Merge remote-tracking branch 'origin/staging-next' into staging

2026-11-01 01:30:27 +00:00 · 2026-10-07 09:22:29 +03:00
parent fa02ca5397 3461aa285f
commit 2c87a32948
281 changed files with 3479 additions and 2216 deletions
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -295,6 +295,8 @@

  See https://nextcloud.com/blog/nextcloud-hub26-summer/ for more details on the new major version.

+- `whisparr` is now an alias for `whisparr_2`, and `whisparr_3` is now available.
+
 - `homebox` v0.26.0 introduced a new, required value to be set, `HBOX_AUTH_API_KEY_PEPPER`. If one is not provided the module will create one, it is recommended that you back this up as it is part of API Key generation and validation.

 - `nextpnr` introduced support for the nexus and gatemate architectures. Building support for each individual architecture can be configured using the package parameters.
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -1443,6 +1443,12 @@ lib.mapAttrs mkLicense (
      redistributable = true; # Definitely redistributable though, it's an AGPL derivative
    };

+    stalwart = {
+      fullName = "Stalwart Enterprise License 2.0 (SELv2) Agreement";
+      url = "https://github.com/stalwartlabs/cli/blob/main/LICENSES/LicenseRef-SEL.txt";
+      free = false;
+    };
+
    stk = {
      spdxId = "MIT-STK";
      fullName = "MIT-STK License";
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -2034,7 +2034,14 @@ in
  webhook = runTest ./webhook.nix;
  weblate = runTest ./web-apps/weblate.nix;
  wg-access-server = runTest ./wg-access-server.nix;
-  whisparr = runTest ./whisparr.nix;
+  whisparr_2 = runTest {
+    imports = [ ./whisparr.nix ];
+    _module.args.getPackage = pkgs: pkgs.whisparr_2;
+  };
+  whisparr_3 = runTest {
+    imports = [ ./whisparr.nix ];
+    _module.args.getPackage = pkgs: pkgs.whisparr_3;
+  };
  whoami = runTest ./whoami.nix;
  whois = runTest ./whois.nix;
  whoogle-search = runTest ./whoogle-search.nix;
--- a/nixos/tests/lomiri.nix
+++ b/nixos/tests/lomiri.nix
@@ -80,12 +80,65 @@ let

  lomiriWallpaperDconfSettings = pkgs: {
    settings = {
+      "com/lomiri/shell" = {
+        background-picture-uri = "file://${wallpaperFile pkgs}";
+      };
+      "com/lomiri/shell/greeter" = {
+        background-picture-uri = "file://${wallpaperFile pkgs}";
+      };
+      # Fallback
      "org/gnome/desktop/background" = {
        picture-uri = "file://${wallpaperFile pkgs}";
      };
    };
  };

+  sharedMachineConfig =
+    {
+      config,
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      imports = [
+        ./common/auto.nix
+        ./common/user-account.nix
+      ];
+
+      virtualisation.memorySize = 2047;
+
+      users.users.${user} = {
+        inherit description password;
+      };
+
+      test-support.displayManager.auto = {
+        enable = true;
+        inherit user;
+      };
+
+      # Help with OCR
+      fonts.packages = [ pkgs.inconsolata ];
+
+      # To control mouse via scripting
+      programs.ydotool.enable = true;
+
+      services.desktopManager.lomiri.enable = true;
+      services.displayManager.defaultSession = "lomiri";
+
+      environment = {
+        etc."${wallpaperName}".source = wallpaperFile pkgs;
+        variables = {
+          LOMIRI_RUNNING_IN_VM = "1";
+        };
+      };
+
+      # Help with OCR
+      systemd.tmpfiles.settings = {
+        "10-lomiri-test-setup" = terminalOcrTmpfilesSetup { inherit pkgs lib config; };
+      };
+    };
+
  sharedTestFunctions = lib: ''
    from collections.abc import Callable
    import datetime
@@ -268,30 +321,10 @@ let

        nodes.machine =
          { config, ... }:
-          {
-            imports = [
-              ./common/auto.nix
-              ./common/user-account.nix
+          lib.attrsets.recursiveUpdate (sharedMachineConfig { inherit config pkgs lib; }) {
+            programs.dconf.profiles.user.databases = [
+              (lomiriWallpaperDconfSettings pkgs)
            ];
-
-            virtualisation.memorySize = 2047;
-
-            users.users.${user} = {
-              inherit description password;
-            };
-
-            test-support.displayManager.auto = {
-              enable = true;
-              inherit user;
-            };
-
-            # To control mouse via scripting
-            programs.ydotool.enable = true;
-
-            services.desktopManager.lomiri.enable = lib.mkForce true;
-            services.displayManager.defaultSession = lib.mkForce "lomiri";
-
-            # Not setting wallpaper, as it breaks indicator OCR(?)
          };

        enableOCR = true;
@@ -369,22 +402,23 @@ in

      nodes.machine =
        { config, ... }:
-        {
-          imports = [ ./common/user-account.nix ];
-
-          virtualisation.memorySize = 2047;
-
-          users.users.${user} = {
-            inherit description password;
-          };
+        lib.attrsets.recursiveUpdate (sharedMachineConfig { inherit config pkgs lib; }) {
+          # Want to enter greeter
+          test-support.displayManager.auto.enable = false;

