Merge master into staging-nixos

2026-08-26 02:05:02 +00:00 · 2026-08-22 00:12:36 +00:00
parent 1a202e21c4 7046523d38
commit 2052d97833
192 changed files with 3853 additions and 1938 deletions
--- a/.editorconfig
+++ b/.editorconfig
@@ -79,7 +79,7 @@ indent_size = unset
 trim_trailing_whitespace = true

 # binaries
-[*.nib]
+[*.{nib,torrent}]
 end_of_line = unset
 insert_final_newline = unset
 trim_trailing_whitespace = unset
--- a/.gitattributes
+++ b/.gitattributes
@@ -62,3 +62,6 @@ ci/OWNERS linguist-language=CODEOWNERS
 # patching CRLF line endings from an upstream source package.
 *.diff !text !eol
 *.patch !text !eol
+
+# Torrent files are binary files and should not be re-encoded.
+*.torrent !text !eol
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -59,7 +59,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
        with:
          # Sandbox is disabled on MacOS by default.
          extra_nix_config: sandbox = true
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -178,7 +178,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -139,7 +139,7 @@ jobs:
            core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)

      - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - name: Load supported versions
        id: versions
@@ -187,7 +187,7 @@ jobs:
          target-as-trusted-at: ${{ inputs.targetSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
@@ -277,7 +277,7 @@ jobs:
          merge-multiple: true

      - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - name: Combine all output paths and eval stats
        run: |
@@ -486,7 +486,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - name: Ensure flake outputs on all systems still evaluate
        run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -35,7 +35,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
      # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -1648,6 +1648,8 @@ lib.mapAttrs mkLicense (
    vol-sl = {
      fullName = "Volatility Software License, Version 1.0";
      url = "https://www.volatilityfoundation.org/license/vsl-v1.0";
+      free = false;
+      redistributable = true;
    };

    vsl10 = {
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -161,14 +161,12 @@ let
            (with final; isWindows && isAarch64);

        # Use the split GCC package set (`gccNGPackages`) instead of the
-        # monolithic `gcc`. No platform selects it yet; it is opt-in, set
-        # explicitly on a platform spec, so that the split set can be exercised
-        # before anything depends on it.
+        # monolithic `gcc`.
        #
-        # I (@Ericson2314) plan on making obscure low-tier platforms (e.g.
-        # NetBSD) use it soon, so we can dogfood GCC NG and thereby iron out its
-        # bugs.
-        useGccNG = false;
+        # I (@Ericson2314) plan on making more obscure low-tier
+        # platforms (e.g. NetBSD) use it soon, so we can dogfood GCC NG
+        # and thereby iron out its bugs.
+        useGccNG = final.isCygwin;

        libc =
          if final.isDarwin then
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4885,6 +4885,12 @@
    githubId = 543423;
    name = "Alex Wied";
  };
+  ceridwen15 = {
+    email = "me@cdwn.gay";
+    github = "NonsensicalNickname";
+    githubId = 118519066;
+    name = "Ceridwen Weaving";
+  };
  cfouche = {
    email = "chaddai.fouche@gmail.com";
    github = "Chaddai";
@@ -10430,6 +10436,12 @@
    github = "gkleen";
    githubId = 20089782;
  };
+  gl1tchxd = {
+    name = "Felix Buchsteiner";
+    github = "gl1tchxd-git";
+    githubId = 92686452;
+    email = "contact@gl1tchxd.at";
+  };
  gleber = {
    email = "gleber.p@gmail.com";
    github = "gleber";
@@ -19138,6 +19150,12 @@
    githubId = 104795;
    name = "Marek Mahut";
  };
+  mmclinton = {
+    email = "nixpkg.concur071@simplelogin.com";
+    github = "mmclinton";
+    githubId = 96266047;
+    name = "Miller Clinton";
+  };
  mmesch = {
    github = "MMesch";
    githubId = 2597803;
@@ -19460,6 +19478,12 @@
    githubId = 15896005;
    name = "Vladyslav Burzakovskyy";
  };
+  mroboff = {
+    email = "mark.roboff@bluecircuit.ai";
+    github = "mroboff";
+    githubId = 81203001;
+    name = "Mark Roboff";
+  };
  mrsmoer = {
    email = "mrsmoer@protonmail.com";
    github = "MrSmoer";
@@ -27399,6 +27423,12 @@
    githubId = 1699155;
    name = "Steve Elliott";
  };
+  stefanboca = {
+    email = "stefan.r.boca@gmail.com";
+    github = "stefanboca";
+    githubId = 45266795;
+    name = "Stefan Boca";
+  };
  stefanfehrenbach = {
    email = "stefan.fehrenbach@gmail.com";
    github = "fehrenbach";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -84,6 +84,8 @@

 - [Krill](https://nlnetlabs.nl/projects/krill/about), RPKI CA and Publication Server written in Rust. Available as [services.krill](#opt-services.krill.enable).

+- [vellum](https://github.com/greyxp1/vellum) is a live screen annotation overlay for Wayland. Available as [programs.vellum](#opt-programs.vellum.enable).
+
 - [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).

 - [OO7](https://github.com/linux-credentials/oo7) is a desktop-agnostic Secret Service provider. Available as [services.oo7](#opt-services.oo7.enable)
@@ -178,6 +180,9 @@

 - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.

+- `security.unprivilegedUsernsClone` has been removed. The option controls a sysctl only provided by the removed -hardened kernels. The removal should only affect users running custom hardened kernels.
+  Disabling user-namespace is possible by setting `boot.kernel.sysctl."user.max_user_namespaces"` to zero, but not generally advised, as browsers, like firefox and chrome, and many other user tools use namespaces for sandboxing.
+
 - The `services.syncthing` module now updates the Syncthing REST API using partial updates (`PATCH`) instead of full replacements (`PUT`) for general settings. Updating these settings was broken and prone to errors after updates, see [#428808](https://github.com/NixOS/nixpkgs/issues/428808) and [#528889](https://github.com/NixOS/nixpkgs/issues/528889). As a result, settings modified manually through the Syncthing Web UI that are not explicitly defined in your Nix configuration will now persist across rebuilds.

 - `services.plantuml-server.packages.jetty` now supports `jetty_12`, it no longer supports `jetty_11`.
@@ -237,6 +242,8 @@

 - `services.nginx` gained a [`lua`](#opt-services.nginx.lua.enable) option to enable Lua scripting via OpenResty's lua-nginx-module on a stock nginx, configuring `lua_package_path`/`lua_package_cpath` from the packages listed in [`services.nginx.lua.extraPackages`](#opt-services.nginx.lua.extraPackages). Use this to add Lua to a regular nginx; for the full OpenResty platform (libraries that rely on its bundled lualib, such as `lua-resty-openidc`), set `services.nginx.package` to `pkgs.openresty` instead — the option configures the Lua search path for it too.

+- `services.nginx.virtualHosts.<name>.locations.<name>` gained a new `useGrpcErrorPages` option. If enabled, it sets up error pages that are valid gRPC messages. This is useful if you proxy gRPC and want to emit errors from nginx, for example when adding authentication on top.
+
 - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.

 - `boot.supportedFilesystems.ntfs` installs `ntfsprogs-plus` instead of `ntfs3g` on kernel version 7.1 and later, unless `boot.supportedFilesystems.ntfs-3g` is explicitly enabled.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -352,6 +352,7 @@
  ./programs/udevil.nix
  ./programs/upki.nix
  ./programs/usbtop.nix
+  ./programs/vellum.nix
  ./programs/vim.nix
  ./programs/virt-manager.nix
  ./programs/vivid.nix
--- a/nixos/modules/programs/benchexec.nix
+++ b/nixos/modules/programs/benchexec.nix
@@ -86,9 +86,6 @@ in
    programs = {
      cpu-energy-meter.enable = lib.mkDefault true;
    };
-
-    # See <https://github.com/sosy-lab/benchexec/blob/3.18/doc/INSTALL.md#kernel-requirements>.
-    security.unprivilegedUsernsClone = true;
  };

  meta.maintainers = with lib.maintainers; [ lorenzleutgeb ];
--- a/nixos/modules/programs/vellum.nix
+++ b/nixos/modules/programs/vellum.nix
@@ -0,0 +1,81 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.vellum;
+
+  inherit (lib)
+    getExe
+    literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    ;
+  inherit (lib.types) separatedString;
+
+  toml = pkgs.formats.toml { };
+in
+{
+  options.programs.vellum = {
+    enable = mkEnableOption "vellum, a live screen annotation overlay for Wayland";
+
+    package = mkPackageOption pkgs "vellum" { };
+
+    settings = mkOption {
+      inherit (toml) type;
+      default = { };
+      description = ''
+        Configuration options for vellum.
+        See available options at <https://github.com/greyxp1/vellum/blob/master/docs/configuration.md>.
+      '';
+      example = literalExpression ''
+        {
+          default_tool = "arrow";
+          remember_last_tool = false;
+          feedback_duration_ms = 250;
+        }
+      '';
+    };
+
+    extraOptions = mkOption {
+      type = separatedString " ";
+      default = "";
+      description = ''
+        Extra command-line options to pass to
+        the {command}`vellum` daemon.
+      '';
+      example = "--force-backend vulkan";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment = {
+      systemPackages = [ cfg.package ];
+
+      etc."xdg/vellum/config.toml" = mkIf (cfg.settings != { }) {
+        source = toml.generate "vellum-config.toml" cfg.settings;
+      };
+    };
+
+    systemd.user.services.vellum = {
+      description = "Vellum screen annotation overlay";
+      after = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      wantedBy = [ "graphical-session.target" ];
+      restartTriggers = [ config.environment.etc."xdg/vellum/config.toml".source ];
+      serviceConfig = {
+        ExecStart = "${getExe cfg.package} ${cfg.extraOptions}";
+        Restart = "on-failure";
+      };
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ poz ];
+  };
+}
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@@ -772,7 +772,7 @@ let
          description = ''
            Key type to use for private keys.
            For an up to date list of supported values check the --key-type option
-            at <https://go-acme.github.io/lego/usage/cli/options/>.
+            at <https://go-acme.github.io/lego/references/ref-flags/index.html#options>.
          '';
        };

@@ -833,7 +833,7 @@ let
          '';
          example = lib.literalExpression ''
            {
-              "RFC2136_TSIG_SECRET_FILE" = "/run/secrets/tsig-secret-example.org";
+              "DNSUPDATE_TSIG_SECRET_FILE" = "/run/secrets/tsig-secret-example.org";
            }
          '';
        };
@@ -852,8 +852,9 @@ let
          inherit (defaultAndText "ocspMustStaple" false) default defaultText;
          description = ''
            Turns on the OCSP Must-Staple TLS extension.
-            Make sure you know what you're doing! See:
-
+            Make sure you know what you're doing!
+            OCSP Must-Staple can be considered a legacy feature, that is no longer superted by Let's Encrypt. See:
+            - <https://letsencrypt.org/2024/12/05/ending-ocsp>
            - <https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-must-staple/>
            - <https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html>
          '';
--- a/nixos/modules/security/misc.nix
+++ b/nixos/modules/security/misc.nix
@@ -9,6 +9,16 @@
      [ "security" "virtualization" "flushL1DataCache" ]
      [ "security" "virtualisation" "flushL1DataCache" ]
    )
+    (lib.mkRemovedOptionModule
+      [
+        "security"
+        "unprivilegedUsernsClone"
+      ]
+      ''
+        to disable or enable unprivileged user namespaces please use
+        the sysctl "user.max_user_namespaces".
+      ''
+    )
  ];

  options = {
@@ -31,16 +41,6 @@
      '';
    };

-    security.unprivilegedUsernsClone = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        When disabled, unprivileged users will not be able to create new namespaces.
-        By default unprivileged user namespaces are disabled.
-        This option only works in a hardened profile.
-      '';
-    };
-
    security.protectKernelImage = lib.mkOption {
      type = lib.types.bool;
      default = false;
@@ -121,10 +121,6 @@
      ];
    })

-    (lib.mkIf config.security.unprivilegedUsernsClone {
-      boot.kernel.sysctl."kernel.unprivileged_userns_clone" = lib.mkDefault true;
-    })
-
    (lib.mkIf config.security.protectKernelImage {
      # Disable hibernation (allows replacing the running kernel)
      boot.kernelParams = [ "nohibernate" ];
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -2090,7 +2090,6 @@ in
      serviceConfig = {
        ExecStartPre = [
          "${lib.getExe' pkgs.coreutils "ln"} -fs ${cfg.package}/share/grafana/conf ${cfg.dataDir}"
-          "${lib.getExe' pkgs.coreutils "ln"} -fs ${cfg.package}/share/grafana/tools ${cfg.dataDir}"
        ];
        ExecStart = "${lib.getExe cfg.package} server -homepath ${cfg.dataDir} -config ${configFile}";

--- a/nixos/modules/services/security/crowdsec.nix
+++ b/nixos/modules/services/security/crowdsec.nix
@@ -825,6 +825,7 @@ in
            RestrictSUIDSGID = true;
            ExecReload = [
              " " # This is needed to clear the ExecReload definitions from upstream
+              "${lib.getExe' pkgs.util-linux "kill"} -HUP $MAINPID"
            ];
            ExecStart = [
              " " # This is needed to clear the ExecStart definitions from upstream
--- a/nixos/modules/services/video/frigate.nix
+++ b/nixos/modules/services/video/frigate.nix
@@ -787,6 +787,7 @@ in

        # Caches
        PrivateTmp = true;
+        TemporaryFileSystem = "/dev/shm:mode=1777,nosuid,nodev";
        CacheDirectory = [
          "frigate"
          # https://github.com/blakeblackshear/frigate/discussions/18129
--- a/nixos/modules/services/web-apps/ente.nix
+++ b/nixos/modules/services/web-apps/ente.nix
@@ -342,10 +342,17 @@ in
              '';
            };
          };
+          virtualHosts.${domainFor "albums"} = {
+            forceSSL = mkDefault true;
+            locations."/" = {
+              root = webPackage "albums";
+              tryFiles = "$uri $uri.html /index.html";
+              extraConfig = ''
+                add_header Access-Control-Allow-Origin 'https://${cfgWeb.domains.api}';
+              '';
+            };
+          };
          virtualHosts.${domainFor "photos"} = {
-            serverAliases = [
-              (domainFor "albums") # the albums app is shared with the photos frontend
-            ];
            forceSSL = mkDefault true;
            locations."/" = {
              root = webPackage "photos";
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -398,6 +398,11 @@ let

        hostListen = if vhost.forceSSL then filter (x: x.ssl) defaultListen else defaultListen;

+        # If there's any location setting `useGrpcErrorPages`, we need to add the location blocks.
+        locationsWantGrpcErrorPages = builtins.any (location: location.useGrpcErrorPages) (
+          attrValues vhost.locations
+        );
+
        listenString =
          {
            addr,
@@ -515,6 +520,10 @@ let

