Merge staging-next into staging

2026-09-28 02:40:50 +00:00 · 2026-09-03 00:26:03 +00:00
parent 36880c80d8 89af367cd4
commit 259a3d71dc
146 changed files with 1376 additions and 1777 deletions
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -157,6 +157,16 @@

 - `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.

+- `buildMozillaMach` is now using `enable<feature>` and `with<dependency>`
+  terminology from RFC 169 and the `wrapFirefox` and `wrapThunderbird` functions
+  check for these new attribute names on the passed package.
+  The `privacySupport` function argument has been replaced by multiple
+  granular options corresponding to individual features: `enableDataReporting`,
+  `enableLocation`, `enableWebRTC`.
+  The `requireSigning` and `allowAddonSideload` function arguments moved from
+  the outer to the inner function and were renamed to `enableAddonSigning` and
+  `enableAddonSideload`, respectively.
+
 - `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
  removed, as announced in the 26.05 release. Packages still using them now
  throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)
@@ -209,6 +219,8 @@
  They were missing before because Ceph omitted logs when this directory was missing.
  Ceph logs can grow large, so you may want to configure rotation of these logs.

+- Firefox wrapper now accepts an optional `appDataDir` argument, which sets `MOZ_APP_DATA` to relocate Firefox application data. This is especially useful on macOS 27 and later, where wrapped Firefox applications may be denied access to profiles in traditional application data directory.
+
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/doc/manual/administration/systemd-state.section.md
+++ b/nixos/doc/manual/administration/systemd-state.section.md
@@ -47,6 +47,6 @@ form to `/var/log/journal/{machine-id}`; if (locally) persisting the entire log
 is desired, it is recommended to make all of `/var/log/journal` persistent.

 If not, one can set `Storage=volatile` in {manpage}`journald.conf(5)`
-([`services.journald.storage = "volatile";`](#opt-services.journald.storage)),
+([`services.journald.settings.Journal.Storage = "volatile";`](#opt-services.journald.settings.Journal)),
 which disables journal persistence and causes it to be written to
 `/run/log/journal`.
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -217,6 +217,15 @@

 - The papra NixOS module is now hardening the systemd unit by default. If this breaks any of the configured directories, please reconfigure them through `services.papra.environment` to enable sandbox passthrough.

+- `services.selfoss.extraConfig` and `services.selfoss.database` have been removed in favor of the structured [](#opt-services.selfoss.settings) option. When moving the `database` options to `settings`, you should also switch to the upstream naming:
+
+  - `type` → [`db_type`](#opt-services.selfoss.settings.db_type)
+  - `host` → [`db_host`](#opt-services.selfoss.settings.db_host)
+  - `name` → [`db_database`](#opt-services.selfoss.settings.db_database)
+  - `username` → [`db_user`](#opt-services.selfoss.settings.db_user)
+  - `password` → [`db_password`](#opt-services.selfoss.settings.db_password)
+  - `port` → [`db_port`](#opt-services.selfoss.settings.db_port)
+
 - `slskd` has been updated to v0.25.0, which renames the `global` option to `transfers`. Please review the [changelog](https://github.com/slskd/slskd/releases#release-0.25.0).

 - [firefox-syncserver.database.type](#opt-services.firefox-syncserver.database.type) no longer defaults to `"mysql"`. You must now explicitly choose between `"mysql"` and `"postgresql"`. New deployments should prefer PostgreSQL.
--- a/nixos/modules/config/nix.nix
+++ b/nixos/modules/config/nix.nix
@@ -252,6 +252,16 @@ in
              '';
            };

+            experimental-features = mkOption {
+              type = with types; listOf str;
+              default = [ ];
+              example = [ "ca-derivations" ];
+              description = ''
+                List of experimental features to enable in Nix.
+                See <https://nixos.org/manual/nix/stable/development/experimental-features> for available features.
+              '';
+            };
+
            sandbox = mkOption {
              type = types.either types.bool (types.enum [ "relaxed" ]);
              default = true;
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -371,7 +371,6 @@ let
          "gfxmenu"
          "gfxterm"
          "gfxterm_background"
-          "gfxterm_menu"
          "test"
          "loadenv"
          "all_video"
--- a/nixos/modules/services/logging/rsyslogd.nix
+++ b/nixos/modules/services/logging/rsyslogd.nix
@@ -84,6 +84,8 @@ in

  config = lib.mkIf cfg.enable {

+    services.journald.settings.Journal.ForwardToSyslog = lib.mkOptionDefault true;
+
    environment.systemPackages = [ pkgs.rsyslog ];

    systemd.services.syslog = {
--- a/nixos/modules/services/logging/syslog-ng.nix
+++ b/nixos/modules/services/logging/syslog-ng.nix
@@ -77,6 +77,8 @@ in
  };

  config = lib.mkIf cfg.enable {
+    services.journald.settings.Journal.ForwardToSyslog = lib.mkOptionDefault true;
+
    systemd.services.syslog-ng = {
      description = "syslog-ng daemon";
      wantedBy = [ "multi-user.target" ];
--- a/nixos/modules/services/security/step-ca.nix
+++ b/nixos/modules/services/security/step-ca.nix
@@ -54,6 +54,15 @@ in
          :::
        '';
      };
+      extraArgs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [
+          "--resolver=10.1.2.3:53"
+          "--quiet"
+        ];
+        description = "Ad-hoc command-line arguments passed to the service at startup.";
+      };
      intermediatePasswordFile = lib.mkOption {
        type = lib.types.nullOr lib.types.externalPath;
        default = null;
@@ -114,6 +123,7 @@ in
              + lib.optionalString (
                cfg.intermediatePasswordFile != null
              ) " --password-file \${CREDENTIALS_DIRECTORY}/intermediate_password"
+              + lib.optionalString (cfg.extraArgs != [ ]) " ${lib.escapeShellArgs cfg.extraArgs}"
            )
          ];

--- a/nixos/modules/services/web-apps/selfoss.nix
+++ b/nixos/modules/services/web-apps/selfoss.nix
@@ -4,33 +4,75 @@
  pkgs,
  ...
 }:
-with lib;
+
 let
+  inherit (lib)
+    mapAttrs
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    ;
+
  cfg = config.services.selfoss;

  poolName = "selfoss_pool";

  dataDir = "/var/lib/selfoss";

-  selfoss-config =
-    let
-      db_type = cfg.database.type;
-      default_port = if (db_type == "mysql") then 3306 else 5342;
-    in
-    pkgs.writeText "selfoss-config.ini" ''
-      [globals]
-      ${lib.optionalString (db_type != "sqlite") ''
-        db_type=${db_type}
-        db_host=${cfg.database.host}
-        db_database=${cfg.database.name}
-        db_username=${cfg.database.user}
-        db_password=${cfg.database.password}
-        db_port=${toString (if (cfg.database.port != null) then cfg.database.port else default_port)}
-      ''}
-      ${cfg.extraConfig}
-    '';
+  settingsFormat = pkgs.formats.iniWithGlobalSection {
+    mkKeyValue = lib.generators.mkKeyValueDefault {
+      mkValueString =
+        v:
+        if v == null then
+          ""
+        else if v == true then
+          "1"
+        else if v == false then
+          "0"
+        else
+          lib.generators.mkValueStringDefault { } v;
+    } "=";
+  };
+
+  selfoss-config = settingsFormat.generate "config.ini" { globalSection = cfg.settings; };
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "type" ]
+      [ "services" "selfoss" "settings" "db_type" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "host" ]
+      [ "services" "selfoss" "settings" "db_host" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "name" ]
+      [ "services" "selfoss" "settings" "db_database" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "username" ]
+      [ "services" "selfoss" "settings" "db_user" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "password" ]
+      [ "services" "selfoss" "settings" "db_password" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "selfoss" "database" "port" ]
+      [ "services" "selfoss" "settings" "db_port" ]
+    )
+    (lib.mkRemovedOptionModule [ "services" "selfoss" "extraConfig" ] ''
+      Use services.selfoss.settings instead.
+
+      This is part of the general move to use structured settings instead of raw
+      text for config as introduced by RFC0042:
+      https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md
+    '')
+  ];
+
  options = {
    services.selfoss = {
      enable = mkEnableOption "selfoss";
@@ -54,67 +96,75 @@ in
        '';
      };

-      database = {
-        type = mkOption {
-          type = types.enum [
-            "pgsql"
-            "mysql"
-            "sqlite"
-          ];
-          default = "sqlite";
-          description = ''
-            Database to store feeds. Supported are sqlite, pgsql and mysql.
-          '';
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          # Only single level of config supported
+          freeformType = types.attrsOf settingsFormat.lib.types.atom;
+
+          options = {
+            db_type = mkOption {
+              type = types.enum [
+                "pgsql"
+                "mysql"
+                "sqlite"
+              ];
+              default = "sqlite";
+              description = ''
+                Database to store feeds. Supported are sqlite, pgsql and mysql.
+              '';
+            };
+
+            db_host = mkOption {
+              type = types.str;
+              default = "localhost";
+              description = ''
+                Host of the database (has no effect if type is "sqlite").
+              '';
+            };
+
+            db_database = mkOption {
+              type = types.str;
+              default = "tt_rss";
+              description = ''
+                Name of the existing database (has no effect if type is "sqlite").
+              '';
+            };
+
+            db_user = mkOption {
+              type = types.str;
+              default = "tt_rss";
+              description = ''
+                The database user. The user must exist and has access to
+                the specified database (has no effect if type is "sqlite").
+              '';
+            };
+
+            db_password = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = ''
+                The database user's password (has no effect if type is "sqlite").
+              '';
+            };
+
+            db_port = mkOption {
+              type = types.nullOr types.port;
+              default = null;
+              description = ''
+                The database's port. If not set, the default ports will be
+                provided (5432 and 3306 for pgsql and mysql respectively)
+                (has no effect if type is "sqlite").
+              '';
+            };
+          };
        };

-        host = mkOption {
-          type = types.str;
-          default = "localhost";
-          description = ''
-            Host of the database (has no effect if type is "sqlite").
-          '';
-        };
+        default = { };

-        name = mkOption {
-          type = types.str;
-          default = "tt_rss";
-          description = ''
-            Name of the existing database (has no effect if type is "sqlite").
-          '';
-        };
-
-        user = mkOption {
-          type = types.str;
-          default = "tt_rss";
-          description = ''
-            The database user. The user must exist and has access to
-            the specified database (has no effect if type is "sqlite").
-          '';
-        };
-
-        password = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          description = ''
-            The database user's password (has no effect if type is "sqlite").
-          '';
-        };
-
-        port = mkOption {
-          type = types.nullOr types.port;
-          default = null;
-          description = ''
-            The database's port. If not set, the default ports will be
-            provided (5432 and 3306 for pgsql and mysql respectively)
-            (has no effect if type is "sqlite").
-          '';
-        };
-      };
-      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
        description = ''
-          Extra configuration added to config.ini
+          Configuration for selfoss, see
+          <https://selfoss.aditu.de/docs/administration/options/>
+          for supported values.
        '';
      };
    };
@@ -123,7 +173,7 @@ in
  config = mkIf cfg.enable {
    services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
      ${poolName} = {
-        user = config.services.nginx.user;
+        user = mkDefault config.services.nginx.user;
        settings = mapAttrs (name: mkDefault) {
          "listen.owner" = config.services.nginx.user;
          "listen.group" = config.services.nginx.group;
--- a/nixos/modules/system/boot/systemd/journald.nix
+++ b/nixos/modules/system/boot/systemd/journald.nix
@@ -1,7 +1,6 @@
 {
  config,
  lib,
-  pkgs,
  utils,
  ...
 }:
@@ -10,111 +9,65 @@ let
 in
 {
  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "storage" ]
+      [ "services" "journald" "settings" "Journal" "Storage" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "rateLimitInterval" ]
+      [ "services" "journald" "settings" "Journal" "RateLimitIntervalSec" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "rateLimitBurst" ]
+      [ "services" "journald" "settings" "Journal" "RateLimitBurst" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "forwardToSyslog" ]
+      [ "services" "journald" "settings" "Journal" "ForwardToSyslog" ]
+    )
+    (lib.mkRemovedOptionModule
+      [
+        "services"
+        "journald"
+        "console"
+      ]
+      "Use services.journald.settings.Journal.ForwardToConsole and services.journald.settings.Journal.TTYPath instead."
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "journald" "audit" ]
+      [ "services" "journald" "settings" "Journal" "Audit" ]
+    )
+    (lib.mkRemovedOptionModule [
+      "services"
+      "journald"
+      "extraConfig"
+    ] "Use services.journald.settings.Journal instead.")
  ];

  options = {
-    services.journald.console = lib.mkOption {
-      default = "";
-      type = lib.types.str;
-      description = "If non-empty, write log messages to the specified TTY device.";
-    };
-
-    services.journald.rateLimitInterval = lib.mkOption {
-      default = "30s";
-      type = lib.types.str;
+    services.journald.settings.Journal = lib.mkOption {
+      default = { };
+      example = {
+        Storage = "volatile";
+        ForwardToConsole = true;
+        TTYPath = "/dev/tty12";
+      };
      description = ''
-        Configures the rate limiting interval that is applied to all
-        messages generated on the system. This rate limiting is applied
-        per-service, so that two services which log do not interfere with
-        each other's limit. The value may be specified in the following
-        units: s, min, h, ms, us. To turn off any kind of rate limiting,
-        set either value to 0.
-
-        See {option}`services.journald.rateLimitBurst` for important
-        considerations when setting this value.
-      '';
-    };
-
-    services.journald.storage = lib.mkOption {
-      default = "persistent";
-      type = lib.types.enum [
-        "persistent"
-        "volatile"
-        "auto"
-        "none"
-      ];
-      description = ''
-        Controls where to store journal data. See
-        {manpage}`journald.conf(5)` for further information.
-      '';
-    };
-
-    services.journald.rateLimitBurst = lib.mkOption {
-      default = 10000;
-      type = lib.types.int;
-      description = ''
-        Configures the rate limiting burst limit (number of messages per
-        interval) that is applied to all messages generated on the system.
-        This rate limiting is applied per-service, so that two services
-        which log do not interfere with each other's limit.
-
-        Note that the effective rate limit is multiplied by a factor derived
-        from the available free disk space for the journal as described on
-        {manpage}`journald.conf(5)`.
-
-        Note that the total amount of logs stored is limited by journald settings
-        such as `SystemMaxUse`, which defaults to 10% the file system size
-        (capped at max 4GB), and `SystemKeepFree`, which defaults to 15% of the
-        file system size.
-
-        It is thus recommended to compute what period of time that you will be
-        able to store logs for when an application logs at full burst rate.
-        With default settings for log lines that are 100 Bytes long, this can
-        amount to just a few hours.
-      '';
-    };
-
-    services.journald.audit = lib.mkOption {
-      default = "keep";
-      type = lib.types.oneOf [
-        lib.types.bool
-        (lib.types.enum [ "keep" ])
-      ];
-      description = ''
-        If enabled systemd-journald will turn on auditing on start-up.
-        If disabled it will turn it off. If unset it will neither enable nor disable it, leaving the previous state unchanged.
-
-        NixOS defaults to leaving this unset as enabling audit without auditd running leads to spamming /dev/kmesg with random messages
-        and if you enable auditd then auditd is responsible for turning auditing on.
-
-        If you want to have audit logs in journald and do not mind audit logs also ending up in /dev/kmesg you can set this option to true.
-
-        If you want to for some ununderstandable reason disable auditing if auditd enabled it then you can set this option to false.
-        It is of NixOS' opinion that setting this to false is definitely the wrong thing to do - but it's an option.
-      '';
-    };
-
-    services.journald.extraConfig = lib.mkOption {
-      default = "";
-      type = lib.types.lines;
-      example = "Storage=volatile";
-      description = ''
-        Extra config options for systemd-journald. See {manpage}`journald.conf(5)`
-        for available options.
-      '';
-    };
-
-    services.journald.forwardToSyslog = lib.mkOption {
-      default = config.services.rsyslogd.enable || config.services.syslog-ng.enable;
-      defaultText = lib.literalExpression "services.rsyslogd.enable || services.syslog-ng.enable";
-      type = lib.types.bool;
-      description = ''
-        Whether to forward log messages to syslog.
+        Options for the systemd journal service. See {manpage}`journald.conf(5)`
+        man page for available options.
      '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf utils.systemdUtils.unitOptions.unitOption;
+      };
    };
  };

  config = {
+    services.journald.settings.Journal = {
+      # "keep" isn't systemd's default since v258, so set it explicitly.
+      Audit = lib.mkOptionDefault "keep";
+    };
+
    systemd.additionalUpstreamSystemUnits = [
      "systemd-journald.socket"
      "systemd-journald@.socket"
@@ -136,23 +89,8 @@ in
      "sockets.target"
    ];

-    environment.etc = {
-      "systemd/journald.conf".text = ''
-        [Journal]
-        Storage=${cfg.storage}
-        RateLimitInterval=${cfg.rateLimitInterval}
-        RateLimitBurst=${toString cfg.rateLimitBurst}
-        ${lib.optionalString (cfg.console != "") ''
-          ForwardToConsole=yes
-          TTYPath=${cfg.console}
-        ''}
-        ${lib.optionalString (cfg.forwardToSyslog) ''
-          ForwardToSyslog=yes
-        ''}
-        Audit=${utils.systemdUtils.lib.toOption cfg.audit}
-        ${cfg.extraConfig}
-      '';
-    };
+    environment.etc."systemd/journald.conf".text =
+      utils.systemdUtils.lib.settingsToSections cfg.settings;

    users.groups.systemd-journal.gid = config.ids.gids.systemd-journal;

--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -233,11 +233,11 @@ in
    environment.systemPackages = [ pkgs.xwininfo ];

    # Log everything to the serial console.
-    services.journald.extraConfig = ''
-      ForwardToConsole=yes
-      TTYPath=/dev/${qemu-common.qemuSerialDevice}
-      MaxLevelConsole=debug
-    '';
+    services.journald.settings.Journal = {
+      ForwardToConsole = true;
+      TTYPath = "/dev/${qemu-common.qemuSerialDevice}";
+      MaxLevelConsole = "debug";
+    };

    systemd.settings.Manager = managerSettings;
    systemd.user.settings.Manager = {
--- a/nixos/tests/firewall.nix
+++ b/nixos/tests/firewall.nix
@@ -121,13 +121,13 @@
      walled.succeed("${reset}")
      attacker.fail("curl --fail --connect-timeout 2 http://walled/ >&2")

+      # Check whether activation of a new configuration reloads the firewall.
+      walled.succeed(
+          "/run/booted-system/specialisation/different-config/bin/switch-to-configuration test 2>&1 | grep -F ${unit}.service"
+      )
+
      # If we stop the firewall, then connections should succeed.
      walled.stop_job("${unit}")
      attacker.succeed("curl -v http://walled/ >&2")
-
-      # Check whether activation of a new configuration reloads the firewall.
-      walled.succeed(
-          "/run/booted-system/specialisation/different-config/bin/switch-to-configuration test 2>&1 | grep -qF ${unit}.service"
-      )
    '';
 }
--- a/nixos/tests/grub/basic.nix
+++ b/nixos/tests/grub/basic.nix
@@ -49,7 +49,7 @@
    grub_select_all_configurations()
    with subtest("Invalid credentials are rejected"):
        grub_login_as("wronguser", "wrongsecret")
-        machine.wait_for_console_text("error: access denied.")
+        machine.wait_for_console_text("access denied")

    grub_select_all_configurations()
    with subtest("Valid credentials are accepted"):
--- a/nixos/tests/os-prober.nix
+++ b/nixos/tests/os-prober.nix
@@ -99,9 +99,11 @@ import ./make-test-python.nix (
            desktop-file-utils
            docbook5
            docbook_xsl_ns
+            hello
            kbd.dev
            kmod.dev
            libarchive.dev
+            libcap-text-verifier
            libxml2.bin
            libxslt.bin
            nixos-artwork.wallpapers.simple-dark-gray-bottom
@@ -112,6 +114,7 @@ import ./make-test-python.nix (
            perlPackages.JSON
            perlPackages.ListCompare
            perlPackages.XMLLibXML
+            # make-options-doc/default.nix
            (python3.withPackages (p: [ p.mistune ]))
            shared-mime-info
            sudo
--- a/nixos/tests/rsyslogd.nix
+++ b/nixos/tests/rsyslogd.nix
@@ -13,10 +13,11 @@ with pkgs.lib;
    meta.maintainers = [ pkgs.lib.maintainers.aanderse ];

    nodes.machine =
-      { config, pkgs, ... }:
+      { lib, ... }:
      {
        services.rsyslogd.enable = true;
-        services.journald.forwardToSyslog = false;
+        # Verify that the module's option default remains overridable by downstream defaults.
+        services.journald.settings.Journal.ForwardToSyslog = lib.mkDefault false;
      };

    # ensure rsyslogd isn't receiving messages from journald if explicitly disabled
@@ -31,7 +32,7 @@ with pkgs.lib;
    meta.maintainers = [ pkgs.lib.maintainers.aanderse ];

    nodes.machine =
-      { config, pkgs, ... }:
+      { ... }:
      {
        services.rsyslogd.enable = true;
      };
--- a/nixos/tests/systemd-journal.nix
+++ b/nixos/tests/systemd-journal.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:

 {
  name = "systemd-journal";
@@ -14,7 +14,8 @@
    security.audit.enable = true;
  };
  nodes.journaldAudit = {
-    services.journald.audit = true;
+    # Verify that the module's option default remains overridable by downstream defaults.
+    services.journald.settings.Journal.Audit = lib.mkDefault true;
    security.audit.enable = true;
  };
  nodes.containerCheck = {
@@ -45,6 +46,7 @@

    with subtest("journald audit"):
      journaldAudit.wait_for_unit("multi-user.target")
+      journaldAudit.succeed("grep -Fx 'Audit=true' /etc/systemd/journald.conf")

      # logs should end up in the journald
      journaldAudit.succeed("journalctl _TRANSPORT=audit --grep 'unit=systemd-journald'")
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -35,7 +35,7 @@
        KExecWatchdogSec = "5min";
      };
      systemd.user.settings.Manager.DefaultEnvironment = "\"XXX_USER=bar\"";
-      services.journald.extraConfig = "Storage=volatile";
+      services.journald.settings.Journal.Storage = "volatile";
      test-support.displayManager.auto.user = "alice";

      systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/test".source =
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4885,8 +4885,8 @@ let
        mktplcRef = {
          name = "opa";
          publisher = "tsandall";
-          version = "0.24.1";
-          hash = "sha256-wNlZM9/2K32W4vYPKzLiBCTqhV+SqgZzXGRxKoHoIaM=";
+          version = "0.25.0";
+          hash = "sha256-d+INOMEc4ZO3T3326GxQW3PP/UflOwmEPfQOm2weVRY=";
        };
        meta = {
          changelog = "https://github.com/open-policy-agent/vscode-opa/blob/master/CHANGELOG.md";
@@ -4978,8 +4978,8 @@ let
        mktplcRef = {
          name = "theme-bluloco-light";
          publisher = "uloco";
-          version = "3.7.5";
-          sha256 = "sha256-MDrw0JWioLyg+H0XOCpULsmtM/y7RfV9ruDtskRiT3A=";
+          version = "3.10.0";
+          sha256 = "sha256-dweX1i8nn8qSleeGyhnrzSUXkhA13IXcGwwdkV7WsCI=";
        };
        postInstall = ''
          rm -r $out/share/vscode/extensions/uloco.theme-bluloco-light/screenshots
@@ -5552,8 +5552,8 @@ let
        mktplcRef = {
          name = "markdown-editor";
          publisher = "zaaack";
-          version = "0.1.19";
-          hash = "sha256-W0lL0JMNyEszyJa6I7RbXYLu4cU9DQUh0ZEAOd6eshI=";
+          version = "0.1.20";
+          hash = "sha256-YewK36OeKWgTU/iFRVZHYjF2+ke6TXb6HIggRZt1/nk=";
        };
        meta = {
          description = "Visual Studio Code extension for WYSIWYG markdown editing";
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -853,7 +853,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "152.0.7977.64",
+    "version": "152.0.7977.75",
    "deps": {
      "depot_tools": {
        "rev": "38c391feba5fb96812f9028da12413ffc39df394",
@@ -865,16 +865,16 @@
        "hash": "sha256-ovLx6KaORdXqnWgbsGEty10k2CHuCmTk3yEqy5//ovk="
      },
      "ungoogled-patches": {
-        "rev": "152.0.7977.64-1",
-        "hash": "sha256-9esE3TgtKiwwFL5pu87aEQznelMVtNXBslggYAJTEbc="
+        "rev": "152.0.7977.75-1",
+        "hash": "sha256-HXWnJfk0SxC8sRcgtFdGBOOeiV7kEQD2YXQFBwMsU1s="
      },
      "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "506c834ecceaa943c5f41e6cfe7f68acb5c45346",
-        "hash": "sha256-KEr9nzF55+c8Rvvay3SZjcWMDWVGTyv1f5Pjv3ckl3E=",
+        "rev": "4999cc1efed37c4d91dc4ce6ec4b0a50e2a9a8cb",
+        "hash": "sha256-RXykREnCulCwk8zkk8OAd62TM4qel6j4uhyaaYzgolY=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -989,8 +989,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "571752c9cb3ed36a3194854374984427794c4dda",
-        "hash": "sha256-YMgRmVMXo1Ra5M034zij/ik/1aHpb3veK4VWsKHIwhI="
+        "rev": "ab8827bc57b176eeaa89f71324130c02d4d41145",
+        "hash": "sha256-Xd1FsdIBO6hzNECnNnXR0306woHl5/L+5WZ/pxTlYfA="
      },
      "src/third_party/dawn/third_party/glfw3/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1124,8 +1124,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "941348cf79c423892e1c7c219091a7103d18a68b",
-        "hash": "sha256-/b+NCAr1jRJd/Uq4Cf5aO/yTdNP00ImIWuSJ4aP+TEw="
+        "rev": "04db1f5240b636511ec4e9058a78f8274a7f65ee",
+        "hash": "sha256-vZxKC/QD2dHNnVm9OZI1Bo0Jdnn+AJhFpXYSXXF7JsA="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1694,8 +1694,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "6aacaf6256a069ee455142333b7d38cad1c8d6e0",
-        "hash": "sha256-1NX4HP/BIJ6bWxoF42K89X8ADHuHjA5akkOL/WkIeME="
+        "rev": "3de6ffffbfdcf265e9f11a5c9d1cfb4d486d7550",
+        "hash": "sha256-ZHEmeSe8r226gjazm91GYqlfbM9a5yi8KnFv4iAWFKE="
      },
      "src/agents/shared": {
        "url": "https://chromium.googlesource.com/chromium/agents.git",
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -130,8 +130,8 @@ stdenv.mkDerivation {
  passthru = {
    inherit applicationName binaryName;
    libName = "firefox-bin-${version}";
-    ffmpegSupport = true;
-    gssSupport = true;
+    withFFmpeg = true;
+    withGSSAPI = true;
    gtk3 = gtk3;