+          # Testing *just* the greeter
          services.xserver.enable = true;
+          services.desktopManager.lomiri.enable = false;
          services.xserver.windowManager.icewm.enable = true;
          services.xserver.displayManager.lightdm = {
            enable = true;
            greeters.lomiri.enable = true;
          };
          services.displayManager.defaultSession = lib.mkForce "none+icewm";
+
+          programs.dconf.profiles.user.databases = [
+            (lomiriWallpaperDconfSettings pkgs)
+          ];
        };

      enableOCR = true;
@@ -403,6 +437,7 @@ in
              # Login
              machine.send_chars("${password}\n")
              machine.wait_for_x()
+              machine.sleep(datetime.timedelta(seconds=10))
              machine.screenshot("session_launched")
        '';
    }
@@ -419,32 +454,7 @@ in

      nodes.machine =
        { config, ... }:
-        {
-          imports = [
-            ./common/auto.nix
-            ./common/user-account.nix
-          ];
-
-          virtualisation.memorySize = 2047;
-
-          users.users.${user} = {
-            inherit description password;
-          };
-
-          test-support.displayManager.auto = {
-            enable = true;
-            inherit user;
-          };
-
-          # To control mouse via scripting
-          programs.ydotool.enable = true;
-
-          services.desktopManager.lomiri.enable = lib.mkForce true;
-          services.displayManager.defaultSession = lib.mkForce "lomiri";
-
-          # Help with OCR
-          fonts.packages = [ pkgs.inconsolata ];
-
+        lib.attrsets.recursiveUpdate (sharedMachineConfig { inherit config pkgs lib; }) {
          environment = {
            # Help with OCR
            etc."xdg/alacritty/alacritty.toml".source = (pkgs.formats.toml { }).generate "alacritty.toml" {
@@ -466,8 +476,6 @@ in
              };
            };

-            etc."${wallpaperName}".source = wallpaperFile pkgs;
-
            systemPackages = with pkgs; [
              # Forcing alacritty to run as an X11 app when opened from the starter menu
              (symlinkJoin {
@@ -491,11 +499,6 @@ in
          programs.dconf.profiles.user.databases = [
            (lomiriWallpaperDconfSettings pkgs)
          ];
-
-          # Help with OCR
-          systemd.tmpfiles.settings = {
-            "10-lomiri-test-setup" = terminalOcrTmpfilesSetup { inherit pkgs lib config; };
-          };
        };

      enableOCR = true;
@@ -572,57 +575,13 @@ in

      nodes.machine =
        { config, ... }:
-        {
-          imports = [
-            ./common/auto.nix
-            ./common/user-account.nix
-          ];
-
-          virtualisation.memorySize = 2047;
-
+        lib.attrsets.recursiveUpdate (sharedMachineConfig { inherit config pkgs lib; }) {
          users.users.${user} = {
-            inherit description password;
            # polkit agent test
            extraGroups = [ "wheel" ];
          };

-          test-support.displayManager.auto = {
-            enable = true;
-            inherit user;
-          };
-
-          # To control mouse via scripting
-          programs.ydotool.enable = true;
-
-          services.desktopManager.lomiri.enable = lib.mkForce true;
-          services.displayManager.defaultSession = lib.mkForce "lomiri";
-
-          # Help with OCR
-          fonts.packages = [ pkgs.inconsolata ];
-
          environment = {
-            # Help with OCR
-            etc."xdg/alacritty/alacritty.yml".text = lib.generators.toYAML { } {
-              font = rec {
-                normal.family = "Inconsolata";
-                bold.family = normal.family;
-                italic.family = normal.family;
-                bold_italic.family = normal.family;
-                size = 16;
-              };
-              colors = rec {
-                primary = {
-                  foreground = "0x000000";
-                  background = "0xffffff";
-                };
-                normal = {
-                  green = primary.foreground;
-                };
-              };
-            };
-
-            etc."${wallpaperName}".source = wallpaperFile pkgs;
-
            variables = {
              # So we can test what lomiri-content-hub is working behind the scenes
              LOMIRI_CONTENT_HUB_LOGGING_LEVEL = "2";
@@ -637,11 +596,6 @@ in
          programs.dconf.profiles.user.databases = [
            (lomiriWallpaperDconfSettings pkgs)
          ];
-
-          # Help with OCR
-          systemd.tmpfiles.settings = {
-            "10-lomiri-test-setup" = terminalOcrTmpfilesSetup { inherit pkgs lib config; };
-          };
        };

      enableOCR = true;
@@ -755,21 +709,14 @@ in

        nodes.machine =
          { config, ... }:
-          {
-            imports = [ ./common/user-account.nix ];
-
-            virtualisation.memorySize = 2047;
-
+          lib.attrsets.recursiveUpdate (sharedMachineConfig { inherit config pkgs lib; }) {
            users.users.${user} = {
-              inherit description;
+              # Need different password to test keymap differences
              password = lib.mkForce pwOutput;
            };