          ${mkBasicAuth vhostName vhost}

+          ${optionalString locationsWantGrpcErrorPages ''
+            include ${./grpc-locations.conf};
+          ''}
+
          ${optionalString (vhost.root != null) "root ${vhost.root};"}

          ${optionalString (vhost.globalRedirect != null) ''
@@ -559,6 +568,9 @@ let
              optionalAttrs (config.fastcgiParams != { }) (defaultFastcgiParams // config.fastcgiParams)
            )
          )}
+          ${optionalString config.useGrpcErrorPages ''
+            include ${./grpc-error-pages.conf};
+          ''}
          ${optionalString (config.index != null) "index ${config.index};"}
          ${optionalString (config.tryFiles != null) "try_files ${config.tryFiles};"}
          ${optionalString (config.root != null) "root ${config.root};"}
--- a/nixos/modules/services/web-servers/nginx/grpc-error-pages.conf
+++ b/nixos/modules/services/web-servers/nginx/grpc-error-pages.conf
@@ -0,0 +1,22 @@
+error_page 400 = @grpc_internal;
+error_page 401 = @grpc_unauthenticated;
+error_page 403 = @grpc_permission_denied;
+error_page 404 = @grpc_unimplemented;
+error_page 429 = @grpc_unavailable;
+error_page 502 = @grpc_unavailable;
+error_page 503 = @grpc_unavailable;
+error_page 504 = @grpc_unavailable;
+# NGINX-to-gRPC status code mappings
+# Ref: https://github.com/grpc/grpc/blob/master/doc/statuscodes.md
+#
+error_page 405 = @grpc_internal; # Method not allowed
+error_page 408 = @grpc_deadline_exceeded; # Request timeout
+error_page 413 = @grpc_resource_exhausted; # Payload too large
+error_page 414 = @grpc_resource_exhausted; # Request URI too large
+error_page 415 = @grpc_internal; # Unsupported media type;
+error_page 426 = @grpc_internal; # HTTP request was sent to HTTPS port
+error_page 495 = @grpc_unauthenticated; # Client certificate authentication error
+error_page 496 = @grpc_unauthenticated; # Client certificate not presented
+error_page 497 = @grpc_internal; # HTTP request was sent to mutual TLS port
+error_page 500 = @grpc_internal; # Server error
+error_page 501 = @grpc_internal; # Not implemented
--- a/nixos/modules/services/web-servers/nginx/grpc-locations.conf
+++ b/nixos/modules/services/web-servers/nginx/grpc-locations.conf
@@ -0,0 +1,46 @@
+# gRPC error responses
+# Ref: https://github.com/grpc/grpc-go/blob/master/codes/codes.go
+# Ref: https://grpc.io/docs/guides/wire
+#
+location @grpc_deadline_exceeded {
+  add_header grpc-status 4;
+  add_header grpc-message 'deadline exceeded';
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_permission_denied {
+  add_header grpc-status 7;
+  add_header grpc-message 'permission denied';
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_resource_exhausted {
+  add_header grpc-status 8;
+  add_header grpc-message 'resource exhausted';
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_unimplemented {
+  add_header grpc-status 12;
+  add_header grpc-message unimplemented;
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_internal {
+  add_header grpc-status 13;
+  add_header grpc-message 'internal error';
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_unavailable {
+  add_header grpc-status 14;
+  add_header grpc-message unavailable;
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_unauthenticated {
+  add_header grpc-status 16;
+  add_header grpc-message unauthenticated;
+  default_type application/grpc;
+  return 200;
+}
--- a/nixos/modules/services/web-servers/nginx/location-options.nix
+++ b/nixos/modules/services/web-servers/nginx/location-options.nix
@@ -158,5 +158,17 @@ with lib;
        Enable recommended uwsgi settings.
      '';
    };
+
+    useGrpcErrorPages = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to configure error codes to be emitted as gRPC-compatible errors.
+
+        Should be set when proxying gRPC, and returning responses from nginx (like when adding authentication).
+
+        This defines a few `@grpc-*` locations inside the containing vhost.
+      '';
+    };
  };
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1168,6 +1168,7 @@ in
  nginx-etag = runTest ./nginx-etag.nix;
  nginx-etag-compression = runTest ./nginx-etag-compression.nix;
  nginx-globalredirect = runTest ./nginx-globalredirect.nix;
+  nginx-grpc-error-pages = runTest ./nginx-grpc-error-pages.nix;
  nginx-http3 = import ./nginx-http3.nix { inherit pkgs runTest; };
  nginx-lua = runTest ./nginx-lua.nix;
  nginx-mime = runTest ./nginx-mime.nix;
--- a/nixos/tests/matrix/mjolnir.nix
+++ b/nixos/tests/matrix/mjolnir.nix
@@ -118,7 +118,7 @@ in
          (pkgs.writers.writePython3Bin "create_management_room_and_invite_mjolnir"
            {
              libraries = with pkgs.python3Packages; [
-                (matrix-nio.override { withOlm = true; })
+                (matrix-nio.override { withVodozemac = true; })
              ];
            }
            ''
--- a/nixos/tests/nginx-grpc-error-pages.nix
+++ b/nixos/tests/nginx-grpc-error-pages.nix
@@ -0,0 +1,40 @@
+{ ... }:
+{
+  name = "nginx-grpc-error-pages";
+
+  containers = {
+    webserver =
+      { pkgs, ... }:
+      {
+        services.nginx = {
+          enable = true;
+
+          virtualHosts.test = {
+            locations = {
+              "=/".return = "200 blub";
+              "/grpc.reflection.v1.ServerReflection" = {
+                useGrpcErrorPages = true;
+                extraConfig = ''
+                  grpc_pass unix:/run/some-service.sock;
+                  # Let's pretend there was a more sophisticated check here
+                  return 401;
+                '';
+              };
+            };
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_port(80)
+
+    # regular HTTP requests should behave normally
+    webserver.succeed("curl --fail http://localhost")
+    t.assertEqual(webserver.succeed("curl -s -o /dev/null -w '%{http_code}' http://localhost/404").strip(), "404")
+
+    # a gRPC 401 becomes HTTP code 2xx, with grpc-message and grpc-status headers set.
+    t.assertEqual(webserver.succeed("curl -s -o /dev/null --fail -w '%header{grpc-status}_%header{grpc-message}' http://localhost/grpc.reflection.v1.ServerReflection").strip(), "16_unauthenticated")
+  '';
+}
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -475,12 +475,12 @@ final: prev: {

  SchemaStore-nvim = buildVimPlugin {
    pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-08-14";
+    version = "0-unstable-2026-08-17";
    src = fetchFromGitHub {
      owner = "b0o";
      repo = "SchemaStore.nvim";
-      rev = "7e3f6dd6ef6da93f74974521c81d8d5bff0443c5";
-      hash = "sha256-nefchLDV6Q3JpngwJ+pOOQFQikVEzM5btWqvZpyI+o8=";
+      rev = "cef8d093b63c9be7e8b49f7dc341e8447fc4c300";
+      hash = "sha256-yNlPcjlfjt+RxK/XVuVLbuKgZF++X/mKSfuV03dXT8c=";
    };
    meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
    meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -897,12 +897,12 @@ final: prev: {

  ale = buildVimPlugin {
    pname = "ale";
-    version = "4.0.0-unstable-2026-08-09";
+    version = "4.0.0-unstable-2026-08-19";
    src = fetchFromGitHub {
      owner = "dense-analysis";
      repo = "ale";
-      rev = "199a95d386cb856c27e5b90d4e3ea8bd45a58c23";
-      hash = "sha256-wguoPT7L4sunUsT1llAUEMBJxNNMUY1V6E8otBnn9WM=";
+      rev = "1c6e71732f3811197ec21cd6d3130791955ca80a";
+      hash = "sha256-Zqd7QD/rGV2GZNjyK05Zj2nVBYdHvAXo7ooE4yA/FnI=";
    };
    meta.homepage = "https://github.com/dense-analysis/ale/";
    meta.license = getLicenseFromSpdxId "BSD-2-Clause";
@@ -2129,12 +2129,12 @@ final: prev: {

  bluloco-nvim = buildVimPlugin {
    pname = "bluloco.nvim";
-    version = "1.4.0-unstable-2026-04-21";
+    version = "1.4.0-unstable-2026-08-19";
    src = fetchFromGitHub {
      owner = "uloco";
      repo = "bluloco.nvim";
-      rev = "4daabf6a9e6b9ecdcb19e7c78e888be0bacd866c";
-      hash = "sha256-qmVneHlI7XKTyXrSJu+lWaX6YmGQero7nTKrWR/i99c=";
+      rev = "424f5ea3c5f92423cbb8e32941e86919005fb4ab";
+      hash = "sha256-HHqLxD+aKIaCh5fFRfT4SlCrO48jhe1YVnXwQfoizqs=";
    };
    meta.homepage = "https://github.com/uloco/bluloco.nvim/";
    meta.license = getLicenseFromSpdxId "LGPL-3.0-only";
@@ -3513,12 +3513,12 @@ final: prev: {

  coc-nvim = buildVimPlugin {
    pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-08-17";
+    version = "0.0.82-unstable-2026-08-19";
    src = fetchFromGitHub {
      owner = "neoclide";
      repo = "coc.nvim";
-      rev = "dd12c1a0eb1e4d53f1c7577dc4ab13295aaa9f8f";
-      hash = "sha256-h9kqlUC/EeiLDuCuwmSM1mOXdqm1AR4CiOfARkSjc2o=";
+      rev = "d7cf12d0dc873fcd276e89dff4e7c4949e3e5793";
+      hash = "sha256-X3baNWAjKwHusfDwRHbQSs7PUspVDVnA/DC0SsNr6KQ=";
    };
    meta.homepage = "https://github.com/neoclide/coc.nvim/";
    meta.license = unfree;
@@ -5308,12 +5308,12 @@ final: prev: {

  diffview-plus-nvim = buildVimPlugin {
    pname = "diffview-plus.nvim";
-    version = "0.36";
+    version = "0.37";
    src = fetchFromGitHub {
      owner = "dlyongemallo";
      repo = "diffview-plus.nvim";
-      tag = "v0.36";
-      hash = "sha256-RBH06hWEW5fP80Sj48UhVT9KexLtm3xWZtdVH+rGWhY=";
+      tag = "v0.37";
+      hash = "sha256-5ZYl7D/V5tFhlojwj6EvHXnQVvfdiLxzpAlNUejLJzI=";
    };
    meta.homepage = "https://github.com/dlyongemallo/diffview-plus.nvim/";
    meta.license = unfree;
@@ -5490,12 +5490,12 @@ final: prev: {

  easy-dotnet-nvim = buildVimPlugin {
    pname = "easy-dotnet.nvim";
-    version = "0-unstable-2026-08-14";
+    version = "0-unstable-2026-08-18";
    src = fetchFromGitHub {
      owner = "GustavEikaas";
      repo = "easy-dotnet.nvim";
-      rev = "0ebe09313dca2a6d4c354ab7df8e1687c2021d13";
-      hash = "sha256-Hu4QKsAR2XnJm41GQ7fjDw2I7J9PEKnRk93s6zmMFro=";
+      rev = "0a8cfb96e40b985921e6613f31f75811e31b8edf";
+      hash = "sha256-8KjAdKYAXQHrJ2ISBv0Eu4hl696fiz09c8yCtNPr2OY=";
    };
    meta.homepage = "https://github.com/GustavEikaas/easy-dotnet.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -6599,12 +6599,12 @@ final: prev: {

  ghcid = buildVimPlugin {
    pname = "ghcid";
-    version = "0.8.9-unstable-2026-08-16";
+    version = "1.0.0";
    src = fetchFromGitHub {
      owner = "ndmitchell";
      repo = "ghcid";
-      rev = "94f309731a161fa31f3d1e61d14faf025b7b4934";
-      hash = "sha256-vw6SqutcgYEbRoMId/qF32Qw/7FRw0gZimigFjA6qAI=";
+      tag = "v1.0.0";
+      hash = "sha256-oFLq0rBd7O52iT55QAOH7w3O6BKx0K3J74sELHcjxCk=";
    };
    meta.homepage = "https://github.com/ndmitchell/ghcid/";
    meta.license = unfree;
@@ -8769,11 +8769,11 @@ final: prev: {

  leap-nvim = buildVimPlugin {
    pname = "leap.nvim";
-    version = "0-unstable-2026-08-15";
+    version = "0-unstable-2026-08-17";
    src = fetchgit {
      url = "https://codeberg.org/andyg/leap.nvim/";
-      rev = "3e6b4be90b227479aab2c124de0664878cf47ec9";
-      hash = "sha256-sfj4rk0eb1c+XrCA1hvhAnLzuGj46uI/Nrw1iSHbLXU=";
+      rev = "e51ba2a70169bb6fd58342312ccde591242ac739";
+      hash = "sha256-0gF993CXulPD5LQhgV6VeDI8ToNkTl/SlXucFkUE6Vk=";
    };
    meta.homepage = "https://codeberg.org/andyg/leap.nvim/";
    meta.license = unfree;
@@ -9202,12 +9202,12 @@ final: prev: {

  llama-vim = buildVimPlugin {
    pname = "llama.vim";
-    version = "0-unstable-2026-08-17";
+    version = "0-unstable-2026-08-18";
    src = fetchFromGitHub {
      owner = "ggml-org";
      repo = "llama.vim";
-      rev = "e687317b9a16a976e1b579a6c62f063e2e3eb00e";
-      hash = "sha256-knXGFGQokOWM9rubmYhoI5oRjBmuGD1DAYl+scUzaLw=";
+      rev = "93f8106ed7657859d7eefebdb210edad515e9463";
+      hash = "sha256-qv8E4Y8UkyQxdGFciLuPE0JQB3G42dI80n7P/ATY2lU=";
    };
    meta.homepage = "https://github.com/ggml-org/llama.vim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -14672,12 +14672,12 @@ final: prev: {

  org-roam-nvim = buildVimPlugin {
    pname = "org-roam.nvim";
-    version = "0.2.0-unstable-2026-05-31";
+    version = "0.2.0-unstable-2026-08-18";
    src = fetchFromGitHub {
      owner = "chipsenkbeil";
      repo = "org-roam.nvim";
-      rev = "0240378c92eb0c9d6bc4ccbc8a6046e3c3d02ece";
-      hash = "sha256-dAFiQFmu9WgE2Wao3z4yFJgTEhHV/sRTkkq8uZk5EO0=";
+      rev = "aa41b86138d337c485b6cdcffa4b45a61d23edf1";
+      hash = "sha256-uqlc1on9MSZhmn099PDNfMy9O3KpRVZmxOHYPWhw/oQ=";
    };
    meta.homepage = "https://github.com/chipsenkbeil/org-roam.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -18434,12 +18434,12 @@ final: prev: {