    # update with:
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
  pname = "firefox-beta";
  binaryName = "firefox-beta";
-  version = "155.0b5";
+  version = "156.0b2";
  applicationName = "Firefox Beta";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "30b4b84c80057a992e763b8f967c65f46308324fd41c0307c9302e262e6428c379861ccd9ce52dde15d0dc3f4410b95a8c047ea7e5af9d90e60e7bb57ee59137";
+    sha512 = "5b685f8b947af0b519c59a308fba6a41f9481df68b7fb6f4b395707653c3ef1822817d2f867d663081cd2d61c8fd4537f46b8002da84b5efa9b8a57ae9491164";
  };

  meta = {
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -7,16 +7,15 @@
  buildMozillaMach,
 }:

-buildMozillaMach rec {
+(buildMozillaMach rec {
  pname = "firefox-devedition";
  binaryName = "firefox-devedition";
-  version = "155.0b5";
+  version = "156.0b2";
  applicationName = "Firefox Developer Edition";
-  requireSigning = false;
  branding = "browser/branding/aurora";
  src = fetchurl {
    url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "8e9ccc65a8cd6640171d4891fe8d01435cd524cee8164a5829429df827bcc2b49c3b7e6a092aaf5bfa48140d7f40f6c9cb371af48a7321132ea6ee5da0af08e3";
+    sha512 = "683326ff4367f9b807c4c5b93f100970258ada9838da2c597358105a99ff4aa7e33269fe67d6c68d466e2f539d2bea3015457109516af19e1785588ce43426b5";
  };

  # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
@@ -52,4 +51,7 @@ buildMozillaMach rec {
    versionSuffix = "b[0-9]*";
    baseUrl = "https://archive.mozilla.org/pub/devedition/releases/";
  };
-}
+}).override
+  {
+    enableAddonSigning = false;
+  }
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -69,8 +69,9 @@ let
      wmClass ? applicationName,
      nativeMessagingHosts ? [ ],
      pkcs11Modules ? [ ],
-      useGlvnd ? (!isDarwin),
+      withGlvnd ? (!isDarwin),
      cfg ? config.${applicationName} or { },
+      appDataDir ? null,

      ## Following options are needed for extra prefs & policies
      # For more information about anti tracking (german website)
@@ -88,20 +89,20 @@ let
    }:

    let
-      ffmpegSupport = browser.ffmpegSupport or false;
+      withFFmpeg = browser.withFFmpeg or false;
      # Firefox dlopens libavcodec by hardcoded soname, so each ffmpeg major needs
      # explicit browser support; keep versioned pins here (never the ffmpeg alias)
      # and add a tier when a release gains the next ABI.
      # libavcodec 62: 146 (bug 1962139), uplifted to ESR 140.10.2 (bug 2036244).
      # libavcodec 63: 154 (bug 2057577), uplifted to ESR 153.1 (bug 2057577).
      ffmpegPackage = if lib.versionAtLeast browser.version "153.1" then ffmpeg_9 else ffmpeg_8;
-      gssSupport = browser.gssSupport or false;
-      alsaSupport = browser.alsaSupport or false;
-      pipewireSupport = browser.pipewireSupport or false;
-      sndioSupport = browser.sndioSupport or false;
-      jackSupport = browser.jackSupport or false;
+      withGSSAPI = browser.withGSSAPI or false;
+      withALSA = browser.withALSA or false;
+      withPipewire = browser.withPipewire or false;
+      withSndio = browser.withSndio or false;
+      withJACK = browser.withJACK or false;
      # PCSC-Lite daemon (services.pcscd) also must be enabled for firefox to access smartcards
-      smartcardSupport = cfg.smartcardSupport or false;
+      withPCSC = cfg.smartcardSupport or false;

      allNativeMessagingHosts = map lib.getBin (lib.unique nativeMessagingHosts);

@@ -119,10 +120,10 @@ let
          ]
          ++ lib.optional (cfg.speechSynthesisSupport or true) speechd-minimal
        )
-        ++ lib.optional pipewireSupport pipewire
-        ++ lib.optional ffmpegSupport ffmpegPackage
-        ++ lib.optional gssSupport libkrb5
-        ++ lib.optional useGlvnd libglvnd
+        ++ lib.optional withPipewire pipewire
+        ++ lib.optional withFFmpeg ffmpegPackage
+        ++ lib.optional withGSSAPI libkrb5
+        ++ lib.optional withGlvnd libglvnd
        ++ lib.optionals (cfg.enableQuakeLive or false) [
          stdenv.cc
          libx11
@@ -134,10 +135,10 @@ let
          zlib
        ]
        ++ lib.optional (config.pulseaudio or (!isDarwin)) libpulseaudio
-        ++ lib.optional alsaSupport alsa-lib
-        ++ lib.optional sndioSupport sndio
-        ++ lib.optional jackSupport libjack2
-        ++ lib.optional smartcardSupport opensc
+        ++ lib.optional withALSA alsa-lib
+        ++ lib.optional withSndio sndio
+        ++ lib.optional withJACK libjack2
+        ++ lib.optional withPCSC opensc
        ++ pkcs11Modules
        ++ lib.optionals (!isDarwin) gtk_modules;
      gtk_modules = lib.optionals (!isDarwin) [ libcanberra-gtk3 ];
@@ -161,7 +162,7 @@ let
      extensions =
        if nameArray != (lib.unique nameArray) then
          throw "Firefox addon name needs to be unique"
-        else if browser.requireSigning || !browser.allowAddonSideload then
+        else if browser.enableAddonSigning || !browser.enableAddonSideload then
          throw "Nix addons are only supported with signature enforcement disabled and addon sideloading enabled (eg. LibreWolf)"
        else
          map (
@@ -195,7 +196,7 @@ let
              Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions;
            };
          }
-          // lib.optionalAttrs smartcardSupport {
+          // lib.optionalAttrs withPCSC {
            SecurityDevices = {
              "OpenSC PKCS#11 Module" = "opensc-pkcs11.so";
            };
@@ -335,6 +336,11 @@ let
        "MOZ_ALLOW_DOWNGRADE"
        "1"
      ]
+      ++ lib.optionals (appDataDir != null) [
+        "--set"
+        "MOZ_APP_DATA"
+        appDataDir
+      ]
      ++ lib.optionals (!isDarwin) [
        "--suffix"
        "GTK_PATH"
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-schema.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-schema.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "helm-schema";
-  version = "2.5.0";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "losisin";
    repo = "helm-values-schema-json";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GryjtwHUchH/69iLKavvJF9BE/E9g3LtgW9SBGXenU0=";
+    hash = "sha256-DTxVVf8p9IHYPIC5TevnvvLWTQx2VIy3WNPXSczTkSs=";
  };

-  vendorHash = "sha256-FFxPgTjg88GX5J+23O7A4WerqzWwM6YS9FlT13arWMQ=";
+  vendorHash = "sha256-XSaTTzSoKnwoiZu/FqHYOas6dMtr5C4+F5jy4FX1ot8=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/k3s/1_33/chart-versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_33/chart-versions.nix
@@ -1,10 +0,0 @@
-{
-  traefik-crd = {
-    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-40.1.4+up40.1.0.tgz";
-    sha256 = "0g79q6rb3n3i2v1qw3j5259pjfb9y1g4m9r9wpqrijhrsj2qjn6d";
-  };
-  traefik = {
-    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-40.1.4+up40.1.0.tgz";
-    sha256 = "0rvp9ch1rda4iv79hjc6236ldqv9xvzsfrqixbzz3ffmrppczsx9";
-  };
-}
--- a/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
@@ -1,26 +0,0 @@
-{
-  "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "49f2d99717503e1f9db527baedf7b4b3d0463f1ed3d4544940a234561c5651ba"
-  },
-  "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "7e59087b6a72e00db45a3bcb4f144114b13eb72dc8947c2b7908a0e1482b42b3"
-  },
-  "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-arm.tar.gz",
-    "sha256": "91e2deca0b39119d02c03495520542977712641ec142a81af0ad1fa1cbf4f362"
-  },
-  "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-arm.tar.zst",
-    "sha256": "b94244483badd6793f2e8d93de9d3125d4faf4a10b10047f289bee1e30bb1f44"
-  },
-  "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "35bbd4e5201c8c6a48776822b8e46d7067cff1875f86c3bde5de3bda37757584"
-  },
-  "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.13%2Bk3s2/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "47bc05eb1b21f0f76530a927ec5e1c5c2dec457f0190bf423e7be1d49348b5e6"
-  }
-}
--- a/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_33/versions.nix
@@ -1,21 +0,0 @@
-{
-  k3sVersion = "1.33.13+k3s2";
-  k3sCommit = "875e930d812e17f955cfb3a4817ad33cce3c6822";
-  k3sRepoSha256 = "1hk3z4s2hhzdha894aai4jpl8nc5mkqb2sf7hywi8b11h8ckhv8n";
-  k3sVendorHash = "sha256-jsGm6y94Kqd4SIDy00A5QpBylHIuTuirEbChpEKo2R8=";
-  chartVersions = import ./chart-versions.nix;
-  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
-  k3sRootVersion = "0.15.2";
-  k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
-  k3sCNIVersion = "1.9.1-k3s1";
-  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
-  containerdVersion = "2.2.5-k3s1.33";
-  containerdSha256 = "1al4zsyh3pz379ia0awhrlz7nyl2abyy0ayw0gl4gr6xjp7jsp1s";
-  containerdPackage = "github.com/k3s-io/containerd/v2";
-  criCtlVersion = "1.33.0-k3s2";
-  flannelVersion = "v0.28.4";
-  flannelPluginVersion = "v1.9.0-flannel1";
-  kubeRouterVersion = "v2.6.3-k3s1";
-  criDockerdVersion = "v0.3.19-k3s2";
-  helmJobVersion = "v0.13.3-build20260727";
-}
--- a/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_34/images-versions.json
@@ -1,26 +1,26 @@
 {
  "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "e972a78ff6ba5a83ea80c36ac986e687ee2ce4181e0fe6104f98a48467094297"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "8347931329bd188ecfa7782e7c0b9509813a29f5b6481c7b1ab54238aef1cf1f"
  },
  "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "7e59087b6a72e00db45a3bcb4f144114b13eb72dc8947c2b7908a0e1482b42b3"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "807160da9a1b3ec86183a777241a6fe948d27fd6fdf3b88d0da39fa3b1ceeddc"
  },
  "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "718b9bf069aff3ffc9c3dd769abc30decf301ae90d06e47f33ed48e4957b9b3b"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "c6c996e5aefd1ffb02f2fd089c29d26ae2b5a24e1c81b32f330e93612d1c38de"
  },
  "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "d24b30ad5536998219611cdb7ee20d2c821a9acb69fb3852dd892a1e082edf44"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "57133711ae21010fd197fb666c631d7ac7c5a3f40533038b9a9d9e51ea066e5f"
  },
  "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "3040602c860a1827d11b6db19307e586300a271b2f5a7781909de47f32df4ea2"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "1f812132104de93d30d8d1f317e11cb263a8e44f9ef1abba07cf3eb178b8113e"
  },
  "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.10%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "dc1a8c0d10a40f2d0dc1d53c5c42f2b4e00a996b1573227bcbf2855c644d3025"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.34.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "18c53139e7ad39009057d5c52ec5501aeea1ada235986e43c7357a3863ff3fdd"
  }
 }
--- a/pkgs/applications/networking/cluster/k3s/1_34/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_34/versions.nix
@@ -1,16 +1,16 @@
 {
-  k3sVersion = "1.34.10+k3s1";
-  k3sCommit = "39a4509ed98145d4f1eb8e15a8ca8362ca018afa";
-  k3sRepoSha256 = "1r0far01pxbjvlrz7pjmx11k1hmvwr6xmkdcpf9iph64qlnwr4s3";
-  k3sVendorHash = "sha256-ypwsQOkbda18/YLqM4v88RH4aKAxsagiocukYFnQHSw=";
+  k3sVersion = "1.34.11+k3s1";
+  k3sCommit = "9312658016b9e33288b528da68bf88e37e6aeecf";
+  k3sRepoSha256 = "0mk2i1ir93amv9aq37mmnzyj1zzq6nvgg81vfnw4da4ln5kvj878";
+  k3sVendorHash = "sha256-QcGSnYXlG/+PFD+XGeVoCI/bh91YdW8sPUi4B0gFSC0=";
  chartVersions = import ./chart-versions.nix;
  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
  k3sRootVersion = "0.15.2";
  k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
  k3sCNIVersion = "1.9.1-k3s1";
  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
-  containerdVersion = "2.2.5-k3s2";
-  containerdSha256 = "1i9vkmf3gg34d9hjq15c00frhqxs9cba03zwg7qqq34gkb4qhjch";
+  containerdVersion = "2.2.7-k3s1";
+  containerdSha256 = "0zn64g6fzv8knan550ydbkgkaxa8qi2l8dw38w9g3hm8lv43nqyv";
  containerdPackage = "github.com/k3s-io/containerd/v2";
  criCtlVersion = "1.34.0-k3s2";
  flannelVersion = "v0.28.4";
--- a/pkgs/applications/networking/cluster/k3s/1_35/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_35/images-versions.json
@@ -1,26 +1,26 @@
 {
  "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "c109b42bce8de6f258be41f3f83393ff2693b7ede95bce0e80a1ff394b590507"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "a2893ea3234e01facd06cdb2ca879b65348fccf6b43be20501d72a949ece45f7"
  },
  "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "d28bbfef8a86b740e8235b6b2cfa6e29ecb0da457a55275d788a18d09142ee1f"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "807160da9a1b3ec86183a777241a6fe948d27fd6fdf3b88d0da39fa3b1ceeddc"
  },
  "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "589150e3493a5cd29bf7b8b57f9e3f7968c1b2d1f79e8a072352d63abb59e978"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "08118b95556457b8a191357b329a42298d485b4597f720c14c5625d256f1e656"
  },
  "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "c6d57e5fb17ba142464bc8db9debfa701f560b4defa70c2e06981bf52cb9e26b"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "3f502e7d64a87b5b5afc5ed8ed27febb73e090d81a5b7df9db51cfd5a7a144a1"
  },
  "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "b686b4c09dc335535889d5630ae5b0283d421d40af1029b271938cfd3b358f11"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "23d82e394d9ad41ea2912afaf0a6ead69bacede819c12678ba5dec22d16784da"
  },
  "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "47bc05eb1b21f0f76530a927ec5e1c5c2dec457f0190bf423e7be1d49348b5e6"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.35.8%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "18c53139e7ad39009057d5c52ec5501aeea1ada235986e43c7357a3863ff3fdd"
  }
 }
--- a/pkgs/applications/networking/cluster/k3s/1_35/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_35/versions.nix
@@ -1,16 +1,16 @@
 {
-  k3sVersion = "1.35.7+k3s1";
-  k3sCommit = "cd43afc7151132bac92feacd3e4d2127ea1e70d0";
-  k3sRepoSha256 = "1m9kwz8i1sqjgmc71qknmr87c9g8z7r2wl9440r32lfzxq8a6g1b";
-  k3sVendorHash = "sha256-0MVOVrRWZ/xyTaRq5Nw5ogxIGZLArDVA1wiHmiwKqFA=";
+  k3sVersion = "1.35.8+k3s1";
+  k3sCommit = "e952d68a5a5f8953c4549cf8fb557f3eae417107";
+  k3sRepoSha256 = "07kpi9kl8pw4fyba474dap5hiskxays8qa8mf4qz6ai4wqapzg5c";
+  k3sVendorHash = "sha256-2u9D2HLhiryOi8bwu5Tbv162WEoRbFfgePW7AeefuG8=";
  chartVersions = import ./chart-versions.nix;
  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
  k3sRootVersion = "0.15.2";
  k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
  k3sCNIVersion = "1.9.1-k3s1";
  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
-  containerdVersion = "2.2.5-k3s2";
-  containerdSha256 = "1i9vkmf3gg34d9hjq15c00frhqxs9cba03zwg7qqq34gkb4qhjch";
+  containerdVersion = "2.2.7-k3s1";
+  containerdSha256 = "0zn64g6fzv8knan550ydbkgkaxa8qi2l8dw38w9g3hm8lv43nqyv";
  containerdPackage = "github.com/k3s-io/containerd/v2";
  criCtlVersion = "1.35.0-k3s2";
  flannelVersion = "v0.28.4";
--- a/pkgs/applications/networking/cluster/k3s/1_36/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_36/images-versions.json
@@ -1,26 +1,26 @@
 {
  "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "e09e718f931ef094294781d3c35e58b84e2170acd5cc2edae075a20f58d1f89d"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "a5a6c970a992ce6ed5801b5fd090aa7edde354a786eb0e7d75b162d0b22901dd"
  },
  "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "a197d79e979cc3f4fa9bca8f500bd70092b25c1b5ebda68b35a25f792abd42b0"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "9024613e2d468c51ba0e5ba21898604c41339354449fb3338cc6a7931189eb6a"
  },
  "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "5e6b25d6cd2f6f25e663edf94a450e560a80b7a207c3d9f4d4646b688cceee5b"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "519824fd8ab0096959164c319de4e28abb4677c1e6a10a2fd0bb8922c73e16d1"
  },
  "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "b94244483badd6793f2e8d93de9d3125d4faf4a10b10047f289bee1e30bb1f44"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "31a0be5131bb87286209fa0ea2c91e73fda57aee622e162f5f0e54b6e53f8ce5"
  },
  "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "75fc0f7a1f8a9babf00e4a6bd5fadfb6657a3af1289fe3611eaf56f01e5ce735"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "5b66fde4e29681c09980d64bc77544769210abf8dcbd19dc210427ed12e0e8f8"
  },
  "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.3%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "856feb047453cd697c2bc4dcf20127448554c8366be992a211558a13d830a038"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.36.4%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "9d3c4c2197bcf857ca17633aa393bad683cc982ddd408620f93036a3cca953b5"
  }
 }
--- a/pkgs/applications/networking/cluster/k3s/1_36/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_36/versions.nix
@@ -1,16 +1,16 @@
 {
-  k3sVersion = "1.36.3+k3s1";
-  k3sCommit = "5aed4d7beddeb3e67120da477c876ac9efd70318";
-  k3sRepoSha256 = "0y5lc93f5pdvgm3mmk87mh50z7iway4cz99nskfh1600zfhia2s6";
-  k3sVendorHash = "sha256-pxYh1AJVZL8Xx23Nairoi5bSNNSVs+EqJbXF7ISN3wg=";
+  k3sVersion = "1.36.4+k3s1";
+  k3sCommit = "4dedb15be78017a8ddd5b9e81acd44f3481078ed";
+  k3sRepoSha256 = "07ynarjmjqybfyq30kaa08nx9rw5h83nifir050mplqjwb10mrk5";
+  k3sVendorHash = "sha256-naO/9O5aLGNf7FwQvsvSb/eG0eCBFc/Um3yfH2fP+8Y=";
  chartVersions = import ./chart-versions.nix;
  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
  k3sRootVersion = "0.15.2";
  k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
  k3sCNIVersion = "1.9.1-k3s1";
  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
-  containerdVersion = "2.3.2-k3s2";
-  containerdSha256 = "1jzhkh0zg1s2922fkr4r5v1680apafkjqba8ic6br8nc8bk7j4xq";
+  containerdVersion = "2.3.4-k3s1.36";
+  containerdSha256 = "0mlazx89616j90s73953spi4ahcas8w9kb51a7qf02pa9isyz5vi";
  containerdPackage = "github.com/k3s-io/containerd/v2";
  criCtlVersion = "1.36.0-k3s1";
  flannelVersion = "v0.28.4";
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -377,6 +377,7 @@ buildGoModule (finalAttrs: {
  pname = "k3s";
  version = k3sVersion;
  pos = builtins.unsafeGetAttrPos "k3sVersion" attrs;
+  __structuredAttrs = true;

  tags = [
    "libsqlite3"
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -2,7 +2,7 @@

