix
  ./services/databases/lldap.nix
  ./services/databases/memcached.nix
  ./services/databases/monetdb.nix
--- a/nixos/modules/programs/btrfs-heatmap.nix
+++ b/nixos/modules/programs/btrfs-heatmap.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  meta.maintainers = with lib.maintainers; [ sandarukasa ];
+
+  options = {
+    programs.btrfs-heatmap = {
+      enable = lib.mkEnableOption "btrfs-heatmap + setcap wrapper";
+      package = lib.mkPackageOption pkgs "btrfs-heatmap" { };
+    };
+  };
+
+  config =
+    let
+      cfg = config.programs.btrfs-heatmap;
+    in
+    lib.mkIf cfg.enable {
+      # for the man page
+      environment.systemPackages = [ cfg.package ];
+
+      security.wrappers.btrfs-heatmap = {
+        owner = config.users.users.root.name;
+        group = config.users.users.root.group;
+        capabilities = "cap_sys_admin+p";
+        source = lib.getExe cfg.package;
+      };
+    };
+}
--- a/nixos/modules/programs/compsize.nix
+++ b/nixos/modules/programs/compsize.nix
@@ -0,0 +1,32 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  meta.maintainers = with lib.maintainers; [ sandarukasa ];
+
+  options = {
+    programs.compsize = {
+      enable = lib.mkEnableOption "compsize + setcap wrapper";
+      package = lib.mkPackageOption pkgs "compsize" { };
+    };
+  };
+
+  config =
+    let
+      cfg = config.programs.compsize;
+    in
+    lib.mkIf cfg.enable {
+      # for the man page
+      environment.systemPackages = [ cfg.package ];
+
+      security.wrappers.compsize = {
+        owner = config.users.users.root.name;
+        group = config.users.users.root.group;
+        capabilities = "cap_sys_admin+p";
+        source = lib.getExe cfg.package;
+      };
+    };
+}
--- a/nixos/modules/services/databases/kvrocks.nix
+++ b/nixos/modules/services/databases/kvrocks.nix
@@ -0,0 +1,278 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.kvrocks;
+
+  format = pkgs.formats.keyValue {
+    # Emit list values as repeated keys (e.g. rename-command), matching MultiStringField.
+    listsAsDuplicateKeys = true;
+    mkKeyValue = lib.generators.mkKeyValueDefault {
+      mkValueString = v: if lib.isBool v then lib.boolToYesNo v else toString v;
+    } " ";
+  };
+
+  defaultDir = "/var/lib/kvrocks";
+  dataDir = cfg.settings.dir;
+  isDefaultDir = dataDir == defaultDir;
+
+  # Defaults match upstream Config field defaults (config.cc).
+  workers = cfg.settings.workers or 8;
+  maxBackgroundJobs = cfg.settings."rocksdb.max_background_jobs" or 4;
+  maxclients = cfg.settings.maxclients or 10240;
+  maxOpenFiles = cfg.settings."rocksdb.max_open_files" or 8096;
+
+  # Thread inventory from server.cc ("Kvrocks threads list") + Server::Start:
+  #   always-on: main, workers, task-runner (1), server-cron, compact-check,
+  #              rocksdb background (bounded by max_background_jobs)
+  #   optional:  master-repl (+ ≤4 parallel fetch via std::async on full sync),
+  #              feed-slave per replica, slot-migrate (cluster)
+  alwaysOnThreads = 1 + workers + 1 + 1 + 1 + maxBackgroundJobs;
+  # 1 master-repl + 4 fetch + 1 slot-migrate + ~16 replicas + misc (jemalloc, …)
+  dynamicThreadMargin = 32;
+
+  # From Server::AdjustOpenFilesLimit:
+  #   max_files = maxclients + rocksdb.max_open_files + min_reserved_fds
+  #   min_reserved_fds = 128  (listen sockets, logs, persistence, misc)
+  openFilesReserved = 128;
+
+  hasUnixSocket = cfg.settings.unixsocket != "";
+  hasTcp = lib.length cfg.settings.bind > 0;
+  configFile = format.generate "kvrocks.conf" (
+    {
+      daemonize = "no";
+      supervised = "systemd";
+    }
+    // (builtins.removeAttrs cfg.settings [
+      "bind"
+      "unixsocket"
+    ])
+    // lib.optionalAttrs (hasTcp && !cfg.socketActivation) {
+      bind = lib.concatStringsSep " " cfg.settings.bind;
+    }
+    // lib.optionalAttrs hasUnixSocket {
+      unixsocket = cfg.settings.unixsocket;
+    }
+    // lib.optionalAttrs cfg.socketActivation {
+      socket-fd = 3;
+    }
+  );
+in
+{
+  meta.maintainers = pkgs.kvrocks.meta.maintainers;
+
+  options = {
+    services.kvrocks = {
+      enable = lib.mkEnableOption "the Kvrocks server";
+
+      package = lib.mkPackageOption pkgs "kvrocks" { };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "kvrocks";
+        description = "User account under which Kvrocks runs.";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "kvrocks";
+        description = "Group under which Kvrocks runs.";
+      };
+
+      socketActivation = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Enable systemd socket activation for TCP.
+          Requires exactly one address in {option}`services.kvrocks.settings.bind`.
+        '';
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = format.type;
+
+          options = {
+            bind = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [
+                "127.0.0.1"
+                "::1"
+              ];
+              description = "The addresses to bind to.";
+            };
+
+            port = lib.mkOption {
+              type = lib.types.port;
+              default = 6666;
+              description = "Accept connections on the specified port.";
+            };
+
+            unixsocket = lib.mkOption {
+              type = lib.types.str;
+              default = "";
+              example = "/run/kvrocks/kvrocks.sock";
+              description = "Unix socket path.";
+            };
+
+            dir = lib.mkOption {
+              type = lib.types.str;
+              default = defaultDir;
+              description = "Directory for database files.";
+            };
+          };
+        };
+        default = { };
+        example = {
+          workers = 8;
+          maxclients = 10000;
+          rename-command = [
+            "KEYS \"\""
+            "FLUSHDB \"\""
+          ];
+        };
+        description = ''
+          Configuration for kvrocks.
+          See <https://github.com/apache/kvrocks/blob/unstable/kvrocks.conf> for supported options.
+
+          List values are emitted as repeated keys (for example `rename-command`),
+          except {option}`services.kvrocks.settings.bind` which is space-separated
+          on a single line.
+        '';
+      };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to open the firewall for the kvrocks port.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = hasTcp || hasUnixSocket;
+        message = "services.kvrocks: set settings.bind and/or settings.unixsocket.";
+      }
+      {
+        assertion = cfg.socketActivation -> builtins.length cfg.settings.bind == 1;
+        message = "services.kvrocks.socketActivation requires exactly one settings.bind address.";
+      }
+    ];
+
+    networking.firewall.allowedTCPPorts = lib.mkIf (cfg.openFirewall && hasTcp) [
+      cfg.settings.port
+    ];
+
+    systemd.tmpfiles.settings."10-kvrocks" = lib.mkIf (!isDefaultDir) {
+      ${dataDir}.d = {
+        user = cfg.user;
+        group = cfg.group;
+        mode = "0700";
+      };
+    };
+
+    systemd.sockets.kvrocks = lib.mkIf cfg.socketActivation {
+      description = "Kvrocks socket";
+      wantedBy = [ "sockets.target" ];
+      listenStreams =
+        let
+          addr = builtins.head cfg.settings.bind;
+          port = toString cfg.settings.port;
+          listenStream = if lib.hasInfix ":" addr then "[${addr}]:${port}" else "${addr}:${port}";
+        in
+        lib.singleton listenStream;
+      socketConfig = {
+        Accept = false;
+        SocketUser = cfg.user;
+        SocketGroup = cfg.group;
+      };
+    };
+
+    systemd.services.kvrocks = {
+      description = "Kvrocks - Distributed key value database";
+      documentation = [ "https://kvrocks.apache.org/" ];
+      wantedBy = lib.mkIf (!cfg.socketActivation) [ "multi-user.target" ];
+      after = [ "network.target" ] ++ lib.optionals cfg.socketActivation [ "kvrocks.socket" ];
+      requires = lib.optionals cfg.socketActivation [ "kvrocks.socket" ];
+
+      serviceConfig = {
+        Type = "notify";
+        ExecStart = "${lib.getExe cfg.package} -c ${configFile}";
+        Restart = "on-failure";
+        RestartSec = "10s";
+        User = cfg.user;
+        Group = cfg.group;
+        StateDirectory = lib.mkIf isDefaultDir "kvrocks";
+        StateDirectoryMode = "0700";
+        RuntimeDirectory = "kvrocks";
+        RuntimeDirectoryMode = "0755";
+        BindPaths = lib.mkIf (!isDefaultDir) [ dataDir ];
+        LimitNPROC = lib.mkDefault (alwaysOnThreads + dynamicThreadMargin);
+        # When rocksdb.max_open_files is -1 (unlimited), fall back to a high limit.
+        LimitNOFILE = lib.mkDefault (
+          if maxOpenFiles < 0 then 1048576 else maxclients + maxOpenFiles + openFilesReserved
+        );
+        TimeoutSec = 300;
+        NonBlocking = lib.mkIf cfg.socketActivation true;
+        # Capabilities
+        CapabilityBoundingSet = "";
+        # Security
+        NoNewPrivileges = true;
+        # Sandboxing
+        TemporaryFileSystem = [ "/:ro" ];
+        BindReadOnlyPaths = [
+          builtins.storeDir
+          "/etc"
+        ];
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        PrivateMounts = true;
+        SocketBindDeny = [ "any" ];
+        SocketBindAllow = lib.optionals (hasTcp && !cfg.socketActivation) [
+          "tcp:${toString cfg.settings.port}"
+        ];
+        # System Call Filtering
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "~@cpu-emulation @debug @keyring @memlock @mount @obsolete @privileged @resources @setuid";
+      };
+    };
+
+    users = {
+      users = lib.mkIf (cfg.user == "kvrocks") {
+        kvrocks = {
+          isSystemUser = true;
+          group = cfg.group;
+          description = "Kvrocks daemon user";
+        };
+      };
+      groups = lib.mkIf (cfg.group == "kvrocks") {
+        kvrocks = { };
+      };
+    };
+  };
+}
--- a/nixos/modules/services/home-automation/openthread-border-router.nix
+++ b/nixos/modules/services/home-automation/openthread-border-router.nix
@@ -181,6 +181,9 @@ in
    # ot-ctl can be used to query the router instance
    environment.systemPackages = [ cfg.package ];

+    # Shared by the agent and web interface for the OpenThread control socket.
+    users.groups.otbr = { };
+
    # Make sure we have ipv6 support, and that forwarding is enabled
    networking.enableIPv6 = true;
    networking.firewall.allowedTCPPorts =
@@ -217,6 +220,7 @@ in
          THREAD_IF = cfg.interfaceName;
        };
        serviceConfig = {
+          Group = "otbr";
          ExecStartPre = "${utils.escapeSystemdExecArg (lib.getExe' cfg.package "otbr-firewall")} start";
          ExecStart = lib.concatStringsSep " " (
            lib.concatLists [
@@ -269,7 +273,7 @@ in
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          SystemCallArchitectures = "native";
-          UMask = "0077";
+          UMask = "0007";

          CapabilityBoundingSet = [
            "CAP_NET_ADMIN"
@@ -288,6 +292,7 @@ in
        after = [ "otbr-agent.service" ];
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
+          Group = "otbr";
          ExecStart = lib.concatStringsSep " " (
            lib.concatLists [
              [
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -918,6 +918,7 @@ in
    inherit runTest;
    inherit (pkgs) lib;
  };
+  kvrocks = runTest ./kvrocks.nix;
  labgrid = runTest ./labgrid.nix;
  lact = runTest ./lact.nix;
  ladybird = runTest ./ladybird.nix;
--- a/nixos/tests/kvrocks.nix
+++ b/nixos/tests/kvrocks.nix
@@ -0,0 +1,122 @@
+{ lib, pkgs, ... }:
+
+{
+  name = "kvrocks";
+  meta.maintainers = with lib.maintainers; [ xyenon ];
+
+  nodes.machine = {
+    services.kvrocks = {
+      enable = true;
+      settings.log-level = "debug";
+    };
+
+    specialisation."nonDefaultDataDir".configuration = {
+      services.kvrocks.settings.dir = "/var/lib/kvrocks-custom";
+    };
+
+    specialisation."unixSocket".configuration = {
+      services.kvrocks.settings.bind = [ ];
+      services.kvrocks.settings.unixsocket = "/run/kvrocks/kvrocks.sock";
+    };
+
+    specialisation."tcpAndUnix".configuration = {
+      services.kvrocks.settings.unixsocket = "/run/kvrocks/kvrocks.sock";
+    };
+
+    specialisation."socketActivation".configuration = {
+      services.kvrocks = {
+        socketActivation = true;
+        settings.bind = [ "127.0.0.1" ];
+      };
+    };
+
+    specialisation."socketActivationAndUnix".configuration = {
+      services.kvrocks = {
+        socketActivation = true;
+        settings = {
+          bind = [ "127.0.0.1" ];
+          unixsocket = "/run/kvrocks/kvrocks.sock";
+        };
+      };
+    };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      inherit (nodes.machine.services) kvrocks;
+      port = toString kvrocks.settings.port;
+      redisCliTcp = "${pkgs.redis}/bin/redis-cli -p ${port}";
+      unixsocket = "/run/kvrocks/kvrocks.sock";
+      redisCliUnix = "${pkgs.redis}/bin/redis-cli -s ${unixsocket}";
+      switchTo =
+        name:
+        "${nodes.machine.system.build.toplevel}/specialisation/${name}/bin/switch-to-configuration test";
+    in
+    ''
+      start_all()
+      machine.wait_for_unit("kvrocks.service")
+      machine.wait_for_open_port(${port})
+      machine.succeed("${redisCliTcp} ping | grep PONG")
+
+      with subtest("Test normal usage"):
+        machine.succeed("${redisCliTcp} set k1 v1 | grep OK")
+        machine.succeed("${redisCliTcp} get k1 | grep v1")
+        machine.systemctl("restart kvrocks")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.succeed("${redisCliTcp} get k1 | grep v1")
+
+      with subtest("Test usage with non-default data directory"):
+        machine.succeed("${switchTo "nonDefaultDataDir"}")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.succeed("test -d /var/lib/kvrocks-custom")
+        machine.succeed("${redisCliTcp} set k2 v2 | grep OK")
+        machine.succeed("${redisCliTcp} get k2 | grep v2")
+        machine.systemctl("restart kvrocks")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.succeed("${redisCliTcp} get k2 | grep v2")
+
+      with subtest("Test usage with unix socket only"):
+        machine.succeed("${switchTo "unixSocket"}")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_file("${unixsocket}")
+        machine.succeed("${redisCliUnix} set k3 v3 | grep OK")
+        machine.succeed("${redisCliUnix} get k3 | grep v3")
+        machine.systemctl("restart kvrocks")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_file("${unixsocket}")
+        machine.succeed("${redisCliUnix} get k3 | grep v3")
+
+      with subtest("Test usage with TCP and unix socket"):
+        machine.succeed("${switchTo "tcpAndUnix"}")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.wait_for_file("${unixsocket}")
+        machine.succeed("${redisCliTcp} set k4 v4 | grep OK")
+        machine.succeed("${redisCliTcp} get k4 | grep v4")
+        machine.succeed("${redisCliUnix} get k4 | grep v4")
+
+      with subtest("Test usage with socket activation"):
+        machine.succeed("${switchTo "socketActivation"}")
+        machine.wait_for_unit("kvrocks.socket")
+        machine.wait_until_succeeds("${redisCliTcp} ping | grep PONG")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.succeed("${redisCliTcp} set k5 v5 | grep OK")
+        machine.succeed("${redisCliTcp} get k5 | grep v5")
+
+      with subtest("Test usage with socket activation and unix socket"):
+        machine.succeed("${switchTo "socketActivationAndUnix"}")
+        machine.wait_for_unit("kvrocks.socket")
+        machine.wait_until_succeeds("${redisCliTcp} ping | grep PONG")
+        machine.wait_for_unit("kvrocks.service")
+        machine.wait_for_open_port(${port})
+        machine.wait_for_file("${unixsocket}")
+        machine.succeed("${redisCliTcp} set k6 v6 | grep OK")
+        machine.succeed("${redisCliTcp} get k6 | grep v6")
+        machine.succeed("${redisCliUnix} get k6 | grep v6")
+    '';
+}
--- a/pkgs/build-support/nix-gitignore/default.nix
+++ b/pkgs/build-support/nix-gitignore/default.nix
@@ -254,5 +254,5 @@ rec {
    else
      gitignoreFilterSource (_: _: true) patterns;