  treewalker-nvim = buildVimPlugin {
    pname = "treewalker.nvim";
-    version = "0-unstable-2026-08-17";
+    version = "0-unstable-2026-08-19";
    src = fetchFromGitHub {
      owner = "aaronik";
      repo = "treewalker.nvim";
-      rev = "f74cd0b05cd40dc78e5d171356e1b9390c2b6198";
-      hash = "sha256-p5IeDmfkumq4KQST5YhLXf/XY2Kd6oNX7BBzwQ6j8cM=";
+      rev = "5ba91123699e8c43c1e7cf85c2313326a3a37f6f";
+      hash = "sha256-u0Uu1kdVAkP4aUAq05rvI/EqLq4QsijQYsHXiS2H/9E=";
    };
    meta.homepage = "https://github.com/aaronik/treewalker.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -18856,12 +18856,12 @@ final: prev: {

  unison = buildVimPlugin {
    pname = "unison";
-    version = "1.3.0";
+    version = "1.4.0";
    src = fetchFromGitHub {
      owner = "unisonweb";
      repo = "unison";
-      tag = "release/1.3.0";
-      hash = "sha256-uw1QBTY6Shj2liDdLaoNjqkEAYr5pMG7SfrLuhdDi8k=";
+      tag = "release/1.4.0";
+      hash = "sha256-TDpyRO5PA9DuQ146kujXfqqDiacFOvJdFwHgU8fXcS4=";
    };
    meta.homepage = "https://github.com/unisonweb/unison/";
    meta.license = unfree;
@@ -21418,12 +21418,12 @@ final: prev: {

  vim-habamax = buildVimPlugin {
    pname = "vim-habamax";
-    version = "0-unstable-2026-08-13";
+    version = "0-unstable-2026-08-19";
    src = fetchFromGitHub {
      owner = "habamax";
      repo = "vim-habamax";
-      rev = "961b42ec4750c21a67be01b5961aa8cbafc0fd73";
-      hash = "sha256-lJRRaek55oc/hMLAZU61BMCWCs67++c1znQGCiS9A/A=";
+      rev = "46028751872d68419f925e5e2baf41643f0b86a4";
+      hash = "sha256-lDJKBAV2a7J2kh35qiJ6V7bdlp6EmGUiL8RqIdLbqcA=";
    };
    meta.homepage = "https://github.com/habamax/vim-habamax/";
    meta.license = unfree;
@@ -26306,12 +26306,12 @@ final: prev: {

  zotcite = buildVimPlugin {
    pname = "zotcite";
-    version = "0.7-unstable-2026-08-10";
+    version = "0.7-unstable-2026-08-19";
    src = fetchFromGitHub {
      owner = "jalvesaq";
      repo = "zotcite";
-      rev = "229c0e6faecbac839e2d80c91d021a1d4b4db0a9";
-      hash = "sha256-WeQ20GzEQ7k4+hb5jtSm2yml/BJwRstC1HOgcpbCW5g=";
+      rev = "b8b96a33dac53b8e9ed3a0a645ca14555fa1404d";
+      hash = "sha256-0jpgvZTU5hPd1wwyNiwAf17hV0XtnPMfNP1IvYk+A1k=";
    };
    meta.homepage = "https://github.com/jalvesaq/zotcite/";
    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -26320,12 +26320,12 @@ final: prev: {

  zoxide-vim = buildVimPlugin {
    pname = "zoxide.vim";
-    version = "0-unstable-2026-08-14";
+    version = "0-unstable-2026-08-18";
    src = fetchFromGitHub {
      owner = "nanotee";
      repo = "zoxide.vim";
-      rev = "f40ac99fe70bc707f56c4fd1e5f614857a4b0d6d";
-      hash = "sha256-KddMbbNsoUfXnSEaoiNPNgPyOFOKJ8fb4urEejeyZGs=";
+      rev = "d4c3d088a70a4edae9def6209644c092f4221fe5";
+      hash = "sha256-IxC/1cy0qsMwdUcqHdaReFAwLVKaIAJFiAyh1G7JtSY=";
    };
    meta.homepage = "https://github.com/nanotee/zoxide.vim/";
    meta.license = getLicenseFromSpdxId "MIT";
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -513,8 +513,8 @@ let
        mktplcRef = {
          publisher = "banacorn";
          name = "agda-mode";
-          version = "0.10.0";
-          hash = "sha256-rz3Ehq/2AewE5ADYHVk8pHICSWO58i8v+nBwzkFkGCY=";
+          version = "0.10.1";
+          hash = "sha256-jQn7DJ3LKnuWDtoTu0FhDXMZSUwasz8lwJ6O9K06B3M=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/banacorn.agda-mode/changelog";
@@ -1190,8 +1190,8 @@ let
        mktplcRef = {
          publisher = "DanielSanMedium";
          name = "dscodegpt";
-          version = "3.24.43";
-          hash = "sha256-Y3pCg0qauVu4K6qz610QGRizyodnRpDigGSSIn6m6gw=";
+          version = "3.24.51";
+          hash = "sha256-VK0AfJdMBofH6ra4jTFRzzId3vXyB66SzMqKJVeXa+Y=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1242,8 +1242,8 @@ let
        mktplcRef = {
          name = "databricks";
          publisher = "databricks";
-          version = "2.13.0";
-          hash = "sha256-4Fa1UABo7JUO7+IECjsYEq9zyscHTGUlrUCa3aBdhoI=";
+          version = "2.14.1";
+          hash = "sha256-f/jkmzHGZx5NJ0hKcNvPodjWcc7xGSUND5XzaXlL/Ms=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -838,7 +838,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "151.0.7922.169",
+    "version": "151.0.7922.173",
    "deps": {
      "depot_tools": {
        "rev": "94e89b10b92cc9d6e58fc8d1b6474b7d29e8a114",
@@ -850,16 +850,16 @@
        "hash": "sha256-T2LdISIkp8fcUli5ZetTqrESBAc7coJhWdJv7I+o9kk="
      },
      "ungoogled-patches": {
-        "rev": "151.0.7922.169-1",
-        "hash": "sha256-xNeShM2r3gpho2rbwriLschCIHO/5/1DkqWsUAb6eE0="
+        "rev": "151.0.7922.173-1",
+        "hash": "sha256-m7Wp64ns06DXbjMcLT9Dz6WBBqBGCPkrCuveYZ/VqZ4="
      },
      "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "4b1c7520055f77780fe76d89bb89b76e4d19f64c",
-        "hash": "sha256-Esamlwf17X1PzJsQRRcIJ4QwA0qHD3vslQwzdAbGJxk=",
+        "rev": "a96602f30358e9b5d256a0464e7e4d4bec223004",
+        "hash": "sha256-uumIVSzf318Xd1JB9jESXgpLxXlrvMDclOzSFQqweZ8=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -1664,8 +1664,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "dccfc345769bb723321ce10168d8084f7f9ac9f7",
-        "hash": "sha256-uyS4w15ppEOxv/FKsdtGDzSIER5bqZtHPic6eKTIVDM="
+        "rev": "4b407bc23f23059b1019cde542601c2cf8f70eb2",
+        "hash": "sha256-TB1A+iIyZOdlbHvim1JOaXOf9uQnoAYqbUL2+PFKUcs="
      },
      "src/agents/shared": {
        "url": "https://chromium.googlesource.com/chromium/agents.git",
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -724,11 +724,11 @@
    "vendorHash": "sha256-s9tdthUzIdisP0XB9V+HGlWgZCXnOodz9Atu/XyDKf4="
  },
  "huaweicloud_huaweicloud": {
-    "hash": "sha256-TiupRu1Aj750do194qYyWlJJAaT1cwyy/oc3WyqtJdM=",
+    "hash": "sha256-pnFGM0zUCZ/47zmOblKHtRYuS+QxBSN6vnhAdYAiQaY=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.96.1",
+    "rev": "v1.97.1",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1310,13 +1310,13 @@
    "vendorHash": "sha256-ZuH+uIv+iRQgUooyXsryICItSRglk1AGGWMVb+o1ILs="
  },
  "temporalio_temporalcloud": {
-    "hash": "sha256-7xj+/RzXtMXN9IWjua0+cAH5zyMMCIqlOzvFqNsAFHk=",
+    "hash": "sha256-crsCSIh2Xc7b6X+CxhC7fpp/3FCYEMKAbmq0QTszg0E=",
    "homepage": "https://registry.terraform.io/providers/temporalio/temporalcloud",
    "owner": "temporalio",
    "repo": "terraform-provider-temporalcloud",
-    "rev": "v1.6.0",
+    "rev": "v1.7.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-QvtirfTfnvy7CBNUng07OZnbXLHJAyRlf1I9Mur44N4="
+    "vendorHash": "sha256-kWwfjiWDm/voT95oxyNtCltRzeBJYR3gJo1USV0j/Uo="
  },
  "tencentcloudstack_tencentcloud": {
    "hash": "sha256-Dd8ZmNw24LEK5NAtQO9qPMm5i2DANLSQ1iVMSqgMago=",
--- a/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix/default.nix
@@ -60,7 +60,7 @@ buildPythonPackage {
    attrs
    logbook
    pygments
-    (matrix-nio.override { withOlm = true; })
+    (matrix-nio.override { withVodozemac = true; })
    aiohttp
    requests
  ];
--- a/pkgs/build-support/fetchtorrent/default.nix
+++ b/pkgs/build-support/fetchtorrent/default.nix
@@ -31,57 +31,48 @@ let
  # Default to flattening if no flatten argument was specified.
  flatten' = if flatten == null then true else flatten;

-  transmissionFinishScript = writeShellScript "fetch-bittorrent-done.sh" ''
+  setupScript = ''
+    export HOME=$TMP
+    mkdir -p $out
+    downloadedDirectory=${
+      if flatten' then "$(mktemp -d $out/downloadedDirectory.XXXXXXXXXX)" else "$out"
+    }
+    export downloadedDirectory # See https://www.shellcheck.net/wiki/SC2155
+    port="$(shuf -n 1 -i 49152-65535)"
+  '';
+
+  flattenScript = ''
+    (
+      shopt -s dotglob nullglob
+      downloadedFiles=($downloadedDirectory/*)
+      if [[ ''${#downloadedFiles[@]} -eq 0 ]]; then
+        echo "Failed to download any files."
+        exit 1
+      elif [[ ''${#downloadedFiles[@]} -eq 1 ]] && [[ -d "$downloadedFiles" ]]; then
+        # Flatten the directory, so that only the torrent contents are in $out,
+        # not the folder name
+        mv -v "$downloadedFiles"/* $out
+      else
+        # Either we downloaded a single (regular) file, or we downloaded
+        # multiple files/directories. We can't flatten, so we move them to
+        # $out.
+        mv -v "''${downloadedFiles[@]}" $out
+      fi
+      rm -v -rf $downloadedDirectory
+    )
+  '';
+
+  finishScript = ''
    ${postUnpack}
-    # Flatten the directory, so that only the torrent contents are in $out, not
-    # the folder name
-    shopt -s dotglob
-    mv -v $downloadedDirectory/*/* $out
-    rm -v -rf $downloadedDirectory
-    unset downloadedDirectory
+    ${lib.optionalString flatten' flattenScript}
    ${postFetch}
+  '';
+
+  transmissionFinishScript = writeShellScript "fetch-bittorrent-done.sh" ''
+    ${finishScript}
    kill $PPID
  '';
  jsonConfig = (formats.json { }).generate "jsonConfig" config;
-
-  # https://github.com/NixOS/nixpkgs/issues/432001
-  #
-  # For a while, the transmission backend would put the downloaded torrent in
-  # the output directory, but whether the rqbit backend would put the output in
-  # the output directory or a subdirectory depended on the version of rqbit.
-  # We want to standardise on a single behaviour, but give users of
-  # fetchtorrent with the rqbit backend some warning that the behaviour might
-  # be unexpected, particularly since we can't know what behaviour users might
-  # be expecting at this point, and they probably wouldn't notice a change
-  # straight away because the results are fixed-output derivations.
-  #
-  # This warning was introduced for 25.11, so we can remove handling of the
-  # `flatten` argument once that release is no longer supported.
-  warnings =
-    if backend == "rqbit" && flatten == null then
-      [
-        ''
-          `fetchtorrent` with the rqbit backend may or may not have the
-          downloaded files stored in a subdirectory of the output directory.
-          Verify which behaviour you need, and set the `flatten` argument to
-          `fetchtorrent` accordingly.
-
-          The `flatten = false` behaviour will still produce a warning, as this
-          behaviour is deprecated.  It is only available with the "rqbit" backend
-          to provide temporary support for users who are relying on the
-          previous incorrect behaviour.  For a warning-free evaluation, use
-          `flatten = true`.
-        ''
-      ]
-    else if flatten == false then
-      [
-        ''
-          `fetchtorrent` with `flatten = false` is deprecated and will be
-          removed in a future release.
-        ''
-      ]
-    else
-      [ ];
 in
 assert
  (config != { } -> backend == "transmission")
@@ -103,7 +94,41 @@ runCommand name
      if (backend == "transmission") then
        [ transmission_4 ]
      else if (backend == "rqbit") then
-        [ rqbit ]
+        lib.warnIf (flatten != true) (
+          # https://github.com/NixOS/nixpkgs/issues/432001
+          #
+          # For a while, the transmission backend would put the downloaded torrent in
+          # the output directory, but whether the rqbit backend would put the output in
+          # the output directory or a subdirectory depended on the version of rqbit.
+          # We want to standardise on a single behaviour, but give users of
+          # fetchtorrent with the rqbit backend some warning that the behaviour might
+          # be unexpected, particularly since we can't know what behaviour users might
+          # be expecting at this point, and they probably wouldn't notice a change
+          # straight away because the results are fixed-output derivations.
+          #
+          # This warning was introduced for 25.11, so we can remove handling of the
+          # `flatten` argument once that release is no longer supported.
+          if flatten == null then
+            ''
+              `fetchtorrent` with the rqbit backend may or may not have the
+              downloaded files stored in a subdirectory of the output directory.
+              Verify which behaviour you need, and set the `flatten` argument to
+              `fetchtorrent` accordingly.
+
+              The `flatten = false` behaviour will still produce a warning, as this
+              behaviour is deprecated.  It is only available with the "rqbit" backend
+              to provide temporary support for users who are relying on the
+              previous incorrect behaviour.  For a warning-free evaluation, use
+              `flatten = true`.
+            ''
+          else if flatten == false then
+            ''
+              `fetchtorrent` with `flatten = false` is deprecated and will be
+              removed in a future release.
+            ''
+          else
+            throw "invalid value for flatten: must be true, false, or null"
+        ) [ rqbit ]
      else
        throw "rqbit or transmission are the only available backends for fetchtorrent"
    );
@@ -119,12 +144,9 @@ runCommand name
  (
    if (backend == "transmission") then
      ''
-        export HOME=$TMP
-        export downloadedDirectory=$out/downloadedDirectory
-        mkdir -p $downloadedDirectory
+        ${setupScript}
        mkdir -p $HOME/.config/transmission
        cp ${jsonConfig} $HOME/.config/transmission/settings.json
-        port="$(shuf -n 1 -i 49152-65535)"
        function handleChild {
          # This detects failures and logs the contents of the transmission fetch
          find $out
@@ -140,18 +162,7 @@ runCommand name
      ''
    else
      ''
-        export HOME=$TMP
-      ''
-      + lib.optionalString flatten' ''
-        downloadedDirectory=$out/downloadedDirectory
-        mkdir -p $downloadedDirectory
-      ''
-      + lib.optionalString (!flatten') ''
-        downloadedDirectory=$out
-      ''
-      + ''
-        port="$(shuf -n 1 -i 49152-65535)"
-
+        ${setupScript}
        rqbit \
            --disable-dht-persistence \
            --http-api-listen-addr "127.0.0.1:$port" \
@@ -159,18 +170,6 @@ runCommand name
            -o "$downloadedDirectory" \
            --exit-on-finish \
            "$url"
-
-        ${postUnpack}
-      ''
-      + lib.optionalString flatten' ''
-        # Flatten the directory, so that only the torrent contents are in $out,
-        # not the folder name
-        shopt -s dotglob
-        mv -v $downloadedDirectory/*/* $out
-        rm -v -rf $downloadedDirectory
-        unset downloadedDirectory
-      ''
-      + ''
-        ${postFetch}
+        ${finishScript}
      ''
  )
--- a/pkgs/build-support/fetchtorrent/test-single-file.torrent
+++ b/pkgs/build-support/fetchtorrent/test-single-file.torrent
@@ -0,0 +1 @@
+d10:created by13:mktorrent 1.113:creation datei1772926249e4:infod6:lengthi1097e4:name7:COPYING12:piece lengthi262144e6:pieces20:€åÏÊ\c™èçæÉ\Q3Ní-e8:url-list96:https://raw.githubusercontent.com/NixOS/nixpkgs/3d82431ec4b51262989559b821b83abe4a9f6dbd/COPYINGe
--- a/pkgs/build-support/fetchtorrent/tests.nix
+++ b/pkgs/build-support/fetchtorrent/tests.nix
@@ -47,7 +47,7 @@ let
    pushd "$out" &&
    sha512sum --check --strict ${./test-hashes.sha512sum} &&
    sed 's/.*  //' ${./test-hashes.sha512sum} | xargs rm --verbose &&
-    popd
+    popd || exit 1
  '';
  unflattened.postFetch = ''
    pushd "$out" &&
@@ -56,7 +56,7 @@ let
    sed 's/.*  //' ${./test-hashes.sha512sum} | xargs rm --verbose &&
    popd &&
    rm --dir --verbose Sintel &&
-    popd
+    popd || exit 1
  '';