 let
  k3s_builder = import ./builder.nix lib;
-  common = opts: callPackage (k3s_builder opts);
+  forVersions = versions: callPackage (k3s_builder (import versions)) extraArgs;
  # extraArgs is the extra arguments passed in by the caller to propagate downward.
  # This is to allow all-packages.nix to do:
  #
@@ -12,18 +12,7 @@ let
  extraArgs = removeAttrs args [ "callPackage" ];
 in
 {
-  k3s_1_33 = common (import ./1_33/versions.nix) extraArgs;
-
-  k3s_1_34 = (common (import ./1_34/versions.nix) extraArgs).overrideAttrs {
-    patches = [ ./go_runc_require.patch ];
-  };
-
-  k3s_1_35 = (common (import ./1_35/versions.nix) extraArgs).overrideAttrs {
-    patches = [ ./go_runc_require.patch ];
-  };
-
-  k3s_1_36 = (common (import ./1_36/versions.nix) extraArgs).overrideAttrs {
-    __structuredAttrs = true;
-    patches = [ ./go_runc_require.patch ];
-  };
+  k3s_1_34 = forVersions ./1_34/versions.nix;
+  k3s_1_35 = forVersions ./1_35/versions.nix;
+  k3s_1_36 = forVersions ./1_36/versions.nix;
 }
--- a/pkgs/applications/networking/cluster/k3s/go_runc_require.patch
+++ b/pkgs/applications/networking/cluster/k3s/go_runc_require.patch
@@ -1,18 +0,0 @@
-# Adds explicit require of opencontainers/runc to go.mod before version.sh is called and
-# removes it afterwards so that later build commands don't complain about inconsistent
-# vendoring.
-diff --git a/scripts/package-cli b/scripts/package-cli
-index a15d754926..bc450dbe4e 100755
--- a/scripts/package-cli
-+++ b/scripts/package-cli
-@@ -3,7 +3,10 @@ set -e -x
- 
- cd $(dirname $0)/..
- 
-+runc_require=$(grep "github.com/opencontainers/runc" go.mod | awk -F '=> ' '{print $2}' | xargs -0 printf 'require %s')
-+echo "$runc_require" >> go.mod
- . ./scripts/version.sh
-+sed -i '$d' go.mod
- 
- GO=${GO-go}
- 
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -82,13 +82,13 @@
    "vendorHash": "sha256-L9IGENsL8Kibq5O/JOgCxLRUxgS7q9G/NovC/Q7tw48="
  },
  "auth0_auth0": {
-    "hash": "sha256-SpGTMAFEiJVGpXYAIigJQditDvs8sU2Bz57ohanccAM=",
+    "hash": "sha256-t/AdooXhTpu4UXE8u6cvdVPL4HFUQQWOSAjw1RXFs8c=",
    "homepage": "https://registry.terraform.io/providers/auth0/auth0",
    "owner": "auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v1.55.0",
+    "rev": "v1.56.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ajl7q+9oA+NA5eqAXA5yjej03qdI5nimRNQW6GoGOq4="
+    "vendorHash": "sha256-ydki+y2A6g94xNGVr7xZkBB/grEbOOD4LRwYGAmzLsc="
  },
  "aviatrixsystems_aviatrix": {
    "hash": "sha256-46djOfAj/5kfeoKLQHbeKefzdGbmlBATR+uN/IaAn8I=",
@@ -1490,13 +1490,13 @@
    "vendorHash": "sha256-GRnVhGpVgFI83Lg34Zv1xgV5Kp8ioKTFV5uaqS80ATg="
  },
  "vpsfreecz_vpsadmin": {
-    "hash": "sha256-T+az9OH9/ZMSJewZpC9VLSXOZ5N/wz00VRnl9Ab4aeI=",
+    "hash": "sha256-1r2SqoRWJJhQej8D3LXHOEXT5RSxE4t6s7QuiNoIqpg=",
    "homepage": "https://registry.terraform.io/providers/vpsfreecz/vpsadmin",
    "owner": "vpsfreecz",
    "repo": "terraform-provider-vpsadmin",
-    "rev": "v1.3.0",
+    "rev": "v1.5.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-98lrEH7j4Fl0oSEoL75e0h+8ySLacPK2k0OehY3jqhA="
+    "vendorHash": "sha256-fbFpENa1/8Qs6RnTUMi0LDATho8+WuKhj4i8S/dG3Yg="
  },
  "vultr_vultr": {
    "hash": "sha256-hK4/Pzj0UtWDLQS3cRMC73ZRr20HCWqI+jUlTUHcHaw=",
--- a/pkgs/applications/networking/instant-messengers/discord/sources.json
+++ b/pkgs/applications/networking/instant-messengers/discord/sources.json
@@ -1,83 +1,78 @@
 {
  "linux-canary": {
    "distro": {
-      "hash": "sha256-4j3ii6uD9f0tV71mU8XFFxWch7LiWCwclnkHa5NGj+4=",
-      "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/full.distro"
+      "hash": "sha256-UHlT587DCEDz7YSxN57S3mZ+4R2bi8/Aqvf62QuibEY=",
+      "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/full.distro"
    },
    "kind": "distro",
    "modules": {
-      "discord_arborium": {
-        "hash": "sha256-I6JRlVELq5Mldcaz+lKMt0izsNSfWdw/e5JPqBGLOzE=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_arborium/1/full.distro",
-        "version": 1
-      },
      "discord_cloudsync": {
-        "hash": "sha256-ZulqlXaIFr+Ds20ON02HZLn45JFqq9POuYoFV1t0eZI=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_cloudsync/1/full.distro",
+        "hash": "sha256-/gA7pLPkyWAMQc2gNgq9L14W9hu3Bi5rPtCyWZGghqQ=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_cloudsync/1/full.distro",
        "version": 1
      },
      "discord_desktop_core": {
-        "hash": "sha256-H7mcz7tm2FQXrmbfLz9n1bxbuAMNAnGK9iWEbMoVoew=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_desktop_core/1/full.distro",
+        "hash": "sha256-/iCoCP3vNeAVXRK3smZdf8XrQNYanejlcjZ9fcddbHg=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_desktop_core/1/full.distro",
        "version": 1
      },
      "discord_dispatch": {
-        "hash": "sha256-XTmNR20AqtrpWiwOy0vMrUy0K2bDG7P27a80hbvWS58=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_dispatch/1/full.distro",
+        "hash": "sha256-KjrgWGgTHuNOqm2NnOiDATyAgngaGSktATe5OnV3Cjg=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_dispatch/1/full.distro",
        "version": 1
      },
      "discord_erlpack": {
-        "hash": "sha256-zH6H8EchYRXbK7HgG6F09Oiieep6JyTw1+r2nRmtQ6Q=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_erlpack/1/full.distro",
+        "hash": "sha256-eLse+k1w07/mGh0h3beXGZtsCz7NuP6qSQH6hJcNspM=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_erlpack/1/full.distro",
        "version": 1
      },
      "discord_game_utils": {
-        "hash": "sha256-3H3KVkC/t6UdxTQEUtKg9rfk1xKaWf0MDerUm5yO3/Y=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_game_utils/1/full.distro",
+        "hash": "sha256-JPacuW/LhaFGftu3tR3C4AKU+6nnJuc4N99CnvJskf8=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_game_utils/1/full.distro",
        "version": 1
      },
      "discord_krisp": {
-        "hash": "sha256-w8XATCZyCv1FeoRBweo7+wL9NAX2jD8JNKiF1ED7T1w=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_krisp/1/full.distro",
+        "hash": "sha256-xYryuPZXFp9nvDQ4l8qFANh16CcO+ZNCEUc0/UXrBzE=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_krisp/1/full.distro",
        "version": 1
      },
      "discord_modules": {
-        "hash": "sha256-Qd4gefF0GDNmZpwtIuuOdGRxRn7b+l88N7lbsRebe9U=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_modules/1/full.distro",
+        "hash": "sha256-KCAWR5Eoib/RkO3MVn8oHh6WBTfTMA2fMLMjMCrRiZs=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_modules/1/full.distro",
        "version": 1
      },
      "discord_rpc": {
-        "hash": "sha256-XxkRTULSxx7o8PNwCtz4FeZ9vowa8EHr7DNryvG/vMk=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_rpc/1/full.distro",
+        "hash": "sha256-uYcDMwefWLdUzCjpN6b0h5pN95UKZs6gwgwA3uiPmb4=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_rpc/1/full.distro",
        "version": 1
      },
      "discord_spellcheck": {
-        "hash": "sha256-mFEZg/Z33mdj4dIwJNfj7pCj/xcLoCTch/t2pssl45c=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_spellcheck/1/full.distro",
+        "hash": "sha256-xSOog8VBcJBhbfzWXUlMMHWYfQ+Mkx0O5/IGu72zTvY=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_spellcheck/1/full.distro",
        "version": 1
      },
      "discord_sysimg": {
-        "hash": "sha256-O5XrO1uL6zNHbIh6XUXQP3e/ZcAd46Z4s26+ihzWfBU=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_sysimg/1/full.distro",
+        "hash": "sha256-UTNNk4RY6fk9GnTxNyhBI3XLmA38oSsdKVpLl3VqtjU=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_sysimg/1/full.distro",
        "version": 1
      },
      "discord_utils": {
-        "hash": "sha256-aN53SHC3x1YKzd3pmmQX7lWu6iVRC7kN9BxViPSSNV8=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_utils/1/full.distro",
+        "hash": "sha256-CbAcjtjZdENZcjcrEOLP/SOdi9Yay4/J4re0UguvO40=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_utils/1/full.distro",
        "version": 1
      },
      "discord_voice": {
-        "hash": "sha256-pbzNmysNg7tWzbpQSqGr8OBWdaGSR8/pi5A15y2oZno=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_voice/1/full.distro",
+        "hash": "sha256-Ev6sh9hjfjdZ+5ZmXKW4QXFdGwQAozXP4/F6P6BYISI=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_voice/1/full.distro",
        "version": 1
      },
      "discord_zstd": {
-        "hash": "sha256-E+ai701mLhnEdSAO+9dR0KEWZuVEJvCzmrRjPB0ST0I=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1766/discord_zstd/1/full.distro",
+        "hash": "sha256-1Sfz6Wymr9T3mIwdRb4e6KYNl/iI2eDoiK+DDsGUty8=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/linux/x64/1.0.1794/discord_zstd/1/full.distro",
        "version": 1
      }
    },
-    "version": "1.0.1766"
+    "version": "1.0.1794"
  },
  "linux-development": {
    "distro": {
@@ -161,253 +156,253 @@
  },
  "linux-ptb": {
    "distro": {
-      "hash": "sha256-9eq0gqGesGYXCLsztSt9mf0laH/OuLhjCuOKRL8Xnp4=",
-      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/full.distro"
+      "hash": "sha256-4LjSOiwKk82VvmxYEKGJnp0yz5pNbdJ3mDOgnK3+GCs=",
+      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/full.distro"
    },
    "kind": "distro",
    "modules": {
      "discord_arborium": {
-        "hash": "sha256-w4mPCev2fCDBLeozW24Aps/m+5kWAyVtYD55868lQzA=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_arborium/1/full.distro",
+        "hash": "sha256-1Oh0s1LoS/IqGUfP5ZLYdVGPXZVzK/hRNRa6qelYqFc=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_arborium/1/full.distro",
        "version": 1
      },
      "discord_cloudsync": {
-        "hash": "sha256-BXIIi69tGkND16aykVut6cE8B/WiVe6/9mpPBBxVZ1s=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_cloudsync/1/full.distro",
+        "hash": "sha256-Tv21h/Zx3cCz3JiCuM/NN8VwZti+KGTqscmDZRsGC2Y=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_cloudsync/1/full.distro",
        "version": 1
      },
      "discord_desktop_core": {
-        "hash": "sha256-gB3j55jhG/qh13itZ79Oiio2Ys7i61k5d4NIj9+a4d8=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_desktop_core/1/full.distro",
+        "hash": "sha256-bfZVCO3uEWlHJa5IhENPpArW1j75wICaRe7BS2FyDN0=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_desktop_core/1/full.distro",
        "version": 1
      },
      "discord_dispatch": {
-        "hash": "sha256-OcokUI/f0Ra6JBC7xJ3+Icv0yyZlD7g1As7c718f3AY=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_dispatch/1/full.distro",
+        "hash": "sha256-C/o9W9HQM27j7Yd9EL/gPqZ4Qwh1PnWeh1hfdwWwnQE=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_dispatch/1/full.distro",
        "version": 1
      },
      "discord_erlpack": {
-        "hash": "sha256-z9pwZyP59qIDZeojVaNgJohsu4SNstQliXvuIJjTWU0=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_erlpack/1/full.distro",
+        "hash": "sha256-tGXulf3fiJh/rYWAVkc3X0BEfYmJ7B+bpco1jdGshiM=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_erlpack/1/full.distro",
        "version": 1
      },
      "discord_game_utils": {
-        "hash": "sha256-pBvHJOJ8LqV1yDY/AKhxl9+5CBuGDdZxNECQ+mzPPcA=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_game_utils/1/full.distro",
+        "hash": "sha256-HteWjRWb7cGjTVx4KR9s6usA742cp09NbTeHF91tCys=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_game_utils/1/full.distro",
        "version": 1
      },
      "discord_krisp": {
-        "hash": "sha256-302w/9D93ESPY3ij6vbOeig32nikoWDD8t8YoCPGWEc=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_krisp/1/full.distro",
+        "hash": "sha256-ntr0p+Mjam+JDwFWTgrFhbmesXPg0CzkajBM/D4pZPw=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_krisp/1/full.distro",
        "version": 1
      },
      "discord_modules": {
-        "hash": "sha256-zDsZa17X3GIIGeNG6JBuTTyXqtqD2NiZRrmcL67oSj4=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_modules/1/full.distro",
+        "hash": "sha256-YC00gpi63MLWWQG52neNOcrE0CLmLPo1f2qtqOQyCNI=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_modules/1/full.distro",
        "version": 1
      },
      "discord_rpc": {
-        "hash": "sha256-ndZwouBJpQHNDIWfuC/xvM2+fIIwrUutLAQwj+fNyXY=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_rpc/1/full.distro",
+        "hash": "sha256-+e6mv8np0+rcHbql4cBW2gymQPAceLC+1EX/fHOWf0k=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_rpc/1/full.distro",
        "version": 1
      },
      "discord_spellcheck": {
-        "hash": "sha256-se40Ubw07Fwg7VBIkvgfIzBIbpdWyOEAHHk+SrAk9Dk=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_spellcheck/1/full.distro",
+        "hash": "sha256-KxWS1m9gD5+hZHqbLmjZV8nmvRJflVITugyvj14aZjM=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_spellcheck/1/full.distro",
        "version": 1
      },
      "discord_sysimg": {
-        "hash": "sha256-kbJsxsqrjoVajWCUDAywNQlEVHQ6Iyl6FjltvGenAPg=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_sysimg/1/full.distro",
+        "hash": "sha256-g8mckNZNTCZDD8m1WnWx3vtsqZ1B/Ou0qGMf5F0bgX8=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_sysimg/1/full.distro",
        "version": 1
      },
      "discord_utils": {
-        "hash": "sha256-l32yxA7h01KsBvc5wambNoyxiACacprLdJXnM5c0bxU=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_utils/1/full.distro",
+        "hash": "sha256-/OKjhFGVQ/U3O/YvNkc+xrPNJGBAkmctgUjLiK2cOcY=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_utils/1/full.distro",
        "version": 1
      },
      "discord_voice": {
-        "hash": "sha256-vuX/J5+Br2lC+rsEnAWlrYivkAF7HKb3FG+xBO3HxOI=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_voice/1/full.distro",
+        "hash": "sha256-EgEXB1pXz5RTXtUPNwkDfuSP001luOYqFIH/TiIWGB4=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_voice/1/full.distro",
        "version": 1
      },
      "discord_zstd": {
-        "hash": "sha256-ZZ1cKzbxPKyu7Ku+T6iQ9Qrs9tFA++Yebpu02v9IkMg=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.211/discord_zstd/1/full.distro",
+        "hash": "sha256-ivgN/iLzXIXdV0KTzZMakkgWj7mDvlAZ06RjLWvB1qQ=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/linux/x64/1.0.212/discord_zstd/1/full.distro",
        "version": 1
      }
    },
-    "version": "1.0.211"
+    "version": "1.0.212"
  },
  "linux-stable": {
    "distro": {
-      "hash": "sha256-8gWwie6ns9oLR+YcN5Yo0Ml9cozrM6Ybg7IXg3hEir0=",
-      "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/full.distro"
+      "hash": "sha256-vvQ7e7rsk85mPCbNeb00d3OCUWUzUkFNYVctPYvBGRE=",
+      "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/full.distro"
    },
    "kind": "distro",
    "modules": {
      "discord_arborium": {
-        "hash": "sha256-W0u/dID213JCOtMxvINaGPRXRMfOkbqWxw2LYJM03N4=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_arborium/1/full.distro",
+        "hash": "sha256-JUA2EDfYcRaVnU4zzhOKZ8Q0X8YafPhKJcUd0J+MztU=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_arborium/1/full.distro",
        "version": 1
      },
      "discord_cloudsync": {
-        "hash": "sha256-kCFreXY3IBuMZ7FtqVSv4IAMzQYBNV4qplQZx9PlQlU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_cloudsync/1/full.distro",
+        "hash": "sha256-J+lGNUKZJ+DtbQ8pXLUuw07T6MH7fyzblKr6fQ9bb2s=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_cloudsync/1/full.distro",
        "version": 1
      },
      "discord_desktop_core": {
-        "hash": "sha256-s7WzMCq0J6XacDErIvMfmIlt9McK00dNshz+w7VJ0wo=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_desktop_core/1/full.distro",
+        "hash": "sha256-21p4kuV4dJUvxNVWgYsVIxkyYohak7NxgscIYdlD0a0=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_desktop_core/1/full.distro",
        "version": 1
      },
      "discord_dispatch": {
-        "hash": "sha256-PHjwOQ71MsbPTDSGGljPd9m4D471ImQp3a8obW7lod8=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_dispatch/1/full.distro",
+        "hash": "sha256-P5FQFCzWsgrDNu7OoyI1mjStfBP5nM6C45fu42MoYv4=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_dispatch/1/full.distro",
        "version": 1
      },
      "discord_erlpack": {
-        "hash": "sha256-vtd9yB9mK6twH74dgC7NuT2rVCr5ucjSv+11yCOF0Gs=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_erlpack/1/full.distro",
+        "hash": "sha256-nfgYCt0rHjlZUedu40sRThxp1TEdfB+9TXz31RFZ60k=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_erlpack/1/full.distro",
        "version": 1
      },
      "discord_game_utils": {
-        "hash": "sha256-H3FM1Ml97v9MkGVCgYUW+mz2JOd9CZP/Dgzvu2rGOuE=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_game_utils/1/full.distro",
+        "hash": "sha256-gAB1QY8QjHl6xogqQr1uxgYuuywQV+VcqMB5cAC0vNc=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_game_utils/1/full.distro",
        "version": 1
      },
      "discord_krisp": {
-        "hash": "sha256-lCOK9yjqa1yLcSOdhILgW/kr1ZJjqxAdbo93/FnyNnk=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_krisp/1/full.distro",
+        "hash": "sha256-bmMDt2FshcCZA3eDZ+uVmxzCqgkTI81Zc6Wrrw3ZK/0=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_krisp/1/full.distro",
        "version": 1
      },
      "discord_modules": {
-        "hash": "sha256-OC2VIUOXaiGcoqV8NOzW55z3DpRpdqfTBdni3wNyvlA=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_modules/1/full.distro",
+        "hash": "sha256-YVhJEFMOo8AmGFpET5sdTdLiRLO407t5Z6KCixKEjGk=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_modules/1/full.distro",
        "version": 1
      },
      "discord_rpc": {
-        "hash": "sha256-GS/nOO/ec43OgYN744Gao4IHYWBPpznA1stk/BmPEqQ=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_rpc/1/full.distro",
+        "hash": "sha256-Av9sjzLybZV9OD5WEteV0sHRDzNp8LiBUOb1V63oZv8=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_rpc/1/full.distro",
        "version": 1
      },
      "discord_spellcheck": {
-        "hash": "sha256-oBGlUOrQ2/cW5EbTcTe31wvfm5V14gyBoStucMXDJqU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_spellcheck/1/full.distro",
-        "version": 1
-      },
-      "discord_utils": {
-        "hash": "sha256-BOb01yg0+O3/k5CX0TKVaz8598HqcQp09R4vA60e87s=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_utils/1/full.distro",
-        "version": 1
-      },
-      "discord_voice": {
-        "hash": "sha256-ib2a5g6Pr6YR+RUWYm4u929yTgWUMtMaETwMNaEal7M=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_voice/1/full.distro",
-        "version": 1
-      },
-      "discord_zstd": {
-        "hash": "sha256-QNYSCSoJJVKeV3w+AS6AbaVcTnIs6gMX1nek0tn/eoA=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.155/discord_zstd/1/full.distro",
-        "version": 1
-      }
-    },
-    "version": "1.0.155"
-  },
-  "osx-canary": {
-    "distro": {
-      "hash": "sha256-g2G2hLwYUiQBDHUiWKGH7BK153qnRZvySwzktOio8SI=",
-      "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/full.distro"
-    },
-    "kind": "distro",
-    "modules": {
-      "discord_arborium": {
-        "hash": "sha256-KNEcVAc7z4n9yPSi3LT+sZe3iq4J7QtH66OAJ473nqM=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_arborium/1/full.distro",
-        "version": 1
-      },
-      "discord_cloudsync": {
-        "hash": "sha256-0iKZk1fyyN5te8AUaC3H1gsOr/BGxhMwionpCgkna4A=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_cloudsync/1/full.distro",
-        "version": 1
-      },
-      "discord_desktop_core": {
-        "hash": "sha256-K4O77jQCWBh2nYjFhwlJCHzxmmuadouv3pqLN0q8c9s=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_desktop_core/1/full.distro",
-        "version": 1
-      },
-      "discord_dispatch": {
-        "hash": "sha256-6T4HWFZpkGQcpwfVWMaw4sTpibG4wo1HLk8ZcmtBfvM=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_dispatch/1/full.distro",
-        "version": 1
-      },
-      "discord_erlpack": {
-        "hash": "sha256-MNX10Hk1nzEq000t15Msg8hzmGCkby7z/I6b9LuR5Sk=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_erlpack/1/full.distro",
-        "version": 1
-      },
-      "discord_game_utils": {
-        "hash": "sha256-6znm3uE1Fl7ItuT/1OVRxP21kSYaDXkTIl1SNadWSSQ=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_game_utils/1/full.distro",
-        "version": 1
-      },
-      "discord_intents": {
-        "hash": "sha256-titG9Z0eXKm2QnWm1xdPljUF7s3VBwM3kZN0Mwc730E=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_intents/1/full.distro",
-        "version": 1
-      },
-      "discord_krisp": {
-        "hash": "sha256-9v2+nnjkQeI7RLt2+Q05zfGaKvchoCxRFciJFT5VrDc=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_krisp/1/full.distro",
-        "version": 1
-      },
-      "discord_modules": {
-        "hash": "sha256-LAc5uFvYdg5ruzmd2Msh3c7eegChFoIBXj8X7JYJVqs=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_modules/1/full.distro",
-        "version": 1
-      },
-      "discord_notifications": {
-        "hash": "sha256-mxQb3Em0wDma8EXTN4cULjvW31JwVxDzQ3ne9FcKbC4=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_notifications/1/full.distro",
-        "version": 1
-      },
-      "discord_rpc": {
-        "hash": "sha256-DXSY6qhtxW0S3rE9w5/KO85bsU7JP2ldx5tOoTwoptM=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_rpc/1/full.distro",
-        "version": 1
-      },
-      "discord_spellcheck": {
-        "hash": "sha256-X5BitbmM9HnEex2DsRN3t56tLBRtkyeeY7rZ9QgoNdU=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_spellcheck/1/full.distro",
+        "hash": "sha256-O0p451X8HYslCd9QWJ/SbjQ+tIs3otCfxzBPmZjM6LI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_spellcheck/1/full.distro",
        "version": 1
      },
      "discord_sysimg": {
-        "hash": "sha256-SHpivOq+XZeEiU9EAfD2YMeIo10DvWDmzU0C0cm3wuQ=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_sysimg/1/full.distro",
+        "hash": "sha256-9HxsiEhAPIpTRPoYYvsyakWJT6GaT+3/L1dvtxNZNhA=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_sysimg/1/full.distro",
        "version": 1
      },
      "discord_utils": {
-        "hash": "sha256-MVLPSCP3AxDs3DNFuwyYjlZHyA4cVErANFCMTzorGWk=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_utils/3/full.distro",
-        "version": 3
+        "hash": "sha256-qsB1dfte6qoD+nT0rZ+mJnn6L0p6OSeGVMWQobc9WM4=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_utils/1/full.distro",
+        "version": 1
      },
      "discord_voice": {
-        "hash": "sha256-mfoo7ZBsU/fRkHGxKk0j/i0qj2PnBnzdTSt8pI0t53s=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_voice/2/full.distro",
-        "version": 2
-      },
-      "discord_webauthn": {
-        "hash": "sha256-kCeElNUwLB1yFrHTqP6W+S6/F5npRiYo5uH6M31uNxo=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_webauthn/1/full.distro",
+        "hash": "sha256-icxv/ISGtR5d7ZdQaFzrspulK8KRYZfMzxzatX7/xhI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_voice/1/full.distro",
        "version": 1
      },
      "discord_zstd": {
-        "hash": "sha256-15edfIf+s9zPaYWYw7SPsUGXXFJK9LMGK6LzaDvSiyE=",
-        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1294/discord_zstd/1/full.distro",
+        "hash": "sha256-tndzE1U8DA+K4XGbX9jII7zrSiybG1qAqSzCwypSYYo=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/linux/x64/1.0.156/discord_zstd/1/full.distro",
        "version": 1
      }
    },
-    "version": "0.0.1294"
+    "version": "1.0.156"
+  },
+  "osx-canary": {
+    "distro": {
+      "hash": "sha256-SjRGJwvd+IOkCqrG6akvvlFFpDV4gQozf4mPinKrZQE=",
+      "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/full.distro"
+    },
+    "kind": "distro",
+    "modules": {
+      "discord_cloudsync": {
+        "hash": "sha256-uynrrQxSvQjnGsS2V+CpiRfBCpNzAVgo94nySxMWrGw=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_cloudsync/1/full.distro",
+        "version": 1
+      },
+      "discord_desktop_core": {
+        "hash": "sha256-7tAXBdi+OXZaXl8+camk2IHEwzqrUpHjcc8QYI3oals=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_desktop_core/1/full.distro",
+        "version": 1
+      },
+      "discord_dispatch": {
+        "hash": "sha256-Kd3fZYacc9H2MfOfHIgdDu56HCeRYF60dG6234Uin2c=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_dispatch/1/full.distro",
+        "version": 1
+      },
+      "discord_erlpack": {
+        "hash": "sha256-/JAAcJ/bDJaUllVn+0aAErWysh//dSPrT64uGe5THVU=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_erlpack/1/full.distro",
+        "version": 1
+      },
+      "discord_game_utils": {
+        "hash": "sha256-4x+ZNH831aCeuNVK2RLiAfaYolFcPSXFcnk/Y/19/Nc=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_game_utils/1/full.distro",
+        "version": 1
+      },
+      "discord_intents": {
+        "hash": "sha256-1RzkNxAlvdLr7vpW2sIj+dE/6gkauXbgmyU6ZfROxvk=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_intents/1/full.distro",
+        "version": 1
+      },
+      "discord_krisp": {
+        "hash": "sha256-WY5x578AvlwSUC/tV0j+SZItOCiHqzNZDfV4TfK52XM=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_krisp/1/full.distro",
+        "version": 1
+      },
+      "discord_modules": {
+        "hash": "sha256-tOTaUzDS5EEJpxCT+2eMaELyqrpBpyg4VVAR2qoKpqs=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_modules/1/full.distro",
+        "version": 1
+      },
+      "discord_notifications": {
+        "hash": "sha256-wgywWGbwb4ZOxAbvP1zwGmXYY7YcWVZZ/3oHPTi6+ns=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_notifications/1/full.distro",
+        "version": 1
+      },
+      "discord_rpc": {
+        "hash": "sha256-76+PQX58ftimpJWWaasvVUz5csbR+mKL0DTcUYAYuHs=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_rpc/1/full.distro",
+        "version": 1
+      },
+      "discord_spellcheck": {
+        "hash": "sha256-An1SBmKEPI8pRip6g/YZW6dGsLpx0TIvS+QCkI1YnWs=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_spellcheck/1/full.distro",
+        "version": 1
+      },
+      "discord_sysimg": {
+        "hash": "sha256-9MJv02Fk+ega0kbbLL7/s420Mx149sJFWvkkU66yJuY=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_sysimg/1/full.distro",
+        "version": 1
+      },
+      "discord_utils": {
+        "hash": "sha256-ptioApBU8h3ryIan7db5A77Tf87MTqRRNSVZhiUeUcA=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_utils/1/full.distro",
+        "version": 1
+      },
+      "discord_voice": {
+        "hash": "sha256-pVs09tpg7jTKfm54N1uaRf731Du9vpB7q8UFUHorpWU=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_voice/1/full.distro",
+        "version": 1
+      },
+      "discord_webauthn": {
+        "hash": "sha256-op6K8vlmdjXxsZ2+23CSuZGmdvS7tb7gCq5eRrD1r6g=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_webauthn/1/full.distro",
+        "version": 1
+      },
+      "discord_zstd": {
+        "hash": "sha256-bibBKtu5xxBdtk5lfJAMtrjVMz/YMjzFTjHu2xoTNSc=",
+        "url": "https://canary.dl2.discordapp.net/distro/app/canary/osx/universal/0.0.1306/discord_zstd/1/full.distro",
+        "version": 1
+      }
+    },
+    "version": "0.0.1306"
  },
  "osx-development": {
    "distro": {
@@ -506,187 +501,192 @@
  },
  "osx-ptb": {
    "distro": {
-      "hash": "sha256-mTArbvIvLjOSGpb35GO17K8lnCqAHd6fDdxpzwFKmg4=",
-      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/full.distro"
+      "hash": "sha256-0itWlg4uO9n251oeACGHfgId6sV9WwWXib+xTpLlKdg=",
+      "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/full.distro"
    },
    "kind": "distro",
    "modules": {
      "discord_arborium": {
-        "hash": "sha256-eySEVa1AmxNMG8P1cqxLFftrQjyzWrN8QInF8rUh53Q=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_arborium/1/full.distro",
+        "hash": "sha256-nxM1iYpiUhF5out+DCCJGaiPr/WuQDYXxHHnOVG542U=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_arborium/1/full.distro",
        "version": 1
      },
      "discord_cloudsync": {
-        "hash": "sha256-7/60p+KD/WIxA0ErfHUrSPXGxVTmyNiC9Kcu6WUAPsQ=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_cloudsync/1/full.distro",
+        "hash": "sha256-+XUuoUmKHd0paaXCm64M/6GbI6oox3auQrHo2QB7IqY=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_cloudsync/1/full.distro",
        "version": 1
      },
      "discord_desktop_core": {
-        "hash": "sha256-xtxh0mvHKtAtohJptt/89DhEVpC1UbWloVnhvK3kmO4=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_desktop_core/1/full.distro",
+        "hash": "sha256-+n+arWUqZyDX9pTRYd90uuo//JXqMo6L3mIymSkrUTY=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_desktop_core/1/full.distro",
        "version": 1
      },
      "discord_dispatch": {
-        "hash": "sha256-wi67HEYdj+bL+Zs+PrNkaMSfzjyGR0eMi0smyyvJoig=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_dispatch/1/full.distro",
+        "hash": "sha256-7nuF4fhgJx0B7s73dnGddPr1gLpnaVksRYpKQmqf5Qk=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_dispatch/1/full.distro",
        "version": 1
      },
      "discord_erlpack": {
-        "hash": "sha256-rhf2TnRJaz3uqFq2tu8JCIbUFdBHJFQWupn2BvreeiM=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_erlpack/1/full.distro",
+        "hash": "sha256-YP5XoJ4gdPJwRVP9Poj0G+Rv+ZrWE1O8TQ211LfD6tI=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_erlpack/1/full.distro",
        "version": 1
      },
      "discord_game_utils": {
-        "hash": "sha256-3GlzC6GHnC+hb6YMWNcA9ly7g8vKMuMf48Xv04tpMMw=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_game_utils/1/full.distro",
+        "hash": "sha256-QOggWiTw6TK9mj7mnn5EvoI6Ai/QuF6R6c16vJQQwMA=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_game_utils/1/full.distro",
        "version": 1
      },
      "discord_intents": {
-        "hash": "sha256-6cDb4uNVlpVTiqww03+74raqkOAbWgI0jS5xG0lgO0g=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_intents/1/full.distro",
+        "hash": "sha256-n+LHKnwc/eDih0rCT11BCMNMG0Nb9LluIxkZ/qdLxYs=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_intents/1/full.distro",
        "version": 1
      },
      "discord_krisp": {
-        "hash": "sha256-jx0nK45QkHhkl9DMB81qwJw6GceFu8KPBcQVMvJKRXI=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_krisp/1/full.distro",
+        "hash": "sha256-hnPCYcyTRyXrq/HaQn7HoFlKF13VSvSwTRn3lrzYAxw=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_krisp/1/full.distro",
        "version": 1
      },
      "discord_modules": {
-        "hash": "sha256-kELcckM97k084WfqVyFaJb9Nmdp1UOsXvL8vfeyzDck=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_modules/1/full.distro",
+        "hash": "sha256-l5X0AeddEKdXzc8z3SkiIEeu0aF9pz7SlRN2+jgvJsQ=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_modules/1/full.distro",
        "version": 1
      },
      "discord_notifications": {
-        "hash": "sha256-lVlDGN+qYKOPKUgHZ20b5b36T0GNj2KyHzRQZclJ6w8=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_notifications/1/full.distro",
+        "hash": "sha256-1Hl6kvliMkmATrqPLUazkTkVhjXxuYufjV/wbg8WMsM=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_notifications/1/full.distro",
        "version": 1
      },
      "discord_rpc": {
-        "hash": "sha256-gwqGxzJPCBIoYTftUIUiTi7D1qtsdxDJgCIqM8MRifo=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_rpc/1/full.distro",
+        "hash": "sha256-pZtk1ilJRl6/UnKV70ON4X1gEewdwUHN8l0VjiGb1QU=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_rpc/1/full.distro",
        "version": 1
      },
      "discord_spellcheck": {
-        "hash": "sha256-SeglC/2Wp8DdSt7EAdxdEB4kfx7pAZdelv7OQYb0fz4=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_spellcheck/1/full.distro",
+        "hash": "sha256-wPa9fIcrPk1yln0/dbhdJzJO93Y7G9x+L61mpGmu9Uk=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_spellcheck/1/full.distro",
        "version": 1
      },
      "discord_sysimg": {
-        "hash": "sha256-PDaNTbEZxg4W8HteDJ1QSgUcpizvnRRLGkYp3YNiSkY=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_sysimg/1/full.distro",
+        "hash": "sha256-at2pxdYqY4h7I0vmmpJN+nuSi3b85qZvngfYVwjD7q0=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_sysimg/1/full.distro",
        "version": 1
      },
      "discord_utils": {
-        "hash": "sha256-zGNUOs+uWSAgAht56Oe6y5xgEhtaSKOLwVmNC0L6t6Y=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_utils/1/full.distro",
+        "hash": "sha256-83pMGx2wlw5gCqcZPKwqUqztF6EnJzHSNExi/LaUsn0=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_utils/1/full.distro",
        "version": 1
      },
      "discord_voice": {
-        "hash": "sha256-pF3ki+YCVyrD/dL9aPCgylc7gs21MppkZOHROEiDm+w=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_voice/1/full.distro",
+        "hash": "sha256-bR4oAeMkBEi4miW27/I6YD7wjcQWOaLZJMsEcA5GttM=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_voice/1/full.distro",
        "version": 1
      },
      "discord_webauthn": {
-        "hash": "sha256-z+rVhzu+CL8nu9FfyQESkDbJBWVGHz03j/EGBc1f1vI=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_webauthn/1/full.distro",
+        "hash": "sha256-JAhcJogkRO6w5lgDau3lQs7R9yvuw2J3e5yNeZkeOCc=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_webauthn/1/full.distro",
        "version": 1
      },
      "discord_zstd": {
-        "hash": "sha256-5cNp0u8jlQYI9LBIbi3pmL7jm43tgD3EVq3bamPZSxE=",
-        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.256/discord_zstd/1/full.distro",
+        "hash": "sha256-YuztgnEkhGX5bUhqRTt4CNj3Cr/TKWFs9GFrnLHccXs=",
+        "url": "https://ptb.dl2.discordapp.net/distro/app/ptb/osx/universal/0.0.257/discord_zstd/1/full.distro",
        "version": 1
      }
    },
-    "version": "0.0.256"
+    "version": "0.0.257"
  },
  "osx-stable": {
    "distro": {
-      "hash": "sha256-KfWALYNAd/FX+LQRMIyCt69MY6J5jRS7gFg4jCl4fSY=",
-      "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/full.distro"
+      "hash": "sha256-J2gIsqC0Kzn+G9FaLqkO5xCr4g5VhIyydPHRKt13eMk=",
+      "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/full.distro"
    },
    "kind": "distro",
    "modules": {
      "discord_arborium": {
-        "hash": "sha256-53S9PggFNCKdfQ0sYl6Mn5R5Kngg2/T6eElq9C+DN08=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_arborium/1/full.distro",
+        "hash": "sha256-1qA8sYKihOt3wymjEVgRTPhX2jSVtthc8KX4w54t+qE=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_arborium/1/full.distro",
        "version": 1
      },
      "discord_cloudsync": {
-        "hash": "sha256-/ySgAAJ0n2TWB/wbvB7OihFxRrC7NyTjQ1H4TqvWZ84=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_cloudsync/1/full.distro",
+        "hash": "sha256-VH8rFK6asP+2lGPiC4NbNY4t20dx7qwGmlp7Mj8iVTE=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_cloudsync/1/full.distro",
        "version": 1
      },
      "discord_desktop_core": {
-        "hash": "sha256-szNLjknsUqkkxLPpyJjEfxT46AUjM4g+DTMoPgrxBm0=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_desktop_core/1/full.distro",
+        "hash": "sha256-ZJKB5FeNJ7Z9+tuSxK9zcFG4826VFUMTrT6XHFi36YM=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_desktop_core/1/full.distro",
        "version": 1
      },
      "discord_dispatch": {
-        "hash": "sha256-UoWIZ1Uc0Q6YXSTzulJSWNjgdRyTiX54R05UTh8fTiE=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_dispatch/1/full.distro",
+        "hash": "sha256-D7R3j/sZpwel0WBwshGHqM/HMIWwA1vW2gxUCDpUZKU=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_dispatch/1/full.distro",
        "version": 1
      },
      "discord_erlpack": {
-        "hash": "sha256-xlWB+o/sjHFLZVMFke9RCQt65lBVn/pUT8jNUUkfSyI=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_erlpack/1/full.distro",
+        "hash": "sha256-kSKDbwiqhXVcGWtOqW184yO6uKeACyCAxgEKTOoqGOI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_erlpack/1/full.distro",
        "version": 1
      },
      "discord_game_utils": {
-        "hash": "sha256-Hqs0td1l6gWvdNcn0WA/DfADlZq+OT0+HlgUXiyvwEk=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_game_utils/1/full.distro",
+        "hash": "sha256-jz65aXMzEct+HT1Shs1ziyaksbFIWyAY8YjWZTvt6jI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_game_utils/1/full.distro",
        "version": 1
      },
      "discord_intents": {
-        "hash": "sha256-jKNBNIlXutv2ex6MuO8kmwkx7kcQ2uaIt0f/ogw4Vws=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_intents/1/full.distro",
+        "hash": "sha256-nU9TvJqrH6+ROZsF3WD+L/ZvuIqIuGbfejQe0C0XypY=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_intents/1/full.distro",
        "version": 1
      },
      "discord_krisp": {
-        "hash": "sha256-7OizZzIYAlP4CmZ1kcpFc52ijT6abHYJ4KvQAhaG/J0=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_krisp/1/full.distro",
+        "hash": "sha256-Jm1/RTUsXrvwntxWZKblkRzlwsVGVegzo9uqyjBH98Q=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_krisp/1/full.distro",
        "version": 1
      },
      "discord_modules": {
-        "hash": "sha256-l3obGjd4nK7DQtwoml6PvzmQnYaRu36xAEUjd0TKmIs=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_modules/1/full.distro",
+        "hash": "sha256-7Nsbay4MP424IAtpQCcgEmSeSxVphOFUJuY/Dytb1LY=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_modules/1/full.distro",
        "version": 1
      },
      "discord_notifications": {
-        "hash": "sha256-8XfxczmmMq5w4HRLQnCjxjFV0fQgDwaEkcezXGd7gNU=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_notifications/1/full.distro",
+        "hash": "sha256-4m4DjudjLxua1KUwjKN+DouU8JYxsa7wvTvbCTEkzKU=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_notifications/1/full.distro",
        "version": 1
      },
      "discord_rpc": {
-        "hash": "sha256-1n+gO1c4SZrV2jOD2SVMCQYnHU8e5ErrB0eJEv8hvus=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_rpc/1/full.distro",
+        "hash": "sha256-kv8Qh9F3PmCru7DKmvsJiq+4/LoYAOtpiE9SCpPBMbc=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_rpc/1/full.distro",
        "version": 1
      },
      "discord_spellcheck": {
-        "hash": "sha256-QPZOJTNAU5rShPeV4SU2P9eBmDEbLZHEwThyXdRPsLg=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_spellcheck/1/full.distro",
+        "hash": "sha256-dzieOT9NurZjWKaetEY5Z1DWXe/Axq7eLtPNyT3ATbk=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_spellcheck/1/full.distro",
+        "version": 1
+      },
+      "discord_sysimg": {
+        "hash": "sha256-ruKew+1lZZO9FpvVkJp2U/X4/l5EaTAjuQqZZP+u2wU=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_sysimg/1/full.distro",
        "version": 1
      },
      "discord_utils": {
-        "hash": "sha256-PMv/psANJnI+yhGwsibWDdLGdlUQC8/Rh0h5nmNQfJY=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_utils/1/full.distro",
+        "hash": "sha256-M6Hd5ehiB7j/VLRRzP/UoO5AK7UdCO8iWdlM+5cps3E=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_utils/1/full.distro",
        "version": 1
      },
      "discord_voice": {
-        "hash": "sha256-GtnSgoFM1aGBLLLwaB/81iRhuQvuuNuvNehO3k/UP7c=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_voice/1/full.distro",
+        "hash": "sha256-eHBSpQfP+oDcbctuDhPeNkAT75bfk+IVhe212D2jCTI=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_voice/1/full.distro",
        "version": 1
      },
      "discord_webauthn": {
-        "hash": "sha256-r0WinKYXuJtY0YWn2GHoFrUID1mwBGRMVVJOMLFGSOs=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_webauthn/1/full.distro",
+        "hash": "sha256-Wlqq/elXIb8m8mZF3P6xWG1mViqrUieBmd83mS9V7Rg=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_webauthn/1/full.distro",
        "version": 1
      },
      "discord_zstd": {
-        "hash": "sha256-pBA8Iyv1S7wePlvdNI4lj4MfY2Z8MPtiVaf6EBi8rY0=",
-        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.409/discord_zstd/1/full.distro",
+        "hash": "sha256-+OkUUomOUW6uj1/6cMZmi6dmEkR4HPDkjm1dJ5gSnTY=",
+        "url": "https://stable.dl2.discordapp.net/distro/app/stable/osx/universal/0.0.410/discord_zstd/1/full.distro",
        "version": 1
      }
    },
-    "version": "0.0.409"
+    "version": "0.0.410"
  }
 }
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix
@@ -33,13 +33,13 @@