-  gitignoreRecursiveSource = gitignoreFilterSourcePure (_: _: true);
+  gitignoreRecursiveSource = gitignoreFilterRecursiveSource (_: _: true);
 }
--- a/pkgs/by-name/ap/aptakube/darwin.nix
+++ b/pkgs/by-name/ap/aptakube/darwin.nix
@@ -1,36 +0,0 @@
-{
-  stdenvNoCC,
-  fetchurl,
-  undmg,
-
-  pname,
-  version,
-  meta,
-}:
-stdenvNoCC.mkDerivation {
-  inherit
-    pname
-    version
-    meta
-    ;
-
-  src = fetchurl {
-    url = "https://github.com/aptakube/aptakube/releases/download/${version}/Aptakube_${version}_universal.dmg";
-    sha256 = "89828e1ac030f9532ba24afdd91d357280b32fcc475830b6667d5066e7a576ac";
-  };
-
-  nativeBuildInputs = [ undmg ];
-
-  unpackPhase = ''
-    runHook preUnpack
-    undmg $src
-    runHook postUnpack
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/Applications
-    cp -r Aptakube.app $out/Applications/Aptakube.app
-    runHook postInstall
-  '';
-}
--- a/pkgs/by-name/ap/aptakube/linux.nix
+++ b/pkgs/by-name/ap/aptakube/linux.nix
@@ -1,43 +0,0 @@
-{
-  stdenvNoCC,
-  fetchurl,
-  dpkg,
-  autoPatchelfHook,
-  webkitgtk_4_1,
-
-  pname,
-  version,
-  meta,
-}:
-stdenvNoCC.mkDerivation {
-  inherit
-    pname
-    version
-    meta
-    ;
-
-  src = fetchurl {
-    url = "https://github.com/aptakube/aptakube/releases/download/${version}/aptakube_${version}_amd64.deb";
-    sha256 = "9660c87da400dad1451f685defff774c6f5af9b3f713ad1cbd48284e965457dd";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    dpkg
-  ];
-
-  buildInputs = [ webkitgtk_4_1 ];
-
-  unpackPhase = ''
-    runHook preUnpack
-    dpkg -X $src .
-    runHook postUnpack
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out
-    cp -r usr/share usr/bin $out
-    runHook postInstall
-  '';
-}
--- a/pkgs/by-name/ap/aptakube/package.nix
+++ b/pkgs/by-name/ap/aptakube/package.nix
@@ -1,33 +1,137 @@
 {
  lib,
-  stdenv,
-  callPackage,
+  stdenvNoCC,
+  fetchurl,
+
+  autoPatchelfHook,
+  dpkg,
+  makeBinaryWrapper,
+  undmg,
+  wrapGAppsHook3,
+
+  glib-networking,
+  webkitgtk_4_1,
+
+  kubectl,
+  kubernetes-helm,
+  extraPath ? [ ],
 }:
-let
-  pname = "aptakube";
-  version = "1.13.0";
-  meta = {
-    homepage = "https://aptakube.com/";
-    description = "Modern, lightweight and multi-cluster Kubernetes GUI";
-    license = lib.licenses.unfree;
-    maintainers = [ lib.maintainers.juliamertz ];
-    platforms = lib.platforms.darwin ++ [ "x86_64-linux" ];
-    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
-  };
-in
-if stdenv.hostPlatform.isDarwin then
-  callPackage ./darwin.nix {
-    inherit
-      pname
-      version
-      meta
-      ;
-  }
-else
-  callPackage ./linux.nix {
-    inherit
-      pname
-      version
-      meta
-      ;
+
+stdenvNoCC.mkDerivation (
+  finalAttrs:
+  let
+    sources = {
+      aarch64-darwin = {
+        name = "Aptakube_${finalAttrs.version}_universal.dmg";
+        hash = "sha256-JWDwsvqZnEQc6Ne+aC2WbdMaEO20f8AEK7SlC3lEzUk=";
+      };
+      x86_64-linux = {
+        name = "aptakube_${finalAttrs.version}_amd64.deb";
+        hash = "sha256-JooC/fwy1zaIU2UAmDooejEbBmCChVrJ2rTsn0M8WaI=";
+      };
+    };
+
+    source =
+      sources.${stdenvNoCC.hostPlatform.system}
+        or (throw "aptakube: unsupported system ${stdenvNoCC.hostPlatform.system}");
+
+    runtimePath = extraPath ++ [
+      kubectl
+      kubernetes-helm
+    ];
+  in
+  {
+    pname = "aptakube";
+    version = "1.18.8";
+
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    src = fetchurl {
+      url = "https://github.com/aptakube/aptakube/releases/download/${finalAttrs.version}/${source.name}";
+      inherit (source) hash;
+    };
+
+    sourceRoot = if stdenvNoCC.hostPlatform.isDarwin then "." else "root";
+
+    nativeBuildInputs =
+      lib.optionals stdenvNoCC.hostPlatform.isLinux [
+        autoPatchelfHook
+        dpkg
+        wrapGAppsHook3
+      ]
+      ++ lib.optionals stdenvNoCC.hostPlatform.isDarwin [
+        makeBinaryWrapper
+        undmg
+      ];
+
+    buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+      glib-networking
+      webkitgtk_4_1
+    ];
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase =
+      if stdenvNoCC.hostPlatform.isLinux then
+        ''
+          runHook preInstall
+
+          mkdir -p $out
+          mv usr/bin usr/share $out/
+          substituteInPlace $out/share/applications/aptakube.desktop \
+            --replace-fail 'Name=aptakube' 'Name=Aptakube'
+
+          runHook postInstall
+        ''
+      else
+        ''
+          runHook preInstall
+
+          mkdir -p $out/Applications $out/bin
+          cp -R Aptakube.app $out/Applications/
+          makeWrapper $out/Applications/Aptakube.app/Contents/MacOS/Aptakube \
+            $out/bin/aptakube \
+            --suffix PATH : ${lib.makeBinPath runtimePath}
+
+          runHook postInstall
+        '';
+
+    preFixup = lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
+      gappsWrapperArgs+=(--suffix PATH : ${lib.makeBinPath runtimePath})
+    '';
+
+    passthru = {
+      inherit sources;
+      updateScript = ./update.sh;
+    };
+
+    meta = {
+      description = "Multi-cluster Kubernetes UI";
+      longDescription = ''
+        Aptakube is proprietary software with a 15-day free trial.
+
+        Some operations use `kubectl` or Helm from `PATH`. If they are not in
+        `PATH`, packaged binaries will be used.
+
+        Any kubeconfig exec-auth helpers are loaded from `PATH`. Use `extraPath`
+        to modify `PATH` specifically for this package.
+      '';
+
+      homepage = "https://aptakube.com/";
+      downloadPage = "https://github.com/aptakube/aptakube/releases";
+      changelog = "https://github.com/aptakube/aptakube/releases/tag/${finalAttrs.version}";
+
+      license = lib.licenses.unfree;
+      sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+
+      mainProgram = "aptakube";
+      maintainers = with lib.maintainers; [
+        juliamertz
+        maximsmol
+      ];
+      platforms = builtins.attrNames sources;
+    };
  }
+)
--- a/pkgs/by-name/ap/aptakube/update.sh
+++ b/pkgs/by-name/ap/aptakube/update.sh
@@ -0,0 +1,108 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts curl jq nix
+# shellcheck shell=bash
+
+set \
+  -o errexit \
+  -o pipefail \
+  -o nounset \
+  -o errtrace
+
+shopt -s \
+  inherit_errexit \
+  shift_verbose
+
+curl_args=(
+  --fail
+  --location
+  --silent
+  --show-error
+)
+
+if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+  curl_args+=(--user ":${GITHUB_TOKEN}")
+fi
+
+release="$(
+  curl \
+    "${curl_args[@]}" \
+    https://api.github.com/repos/aptakube/aptakube/releases/latest
+)"
+version="$(
+  jq \
+    --exit-status \
+    --raw-output \
+    '.tag_name | select(type == "string")' \
+    <<<"${release}"
+)"
+
+get_hash() {
+  local name="$1"
+  local digest
+
+  digest="$(
+    jq \
+      --arg name "${name}" \
+      --exit-status \
+      --raw-output \
+      '.assets[] | select(.name == $name) | .digest | select(type == "string" and startswith("sha256:"))' \
+      <<<"${release}"
+  )"
+
+  nix hash convert \
+    --hash-algo sha256 \
+    --to sri \
+    "${digest#sha256:}"
+}
+
+get_url() {
+  local system="$1"
+
+  nix-instantiate \
+    --argstr system "${system}" \
+    --argstr version "${version}" \
+    --eval \
+    --expr '
+      { system, version }:
+      let
+        package = (import ./. { inherit system; }).aptakube.overrideAttrs (_: {
+          inherit version;
+          __intentionallyOverridingVersion = true;
+        });
+      in
+      package.src.url
+    ' \
+    --raw
+}
+
+cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../../.."
+printf 'Updating aptakube to %s\n' "${version}"
+
+platforms="$(
+  nix-instantiate \
+    --eval \
+    --json \
+    --strict \
+    --attr aptakube.meta.platforms
+)"
+systems="$(
+  jq \
+    --exit-status \
+    --raw-output \
+    '.[] | select(type == "string")' \
+    <<<"${platforms}"
+)"
+
+while IFS= read -r system; do
+  url="$(get_url "${system}")"
+  name="${url##*/}"
+  hash="$(get_hash "${name}")"
+
+  update-source-version \
+    aptakube \
+    "${version}" \
+    "${hash}" \
+    --ignore-same-hash \
+    --ignore-same-version \
+    --system="${system}"
+done <<<"${systems}"
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@@ -40,7 +40,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "beekeeper-studio";
-  version = "5.9.3";
+  version = "6.0.0";

  src =
    let
@@ -54,9 +54,9 @@ stdenv.mkDerivation (finalAttrs: {
    fetchurl {
      url = "https://github.com/beekeeper-studio/beekeeper-studio/releases/download/v${finalAttrs.version}/${asset}";
      hash = selectSystem {
-        x86_64-linux = "sha256-ngVE7hjtr/a6CBASwZA3gmvk7+WR2okQy+ywXbEUQpk=";
-        aarch64-linux = "sha256-aAoputvhCHqekT+pdaZEmps4aa48gz9DDCgomJvWQSw=";
-        aarch64-darwin = "sha256-SCttC+P3ZSAlU8mBWfPpT4wAVtwcvpgePhJp+sbsvU8=";
+        x86_64-linux = "sha256-mTS5elz54AbbYF6AtPaeZvbR7ysB6a6iu+lbaTrwv5k=";
+        aarch64-linux = "sha256-KSz60oSR5UcVM5p8swRqBCZknGob7/MEMtAI2UmN2Q0=";
+        aarch64-darwin = "sha256-71xe4uWRb83WgvZvwqv52tubZ+8CKKuU1/zQnV0aSGw=";
      };
    };

--- a/pkgs/by-name/bl/blesh/package.nix
+++ b/pkgs/by-name/bl/blesh/package.nix
@@ -88,7 +88,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [
      aiotter
-      hibiday
+      recutita
      matthiasbeyer
    ];
    platforms = lib.platforms.unix;
--- a/pkgs/by-name/co/consul/package.nix
+++ b/pkgs/by-name/co/consul/package.nix
@@ -8,7 +8,7 @@

 buildGoModule rec {
  pname = "consul";
-  version = "2.0.2";
+  version = "2.0.3";

  # Note: Currently only release tags are supported, because they have the Consul UI
  # vendored. See
@@ -22,7 +22,7 @@ buildGoModule rec {
    owner = "hashicorp";
    repo = "consul";
    tag = "v${version}";
-    hash = "sha256-Xt9Rch4pSSUb1/KI+W3fn++Jlm7ZtYNxSo9hOjXXEhw=";
+    hash = "sha256-VhjTMHfsbo9MFw/YkQ3AGcxEIM2Cq4LoTbDI6se0xHY=";
  };

  # This corresponds to paths with package main - normally unneeded but consul
@@ -32,7 +32,7 @@ buildGoModule rec {
    "connect/certgen"
  ];

-  vendorHash = "sha256-C532h7n/2E2vYQO02EcznnF8s/eI5r7qGoB5NEiiHEg=";
+  vendorHash = "sha256-MzbMG9mg/7RsQyAL50ob06Y/PZdF1W30e3Pfe9XAvvo=";

  doCheck = false;

--- a/pkgs/by-name/ed/edencommon/glog-0.7.patch
+++ b/pkgs/by-name/ed/edencommon/glog-0.7.patch
@@ -1,27 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 8d7b3454df..2ce7b5af1a 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -50,8 +50,7 @@
-   "${CMAKE_CURRENT_SOURCE_DIR}/build/fbcode_builder/CMake"
-   ${CMAKE_MODULE_PATH})
- 
-find_package(Glog MODULE REQUIRED)
-include_directories(${GLOG_INCLUDE_DIR})
-+find_package(Glog CONFIG REQUIRED)
- 
- find_package(Gflags REQUIRED)
- include_directories(${GFLAGS_INCLUDE_DIR})
-diff --git a/eden/common/testharness/CMakeLists.txt b/eden/common/testharness/CMakeLists.txt
-index bef7421906..f35067efa9 100644
--- a/eden/common/testharness/CMakeLists.txt
-+++ b/eden/common/testharness/CMakeLists.txt
-@@ -19,7 +19,7 @@
-     ${BOOST_LIBRARIES}
-     Folly::folly_test_util
-     ${LIBGMOCK_LIBRARIES}
-    ${GLOG_LIBRARY}
-+    glog::glog
- )
- 
- target_include_directories(
--- a/pkgs/by-name/ed/edencommon/increase-test-discovery-timeout.patch
+++ b/pkgs/by-name/ed/edencommon/increase-test-discovery-timeout.patch
@@ -1,20 +0,0 @@
-diff --git a/eden/common/os/test/CMakeLists.txt b/eden/common/os/test/CMakeLists.txt
-index a9f71443f8..be1423c455 100644
--- a/eden/common/os/test/CMakeLists.txt
-+++ b/eden/common/os/test/CMakeLists.txt
-@@ -18,4 +18,4 @@
-     ${LIBGMOCK_LIBRARIES}
- )
- 
-gtest_discover_tests(os_test)
-+gtest_discover_tests(os_test DISCOVERY_TIMEOUT 25)
-diff --git a/eden/common/utils/test/CMakeLists.txt b/eden/common/utils/test/CMakeLists.txt
-index 0cac73e569..ff08ecccb8 100644
--- a/eden/common/utils/test/CMakeLists.txt
-+++ b/eden/common/utils/test/CMakeLists.txt
-@@ -34,4 +34,4 @@
-     ${LIBGMOCK_LIBRARIES}
- )
- 
-gtest_discover_tests(utils_test)
-+gtest_discover_tests(utils_test DISCOVERY_TIMEOUT 25)
--- a/pkgs/by-name/ed/edencommon/package.nix
+++ b/pkgs/by-name/ed/edencommon/package.nix
@@ -20,7 +20,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "edencommon";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";

  outputs = [
    "out"
@@ -31,17 +31,9 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "facebookexperimental";
    repo = "edencommon";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gTf3NgxCYaIJ4ubkPKrPct4D6IsHnTZRAzrDHoErDNM=";
+    hash = "sha256-RcLdBurFB4Zk479EHeGZHdNKvSMO1M54HDbxHVEFa7Y=";
  };