  fetchtorrentWithHash =
@@ -75,7 +75,7 @@ let
    );
 in
 # Seems almost but not quite worth using lib.mapCartesianProduct...
-builtins.mapAttrs (n: v: testers.invalidateFetcherByDrvHash fetchtorrentWithHash v) {
+(builtins.mapAttrs (n: v: testers.invalidateFetcherByDrvHash fetchtorrentWithHash v) {
  http-link = {
    inherit (http) url;
    inherit (flattened) postFetch;
@@ -94,16 +94,22 @@ builtins.mapAttrs (n: v: testers.invalidateFetcherByDrvHash fetchtorrentWithHash
    backend = "transmission";
    inherit (flattened) postFetch;
  };
-  http-link-rqbit = {
-    inherit (http) url;
-    backend = "rqbit";
-    inherit (flattened) postFetch;
-  };
-  magnet-link-rqbit = {
-    inherit (magnet) url;
-    backend = "rqbit";
-    inherit (flattened) postFetch;
-  };
+  #
+  # Disabled because these warn that flatten hasn't been explicitly
+  # set to true, and warnings are treated as failures in tests.
+  #
+  # Re-enable these tests when flatten defaults to true.
+  #
+  #http-link-rqbit = {
+  #  inherit (http) url;
+  #  backend = "rqbit";
+  #  inherit (flattened) postFetch;
+  #};
+  #magnet-link-rqbit = {
+  #  inherit (magnet) url;
+  #  backend = "rqbit";
+  #  inherit (flattened) postFetch;
+  #};
  http-link-rqbit-flattened = {
    inherit (http) url;
    backend = "rqbit";
@@ -116,16 +122,38 @@ builtins.mapAttrs (n: v: testers.invalidateFetcherByDrvHash fetchtorrentWithHash
    flatten = true;
    inherit (flattened) postFetch;
  };
-  http-link-rqbit-unflattened = {
-    inherit (http) url;
-    backend = "rqbit";
-    flatten = false;
-    inherit (unflattened) postFetch;
-  };
-  magnet-link-rqbit-unflattened = {
-    inherit (magnet) url;
-    backend = "rqbit";
-    flatten = false;
-    inherit (unflattened) postFetch;
+  #
+  # Disabled because these warn that `flatten = false` is deprecated
+  # and will be removed.
+  #
+  # Remove these when support for `flatten = false` is completely removed.
+  #
+  #http-link-rqbit-unflattened = {
+  #  inherit (http) url;
+  #  backend = "rqbit";
+  #  flatten = false;
+  #  inherit (unflattened) postFetch;
+  #};
+  #magnet-link-rqbit-unflattened = {
+  #  inherit (magnet) url;
+  #  backend = "rqbit";
+  #  flatten = false;
+  #  inherit (unflattened) postFetch;
+  #};
+})
+// {
+  # Make sure we can download and "flatten" single-file torrents.
+  # We only test with transmission because we use a web-seed and rqbit
+  # doesn't support web-seeds.
+  single-file = fetchtorrent {
+    hash = "sha256-u5c/ZN5V79Jg1aN6spbui4OdhExsXjofk1JpvUdW7Ro=";
+    backend = "transmission";
+    flatten = true;
+    url = "${./test-single-file.torrent}";
+    meta = {
+      hydraPlatforms = [ ];
+      license = lib.licenses.mit;
+      description = "The license file for the Nixpkgs repository as of 7 March 2026";
+    };
  };
 }
--- a/pkgs/by-name/ar/arity/package.nix
+++ b/pkgs/by-name/ar/arity/package.nix
@@ -9,7 +9,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "arity";
-  version = "0.18.0";
+  version = "0.19.1";

  __structuredAttrs = true;

@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "jolars";
    repo = "arity";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ZB/1SgJFom4U5KztBAfMztXsG0/T5tETQZxsRt6N8jY=";
+    hash = "sha256-MirIe+AOAlhgQi26P7h/NFOYAnKzHdd+aYvXlpULbCA=";
  };

-  cargoHash = "sha256-uwQlfK6YXqXNRyZaYTnoEzXn21l01k1Fuw903Gn/7AU=";
+  cargoHash = "sha256-NEyZQj6po/O0qTrI4OrEY0n8ME8Pdn5VnNuQs+/wQf0=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/at/atlantis/package.nix
+++ b/pkgs/by-name/at/atlantis/package.nix
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "atlantis";
-  version = "0.47.0";
+  version = "0.47.1";

  src = fetchFromGitHub {
    owner = "runatlantis";
    repo = "atlantis";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WHU8n82GyDmKcjIQbwphCi4qjBN/8j+zxC9/Jqd2sCs=";
+    hash = "sha256-GNHu6nZijSd+kluqWTYrmUZubGmicXQdzChXnJbXCyw=";
  };

  ldflags = [
--- a/pkgs/by-name/at/atomgit-cli/package.nix
+++ b/pkgs/by-name/at/atomgit-cli/package.nix
@@ -1,10 +1,12 @@
 {
+  _experimental-update-script-combinators,
  lib,
  stdenv,
  buildGoModule,
  fetchgit,
  gitMinimal,
  gitUpdater,
+  nix-update-script,
  makeWrapper,
  versionCheckHook,
  writableTmpDirAsHomeHook,
@@ -15,15 +17,15 @@ buildGoModule (finalAttrs: {
  __structuredAttrs = true;

  pname = "atomgit-cli";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchgit {
    url = "https://atomgit.com/hust-open-atom-club/atomgit-cli.git";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-SyOGkxDgkfQUeaHp6F+FhTLqWYCWvG7RVqVw1wfE1Uw=";
+    hash = "sha256-E1T093LkccgLPPNs5OokxY5tw4HEMmRy+ulaROnuSCE=";
  };

-  vendorHash = "sha256-gkVSHoo7BWMy/vSKq2+sgm/TAhC4WYl04OXfG6INrG4=";
+  vendorHash = "sha256-YuAY+CBO+YAMEfrJuUJ/EMnmR9pfRkL+qMhOr1LPKck=";

  subPackages = [ "cmd/ag" ];

@@ -42,7 +44,10 @@ buildGoModule (finalAttrs: {

  nativeBuildInputs = [ makeWrapper ];

-  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+  passthru.updateScript = _experimental-update-script-combinators.sequence [
+    (gitUpdater { rev-prefix = "v"; }).command
+    (nix-update-script { extraArgs = [ "--version=skip" ]; })
+  ];

  postFixup = ''
    wrapProgram $out/bin/ag \
--- a/pkgs/by-name/cc/ccmeter/package.nix
+++ b/pkgs/by-name/cc/ccmeter/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ccmeter";
+  version = "2.0.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "hmenzagh";
+    repo = "CCMeter";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-iVPHRV+qfLl77wdyGLycYCYbtMLh3KF+TFwFI8qZPNs=";
+  };
+
+  cargoHash = "sha256-owQwUm8jbi3GItHV7UUfxyNn+htHfXEP/OfJjVLxFzs=";
+
+  # These tests hardcode 2026-04-01 timestamps, but discover_rate_limit_hits()
+  # discards hits older than 30 days, so they only pass within a month of the
+  # release date:
+  # https://github.com/hmenzagh/CCMeter/blob/v2.0.0/src/data/rate_limits.rs#L180-L182
+  checkFlags = [
+    "--skip=data::rate_limits::tests::detects_rate_limit_hit"
+    "--skip=data::rate_limits::tests::deduplicates_same_minute"
+  ];
+
+  meta = {
+    description = "TUI dashboard for tracking Claude Code usage and costs";
+    homepage = "https://github.com/hmenzagh/CCMeter";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sophronesis ];
+    platforms = lib.platforms.unix;
+    mainProgram = "ccmeter";
+  };
+})
--- a/pkgs/by-name/ce/centrifugo/package.nix
+++ b/pkgs/by-name/ce/centrifugo/package.nix
@@ -16,16 +16,16 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "centrifugo";
-  version = "6.9.1";
+  version = "6.9.2";

  src = fetchFromGitHub {
    owner = "centrifugal";
    repo = "centrifugo";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-j5ezw4LOwNK61fk71XFfUtqyXwUyX5QwHPvbH4sOtjE=";
+    hash = "sha256-rNh2fM+/j6/br1Cz1m3OxA3mi+TmaMjms2fgAr+4IA4=";
  };

-  vendorHash = "sha256-hmAZ5fo9Hko2w+xwessHGTXlifHDGGAHmtehP1CVdkE=";
+  vendorHash = "sha256-zAXXsfV8Av5D7nCl7tRLIBW/HmzXgZyokNsC/c6+Ssg=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/co/coldsnap/package.nix
+++ b/pkgs/by-name/co/coldsnap/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "coldsnap";
-  version = "0.11.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "coldsnap";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-KYP0CQ4t5ytw8vT9kOZsNjl5KY0DzBTiWp2G+oYt1SU=";
+    hash = "sha256-AQwLZM/33jcJXjsAGC+kZ6XLijgcluLwcVokw+nj+J8=";
  };

-  cargoHash = "sha256-clZ1HNABg8dVOcuRI1GmFfyFYZqiB/M1OWBpuiZrg08=";
+  cargoHash = "sha256-7c++lklOLI1tg1I4GUJXHl64qsUabXxD0gVkDEKj3uA=";

  buildInputs = [ openssl ];
  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/by-name/co/complgen/package.nix
+++ b/pkgs/by-name/co/complgen/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "complgen";
-  version = "0.10.1";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "adaszko";
    repo = "complgen";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0oC/jpCKM2Y1yag+qIUu+b3sCIPmHs/GUBSPHi7KaVI=";
+    hash = "sha256-zH16qv1d2D0txa9Y/v9kcS1/dxS9GeIqjPp/HUViulA=";
  };