 stdenv.mkDerivation {
  pname = "tg_owt";
-  version = "0-unstable-2026-04-09";
+  version = "0-unstable-2026-08-03";

  src = fetchFromGitHub {
    owner = "desktop-app";
    repo = "tg_owt";
-    rev = "89df288dd6ba5b2ec95b3c5eaf1e7e0c3a870fc4";
-    hash = "sha256-wdO3AACCEN3IDYWt5a+f7zrcPFoqz+c7vLpo6LZk29w=";
+    rev = "19d51d3c19632a63fdbe17c62f10332d978cb940";
+    hash = "sha256-Cb1XWnryZEKTyvhBeOsYX5KZG88zUOAlSRhfyIh06g4=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
@@ -16,7 +16,7 @@
  kcoreaddons,
  lz4,
  xxhash,
-  ffmpeg_6,
+  ffmpeg,
  protobuf,
  openal-soft,
  minizip-ng-compat,
@@ -29,6 +29,7 @@
  boost,
  ada,
  cmark-gfm,
+  libfido2,
  libavif,
  libheif,
  libjxl,
@@ -46,14 +47,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "telegram-desktop-unwrapped";
-  version = "7.0.2";
+  version = "7.0.9";

  src = fetchFromGitHub {
    owner = "telegramdesktop";
    repo = "tdesktop";
    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-G/A5J2m1sXHD50zDmMD9ehnorAGRjnQ+YGMv6DEiJcQ=";
+    hash = "sha256-zpGfubIZtTmLjAgxYGcMy2N3Xlf9NOppcxsMSUS/KEA=";
  };

  nativeBuildInputs = [
@@ -72,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
    qtsvg
    lz4
    xxhash
-    ffmpeg_6
+    ffmpeg
    openal-soft
    minizip-ng-compat
    range-v3
@@ -83,6 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
    boost
    ada
    cmark-gfm
+    libfido2
    (tdlib.override { tde2eOnly = true; })
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
@@ -106,7 +106,7 @@ let
      gtk3
      ;
    binaryName = "thunderbird";
-    gssSupport = true;
+    withGSSAPI = true;
  };

 in
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -69,14 +69,14 @@ let
    }).override
      (
        {
-          geolocationSupport = false;
-          webrtcSupport = false;
+          enableLocation = false;
+          enableWebRTC = false;

-          pgoSupport = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
+          enablePGO = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
        }
        // lib.optionalAttrs (lib.versionAtLeast version "149") {
          # https://bugzilla.mozilla.org/show_bug.cgi?id=2025767
-          crashreporterSupport = false;
+          enableCrashReporter = false;
        }
      );

--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -8,8 +8,6 @@
  application ? "browser",
  applicationName ? "Firefox",
  branding ? null,
-  requireSigning ? true,
-  allowAddonSideload ? false,
  src,
  unpackPhase ? null,
  extraPatches ? [ ],
@@ -24,12 +22,8 @@
 }:

 let
-  # Rename the variables to prevent infinite recursion
-  requireSigningDefault = requireSigning;
-  allowAddonSideloadDefault = allowAddonSideload;
-
  # Specifying --(dis|en)able-elf-hack on a platform for which it's not implemented will give `--disable-elf-hack is not available in this configuration`
-  # This is declared here because it's used in the default value of elfhackSupport
+  # This is declared here because it's used in the default value of enableElfhack
  isElfhackPlatform =
    stdenv:
    stdenv.hostPlatform.isElf
@@ -50,11 +44,13 @@ in

  # build time
  autoconf,
+  buildPackages,
  cargo,
  dump_syms,
  makeBinaryWrapper,
  mimalloc,
  nodejs,
+  overrideCC,
  perl,
  pkg-config,
  pkgsCross, # wasm32 rlbox
@@ -115,80 +111,73 @@ in
  cups,
  rsync, # used when preparing .app directory

-  # optionals
-
-  ## addon signing/sideloading
-  requireSigning ? requireSigningDefault,
-  allowAddonSideload ? allowAddonSideloadDefault,
-
-  ## debugging
-
-  debugBuild ? false,
-
-  # On 32bit platforms, we disable adding "-g" for easier linking.
-  enableDebugSymbols ? !stdenv.hostPlatform.is32bit,
-
-  ## optional libraries
-
-  alsaSupport ? stdenv.hostPlatform.isLinux,
+  # optional dependencies
+  withALSA ? stdenv.hostPlatform.isLinux,
  alsa-lib,
-  ffmpegSupport ? true,
-  gssSupport ? true,
+  withFFmpeg ? true,
+  withGSSAPI ? true,
  libkrb5,
-  jackSupport ? stdenv.hostPlatform.isLinux,
+  withJACK ? stdenv.hostPlatform.isLinux,
  libjack2,
-  jemallocSupport ? !stdenv.hostPlatform.isMusl,
+  withJemalloc ? !stdenv.hostPlatform.isMusl,
  jemalloc,
-  ltoSupport ? (
+  withPipewire ? withWayland && enableWebRTC,
+  withPulseaudio ? stdenv.hostPlatform.isLinux,
+  libpulseaudio,
+  withSndio ? stdenv.hostPlatform.isLinux,
+  sndio,
+  withWayland ? !stdenv.hostPlatform.isDarwin,
+  libxkbcommon,
+  libdrm,
+
+  # Build configuration
+
+  ## Addon signing/sideloading
+  enableAddonSigning ? true,
+  enableAddonSideload ? false,
+
+  ## Optimizations
+  enableElfhack ?
+    isElfhackPlatform stdenv && !(stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isAarch64),
+  enableLTO ? (
    (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin)
    && stdenv.hostPlatform.is64bit
    && !stdenv.hostPlatform.isRiscV
  ),
-  overrideCC,
-  buildPackages,
-  # PGO merges profile data with a 32-bit llvm-profdata, which runs out of
-  # address space on the huge libxul profile, so disable it on 32-bit.
-  pgoSupport ? (
+  enablePGO ? (
    stdenv.hostPlatform.isLinux
    && stdenv.hostPlatform == stdenv.buildPlatform
+    # PGO merges profile data with a 32-bit llvm-profdata, which runs out of
+    # address space on the huge libxul profile, so disable it on 32-bit.
    && stdenv.hostPlatform.is64bit
  ),
  xvfb-run,
-  elfhackSupport ?
-    isElfhackPlatform stdenv && !(stdenv.hostPlatform.isMusl && stdenv.hostPlatform.isAarch64),
-  pipewireSupport ? waylandSupport && webrtcSupport,
-  pulseaudioSupport ? stdenv.hostPlatform.isLinux,
-  libpulseaudio,
-  sndioSupport ? stdenv.hostPlatform.isLinux,
-  sndio,
-  waylandSupport ? !stdenv.hostPlatform.isDarwin,
-  libxkbcommon,
-  libdrm,

-  ## privacy-related options
+  ## Debugging
+  enableDebug ? false,

-  privacySupport ? false,
+  ## On 32bit platforms, we disable adding "-g" for easier linking.
+  enableDebugSymbols ? !stdenv.hostPlatform.is32bit,

-  # WARNING: NEVER set any of the options below to `true` by default.
-  # Set to `!privacySupport` or `false`.
+  ## Privacy knobs
+  enableDataReporting ? true,
+  enableLocation ? true,
+  enableWebRTC ? true,
+  enableNeckoWiFi ? enableLocation,

-  crashreporterSupport ?
-    !privacySupport
+  ## Crash reporting
+  ## https://crash-stats.mozilla.org/search/?distribution_id=%3Dnixos
+  enableCrashReporter ?
+    enableDataReporting
    && !stdenv.hostPlatform.isLoongArch64
    && !stdenv.hostPlatform.isRiscV
    && !stdenv.hostPlatform.isMusl,
  curl,
-  geolocationSupport ? !privacySupport,
-  webrtcSupport ? !privacySupport,

-  # digital rights management
-
-  # This flag controls whether Firefox will show the nagbar, that allows
-  # users at runtime the choice to enable Widevine CDM support when a site
-  # requests it.
-  # Controlling the nagbar and widevine CDM at runtime is possible by setting
-  # `browser.eme.ui.enabled` and `media.gmp-widevinecdm.enabled` accordingly
-  drmSupport ? true,
+  ## DRM / Encrypted Media Extensions
+  # Build time toggle to control whether the DRM nagbar will appear
+  # (browser.eme.ui.enabled), when sites require it to playback media.
+  enableEMENagbar ? true,

  # As stated by Sylvestre Ledru (@sylvestre) on Nov 22, 2017 at
  # https://github.com/NixOS/nixpkgs/issues/31843#issuecomment-346372756 we
@@ -213,10 +202,10 @@ in

 assert stdenv.cc.libc or null != null;
 assert
-  pipewireSupport
-  -> !waylandSupport || !webrtcSupport
-  -> throw "${pname}: pipewireSupport requires both wayland and webrtc support.";
-assert elfhackSupport -> isElfhackPlatform stdenv;
+  withPipewire
+  -> !withWayland || !enableWebRTC
+  -> throw "${pname}: Pipewire support depends on Wayland and WebRTC support.";
+assert enableElfhack -> isElfhackPlatform stdenv;

 let
  inherit (lib) enableFeature;
@@ -238,7 +227,7 @@ let
  # LTO requires LLVM bintools including ld.lld and llvm-ar.
  buildStdenv = overrideCC llvmPackages.stdenv (
    llvmPackages.stdenv.cc.override {
-      bintools = if ltoSupport then buildPackages.rustc.llvmPackages.bintools else stdenv.cc.bintools;
+      bintools = if enableLTO then buildPackages.rustc.llvmPackages.bintools else stdenv.cc.bintools;
    }
  );

@@ -273,7 +262,7 @@ let
    );

  defaultPrefs =
-    if geolocationSupport then
+    if enableLocation then
      {
        "geo.provider.network.url" = {
          value = "https://api.beacondb.net/v1/geolocate";
@@ -284,7 +273,7 @@ let
      {
        "geo.provider.use_geoclue" = {
          value = false;
-          reason = "Geolocation support has been disabled through the `geolocationSupport` package attribute.";
+          reason = "Geolocation support has been disabled through the `enableLocation` package attribute.";
        };
      };