-  patches = [
-    ./glog-0.7.patch
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-    # Test discovery timeout is bizarrely flaky on `x86_64-darwin`
-    ./increase-test-discovery-timeout.patch
-  ];
-
  nativeBuildInputs = [
    cmake
    ninja
@@ -93,6 +85,11 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail \
        'find_package(FBThrift CONFIG REQUIRED COMPONENTS cpp2 py)' \
        'find_package(FBThrift CONFIG REQUIRED COMPONENTS cpp2)'
+
+    # this header was missing. this is likely a consequence of fmt v12.2.0
+    # changing the definition of its fmt/core.h header, which is included in
+    # the same file.
+    sed -e '1i #include <string>' -i eden/common/utils/String.h
  '';

  passthru.updateScript = nix-update-script { };
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,13 +17,13 @@
 }:

 let
-  version = "0.313.2";
+  version = "0.313.3";

  src = fetchFromGitHub {
    owner = "evcc-io";
    repo = "evcc";
    tag = version;
-    hash = "sha256-gFsAf10GT4rGXR08P09vZHguQ2alVGy3PJwYPgNPGaw=";
+    hash = "sha256-mf8Jf+JtbcTQ227Dp0oRKBRpNKg2Gv+jkPsi36+Uogw=";
  };

  vendorHash = "sha256-QJsdBqa/JHaBig4bRtU3LqlYwh/BHnP3vg8YM3reuDY=";
--- a/pkgs/by-name/fb/fb303/glog-0.7.patch
+++ b/pkgs/by-name/fb/fb303/glog-0.7.patch
@@ -1,29 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 477b8d6a55..cfeae9ab3f 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -56,7 +56,7 @@
- 
- find_package(Gflags REQUIRED)
- 
-find_package(Glog MODULE REQUIRED)
-+find_package(Glog CONFIG REQUIRED)
- 
- find_package(folly CONFIG REQUIRED)
- 
-@@ -88,7 +88,6 @@
- 
- target_include_directories(fb303 PUBLIC
-   ${GFLAGS_INCLUDE_DIR}
-  ${GLOG_INCLUDE_DIR}
-   ${DOUBLE_CONVERSION_INCLUDE_DIR}
-   $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}>
-   $<INSTALL_INTERFACE:${INCLUDE_INSTALL_DIR}>
-@@ -98,6 +97,7 @@
-   fb303_thrift_cpp
-   Folly::folly
-   FBThrift::thrift
-+  glog::glog
- )
- 
- install(
--- a/pkgs/by-name/fb/fb303/package.nix
+++ b/pkgs/by-name/fb/fb303/package.nix
@@ -19,7 +19,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fb303";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";

  outputs = [
    "out"
@@ -30,13 +30,9 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "facebook";
    repo = "fb303";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mQuTvjaBTbbLG8fmtM19MU1yIbq1O8TjaQ2TLQXpwkQ=";
+    hash = "sha256-euqoTxNizn4cA9UY/U6X6m2bV1owEuqEQIDEiDM9n5w=";
  };

-  patches = [
-    ./glog-0.7.patch
-  ];
-
  nativeBuildInputs = [
    cmake
    ninja
--- a/pkgs/by-name/fb/fbthrift/glog-0.7.patch
+++ b/pkgs/by-name/fb/fbthrift/glog-0.7.patch
@@ -1,87 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 492bcccd9a..9c907a87a8 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -108,7 +108,7 @@
- # Find required dependencies for thrift/lib
- if (THRIFT_LIB_ONLY OR build_all)
-   find_package(Gflags REQUIRED)
-  find_package(Glog REQUIRED)
-+  find_package(Glog CONFIG REQUIRED)
-   find_package(fizz CONFIG REQUIRED)
-   find_package(wangle CONFIG REQUIRED)
-   find_package(ZLIB REQUIRED)
-@@ -120,7 +120,6 @@
-   find_package(Threads)
-   include_directories(
-     ${LIBGFLAGS_INCLUDE_DIR}
-    ${GLOG_INCLUDE_DIRS}
-     ${OPENSSL_INCLUDE_DIR}
-     ${ZSTD_INCLUDE_DIRS}
-     ${Xxhash_INCLUDE_DIR}
-diff --git a/thrift/example/cpp2/CMakeLists.txt b/thrift/example/cpp2/CMakeLists.txt
-index afa28dad61..318860b3d6 100644
--- a/thrift/example/cpp2/CMakeLists.txt
-+++ b/thrift/example/cpp2/CMakeLists.txt
-@@ -28,7 +28,7 @@
-   thriftcpp2
-   chatroom-cpp2
-   ${LIBGFLAGS_LIBRARY}
-  ${GLOG_LIBRARIES}
-+  glog::glog
- )
- install(
-   TARGETS example_server
-diff --git a/thrift/lib/cpp/CMakeLists.txt b/thrift/lib/cpp/CMakeLists.txt
-index 2c65e1f0a8..1e80060100 100644
--- a/thrift/lib/cpp/CMakeLists.txt
-+++ b/thrift/lib/cpp/CMakeLists.txt
-@@ -43,7 +43,7 @@
-   PUBLIC
-     Folly::folly
-     ${LIBGFLAGS_LIBRARY}
-    ${GLOG_LIBRARIES}
-+    glog::glog
- )
- 
- add_library(
-@@ -121,7 +121,7 @@
-     Boost::boost
-     Folly::folly
-     wangle::wangle
-    ${GLOG_LIBRARIES}
-+    glog::glog
-     ${OPENSSL_LIBRARIES}
- )
- 
-@@ -137,7 +137,7 @@
-     thriftprotocol
-     transport
-     Folly::folly
-    ${GLOG_LIBRARIES}
-+    glog::glog
- )
- 
- set(THRIFT1_HEADER_DIRS
-diff --git a/thrift/lib/cpp2/CMakeLists.txt b/thrift/lib/cpp2/CMakeLists.txt
-index 03216f5d6f..5f31fc0c64 100644
--- a/thrift/lib/cpp2/CMakeLists.txt
-+++ b/thrift/lib/cpp2/CMakeLists.txt
-@@ -75,7 +75,7 @@
-     Folly::folly
-     thriftmetadata
-     thriftprotocol
-    ${GLOG_LIBRARIES}
-+    glog::glog
-     ${LIBGFLAGS_LIBRARY}
- )
- 
-@@ -207,7 +207,7 @@
-     thrift
-     Folly::folly
-     wangle::wangle
-    ${GLOG_LIBRARIES}
-+    glog::glog
-     thrift-core
- )
- 
--- a/pkgs/by-name/fb/fbthrift/package.nix
+++ b/pkgs/by-name/fb/fbthrift/package.nix
@@ -3,7 +3,6 @@
  stdenv,

  fetchFromGitHub,
-  fetchpatch,

  cmake,
  ninja,
@@ -25,7 +24,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fbthrift";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";

  outputs = [
    # Trying to split this up further into `bin`, `out`, and `dev`
@@ -39,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "facebook";
    repo = "fbthrift";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jx2jSMeoRBYG7xCWKTzaIpNjrGnbPLiR9vQVO7m3if0=";
+    hash = "sha256-bzi4DRGOQy8HXLQa6roMY3CRqteoJxz2Xo6SsLfOdhY=";
  };

  patches = [
@@ -51,7 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
    # incorrect path concatenation.
    ./remove-cmake-install-rpath.patch

-    ./glog-0.7.patch
+    # On some machines (potentially those with low parallelism), this build
+    # seems to have a missing dependency and seems to fail with:
+    # "/build/source/build/thrift/lib/thrift/gen-cpp2/any_rep_types.h:12:10:
+    # fatal error: thrift/lib/thrift/gen-cpp2/type_types.h: No such file or
+    # directory"
+    # https://github.com/facebook/fbthrift/pull/709
+    ./thriftmetadata-dependency-type-cpp2-target.patch
  ];

  nativeBuildInputs = [
@@ -95,14 +100,6 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeFeature "CMAKE_SHARED_LINKER_FLAGS" "-Wl,-undefined,dynamic_lookup")
  ];

-  # Fix a typo introduced by the following commit that causes hundreds
-  # of pointless rebuilds when installing:
-  # <https://github.com/facebook/fbthrift/commit/58038399cefc0c2256ce4ef5444dee37147cbf07>
-  postPatch = ''
-    substituteInPlace ThriftLibrary.cmake \
-      --replace-fail .tcch .tcc
-  '';
-
  # Copied from Homebrew; fixes the following build error:
  #
  #     [ERROR:/nix/var/nix/b/5f3kn8spg6j0z0xlags8va6sq7/source/thrift/lib/thrift/RpcMetadata.thrift:1] unordered_map::at: key not found
--- a/pkgs/by-name/fb/fbthrift/scrub-build-directory-from-output.patch
+++ b/pkgs/by-name/fb/fbthrift/scrub-build-directory-from-output.patch
@@ -1,21 +1,3 @@
-diff --git a/thrift/compiler/generate/t_mstch_cpp2_generator.cc b/thrift/compiler/generate/t_mstch_cpp2_generator.cc
-index d232df5158..96d15efbda 100644
--- a/thrift/compiler/generate/t_mstch_cpp2_generator.cc
-+++ b/thrift/compiler/generate/t_mstch_cpp2_generator.cc
-@@ -1116,6 +1116,13 @@
-   mstch::node autogen_path() {
-     std::string path = service_->program()->path();
-     std::replace(path.begin(), path.end(), '\\', '/');
-+    // Ensure output reproducibility for Nix builds.
-+    if (auto nix_build_top = std::getenv("NIX_BUILD_TOP")) {
-+      auto prefix = std::string(nix_build_top) + "/";
-+      if (path.starts_with(prefix)) {
-+        path.replace(0, prefix.length(), "/build/");
-+      }
-+    }
-     return path;
-   }
-   mstch::node cpp_includes() {
 diff --git a/thrift/compiler/generate/t_whisker_generator.cc b/thrift/compiler/generate/t_whisker_generator.cc
 index 99a6ac14af..fa91a05247 100644
 --- a/thrift/compiler/generate/t_whisker_generator.cc
--- a/pkgs/by-name/fb/fbthrift/thriftmetadata-dependency-type-cpp2-target.patch
+++ b/pkgs/by-name/fb/fbthrift/thriftmetadata-dependency-type-cpp2-target.patch
@@ -0,0 +1,12 @@
+diff --git a/thrift/lib/cpp2/CMakeLists.txt b/thrift/lib/cpp2/CMakeLists.txt
+index dc4dd4e13f..66c50d0f60 100644
+--- a/thrift/lib/cpp2/CMakeLists.txt
+++ b/thrift/lib/cpp2/CMakeLists.txt
+@@ -102,6 +102,7 @@
+   any_rep-cpp2-target
+   protocol-cpp2-target
+   protocol_detail-cpp2-target
+  type-cpp2-target
+   type_id-cpp2-target
+   type_system-cpp2-target
+   schema-cpp2-target
--- a/pkgs/by-name/fi/fizz/glog-0.7.patch
+++ b/pkgs/by-name/fi/fizz/glog-0.7.patch
@@ -1,30 +0,0 @@
-diff --git a/fizz/CMakeLists.txt b/fizz/CMakeLists.txt
-index c60177c2b9..425326c529 100644
--- a/fizz/CMakeLists.txt
-+++ b/fizz/CMakeLists.txt
-@@ -50,7 +50,7 @@
- find_package(fmt CONFIG REQUIRED)
- 
- find_package(OpenSSL REQUIRED)
-find_package(Glog REQUIRED)
-+find_package(Glog CONFIG REQUIRED)
- find_package(Threads REQUIRED)
- find_package(Zstd REQUIRED)
- if (UNIX AND NOT APPLE)
-@@ -198,7 +198,6 @@
-     ${sodium_INCLUDE_DIR}
-     ${ZSTD_INCLUDE_DIR}
-   PRIVATE
-    ${GLOG_INCLUDE_DIRS}
-     ${FIZZ_INCLUDE_DIRECTORIES}
- )
- 
-@@ -212,7 +211,7 @@
-     ZLIB::ZLIB
-     ${ZSTD_LIBRARY}
-   PRIVATE
-    ${GLOG_LIBRARIES}
-+    glog::glog
-     ${GFLAGS_LIBRARIES}
-     ${FIZZ_LINK_LIBRARIES}
-     ${CMAKE_DL_LIBS}
--- a/pkgs/by-name/fi/fizz/package.nix
+++ b/pkgs/by-name/fi/fizz/package.nix
@@ -26,7 +26,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fizz";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";

  outputs = [
    "bin"
@@ -38,13 +38,9 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "facebookincubator";
    repo = "fizz";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fO0lKi8MJe0+RX8Y5shkO0C7NVAFOsXyx+OyoHeMy4c=";
+    hash = "sha256-zOTBC6G7mIVN/s56aUXEqs2FG2z/33jG/W5GUq4GwO0=";
  };

-  patches = [
-    ./glog-0.7.patch
-  ];
-
  nativeBuildInputs = [
    cmake
    ninja
--- a/pkgs/by-name/fo/folly/char_traits.patch
+++ b/pkgs/by-name/fo/folly/char_traits.patch
@@ -1,29 +0,0 @@
-diff --git a/folly/memory/test/UninitializedMemoryHacksTest.cpp b/folly/memory/test/UninitializedMemoryHacksTest.cpp
-index 38e27c3..17424af 100644
--- a/folly/memory/test/UninitializedMemoryHacksTest.cpp
-+++ b/folly/memory/test/UninitializedMemoryHacksTest.cpp
-@@ -283,7 +283,7 @@ TEST(UninitializedMemoryHacks, simpleStringWChar) {
- }
- 
- TEST(UninitializedMemoryHacks, simpleStringSChar) {
-  testSimple<std::basic_string<signed char>>();
-+  testSimple<std::basic_string<char>>();
- }
- 
- TEST(UninitializedMemoryHacks, simpleVectorChar) {
-@@ -307,7 +307,7 @@ TEST(UninitializedMemoryHacks, randomStringWChar) {
- }
- 
- TEST(UninitializedMemoryHacks, randomStringSChar) {
-  testRandom<std::basic_string<signed char>>();
-+  testRandom<std::basic_string<char>>();
- }
- 
- TEST(UninitializedMemoryHacks, randomVectorChar) {
-@@ -323,5 +323,5 @@ TEST(UninitializedMemoryHacks, randomVectorInt) {
- }
- 
- // We are deliberately putting this at the bottom to make sure it can follow use
-FOLLY_DECLARE_STRING_RESIZE_WITHOUT_INIT(signed char)
-+//FOLLY_DECLARE_STRING_RESIZE_WITHOUT_INIT(char)
- FOLLY_DECLARE_VECTOR_RESIZE_WITHOUT_INIT(int)
--- a/pkgs/by-name/fo/folly/cmake-asm-shared-library.patch
+++ b/pkgs/by-name/fo/folly/cmake-asm-shared-library.patch
@@ -0,0 +1,15 @@
+diff --git a/folly/external/aor/CMakeLists.txt b/folly/external/aor/CMakeLists.txt
+index e07e58745..1429f54e9 100644
+--- a/folly/external/aor/CMakeLists.txt
+++ b/folly/external/aor/CMakeLists.txt
+@@ -20,6 +20,10 @@
+ # Linux ELF directives (.size, etc.) that Darwin's assembler doesn't support
+ if(IS_AARCH64_ARCH)
+ 
+if(BUILD_SHARED_LIBS)
+  set(CMAKE_ASM_CREATE_SHARED_LIBRARY ${CMAKE_C_CREATE_SHARED_LIBRARY})
+endif()
+
+ folly_add_library(
+   NAME memcpy_aarch64
+   SRCS
--- a/pkgs/by-name/fo/folly/folly-fix-glog-0.7.patch
+++ b/pkgs/by-name/fo/folly/folly-fix-glog-0.7.patch
@@ -1,18 +0,0 @@
-diff --git a/CMake/folly-deps.cmake b/CMake/folly-deps.cmake
-index c72273a73..d0408f2b3 100644
--- a/CMake/folly-deps.cmake
-+++ b/CMake/folly-deps.cmake
-@@ -61,10 +61,9 @@ if(LIBGFLAGS_FOUND)
-   set(FOLLY_LIBGFLAGS_INCLUDE ${LIBGFLAGS_INCLUDE_DIR})
- endif()
- 
-find_package(Glog MODULE)
-set(FOLLY_HAVE_LIBGLOG ${GLOG_FOUND})
-list(APPEND FOLLY_LINK_LIBRARIES ${GLOG_LIBRARY})
-list(APPEND FOLLY_INCLUDE_DIRECTORIES ${GLOG_INCLUDE_DIR})
-+find_package(Glog CONFIG REQUIRED)
-+set(FOLLY_HAVE_LIBGLOG True)
-+list(APPEND FOLLY_LINK_LIBRARIES glog::glog)
- 
- find_package(LibEvent MODULE REQUIRED)
- list(APPEND FOLLY_LINK_LIBRARIES ${LIBEVENT_LIB})
--- a/pkgs/by-name/fo/folly/memset-benchmark-darwin.patch
+++ b/pkgs/by-name/fo/folly/memset-benchmark-darwin.patch
@@ -1,11 +0,0 @@
--- a/folly/test/MemsetBenchmark.cpp
-+++ b/folly/test/MemsetBenchmark.cpp
-@@ -40,7 +40,7 @@
- 
- template <void* memset_impl(void*, int, size_t)>
- void bmMemset(void* buf, size_t length, size_t iters) {
-#if !defined(__aarch64__)
-+#if !defined(__aarch64__) && !defined(__APPLE__)
-   __asm__ volatile(".align 64\n");
- #endif
- #pragma unroll(1)
--- a/pkgs/by-name/fo/folly/memset-memcpy-aarch64.patch
+++ b/pkgs/by-name/fo/folly/memset-memcpy-aarch64.patch
@@ -1,39 +1,8 @@
-From 9acd1ec8e6890c7f5d86a0dd6941ae3b8692ac9c Mon Sep 17 00:00:00 2001
-From: Lukas Krenz <lkrenz@nvidia.com>
-Date: Tue, 20 Jan 2026 05:59:00 -0800
-Subject: [PATCH] Fix memset/memcpy linkage on aarch64
-
-Otherwise memcpy and memset benchmarks won't compile
---
- folly/CMakeLists.txt | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
 diff --git a/folly/CMakeLists.txt b/folly/CMakeLists.txt
-index a1bcbdd6e92..51280821a24 100644
+index dc77e24731..cd6635ffd6 100644
 --- a/folly/CMakeLists.txt
 +++ b/folly/CMakeLists.txt
-@@ -879,6 +879,9 @@ folly_add_library(
-   NAME memset-impl
-   SRCS
-     FollyMemset.cpp
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:memset_select_aarch64.cpp>
-+  DEPS
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memset_aarch64>
- )
- 
- folly_add_library(
-@@ -894,12 +897,20 @@ folly_add_library(
-   EXCLUDE_FROM_MONOLITH
-   SRCS
-     FollyMemset.cpp
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:memset_select_aarch64.cpp>
-+  DEPS
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memset_aarch64-use>
-+  COMPILE_OPTIONS
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:-DFOLLY_MEMSET_IS_MEMSET>
- )
- 
- folly_add_library(
+@@ -807,6 +807,9 @@
   NAME memcpy-impl
   SRCS
     FollyMemcpy.cpp
@@ -43,15 +12,13 @@ index a1bcbdd6e92..51280821a24 100644
 )
 