-  cargoHash = "sha256-skdtXxNUuC7xLtZSol3b1prdN1YT62uvwo+F7rtFVVQ=";
+  cargoHash = "sha256-cM8YBlukZQ+646L5FyUL3ln01sCXNOGh3frWNCtY3YI=";

  meta = {
    changelog = "https://github.com/adaszko/complgen/blob/v${finalAttrs.version}/CHANGELOG.md";
--- a/pkgs/by-name/co/containerlab/package.nix
+++ b/pkgs/by-name/co/containerlab/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "containerlab";
-  version = "0.78.0";
+  version = "0.78.2";

  src = fetchFromGitHub {
    owner = "srl-labs";
    repo = "containerlab";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-e2TaBoC4kzwron1FXeb78V7BkYujdjgfZ8DNBhrL6Tw=";
+    hash = "sha256-dDIG3Hfx24H9AkzSFgwzPeNeoX89kO2RzW8iNyKyrC0=";
  };

  vendorHash = "sha256-kRBYjxirApj91hNBz3a+NyRm8SqRTVeQQCz+JFsKY0U=";
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -105,8 +105,36 @@ stdenv.mkDerivation (finalAttrs: {
  # necessary for FreeBSD code path in configure
  postPatch = ''
    substituteInPlace ./config.guess --replace-fail /usr/bin/uname uname
-    patchShebangs scripts
-  '';
+  ''
+  # `wcurl` is the one thing in `scripts` that is installed, so it is the one
+  # whose shebang has to suit the host platform. The rest are only used during
+  # the build, and want this platform's shell. Say which is which rather than
+  # patch them all one way and correct it afterwards.
+  #
+  # Where the host has no shell at all, `patchShebangs --host` finds nothing
+  # and leaves the shebang as shipped, which is the best available answer.
+  #
+  # TODO: take the first branch unconditionally --- in the spirit of strictDeps,
+  # it is good to always be defensive rather than do something unnecessarily
+  # that we can only get away with when build == host.
+  + (
+    if isCross then
+      ''
+        local f flag
+        for f in scripts/*; do
+          if [[ "$f" == scripts/wcurl ]]; then
+            flag=--host
+          else
+            flag=--build
+          fi
+          patchShebangs "$flag" "$f"
+        done
+      ''
+    else
+      ''
+        patchShebangs scripts
+      ''
+  );

  outputs = [
    "bin"
@@ -247,19 +275,27 @@ stdenv.mkDerivation (finalAttrs: {
    ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4
    ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4.4.0
  ''
-  # The wcurl shell script found in `''${!outputBin}/bin`, is located in the
-  # source along with all the scripts patched in `postPatch` above.
-  # `patchShebangs` at that stage causes the host intended wcurl script to get
-  # the buildPlatform's runtimeShell shebang, instead of the hostPlatform's. To
-  # make sure this doesn't happen we disallow it, and fix it above in the
-  # postInstall, and also with the conditional hostPlatform's
-  # runtimeShellPackage added in buildInputs.
+  # `postPatch` above should have pointed everything installed at the host's
+  # shell already. Do it again over what was installed, defensively.
  + lib.optionalString isCross ''
-    patchShebangs --update --host "''${!outputBin}/bin"
+    patchShebangs --host "''${!outputBin}/bin"
  '';
+
+  # Whether we patch the shebangs in the installed script or not, we should not
+  # have build platform software in the final runtime closure.
  outputChecks.bin.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
  outputChecks.out.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
-  buildInputs = lib.optional isCross runtimeShellPackage;
+
+  # Some hosts have no shell for the scripts to point at: MinGW is the one in
+  # tree, where `bash` is marked unsupported because it needs a POSIX layer. We
+  # cannot patch shebangs in that case.
+  #
+  # TODO: drop the isCross part of the condition --- in the spirit of
+  # `strictDeps` it is good to have the dep (when it is available), even if it
+  # is gratuitous in the `build = host` case.
+  buildInputs = lib.optional (
+    isCross && lib.meta.availableOn stdenv.hostPlatform runtimeShellPackage
+  ) runtimeShellPackage;

  passthru =
    let
--- a/pkgs/by-name/cy/cyberia/package.nix
+++ b/pkgs/by-name/cy/cyberia/package.nix
@@ -0,0 +1,73 @@
+{
+  rustPlatform,
+  fetchFromForgejo,
+  fetchNpmDeps,
+  cargo-tauri,
+  nodejs,
+  npmHooks,
+  pkg-config,
+  lib,
+  stdenv,
+  wrapGAppsHook4,
+  dbus,
+  glib-networking,
+  gtk3,
+  webkitgtk_4_1,
+  alsa-lib,
+  libappindicator,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cyberia";
+  version = "0.2.8";
+
+  __structuredAttrs = true;
+
+  src = fetchFromForgejo {
+    domain = "git.gay";
+    owner = "zutyosh";
+    repo = "Cyberia";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-MKq3Q0g02JiTnwyjUNv1CzCCmG43ZFCffRa7BmUU5SU=";
+  };
+
+  cargoRoot = "src-tauri";
+  buildAndTestSubdir = finalAttrs.cargoRoot;
+  cargoHash = "sha256-ghdZyJt/hE+r/D+FqyLrUNSvVDZf+FRv463K33XrNbs=";
+
+  npmDeps = fetchNpmDeps {
+    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
+    inherit (finalAttrs) src;
+    hash = "sha256-aZsQHb1Hj7dmz/04E6KJ5AMKKTcN+4fSK8phwDg2YAU=";
+  };
+
+  nativeBuildInputs = [
+    cargo-tauri.hook
+
+    nodejs
+    npmHooks.npmConfigHook
+
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ wrapGAppsHook4 ];
+
+  buildInputs = [
+    dbus
+    gtk3
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    glib-networking
+    webkitgtk_4_1
+    alsa-lib
+    libappindicator
+  ];
+
+  meta = {
+    description = "VRCX style client for Resonite";
+    homepage = "https://git.gay/zutyosh/Cyberia";
+    changelog = "https://git.gay/zutyosh/Cyberia/releases/tag/v${finalAttrs.version}";
+    mainProgram = "cyberia";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ toasteruwu ];
+  };
+})
--- a/pkgs/by-name/di/dita-ot/package.nix
+++ b/pkgs/by-name/di/dita-ot/package.nix
@@ -9,14 +9,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dita-ot";
-  version = "4.4";
+  version = "4.4.1";

  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ openjdk17 ];

  src = fetchzip {
    url = "https://github.com/dita-ot/dita-ot/releases/download/${finalAttrs.version}/dita-ot-${finalAttrs.version}.zip";
-    hash = "sha256-0P2E0c5HHOCk1w0/CHe3a6AH8FJIeKoQdTruuGkwo/c=";
+    hash = "sha256-RWMb2s9feFUeRVrp2J9MZmEivCf3bGsqlQcSRWEJhpM=";
  };

  installPhase = ''
--- a/pkgs/by-name/en/ente-web/package.nix
+++ b/pkgs/by-name/en/ente-web/package.nix
@@ -84,7 +84,7 @@ buildNpmPackage (finalAttrs: {
    # Replace hardcoded links pointing to the public ente instance so that
    # users of a self-hosted instance are not accidentally redirected there
    + lib.optionalString (enteMainUrl != null) ''
-      for pattern in "https://web.ente.io" "https://ente.com" "https://ente.io"; do
+      for pattern in "https://web.ente.io" "https://ente.com" "https://ente.io" "https://photos.ente.com"; do
        mapfile -d "" -t files < <(grep -rlFZ -- "$pattern" apps/)
        ${lib.getExe sd} -F -- "$pattern" ${lib.escapeShellArg enteMainUrl} "''${files[@]}"
      done
--- a/pkgs/by-name/fa/fatou/package.nix
+++ b/pkgs/by-name/fa/fatou/package.nix
@@ -9,7 +9,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "fatou";
-  version = "0.6.0";
+  version = "0.15.0";

  __structuredAttrs = true;

@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "jolars";
    repo = "fatou";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lbMT9CQV/nEfjxfnnpRDPhWmSbyD1nESp797hkWE1iA=";
+    hash = "sha256-bh+8+0Y5wNs39q+1gAwCjLU2N/65GPoBzCdNWmUFmaY=";
  };

-  cargoHash = "sha256-FOID5+PfNFFCCl5zG7NwZRwAg4KjuByjhtXRC5QUBW4=";
+  cargoHash = "sha256-qf9Q607UZYR/zVBmrZ5rjqYi2sc5kQzECdsA8OS28tc=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/fc/fcgi/package.nix
+++ b/pkgs/by-name/fc/fcgi/package.nix
@@ -26,6 +26,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.oml;
    mainProgram = "cgi-fcgi";
    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ jtbx ];
+    maintainers = [ ];
  };
 })
--- a/pkgs/by-name/fe/feishu-cli/package.nix
+++ b/pkgs/by-name/fe/feishu-cli/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "feishu-cli";
-  version = "1.38.3";
+  version = "1.39.0";

  src = fetchFromGitHub {
    owner = "riba2534";
    repo = "feishu-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wLPR7uet73JUOgXqneNAPy3Rk3/WMSnIa6zIQUXEcic=";
+    hash = "sha256-6AP9oXCfJ7zZkYeDGlvZD31FJbJLmUB2FsEBiTJV9wg=";
  };

-  vendorHash = "sha256-JhrcuZ/FyvtUfsSq6YoYHNMjqFU/+FhxgCJ5bPtyYD8=";
+  vendorHash = "sha256-cbhq0GfNHH2jq/P57twnvS+WjkHmNQDzScrcMup3CPc=";

  subPackages = [ "." ];

--- a/pkgs/by-name/fi/firecrawl-cli/package.nix
+++ b/pkgs/by-name/fi/firecrawl-cli/package.nix
@@ -15,7 +15,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "firecrawl-cli";
-  version = "1.20.0";
+  version = "1.21.1";
  __structuredAttrs = true;
  strictDeps = true;

@@ -28,7 +28,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "firecrawl";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w+U+WBiGv5F9AQcU+ItUzyBj1f51O7U5tNfOvs58L+g=";
+    hash = "sha256-zFtXf+3vj/xcodCTbyEvQsNqNqnnnOvnrWFn65+heS0=";
  };

  patches = [
--- a/pkgs/by-name/ge/getopt/package.nix
+++ b/pkgs/by-name/ge/getopt/package.nix
@@ -25,8 +25,9 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    platforms = lib.platforms.unix;
-    homepage = "http://frodo.looijaard.name/project/getopt";
+    homepage = "https://frodo.looijaard.name/project/getopt";
    description = "Parses command-line arguments from shell scripts";
    mainProgram = "getopt";
+    license = lib.licenses.gpl2Plus;
  };
 })
--- a/pkgs/by-name/gl/gl-gsync-demo/package.nix
+++ b/pkgs/by-name/gl/gl-gsync-demo/package.nix
@@ -15,7 +15,7 @@ in

 stdenv.mkDerivation {
  pname = "gl-gsync-demo";
-  version = "unstable-2020-12-27";
+  version = "1.0-unstable-2020-12-27";

  src = fetchFromGitHub {
    owner = "dahenry";
--- a/pkgs/by-name/gr/grafana/package.nix
+++ b/pkgs/by-name/gr/grafana/package.nix
@@ -21,7 +21,7 @@

 buildGoModule (finalAttrs: {
  pname = "grafana";
-  version = "13.1.3";
+  version = "13.1.4";

  subPackages = [
    "pkg/cmd/grafana"
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
    owner = "grafana";
    repo = "grafana";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-zAEtEjlqMBnjYLeYTWlJoZG/frxeirYvhff4wrjr1W4=";
+    hash = "sha256-Ki3P6ukIj7KgF9sIcJGdO7NXA2ZLIyWFOIHRUZ5uiVk=";
  };

  # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
@@ -49,7 +49,7 @@ buildGoModule (finalAttrs: {
  # Since this is not a dependency attribute the buildPackages has to be specified.
  offlineCache = buildPackages.yarn-berry_4-fetcher.fetchYarnBerryDeps {
    inherit (finalAttrs) src missingHashes;
-    hash = "sha256-/RDWtuSrfH6VSSbZShrHLiZ9+Ft2Ohpl5bT9/cdwKrA=";
+    hash = "sha256-wL2m4z/d6NkXYOSBGjju3EQZElTgI2MLK/fYzNucNKU=";
  };

  disallowedRequisites = [ finalAttrs.offlineCache ];
--- a/pkgs/by-name/hy/hyprland-preview-share-picker/package.nix
+++ b/pkgs/by-name/hy/hyprland-preview-share-picker/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  glib,
+  gtk4,
+  gtk4-layer-shell,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hyprland-preview-share-picker";
+  version = "0.2.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "WhySoBad";
+    repo = "hyprland-preview-share-picker";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-Zztb0soSN/NynWnBIGPuUNRKt2xSx/+f+QpYIPRyRdc=";
+  };
+
+  cargoHash = "sha256-AqX9jKj7JLEx1SLefyaWYGbRdk0c3H/NDTIsZy6B6hY=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    glib
+    gtk4
+    gtk4-layer-shell
+  ];
+
+  strictDeps = true;
+
+  postInstall = ''
+    $out/bin/hyprland-preview-share-picker schema > schema.json
+    install -Dm0644 schema.json -t $out/share/hyprland-preview-share-picker
+  '';
+
+  meta = {
+    description = "Alternative share picker for hyprland with window and monitor previews";
+    homepage = "https://github.com/WhySoBad/hyprland-preview-share-picker";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sophronesis ];
+    platforms = lib.platforms.linux;
+    mainProgram = "hyprland-preview-share-picker";
+  };
+})
--- a/pkgs/by-name/hy/hyprmod/package.nix
+++ b/pkgs/by-name/hy/hyprmod/package.nix
@@ -0,0 +1,97 @@
+{
+  lib,
+  fetchFromGitHub,
+  glib,
+  gnome-desktop,
+  gobject-introspection,
+  gtk4,
+  libadwaita,
+  python3Packages,
+  wrapGAppsHook4,
+  xvfb-run,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "hyprmod";
+  version = "0.4.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "BlueManCZ";
+    repo = "hyprmod";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MYxYraLMc9QecjKsoVxYO3wkeXDTgLJnBH131VVs0hI=";
+  };
+
+  build-system = with python3Packages; [ hatchling ];
+
+  nativeBuildInputs = [
+    glib # glib-compile-schemas for hatch build hook
+    gobject-introspection
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gnome-desktop
+    gtk4
+    libadwaita
+  ];
+
+  dependencies = with python3Packages; [
+    hyprland-config
+    hyprland-monitors
+    hyprland-schema
+    hyprland-socket
+    hyprland-state
+    pygobject3
+  ];
+
+  pythonRelaxDeps = [ "pygobject" ];
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  postInstall = ''
+    install -Dm0644 data/applications/io.github.bluemancz.hyprmod.desktop \
+      -t $out/share/applications
+    install -Dm0644 data/icons/hicolor/scalable/apps/io.github.bluemancz.hyprmod.svg \
+      -t $out/share/icons/hicolor/scalable/apps
+    install -Dm0644 data/metainfo/io.github.bluemancz.hyprmod.metainfo.xml \
+      -t $out/share/metainfo
+  '';
+
+  pythonImportsCheck = [ "hyprmod" ];
+
+  nativeCheckInputs = [
+    python3Packages.pytest
+    xvfb-run
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    # GnomeDesktop.XkbInfo aborts without the org.gnome.desktop.* schemas, which
+    # are otherwise only wired up by the wrapper this phase runs before
+    export XDG_DATA_DIRS="$GSETTINGS_SCHEMAS_PATH''${XDG_DATA_DIRS:+:$XDG_DATA_DIRS}"
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+    xvfb-run -s '-screen 0 1024x768x24' pytest
+    runHook postCheck
+  '';
+
+  meta = {
+    description = "Native GTK4/libadwaita settings application for Hyprland";
+    homepage = "https://github.com/BlueManCZ/hyprmod";
+    changelog = "https://github.com/BlueManCZ/hyprmod/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ sophronesis ];
+    platforms = lib.platforms.linux;
+    mainProgram = "hyprmod";
+  };
+})
--- a/pkgs/by-name/hy/hyprquickframe/package.nix
+++ b/pkgs/by-name/hy/hyprquickframe/package.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  makeWrapper,
+  qt6,
+  quickshell,
+  grim,
+  imagemagick,
+  wl-clipboard,
+  libnotify,
+  satty,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "hyprquickframe";
+  version = "1.1.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "Ronin-CK";
+    repo = "HyprQuickFrame";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hyu7ihDIVXfswghbY8I4kBkNqft5kZ7ARD9frethQx8=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt6.qt5compat
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/hyprquickframe
+    cp -r . $out/share/hyprquickframe/
+
+    mkdir -p $out/bin
+    makeWrapper ${quickshell}/bin/quickshell $out/bin/hyprquickframe \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          quickshell
+          grim
+          imagemagick
+          wl-clipboard
+          libnotify
+          satty
+        ]
+      } \
+      --add-flags "-c $out/share/hyprquickframe -n"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Quickshell-based screenshot utility for Hyprland";
+    homepage = "https://github.com/Ronin-CK/HyprQuickFrame";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.sophronesis ];
+    mainProgram = "hyprquickframe";
+  };
+})
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "inputplumber";
-  version = "0.78.0";
+  version = "0.78.1";

  src = fetchFromGitHub {
    owner = "ShadowBlip";
    repo = "InputPlumber";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wa05/gStEbXUZLvokY1N4k4f4/cPm2Kolbf+AF479lU=";
+    hash = "sha256-DUrPhspzmD2QvM8Mr7softPxC4nPlR9AP7ZsO1PlTlo=";
  };