@@ -301,7 +290,7 @@ let
    if stdenv.hostPlatform.isDarwin then
      "cairo-cocoa"
    else
-      "cairo-gtk3${lib.optionalString waylandSupport "-wayland"}";
+      "cairo-gtk3${lib.optionalString withWayland "-wayland"}";

 in

@@ -324,10 +313,10 @@ buildStdenv.mkDerivation {
  outputs = [
    "out"
  ]
-  ++ lib.optionals crashreporterSupport [ "symbols" ];
+  ++ lib.optionals enableCrashReporter [ "symbols" ];

  # Add another configure-build-profiling run before the final configure phase if we build with pgo
-  preConfigurePhases = lib.optionals pgoSupport [
+  preConfigurePhases = lib.optionals enablePGO [
    "configurePhase"
    "buildPhase"
    "profilingPhase"
@@ -393,11 +382,11 @@ buildStdenv.mkDerivation {
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [ rsync ]
  ++ lib.optionals stdenv.hostPlatform.isx86 [ nasm ]
-  ++ lib.optionals crashreporterSupport [
+  ++ lib.optionals enableCrashReporter [
    dump_syms
    patchelf
  ]
-  ++ lib.optionals pgoSupport [ xvfb-run ]
+  ++ lib.optionals enablePGO [ xvfb-run ]
  ++ extraNativeBuildInputs;

  setOutputFlags = false; # `./mach configure` doesn't understand `--*dir=` flags.
@@ -430,7 +419,7 @@ buildStdenv.mkDerivation {
    export WASM_CC=${pkgsCross.wasm32-wasip1.stdenv.cc}/bin/${pkgsCross.wasm32-wasip1.stdenv.cc.targetPrefix}cc
    export WASM_CXX=${pkgsCross.wasm32-wasip1.stdenv.cc}/bin/${pkgsCross.wasm32-wasip1.stdenv.cc.targetPrefix}c++
  ''
-  + lib.optionalString pgoSupport ''
+  + lib.optionalString enablePGO ''
    if [ -e "$TMPDIR/merged.profdata" ]; then
      echo "Configuring with profiling data"
      for i in "''${!configureFlagsArray[@]}"; do
@@ -464,7 +453,7 @@ buildStdenv.mkDerivation {
  + lib.optionalString (enableOfficialBranding && !stdenv.hostPlatform.is32bit) ''
    export MOZILLA_OFFICIAL=1
  ''
-  + lib.optionalString (!requireSigning) ''
+  + lib.optionalString (!enableAddonSigning) ''
    export MOZ_REQUIRE_SIGNING=
  ''
  + lib.optionalString stdenv.hostPlatform.isMusl ''
@@ -491,13 +480,13 @@ buildStdenv.mkDerivation {
    "--target=${buildStdenv.hostPlatform.config}"
  ]
  # LTO is done using clang and lld.
-  ++ lib.optionals ltoSupport [
+  ++ lib.optionals enableLTO [
    "--enable-lto=cross,full" # Cross-Language LTO
    "--enable-linker=lld"
  ]
-  ++ lib.optional (isElfhackPlatform stdenv) (enableFeature elfhackSupport "elf-hack")
-  ++ lib.optional (!drmSupport) "--disable-eme"
-  ++ lib.optional allowAddonSideload "--allow-addon-sideload"
+  ++ lib.optional (isElfhackPlatform stdenv) (enableFeature enableElfhack "elf-hack")
+  ++ lib.optional (!enableEMENagbar) "--disable-eme"
+  ++ lib.optional enableAddonSideload "--allow-addon-sideload"
  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
    # MacOS builds use bundled versions of libraries: https://bugzilla.mozilla.org/show_bug.cgi?id=1776255
    "--enable-system-pixman"
@@ -514,27 +503,28 @@ buildStdenv.mkDerivation {
    "--with-system-zlib"

    # These options are not available on MacOS, even --disable-*
-    (enableFeature alsaSupport "alsa")
-    (enableFeature jackSupport "jack")
-    (enableFeature pulseaudioSupport "pulseaudio")
-    (enableFeature sndioSupport "sndio")
+    (enableFeature withALSA "alsa")
+    (enableFeature withJACK "jack")
+    (enableFeature withPulseaudio "pulseaudio")
+    (enableFeature withSndio "sndio")
  ]
  ++ lib.optionals (!buildStdenv.hostPlatform.isDarwin && lib.versionAtLeast version "141") [
    "--with-onnx-runtime=${lib.getLib onnxruntime}/lib"
  ]
  ++ [
-    (enableFeature crashreporterSupport "crashreporter")
-    (enableFeature ffmpegSupport "ffmpeg")
-    (enableFeature geolocationSupport "necko-wifi")
-    (enableFeature gssSupport "negotiateauth")
-    (enableFeature jemallocSupport "jemalloc")
-    (enableFeature webrtcSupport "webrtc")
+    (enableFeature withFFmpeg "ffmpeg")
+    (enableFeature withGSSAPI "negotiateauth")
+    (enableFeature withJemalloc "jemalloc")

-    (enableFeature debugBuild "debug")
-    (if debugBuild then "--enable-profiling" else "--enable-optimize")
+    (enableFeature enableCrashReporter "crashreporter")
+    (enableFeature enableNeckoWiFi "necko-wifi")
+    (enableFeature enableWebRTC "webrtc")
+
+    (enableFeature enableDebug "debug")
+    (if enableDebug then "--enable-profiling" else "--enable-optimize")
    # --enable-release adds -ffunction-sections & LTO that require a big amount
    # of RAM, and the 32-bit memory space cannot handle that linking
-    (enableFeature (!debugBuild && !stdenv.hostPlatform.is32bit) "release")
+    (enableFeature (!enableDebug && !stdenv.hostPlatform.is32bit) "release")
    (enableFeature enableDebugSymbols "debug-symbols")
  ]
  ++ lib.optionals enableDebugSymbols [
@@ -597,20 +587,20 @@ buildStdenv.mkDerivation {
      zlib
      (if (lib.versionAtLeast version "144") then nss_latest else nss_esr)
    ]
-    ++ lib.optional alsaSupport alsa-lib
-    ++ lib.optional jackSupport libjack2
-    ++ lib.optional pulseaudioSupport libpulseaudio # only headers are needed
-    ++ lib.optional sndioSupport sndio
-    ++ lib.optionals waylandSupport [
+    ++ lib.optional withALSA alsa-lib
+    ++ lib.optional withJACK libjack2
+    ++ lib.optional withPulseaudio libpulseaudio # only headers are needed
+    ++ lib.optional withSndio sndio
+    ++ lib.optionals withWayland [
      libxkbcommon
      libdrm
    ]
  ))
-  ++ lib.optional gssSupport libkrb5
-  ++ lib.optional jemallocSupport jemalloc
+  ++ lib.optional withGSSAPI libkrb5
+  ++ lib.optional withJemalloc jemalloc
  ++ extraBuildInputs;

-  profilingPhase = lib.optionalString pgoSupport ''
+  profilingPhase = lib.optionalString enablePGO ''
    # Avoid compressing the instrumented build with high levels of compression
    export MOZ_PKG_FORMAT=TAR

@@ -663,7 +653,7 @@ buildStdenv.mkDerivation {
  # Generate build symbols once after the final build
  # https://firefox-source-docs.mozilla.org/crash-reporting/uploading_symbol.html
  preInstall =
-    lib.optionalString crashreporterSupport ''
+    lib.optionalString enableCrashReporter ''
      ./mach buildsymbols
      mkdir -p $symbols/
      cp objdir/dist/*.crashreporter-symbols.zip $symbols/
@@ -697,7 +687,7 @@ buildStdenv.mkDerivation {
      cd ..
    '';

-  postFixup = lib.optionalString (crashreporterSupport && buildStdenv.hostPlatform.isLinux) ''
+  postFixup = lib.optionalString (enableCrashReporter && buildStdenv.hostPlatform.isLinux) ''
    patchelf --add-rpath "${lib.makeLibraryPath [ curl ]}" $out/lib/${binaryName}/crashreporter
  '';

@@ -715,21 +705,25 @@ buildStdenv.mkDerivation {
    '';

  passthru = {
-    inherit applicationName;
-    inherit application extraPatches;
-    inherit updateScript;
-    inherit alsaSupport;
-    inherit binaryName;
-    inherit requireSigning allowAddonSideload;
-    inherit jackSupport;
-    inherit pipewireSupport;
-    inherit sndioSupport;
-    inherit nspr;
-    inherit ffmpegSupport;
-    inherit gssSupport;
-    inherit tests;
-    inherit gtk3;
-    inherit wasiSysRoot;
+    inherit
+      application
+      applicationName
+      binaryName
+      enableAddonSideload
+      enableAddonSigning
+      extraPatches
+      gtk3
+      nspr
+      tests
+      updateScript
+      wasiSysRoot
+      withALSA
+      withFFmpeg
+      withGSSAPI
+      withJACK
+      withPipewire
+      withSndio
+      ;
    version = packageVersion;
  }
  // extraPassthru;
--- a/pkgs/by-name/_6/_64gram/package.nix
+++ b/pkgs/by-name/_6/_64gram/package.nix
@@ -10,13 +10,13 @@ telegram-desktop.override {
  inherit withWebkit;
  unwrapped = telegram-desktop.unwrapped.overrideAttrs (old: rec {
    pname = "64gram-unwrapped";
-    version = "1.2.5";
+    version = "1.2.7";

    src = fetchFromGitHub {
      owner = "TDesktop-x64";
      repo = "tdesktop";
      tag = "v${version}";
-      hash = "sha256-CcYcdSgeVEbGKOzim+Q/gIxMIfDGaSStF4cLLttA+SM=";
+      hash = "sha256-5Ovx/71wf0SV4RUwEmIvf1Q686AZ5WPxn9WlgklAMf4=";
      fetchSubmodules = true;
    };

--- a/pkgs/by-name/ag/age-plugin-fido2prf/package.nix
+++ b/pkgs/by-name/ag/age-plugin-fido2prf/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "age-plugin-fido2prf";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "FiloSottile";
    repo = "typage";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JGEn1xIzfLyoCWd/aRRG08Z/OoviEyZF+tGEfcj9DXw=";
+    hash = "sha256-vwE4u7xMHe0pGY/18ZbIAnoMyFyWlIbVbpQH4ZIbgZ8=";
  };

  srcRoot = "${finalAttrs.src}/fido2prf/cmd/age-plugin-fido2prf";
--- a/pkgs/by-name/as/ashell/package.nix
+++ b/pkgs/by-name/as/ashell/package.nix
@@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ashell";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "MalpenZibo";
    repo = "ashell";
    tag = finalAttrs.version;
-    hash = "sha256-QRNEc2HNqA1tZk/jW/MXDwXda58yNlkw86SCTjH1/1w=";
+    hash = "sha256-1ci09G9qQCAmYnERtd1Pm2hZPEL0AMuYF7B9AlnnfbE=";
  };

-  cargoHash = "sha256-bLZcRASBGV9Y/QlDVBdOl2ElZDLI1KUAh5MlOsjmlKs=";
+  cargoHash = "sha256-yuj74sMsL1c0vLEb0iyXTJYUw0rH7bJdxJRVVpPCkf0=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/au/audacity/package.nix
+++ b/pkgs/by-name/au/audacity/package.nix
@@ -31,7 +31,7 @@
  libid3tag,
  libopus,
  libuuid,
-  ffmpeg_8,
+  ffmpeg,
  soundtouch,
  portaudio, # given up fighting their portaudio.patch?
  portmidi,
@@ -58,18 +58,15 @@
 # TODO
 # 1. detach sbsms

-let
-  ffmpeg = ffmpeg_8;
-in
 stdenv.mkDerivation (finalAttrs: {
  pname = "audacity";
-  version = "3.7.8";
+  version = "3.7.9";

  src = fetchFromGitHub {
    owner = "audacity";
    repo = "audacity";
    rev = "Audacity-${finalAttrs.version}";
-    hash = "sha256-Vp3Nx3LuNu5fqeLF6dvZ9/hhkoUCu0eCAdIEDtS1IwU=";
+    hash = "sha256-q/5LPL76GPEFGRxTZcuxmLuq15fwbw2Mak/q2RObghk=";
  };

  patches = [
--- a/pkgs/by-name/ba/balena-compose-parser/package.nix
+++ b/pkgs/by-name/ba/balena-compose-parser/package.nix
@@ -6,13 +6,13 @@
 buildGoModule rec {
  __structuredAttrs = true;
  pname = "balena-compose-parser";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "balena-io-modules";
    repo = "balena-compose-parser";
    rev = "v${version}";
-    hash = "sha256-VOFSdcygi3YlRlV48zV1fGtRgFSio2KBZCs25iqBmLY=";
+    hash = "sha256-fEvLu2xZlYoILM4DThiSQHG2gbGOB5IQVgmwcLKsKwo=";
  };

  modRoot = "lib";
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@@ -159,5 +159,8 @@ stdenv.mkDerivation (finalAttrs: {
      "x86_64-linux"
      "aarch64-darwin"
    ];
+    knownVulnerabilities = [
+      "Uses Electron 39.8.1, which was EOL on March 13 2026, with several known CVEs"
+    ];
  };
 })
--- a/pkgs/by-name/bu/buildstream/package.nix
+++ b/pkgs/by-name/bu/buildstream/package.nix
@@ -24,14 +24,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "buildstream";
-  version = "2.7.0";
+  version = "2.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "apache";
    repo = "buildstream";
    tag = finalAttrs.version;
-    hash = "sha256-eHZmimuwOo3ZHZw5QF94B6wkso1+QbZIcgpDgsw1hiM=";
+    hash = "sha256-TS1er7lWoaMaVnfT1GAApt2qxxyTrl0o354v6rIpgCA=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/cw/cwal/package.nix
+++ b/pkgs/by-name/cw/cwal/package.nix
@@ -2,31 +2,27 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  cmake,
-  pkg-config,
+  pkgconf,
  imagemagick,
  libimagequant,
  luajit,
-  makeBinaryWrapper,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "cwal";
-  version = "0.9.0";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "nitinbhat972";
    repo = "cwal";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-RDtYBgqTG3Ycn1D6QtaHGZVXKxw8UqhzssxXA4temYo=";
+    hash = "sha256-n9v2EiW1wRMsYoNk+m20qQao52vvmD6NDM8Z/oEyjbU=";
  };

  strictDeps = true;

  nativeBuildInputs = [
-    cmake
-    pkg-config
-    makeBinaryWrapper
+    pkgconf
  ];

  buildInputs = [
@@ -35,9 +31,23 @@ stdenv.mkDerivation (finalAttrs: {
    luajit
  ];

-  postFixup = ''
-    wrapProgram $out/bin/cwal \
-      --prefix XDG_DATA_DIRS : $out/share
+  postPatch = ''
+    substituteInPlace config.h \
+      --replace-fail '#define INSTALL_DIR "/usr"' \
+      "#define INSTALL_DIR \"$out\""
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    cc nob.c -o nob
+    ./nob build
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    ./nob install
+    runHook postInstall
  '';

  meta = {
--- a/pkgs/by-name/cy/cypress/package.nix
+++ b/pkgs/by-name/cy/cypress/package.nix
@@ -127,5 +127,8 @@ stdenv.mkDerivation rec {
      Crafter
      jonhermansen
    ];
+    knownVulnerabilities = [
+      "Uses Electron 37.6.0, EOL on October 4, 2025, Several CVEs known."
+    ];
  };
 }
--- a/pkgs/by-name/da/daktari/package.nix
+++ b/pkgs/by-name/da/daktari/package.nix
@@ -7,7 +7,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "daktari";
-  version = "0.0.350";
+  version = "0.0.353";
  pyproject = true;
  __structuredAttrs = true;

@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "genio-learn";
    repo = "daktari";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JpLY+s88UcNgpy6K7+ZmLUCDlxqNtbuW3wIz8phy7Ag=";
+    hash = "sha256-gVch0gfuUd6/33z6KK7hTHOjG0rPaBThruqMLHf+2PA=";
  };

  patches = [ ./optional-pyclip.patch ];
--- a/pkgs/by-name/da/darkplaces/package.nix
+++ b/pkgs/by-name/da/darkplaces/package.nix
@@ -23,8 +23,13 @@ stdenv.mkDerivation {
    zlib
    libjpeg
    SDL2
-    libx11
-  ];
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ libx11 ];
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace makefile.inc \
+      --replace-fail '$(SDLCONFIG_STATICLIBS)' '$(SDLCONFIG_LIBS)'
+  '';

  buildFlags = [ "release" ];

@@ -38,12 +43,18 @@ stdenv.mkDerivation {
    runHook postInstall
  '';

-  postFixup = ''
-    patchelf \
-      --add-needed ${libvorbis}/lib/libvorbisfile.so \
-      --add-needed ${libvorbis}/lib/libvorbis.so \
-      $out/bin/darkplaces
-  '';
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      patchelf \
+        --add-needed ${libvorbis}/lib/libvorbisfile.so \
+        --add-needed ${libvorbis}/lib/libvorbis.so \
+        $out/bin/darkplaces
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      ${stdenv.cc.targetPrefix}install_name_tool \
+        -add_rpath ${lib.getLib libvorbis}/lib \
+        $out/bin/darkplaces
+    '';

  meta = {
    homepage = "https://www.icculus.org/twilight/darkplaces/";
@@ -56,6 +67,6 @@ stdenv.mkDerivation {
    '';
    maintainers = with lib.maintainers; [ necrophcodr ];
    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
  };
 }
--- a/pkgs/by-name/do/docuum/package.nix
+++ b/pkgs/by-name/do/docuum/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "docuum";
-  version = "0.27.0";
+  version = "0.27.1";

  src = fetchFromGitHub {
    owner = "stepchowfun";
    repo = "docuum";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Avd+37mY9E28kfqRI8W3Lx5O/RrxuHFwBnXZqqdrkNQ=";
+    hash = "sha256-yy2mZx2eFgEpYVvO0Dgvf42b2rK+xMiIiF5tFz+1tV0=";
  };

-  cargoHash = "sha256-VrCtfE4WvTlKeLsJVm73kNvo3lH90nt+imG2Yqse8K0=";
+  cargoHash = "sha256-GVjVX942kAUWZuR7k4Yu1GS9DbSr9HMoM/rfdUVXX5o=";

  checkFlags = [
    # fails, no idea why
--- a/pkgs/by-name/do/dokuwiki/package.nix
+++ b/pkgs/by-name/do/dokuwiki/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "dokuwiki";
-  version = "2026-07-14b";
+  version = "2026-07-14c";

  src = fetchFromGitHub {
    owner = "dokuwiki";
    repo = "dokuwiki";
    rev = "release-${version}";
-    sha256 = "sha256-w/uVk60gdr4PhUMOHHYl+X87Hx9pojYqJo5sZXLUX6o=";
+    sha256 = "sha256-84kMuFTWYo6Cjd6qpkZsLZoECIP9IzSrc9dX1uKMp0M=";
  };

  preload = writeText "preload.php" ''
--- a/pkgs/by-name/dp/dpkg/package.nix
+++ b/pkgs/by-name/dp/dpkg/package.nix
@@ -16,6 +16,7 @@
  diffutils,
  versionCheckHook,
  glibc,
+  bashNonInteractive,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -113,7 +114,9 @@ stdenv.mkDerivation (finalAttrs: {
    xz
    zstd
    libmd
+    bashNonInteractive
  ];
+
  nativeBuildInputs = [
    makeWrapper
    perl
@@ -121,6 +124,8 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
  ];

+  strictDeps = true;
+
  postInstall = ''
    for i in $out/bin/*; do
      if head -n 1 $i | grep -q perl; then
@@ -138,6 +143,8 @@ stdenv.mkDerivation (finalAttrs: {

  setupHook = ./setup-hook.sh;

+  __structuredAttrs = true;
+
  meta = {
    description = "Debian package manager";
    homepage = "https://wiki.debian.org/Teams/Dpkg";
--- a/pkgs/by-name/er/ergo/package.nix
+++ b/pkgs/by-name/er/ergo/package.nix
@@ -9,11 +9,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ergo";
-  version = "6.0.4";
+  version = "6.0.5";

  src = fetchurl {
    url = "https://github.com/ergoplatform/ergo/releases/download/v${finalAttrs.version}/ergo-${finalAttrs.version}.jar";
-    sha256 = "sha256-PeFQiRx+oE9cbNSPjVPU5/q7Ib+ZnFoXiattnszXT4c=";
+    sha256 = "sha256-Kn4peMsJU47WeA2FrjqjnB7M4Q5eWm4Nw82KsIeFFYg=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -11,17 +11,17 @@

 buildNpmPackage rec {
  pname = "firebase-tools";
-  version = "15.28.1";
+  version = "15.28.2";
  nodejs = nodejs_22;

  src = fetchFromGitHub {
    owner = "firebase";
    repo = "firebase-tools";
    tag = "v${version}";
-    hash = "sha256-Dls7xLkHnvLGQnw72RoOYw8iz2axHNBBKdzVwWpfWHE=";
+    hash = "sha256-19cIgkZ0luZYYx+9Cs077b5Q+sLxf+4ahwWO6hspxDw=";
  };

-  npmDepsHash = "sha256-u8zhpnd2avSXiIZi6rj8y6JI9ngqTxIhlPR+Xor3ka8=";
+  npmDepsHash = "sha256-ZcI4Do4NcTIhJx1o/Hb9fZysv7WyGMLOUKMb4SUbeTY=";

  # No more package-lock.json in upstream src
  postPatch = ''
--- a/pkgs/by-name/fi/firefoxpwa-unwrapped/package.nix
+++ b/pkgs/by-name/fi/firefoxpwa-unwrapped/package.nix
@@ -99,12 +99,12 @@ rustPlatform.buildRustPackage rec {
    # wrapped similarly to `firefoxRuntime`, and these passthru variables are
    # read when `wrapFirefox` wraps this derivation too.
    inherit (firefoxRuntime)
-      ffmpegSupport
-      gssSupport
-      alsaSupport
-      pipewireSupport
-      sndioSupport
-      jackSupport
+      withALSA
+      withFFmpeg
+      withGSSAPI
+      withJACK
+      withPipewire
+      withSndio
      ;
  };

--- a/pkgs/by-name/fl/floorp-bin-unwrapped/package.nix
+++ b/pkgs/by-name/fl/floorp-bin-unwrapped/package.nix
@@ -113,8 +113,8 @@ stdenv.mkDerivation (finalAttrs: {
    inherit binaryName;
    applicationName = "Floorp";
    libName = "floorp-bin-${finalAttrs.version}";
-    ffmpegSupport = true;
-    gssSupport = true;
+    withFFmpeg = true;
+    withGSSAPI = true;
    gtk3 = gtk3;
    updateScript = ./update.sh;
  };
--- a/pkgs/by-name/fo/foot/package.nix
+++ b/pkgs/by-name/fo/foot/package.nix
@@ -27,7 +27,7 @@
 }:

 let
-  version = "1.27.0";
+  version = "1.28.0";

  # build stimuli file for PGO build and the script to generate it
  # independently of the foot's build, so we can cache the result
@@ -40,7 +40,7 @@ let

    src = fetchurl {
      url = "https://codeberg.org/dnkl/foot/raw/tag/${version}/scripts/generate-alt-random-writes.py";
-      hash = "sha256-d7oE3hSStET9Bz8PcmRHSZ+ga+7lrL3/oJdx7phNei8=";
+      hash = "sha256-RUCG4EK9+aXe+EKvFYv6/JzQBglGZHyaEpr63v8akW4=";
    };

    dontUnpack = true;
@@ -103,7 +103,7 @@ stdenv.mkDerivation {
    owner = "dnkl";
    repo = "foot";
    tag = version;
-    hash = "sha256-jbE44SpMqDhOOT2o4Wh7UCdXn6bBqxOMskCHHTzEKmU=";
+    hash = "sha256-CZlbQut5jM8/dWuLlJPDaLBykV7K5l/caB3DLQ94mG8=";
  };

  separateDebugInfo = true;
--- a/pkgs/by-name/fr/frame-media-converter/package.nix
+++ b/pkgs/by-name/fr/frame-media-converter/package.nix
@@ -25,7 +25,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "frame-media-converter";
-  version = "0.33.0";
+  version = "0.33.1";

  __structuredAttrs = true;

@@ -33,10 +33,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "66HEX";
    repo = "frame";
    tag = finalAttrs.version;
-    hash = "sha256-Nz1ct+Hkc1f7llXT925gBwAivfz1QCpTJW1WzjratTI=";
+    hash = "sha256-oUJ6yiSZGrpdKra22H/nyLjDh9f6p9gOA9TeXjlDuRY=";
  };

-  cargoHash = "sha256-n1HlMAYHrHwZN+nxA5dgTghcrNaYKL3LLtphcc2Ty7U=";
+  cargoHash = "sha256-Rq2/CWxKN7HmmFtmt26CMfVwmwc4Wl2wnbvB9inVsHw=";
  cargoBuildFlags = cargoFlags;
  cargoTestFlags = cargoFlags;