 folly_add_library(
-@@ -915,6 +926,11 @@ folly_add_library(
-   EXCLUDE_FROM_MONOLITH
+@@ -860,6 +868,9 @@
+   NAME memset-impl
   SRCS
-     FollyMemcpy.cpp
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:memcpy_select_aarch64.cpp>
+     FollyMemset.cpp
+    $<$<BOOL:${IS_AARCH64_ARCH}>:memset_select_aarch64.cpp>
 +  DEPS
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memcpy_aarch64-use>
-+  COMPILE_OPTIONS
-+    $<$<BOOL:${IS_AARCH64_ARCH}>:-DFOLLY_MEMCPY_IS_MEMCPY>
+    $<$<BOOL:${IS_AARCH64_ARCH}>:folly_external_aor_memset_aarch64>
 )
 
- # x86 assembly memcpy implementation (not supported on MSVC)
+ folly_add_library(
--- a/pkgs/by-name/fo/folly/package.nix
+++ b/pkgs/by-name/fo/folly/package.nix
@@ -41,7 +41,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "folly";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";

  # split outputs to reduce downstream closure sizes
  outputs = [
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "facebook";
    repo = "folly";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gfmN/9LizPdacUd1eJxFx79I63SwqX0NaWFgbe6vbFk=";
+    hash = "sha256-xxS1FU3thl8UA1DzumVEazelISayLioabFjKlXX67Yk=";
  };

  nativeBuildInputs = [
@@ -134,28 +134,11 @@ stdenv.mkDerivation (finalAttrs: {
    # `dev` output’s CMake files.
    ./install-test-certs.patch

-    # The base template for std::char_traits has been removed in LLVM 19
-    # https://releases.llvm.org/19.1.0/projects/libcxx/docs/ReleaseNotes.html
-    ./char_traits.patch
-
-    # <https://github.com/facebook/folly/issues/2171>
-    ./folly-fix-glog-0.7.patch
-
    # https://github.com/facebook/folly/pull/2561
    ./memset-memcpy-aarch64.patch

-    # `.align 64` is invalid on x86_64 Mach-O, where `.align` takes a
-    # power-of-two exponent (64 means 2^64). The guard only excluded
-    # aarch64, so add !__APPLE__ to also skip x86_64-darwin.
-    ./memset-benchmark-darwin.patch
-
-    # Use feature detection directly instead of private standard library
-    # macros to detect the presence of ASAN and otherwise fallback to
-    # _not_ having ASAN.
-    (fetchpatch2 {
-      url = "https://github.com/facebook/folly/commit/fdde9bc360d525a1b2889b9ba89d671c3a13e72e.patch?full_index=1";
-      hash = "sha256-+1XJRAl4o9YubjqdIgQZpyrMmcb2imBfQUmiHNmFMRE=";
-    })
+    # https://github.com/Homebrew/homebrew-core/blob/1bebfe2c3e393a65c27f3e74f254770219b126f3/Formula/f/folly.rb#L83
+    ./cmake-asm-shared-library.patch
  ];

  # https://github.com/NixOS/nixpkgs/issues/144170
@@ -167,19 +150,6 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail \
        ${lib.escapeShellArg "\${prefix}/@CMAKE_INSTALL_INCLUDEDIR@"} \
        '@CMAKE_INSTALL_FULL_INCLUDEDIR@'
-  ''
-  # Fix duplicate symbol errors on aarch64-linux caused by both
-  # memcpy_aarch64 and memcpy_aarch64-use (same for memset) being linked
-  # into libfolly.so. Add EXCLUDE_FROM_MONOLITH to -use variants.
-  # https://github.com/facebook/folly/pull/2562
-  + lib.optionalString stdenv.hostPlatform.isAarch64 ''
-    substituteInPlace folly/external/aor/CMakeLists.txt \
-      --replace-fail \
-        "NAME memcpy_aarch64-use" \
-        "NAME memcpy_aarch64-use EXCLUDE_FROM_MONOLITH" \
-      --replace-fail \
-        "NAME memset_aarch64-use" \
-        "NAME memset_aarch64-use EXCLUDE_FROM_MONOLITH"
  '';

  disabledTests = [
--- a/pkgs/by-name/fr/freetube/package.nix
+++ b/pkgs/by-name/fr/freetube/package.nix
@@ -12,24 +12,24 @@
  pnpm_10,
  makeShellWrapper,
  copyDesktopItems,
-  electron,
  darwin,
-
+  electron_42,
  nixosTests,
 }:
 let
  description = "Open Source YouTube app for privacy";
  pnpm = pnpm_10;
+  electron = electron_42;
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "freetube";
-  version = "0.25.1";
+  version = "0.25.2";

  src = fetchFromGitHub {
    owner = "FreeTubeApp";
    repo = "FreeTube";
    tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-CQiwAoOJoAZpcDIwqcOfUAvJHLWTdj8fIInlR3qyjg8=";
+    hash = "sha256-A25I64GP4FRyP21W5QuVvrWpThyU7hDosO25vkIx0UY=";
  };

  __structuredAttrs = true;
@@ -58,7 +58,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-NWCgUjBuSeEl65mmAeJzOyIxCi2ha0Nr5qjOQq+CtMQ=";
+    hash = "sha256-1OnmJi4xCxMALAac4jnLOKg5N/t3pcHgM0AgvF1+DpM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fr/fromager/package.nix
+++ b/pkgs/by-name/fr/fromager/package.nix
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "fromager";
-  version = "0.91.0";
+  version = "0.94.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "python-wheel-build";
    repo = "fromager";
    tag = finalAttrs.version;
-    hash = "sha256-N+4DbKNUpQdkJAfr0vwlfXJS8FLLBOXxuzkLoJblJM4=";
+    hash = "sha256-h+WQlz1JIwlAF2wXVaUWScEE87P/r5bBFcDVMLalsEM=";
  };

  build-system = with python3Packages; [
@@ -59,11 +59,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
    "fromager"
  ];

-  # Upstream runs pytest with `--log-level DEBUG`, which this test suite
-  # relies on for caplog assertions against INFO records.
-  # Reported: https://github.com/python-wheel-build/fromager/issues/1274
-  pytestFlags = [ "--log-level=DEBUG" ];
-
  meta = {
    description = "Wheel maker";
    homepage = "https://pypi.org/project/fromager/";
--- a/pkgs/by-name/je/jetbrains-toolbox/package.nix
+++ b/pkgs/by-name/je/jetbrains-toolbox/package.nix
@@ -10,7 +10,7 @@

 let
  pname = "jetbrains-toolbox";
-  version = "3.6.3.86383";
+  version = "3.6.4.86641";

  updateScript = ./update.sh;

@@ -57,9 +57,9 @@ let
        aarch64 = "-arm64";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-RhBZK/86wMqgtFAolk5xubGAaqCewyEUlWjB+HAGEDg=";
-        aarch64-linux = "sha256-qhheArqQpElRoZGHmrl2W4+llDWEq+m4PXfG2XM6uYQ=";
-        aarch64-darwin = "sha256-mvfy8B2sOumvWiUmG8BtHvyZdcBs90BG8bEn21sPs5E=";
+        x86_64-linux = "sha256-UqEhoaH8vB6tcy+GcxUy+VupJPbv//q3wEQ8CwMUdic=";
+        aarch64-linux = "sha256-UQwFDdZNPxjtG/kK5imupGZ0xE4oyThCTLFxb0i2fTw=";
+        aarch64-darwin = "sha256-jPlYLiKabVew1kxd+TJ0W0WuT82R0p+yIAPxuIVEYRA=";
      };
    in
    selectKernel {
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/servers/http/jetty/default.nix
@@ -6,7 +6,7 @@
 }:

 let
-  common =
+  generic =
    { version, hash }:
    stdenvNoCC.mkDerivation rec {
      pname = "jetty";
@@ -51,12 +51,7 @@ let

 in
 {
-  jetty_11 = common {
-    version = "11.0.26";
-    hash = "sha256-uJgh/+/uGjchTgtoF38f7jIvbdrwdToAsqqVOlYtMIM=";
-  };
-
-  jetty_12 = common {
+  jetty_12 = generic {
    version = "12.1.11";
    hash = "sha256-fkXPjyO6xFZ/r5RiSzrEPgrrSSXLklQJ52BAmQocvpw=";
  };
--- a/pkgs/by-name/je/jetty/package.nix
+++ b/pkgs/by-name/je/jetty/package.nix
@@ -0,0 +1,5 @@
+{
+  jetty_12,
+}:
+
+jetty_12
--- a/pkgs/by-name/kv/kvrocks/package.nix
+++ b/pkgs/by-name/kv/kvrocks/package.nix
@@ -4,6 +4,7 @@
  stdenv,
  fetchFromGitHub,
  fetchpatch,
+  nixosTests,

  # keep-sorted start
  cmake,
@@ -343,6 +344,7 @@ stdenv.mkDerivation (finalAttrs: {
  passthru = {
    hook = callPackage ./hook.nix { kvrocks = finalAttrs.finalPackage; };
    tests = {
+      inherit (nixosTests) kvrocks;
      hook = callPackage ./hook-test.nix { kvrocks = finalAttrs.finalPackage; };
    };
  };
--- a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
+++ b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "mongodb-atlas-cli";
-  version = "1.57.0";
+  version = "1.58.0";

  src = fetchFromGitHub {
    owner = "mongodb";
    repo = "mongodb-atlas-cli";
    tag = "atlascli/v${finalAttrs.version}";
-    hash = "sha256-4UsQCflxYB2jy7y6FejBNJfE1a66JwS44aqelrQBdsU=";
+    hash = "sha256-kpgHmKm9gmAll+zuzXeUGv4oYRE4XL4LbSsFAB6Sj1M=";
  };

-  vendorHash = "sha256-FgAnXdYUFRJNKT5c8yS3B9tY8XQmUO+pRAlfw//d6tE=";
+  vendorHash = "sha256-PuwDBGVM7I0s2m8WppG6YdEM5sORTg0OfFFNpo0F31c=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/mp/mpv/scripts/modernx-zydezu.nix
+++ b/pkgs/by-name/mp/mpv/scripts/modernx-zydezu.nix
@@ -9,14 +9,14 @@
 }:
 buildLua (finalAttrs: {
  pname = "modernx-zydezu";
-  version = "0.4.6";
+  version = "0.4.7";

  scriptPath = "modernx.lua";
  src = fetchFromGitHub {
    owner = "zydezu";
    repo = "ModernX";
    rev = finalAttrs.version;
-    hash = "sha256-jK35LmihSCF789AJhKlySg6fXurAe5uuHNsgFjt0+iY=";
+    hash = "sha256-EekTzSC2Komh3H18IK1xr5bpQuAlulsc6CnmGb4aZ+A=";
  };

  nativeBuildInputs = [ installFonts ];
--- a/pkgs/by-name/mv/mvfst/glog-0.7.patch
+++ b/pkgs/by-name/mv/mvfst/glog-0.7.patch
@@ -1,26 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index a878c7c473..c76c989f91 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -52,7 +52,7 @@
- find_package(fmt REQUIRED)
- find_package(folly REQUIRED)
- find_package(Fizz REQUIRED)
-find_package(Glog REQUIRED)
-+find_package(Glog CONFIG REQUIRED)
- find_package(Threads)
- 
- SET(GFLAG_DEPENDENCIES "")
-diff --git a/cmake/QuicTest.cmake b/cmake/QuicTest.cmake
-index e7d9f0c0c3..5f4525189c 100644
--- a/cmake/QuicTest.cmake
-+++ b/cmake/QuicTest.cmake
-@@ -50,7 +50,7 @@
-   target_link_libraries(${QUIC_TEST_TARGET} PUBLIC
-     "${QUIC_TEST_DEPENDS}"
-     ${LIBGMOCK_LIBRARIES}
-    ${GLOG_LIBRARY}
-+    glog::glog
-   )
- 
-   # Per https://github.com/facebook/mvfst/pull/9, disable some warnings
--- a/pkgs/by-name/mv/mvfst/package.nix
+++ b/pkgs/by-name/mv/mvfst/package.nix
@@ -10,6 +10,7 @@
  folly,
  gflags,
  glog,
+  openssl,

  fizz,

@@ -22,10 +23,9 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mvfst";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";

  outputs = [
-    "bin"
    "out"
    "dev"
  ];
@@ -34,13 +34,9 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "facebook";
    repo = "mvfst";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-K4rskeF66EHchsBj8wIP3BYBa7SvQ1ohnOV0HPu+y80=";
+    hash = "sha256-H5T039YtYWP01UFtg7Y/7uGt9jhYEa7Q7j/9JhhSDfw=";
  };