-  cargoHash = "sha256-lScpMua5czwmnz/+fz+UrgZSWHwRNP7zB317xJS+6gs=";
+  cargoHash = "sha256-h8741XCE7vqVn1hUr08AMEZNeFZY1ejw/N+zQOJPcVM=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/in/intel-compute-runtime/package.nix
+++ b/pkgs/by-name/in/intel-compute-runtime/package.nix
@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "intel-compute-runtime";
-  version = "26.27.39122.11";
+  version = "26.31.39395.13";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "compute-runtime";
    tag = finalAttrs.version;
-    hash = "sha256-CbOtBgYlvn5r15gB7skmmZ+ZvRwq7FFtouICakku0ls=";
+    hash = "sha256-/rZvPEI5EFhkeW2h7ebhtZnrU48N54mCAfkRgM3b1L4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ku/kubectl-gadget/package.nix
+++ b/pkgs/by-name/ku/kubectl-gadget/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "kubectl-gadget";
-  version = "0.55.0";
+  version = "0.55.1";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eURvBwFbd+dgzeW0ukiyhrMqAvR5oHGqFPPlJkj30Bg=";
+    hash = "sha256-trpvsOefcmajxmVTPGLDKjS7To5psgIBGcQ/XxlFeHo=";
  };

-  vendorHash = "sha256-LL3Fma9q8be3Rf354c2v8RziuKZPInG4YZqRlGGj61M=";
+  vendorHash = "sha256-AJmtOmFV06WYtHD5e/3TuzxsRVypoIVIiTxgesNtCKk=";

  env.CGO_ENABLED = 0;

--- a/pkgs/by-name/li/libbacktrace/package.nix
+++ b/pkgs/by-name/li/libbacktrace/package.nix
@@ -77,6 +77,17 @@ stdenv.mkDerivation {
    (lib.enableFeature enableShared "shared")
  ];

+  # A (PE/COFF) DLL has to resolve every symbol at link time, and
+  # libtool declines to build one at all unless told unresolved symbols
+  # are not allowed. We don't have any unresolved symbols so we can pass
+  # this flag.
+  #
+  # We only want this affecting the build. It could mess up configure
+  # scripts if we defined it for the entire derivation.
+  #
+  # TODO use `lib.optionalString` at the cost of some rebuilds.
+  makeFlags = if enableShared && stdenv.hostPlatform.isPE then "LDFLAGS=-no-undefined" else null;
+
  doCheck = stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isMusl;

  passthru = {
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "libretro-shaders-slang";
-  version = "0-unstable-2026-08-08";
+  version = "0-unstable-2026-08-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "slang-shaders";
-    rev = "a7f04a0698908015c6f9e3a3f446b3d17083269c";
-    hash = "sha256-Zz5EqEyGZwMZcFgowUpW2b3/cRcmOHL5R/Z78sg4dm8=";
+    rev = "9d68d530a92b5666c8dc151a6884aa8ce16df095";
+    hash = "sha256-hnBCWIDi6zCOxtL80sr0fIhiDePVmgXO7udgkWp7ej4=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -36,7 +36,7 @@ let

  pname = "librewolf-bin-unwrapped";

-  version = "153.0.4-1";
+  version = "154.0-2";
 in

 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
    url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
    hash =
      {
-        x86_64-linux = "sha256-KPv44+F1ofq7L2Ja6XM4AtIutICSfJz6R7XvkvlH5Y0=";
-        aarch64-linux = "sha256-OVR4ivYSdCKIGKYf80FL9WKSFIB6eHura/rMv9Z6asE=";
+        x86_64-linux = "sha256-uJs6+QdLmpUShD3rLMLGM7nuJ5zv5FudqNQdsPN3vFo=";
+        aarch64-linux = "sha256-aZ03NALjjOexc0cnP3amdc7Pu11p9CNfTWdpD+yxG5A=";
      }
      .${stdenv.hostPlatform.system} or throwSystem;
  };
--- a/pkgs/by-name/lx/lxgw-neoxihei/package.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "lxgw-neoxihei";
-  version = "1.304";
+  version = "1.305";

  src = fetchurl {
    url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-WWXdmSKQhhxtYihQmNxcp/bGaZMHZf0R1dD9SRLYFuc=";
+    hash = "sha256-iTz77GBHaPA3hatPNpUI3mjCdCczWaXK3uF+KFKXXVw=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/ma/maia3/package.nix
+++ b/pkgs/by-name/ma/maia3/package.nix
@@ -0,0 +1,3 @@
+{ python3Packages }:
+
+python3Packages.toPythonApplication python3Packages.maia3
--- a/pkgs/by-name/ma/matrix-commander/package.nix
+++ b/pkgs/by-name/ma/matrix-commander/package.nix
@@ -33,7 +33,7 @@ python3Packages.buildPythonApplication rec {
  ]
  ++ (with python3Packages; [
    setuptools
-    (matrix-nio.override { withOlm = true; })
+    (matrix-nio.override { withVodozemac = true; })
    python-magic
    markdown
    pillow
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@@ -14,19 +14,19 @@

 python3Packages.buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.158.0";
+  version = "1.159.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "synapse";
    rev = "v${version}";
-    hash = "sha256-9H2qhEnmqgC3kAdmWWCMay6zZU8czjCX4S2AXHwMBIo=";
+    hash = "sha256-Fdbr+uMKFTZl1ETyaDavsSCpJYwS5+eLqifMlLGtDeA=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-rYO/1QRYS2J28RvgNXymcOa+2k+Djm+6kFmzUfYXoIQ=";
+    hash = "sha256-9VmEej1AKvGMMgbdyvm0DFZJ9sLP2WcV29+xVtOLV4g=";
  };

  build-system =
--- a/pkgs/by-name/mi/mistral-rs/package.nix
+++ b/pkgs/by-name/mi/mistral-rs/package.nix
@@ -74,14 +74,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mistral-rs";
-  version = "0.9.1";
+  version = "0.9.2";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "EricLBuehler";
    repo = "mistral.rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5W/CBFw28xBC7GnbpQ9jxRAdxXBtTdsD3X/YNR6z6iI=";
+    hash = "sha256-T7CKIQOCvJXAdYpwLzQ7oFs/xu30OIuxqa8GpYWLK9U=";
  };

  patches = [
@@ -130,7 +130,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
          ""
    '';

-  cargoHash = "sha256-VivnZNtIjnu1JOKaE7nEIse8300oB9oqGP0aly+9/OQ=";
+  cargoHash = "sha256-7Vp9nNvVbC8McJwQuiIMJWGfU42xtr6rL1/H8WJ1wkQ=";

  nativeBuildInputs = [
    pkg-config
@@ -228,6 +228,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "--skip=sandboxed_session_can_execute_python"
    "--skip=sandboxed_session_default_policy_can_execute_python"

+    # Upstream's v0.9.2 bump updated the version example in the generated CLI reference page
+    # but not in the clap doc comment it is generated from, so this golden test fails at the tag.
+    "--skip=docgen::cli_reference_matches_committed"
+
    # Linux namespace / seccomp tests require capabilities the nix build sandbox blocks
    "--skip=network_none_blocks_socket"
    "--skip=rlimit_nproc_caps_processes"
--- a/pkgs/by-name/mu/musl/package.nix
+++ b/pkgs/by-name/mu/musl/package.nix
@@ -177,9 +177,11 @@ stdenv.mkDerivation (finalAttrs: {
  passthru = {
    linuxHeaders = linuxHeaders;

-    # musl's threads are POSIX threads. `libgcc` and `libstdc++` have to be
-    # configured for the same threading model as each other, so rather than
-    # have each guess, they take it from the libc they are built against.
+    # musl's threads are POSIX threads.
+    #
+    # See the comment on `threadModel` in
+    # pkgs/development/compilers/gcc/ng/common/libgcc/default.nix for further
+    # details.
    threadModel = "posix";
  };

--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "namespace-cli";
-  version = "0.0.556";
+  version = "0.0.557";

  src = fetchFromGitHub {
    owner = "namespacelabs";
    repo = "foundation";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Vq9aOhQKz2nyjy+zXnaUxGbTrPBmyWeR0n26kReRd3I=";
+    hash = "sha256-EAHsfbCNLSZpfaWLbLh6Eb5D8PE7ZG4HBXuiH7okfF4=";
  };

-  vendorHash = "sha256-x4GWkINfOzcLFg7mCHG80Dpz7tkdcEDMj1oPAXM2n8w=";
+  vendorHash = "sha256-b9L3K2YxD7zhrZthgDzovNnYzaJda4XFYObokG7Nt28=";

  subPackages = [
    "cmd/nsc"
--- a/pkgs/by-name/ni/nirimod/package.nix
+++ b/pkgs/by-name/ni/nirimod/package.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  copyDesktopItems,
+  gobject-introspection,
+  gtk4,
+  libadwaita,
+  makeDesktopItem,
+  unstableGitUpdater,
+  wrapGAppsHook4,
+}:
+
+python3Packages.buildPythonApplication {
+  pname = "nirimod";
+  version = "0-unstable-2026-07-27";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "srinivasr";
+    repo = "nirimod";
+    rev = "fb62bb30a060cb37868231846810c98bc1eb22d4";
+    hash = "sha256-h4p5Nn7xFTJ+aHw2FALwMygDM5l0GXakvEwRxadx87k=";
+  };
+
+  build-system = [ python3Packages.hatchling ];
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    gobject-introspection
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gtk4
+    libadwaita
+  ];
+
+  dependencies = [ python3Packages.pygobject3 ];
+
+  postInstall = ''
+    install -Dm644 data/nirimod.svg $out/share/icons/hicolor/scalable/apps/nirimod.svg
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "io.github.nirimod";
+      exec = "nirimod";
+      icon = "nirimod";
+      desktopName = "NiriMod";
+      genericName = "Compositor Settings";
+      comment = "GUI configuration manager for the niri Wayland compositor";
+      categories = [
+        "Utility"
+        "Settings"
+        "DesktopSettings"
+      ];
+      keywords = [
+        "compositor"
+        "windowmanager"
+        "wayland"
+        "niri"
+        "settings"
+        "config"
+      ];
+      startupNotify = true;
+      startupWMClass = "nirimod";
+    })
+  ];
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Visual configuration interface for the niri Wayland compositor";
+    homepage = "https://github.com/srinivasr/nirimod";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sophronesis ];
+    platforms = lib.platforms.linux;
+    mainProgram = "nirimod";
+  };
+}
--- a/pkgs/by-name/op/opsdroid/package.nix
+++ b/pkgs/by-name/op/opsdroid/package.nix
@@ -36,7 +36,7 @@ python3Packages.buildPythonPackage rec {
    emoji
    get-video-properties
    ibm-watson
-    (matrix-nio.override { withOlm = true; })
+    (matrix-nio.override { withVodozemac = true; })
    mattermostdriver
    motor
    multidict
--- a/pkgs/by-name/pa/pantalaimon/package.nix
+++ b/pkgs/by-name/pa/pantalaimon/package.nix
@@ -43,7 +43,7 @@ python3Packages.buildPythonApplication rec {
      janus
      keyring
      logbook
-      (matrix-nio.override { withOlm = true; })
+      (matrix-nio.override { withVodozemac = true; })
      peewee
      platformdirs
      prompt-toolkit
--- a/pkgs/by-name/pa/pappl/package.nix
+++ b/pkgs/by-name/pa/pappl/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pappl";
-  version = "1.4.11";
+  version = "1.4.12";

  src = fetchFromGitHub {
    owner = "michaelrsweet";
    repo = "pappl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ai5cOyTdjIaOeLvWZBtn59dKHtaTeYZMJVdl4so1Zkc=";
+    hash = "sha256-WDMw8uWmUTk7LBZJbBxP6dZblNyTY4Ykt+Ab9CEondE=";
  };

  outputs = [
--- a/pkgs/by-name/pa/par-lang/package.nix
+++ b/pkgs/by-name/pa/par-lang/package.nix
@@ -19,16 +19,16 @@

 rustPlatform.buildRustPackage {
  pname = "par-lang";
-  version = "0-unstable-2026-07-29";
+  version = "0-unstable-2026-08-20";

  src = fetchFromGitHub {
    owner = "par-team";
    repo = "par-lang";
-    rev = "97e3ae546d7da1baa05bb0f4d523e39132e1d7ff";
-    hash = "sha256-gBXf2XYtlThr7X4uMfREeoYhmsfcqKU9z8rYX74gH1c=";
+    rev = "707327728de48aae5f8ae74ee7bbdbb61cb02a8a";
+    hash = "sha256-0u+9T5wMU63eU0O9ZAdmD5cHeFNpovSJGhuFQoxfMVM=";
  };