--- a/pkgs/by-name/gi/github-copilot-app/package.nix
+++ b/pkgs/by-name/gi/github-copilot-app/package.nix
@@ -95,7 +95,8 @@ stdenv.mkDerivation {
        cp -r *.app $out/Applications/

        mkdir -p $out/bin
-        ln -s "$out/Applications/"*.app/Contents/MacOS/* $out/bin/github-copilot-app
+        ln -s "$out/Applications/"*.app/Contents/MacOS/git-credential-copilot "$out"/bin/git-credential-copilot
+        ln -s "$out/Applications/"*.app/Contents/MacOS/github "$out"/bin/github-copilot-app
      ''
    else
      ''
--- a/pkgs/by-name/go/gobgp/package.nix
+++ b/pkgs/by-name/go/gobgp/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "gobgp";
-  version = "4.8.0";
+  version = "4.9.0";

  src = fetchFromGitHub {
    owner = "osrg";
    repo = "gobgp";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-nU/HjHi0nKQy8SelwKSHneRjaRVNfvif4dljhPpUZrI=";
+    sha256 = "sha256-52eJtAQfDF76vvLQMxnttPgXppaumZcZ/toOoLeYBu8=";
  };

  vendorHash = "sha256-9r8LZlCF4sr8VTyJfDktjhk32afc8ep7GXtqxUnAleE=";
--- a/pkgs/by-name/go/gobgpd/package.nix
+++ b/pkgs/by-name/go/gobgpd/package.nix
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "gobgpd";
-  version = "4.8.0";
+  version = "4.9.0";

  src = fetchFromGitHub {
    owner = "osrg";
    repo = "gobgp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nU/HjHi0nKQy8SelwKSHneRjaRVNfvif4dljhPpUZrI=";
+    hash = "sha256-52eJtAQfDF76vvLQMxnttPgXppaumZcZ/toOoLeYBu8=";
  };

  vendorHash = "sha256-9r8LZlCF4sr8VTyJfDktjhk32afc8ep7GXtqxUnAleE=";
--- a/pkgs/by-name/go/goose/package.nix
+++ b/pkgs/by-name/go/goose/package.nix
@@ -7,17 +7,17 @@

 buildGoModule (finalAttrs: {
  pname = "goose";
-  version = "3.27.3";
+  version = "3.28.0";

  src = fetchFromGitHub {
    owner = "pressly";
    repo = "goose";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-CSS0OtC4/EeQD7PGin64U0Fag2z490RQ7CKNBRyp8f8=";
+    hash = "sha256-V7kpDIJOyWB0O6uGQmxO1lgfdUYXIGJ3ycmXGu20H94=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-opO6G9Fdyt27GlWyaB/6J1xhm3wTgH9Xc/FYcLcqBVs=";
+  vendorHash = "sha256-phtM6ClEwszIE7TQVXJbRLvSk0uSbng6h/pQsjHmjGU=";

  # skipping: end-to-end tests require a docker daemon
  postPatch = ''
--- a/pkgs/by-name/gp/gpu-viewer/package.nix
+++ b/pkgs/by-name/gp/gpu-viewer/package.nix
@@ -29,7 +29,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "gpu-viewer";
-  version = "3.35";
+  version = "4.00";
  pyproject = false;
  __structuredAttrs = true;

@@ -37,7 +37,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "arunsivaramanneo";
    repo = "gpu-viewer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-W8BPtHbOwLZ95bY6ZmAaKS87fh+gOWZIhxjWKqiavag=";
+    hash = "sha256-zSPXOWdd962DvwqYiit9wGT6vDxvgkQz91852+h4d7Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gr/graphify/package.nix
+++ b/pkgs/by-name/gr/graphify/package.nix
@@ -8,14 +8,14 @@
 python3Packages.buildPythonApplication rec {
  __structuredAttrs = true;
  pname = "graphify";
-  version = "0.9.48";
+  version = "0.9.53";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Graphify-Labs";
    repo = "graphify";
    tag = "v${version}";
-    hash = "sha256-gcQ8isXZQu/VQkK74vAaOKnbNdsxiez+TSZdRUxEMiA=";
+    hash = "sha256-1G8PuSxYM70nMf8glJARA9vVMI8Ue7zqfAxgXi18lPM=";
  };

  build-system = [
--- a/pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch
+++ b/pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch
@@ -1,42 +1,86 @@
+From dc1b837925f7c2ee6663cf34bbd982e0b368d811 Mon Sep 17 00:00:00 2001
+From: hustlerone <nine-ball@tutanota.com>
+Date: Sun, 18 Jan 2026 11:57:36 +0100
+Subject: [PATCH] Add hidden menu entries
+
+Merge conflicts manually resolved.
+
+https://lists.gnu.org/archive/html/grub-devel/2016-04/msg00089.html
+https://marc.info/?l=grub-devel&m=146193404929072&w=2
+
+Vendored in:
+https://build.opensuse.org/projects/openSUSE:Factory/packages/grub2/files/grub2-Add-hidden-menu-entries.patch?expand=1
+---
+ grub-core/commands/blsuki.c    |  4 ++--
+ grub-core/commands/legacycfg.c |  4 ++--
+ grub-core/commands/menuentry.c | 22 +++++++++++++++++-----
+ grub-core/normal/menu.c        | 30 ++++++++++++++++++++++++++----
+ grub-core/normal/menu_text.c   |  6 +++++-
+ include/grub/menu.h            |  2 ++
+ include/grub/normal.h          |  2 +-
+ 7 files changed, 55 insertions(+), 15 deletions(-)
+
+diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c
+index 4133d3111..26055f91f 100644
+--- a/grub-core/commands/blsuki.c
+++ b/grub-core/commands/blsuki.c
+@@ -1022,7 +1022,7 @@ bls_create_entry (grub_blsuki_entry_t *entry)
+ 			linux_cmd, initrd_cmd ? initrd_cmd : "",
+ 			dt_cmd ? dt_cmd : "");
+ 
+-  grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, entry);
+  grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, entry, 0);
+ 
+  finish:
+   grub_free (linux_cmd);
+@@ -1088,7 +1088,7 @@ uki_create_entry (grub_blsuki_entry_t *entry)
+ 			(options != NULL) ? " " : "",
+ 			(options != NULL) ? options : "");
+ 
+-  grub_normal_add_menu_entry (1, argv, NULL, id, NULL, NULL, NULL, src, 0, entry);
+  grub_normal_add_menu_entry (1, argv, NULL, id, NULL, NULL, NULL, src, 0, entry, 0);
+ 
+  finish:
+   grub_free (argv);
 diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c
-index e9e9d94ef..54e08a1b4 100644
+index 7d9f9eb3c..bb5b7b3ad 100644
 --- a/grub-core/commands/legacycfg.c
 +++ b/grub-core/commands/legacycfg.c
@@ -143,7 +143,7 @@ legacy_file (const char *filename)
 	    args[0] = oldname;
 	    grub_normal_add_menu_entry (1, args, NULL, NULL, "legacy",
 					NULL, NULL,
-					entrysrc, 0);
-+					entrysrc, 0, 0);
+-					entrysrc, 0, NULL);
+					entrysrc, 0, NULL, 0);
 	    grub_free (args);
 	    entrysrc[0] = 0;
 	    grub_free (oldname);
-@@ -205,7 +205,7 @@ legacy_file (const char *filename)
+@@ -204,7 +204,7 @@ legacy_file (const char *filename)
 	}
       args[0] = entryname;
       grub_normal_add_menu_entry (1, args, NULL, NULL, NULL,
-				  NULL, NULL, entrysrc, 0);
-+				  NULL, NULL, entrysrc, 0, 0);
+-				  NULL, NULL, entrysrc, 0, NULL);
+				  NULL, NULL, entrysrc, 0, NULL, 0);
       grub_free (args);
     }
 
 diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
-index 720e6d8ea..50632ccce 100644
+index 5e1318f17..288189b8d 100644
 --- a/grub-core/commands/menuentry.c
 +++ b/grub-core/commands/menuentry.c
@@ -78,7 +78,7 @@ grub_normal_add_menu_entry (int argc, const char **args,
 			    char **classes, const char *id,
 			    const char *users, const char *hotkey,
 			    const char *prefix, const char *sourcecode,
-			    int submenu)
-+			    int submenu, int hidden)
+-			    int submenu, grub_blsuki_entry_t *blsuki)
+			    int submenu, grub_blsuki_entry_t *blsuki, int hidden)
 {
   int menu_hotkey = 0;
   char **menu_args = NULL;
-@@ -188,8 +188,11 @@ grub_normal_add_menu_entry (int argc, const char **args,
-   (*last)->args = menu_args;
+@@ -189,8 +189,11 @@ grub_normal_add_menu_entry (int argc, const char **args,
   (*last)->sourcecode = menu_sourcecode;
   (*last)->submenu = submenu;
+   (*last)->blsuki = blsuki;
 +  (*last)->hidden = hidden;
 +
 +  if (!hidden)
@@ -46,27 +90,28 @@ index 720e6d8ea..50632ccce 100644
   return GRUB_ERR_NONE;
 
  fail:
-@@ -286,7 +289,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
- 				       users,
+@@ -291,7 +294,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
 				       ctxt->state[2].arg, 0,
 				       ctxt->state[3].arg,
-				       ctxt->extcmd->cmd->name[0] == 's');
-+				       ctxt->extcmd->cmd->name[0] == 's',
+ 				       ctxt->extcmd->cmd->name[0] == 's',
+-				       NULL);
+				       NULL,
 +               ctxt->extcmd->cmd->name[0] == 'h');
 
   src = args[argc - 1];
   args[argc - 1] = NULL;
-@@ -303,7 +307,8 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+@@ -308,7 +312,9 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
 				  ctxt->state[0].args, ctxt->state[4].arg,
 				  users,
 				  ctxt->state[2].arg, prefix, src + 1,
-				  ctxt->extcmd->cmd->name[0] == 's');
+-				  ctxt->extcmd->cmd->name[0] == 's', NULL);
 +				  ctxt->extcmd->cmd->name[0] == 's',
+          NULL,
 +          ctxt->extcmd->cmd->name[0] == 'h');
 
   src[len - 1] = ch;
   args[argc - 1] = src;
-@@ -311,7 +316,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
+@@ -316,7 +322,7 @@ grub_cmd_menuentry (grub_extcmd_context_t ctxt, int argc, char **args)
   return r;
 }
 
@@ -75,7 +120,7 @@ index 720e6d8ea..50632ccce 100644
 
 void
 grub_menu_init (void)
-@@ -327,6 +332,12 @@ grub_menu_init (void)
+@@ -332,6 +338,12 @@ grub_menu_init (void)
 				  | GRUB_COMMAND_FLAG_EXTRACTOR,
 				  N_("BLOCK"), N_("Define a submenu."),
 				  options);
@@ -89,10 +134,10 @@ index 720e6d8ea..50632ccce 100644
 
 void
 diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c
-index 6a90e091f..4236f55bc 100644
+index b946c834d..483a3505c 100644
 --- a/grub-core/normal/menu.c
 +++ b/grub-core/normal/menu.c
-@@ -37,6 +37,8 @@
+@@ -38,6 +38,8 @@
    entry failing to boot.  */
 #define DEFAULT_ENTRY_ERROR_DELAY_MS  2500
 
@@ -101,7 +146,7 @@ index 6a90e091f..4236f55bc 100644
 grub_err_t (*grub_gfxmenu_try_hook) (int entry, grub_menu_t menu,
 				     int nested) = NULL;
 
-@@ -80,8 +82,20 @@ grub_menu_get_entry (grub_menu_t menu, int no)
+@@ -81,8 +83,20 @@ grub_menu_get_entry (grub_menu_t menu, int no)
 {
   grub_menu_entry_t e;
 
@@ -124,7 +169,7 @@ index 6a90e091f..4236f55bc 100644
 
   return e;
 }
-@@ -93,10 +107,10 @@ get_entry_index_by_hotkey (grub_menu_t menu, int hotkey)
+@@ -94,10 +108,10 @@ get_entry_index_by_hotkey (grub_menu_t menu, int hotkey)
   grub_menu_entry_t entry;
   int i;
 
@@ -137,7 +182,7 @@ index 6a90e091f..4236f55bc 100644
 
   return -1;
 }
-@@ -509,6 +523,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+@@ -510,6 +524,10 @@ get_entry_number (grub_menu_t menu, const char *name)
       grub_menu_entry_t e = menu->entry_list;
       int i;
 
@@ -148,7 +193,7 @@ index 6a90e091f..4236f55bc 100644
       grub_errno = GRUB_ERR_NONE;
 
       for (i = 0; e; i++)
-@@ -520,6 +538,10 @@ get_entry_number (grub_menu_t menu, const char *name)
+@@ -521,6 +539,10 @@ get_entry_number (grub_menu_t menu, const char *name)
 	      break;
 	    }
 	  e = e->next;
@@ -160,10 +205,10 @@ index 6a90e091f..4236f55bc 100644
 
       if (! e)
 diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
-index b1321eb26..d2e46cac8 100644
+index 9c383e64a..e55bafa6c 100644
 --- a/grub-core/normal/menu_text.c
 +++ b/grub-core/normal/menu_text.c
-@@ -289,7 +289,11 @@ print_entries (grub_menu_t menu, const struct menu_viewer_data *data)
+@@ -292,7 +292,11 @@ print_entries (grub_menu_t menu, const struct menu_viewer_data *data)
       print_entry (data->geo.first_entry_y + i, data->offset == i,
 		   e, data);
       if (e)
@@ -177,10 +222,10 @@ index b1321eb26..d2e46cac8 100644
 
   grub_term_gotoxy (data->term,
 diff --git a/include/grub/menu.h b/include/grub/menu.h
-index ee2b5e910..eb8a86ba9 100644
+index 8d06e8400..f7a302081 100644
 --- a/include/grub/menu.h
 +++ b/include/grub/menu.h
-@@ -58,6 +58,8 @@ struct grub_menu_entry
+@@ -72,6 +72,8 @@ struct grub_menu_entry
 
   int submenu;
 
@@ -188,17 +233,20 @@ index ee2b5e910..eb8a86ba9 100644
 +
   /* The next element.  */
   struct grub_menu_entry *next;
- };
+ 
 diff --git a/include/grub/normal.h b/include/grub/normal.h
-index 218cbabcc..bcb412466 100644
+index d0150e3c2..4c1fe8ec1 100644
 --- a/include/grub/normal.h
 +++ b/include/grub/normal.h
@@ -145,7 +145,7 @@ grub_normal_add_menu_entry (int argc, const char **args, char **classes,
 			    const char *id,
 			    const char *users, const char *hotkey,
 			    const char *prefix, const char *sourcecode,
-			    int submenu);
-+			    int submenu, int hidden);
+-			    int submenu, grub_blsuki_entry_t *blsuki);
+			    int submenu, grub_blsuki_entry_t *blsuki, int hidden);
 
 grub_err_t
 grub_normal_set_password (const char *user, const char *password);
+-- 
+2.51.2
+
--- a/pkgs/by-name/gr/grub2/bootstrap-po-downloads.patch
+++ b/pkgs/by-name/gr/grub2/bootstrap-po-downloads.patch
@@ -0,0 +1,13 @@
+diff --git a/bootstrap b/bootstrap
+index dc9fb4383..5d0e90a92 100755
+--- a/bootstrap
+++ b/bootstrap
+@@ -931,7 +931,7 @@ update_po_files() {
+   # Usually contains *.s1 checksum files.
+   ref_po_dir="$po_dir/.reference"
+ 
+-  test -d $ref_po_dir || mkdir $ref_po_dir || return
+  test -d $ref_po_dir && return || mkdir $ref_po_dir
+   download_po_files $ref_po_dir $domain \
+     && ls "$ref_po_dir"/*.po 2>/dev/null |
+       sed 's|.*/||; s|\.po$||' > "$po_dir/LINGUAS" || return
--- a/pkgs/by-name/gr/grub2/package.nix
+++ b/pkgs/by-name/gr/grub2/package.nix
@@ -1,12 +1,15 @@
 {
  lib,
  stdenv,
+  fetchurl,
  fetchgit,
  flex,
  bison,
  python3,
  autoconf,
+  autoconf-archive,
  automake,
+  autoreconfHook,
  libtool,
  bash,
  gettext,
@@ -23,6 +26,7 @@
  buildPackages,
  nixosTests,
  fuse3, # only needed for grub-mount
+  xz, # for xz compression support. Usually counterproductive, so don't try to force compression in your GRUB install.
  runtimeShell,
  zfs ? null,
  efiSupport ? false,
@@ -30,7 +34,8 @@
  zfsSupport ? false,
  xenSupport ? false,
  xenPvhSupport ? false,
-  kbdcompSupport ? false,
+  corebootSupport ? false,
+  kbdcompSupport ? corebootSupport,
  ckbcomp,
 }:

@@ -40,6 +45,11 @@ let
    x86_64-linux.target = "i386";
  };

+  corebootSystemsBuild = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = "i386";
+  };
+
  efiSystemsBuild = {
    i686-linux.target = "i386";
    x86_64-linux.target = "x86_64";
@@ -80,8 +90,8 @@ let
  inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.attrNames pcSystems);

  gnulib = fetchgit {
-    url = "https://git.savannah.gnu.org/git/gnulib.git";
-    # NOTE: keep in sync with bootstrap.conf!
+    url = "https://https.git.savannah.gnu.org/git/gnulib.git";
+    # NOTE: get $GNULIB_REVISION from bootstrap.conf!
    rev = "9f48fb992a3d7e96610c4ce8be969cff2d61a01b";
    hash = "sha256-mzbF66SNqcSlI+xmjpKpNMwzi13yEWoc1Fl7p4snTto=";
  };
@@ -90,9 +100,12 @@ let
  # but those translations are not versioned/stable. For that reason
  # we take them from the nearest release tarball instead:
  locales = fetchzip {
-    url = "https://ftp.gnu.org/gnu/grub/grub-2.12.tar.gz";
-    hash = "sha256-IoRiJHNQ58y0UhCAD0CrpFiI8Mz1upzAtyh5K4Njh/w=";
+    url = "mirror://gnu/grub/grub-${version}.tar.gz";
+    hash = "sha256-NUlE6l8Ul3i1Si9mZgND6lnvFqc74EGptHV2iCtu+As=";
  };
+
+  # This is the variable that sets the GRUB release.
+  version = "2.14";
 in

 assert zfsSupport -> zfs != null;
@@ -103,505 +116,81 @@ assert lib.asserts.assertMsg (
      ieee1275Support
      xenSupport
      xenPvhSupport
+      corebootSupport
    ]
  ) <= 1 # (0 == pc)
 ) "Only <= 1 of grub2's platform-related *Support options may be enabled at the same time";

 stdenv.mkDerivation rec {
  pname = "grub";
-  version = "2.12";
+  inherit version;

  src = fetchgit {
-    url = "https://git.savannah.gnu.org/git/grub.git";
+    url = "https://gitlab.freedesktop.org/gnu-grub/grub.git";
    tag = "grub-${version}";
-    hash = "sha256-lathsBb2f7urh8R86ihpTdwo3h1hAHnRiHd5gCLVpBc=";
+    hash = "sha256-Gkpde5CeJOQ+0p5WGwXZ2P881jxrWkuFw3Fh4lul/so=";
  };

-  patches = [
-    ./fix-bash-completion.patch
-    ./add-hidden-menu-entries.patch
+  patches =
+    let
+      grubPatch = commit: "https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/${commit}.patch";
+    in
+    [
+      ./fix-bash-completion.patch
+      ./add-hidden-menu-entries.patch
+      ./bootstrap-po-downloads.patch