-  patches = [
-    ./glog-0.7.patch
-  ];
-
  nativeBuildInputs = [
    cmake
    ninja
@@ -50,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
    folly
    gflags
    glog
+    openssl
  ];

  propagatedBuildInputs = [
--- a/pkgs/by-name/op/openlinkhub/package.nix
+++ b/pkgs/by-name/op/openlinkhub/package.nix
@@ -11,17 +11,17 @@

 buildGoModule (finalAttrs: {
  pname = "openlinkhub";
-  version = "0.8.9";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "jurkovic-nikola";
    repo = "OpenLinkHub";
    tag = finalAttrs.version;
-    hash = "sha256-g8ZdiBaEelS+LhnOA23mMR+irN1wKD6Rp66sCnSD2tU=";
+    hash = "sha256-VGrLQmg+ze60LRVmzeN8y8W8ZQt1Zxk8iENOsxNaOZ4=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-/itomxsbTDT7ML52bpUfDZIBZ/Rh/zx4Blg+PP7m7gE=";
+  vendorHash = "sha256-d0tA2XVDF/PzmBKqBSjfKJ3C3Lt0gMi3i2bx5LKRgj8=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/qu/quartus-prime-lite/package.nix
+++ b/pkgs/by-name/qu/quartus-prime-lite/package.nix
@@ -5,8 +5,9 @@
  makeDesktopItem,
  runtimeShell,
  runCommand,
+  writeShellScriptBin,
+  xdg-utils,
  unstick,
-  quartus-prime-lite,
  libfaketime,
  pkgsi686Linux,
  withQuesta ? true,
@@ -31,9 +32,23 @@ let
    genericName = "Quartus Prime";
    categories = [ "Development" ];
  };
+  # Quartus's own launcher (quartus/adm/qenv.sh) prepends quartus/linux64
+  # (which bundles an older libstdc++.so.6) to LD_LIBRARY_PATH for its whole
+  # session. When a user clicks a web link, Quartus execs `xdg-open` (found
+  # via $PATH) to open it, and that process inherits the polluted
+  # LD_LIBRARY_PATH, causing the browser it eventually launches to pick up
+  # Quartus's outdated libstdc++ instead of its own and fail to start. Shadow
+  # `xdg-open` on $PATH with a wrapper that restores the environment's
+  # original LD_LIBRARY_PATH (conveniently saved by qenv.sh as
+  # $QUARTUS_ORIG_LIBPATH) before delegating to nixpkgs' own xdg-utils
+  # xdg-open.
+  xdgOpenWrapper = writeShellScriptBin "xdg-open" ''
+    export LD_LIBRARY_PATH=$QUARTUS_ORIG_LIBPATH
+    exec ${lib.getExe' xdg-utils "xdg-open"} "$@"
+  '';
 in
 # I think questa_fse/linux/vlm checksums itself, so use FHSUserEnv instead of `patchelf`
-buildFHSEnv rec {
+buildFHSEnv (finalAttrs: {
  pname = "quartus-prime-lite"; # wrapped
  inherit (unwrapped) version;

@@ -75,7 +90,14 @@ buildFHSEnv rec {
    pkgs:
    with pkgs;
    let
-      # This seems ugly - can we override `libpng = libpng12` for all `pkgs`?
+      # NOTE: Not using `pkgs.extend` here on purpose: `pkgs` here is
+      # `pkgsi686Linux`, a spliced package set (see the "splicing code does not
+      # handle `pkgsi686Linux` well" comment in buildFHSEnv.nix), and `.extend`
+      # rebuilds the whole fixed point instead of overriding a single
+      # derivation. That drops the splice, so every package pulled from this
+      # set below (not just the ones touching `libpng`) ends up rebuilt from an
+      # independent, non-spliced i686 bootstrap instead of sharing store paths
+      # with the rest of the closure.
      freetype = pkgs.freetype.override { libpng = libpng12; };
      fontconfig = pkgs.fontconfig.override { inherit freetype; };
      libxft = pkgs.libxft.override { inherit freetype fontconfig; };
@@ -95,6 +117,11 @@ buildFHSEnv rec {
      libxcrypt-legacy
    ];

+  # See above NOTE regarding libpng
+  disallowedReferences = [
+    pkgsi686Linux.libpng
+  ];
+
  extraInstallCommands = ''
    mkdir -p $out/share/applications $out/share/icons/hicolor/64x64/apps
    ln -s ${desktopItem}/share/applications/* $out/share/applications
@@ -102,12 +129,13 @@ buildFHSEnv rec {

    progs_to_wrap=(
      "${unwrapped}"/quartus/bin/*
+      "${unwrapped}"/niosv/bin/*
      "${unwrapped}"/quartus/sopc_builder/bin/qsys-{generate,edit,script}
      "${unwrapped}"/questa_fse/bin/*
      "${unwrapped}"/questa_fse/linux_x86_64/lmutil
    )

-    wrapper=$out/bin/${pname}
+    wrapper=$out/bin/quartus-prime-lite
    progs_wrapped=()
    for prog in ''${progs_to_wrap[@]}; do
        relname="''${prog#"${unwrapped}/"}"
@@ -133,6 +161,11 @@ buildFHSEnv rec {
                ;;
        esac
        echo "export NIXPKGS_QUARTUS_THIS_PROG_SUPPORTS_FIXED_CLOCK=$NIXPKGS_QUARTUS_THIS_PROG_SUPPORTS_FIXED_CLOCK" >> "$wrapped"
+        # If a Wayland user has QT_QPA_PLATFORM=wayland, Quartus executables
+        # that use Qt won't work, so let's be explicit.
+        echo "export QT_QPA_PLATFORM=xcb" >> "$wrapped"
+        # See above NOTE regarding `xdgOpenWrapper`
+        echo "export PATH=${xdgOpenWrapper}/bin:\$PATH" >> "$wrapped"
        echo "exec $wrapper $prog \"\$@\"" >> "$wrapped"
    done

@@ -183,7 +216,7 @@ buildFHSEnv rec {
      buildSof =
        runCommand "quartus-prime-lite-test-build-sof"
          {
-            nativeBuildInputs = [ quartus-prime-lite ];
+            nativeBuildInputs = [ finalAttrs.finalPackage ];
            env.NIXPKGS_QUARTUS_REPRODUCIBLE_BUILD = "1";
          }
          ''
@@ -220,11 +253,11 @@ buildFHSEnv rec {
            env.NIXPKGS_QUARTUS_REPRODUCIBLE_BUILD = "1";
          }
          ''
-            "${quartus-prime-lite}/bin/vlog" "${quartus-prime-lite.unwrapped}/questa_fse/intel/verilog/src/arriav_atoms_ncrypt.v"
+            "${finalAttrs.finalPackage}/bin/vlog" "${finalAttrs.passthru.unwrapped}/questa_fse/intel/verilog/src/arriav_atoms_ncrypt.v"
            touch "$out"
          '';
    };
  };

  inherit (unwrapped) meta;
-}
+})
--- a/pkgs/by-name/qu/quartus-prime-lite/quartus.nix
+++ b/pkgs/by-name/qu/quartus-prime-lite/quartus.nix
@@ -2,6 +2,7 @@
  stdenv,
  lib,
  unstick,
+  unzip,
  fetchurl,
  withQuesta ? true,
  supportedDevices ? [
@@ -12,119 +13,142 @@
    "MAX II/V"
    "MAX 10 FPGA"
  ],
+  # leaves enabled: quartus, devinfo
+  disabledComponents ? [
+    "quartus_help"
+    "quartus_update"
+    "questa_fe"
+  ],
 }:

-let
-  deviceIds = {
-    "Arria II" = "arria_lite";
-    "Cyclone V" = "cyclonev";
-    "Cyclone IV" = "cyclone";
-    "Cyclone 10 LP" = "cyclone10lp";
-    "MAX II/V" = "max";
-    "MAX 10 FPGA" = "max10";
-  };
-
-  supportedDeviceIds =
-    assert lib.assertMsg (lib.all (
-      name: lib.hasAttr name deviceIds
-    ) supportedDevices) "Supported devices are: ${lib.concatStringsSep ", " (lib.attrNames deviceIds)}";
-    lib.listToAttrs (
-      map (name: {
-        inherit name;
-        value = deviceIds.${name};
-      }) supportedDevices
-    );
-
-  unsupportedDeviceIds = lib.removeAttrs deviceIds (lib.attrNames supportedDeviceIds);
-
-  componentHashes = {
-    "arria_lite" = "sha256-Epxvu1z7Z4vQWASIYEJAy5P7Meee114ZNVIAZnmTEH8=";
-    "cyclone" = "sha256-lKOYy61BHxY4OyonxADg6d7IGwckGX8zu0x6dpGB5Lo=";
-    "cyclone10lp" = "sha256-lurSlhCuE6i2ULKNFvlWNtk6rqdvVwREC607HbMSH2I=";
-    "cyclonev" = "sha256-1uSE/RsKR3hbyLzTGOQn1Ml5j5J26e+SmFI1hl9ry28=";
-    "max" = "sha256-jY/b906fJKgJOL3h5nWR5RQdvAJ3U9of6y4VopGo2z0=";
-    "max10" = "sha256-gFeESwuRwrp+8rN7GYbRmOxPGDHMm+ClLRjl/rTBnOk=";
-  };
-
+stdenv.mkDerivation (finalAttrs: {
+  pname = "quartus-prime-lite-unwrapped";
  version = "25.1std.0.1129";

-  download =
-    { name, sha256 }:
-    fetchurl {
-      inherit name sha256;
-      # e.g. "23.1std.1.993" -> "23.1std/993"
-      url = "https://downloads.intel.com/akdlm/software/acdsinst/${lib.versions.majorMinor version}std/${lib.elemAt (lib.splitVersion version) 4}/ib_installers/${name}";
-    };
+  nativeBuildInputs = [
+    unstick
+    # The devices' .qdz files are actually zip files, and without `unzip` here
+    # they are failed to be extracted because the installer tries to run its
+    # own `unzip` utility.
+    unzip
+  ];

-  installers = map download (
-    [
-      {
-        name = "QuartusLiteSetup-${version}-linux.run";
-        sha256 = "sha256-UYQz7H3NYXJVYK9lM1P3pcMgzOnlKLInR7io3zZ0xOs=";
-      }
-    ]
-    ++ lib.optional withQuesta {
-      name = "QuestaSetup-${version}-linux.run";
-      sha256 = "sha256-0F7psE+jTimCoy+UVJRgxNC6GEVdY/PJu49hf+D7T3U=";
-    }
-  );
-  components = map (
-    id:
-    download {
-      name = "${id}-${version}.qdz";
-      sha256 = lib.getAttr id componentHashes;
-    }
-  ) (lib.attrValues supportedDeviceIds);
-
-in
-stdenv.mkDerivation {
-  inherit version;
-  pname = "quartus-prime-lite-unwrapped";
-
-  nativeBuildInputs = [ unstick ];
-
-  buildCommand =
+  buildCommand = ''
+    echo "setting up installer..."
+  ''
+  + lib.pipe finalAttrs.finalPackage.passthru.installers [
+    (lib.mapAttrsToList finalAttrs.finalPackage.passthru.download)
+    # NOTE that we don't have a choice but to `cp` the installers and not
+    # symlink them, because the installers lookup for `.qdz` files by looking
+    # at the directory of their real, symlink-resolved location. We can however
+    # symlink the `.qdz` files to `$TEMP`.
+    (map (installer: ''
+      # `$(cat $NIX_CC/nix-support/dynamic-linker) $src[0]` often segfaults, so cp + patchelf
+      cp ${installer} $TEMP/${installer.name}
+      chmod u+w,+x $TEMP/${installer.name}
+      patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $TEMP/${installer.name}
+    ''))
+    (lib.concatStringsSep "\n")
+  ]
+  + (
    let
-      copyInstaller = installer: ''
-        # `$(cat $NIX_CC/nix-support/dynamic-linker) $src[0]` often segfaults, so cp + patchelf
-        cp ${installer} $TEMP/${installer.name}
-        chmod u+w,+x $TEMP/${installer.name}
-        patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $TEMP/${installer.name}
-      '';
-      copyComponent = component: "cp ${component} $TEMP/${component.name}";
-      # leaves enabled: quartus, devinfo
-      disabledComponents = [
-        "quartus_help"
-        "quartus_update"
-        "questa_fe"
-      ]
-      ++ (lib.optional (!withQuesta) "questa_fse")
-      ++ (lib.attrValues unsupportedDeviceIds);
+      availableDevices = lib.pipe finalAttrs.finalPackage.passthru.deviceIds [
+        lib.attrNames
+        lib.naturalSort
+      ];
+      unsupportedRequestedDevices = lib.pipe supportedDevices [
+        (lib.subtractLists availableDevices)
+        lib.naturalSort
+      ];
    in
-    ''
-      echo "setting up installer..."
-      ${lib.concatMapStringsSep "\n" copyInstaller installers}
-      ${lib.concatMapStringsSep "\n" copyComponent components}
-
-      echo "executing installer..."
-      # "Could not load seccomp program: Invalid argument" might occur if unstick
-      # itself is compiled for x86_64 instead of the non-x86 host. In that case,
-      # override the input.
-      unstick $TEMP/${(builtins.head installers).name} \
-        --disable-components ${lib.concatStringsSep "," disabledComponents} \
-        --mode unattended --installdir $out --accept_eula 1
-
-      echo "cleaning up..."
-      rm -r $out/uninstall $out/logs
-
-      # replace /proc pentium check with a true statement. this allows usage under emulation.
-      substituteInPlace $out/quartus/adm/qenv.sh \
-        --replace-fail 'grep sse /proc/cpuinfo > /dev/null 2>&1' ':'
+    assert lib.assertMsg (unsupportedRequestedDevices == [ ]) ''
+      Unsupported devices requested:
+      ${lib.concatMapStringsSep "\n" (d: " - ${d}") unsupportedRequestedDevices}
+      Supported devices are:
+      ${lib.concatMapStringsSep "\n" (d: " - ${d}") availableDevices}
    '';
+    lib.pipe supportedDevices [
+      (map (name: finalAttrs.finalPackage.passthru.deviceIds.${name}))
+      (ids: lib.getAttrs ids finalAttrs.finalPackage.passthru.components)
+      (lib.mapAttrsToList (
+        id: hash: finalAttrs.finalPackage.passthru.download "${id}-${finalAttrs.version}.qdz" hash
+      ))
+      # See NOTE above `map` that iterates the installers.
+      (map (component: "ln -s ${component} $TEMP/${component.name}"))
+      (lib.concatStringsSep "\n")
+    ]
+  )
+  # New line preceding the below bash commands is required for the `echo` below
+  # to be in its own line.
+  + ''
+
+    echo "executing installer..."
+    # "Could not load seccomp program: Invalid argument" might occur if unstick
+    # itself is compiled for x86_64 instead of the non-x86 host. In that case,
+    # override the input.
+    unstick $TEMP/${finalAttrs.finalPackage.passthru.mainInstaller} \
+      --disable-components ${
+        lib.concatStringsSep "," (
+          disabledComponents
+          ++ lib.optional (!withQuesta) "questa_fse"
+          ++ lib.attrValues (lib.removeAttrs finalAttrs.finalPackage.passthru.deviceIds supportedDevices)
+        )
+      } \
+      --mode unattended --installdir $out --accept_eula 1
+
+    echo "installer log:"
+    cat "$out/logs/quartus-${finalAttrs.version}-linux-install.log"
+
+    echo "cleaning up..."
+    rm -r $out/uninstall $out/logs
+
+    # replace /proc pentium check with a true statement. this allows usage under emulation.
+    substituteInPlace $out/quartus/adm/qenv.sh \
+      --replace-fail 'grep sse /proc/cpuinfo > /dev/null 2>&1' ':'
+  '';
+
+  passthru = {
+    deviceIds = {
+      "Arria II" = "arria_lite";
+      "Cyclone V" = "cyclonev";
+      "Cyclone IV" = "cyclone";
+      "Cyclone 10 LP" = "cyclone10lp";
+      "MAX II/V" = "max";
+      "MAX 10 FPGA" = "max10";
+    };
+    components = {
+      "arria_lite" = "sha256-Epxvu1z7Z4vQWASIYEJAy5P7Meee114ZNVIAZnmTEH8=";
+      "cyclone" = "sha256-lKOYy61BHxY4OyonxADg6d7IGwckGX8zu0x6dpGB5Lo=";
+      "cyclone10lp" = "sha256-lurSlhCuE6i2ULKNFvlWNtk6rqdvVwREC607HbMSH2I=";
+      "cyclonev" = "sha256-1uSE/RsKR3hbyLzTGOQn1Ml5j5J26e+SmFI1hl9ry28=";
+      "max" = "sha256-jY/b906fJKgJOL3h5nWR5RQdvAJ3U9of6y4VopGo2z0=";
+      "max10" = "sha256-gFeESwuRwrp+8rN7GYbRmOxPGDHMm+ClLRjl/rTBnOk=";
+    };
+    installers = {
+      "QuartusLiteSetup-${finalAttrs.version}-linux.run" =
+        "sha256-UYQz7H3NYXJVYK9lM1P3pcMgzOnlKLInR7io3zZ0xOs=";
+    }
+    // lib.optionalAttrs withQuesta {
+      "QuestaSetup-${finalAttrs.version}-linux.run" =
+        "sha256-0F7psE+jTimCoy+UVJRgxNC6GEVdY/PJu49hf+D7T3U=";
+    };
+    mainInstaller = "QuartusLiteSetup-${finalAttrs.version}-linux.run";
+    # Make it a bit easier to override the download URL schema.
+    baseURL = "https://downloads.intel.com/akdlm/software/acdsinst";
+    # e.g. "23.1std.1.993" -> "23.1std/993"
+    URLdir = "${lib.versions.majorMinor finalAttrs.version}std/${lib.elemAt (lib.splitVersion finalAttrs.version) 4}/ib_installers";
+    download =
+      name: hash:
+      fetchurl {
+        inherit name hash;
+        url = "${finalAttrs.finalPackage.baseURL}/${finalAttrs.finalPackage.URLdir}/${name}";
+      };
+  };

  meta = {
    homepage = "https://fpgasoftware.intel.com";
    description = "FPGA design and simulation software";
+    mainProgram = "quartus";
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    license = lib.licenses.unfree;
    platforms = [ "x86_64-linux" ];
@@ -132,6 +156,7 @@ stdenv.mkDerivation {
      bjornfor
      kwohlfahrt
      zainkergaye
+      doronbehar
    ];
  };
-}
+})
--- a/pkgs/by-name/tr/tree-sitter/grammars/README.md
+++ b/pkgs/by-name/tr/tree-sitter/grammars/README.md
@@ -149,6 +149,9 @@ grammars.withPlugins (p: [

 The scoped `withPlugins` helper receives derivations from the same overridden scope, so added or replaced grammars are visible.