-  cargoHash = "sha256-8lG+cKN3/W+LYWhmOfDwGiq6u3nlLJaD5uNABaY0zRY=";
+  cargoHash = "sha256-wRgSLBFQKsv8mJL0mdwkcHJqMKhuVj0rcfqvm6JNlSM=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/pi/piped/package.nix
+++ b/pkgs/by-name/pi/piped/package.nix
@@ -12,13 +12,13 @@ let
 in
 buildNpmPackage rec {
  pname = "piped";
-  version = "0-unstable-2026-08-09";
+  version = "0-unstable-2026-08-13";

  src = fetchFromGitHub {
    owner = "TeamPiped";
    repo = "piped";
-    rev = "5ef4a0d0072753521cb7584075346623b8282402";
-    hash = "sha256-8vuanaSjspGkminCO2fTrGhecpoGgTcpEtl7YT2ZDYA=";
+    rev = "15f7e8a23b0f048e8110a449fa3720902ffed308";
+    hash = "sha256-zQqkF+MFDokN0DPBWfJfEhqaYzQkIGT/0ityYXMi5PM=";
  };

  nativeBuildInputs = [ pnpm ];
--- a/pkgs/by-name/pw/pwneye/package.nix
+++ b/pkgs/by-name/pw/pwneye/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  python3Packages,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "pwneye";
+  version = "1.3.2";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Hackerest";
+    repo = "pwneye";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-CF0A4o+J7KQByoWNRbl2OGh4saqKAf6jJCGgtVQ3y6o=";
+  };
+
+  pythonRelaxDeps = true;
+
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
+    attrs
+    certifi
+    charset-normalizer
+    idna
+    ifaddr
+    isodate
+    lxml
+    markdown-it-py
+    mdurl
+    onvif-python
+    ping3
+    platformdirs
+    pygments
+    pyqt6
+    pytz
+    pyyaml
+    requests
+    requests-file
+    requests-toolbelt
+    rich
+    rich-argparse
+    urllib3
+    zeep
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  pythonImportsCheck = [ "pwneye" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool for discovering and working with ONVIF and RTSP cameras";
+    homepage = "https://github.com/Hackerest/pwneye";
+    changelog = "https://github.com/Hackerest/pwneye/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "pwneye";
+  };
+})
--- a/pkgs/by-name/qu/quark/package.nix
+++ b/pkgs/by-name/qu/quark/package.nix
@@ -7,7 +7,7 @@

 stdenv.mkDerivation {
  pname = "quark";
-  version = "unstable-2021-02-22";
+  version = "0-unstable-2021-02-22";

  src = fetchgit {
    url = "git://git.suckless.org/quark";
--- a/pkgs/by-name/qu/quickemu/package.nix
+++ b/pkgs/by-name/qu/quickemu/package.nix
@@ -70,8 +70,13 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = ''
    sed -i \
-      -e '/OVMF_CODE_4M.secboot.fd/s|ovmfs=(|ovmfs=("${OVMFFull.firmware}","${OVMFFull.variables}" |' \
-      -e '/OVMF_CODE_4M.fd/s|ovmfs=(|ovmfs=("${OVMF.firmware}","${OVMF.variables}" |' \
+      ${lib.optionalString stdenv.hostPlatform.isx86_64 ''
+        -e '/OVMF_CODE_4M.secboot.fd/s|ovmfs=(|ovmfs=("${OVMFFull.firmware}","${OVMFFull.variablesMs}" |' \
+        -e '/OVMF_CODE_4M.fd/s|ovmfs=(|ovmfs=("${OVMF.firmware}","${OVMF.variables}" |' \
+      ''} \
+      ${lib.optionalString stdenv.hostPlatform.isAarch64 ''
+        -e '/AAVMF_CODE.fd/s|ovmfs=(|ovmfs=("${OVMF.firmware}","${OVMF.variables}" |' \
+      ''} \
      -e '/cp "''${VARS_IN}" "''${VARS_OUT}"/a chmod +w "''${VARS_OUT}"' \
      -e 's/Icon=.*qemu.svg/Icon=qemu/' \
      -e 's,\[ -x "\$(command -v smbd)" \],true,' \
--- a/pkgs/by-name/ra/randomx/package.nix
+++ b/pkgs/by-name/ra/randomx/package.nix
@@ -7,7 +7,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "randomX";
-  version = "1.2.2";
+  version = "1.2.3";

  nativeBuildInputs = [ cmake ];

@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "tevador";
    repo = "randomX";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-15hRPPEo48SL09gYpGtdpXqsVlOTQuMRn4AoXQJWEMI=";
+    sha256 = "sha256-H5tsmvCeMYMpLd+XHe5365QRMaXaUF7GkXk21ZH2W1E=";
  };

  meta = {
--- a/pkgs/by-name/re/redis/package.nix
+++ b/pkgs/by-name/re/redis/package.nix
@@ -27,16 +27,23 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "redis";
-  version = "8.8.1";
+  version = "8.10.1";

  src = fetchFromGitHub {
    owner = "redis";
    repo = "redis";
    tag = finalAttrs.version;
-    hash = "sha256-VIzIv7NOmvuXygMXyWpYpnwKQ2rGguaGRd48/QjyYD8=";
+    hash = "sha256-fGLuOuiM3VHj70qlSpb2s25RYD8gFARrqwAhW6CIHXE=";
  };

-  patches = lib.optional useSystemJemalloc (fetchpatch2 {
+  patches = [
+    # https://github.com/redis/redis/pull/15585
+    (fetchpatch2 {
+      url = "https://github.com/redis/redis/commit/c027c8effe13564bcbc903741305acd929cc23da.patch";
+      hash = "sha256-MynmKLQ04JjyHMVbfeSIEnKaj4jvjS1FjQNpfvQz3Pw=";
+    })
+  ]
+  ++ lib.optional useSystemJemalloc (fetchpatch2 {
    url = "https://gitlab.archlinux.org/archlinux/packaging/packages/redis/-/raw/102cc861713c796756abd541bf341a4512eb06e6/redis-5.0-use-system-jemalloc.patch";
    hash = "sha256-A9qp+PWQRuNy/xmv9KLM7/XAyL7Tzkyn0scpVCGngcc=";
  });
@@ -112,6 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
      --timeout 2000 \
      --clients "$CLIENTS" \
      --tags -leaks \
+      --tags -defrag \
      --skipunit integration/aof-multi-part \
      --skipunit integration/failover \
      --skipunit integration/replication-rdbchannel \
--- a/pkgs/by-name/sa/sage/package.nix
+++ b/pkgs/by-name/sa/sage/package.nix
@@ -1,6 +1,5 @@
 {
  pkgs,
-  stdenv,
  withDoc ? false,
  requireSageTests ? true,
  extraPythonPackages ? ps: [ ],
@@ -131,6 +130,10 @@ let
      rpy2
      sphinx
      pillow
+      # sage.misc.cython compiles code at runtime using setuptools and
+      # distutils (the latter provided by setuptools' shim on python >= 3.12).
+      # Not declared upstream: https://github.com/sagemath/sage/issues/33065
+      setuptools
    ]
    ++ extraPythonPackages python3.pkgs;

--- a/pkgs/by-name/sa/sage/sage-src.nix
+++ b/pkgs/by-name/sa/sage/sage-src.nix
@@ -1,6 +1,7 @@
 {
-  stdenv,
  lib,
+  stdenv,
+  bashNonInteractive,
  fetchFromGitHub,
  fetchpatch2,
  fetchurl,
@@ -11,17 +12,25 @@
 # This is done because multiple derivations rely on these sources and they should
 # all get the same sources with the same patches applied.

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  version = "10.9";
  pname = "sage-src";

+  __structuredAttrs = true;
+  strictDeps = true;
+
  src = fetchFromGitHub {
    owner = "sagemath";
    repo = "sage";
-    rev = version;
+    tag = finalAttrs.version;
    hash = "sha256-8IBCQYdmL7ane7/WOoogArbwgqPDtL8ecz9GIzuEfOU=";
  };

+  # The shipped scripts (e.g. build/bin/sage-site) use `#!/usr/bin/env bash`.
+  # With `strictDeps`, patchShebangs only searches HOST_PATH, so bash has to be
+  # a buildInput for those to get patched.
+  buildInputs = [ bashNonInteractive ];
+
  # contains essential files (e.g., setup.cfg) generated by the bootstrap script.
  # TODO: investigate https://github.com/sagemath/sage/pull/35950
  configure-src = fetchurl {
@@ -160,7 +169,7 @@ stdenv.mkDerivation rec {
    ./patches/scipy-1_18-workaround.patch
  ];

-  patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
+  patches = finalAttrs.nixPatches ++ finalAttrs.bugfixPatches ++ finalAttrs.packageUpgradePatches;

  # do not create .orig backup files if patch applies with fuzz
  patchFlags = [
@@ -195,11 +204,11 @@ stdenv.mkDerivation rec {
  '';

  buildPhase = ''
-    tar xzf ${configure-src}
+    tar xzf ${finalAttrs.configure-src}
    rm configure
  '';

  installPhase = ''
    cp -r . "$out"
  '';
-}
+})
--- a/pkgs/by-name/sc/scdl/package.nix
+++ b/pkgs/by-name/sc/scdl/package.nix
@@ -7,12 +7,12 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "scdl";
-  version = "3.0.7";
+  version = "3.0.8";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-3jwruTldVZ/j+i0X0+EW6JX8CwGQAZOGi2894MTrmVk=";
+    hash = "sha256-dThICN/QF79LemNj621gX9EW4SXOs/hqPHLh0NGLxi8=";
  };

  build-system = [ python3Packages.setuptools ];
--- a/pkgs/by-name/sc/scopehal-apps/package.nix
+++ b/pkgs/by-name/sc/scopehal-apps/package.nix
@@ -4,43 +4,41 @@
  fetchFromGitHub,
  cmake,
  pkg-config,
-  gtkmm3,
-  cairomm,
+  gtk3,
  yaml-cpp,
  glfw,
+  libpng,
  libtirpc,
  liblxi,
  libsigcxx,
-  glew,
-  zstd,
+  zlib,
  wrapGAppsHook3,
  makeBinaryWrapper,
  writeDarwinBundle,
  shaderc,
  vulkan-headers,
  vulkan-loader,
-  vulkan-tools,
  glslang,
  spirv-tools,
-  ffts,
  moltenvk,
  llvmPackages,
  hidapi,
+  wayland,
+  wayland-scanner,
 }:

 let
-  pname = "scopehal-apps";
-  version = "0.1.1";
+  version = "0.2.2";
 in
 stdenv.mkDerivation {
  pname = "scopehal-apps";
-  version = "${version}";
+  inherit version;

  src = fetchFromGitHub {
    owner = "ngscopeclient";
    repo = "scopehal-apps";
    tag = "v${version}";
-    hash = "sha256-7ZXfxfRa+1fbMj2IDF/boNL/qCy4i9IyMnzIgOZunDw=";
+    hash = "sha256-LhkhSuoj6lHz3zB4U37qDkMxfV1UktIjwJvwbVGKDDM=";
    fetchSubmodules = true;
  };

@@ -54,6 +52,7 @@ stdenv.mkDerivation {
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    wrapGAppsHook3
+    wayland-scanner
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    makeBinaryWrapper
@@ -61,23 +60,21 @@ stdenv.mkDerivation {
  ];

  buildInputs = [
-    cairomm
-    glew
    glfw
    glslang
+    hidapi
    liblxi
+    libpng
    libsigcxx
    vulkan-headers
    vulkan-loader
-    vulkan-tools
    yaml-cpp
-    zstd
-    hidapi
+    zlib
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    ffts
-    gtkmm3
+    gtk3
    libtirpc
+    wayland
  ]
  ++ lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -89,16 +86,11 @@ stdenv.mkDerivation {
    "-DNGSCOPECLIENT_PACKAGE_VERSION_LONG=v${version}-0"
  ];

-  env.NIX_CFLAGS_COMPILE = toString [
-    # error: variable 'empty_string' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
-    "-Wno-error=uninitialized"
-  ];
-
  patches = [
    ./remove-required-lsb-release.patch
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    ./remove-brew-molten-vk-lookup.patch
+    ./remove-macos-bundle-fixup.patch
  ];

  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
--- a/pkgs/by-name/sc/scopehal-apps/remove-brew-molten-vk-lookup.patch
+++ b/pkgs/by-name/sc/scopehal-apps/remove-brew-molten-vk-lookup.patch
@@ -1,12 +1,17 @@
+MoltenVK comes from nixpkgs rather than Homebrew, so the `brew --prefix`
+lookup is a hard build failure here. fixup_bundle() copies dependencies into
+the output and rewrites their install names, which fails in the Nix store
+layout, and signing.cmake resolves its bundle root to
+${CMAKE_INSTALL_PREFIX}/../.. -- i.e. /nix -- and would chmod and re-sign every
+dylib it finds there.
+
 diff --git a/src/ngscopeclient/CMakeLists.txt b/src/ngscopeclient/CMakeLists.txt
-index fb6d19fa..25611981 100644
 --- a/src/ngscopeclient/CMakeLists.txt
 +++ b/src/ngscopeclient/CMakeLists.txt
-@@ -249,31 +249,6 @@ if(LINUX)
- 		DESTINATION share/mime/packages)
+@@ -278,28 +278,9 @@ if(LINUX)
 endif()
- 
-if(APPLE)
+
+ if(APPLE)
 -	set(APPS "\${CMAKE_INSTALL_PREFIX}/bin/ngscopeclient")
 -	set(DIRS "\${CMAKE_INSTALL_PREFIX}/lib")
 -	set(FRAMEWORKS "\${CMAKE_INSTALL_PREFIX}/Frameworks")
@@ -20,17 +25,15 @@ index fb6d19fa..25611981 100644
 -	if(NOT MOLTEN_VK_RESULT EQUAL 0)
 -		message(FATAL_ERROR "failed to find Homebrew prefix for molten-vk")
 -	endif()
-	# https://vulkan.lunarg.com/doc/view/1.3.275.0/mac/getting_started.html#application-bundle-structure-on-macos
-	install(FILES "${CMAKE_SOURCE_DIR}/src/ngscopeclient/macos/MoltenVK_icd.json"
-		DESTINATION bin/vulkan/icd.d/)
+ 	# https://vulkan.lunarg.com/doc/view/1.3.275.0/mac/getting_started.html#application-bundle-structure-on-macos
+ 	install(FILES "${CMAKE_SOURCE_DIR}/src/ngscopeclient/macos/MoltenVK_icd.json"
+ 		DESTINATION bin/vulkan/icd.d/)
 -	install(FILES "${MOLTEN_VK_OUTPUT}/lib/libMoltenVK.dylib" DESTINATION lib)
 -	install(CODE "
 -		include(BundleUtilities)
-		fixup_bundle(\"${APPS}\" \"lib/libMoltenVK.dylib\" \"${DIRS}\")
+-		fixup_bundle(\"${APPS}\" \"${DIRS}/libMoltenVK.dylib\" \"${DIRS}\")
 -		include(\"${CMAKE_SOURCE_DIR}/src/ngscopeclient/macos/signing.cmake\")
 -		")
-endif()
-
+ endif()
+
 # ngscopeclient Windows portable zip/MSI installer build
- if(WIXPATH AND WIN32)
- 	# Run the command to get /mingw64/bin full path using where gcc
--- a/pkgs/by-name/sc/scopehal-apps/remove-required-lsb-release.patch
+++ b/pkgs/by-name/sc/scopehal-apps/remove-required-lsb-release.patch
@@ -1,8 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 69d8c7b..a2f3b8c 100644
+index 45deed0..a2f3b8c 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -337,14 +337,14 @@ set(CPACK_STRIP_FILES TRUE)
+@@ -353,15 +353,15 @@ set(CPACK_STRIP_FILES TRUE)