-    # https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
-    (fetchpatch {
-      name = "01_implement_grub_strlcpy.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f";
-      hash = "sha256-MSMgu1vMG83HRImUUsTyA1YQaIhgEreGGPd+ZDWSI2I=";
-    })
-    (fetchpatch {
-      name = "02_CVE-2024-45781.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba";
-      hash = "sha256-q8ErK+cQzaqwSuhLRFL3AfYBkpgJq1IQmadnlmlz2yw=";
-    })
-    (fetchpatch {
-      name = "03_CVE-2024-45782_CVE-2024-56737.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=417547c10410b714e43f08f74137c24015f8f4c3";
-      hash = "sha256-mRinw27WZ2d1grzyzFGO18yXx72UVBM6Lf5cR8XJfs8=";
-    })
-    (fetchpatch {
-      name = "04_fs_tar_initialize_name_in_grub_cpio_find_file.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c8ac08c99466c0697f704242363fc687f492a0d";
-      hash = "sha256-EMGF0B+Fw6tSmllWUJAp1ynzWk+w2C/XM1LmXSReHWg=";
-    })
-    (fetchpatch {
-      name = "05_CVE-2024-45780.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3";
-      hash = "sha256-IlW5i4EJVoUYPu9/lb0LeytTpzltQuu5fpkFPQNIhls=";
-    })
-    (fetchpatch {
-      name = "06_fs_f2fs_grub_errno_mount_fails.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=563436258cde64da6b974880abff1bf0959f4da3";
-      hash = "sha256-Iu0RPyB+pAnqMT+MTX+TrJbYJsvYPn7jbMgE1jcLh/Q=";
-    })
-    (fetchpatch {
-      name = "07_CVE-2024-45783.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898";
-      hash = "sha256-V1wh2dPeTazmad61jFtOjhq2MdoD+txPWY/AfwwyTZM=";
-    })
-    (fetchpatch {
-      name = "08_fs_iso9660_grub_errno_mount_fails.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=965db5970811d18069b34f28f5f31ddadde90a97";
-      hash = "sha256-6eN1AvZwXkJOQVcjgymy/E7QiAxzL/d0W3KlAZRqUzI=";
-    })
-    (fetchpatch {
-      name = "09_fs_iso9660_fix_invalid_free.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1443833a9535a5873f7de3798cf4d8389f366611";
-      hash = "sha256-Gt5yMy5Vg9zrDggj3o/TLNt2vT9/6IuHg4Se2p8e8pI=";
-    })
-    (fetchpatch {
-      name = "10_fs_jfs_fix_oob_read_jfs_getent.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66175696f3a385b14bdf1ebcda7755834bd2d5fb";
-      hash = "sha256-ETbzbc5gvf55sTLjmJOXXC9VH3qcP1Gv5seR/U9NRiY=";
-    })
-    (fetchpatch {
-      name = "11_fs_jfs_fix_oob_read_caused_by_invalid_dir_slot_index.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ab09fd0531f3523ac0ef833404526c98c08248f7";
-      hash = "sha256-wE6niiIx4BdN800/Eegb6IbBRoMFpXq9kPvatwhWNXY=";
-    })
-    (fetchpatch {
-      name = "12_fs_jfs_use_full_40_bits_offset_and_address_for_data_extent.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bd999310fe67f35a66de3bfa2836da91589d04ef";
-      hash = "sha256-fbC4oTEIoGWJASzJI5RXfoanrMLTfjFOI51LCUU7Ctg=";
-    })
-    (fetchpatch {
-      name = "13_fs_jfs_inconsistent_signed_unsigned_types_usage.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=edd995a26ec98654d907a9436a296c2d82bc4b28";
-      hash = "sha256-aa1G1vi4bPZejfKEqZokAZTzY9Ea2lyxTrP4drDV9tk=";
-    })
-    (fetchpatch {
-      name = "14_fs_ext2_fix_out-of-bounds_read_for_inline_extent.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7e2f750f0a795c4d64ec7dc7591edac8da2e978c";
-      hash = "sha256-PtPqZHMU2fy7btRRaaswLyHizplxnygCzDfcg5ievOQ=";
-    })
-    (fetchpatch {
-      name = "15_fs_ntfs_fix_out-of-bounds_read.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aff26318783a135562b904ff09e2359893885732";
-      hash = "sha256-znN6lkAB9aAhTGKR1038DzOz5nzuTp+7ylHVqRM7HeI=";
-    })
-    (fetchpatch {
-      name = "16_fs_ntfs_track_the_end_of_the_MFT_attribute_buffer.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=237a71184a32d1ef7732f5f49ed6a89c5fe1c99a";
-      hash = "sha256-0I/g0qHkWY6PArPn1UaYRhCrrh9bHknADh34v5eSjjM=";
-    })
-    (fetchpatch {
-      name = "17_fs_ntfs_use_a_helper_function_to_access_attributes.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=048777bc29043403d077d41a81d0183767b8bc71";
-      hash = "sha256-Mm49MSLqCq143r8ruLJm1QoyCoLtOlCBfqoAPwPlv8E=";
-    })
-    # Patch 18 (067b6d225d482280abad03944f04e30abcbdafa1) has been removed because it causes regressions
-    # https://lists.gnu.org/archive/html/grub-devel/2025-03/msg00067.html
-    (fetchpatch {
-      name = "19_fs_xfs_fix_out-of-bounds_read.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6ccc77b59d16578b10eaf8a4fe85c20b229f0d8a";
-      hash = "sha256-FvTzFvfEi3oyxPC/dUHreyzzeVCskaUlYUjpKY/l0DE=";
-    })
-    (fetchpatch {
-      name = "20_fs_xfs_ensuring_failing_to_mount_sets_a_grub_errno.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d1d6b7ea58aa5a80a4c4d0666b49460056c8ef0a";
-      hash = "sha256-SLdXMmYHq/gRmWrjRrOu5ZYFod84EllUL6hk+gnr3kg=";
-    })
-    (fetchpatch {
-      name = "21_kern_file_ensure_file_data_is_set.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a7910687294b29288ac649e71b47493c93294f17";
-      hash = "sha256-DabZK9eSToEmSA9dEwtEN+URiVyS9qf6e2Y2UiMuy8Q=";
-    })
-    (fetchpatch {
-      name = "22_kern_file_implement_filesystem_reference_counting.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=16f196874fbe360a1b3c66064ec15adadf94c57b";
-      excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12
-      hash = "sha256-yGU//1tPaxi+xFKZrsbUAnvgFpwtrIMG+8cPbSud4+U=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_1_key_protector_add_key_protectors_framework.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5d260302da672258444b01239803c8f4d753e3f3";
-      hash = "sha256-5aFHzc5qXBNLEc6yzI17AH6J7EYogcXdLxk//1QgumY=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_2_disk_cryptodisk_allow_user_to_retry_failed_passphrase.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=386b59ddb42fa3f86ddfe557113b25c8fa16f88c";
-      hash = "sha256-e1kGQB7wGWvEb2bY3xIpZxE1uzTt9JOKi05jXyUm+bI=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_3_cryptodisk_support_key_protectors.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ad0c52784a375cecaa8715d7deadcf5d65baf173";
-      hash = "sha256-+YIvUYA3fLiOFFsXDrQjqjWFluzLa7N1tv0lwq8BqCs=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_4_cryptodisk_fallback_to_passphrase.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6abf8af3c54abc04c4ec71c75d10fcfbc190e181";
-      hash = "sha256-eMu9rW4iJucDAsTQMJD1XE6dDIcUmn02cGqIaqBbO3o=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_5_cryptodisk_wipe_out_the_cached_keys_from_protectors.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b35480b48e6f9506d8b7ad8a3b5206d29c24ea95";
-      hash = "sha256-5L6Rr+X5Z+Ip91z8cpLcatDW1vyEoZa1icL2oMXPXuI=";
-    })
-    (fetchpatch {
-      name = "23_prerequisite_6_cli_lock_add_build_option_to_block_command_line_interface.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bb65d81fe320e4b20d0a9b32232a7546eb275ecc";
-      hash = "sha256-HxXgtvEhtaIjXbOcxJHNpD9/NVOv3uXPnue7cagEMu8=";
-    })
-    (fetchpatch {
-      name = "23_CVE-2024-49504.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13febd78db3cd85dcba67d8ad03ad4d42815f11e";
-      hash = "sha256-GejDL9IKbmbSUmp8F1NuvBcFAp2/W04jxmOatI5dKn8=";
-    })
-    (fetchpatch {
-      name = "24_disk_loopback_reference_tracking_for_the_loopback.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=67f70f70a36b6e87a65f928fe1e840a12eafb7ae";
-      hash = "sha256-sWBnSF3rAuY1A/IIK1Pc+BqTvyK3j7+lLEhvImtBQMA=";
-    })
-    (fetchpatch {
-      name = "25_kern_disk_limit_recursion_depth.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=18212f0648b6de7d71d4c8f41eb4d8b78b3a299b";
-      hash = "sha256-HiVzXUNs45Fxh4DSqO8wAxSBM7CaYU/bix0PVBcIHGw=";
-    })
-    (fetchpatch {
-      name = "26_kern_partition_limit_recursion_in_part_iterate.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8a7103fddfd6664f41081f3bb88eebbf2871da2a";
-      hash = "sha256-Nw1VFRVww1VSDSBkRrnTGeaA2PKCitugM12XH6X/2YI=";
-    })
-    (fetchpatch {
-      name = "27_script_execute_limit_the_recursion_depth.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8a937ccae5c6d86dc4375698afca5cefdcd01e1";
-      hash = "sha256-YOAdPMZ2iBNMzIwAXFkkyTMKh4ptZUQ0J3v9EjnRlbo=";
-    })
-    (fetchpatch {
-      name = "28_net_unregister_net_default_ip_and_net_default_mac_variables_hooks_on_unload.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a1dd8e59da26f1a9608381d3a1a6c0f465282b1d";
-      hash = "sha256-7fqdkhFqLECzhz1OLavkHrE9ktDAEmx9ZxZayNr/Eo4=";
-    })
-    (fetchpatch {
-      name = "29_net_remove_variables_hooks_when_interface_is_unregisted.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=aa8b4d7facef7b75a2703274b1b9d4e0e734c401";
-      hash = "sha256-m3VLDbJlwchV5meEpU4LJrDxBtA80qvYcVMJinHLnac=";
-    })
-    (fetchpatch {
-      name = "30_CVE-2025-0624.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5eef88152833062a3f7e017535372d64ac8ef7e1";
-      hash = "sha256-DvhzHnenAmO9SZpi4kU+0GhyKZB4q4xQYuNJgEhJmn0=";
-    })
-    (fetchpatch {
-      name = "31_net_tftp_fix_stack_buffer_overflow_in_tftp_open.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0707accab1b9be5d3645d4700dde3f99209f9367";
-      hash = "sha256-16NrpWFSE4jFT2uxmJg16jChw8HiGRTol25XQXNQ5l4=";
-    })
-    (fetchpatch {
-      name = "32_CVE-2024-45774.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2c34af908ebf4856051ed29e46d88abd2b20387f";
-      hash = "sha256-OWmF+fp2TmetQjV4EWMcESW8u52Okkb5C5IPLfczyv4=";
-    })
-    (fetchpatch {
-      name = "33_kern_dl_fix_for_an_integer_overflow_in_grub_dl_ref.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=500e5fdd82ca40412b0b73f5e5dda38e4a3af96d";
-      hash = "sha256-FNqOWo+oZ4/1sCbTi2uaeKchUxwAKXtbzhScezm0yxk=";
-    })
-    # Patch 34 (https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d72208423dcabf9eb4a3bcb17b6b31888396bd49)
-    # is skipped, grub_dl_set_mem_attrs() does not exist on 2.12
-    (fetchpatch {
-      name = "35_kern_dl_check_for_the_SHF_INFO_LINK_flag_in_grub_dl_relocate_symbols.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=98ad84328dcabfa603dcf5bd217570aa6b4bdd99";
-      hash = "sha256-Zi4Pj2NbodL0VhhO5MWhvErb8xmA7Li0ur0MxpgQjzg=";
-    })
-    (fetchpatch {
-      name = "36_CVE-2024-45775.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872";
-      hash = "sha256-T6DO8iuImQTP7hPaCAHMtFnheQoCkZ6w+kfNolLPmrY=";
-    })
-    (fetchpatch {
-      name = "37_commands_ls_fix_NULL_dereference.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0bf56bce47489c059e50e61a3db7f682d8c44b56";
-      hash = "sha256-h5okwqv4ZFahP3ANUbsk1fiSV4pwEnxUExeBgQ4tiTI=";
-    })
-    (fetchpatch {
-      name = "38_CVE-2025-0622.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=2123c5bca7e21fbeb0263df4597ddd7054700726";
-      hash = "sha256-tFE7VgImGZWDICyvHbrI1hqW6/XohgdTmk21MzljMGw=";
-    })
-    (fetchpatch {
-      name = "39_CVE-2025-0622.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9c16197734ada8d0838407eebe081117799bfe67";
-      hash = "sha256-tTeuEvadKbXVuY0m0dKtTr11Lpb3yQi4zk0bpwrMOeA=";
-    })
-    (fetchpatch {
-      name = "40_CVE-2025-0622.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637";
-      hash = "sha256-khRLpWqE7hzzoqssVkGFMjAv09T+uHn13Q9pCpogMms=";
-    })
-    (fetchpatch {
-      name = "41_CVE-2024-45776.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91";
-      hash = "sha256-yrl/6XUdKQg/MLe8KFuFoRRbQSyOhDmyvnWBV+sr3EY=";
-    })
-    (fetchpatch {
-      name = "42_CVE-2024-45777.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=b970a5ed967816bbca8225994cd0ee2557bad515";
-      hash = "sha256-Vl5Emw3O3Ba2hD1GCWune4PGduDDPO0gM5u+zx/OwKo=";
-    })
-    (fetchpatch {
-      name = "43_CVE-2025-0690.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc";
-      hash = "sha256-DeWOncndX2VM8w1lb5fd5wHAZrI+ChB5Pj9XbUIfDWY=";
-    })
-    (fetchpatch {
-      name = "44_commands_test_stack_overflow_due_to_unlimited_recursion_depth.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c68b7d23628a19da67ebe2e06f84165ee04961af";
-      hash = "sha256-aputM9KqkB/cK8hBiU9VXbu0LpLNlNCMVIeE9h2pMgY=";
-    })
-    (fetchpatch {
-      name = "45_CVE-2025-1118.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=34824806ac6302f91e8cabaa41308eaced25725f";
-      hash = "sha256-PKQs+fCwj4a9p4hbMqAT3tFNoAOw4xnbKmCwjPUgEOc=";
-    })
-    (fetchpatch {
-      name = "46_commands_memrw_disable_memory_reading_in_lockdown_mode.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=340e4d058f584534f4b90b7dbea2b64a9f8c418c";
-      hash = "sha256-NiMIUnfRreDBw+k4yxUzoRNMFL8pkJhVtkINVgmv5XA=";
-    })
-    (fetchpatch {
-      name = "47_commands_hexdump_disable_memory_reading_in_lockdown_mode.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5f31164aed51f498957cdd6ed733ec71a8592c99";
-      hash = "sha256-NA7QjxZ9FP+WwiOveqLkbZqsF7hULIyaVS3gNaSUXJE=";
-    })
-    (fetchpatch {
-      name = "48_CVE-2024-45778_CVE-2024-45779.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630";
-      hash = "sha256-1+ImwkF/qsejWs2lpyO6xbcqVo2NJGv32gjrP8mEPnI=";
-    })
-    (fetchpatch {
-      name = "49_CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4bc55da28543d2522a939ba4ee0acde45f2fa74";
-      hash = "sha256-qrlErSImMX8eXJHkXjOe5GZ6lWOya5SVpNoiqyEM1lE=";
-    })
-    (fetchpatch {
-      name = "50_disk_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c407724dad6c3e2fc1571e57adbda71cc03f82aa";
-      hash = "sha256-kkAjxXvCdzwqh+oWtEF3qSPiUX9cGWO6eSFVeo7WJzQ=";
-    })
-    (fetchpatch {
-      name = "51_disk_prevent_overflows_when_allocating_memory_for_arrays.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d8151f98331ee4d15fcca59edffa59246d8fc15f";
-      hash = "sha256-2U+gMLigOCCg3P1GB615xQ0B9PDA6j92tt1ba3Tqg+E=";
-    })
-    (fetchpatch {
-      name = "52_disk_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=33bd6b5ac5c77b346769ab5284262f94e695e464";
-      hash = "sha256-+BaJRskWP/YVEdvIxMvEydjQx2LpLlGphRtZjiOUxJ0=";
-    })
-    (fetchpatch {
-      name = "53_disk_ieee1275_ofdisk_call_grub_ieee1275_close_when_grub_malloc_fails.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=fbaddcca541805c333f0fc792b82772594e73753";
-      hash = "sha256-9sGA41HlB/8rtT/fMfkDo4ZJMXBSr+EyN92l/0gDfl4=";
-    })
-    (fetchpatch {
-      name = "54_fs_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=6608163b08a7a8be4b0ab2a5cd4593bba07fe2b7";
-      excludes = [ "grub-core/fs/erofs.c" ]; # Does not exist on 2.12
-      hash = "sha256-mW4MH5VH5pDxCaFhNh/4mEcYloga56p8vCi7X4kSaek=";
-    })
-    (fetchpatch {
-      name = "55_CVE-2025-0678_CVE-2025-1125.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=84bc0a9a68835952ae69165c11709811dae7634e";
-      hash = "sha256-rCliqM2+k7rTGNpdHFkg3pHvuISjoG0MQr6/8lIvwK4=";
-    })
-    (fetchpatch {
-      name = "56_fs_prevent_overflows_when_assigning_returned_values_from_read_number.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cde9f7f338f8f5771777f0e7dfc423ddf952ad31";
-      hash = "sha256-dN3HJXNIYtaUZL0LhLabC4VKK6CVC8km9UTw/ln/6ys=";
-    })
-    (fetchpatch {
-      name = "57_fs_zfs_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=88e491a0f744c6b19b6d4caa300a576ba56db7c9";
-      hash = "sha256-taSuKyCf9+TiQZcF26yMWpDDQqCfTdRuZTqB9aEz3aA=";
-    })
-    (fetchpatch {
-      name = "58_fs_zfs_prevent_overflows_when_allocating_memory_for_arrays.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7f38e32c7ebeaebb79e2c71e3c7d5ea367d3a39c";
-      hash = "sha256-E5VmP7I4TAEXxTz3j7mi/uIr9kOSzMoPHAYAbyu56Xk=";
-    })
-    (fetchpatch {
-      name = "59_fs_zfs_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=13065f69dae0eeb60813809026de5bd021051892";
-      hash = "sha256-1W//rHUspDS+utdNc069J8lX1ONfoBKiJYnUt46C/D0=";
-    })
-    (fetchpatch {
-      name = "60_fs_zfs_add_missing_NULL_check_after_grub_strdup_call.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dd6a4c8d10e02ca5056681e75795041a343636e4";
-      hash = "sha256-iFLEkz5G6aQ8FXGuY7/wgN4d4o0+sUxWMKYIFcQ/H+o=";
-    })
-    (fetchpatch {
-      name = "61_net_use_safe_math_macros_to_prevent_overflows.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4beeff8a31c4fb4071d2225533cfa316b5a58391";
-      hash = "sha256-/gs5ZhplQ1h7PWw0p+b5+0OxmRcvDRKWHj39ezhivcg=";
-    })
-    (fetchpatch {
-      name = "62_net_prevent_overflows_when_allocating_memory_for_arrays.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=dee2c14fd66bc497cdc74c69fde8c9b84637c8eb";
-      hash = "sha256-cO02tCGEeQhQF0TmgtNOgUwRLnNgmxhEefo1gtSlFOk=";
-    })
-    (fetchpatch {
-      name = "63_net_check_if_returned_pointer_for_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1c06ec900591d1fab6fbacf80dc010541d0a5ec8";
-      hash = "sha256-oSRhWWVraitoVDqGlFOVzdCkaNqFGOHLjJu75CSc388=";
-    })
-    (fetchpatch {
-      name = "64_fs_sfs_check_if_allocated_memory_is_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e3c578a56f9294e286b6028ca7c1def997a17b15";
-      hash = "sha256-7tvFbmjWmWmmRykQjMvZV6IYlhSS8oNR7YfaO5XXAfU=";
-    })
-    (fetchpatch {
-      name = "65_script_execute_fix_potential_underflow_and_NULL.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=d13b6e8ebd10b4eb16698a002aa40258cf6e6f0e";
-      hash = "sha256-paMWaAIImzxtufUrVF5v4T4KnlDAJIPhdaHznu5CyZ8=";
-    })
-    (fetchpatch {
-      name = "66_osdep_unix_getroot_fix_potential_underflow.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=66733f7c7dae889861ea3ef3ec0710811486019e";
-      hash = "sha256-/14HC1kcW7Sy9WfJQFfC+YnvS/GNTMP+Uy6Dxd3zkwc=";
-    })
-    (fetchpatch {
-      name = "67_misc_ensure_consistent_overflow_error_messages.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=f8795cde217e21539c2f236bcbb1a4bf521086b3";
-      hash = "sha256-4X7wr1Tg16xDE9FO6NTlgkfLV5zFKmajeaOspIqcCuI=";
-    })
-    (fetchpatch {
-      name = "68_bus_usb_ehci_define_GRUB_EHCI_TOGGLE_as_grub_uint32_t.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9907d9c2723304b42cf6da74f1cc6c4601391956";
-      hash = "sha256-D8xaI8g7ffGGmZqqeS8wxWIFLUWUBfmHwMVOHkYTc2I=";
-    })
-    (fetchpatch {
-      name = "69_normal_menu_use_safe_math_to_avoid_an_integer_overflow.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=5b36a5210e21bee2624f8acc36aefd8f10266adb";
-      hash = "sha256-UourmM0Zlaj4o+SnYi5AtjfNujDOt+2ez2XH/uWyiaM=";
-    })
-    (fetchpatch {
-      name = "70_kern_partition_add_sanity_check_after_grub_strtoul_call.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8e6e87e7923ca2ae880021cb42a35cc9bb4c8fe2";
-      hash = "sha256-4keMUu6ZDKmuSQlFnldV15dDGUibsnSvoEWhLsqWieI=";
-    })
-    (fetchpatch {
-      name = "71_kern_misc_add_sanity_check_after_grub_strtoul_call.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=a8d6b06331a75d75b46f3dd6cc6fcd40dcf604b7";
-      hash = "sha256-2Mpe1sqyuoUPyMAKGZTNzG/ig3G3K8w0gia7lc508Rg=";
-    })
-    (fetchpatch {
-      name = "72_loader_i386_linux_cast_left_shift_to_grub_uint32_t.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=490a6ab71cebd96fae7a1ceb9067484f5ccbec2a";
-      hash = "sha256-e49OC1EBaX0/nWTTXT5xE5apTJPQV0myP5Ohxn9Wwa8=";
-    })
-    (fetchpatch {
-      name = "73_loader_i386_bsd_use_safe_math_to_avoid_underflow.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=4dc6166571645780c459dde2cdc1b001a5ec844c";
-      hash = "sha256-e8X+oBvejcFNOY1Tp/f6QqCDwrgK7f9u1F8SdO/dhy4=";
-    })
-    (fetchpatch {
-      # Fixes 7e2f750f0a (security patch 14/73)
-      name = "fs_ext2_rework_out-of-bounds_read_for_inline_and_external_extents.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=348cd416a3574348f4255bf2b04ec95938990997";
-      hash = "sha256-WBLYQxv8si2tvdPAvbm0/4NNqYWBMJpFV4GC0HhN/kE=";
-    })
-    (fetchpatch {
-      name = "CVE-2025-4382.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c448f511e74cb7c776b314fcb7943f98d3f22b6d";
-      hash = "sha256-64gMhCEW0aYHt46crX/qN/3Hj8MgvWLazgQlVXqe8LE=";
-    })
-    # https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html
-    (fetchpatch {
-      name = "1_commands_test_fix_error_in_recursion_depth_calculation.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cc9d621dd06bfa12eac511b37b4ceda5bd2f8246";
-      hash = "sha256-GpLpqTKr2ke/YaxnZIO1Kh9wpde44h2mvwcODcAL/nk=";
-    })
-    (fetchpatch {
-      name = "2_CVE-2025-54771.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4fb4cbc941981894a00ba8e75d634a41967a27f";
-      hash = "sha256-yWowlAMVXdfIyC+BiB00IZvTwIybvaPhxAyz0MPjQuY=";
-    })
-    (fetchpatch {
-      name = "3_CVE-2025-54770.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=10e58a14db20e17d1b6a39abe38df01fef98e29d";
-      hash = "sha256-1ROc5n7sApw7aGr+y8gygFqVkifLdgOD3RPaW9b8aQQ=";
-    })
-    (fetchpatch {
-      name = "4_CVE-2025-61662.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8ed78fd9f0852ab218cc1f991c38e5a229e43807";
-      hash = "sha256-mG+vcZHbF4duY2YoYAzPBQRHfWvp5Fvgtm0XBk7JqqM=";
-    })
-    (fetchpatch {
-      name = "5_CVE-2025-61663_CVE-2025-61664.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05d3698b8b03eccc49e53491bbd75dba15f40917";
-      hash = "sha256-kgtXhZmAQpassEf8+RzqkghAzLrCcRoRMMnfunF/0J8=";
-    })
-    (fetchpatch {
-      name = "6_tests_lib_functional_test_unregister_commands_on_module_unload.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9df1e693e70c5a274b6d60dc76efe2694b89c2fc";
-      hash = "sha256-UzyYkpP7vivx2jzxi7BMP9h9OB2yraswrMW4g9UWsbI=";
-    })
-    (fetchpatch {
-      name = "7_CVE-2025-61661.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=549a9cc372fd0b96a4ccdfad0e12140476cc62a3";
-      hash = "sha256-2mlDoVXY7Upwx4QBeAMOHUtoUlyx1MDDmabnrwK1gEY=";
-    })
-    (fetchpatch {
-      name = "8_commands_usbtest_ensure_string_length_is_sufficient_in_usb_string_processing.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7debdce1e98907e65223a4b4c53a41345ac45e53";
-      hash = "sha256-2ALvrmwxvpjQYjGNrQ0gyGotpk0kgmYlJXMF1xXrnEw=";
-    })
-    # Required to apply the GCC-15 patch
-    (fetchpatch {
-      name = "gnulib_Add_patch_to_allow_GRUB_w_GCC-15_compile_0_1.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=bba7dd7363402157034e9c94ee3d9ea82e37861d";
-      hash = "sha256-KO9rE/9xRkIGi/Y6jv1gVPiAJZUejwaUW6kIWthPUhw=";
-    })
-    # Required to apply the GCC-11 patch
-    (fetchpatch {
-      name = "gnulib_Add_patch_to_allow_GRUB_w_GCC-15_compile_0_2.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=db506b3b83640ab166a782e1ca47c47836afddcd";
-      hash = "sha256-4ucCu+9OZ8NoicLF9hCgUpX4xgJk4Gzu6F3P4zl9J3U=";
-    })
-    # Required to build grub 2.12 with GCC 15
-    (fetchpatch {
-      name = "gnulib_Add_patch_to_allow_GRUB_w_GCC-15_compile_1_2.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=ac1512b872af8567b408518a7efa01607a0219ae";
-      hash = "sha256-deyp6Yatlgv86bYMt7WcWhKg8J6StDPUEy4UPHqJYIc=";
-    })
-    # Required to build grub2_efi with GCC 16, or fails with "error: 'regparm'
-    # attribute ignored [-Werror=attributes]"
-    (fetchpatch {
-      name = "gcc16_make_regparm_attribute_more_conditional.patch";
-      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9922ed133c2c754ec9f37198da2b3e3e8a4fd5ff";
-      hash = "sha256-V2vffDxL/qQ14YN5scc3CFPBFBWvkh57dc5/hWd/6F4=";
-    })
-  ];
+      /*
+        Fix parallel `msgmerge` race on de.po.
+        See https://gitlab.freedesktop.org/gnu-grub/grub/-/work_items/18
+        See https://github.com/NixOS/nixpkgs/pull/248747#issuecomment-1676301670
+      */
+      (fetchpatch {
+        name = "02_fix_msmerge.patch";
+        url = grubPatch "c2a215245e2e7d61da4f41945222bd761679ae11";
+        hash = "sha256-vBCDej/5DVX1NQMR05kNunxbmfyKywyYQtu4tg3Q2Cs=";
+      })

-  postPatch =
-    if kbdcompSupport then
-      ''
-        sed -i util/grub-kbdcomp.in -e 's@\bckbcomp\b@${ckbcomp}/bin/ckbcomp@'
-      ''
-    else
-      ''
-        echo '#! ${runtimeShell}' > util/grub-kbdcomp.in
-        echo 'echo "Compile grub2 with { kbdcompSupport = true; } to enable support for this command."' >> util/grub-kbdcomp.in
-      '';
+      /*
+        The commit that we're reverting below breaks the `kernel.img` payload that's generated at runtime.
+
+        If we don't do this, we can't install GRUB.
+      */
+      (fetchpatch {
+        name = "01_fix_kernel-img_load_offset.patch";
+        url = grubPatch "1dc2986c7e8480d955f87d276d31400116a21fac";
+        hash = "sha256-T1V7Rklc7RNsKTwk2gLoWHxoXUlCM0/mxcnymqUcyRg=";
+      })
+
+      # Required to build grub2_efi with GCC 16, or fails with "error: 'regparm' attribute ignored [-Werror=attributes]"
+      (fetchpatch {
+        name = "gcc16_make_regparm_attribute_more_conditional.patch";
+        url = grubPatch "9922ed133c2c754ec9f37198da2b3e3e8a4fd5ff";
+        hash = "sha256-V2vffDxL/qQ14YN5scc3CFPBFBWvkh57dc5/hWd/6F4=";
+      })
+    ];
+
+  postPatch = ''
+    ${
+      if kbdcompSupport then
+        ''
+          sed -i util/grub-kbdcomp.in -e 's@\bckbcomp\b@${ckbcomp}/bin/ckbcomp@'
+        ''
+      else
+        ''
+          echo '#! ${runtimeShell}' > util/grub-kbdcomp.in
+          echo 'echo "Compile grub2 with { kbdcompSupport = true; } to enable support for this command."' >> util/grub-kbdcomp.in
+        ''
+    }
+
+    GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION)
+    if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then
+      echo "This version of GRUB requires a different gnulib revision!"
+      echo "We have: ${gnulib.rev}"
+      echo "GRUB needs: $GNULIB_REVISION"
+      exit 1
+    fi
+  '';

  depsBuildBuild = [
    buildPackages.stdenv.cc
@@ -615,6 +204,7 @@ stdenv.mkDerivation rec {
    gettext
    freetype
    autoconf
+    autoconf-archive
    automake
    help2man
  ];
@@ -624,6 +214,7 @@ stdenv.mkDerivation rec {
    freetype
    lvm2
    fuse3
+    xz
    libtool
    bash
  ]
@@ -637,36 +228,31 @@ stdenv.mkDerivation rec {
  separateDebugInfo = !xenSupport;

  preConfigure = ''
-     for i in "tests/util/"*.in
-     do
-       sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
-     done
+    # Trust me, it's NEVER missing.
+    substituteInPlace configure.ac --replace-fail 'm4_ifndef([AX_CHECK_LINK_FLAG], [m4_fatal([autoconf-archive is missing. You must install it to generate the configure script.])])' ' '

-     # Apparently, the QEMU executable is no longer called
-     # `qemu-system-i386', even on i386.
-     #
-     # In addition, use `-nodefaults' to avoid errors like:
-     #
-     #  chardev: opening backend "stdio" failed
-     #  qemu: could not open serial device 'stdio': Invalid argument
-     #
-     # See <http://www.mail-archive.com/qemu-devel@nongnu.org/msg22775.html>.
-     sed -i "tests/util/grub-shell.in" \
-         -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g'
+    for i in "tests/util/"*.in
+    do
+      sed -i "$i" -e's|/bin/bash|${stdenv.shell}|g'
+    done

-    unset CPP # setting CPP intereferes with dependency calculation
+    # Apparently, the QEMU executable is no longer called
+    # `qemu-system-i386', even on i386.
+    #
+    # In addition, use `-nodefaults' to avoid errors like:
+    #
+    #  chardev: opening backend "stdio" failed
+    #  qemu: could not open serial device 'stdio': Invalid argument
+    #
+    # See <http://www.mail-archive.com/qemu-devel@nongnu.org/msg22775.html>.
+    sed -i "tests/util/grub-shell.in" \
+        -e's/qemu-system-i386/qemu-system-x86_64 -nodefaults/g'

    patchShebangs .