+Deprecated or renamed grammar aliases live in [aliases.nix](aliases.nix) and are exposed only when `config.allowAliases = true`.
+An alias resolves to the same derivation as its canonical name, so `derivations`, `allGrammars`, and `withPlugins` all see it once enabled.
+
 The set also carries package-set helpers (`callPackage`, `newScope`, `overrideScope`, …) alongside the grammars, so do not iterate it directly.
 Use one of its grammar-only views instead; each reflects any `overrideScope`:

--- a/pkgs/by-name/tr/tree-sitter/grammars/aliases.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/aliases.nix
@@ -0,0 +1,16 @@
+{ lib }:
+_final: prev:
+let
+  checkInGrammars =
+    name: alias:
+    if builtins.hasAttr name prev then
+      throw "Alias ${name} is still in tree-sitter-grammars"
+    else
+      alias;
+
+  mapAliases = lib.mapAttrs checkInGrammars;
+in
+mapAliases {
+  # keep-sorted start block=yes
+  # keep-sorted end
+}
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -1,6 +1,7 @@
 {
  lib,
  stdenv,
+  config,
  newScope,
  fetchFromGitHub,
  fetchFromGitLab,
@@ -76,6 +77,8 @@ let
  builtGrammars = lib.mapAttrs (_: lib.makeOverridable buildGrammar) grammars;

  hasTreeSitterPrefix = lib.hasPrefix "tree-sitter-";
+  grammarAliases = import ./grammars/aliases.nix { inherit lib; };
+
  grammarDerivationsFrom = lib.filterAttrs (
    name: value: hasTreeSitterPrefix name && lib.isDerivation value
  );
@@ -117,6 +120,7 @@ let
  grammarsScope = lib.makeScope newScope (
    self:
    builtGrammars
+    // lib.optionalAttrs config.allowAliases (grammarAliases self builtGrammars)
    // {
      derivations = grammarDerivationsFrom self;
      allGrammars = lib.filter (p: !(p.meta.broken or false)) (
--- a/pkgs/by-name/wa/wangle/glog-0.7.patch
+++ b/pkgs/by-name/wa/wangle/glog-0.7.patch
@@ -1,30 +0,0 @@
-diff --git a/wangle/CMakeLists.txt b/wangle/CMakeLists.txt
-index 041e73c2b1..2804ad72cf 100644
--- a/wangle/CMakeLists.txt
-+++ b/wangle/CMakeLists.txt
-@@ -66,7 +66,7 @@
- find_package(fizz CONFIG REQUIRED)
- find_package(fmt CONFIG REQUIRED)
- find_package(OpenSSL REQUIRED)
-find_package(Glog REQUIRED)
-+find_package(Glog CONFIG REQUIRED)
- find_package(gflags CONFIG QUIET)
- if (gflags_FOUND)
-   message(STATUS "Found gflags from package config")
-@@ -162,7 +162,6 @@
-     ${FOLLY_INCLUDE_DIR}
-     ${Boost_INCLUDE_DIRS}
-     ${OPENSSL_INCLUDE_DIR}
-    ${GLOG_INCLUDE_DIRS}
-     ${GFLAGS_INCLUDE_DIRS}
-     ${LIBEVENT_INCLUDE_DIR}
-     ${DOUBLE_CONVERSION_INCLUDE_DIR}
-@@ -172,7 +171,7 @@
-   ${FIZZ_LIBRARIES}
-   ${Boost_LIBRARIES}
-   ${OPENSSL_LIBRARIES}
-  ${GLOG_LIBRARIES}
-+  glog::glog
-   ${GFLAGS_LIBRARIES}
-   ${LIBEVENT_LIB}
-   ${DOUBLE_CONVERSION_LIBRARY}
--- a/pkgs/by-name/wa/wangle/package.nix
+++ b/pkgs/by-name/wa/wangle/package.nix
@@ -24,7 +24,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "wangle";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";

  outputs = [
    "out"
@@ -35,13 +35,9 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "facebook";
    repo = "wangle";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tGq6jbBPotuBK1PuRRGvdNb208glzlt7dehjIY+4nvk=";
+    hash = "sha256-BGl1LGaYRmYdG4h98HhAT7X4tXEMjlzh27nGLCY/B1c=";
  };

-  patches = [
-    ./glog-0.7.patch
-  ];
-
  nativeBuildInputs = [
    cmake
    ninja
--- a/pkgs/by-name/wa/watchman/Cargo.lock
+++ b/pkgs/by-name/wa/watchman/Cargo.lock
@@ -16,48 +16,72 @@ dependencies = [
 ]

 [[package]]
-name = "ansi_term"
-version = "0.12.1"
+name = "anstream"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
 dependencies = [
- "winapi",
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
 ]

 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
-
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"

 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"

 [[package]]
 name = "bitflags"
-version = "1.3.2"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"

 [[package]]
 name = "byteorder"
@@ -67,9 +91,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"

 [[package]]
 name = "bytes"
-version = "1.11.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 dependencies = [
 "serde",
 ]
@@ -82,25 +106,59 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"

 [[package]]
 name = "cfg_aliases"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"

 [[package]]
 name = "clap"
-version = "2.34.0"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
+checksum = "d91e0c145792ef73a6ad36d27c75ac09f1832222a3c209689d90f534685ee5b7"
 dependencies = [
- "ansi_term",
- "atty",
- "bitflags 1.3.2",
- "strsim",
- "textwrap",
- "unicode-width",
- "vec_map",
+ "clap_builder",
+ "clap_derive",
 ]

+[[package]]
+name = "clap_builder"
+version = "4.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+ "terminal_size",
+ "unicase",
+ "unicode-width 0.2.2",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
 [[package]]
 name = "crossbeam"
 version = "0.8.4"
@@ -116,18 +174,18 @@ dependencies = [

 [[package]]
 name = "crossbeam-channel"
-version = "0.5.15"
+version = "0.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
 dependencies = [
 "crossbeam-utils",
 ]

 [[package]]
 name = "crossbeam-deque"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
+checksum = "5181e0de7b61eb03a81e347d6dd8797bae9da5146707b51077e2d71a54ec0ceb"
 dependencies = [
 "crossbeam-epoch",
 "crossbeam-utils",
@@ -135,27 +193,27 @@ dependencies = [

 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
 "crossbeam-utils",
 ]

 [[package]]
 name = "crossbeam-queue"
-version = "0.3.12"
+version = "0.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
 dependencies = [
 "crossbeam-utils",
 ]

 [[package]]
 name = "crossbeam-utils"
-version = "0.8.21"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"

 [[package]]
 name = "duct"
@@ -171,9 +229,9 @@ dependencies = [

 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"

 [[package]]
 name = "errno"
@@ -193,9 +251,9 @@ checksum = "3a471a38ef8ed83cd6e40aa59c1ffe17db6855c18e3604d9c4ed8c08ebc28678"

 [[package]]
 name = "futures"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
 dependencies = [
 "futures-channel",
 "futures-core",
@@ -208,9 +266,9 @@ dependencies = [

 [[package]]
 name = "futures-channel"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
 dependencies = [
 "futures-core",
 "futures-sink",
@@ -218,15 +276,15 @@ dependencies = [

 [[package]]
 name = "futures-core"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"

 [[package]]
 name = "futures-executor"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
 dependencies = [
 "futures-core",
 "futures-task",
@@ -235,38 +293,38 @@ dependencies = [

 [[package]]
 name = "futures-io"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"

 [[package]]
 name = "futures-macro"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.114",
+ "syn 2.0.119",
 ]

 [[package]]
 name = "futures-sink"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"

 [[package]]
 name = "futures-task"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"

 [[package]]
 name = "futures-util"
-version = "0.3.31"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
 dependencies = [
 "futures 0.1.31",
 "futures-channel",
@@ -275,9 +333,9 @@ dependencies = [
 "futures-macro",
 "futures-sink",
 "futures-task",
+ "libc",
 "memchr",
 "pin-project-lite",
- "pin-utils",
 "slab",
 ]

@@ -301,27 +359,21 @@ checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"

 [[package]]
 name = "heck"
-version = "0.3.3"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"

 [[package]]
-name = "hermit-abi"
-version = "0.1.19"
+name = "is_terminal_polyfill"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"

 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"

 [[package]]
 name = "jwalk"
@@ -334,16 +386,16 @@ dependencies = [
 ]

 [[package]]
-name = "lazy_static"
-version = "1.5.0"
+name = "libc"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"

 [[package]]
-name = "libc"
-version = "0.2.180"
+name = "linux-raw-sys"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"

 [[package]]
 name = "lock_api"
@@ -362,9 +414,9 @@ checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"

 [[package]]
 name = "memchr"
-version = "2.7.6"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"

 [[package]]
 name = "memoffset"
@@ -377,9 +429,9 @@ dependencies = [

 [[package]]
 name = "mio"
-version = "1.1.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
 "libc",
 "wasi",
@@ -392,7 +444,7 @@ version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags",
 "cfg-if",
 "cfg_aliases",
 "libc",
@@ -401,9 +453,9 @@ dependencies = [

 [[package]]
 name = "ntapi"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c70f219e21142367c70c0b30c6a9e3a14d55b4d12a204d897fbec83a0363f081"
+checksum = "c3b335231dfd352ffb0f8017f3b6027a4917f7df785ea2143d8af2adc66980ae"
 dependencies = [
 "winapi",
 ]
@@ -414,7 +466,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags",
 ]

 [[package]]
@@ -429,9 +481,15 @@ dependencies = [

 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"

 [[package]]
 name = "os_pipe"
@@ -468,54 +526,24 @@ dependencies = [

 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
-
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
-
-[[package]]
-name = "proc-macro-error"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
-dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "version_check",
-]
-
-[[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
-dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
-]
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"

 [[package]]
 name = "proc-macro2"
-version = "1.0.105"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "535d180e0ecab6268a3e718bb9fd44db66bbbc256257165fc699dadf70d16fe7"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
 "unicode-ident",
 ]

 [[package]]
 name = "quote"
-version = "1.0.43"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc74d9a594b72ae6656596548f56f667211f8a97b3d4c3d467150794690dc40a"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
 "proc-macro2",
 ]
@@ -528,9 +556,9 @@ checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"

 [[package]]
 name = "rayon"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f"
+checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
 dependencies = [
 "either",
 "rayon-core",
@@ -552,7 +580,20 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -563,9 +604,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
 "serde_core",
 "serde_derive",
@@ -595,29 +636,29 @@ dependencies = [

 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.114",
+ "syn 3.0.3",
 ]

 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
 "itoa",
 "memchr",
@@ -670,61 +711,37 @@ dependencies = [

 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"

 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"

 [[package]]
 name = "socket2"
-version = "0.6.1"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
 "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
 name = "strsim"
-version = "0.8.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
-
-[[package]]
-name = "structopt"
-version = "0.3.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c6b5c64445ba8094a6ab0c3cd2ad323e07171012d9c98b0b15651daf1787a10"
-dependencies = [
- "clap",
- "lazy_static",
- "structopt-derive",
-]
-
-[[package]]
-name = "structopt-derive"
-version = "0.4.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcb5ae327f9cc13b68763b5749770cb9e048a99bd9dfdfa58d0cf05d5f64afe0"
-dependencies = [
- "heck",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

 [[package]]
 name = "syn"
-version = "1.0.109"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -733,9 +750,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "2.0.114"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -762,43 +779,44 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9a2882c514780a1973df90de9d68adcd8871bacc9a6331c3f28e6d2ff91a3d1"
 dependencies = [
- "unicode-width",
+ "unicode-width 0.1.14",
 ]

 [[package]]
-name = "textwrap"
-version = "0.11.0"
+name = "terminal_size"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
- "unicode-width",
+ "rustix",
+ "windows-sys 0.61.2",
 ]

 [[package]]
 name = "thiserror"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.114",
+ "syn 3.0.3",
 ]

 [[package]]
 name = "tokio"
-version = "1.49.0"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
 "bytes",
 "libc",
@@ -814,20 +832,20 @@ dependencies = [

 [[package]]
 name = "tokio-macros"
-version = "2.6.0"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.114",
+ "syn 3.0.3",
 ]

 [[package]]
 name = "tokio-util"
-version = "0.7.18"
+version = "0.7.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
 dependencies = [
 "bytes",
 "futures-core",
@@ -835,6 +853,7 @@ dependencies = [
 "futures-sink",
 "futures-util",
 "hashbrown",
+ "libc",
 "pin-project-lite",
 "slab",
 "tokio",
@@ -860,16 +879,16 @@ dependencies = [
 ]

 [[package]]
-name = "unicode-ident"
-version = "1.0.22"
+name = "unicase"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"

 [[package]]
-name = "unicode-segmentation"
-version = "1.12.0"
+name = "unicode-ident"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"

 [[package]]
 name = "unicode-width"
@@ -878,10 +897,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"

 [[package]]
-name = "vec_map"
-version = "0.8.2"
+name = "unicode-width"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"

 [[package]]
 name = "version_check"
@@ -897,9 +922,9 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"

 [[package]]
 name = "wasip2"
-version = "1.0.2+wasi-0.2.9"
+version = "1.0.4+wasi-0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
 dependencies = [
 "wit-bindgen",
 ]
@@ -910,7 +935,7 @@ version = "0.9.0"
 dependencies = [
 "anyhow",
 "bytes",
- "futures 0.3.31",
+ "futures 0.3.33",
 "maplit",
 "serde",
 "serde_bser",
@@ -926,12 +951,12 @@ version = "0.1.0"
 dependencies = [
 "ahash",
 "anyhow",
+ "clap",
 "duct",
 "jwalk",
 "nix",
 "serde",
 "serde_json",
- "structopt",
 "sysinfo",
 "tabular",
 "tokio",
@@ -1014,7 +1039,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.114",
+ "syn 2.0.119",
 ]

 [[package]]
@@ -1025,7 +1050,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.114",
+ "syn 2.0.119",
 ]

 [[package]]
@@ -1162,32 +1187,32 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"

 [[package]]
 name = "wit-bindgen"
-version = "0.51.0"
+version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"

 [[package]]
 name = "zerocopy"
-version = "0.8.33"
+version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "668f5168d10b9ee831de31933dc111a459c97ec93225beb307aed970d1372dfd"
+checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
 dependencies = [
 "zerocopy-derive",
 ]