 # Figure out what distro version we're on
 if(LINUX)
@@ -20,3 +20,4 @@ index 69d8c7b..a2f3b8c 100644
 +		)

 	message(STATUS "Linux distribution target for packaging: name ${DISTRO_NAME}, version ${DISTRO_VER}")
+
--- a/pkgs/by-name/sc/scroll-reverser/package.nix
+++ b/pkgs/by-name/sc/scroll-reverser/package.nix
@@ -3,13 +3,14 @@
  stdenvNoCC,
  fetchurl,
  unzip,
+  nix-update-script,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "scroll-reverser";
  version = "1.9";

  src = fetchurl {
-    url = "https://web.archive.org/web/20250427052440/https://pilotmoon.com/downloads/ScrollReverser-${finalAttrs.version}.zip";
+    url = "https://pilotmoon.com/downloads/ScrollReverser-${finalAttrs.version}.zip";
    hash = "sha256-CWHbtvjvTl7dQyvw3W583UIZ2LrIs7qj9XavmkK79YU=";
  };

@@ -26,9 +27,19 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "v([0-9]*.*)"
+      "--url"
+      "https://github.com/pilotmoon/Scroll-Reverser"
+    ];
+  };
+
  meta = {
    description = "Tool to reverse the direction of scrolling";
    homepage = "https://pilotmoon.com/scrollreverser/";
+    changelog = "https://github.com/pilotmoon/Scroll-Reverser/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [
      stackptr
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@@ -9,7 +9,7 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "seaweedfs";
-  version = "4.42";
+  version = "4.43";

  src = fetchFromGitHub {
    owner = "seaweedfs";
@@ -22,10 +22,10 @@ buildGoModule (finalAttrs: {
      find "$out" -name .git -print0 | xargs -0 rm -rf
      popd
    '';
-    hash = "sha256-EndpPf3fywR/exE8r8DAPwPL/BUQjx2hH099C5xLmos=";
+    hash = "sha256-oFltUyy9yw1c/AlaO+0tNL+ZRkfEBHQ4rgAGcZgq7e8=";
  };

-  vendorHash = "sha256-5fvW7dibM8543gC997oHW2b7GSNqSHimcAHzHkW/50g=";
+  vendorHash = "sha256-73AwEvxopbKWAuJIzq4VHHW1QtTOkWKPCiyWBCqD6Ps=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/sh/shadps4-qtlauncher/package.nix
+++ b/pkgs/by-name/sh/shadps4-qtlauncher/package.nix
@@ -17,13 +17,13 @@
 }:
 clangStdenv.mkDerivation (finalAttrs: {
  pname = "shadps4-qtlauncher";
-  version = "0-unstable-2026-08-08";
+  version = "0-unstable-2026-08-18";

  src = fetchFromGitHub {
    owner = "shadps4-emu";
    repo = "shadps4-qtlauncher";
-    rev = "a12b988ef35d98f2222a614c05498b27fef87121";
-    hash = "sha256-ux9iXNV5QiBCyLCyDYTN1WtO+DyMlXrr+8xWX/4TmD4=";
+    rev = "a30486c3e0a17460c44cf1caf15559c6f3331e57";
+    hash = "sha256-uVTy+0JvJUREY0qt+hkggSjyN1swGdG9aAYQvWNiNs4=";

    postCheckout = ''
      git -C "$out" rev-parse --short=8 HEAD > $out/COMMIT
--- a/pkgs/by-name/sh/shadps4/package.nix
+++ b/pkgs/by-name/sh/shadps4/package.nix
@@ -2,8 +2,7 @@
  lib,
  clangStdenv,
  fetchFromGitHub,
-  fetchpatch2,
-  makeWrapper,
+  makeBinaryWrapper,

  nixosTests,
  alsa-lib,
@@ -71,13 +70,13 @@ let
 in
 clangStdenv.mkDerivation (finalAttrs: {
  pname = "shadps4";
-  version = "0.17.0";
+  version = "0.18.0";

  src = fetchFromGitHub {
    owner = "shadps4-emu";
    repo = "shadPS4";
    tag = "v.${finalAttrs.version}";
-    hash = "sha256-Z3UwxK+0D3RXKTM0ybYG4U42bInjF05KlMXzxN4UcNg=";
+    hash = "sha256-n2q4qmbknkT6kb6I5aeu6tU6EzSIfdrV+ptzQvhUJ/Q=";

    postCheckout = ''
      git -C "$out" rev-parse --short=8 HEAD > $out/COMMIT
@@ -105,15 +104,6 @@ clangStdenv.mkDerivation (finalAttrs: {
  strictDeps = true;
  __structuredAttrs = true;

-  patches = [
-    # https://github.com/shadps4-emu/shadPS4/pull/4786
-    (fetchpatch2 {
-      name = "use-system-zarchive.patch";
-      url = "https://github.com/shadps4-emu/shadPS4/commit/71c48b43570ac8df545d3d96261b0ec7fa37c808.patch?full_index=1";
-      hash = "sha256-MQiw+DGi/85nTSAVrNw2GmwhbBD7/Xy3lCIDMg1HxxU=";
-    })
-  ];
-
  postPatch = ''
    substituteInPlace src/common/scm_rev.cpp.in \
      --replace-fail @APP_VERSION@ ${finalAttrs.version} \
@@ -129,7 +119,7 @@ clangStdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    cmake
    pkg-config
-    makeWrapper
+    makeBinaryWrapper
  ];

  buildInputs = [
--- a/pkgs/by-name/si/signalbackup-tools/package.nix
+++ b/pkgs/by-name/si/signalbackup-tools/package.nix
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "signalbackup-tools";
-  version = "20260718";
+  version = "20260820";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = "signalbackup-tools";
    tag = finalAttrs.version;
-    hash = "sha256-C/yAq2i8r9gk0LCOi6kaM/kusklu/jeJ61H45PnSWQY=";
+    hash = "sha256-PbyHv1UhOjshEYakPpp0NRxwi8COAtK5cOBXisK7JqY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sk/skyscraper/package.nix
+++ b/pkgs/by-name/sk/skyscraper/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "skyscraper";
-  version = "3.20.3";
+  version = "3.20.4";

  src = fetchFromGitHub {
    owner = "Gemba";
    repo = "skyscraper";
    tag = finalAttrs.version;
-    hash = "sha256-/N9yMJuz1S/kcPiO3AxHE2YlEnZzPwu2/yCfGjzbbcM=";
+    hash = "sha256-oTFsRgZ9+iRP9IA6YFD9ZJCh0+UhAaQLbSYkH7Z/GrU=";
  };

  strictDeps = true;
--- a/pkgs/by-name/sp/spectral-mic/package.nix
+++ b/pkgs/by-name/sp/spectral-mic/package.nix
@@ -0,0 +1,84 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitea,
+  pkg-config,
+  makeWrapper,
+  libxkbcommon,
+  wayland,
+  libx11,
+  libxcursor,
+  libxi,
+  libxrandr,
+  fontconfig,
+  pipewire,
+  versionCheckHook,
+}:
+let
+  # Loaded via dlopen at runtime by winit (x11-dl, xkbcommon-dl) and
+  # wayland-sys; everything linked at build time (fontconfig, pipewire)
+  # resolves through the binary's RUNPATH instead.
+  dlopenLibs = [
+    libxkbcommon
+    wayland
+    libx11
+    libxcursor
+    libxi
+    libxrandr
+  ];
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "spectral-mic";
+  version = "0.8.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "mmc";
+    repo = "spectral";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2HaTOLhHVLYKnEsWjvLf1GqPvtBdrjotG1kZj9mbwkk=";
+  };
+
+  cargoHash = "sha256-OMrYfPQim9H178LnRUg2Ues9Nf2txz4u+tEddrllKME=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+    makeWrapper
+  ];
+
+  buildInputs = [
+    fontconfig
+    pipewire
+  ];
+
+  postInstall = ''
+    install -Dm644 assets/page.codeberg.mmc.Spectral.desktop $out/share/applications/page.codeberg.mmc.Spectral.desktop
+    install -Dm644 assets/page.codeberg.mmc.Spectral.metainfo.xml $out/share/metainfo/page.codeberg.mmc.Spectral.metainfo.xml
+    install -Dm644 assets/spectral.png $out/share/icons/hicolor/512x512/apps/page.codeberg.mmc.Spectral.png
+    install -Dm644 THIRD-PARTY.md $out/share/licenses/spectral-mic/THIRD-PARTY.md
+
+    wrapProgram $out/bin/spectral \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath dlopenLibs}"
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Real-time audio noise suppression application";
+    longDescription = ''
+      Spectral is a real-time audio noise suppression application powered by
+      RNNoise, a hybrid DSP and neural-network-based noise suppression system.
+      It creates a virtual microphone that can be used with any application,
+      filtering out background noise in real-time.
+    '';
+    homepage = "https://codeberg.org/mmc/spectral";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.mmclinton ];
+    mainProgram = "spectral";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@@ -12,16 +12,16 @@

 buildGoModule (finalAttrs: {
  pname = "stackit-cli";
-  version = "0.70.0";
+  version = "0.71.0";

  src = fetchFromGitHub {
    owner = "stackitcloud";
    repo = "stackit-cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-jKOJPpmELJBkljVetIJkd5cZ2FMz687FEUCwV2ZVFjA=";
+    hash = "sha256-eFFa55BJwnRRnQT7zNFwRH1gBvrukY0VCMOjfJvg+58=";
  };

-  vendorHash = "sha256-ptS1n1Z74q6NnFiOqDrBZLjjfNdpaZuZiggXKg5hRO4=";
+  vendorHash = "sha256-ObWX+itioQNGQonFFRqVKaVpatq638DNMa3KkoLyBqc=";

  subPackages = [ "." ];

--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -5,7 +5,7 @@
  fetchFromGitHub,
  alsa-utils,
  copyDesktopItems,
-  electron_41,
+  electron_42,
  libicns,
  makeDesktopItem,
  makeWrapper,
@@ -15,7 +15,7 @@
 }:

 let
-  electron = electron_41;
+  electron = electron_42;
 in
 buildNpmPackage rec {
  pname = "teams-for-linux";
--- a/pkgs/by-name/te/terminal-oscilloscope/lock.json
+++ b/pkgs/by-name/te/terminal-oscilloscope/lock.json
@@ -0,0 +1,14 @@
+{
+  "depends": [
+    {
+      "method": "fetchzip",
+      "packages": ["illwill"],
+      "path": "",
+      "rev": "v0.4.1",
+      "sha256": "0hiic5yjsaw6sgl1jzmfpm5g6a5ckzmd29c3pzg30glchn2g94sk",
+      "srcDir": "",
+      "subDir": "",
+      "url": "https://github.com/johnnovak/illwill/archive/v0.4.1.tar.gz"
+    }
+  ]
+}
--- a/pkgs/by-name/te/terminal-oscilloscope/package.nix
+++ b/pkgs/by-name/te/terminal-oscilloscope/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildNimPackage,
+  fetchFromGitHub,
+  makeWrapper,
+  ffmpeg,
+  wireplumber,
+}:
+
+buildNimPackage (finalAttrs: {
+  pname = "terminal-oscilloscope";
+  version = "0.1.0-unstable-2026-04-07";
+
+  src = fetchFromGitHub {
+    owner = "rolandnsharp";
+    repo = "terminal-oscilloscope";
+    rev = "f2a94befaa4b9de1c01a410f132e08032b447844";
+    hash = "sha256-L1/1Hg7ig286KbNuo9ED5mJxpUIVBFdH5KHnVdBm390=";
+  };
+
+  lockFile = ./lock.json;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/osc \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ ffmpeg ]}" \
+      --prefix PATH : "${lib.makeBinPath [ wireplumber ]}"
+  '';
+
+  meta = {
+    description = "Terminal oscilloscope with CRT phosphor physics";
+    homepage = "https://github.com/rolandnsharp/terminal-oscilloscope";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sophronesis ];
+    platforms = lib.platforms.linux;
+    mainProgram = "osc";
+  };
+})
--- a/pkgs/by-name/te/testkube/package.nix
+++ b/pkgs/by-name/te/testkube/package.nix
@@ -2,15 +2,19 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 buildGoModule (finalAttrs: {
  pname = "testkube";
  version = "2.12.2";

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "kubeshop";
    repo = "testkube";
-    rev = "${finalAttrs.version}";
+    tag = finalAttrs.version;
    hash = "sha256-5nKlOpSkr5YkocbfSZ/Zx19X3QSucSZV2UoNUAi09dI=";
  };

@@ -25,6 +29,14 @@ buildGoModule (finalAttrs: {

  subPackages = [ "cmd/kubectl-testkube" ];

+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
  meta = {
    description = "Kubernetes-native framework for test definition and execution";
    homepage = "https://github.com/kubeshop/testkube/";
--- a/pkgs/by-name/te/tetro-tui/package.nix
+++ b/pkgs/by-name/te/tetro-tui/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  makeDesktopItem,
+  copyDesktopItems,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "tetro-tui";
+  version = "3.6.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Strophox";
+    repo = "tetro-tui";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-i/d+i6E0ClMAAjC6zB9Lt26LYEcjvR01MCzGne2EXNQ=";
+  };
+
+  cargoHash = "sha256-LTHokF9T7nRvvzfQWSL9igTHmvV+w40Pm4z/i0y7goA=";
+
+  nativeBuildInputs = [
+    copyDesktopItems
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "tetro-tui";
+      desktopName = "Tetro TUI";
+      exec = "tetro-tui";
+      terminal = true;
+      comment = "Cross-platform terminal game where tetrominos fall and stack";
+      categories = [
+        "Game"
+        "ArcadeGame"
+      ];
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Cross-platform terminal game where tetrominos fall and stack";
+    homepage = "https://github.com/Strophox/tetro-tui";
+    changelog = "https://github.com/Strophox/tetro-tui/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ gl1tchxd ];
+    mainProgram = "tetro-tui";
+  };
+})
--- a/pkgs/by-name/ti/tilix/package.nix
+++ b/pkgs/by-name/ti/tilix/package.nix
@@ -73,7 +73,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = lib.licenses.mpl20;
    maintainers = with lib.maintainers; [
      midchildan
-      jtbx
    ];
    platforms = lib.platforms.linux;
    mainProgram = "tilix";
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`d10:created by13:mktorrent 1.113:creation datei1772926249e4:infod6:lengthi1097e4:name7:COPYING12:piece lengthi262144e6:pieces20:€åÏÊ\c™èçæÉ\Q3Ní-e8:url-list96:https://raw.githubusercontent.com/NixOS/nixpkgs/3d82431ec4b51262989559b821b83abe4a9f6dbd/COPYINGe`