-    GNULIB_REVISION=$(. bootstrap.conf; echo $GNULIB_REVISION)
-    if [ "$GNULIB_REVISION" != ${gnulib.rev} ]; then
-      echo "This version of GRUB requires a different gnulib revision!"
-      echo "We have: ${gnulib.rev}"
-      echo "GRUB needs: $GNULIB_REVISION"
-      exit 1
-    fi
-
    cp -f --no-preserve=mode ${locales}/po/LINGUAS ${locales}/po/*.po po
+    mkdir po/.reference
+    cp -f --no-preserve=mode ${locales}/po/*.po po/.reference

    ./bootstrap --no-git --gnulib-srcdir=${gnulib}

@@ -679,13 +265,6 @@ stdenv.mkDerivation rec {
    )
  '';

-  postConfigure = ''
-    # make sure .po files are up to date to workaround
-    # parallel `msgmerge --update` on autogenerated .po files:
-    #   https://github.com/NixOS/nixpkgs/pull/248747#issuecomment-1676301670
-    make dist
-  '';
-
  configureFlags = [
    "--enable-grub-mount" # dep of os-prober
  ]
@@ -718,6 +297,11 @@ stdenv.mkDerivation rec {
  ++ lib.optionals xenPvhSupport [
    "--with-platform=xen_pvh"
    "--target=${xenPvhSystemsBuild.${stdenv.hostPlatform.system}.target}"
+  ]
+  ++ lib.optionals corebootSupport [
+    "--with-platform=coreboot"
+    "--target=${corebootSystemsBuild.${stdenv.hostPlatform.system}.target}"
+    "--enable-boot-time" # Log boot times. Might be useful for debugging loading issues.
  ];

  # save target that grub is compiled for
@@ -726,6 +310,8 @@ stdenv.mkDerivation rec {
      "${efiSystemsInstall.${stdenv.hostPlatform.system}.target}-efi"
    else if ieee1275Support then
      "${ieee1275SystemsBuild.${stdenv.hostPlatform.system}.target}-ieee1275"
+    else if corebootSupport then
+      "${corebootSystemsBuild.${stdenv.hostPlatform.system}.target}-coreboot"
    else
      lib.optionalString inPCSystems "${pcSystems.${stdenv.hostPlatform.system}.target}-pc";

@@ -733,11 +319,10 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  postInstall = ''
-    # Avoid a runtime reference to gcc
+    # We have to do this or else closure size balloons up
+
+    patchShebangs $out/lib/grub/*/modinfo.sh
    sed -i $out/lib/grub/*/modinfo.sh -e "/grub_target_cppflags=/ s|'.*'|' '|"
-    # just adding bash to buildInputs wasn't enough to fix the shebang
-    substituteInPlace $out/lib/grub/*/modinfo.sh \
-      --replace ${buildPackages.bash} "/usr/bin/bash"
  '';

  passthru.tests = {
@@ -775,6 +360,8 @@ stdenv.mkDerivation rec {
        lib.attrNames xenSystemsBuild
      else if xenPvhSupport then
        lib.attrNames xenPvhSystemsBuild
+      else if corebootSupport then
+        lib.attrNames corebootSystemsBuild
      else
        lib.platforms.gnu ++ lib.platforms.linux;

--- a/pkgs/by-name/ha/hakuneko/package.nix
+++ b/pkgs/by-name/ha/hakuneko/package.nix
@@ -101,5 +101,8 @@ stdenv.mkDerivation (finalAttrs: {
      "i686-linux"
    ];
    mainProgram = "hakuneko";
+    knownVulnerabilities = [
+      "Uses Electron 6.1.7, which was EOL on February 25, 2020, with many known CVEs"
+    ];
  };
 })
--- a/pkgs/by-name/ha/hash_extender/package.nix
+++ b/pkgs/by-name/ha/hash_extender/package.nix
@@ -8,13 +8,16 @@

 stdenv.mkDerivation {
  pname = "hash_extender";
-  version = "unstable-2020-03-24";
+  version = "0-unstable-2020-03-24";
+
+  strictDeps = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "iagox86";
    repo = "hash_extender";
    rev = "cb8aaee49f93e9c0d2f03eb3cafb429c9eed723d";
-    sha256 = "1fj118566hr1wv03az2w0iqknazsqqkak0mvlcvwpgr6midjqi9b";
+    hash = "sha256-K0UsW6wmv8s3o7uCqSbG+is7cQRcfDXA5iFDYwoKQbo=";
  };

  patches = [
--- a/pkgs/by-name/in/inav-configurator/package.nix
+++ b/pkgs/by-name/in/inav-configurator/package.nix
@@ -79,5 +79,8 @@ stdenv.mkDerivation rec {
      wucke13
    ];
    platforms = lib.platforms.linux;
+    knownVulnerabilities = [
+      "Uses Electron 38.7.2, EOL on 28-Jan-2026, with several known CVEs."
+    ];
  };
 }
--- a/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
+++ b/pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "jawiki-all-titles-in-ns0";
-  version = "0-unstable-2026-08-01";
+  version = "0-unstable-2026-09-01";

  src = fetchFromGitHub {
    owner = "musjj";
    repo = "jawiki-archive";
-    rev = "9d043ec108e2bd63a0f5971826e14b9888d18399";
-    hash = "sha256-rCPD/Y82dvAiCVt2XmX1WwcujIpacCU/Pcyn4zUWg0I=";
+    rev = "5c0d3d609a19361e9ebbe24702da11c8285e278d";
+    hash = "sha256-D4dqdc0xeKPcy0MmfKcK6GEngQOmLg/2H6TuWGyS0i8=";
  };

  installPhase = ''
--- a/pkgs/by-name/ke/keeweb/package.nix
+++ b/pkgs/by-name/ke/keeweb/package.nix
@@ -76,6 +76,9 @@ let
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ sikmir ];
    platforms = builtins.attrNames srcs;
+    knownVulnerabilities = [
+      "Uses Electron 12, EOL on November 16 2012. Has many known CVEs"
+    ];
  };
 in
 if stdenv.hostPlatform.isDarwin then
--- a/pkgs/by-name/ke/keybase-gui/package.nix
+++ b/pkgs/by-name/ke/keybase-gui/package.nix
@@ -163,5 +163,8 @@ stdenv.mkDerivation (finalAttrs: {
    ];
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    license = lib.licenses.bsd3;
+    knownVulnerabilities = [
+      "Uses Electron 28, EOL on 05 Dec 2023. Has many known CVEs"
+    ];
  };
 })
--- a/pkgs/by-name/lc/lcrq/package.nix
+++ b/pkgs/by-name/lc/lcrq/package.nix
@@ -5,13 +5,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "lcrq";
-  version = "0.3.1";
+  version = "0.4.0";

  src = fetchFromCodeberg {
    owner = "librecast";
    repo = "lcrq";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-hNH5SdvKhNPUJWs7vpPECcBsRyNdHQF+Ot3LmyX2V3c=";
+    hash = "sha256-1kKWg+GN+WrYx7RTjTLqfGt9qcqeh9vc/TyfZMKsH7A=";
  };

  installFlags = [ "PREFIX=$(out)" ];
--- a/pkgs/by-name/li/libdigidocpp/package.nix
+++ b/pkgs/by-name/li/libdigidocpp/package.nix
@@ -16,14 +16,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "4.5.0";
+  version = "4.5.1";
  pname = "libdigidocpp";

  src = fetchFromGitHub {
    owner = "open-eid";
    repo = "libdigidocpp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/RCRYF3G7/0J6oHT4mfapI4tlYLdWlQ2HTVqJGuDm3A=";
+    hash = "sha256-LT2JQwrliec3/tttu0SehhOnO+IL+IOLyk9L1tLsuuw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -96,8 +96,8 @@ stdenv.mkDerivation {
    inherit binaryName;
    applicationName = "LibreWolf";
    libName = "librewolf-bin-${version}";
-    ffmpegSupport = true;
-    gssSupport = true;
+    withFFmpeg = true;
+    withGSSAPI = true;
    gtk3 = gtk3;
    updateScript = ./update.sh;
  };
--- a/pkgs/by-name/li/librewolf-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/package.nix
@@ -15,8 +15,6 @@ in
  binaryName = "librewolf";
  version = librewolf-src.packageVersion;
  src = librewolf-src.firefox;
-  requireSigning = false;
-  allowAddonSideload = true;
  branding = "browser/branding/librewolf";
  inherit (librewolf-src)
    extraConfigureFlags
@@ -52,7 +50,10 @@ in
  };
 }).override
  {
-    crashreporterSupport = false;
+    enableAddonSigning = false;
+    enableAddonSideload = true;
+
+    enableCrashReporter = false;
    # This will set `MOZILLA_OFFICIAL=1`, which is set by the mozconfig upstream, but has to
    # be set manually in our case.
    # This will not override the branding as `branding` is already set to the official
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
--- a/pkgs/by-name/li/libvgm/package.nix
+++ b/pkgs/by-name/li/libvgm/package.nix
@@ -38,13 +38,13 @@ assert enableTools -> enableAudio && enableEmulation && enableLibplayer;

 stdenv.mkDerivation (finalAttrs: {
  pname = "libvgm";
-  version = "0-unstable-2026-08-18";
+  version = "0-unstable-2026-08-27";

  src = fetchFromGitHub {
    owner = "ValleyBell";
    repo = "libvgm";
-    rev = "d4a07d0111527bf5130d0814505a1243136f3962";
-    hash = "sha256-t0/7uorfT+nusRGOv58XNXwZruwyKld7IC+l1q6Ewn8=";
+    rev = "e41ca80220cbcbaac0e7d77bf57c689a395c5f97";
+    hash = "sha256-r2bE8cmSxDab4kOu/8KJHqcICKTmv2uSMvIOaOHuaFc=";
  };

  outputs = [
--- a/pkgs/by-name/ln/lnd/package.nix
+++ b/pkgs/by-name/ln/lnd/package.nix
@@ -23,16 +23,16 @@

 buildGoModule (finalAttrs: {
  pname = "lnd";
-  version = "0.21.2-beta";
+  version = "0.21.3-beta";

  src = fetchFromGitHub {
    owner = "lightningnetwork";
    repo = "lnd";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8HSKntW0cLkJi4You8gJgXaUoQoevl2zY+mji3fprJI=";
+    hash = "sha256-sz0BSf6QnxGQxLw/8fPNsg9/v742JNMCs+lTWa6lPD0=";
  };

-  vendorHash = "sha256-YdrgmzTbxrsW/smmxFBiHQ1jB+cxNgNxPAsrPPS61AU=";
+  vendorHash = "sha256-/TKQLgVCgBF6DLnaXUJCVvOmOXZ3sJUGbyKQGsBi1dE=";

  subPackages = [
    "cmd/lncli"
@@ -48,7 +48,6 @@ buildGoModule (finalAttrs: {
    homepage = "https://github.com/lightningnetwork/lnd";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
-      bleetube
      cypherpunk2140
      prusnak
    ];
--- a/pkgs/by-name/ma/mago/package.nix
+++ b/pkgs/by-name/ma/mago/package.nix
@@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mago";
-  version = "1.47.4";
+  version = "1.47.5";

  src = fetchFromGitHub {
    owner = "carthage-software";
    repo = "mago";
    tag = finalAttrs.version;
-    hash = "sha256-Qi1Bz5u/ZDupJz/9ueAwCnJ1hUWIpx1B32dGzcp87Fo=";
+    hash = "sha256-IUz1BrwJnx+VXq89YbuN6kR7CzCZzkTOG1pQQ9+NpA4=";
    forceFetchGit = true; # Does not download all files otherwise
  };

-  cargoHash = "sha256-iw9ipn86SjXCdmC5W2naJvaSpYCYb6uNPkKVtA/ZMd4=";
+  cargoHash = "sha256-r9YgTFIBa3HoKEpDH3SLqmXLLd5HNPCznf/mo1si2rw=";

  env = {
    # Get openssl-sys to use pkg-config
--- a/pkgs/by-name/ma/materialgram/package.nix
+++ b/pkgs/by-name/ma/materialgram/package.nix
@@ -11,12 +11,12 @@ telegram-desktop.override {
  unwrapped = telegram-desktop.unwrapped.overrideAttrs (
    finalAttrs: previousAttrs: {
      pname = "materialgram-unwrapped";
-      version = "6.7.7.1";
+      version = "7.0.5.1";

      src = fetchFromGitHub {
        owner = "kukuruzka165";
        repo = "materialgram";
-        hash = "sha256-Cy0ooQZOhfE+QBaRDblKXhmqYsKJ0TfeHsfJaVLVn8o=";
+        hash = "sha256-OE7TbxFEYzTM2IB7HMokR3a+tsrg4n4cbHmRXPITykI=";
        tag = "v${finalAttrs.version}";
        fetchSubmodules = true;
      };
--- a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
+++ b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
@@ -8,17 +8,17 @@

 buildGoModule (finalAttrs: {
  pname = "matrix-alertmanager-receiver";
-  version = "2026.8.5";
+  version = "2026.8.26";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "metio";
    repo = "matrix-alertmanager-receiver";
    tag = finalAttrs.version;
-    hash = "sha256-0Kh446DWt9UcAuFF0DjMxlNCb+kZOCHs+oCG+BPgsi8=";
+    hash = "sha256-Qlg3IvfTQ0lzPN+m4usRT5SW4IFWXkvG4PRGIhwukcs=";
  };

-  vendorHash = "sha256-+6qW0W2cSTMOPJznhGy8sAH8O1GucrwVL/uRj8qUYLQ=";
+  vendorHash = "sha256-AJ5st9AHf2laZI1hdGa0oFsPA8ulSSUFnSyeNttqem0=";

  env.CGO_ENABLED = "0";

--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
@@ -205,12 +205,17 @@ class Profile:
    name: str
    path: Path

+    @classmethod
+    def _is_custom_name(cls, name: str) -> bool:
+        return name != "system"
+
    @classmethod
    def from_arg(cls, name: str) -> Self:
-        match name:
-            case "system":
-                return cls(name, Path("/nix/var/nix/profiles/system"))
-            case _:
-                path = Path("/nix/var/nix/profiles/system-profiles") / name
-                path.parent.mkdir(mode=0o755, parents=True, exist_ok=True)
-                return cls(name, path)
+        if cls._is_custom_name(name):
+            path = Path("/nix/var/nix/profiles/system-profiles") / name
+            return cls(name, path)
+        else:
+            return cls(name, Path("/nix/var/nix/profiles/system"))
+
+    def is_custom(self) -> bool:
+        return self._is_custom_name(self.name)
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -690,6 +690,15 @@ def set_profile(
            ).strip()
            raise NixOSRebuildError(msg)

+    if profile.is_custom():
+        # Using custom profile, the target profile directory may not exist yet,
+        # so we need to create it first
+        run_wrapper(
+            ["mkdir", "-p", profile.path.parent],
+            remote=target_host,
+            elevate=elevate,
+        )
+
    run_wrapper(
        ["nix-env", "-p", profile.path, "--set", path_to_config],
        remote=target_host,
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -610,7 +610,7 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
@patch("subprocess.run", autospec=True)
@patch("uuid.uuid4", autospec=True)
@patch(get_qualified_name(nr.services.cleanup_ssh), autospec=True)
-def test_execute_nix_switch_build_target_host(
+def test_execute_nix_switch_build_target_host_custom_profile(
    mock_cleanup_ssh: Mock,
    mock_uuid4: Mock,
    mock_run: Mock,
@@ -654,10 +654,12 @@ def test_execute_nix_switch_build_target_host(
            "nixos-config=./configuration.nix",
            "-I",
            "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
+            "--profile-name",
+            "custom-profile",
        ]
    )

-    assert mock_run.call_count == 12
+    assert mock_run.call_count == 13
    mock_run.assert_has_calls(
        [
            call(
@@ -791,6 +793,24 @@ def test_execute_nix_switch_build_target_host(
                check=True,
                **DEFAULT_RUN_KWARGS,
            ),
+            call(
+                [
+                    "ssh",
+                    *nr.process.SSH_DEFAULT_OPTS,
+                    "user@target-host",
+                    "--",
+                    "sudo",
+                    "/bin/sh",
+                    "-c",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                    "sh",
+                    "mkdir",
+                    "-p",
+                    "/nix/var/nix/profiles/system-profiles",
+                ],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
            call(
                [
                    "ssh",
@@ -804,7 +824,7 @@ def test_execute_nix_switch_build_target_host(
                    "sh",
                    "nix-env",
                    "-p",
-                    "/nix/var/nix/profiles/system",
+                    "/nix/var/nix/profiles/system-profiles/custom-profile",
                    "--set",
                    str(config_path),
                ],
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
@@ -205,19 +205,21 @@ def test_flake_from_arg(
        ) == m.Flake("/path/to", 'nixosConfigurations."remote-hostname"')


-@patch("pathlib.Path.mkdir", autospec=True)
-def test_profile_from_arg(mock_mkdir: Mock) -> None:
+def test_profile_from_arg() -> None:
    assert m.Profile.from_arg("system") == m.Profile(
        "system",
        Path("/nix/var/nix/profiles/system"),
    )
-    mock_mkdir.assert_not_called()

    assert m.Profile.from_arg("something") == m.Profile(
        "something",
        Path("/nix/var/nix/profiles/system-profiles/something"),
    )
-    mock_mkdir.assert_called_once()
+
+
+def test_profile_is_custom() -> None:
+    assert not m.Profile("system", Path()).is_custom()
+    assert m.Profile("something", Path()).is_custom()


 def test_grouped_nix_args_flake_build_flags() -> None:
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -749,6 +749,32 @@ def test_set_profile(mock_run: Mock) -> None:
        elevate=e.NO_ELEVATOR,
    )

+    mock_run.reset_mock()
+    target_host = m.Remote("user@localhost", [], "ssh")
+
+    n.set_profile(
+        m.Profile("something", profile_path),
+        config_path,
+        target_host=target_host,
+        elevate=e.NO_ELEVATOR,
+    )
+
+    mock_run.assert_has_calls(
+        [
+            call(
+                ["mkdir", "-p", profile_path.parent],
+                remote=target_host,
+                elevate=e.NO_ELEVATOR,
+            ),
+            call(
+                ["nix-env", "-p", profile_path, "--set", config_path],
+                remote=target_host,
+                elevate=e.NO_ELEVATOR,
+            ),
+        ]
+    )
+
+    mock_run.reset_mock()
    mock_run.return_value = CompletedProcess([], 1)

    with pytest.raises(m.NixOSRebuildError) as exc:
--- a/pkgs/by-name/oi/oidc-agent/package.nix
+++ b/pkgs/by-name/oi/oidc-agent/package.nix
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "oidc-agent";
-  version = "5.3.6";
+  version = "5.3.8";

  src = fetchFromGitHub {
    owner = "indigo-dc";
    repo = "oidc-agent";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GY0YsZJUUDBx1+ivE+h7tRG32qTeAcI7mmh6+zK+1KA=";
+    hash = "sha256-n88PQgFqsYiFwngaz1LGicVszoiepafshZa5/DiNw3I=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ok/okms-cli/package.nix
+++ b/pkgs/by-name/ok/okms-cli/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "okms-cli";
-  version = "0.4.4";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "ovh";
    repo = "okms-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-S3A3X1Inrnqf4+Sz7e6mqL+vzrz2huIfvNSV6cV5NIU=";
+    hash = "sha256-mAHhmEB2N4TcW1axzNHtsOOc9mlUJS66CZprKIsrFyg=";
  };

-  vendorHash = "sha256-GJG6cZ1FIWUNjDvcuOav7gPrgaKsfEI7U9lkPq+2H7E=";
+  vendorHash = "sha256-/VKa35URUY4K60aN+9saFyzCgCUb0xDDTa8eSXofOtk=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ok/okteto/package.nix
+++ b/pkgs/by-name/ok/okteto/package.nix
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "okteto";
-  version = "3.22.0";
+  version = "3.23.0";

  src = fetchFromGitHub {
    owner = "okteto";
    repo = "okteto";
    tag = finalAttrs.version;
-    hash = "sha256-PuJag9/qQG23mU+TE1LboYF+/1od5nVmgXpAaTJKlIg=";
+    hash = "sha256-P5dHpv2CEoJYr4rj3hQbavlsNNBRBIx4mzE3KhtLTXg=";
  };

-  vendorHash = "sha256-zEdhWfbZv088CXN2+3FQdCPcz3lJOf5iJPeublmVJyM=";
+  vendorHash = "sha256-/ZC5p5TAJOD8Wx1MDaI2NMPIL2QLfCeP0+XzdK346vI=";

  postPatch = ''
    # Disable some tests that need file system & network access.
--- a/pkgs/by-name/or/orbvis/package.nix
+++ b/pkgs/by-name/or/orbvis/package.nix
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "orbvis";
-  version = "0.3.3";
+  version = "0.3.4";

  src = fetchFromGitHub {
    owner = "wojciech-graj";
    repo = "orbvis";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-U19kslgAULBBFozK5KUtew6KRsFeJ4+h8bL9cXmnzso=";
+    hash = "sha256-e41CDv86zz+x5LF2JDZuxzgIvhHBM0s2XHoQMHfMRAg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/os/os-prober/package.nix
+++ b/pkgs/by-name/os/os-prober/package.nix
@@ -16,14 +16,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.84";
+  version = "1.85";
  pname = "os-prober";
  src = fetchFromGitLab {
    domain = "salsa.debian.org";
    owner = "installer-team";
    repo = "os-prober";
    rev = finalAttrs.version;
-    sha256 = "sha256-91UTiwg4qIi+aCzAto7tCd5WZFjI15XxR1/hZQ0fUa4=";
+    sha256 = "sha256-JK1+xzbl1EyHZ4E6pmQ5NDbtivZvFySHX+JkWodxyl4=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/ox/oxker/package.nix
+++ b/pkgs/by-name/ox/oxker/package.nix
@@ -10,14 +10,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "oxker";
-  version = "0.13.3";
+  version = "0.13.4";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-F/5QkEA4/UFFM3FEiqyBFZQWiIhQokT4VjL5SaKrDIA=";
+    hash = "sha256-W2swVJd/rygvt/q3YqqI1bVMmuitre4k9Zwl9JYZZbs=";
  };

-  cargoHash = "sha256-v0EOUIEaAUtcNlkBhFQ1Q/quYdG6+18MT2nnjZ/ApbM=";
+  cargoHash = "sha256-pJAnR0P5/vA9HbljbC3XhQbpiSeq3oBDCCaMuwfzLZ4=";

  # See https://github.com/mrjackwills/oxker/issues/73
  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
--- a/pkgs/by-name/pe/pedantix/package.nix
+++ b/pkgs/by-name/pe/pedantix/package.nix
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "pedantix";
-  version = "1.1.0";
+  version = "1.2.1";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "Swarsel";
    repo = "pedantix";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6NwpoqHkMMnqDkoJGbjZ47PUx+M4yYDcN5HiTKscw7E=";
+    hash = "sha256-WqCiIOFaVZ6+pVBF+fIZlOEb4N+cHCJZBPQ8Rj2OEh0=";
  };

-  cargoHash = "sha256-6U9rnWTVsO1DPp1cEBkRLHjJKcbgNEqXSvzWUC8tWZQ=";
+  cargoHash = "sha256-ay4rANqOby+/VM+JWbXcd0JQCcZuv8TjZv3d9vcFgfI=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
--- a/Show More
+++ b/Show More