 [[package]]
 name = "zerocopy-derive"
-version = "0.8.33"
+version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c7962b26b0a8685668b671ee4b54d007a67d4eaf05fda79ac0ecf41e32270f1"
+checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.114",
+ "syn 2.0.119",
 ]

 [[package]]
 name = "zmij"
-version = "1.0.15"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94f63c051f4fe3c1509da62131a678643c5b6fbdc9273b2b79d4378ebda003d2"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
--- a/pkgs/by-name/wa/watchman/fmt-12.2.0-format-header.patch
+++ b/pkgs/by-name/wa/watchman/fmt-12.2.0-format-header.patch
@@ -0,0 +1,611 @@
+From 2235635249f63e127963b0c8d66b8da20d57363a Mon Sep 17 00:00:00 2001
+From: Daeho Ro <40587651+daeho-ro@users.noreply.github.com>
+Date: Wed, 5 Aug 2026 23:25:44 +0900
+Subject: [PATCH] Include <fmt/format.h> for fmt::format instead of
+ <fmt/core.h>
+
+---
+ watchman/ChildProcess.cpp                 | 2 +-
+ watchman/Client.h                         | 2 +-
+ watchman/ContentHash.cpp                  | 2 +-
+ watchman/CookieSync.cpp                   | 2 +-
+ watchman/Errors.h                         | 2 +-
+ watchman/InMemoryView.cpp                 | 2 +-
+ watchman/LRUCache.h                       | 2 +-
+ watchman/Logging.cpp                      | 2 +-
+ watchman/Options.cpp                      | 2 +-
+ watchman/PathUtils.cpp                    | 2 +-
+ watchman/Poison.cpp                       | 2 +-
+ watchman/ProcessLock.cpp                  | 2 +-
+ watchman/SanityCheck.cpp                  | 2 +-
+ watchman/SignalHandler.cpp                | 2 +-
+ watchman/UserDir.cpp                      | 2 +-
+ watchman/benchmarks/bser.cpp              | 2 +-
+ watchman/bser.h                           | 2 +-
+ watchman/cmds/heapprof.cpp                | 2 +-
+ watchman/cppclient/WatchmanClient.cpp     | 2 +-
+ watchman/cppclient/WatchmanConnection.cpp | 2 +-
+ watchman/fs/FileSystem.cpp                | 2 +-
+ watchman/fs/ParallelWalk.cpp              | 2 +-
+ watchman/fs/UnixDirHandle.cpp             | 2 +-
+ watchman/main.cpp                         | 2 +-
+ watchman/query/GlobTree.cpp               | 2 +-
+ watchman/query/TermRegistry.cpp           | 2 +-
+ watchman/query/intcompare.cpp             | 2 +-
+ watchman/query/parse.cpp                  | 2 +-
+ watchman/query/pcre.cpp                   | 2 +-
+ watchman/query/type.cpp                   | 2 +-
+ watchman/root/init.cpp                    | 2 +-
+ watchman/root/resolve.cpp                 | 2 +-
+ watchman/root/watchlist.cpp               | 2 +-
+ watchman/scm/Git.cpp                      | 2 +-
+ watchman/scm/Mercurial.cpp                | 2 +-
+ watchman/test/ArtTest.cpp                 | 2 +-
+ watchman/test/BserTest.cpp                | 2 +-
+ watchman/thirdparty/jansson/load.cpp      | 2 +-
+ watchman/thirdparty/jansson/value.cpp     | 2 +-
+ watchman/watcher/WatcherRegistry.cpp      | 2 +-
+ watchman/watcher/eden.cpp                 | 2 +-
+ watchman/watchman_string.h                | 2 +-
+ watchman/winbuild/susres.cpp              | 2 +-
+ 43 files changed, 43 insertions(+), 43 deletions(-)
+
+diff --git a/watchman/ChildProcess.cpp b/watchman/ChildProcess.cpp
+index abfb15993529..8ace18c98703 100644
+--- a/watchman/ChildProcess.cpp
+++ b/watchman/ChildProcess.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/ChildProcess.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/ScopeGuard.h>
+ #include <folly/String.h>
+ #include <memory>
+diff --git a/watchman/Client.h b/watchman/Client.h
+index c3f3b9273d64..e5e3f16a3626 100644
+--- a/watchman/Client.h
+++ b/watchman/Client.h
+@@ -7,7 +7,7 @@
+ 
+ #pragma once
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ 
+ #include <chrono>
+ #include <deque>
+diff --git a/watchman/ContentHash.cpp b/watchman/ContentHash.cpp
+index cdecf02ff67b..3fa84487ac96 100644
+--- a/watchman/ContentHash.cpp
+++ b/watchman/ContentHash.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/ContentHash.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/ScopeGuard.h>
+ #include <string>
+ #include "watchman/Hash.h"
+diff --git a/watchman/CookieSync.cpp b/watchman/CookieSync.cpp
+index 99dcc2692c5b..3e619db9ff5f 100644
+--- a/watchman/CookieSync.cpp
+++ b/watchman/CookieSync.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/CookieSync.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <exception>
+ #include <optional>
+diff --git a/watchman/Errors.h b/watchman/Errors.h
+index 072628fed1c2..aef90104b84c 100644
+--- a/watchman/Errors.h
+++ b/watchman/Errors.h
+@@ -7,7 +7,7 @@
+ 
+ #pragma once
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <cstdint>
+ #include <string>
+ #include <system_error>
+diff --git a/watchman/InMemoryView.cpp b/watchman/InMemoryView.cpp
+index 38ea8baa828f..ee2fc79c1a27 100644
+--- a/watchman/InMemoryView.cpp
+++ b/watchman/InMemoryView.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/InMemoryView.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/ScopeGuard.h>
+ #include <algorithm>
+ #include <chrono>
+diff --git a/watchman/LRUCache.h b/watchman/LRUCache.h
+index 89aa9beb8298..e6dcba1cc293 100644
+--- a/watchman/LRUCache.h
+++ b/watchman/LRUCache.h
+@@ -6,7 +6,7 @@
+  */
+ 
+ #pragma once
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/Synchronized.h>
+ #include <folly/futures/Future.h>
+ #include <chrono>
+diff --git a/watchman/Logging.cpp b/watchman/Logging.cpp
+index 7ad66d3723f5..11c56affa73a 100644
+--- a/watchman/Logging.cpp
+++ b/watchman/Logging.cpp
+@@ -15,7 +15,7 @@
+ 
+ #include "watchman/portability/Backtrace.h"
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <array>
+ #include <limits>
+ #include <optional>
+diff --git a/watchman/Options.cpp b/watchman/Options.cpp
+index 4cae973f92e9..0b8cf659c47a 100644
+--- a/watchman/Options.cpp
+++ b/watchman/Options.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/Options.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <string.h>
+ #include "watchman/CommandRegistry.h"
+ #include "watchman/LogConfig.h"
+diff --git a/watchman/PathUtils.cpp b/watchman/PathUtils.cpp
+index 9712e2e13ba4..fb03b5f6084e 100644
+--- a/watchman/PathUtils.cpp
+++ b/watchman/PathUtils.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "watchman/PathUtils.h"
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/Exception.h>
+ #include <folly/String.h>
+ #include <folly/portability/Fcntl.h>
+diff --git a/watchman/Poison.cpp b/watchman/Poison.cpp
+index 65741d5ea321..ee307d7ac2ae 100644
+--- a/watchman/Poison.cpp
+++ b/watchman/Poison.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include "watchman/Logging.h"
+ #include "watchman/WatchmanConfig.h"
+ 
+diff --git a/watchman/ProcessLock.cpp b/watchman/ProcessLock.cpp
+index 5cb3ef0ffbc8..960be71530db 100644
+--- a/watchman/ProcessLock.cpp
+++ b/watchman/ProcessLock.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "ProcessLock.h"
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ 
+ #include "watchman/Logging.h"
+diff --git a/watchman/SanityCheck.cpp b/watchman/SanityCheck.cpp
+index f0e430afd3ae..a4ee1eef57dc 100644
+--- a/watchman/SanityCheck.cpp
+++ b/watchman/SanityCheck.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ 
+ #include "watchman/Connect.h"
+diff --git a/watchman/SignalHandler.cpp b/watchman/SignalHandler.cpp
+index 8606b9c4dd85..c2bd56d50a72 100644
+--- a/watchman/SignalHandler.cpp
+++ b/watchman/SignalHandler.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include "watchman/Logging.h"
+ #include "watchman/Shutdown.h"
+ 
+diff --git a/watchman/UserDir.cpp b/watchman/UserDir.cpp
+index 50e1c481914b..1e374cf84ab4 100644
+--- a/watchman/UserDir.cpp
+++ b/watchman/UserDir.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "watchman/UserDir.h"
+ #include <eden/common/utils/StringConv.h>
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <folly/portability/Unistd.h>
+ #include "watchman/Logging.h"
+diff --git a/watchman/benchmarks/bser.cpp b/watchman/benchmarks/bser.cpp
+index 8c48e6b62a00..2133f3da134c 100644
+--- a/watchman/benchmarks/bser.cpp
+++ b/watchman/benchmarks/bser.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "watchman/bser.h"
+ #include <benchmark/benchmark.h>
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <random>
+ #include <vector>
+ 
+diff --git a/watchman/bser.h b/watchman/bser.h
+index 92a3a3328b84..49e719fb31a2 100644
+--- a/watchman/bser.h
+++ b/watchman/bser.h
+@@ -7,7 +7,7 @@
+ 
+ #pragma once
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include "watchman/thirdparty/jansson/jansson.h"
+ 
+ typedef struct bser_ctx {
+diff --git a/watchman/cmds/heapprof.cpp b/watchman/cmds/heapprof.cpp
+index d30c9dcfc4fb..fa0334f939c1 100644
+--- a/watchman/cmds/heapprof.cpp
+++ b/watchman/cmds/heapprof.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <folly/memory/Malloc.h>
+ #include "watchman/Client.h"
+diff --git a/watchman/cppclient/WatchmanClient.cpp b/watchman/cppclient/WatchmanClient.cpp
+index 5331149c42ac..d4fc4536a5db 100644
+--- a/watchman/cppclient/WatchmanClient.cpp
+++ b/watchman/cppclient/WatchmanClient.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "WatchmanClient.h"
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <glog/logging.h>
+ 
+ #include <utility>
+diff --git a/watchman/cppclient/WatchmanConnection.cpp b/watchman/cppclient/WatchmanConnection.cpp
+index c041baa41d53..fa6aba15d627 100644
+--- a/watchman/cppclient/WatchmanConnection.cpp
+++ b/watchman/cppclient/WatchmanConnection.cpp
+@@ -9,7 +9,7 @@
+ 
+ #include <cstdlib>
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ 
+ #include <folly/ExceptionWrapper.h>
+ #include <folly/SocketAddress.h>
+diff --git a/watchman/fs/FileSystem.cpp b/watchman/fs/FileSystem.cpp
+index 7cc159a6bd1c..85fc2c0f6fa1 100644
+--- a/watchman/fs/FileSystem.cpp
+++ b/watchman/fs/FileSystem.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/fs/FileSystem.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <system_error>
+ #include "watchman/fs/FSDetect.h"
+diff --git a/watchman/fs/ParallelWalk.cpp b/watchman/fs/ParallelWalk.cpp
+index 5a063dbca390..36ecea6826af 100644
+--- a/watchman/fs/ParallelWalk.cpp
+++ b/watchman/fs/ParallelWalk.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/fs/ParallelWalk.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/concurrency/UnboundedQueue.h>
+ #include <folly/executors/CPUThreadPoolExecutor.h>
+ #include <folly/system/HardwareConcurrency.h>
+diff --git a/watchman/fs/UnixDirHandle.cpp b/watchman/fs/UnixDirHandle.cpp
+index 6b644e5fb241..1198182112db 100644
+--- a/watchman/fs/UnixDirHandle.cpp
+++ b/watchman/fs/UnixDirHandle.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "watchman/fs/DirHandle.h"
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <system_error>
+ #include "watchman/Logging.h"
+diff --git a/watchman/main.cpp b/watchman/main.cpp
+index 9511b916b024..4382297b1b21 100644
+--- a/watchman/main.cpp
+++ b/watchman/main.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/Exception.h>
+ #include <folly/ScopeGuard.h>
+ #include <folly/Singleton.h>
+diff --git a/watchman/query/GlobTree.cpp b/watchman/query/GlobTree.cpp
+index c771db5225fd..568ee7cec5ef 100644
+--- a/watchman/query/GlobTree.cpp
+++ b/watchman/query/GlobTree.cpp
+@@ -7,7 +7,7 @@
+ 
+ #include "watchman/query/GlobTree.h"
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/Range.h>
+ 
+ namespace watchman {
+diff --git a/watchman/query/TermRegistry.cpp b/watchman/query/TermRegistry.cpp
+index 4efe2c5b46a0..f2cc1abd9eb4 100644
+--- a/watchman/query/TermRegistry.cpp
+++ b/watchman/query/TermRegistry.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/query/TermRegistry.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include "watchman/CommandRegistry.h"
+ #include "watchman/Errors.h"
+ #include "watchman/query/QueryExpr.h"
+diff --git a/watchman/query/intcompare.cpp b/watchman/query/intcompare.cpp
+index 4b13bb9d3c16..3f308456b718 100644
+--- a/watchman/query/intcompare.cpp
+++ b/watchman/query/intcompare.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/query/intcompare.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include "watchman/Errors.h"
+ #include "watchman/query/FileResult.h"
+ #include "watchman/query/QueryExpr.h"
+diff --git a/watchman/query/parse.cpp b/watchman/query/parse.cpp
+index 90fe43245364..772c1c85e7be 100644
+--- a/watchman/query/parse.cpp
+++ b/watchman/query/parse.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ 
+ #include "watchman/CommandRegistry.h"
+ #include "watchman/Errors.h"
+diff --git a/watchman/query/pcre.cpp b/watchman/query/pcre.cpp
+index 0b7abebf397f..34b68700aab3 100644
+--- a/watchman/query/pcre.cpp
+++ b/watchman/query/pcre.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <memory>
+ #include "watchman/Errors.h"
+ #include "watchman/fs/FileSystem.h"
+diff --git a/watchman/query/type.cpp b/watchman/query/type.cpp
+index cf87e9f7d601..6a303a684d3b 100644
+--- a/watchman/query/type.cpp
+++ b/watchman/query/type.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include "watchman/Errors.h"
+ #include "watchman/fs/FileInformation.h"
+ #include "watchman/query/FileResult.h"
+diff --git a/watchman/root/init.cpp b/watchman/root/init.cpp
+index d8d8f14660b0..979c2f13b9b6 100644
+--- a/watchman/root/init.cpp
+++ b/watchman/root/init.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ #include "watchman/Logging.h"
+ #include "watchman/QueryableView.h"
+diff --git a/watchman/root/resolve.cpp b/watchman/root/resolve.cpp
+index 667de1303b73..3fe5ddc69df3 100644
+--- a/watchman/root/resolve.cpp
+++ b/watchman/root/resolve.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <system_error>
+ #include "watchman/Errors.h"
+diff --git a/watchman/root/watchlist.cpp b/watchman/root/watchlist.cpp
+index ec36b16c64bb..67b3e41e6456 100644
+--- a/watchman/root/watchlist.cpp
+++ b/watchman/root/watchlist.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/root/watchlist.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/Synchronized.h>
+ #include <vector>
+ #include "watchman/QueryableView.h"
+diff --git a/watchman/scm/Git.cpp b/watchman/scm/Git.cpp
+index c92a5a42cd09..39b45c728bee 100644
+--- a/watchman/scm/Git.cpp
+++ b/watchman/scm/Git.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/scm/Git.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <folly/portability/SysTime.h>
+ #include "watchman/ChildProcess.h"
+diff --git a/watchman/scm/Mercurial.cpp b/watchman/scm/Mercurial.cpp
+index bdb586e73f9b..0952506c4160 100644
+--- a/watchman/scm/Mercurial.cpp
+++ b/watchman/scm/Mercurial.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "Mercurial.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ #include <folly/portability/SysTime.h>
+ #include <chrono>
+diff --git a/watchman/test/ArtTest.cpp b/watchman/test/ArtTest.cpp
+index a1f86034e9c4..05c4d249e6a0 100644
+--- a/watchman/test/ArtTest.cpp
+++ b/watchman/test/ArtTest.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/logging/xlog.h>
+ #include <folly/portability/GTest.h>
+ #include <stdio.h>
+diff --git a/watchman/test/BserTest.cpp b/watchman/test/BserTest.cpp
+index 119b4849b5dc..9fb5b2f66883 100644
+--- a/watchman/test/BserTest.cpp
+++ b/watchman/test/BserTest.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include "watchman/bser.h"
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/ScopeGuard.h>
+ #include <folly/logging/xlog.h>
+ #include <folly/portability/GTest.h>
+diff --git a/watchman/thirdparty/jansson/load.cpp b/watchman/thirdparty/jansson/load.cpp
+index 888588cab88d..c2f29b309b19 100644
+--- a/watchman/thirdparty/jansson/load.cpp
+++ b/watchman/thirdparty/jansson/load.cpp
+@@ -20,7 +20,7 @@
+ 
+ #include <system_error>
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/String.h>
+ 
+ 
+diff --git a/watchman/thirdparty/jansson/value.cpp b/watchman/thirdparty/jansson/value.cpp
+index 5c241421f650..1ac20171210b 100644
+--- a/watchman/thirdparty/jansson/value.cpp
+++ b/watchman/thirdparty/jansson/value.cpp
+@@ -13,7 +13,7 @@
+ 
+ #include <algorithm>
+ #include <cmath>
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <string>
+ #include <sstream>
+ 
+diff --git a/watchman/watcher/WatcherRegistry.cpp b/watchman/watcher/WatcherRegistry.cpp
+index bf7fcaf8e06a..2384842f50ce 100644
+--- a/watchman/watcher/WatcherRegistry.cpp
+++ b/watchman/watcher/WatcherRegistry.cpp
+@@ -5,7 +5,7 @@
+  * LICENSE file in the root directory of this source tree.
+  */
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ 
+ #include "watchman/watcher/WatcherRegistry.h"
+ 
+diff --git a/watchman/watcher/eden.cpp b/watchman/watcher/eden.cpp
+index 66bd8f98cf2f..836c88d9f240 100644
+--- a/watchman/watcher/eden.cpp
+++ b/watchman/watcher/eden.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include <cpptoml.h>
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/ScopeGuard.h>
+ #include <folly/String.h>
+ #include <folly/futures/Future.h>
+diff --git a/watchman/watchman_string.h b/watchman/watchman_string.h
+index 0a653f39eed5..5f03973a90d5 100644
+--- a/watchman/watchman_string.h
+++ b/watchman/watchman_string.h
+@@ -9,7 +9,7 @@
+ 
+ #include "watchman/watchman_system.h"
+ 
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <folly/FBString.h>
+ 
+ #include <stdint.h>
+diff --git a/watchman/winbuild/susres.cpp b/watchman/winbuild/susres.cpp
+index cc686912c10a..fd9306a24976 100644
+--- a/watchman/winbuild/susres.cpp
+++ b/watchman/winbuild/susres.cpp
+@@ -6,7 +6,7 @@
+  */
+ 
+ #include <errno.h>
+-#include <fmt/core.h>
+#include <fmt/format.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <windows.h>
--- a/pkgs/by-name/wa/watchman/glog-0.7.patch
+++ b/pkgs/by-name/wa/watchman/glog-0.7.patch
@@ -1,21 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index dd6eec3320..ee74ab0008 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -333,7 +333,7 @@
- find_package(Gflags REQUIRED)
- include_directories(SYSTEM ${GFLAGS_INCLUDE_DIR})
- 
-find_package(Glog REQUIRED)
-+find_package(Glog CONFIG REQUIRED)
- add_compile_definitions(GLOG_NO_ABBREVIATED_SEVERITIES)
- 
- # We indirectly depend on boost.  This logic needs to match
-@@ -479,7 +479,6 @@
- )
- target_include_directories(third_party_deps INTERFACE
-   ${FOLLY_INCLUDE_DIR}
-  ${GLOG_INCLUDE_DIR}
-   ${GFLAGS_INCLUDE_DIR}
-   ${Boost_INCLUDE_DIRS}
- )
--- a/pkgs/by-name/wa/watchman/package.nix
+++ b/pkgs/by-name/wa/watchman/package.nix
@@ -30,19 +30,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "watchman";
-  version = "2026.01.19.00";
+  version = "2026.07.27.00";

  src = fetchFromGitHub {
    owner = "facebook";
    repo = "watchman";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Eh7IHYEavgVd2p+r1PzQrAdqPD5FlYiTp4TCon55byE=";
+    hash = "sha256-cfx0hRsWDq6NTr8QvnLt/LsZ4Ja8d3lejUSgzsockp4=";
  };

-  patches = [
-    ./glog-0.7.patch
-  ];
-
  nativeBuildInputs = [
    cmake
    ninja
@@ -90,6 +86,13 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = true;

+  # fmt v12.2.0 changed the definition of its fmt/core.h header to no longer
+  # include fmt/format.h, so we must pull that one in instead. vendored from
+  # https://github.com/facebook/watchman/pull/1348 with a small modification to
+  # the surrounding context in watchman/watcher/eden.cpp to avoid the changes
+  # in 542ccb794647fe7bdeb59db8f54cd434db42bd30.
+  patches = [ ./fmt-12.2.0-format-header.patch ];
+
  postPatch = ''
    patchShebangs .

--- a/pkgs/by-name/wd/wdt/package.nix
+++ b/pkgs/by-name/wd/wdt/package.nix
@@ -51,11 +51,14 @@ stdenv.mkDerivation {
    };
  };

+  # We must increase the pinned C++ standard since headers from Folly
+  # v2026.07.27.00 require at least C++20
  postPatch = ''
    substituteInPlace CMakeLists.txt \
      --replace-fail "cmake_minimum_required(VERSION 3.2)" "cmake_minimum_required(VERSION 3.10)" \
      --replace-fail "find_package(Boost COMPONENTS system filesystem REQUIRED)" \
-        "find_package(Boost COMPONENTS filesystem REQUIRED)"
+        "find_package(Boost COMPONENTS filesystem REQUIRED)" \
+      --replace-fail "set(CMAKE_CXX_STANDARD 17)" "set(CMAKE_CXX_STANDARD 20)"
  '';

  meta = {
--- a/pkgs/by-name/wi/wireshark/package.nix
+++ b/pkgs/by-name/wi/wireshark/package.nix
@@ -60,7 +60,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.6.7";
+  version = "4.6.8";

  outputs = [
    "out"
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
    repo = "wireshark";
    owner = "wireshark";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+y2OyCXHnUYNKVbUNeqcATKcTPZz+ikOHPAEs1C2hww=";
+    hash = "sha256-qUC2k8LZQxmSu19jj1LHM+oQiF/ao+rV6wwRQhISuzk=";
  };

  patches = [
--- a/pkgs/by-name/ze/zennotes-desktop/package.nix
+++ b/pkgs/by-name/ze/zennotes-desktop/package.nix
@@ -13,14 +13,14 @@

 buildNpmPackage (finalAttrs: {
  pname = "zennotes-desktop";
-  version = "2.25.0";
-  npmDepsHash = "sha256-qW7G+zZCmFMR9pKdLelI+jfHyuU1/cTx1hTmzM9HRc4=";
+  version = "2.27.0";
+  npmDepsHash = "sha256-cSotsEeJp2/5t7me8ETs+1URHfUoM1boY5lsjUEi8WI=";

  src = fetchFromGitHub {
    owner = "ZenNotes";
    repo = "zennotes";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Sdyl5b8IeshmstXQqUX1YbWehCaUrKELU2FiTW4xm7g=";
+    hash = "sha256-ViZHSH9m02NzexYNbeOuZJ623Nz8dvd2jGqAIj+lKRI=";
  };

  npmWorkspace = "apps/desktop";
--- a/pkgs/development/php-packages/relay/default.nix
+++ b/pkgs/development/php-packages/relay/default.nix
@@ -16,36 +16,36 @@
 }:

 let
-  version = "0.30.0";
+  version = "0.40.0";
  hashes = {
    "aarch64-darwin" = {
      platform = "darwin-arm64";
      hash = {
-        "8.1" = "sha256-71TLrF9HvuocMLei89bGIibJIC1sD59RB9Vb6FBS49U=";
-        "8.2" = "sha256-WFrJ0+gun1qs77s3URFTha/tZA8gSeqlGLT26twnjko=";
-        "8.3" = "fiduW1NKScDDY3k3lvw98r8KqaD0jPR4En8dNvdglFA=";
-        "8.4" = "sha256-SQ9+/zD6n49e2/9nH6hotyIJ/xsQMX5A78hFTPK4/hg=";
-        "8.5" = "+n+fE5soEbruH+L35B+bapU/Z7rSjjOD/4BgRmr3MVc=";
+        "8.1" = "sha256-pwqus2P17DirEGqwbe5CqlIZ+InPrIHbUUbcgLli8rc=";
+        "8.2" = "sha256-IeoOYVnp0sWD+Ww/d8DwDemqXv/6neEWE3g2txHEuEg=";
+        "8.3" = "OQAErtNtCIpNmz2YbfhLJ9ueH7mhZa6j1YtcuH00Ob8=";
+        "8.4" = "sha256-WP283JJfXQTnfbnyLfs0j8IIcdDGflCFtV0WxBV/JLU=";
+        "8.5" = "0zH1RD2Uq5uG4TnUsYzsYgUdUshsKNU0kzbdNG77sd8=";
      };
    };
    "aarch64-linux" = {
      platform = "debian-aarch64+libssl3";
      hash = {
-        "8.1" = "sha256-hetG8fEmMJccYWMQwPb3hml5thNeY2L6Y4gCDQmbDlo=";
-        "8.2" = "sha256-HufvcT4QSkuoxDcaCWD+hmG1fORyTUBh1Vsfnv7krng=";
-        "8.3" = "sha256-LV4coud7YNqB+s1sHoKXNVLAUrLjDMDpulS9fGVXDsg=";
-        "8.4" = "em1nZgGD1fAtvMxVeJBU4RZaA71/qMVLi0KCRAbilpM=";
-        "8.5" = "d0f3PzvZZn1KmXy1Gm0gm5f3f58kt+/LTc3yWZqto2I=";
+        "8.1" = "sha256-r6rV05ZLsi2SvFqONtYk2IIrkdbTZqsClruTMpcOOas=";
+        "8.2" = "sha256-SsHqRS3Bq4N10c06zEoVZXTv5+bfkcDgCRdntcoyD/k=";
+        "8.3" = "sha256-yQunez9xOyhGYqFKHKWtdK8BiGPz3JIyDnsfqGthIYs=";
+        "8.4" = "bC/67qQxe/Zy027r8c7tWr6S6Seeh+lbjYEl+cE7HNw=";
+        "8.5" = "3KWlZxbO8u5hpN/PsKzgCbNUhWHb56SqgNwTL8iHtSs=";
      };
    };
    "x86_64-linux" = {
      platform = "debian-x86-64+libssl3";
      hash = {
-        "8.1" = "sha256-La/TQDnQ0hqNhPMtLlwfw5cKtXCpjxBMTd6yvZM2O2M=";
-        "8.2" = "sha256-+FavbnliF071lWFU55rhFNq6X2wpW9mHSstwQQTbnwQ=";
-        "8.3" = "sha256-G6nfKMObVMtY45J7DaKg0LdHwV+lfCUa1Pkfp66+apY=";
-        "8.4" = "x9YXGxtqN3EL1lWCqAkIKKrO0b40BFalO6GExhF3p4c=";
-        "8.5" = "8hU5Ft9i3L6pf2XY7rRLmSbQmZ3z1wjI+7sjiq/GHUU=";
+        "8.1" = "sha256-KgyAPCLLtmeMa5X3Akuf0nR51aSQS6+RpNYO3U4Zdp0=";
+        "8.2" = "sha256-zSl141iQ3Vfb5JmeRacFZhBcfEKQuW9rld9O2c8HRvU=";
+        "8.3" = "sha256-kdd4k6xdbbNuIk/DBTufxqH8j+4Z2xgzG4Z/c7PfKFs=";
+        "8.4" = "jteJPpdxFSBljS81Jn9x6cLLn3iLVpqeGb3qecWFw4c=";
+        "8.5" = "uFZj/cDsd6LhIeaj3IdB3Kl9btnkS/eEVfLdYhh4Mus=";
      };
    };
  };
--- a/pkgs/development/python-modules/stringzilla/default.nix
+++ b/pkgs/development/python-modules/stringzilla/default.nix
@@ -10,14 +10,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "stringzilla";
-  version = "5.0.7";
+  version = "5.1.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ashvardanian";
    repo = "stringzilla";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qVWHbtr3lo2LGX376Ctuo6hzRRXTpEug7a77UZCVd70=";
+    hash = "sha256-RENsISsEfDJaoQK9v9i6vM3OId7FREw5hixpEUETfEw=";
  };

  build-system = [
--- a/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
  owner = "skye-harris";
  domain = "local_openai";
-  version = "1.9.0";
+  version = "1.10.0";

  src = fetchFromGitHub {
    inherit (finalAttrs) owner;
    repo = "hass_local_openai_llm";
    tag = finalAttrs.version;
-    hash = "sha256-z5O+G5OtsC82rRjf3hAbfD5MON62AajBolCKfbo31X0=";
+    hash = "sha256-rDvZtNwfw3GI0qvKRLT8BsQ60au8S0hPw36CdAlBgIw=";
  };

  dependencies = [
--- a/pkgs/tools/security/ghidra/extensions.nix
+++ b/pkgs/tools/security/ghidra/extensions.nix
@@ -13,6 +13,8 @@ lib.makeScope newScope (self: {

  findcrypt = self.callPackage ./extensions/findcrypt { };

+  ghidralib = self.callPackage ./extensions/ghidralib { };
+
  ghidra-delinker-extension = self.callPackage ./extensions/ghidra-delinker-extension {
    inherit ghidra;
  };
--- a/pkgs/tools/security/ghidra/extensions/ghidralib/default.nix
+++ b/pkgs/tools/security/ghidra/extensions/ghidralib/default.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGhidraScripts,
+}:
+buildGhidraScripts {
+  pname = "GhidraLib";
+  version = "0.2.0-unstable-2025-10-31";
+
+  src = fetchFromGitHub {
+    owner = "msm-code";
+    repo = "ghidralib";
+    rev = "f3e33e444b4a8682c240c87f8754542e2e338731";
+    hash = "sha256-Dz7CWHkszHq5HT/S9cBGOfkoamnf9T1l2IbaAZXEGf0=";
+  };
+
+  meta = {
+    description = "A Pythonic Ghidra standard library";
+    homepage = "https://github.com/msm-code/ghidralib";
+    maintainers = with lib.maintainers; [
+      BonusPlay
+      msm
+    ];
+    license = lib.licenses.asl20;
+  };
+}
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1167,6 +1167,7 @@ mapAliases {
  jellyfin-media-player = jellyfin-desktop; # Added 2025-12-14
  jellyseerr = warnAlias "'jellyseerr' has been renamed to 'seerr'" seerr; # Added 2026-03-17
  jesec-rtorrent = throw "'jesec-rtorrent' has been removed due to lack of maintenance upstream."; # Added 2025-11-20
+  jetty_11 = throw "'jetty_11' has been removed as it has reached end of life. Please migrate to 'jetty_12'."; # Added 2026-08-04
  jextract-21 = throw "'jextract-21' has been removed due to lack of maintenance upstream. Please use 'jextract'"; # Added 2026-05-13
  jhentai = throw "'jhentai' has been removed, as it is unmaintained"; # Added 2026-01-25
  jikespg = throw "'jikespg' has been removed due to lack of maintenance upstream."; # Added 2025-06-10
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7320,13 +7320,10 @@ with pkgs;

  inspircdMinimal = inspircd.override { extraModules = [ ]; };

-  inherit (callPackages ../servers/http/jetty { })
-    jetty_11
+  inherit (callPackages ../by-name/je/jetty { })
    jetty_12
    ;

-  jetty = jetty_12;
-
  inherit
    ({
      kanidm_1_8 = callPackage ../servers/kanidm/1_8.nix {