-            services.desktopManager.lomiri.enable = lib.mkForce true;
-            services.displayManager.defaultSession = lib.mkForce "lomiri";
-
-            # Help with OCR
-            fonts.packages = [ pkgs.inconsolata ];
+            # Want to enter greeter
+            test-support.displayManager.auto.enable = false;

            services.xserver.xkb.layout = lib.strings.concatStringsSep "," [
              # Start with a non-QWERTY keymap to test keymap patch
@@ -778,16 +725,9 @@ in
              "us"
            ];

-            environment.etc."${wallpaperName}".source = wallpaperFile pkgs;
-
            programs.dconf.profiles.user.databases = [
              (lomiriWallpaperDconfSettings pkgs)
            ];
-
-            # Help with OCR
-            systemd.tmpfiles.settings = {
-              "10-lomiri-test-setup" = terminalOcrTmpfilesSetup { inherit pkgs lib config; };
-            };
          };

        enableOCR = true;
@@ -890,8 +830,9 @@ in
      name = "power";
      left = 2;
      ocr = [
-        "Charge"
-        "Battery"
+        "Keep screen"
+        "screen on"
+        "Battery settings"
      ];
    }
    {
--- a/nixos/tests/nginx-njs.nix
+++ b/nixos/tests/nginx-njs.nix
@@ -1,11 +1,8 @@
-{ pkgs, lib, ... }:
-{
+_: {
  name = "nginx-njs";

  nodes.machine =
    {
-      config,
-      lib,
      pkgs,
      ...
    }:
@@ -21,15 +18,24 @@
            export default {hello};
          ''};
        '';
-        virtualHosts."localhost".locations."/".extraConfig = ''
-          js_content http.hello;
-        '';
+        virtualHosts."localhost".locations = {
+          "/njs".extraConfig = ''
+            js_content http.hello;
+          '';
+          "/qjs".extraConfig = ''
+            js_engine qjs;
+            js_content http.hello;
+          '';
+        };
      };
    };
  testScript = ''
    machine.wait_for_unit("nginx")

-    response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/")
+    response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/njs")
+    assert "Hello world!" == response, f"Expected 'Hello world!', got '{response}'"
+
+    response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/qjs")
    assert "Hello world!" == response, f"Expected 'Hello world!', got '{response}'"
  '';
 }
--- a/nixos/tests/whisparr.nix
+++ b/nixos/tests/whisparr.nix
@@ -1,17 +1,44 @@
-{ lib, ... }:
 {
-  name = "whisparr";
-  meta.maintainers = [ ];
+  config,
+  getPackage,
+  lib,
+  ...
+}:
+let
+  package = getPackage config.node.pkgs;
+  isV2 = lib.versions.major package.version == "2";
+in
+{
+  name = "whisparr_${lib.versions.major package.version}";
+  meta.maintainers = with lib.maintainers; [ connor-grady ];

-  nodes.machine =
-    { pkgs, ... }:
-    {
-      services.whisparr.enable = true;
+  nodes.machine = { pkgs, ... }: {
+    services.whisparr = {
+      enable = true;
+      package = getPackage pkgs;
+      settings.auth.apikey = lib.mkIf (!isV2) "0123456789abcdef0123456789abcdef";
    };
+  };

-  testScript = ''
-    machine.wait_for_unit("whisparr.service")
-    machine.wait_for_open_port(6969)
-    machine.succeed("curl --fail http://localhost:6969/")
-  '';
+  testScript =
+    { nodes, ... }:
+    let
+      cfg = nodes.machine.services.whisparr;
+    in
+    ''
+      import json
+
+      machine.wait_for_unit("whisparr.service")
+      machine.wait_for_open_port(${toString cfg.settings.server.port})
+      machine.wait_until_succeeds("curl --fail http://localhost:${toString cfg.settings.server.port}/")
+
+      with subtest("ping reports a healthy database"):
+          ping = json.loads(machine.succeed("curl --fail http://localhost:${toString cfg.settings.server.port}/ping"))
+          assert ping["status"] == "OK", ping
+    ''
+    + lib.optionalString (!isV2) ''
+      with subtest("system status reports the packaged version"):
+          status = json.loads(machine.succeed("curl --fail --header 'X-Api-Key: ${cfg.settings.auth.apikey}' http://localhost:${toString cfg.settings.server.port}/api/v3/system/status"))
+          assert status["version"] == "${cfg.package.versionForDotnet}", status
+    '';
 }
--- a/pkgs/applications/editors/kakoune/plugins/overrides.nix
+++ b/pkgs/applications/editors/kakoune/plugins/overrides.nix
@@ -12,7 +12,7 @@
  git,
  guile,
  kakoune-unwrapped,
-  lua5_3,
+  lua5_5,
  plan9port,
  rustPlatform,
 }:
@@ -198,13 +198,9 @@ self: super: {
      sha256 = "0y1g3zpa2ql8l9rl5i2w84bka8a09kig9nq9zdchaff5pw660mcx";
    };

-    buildInputs = [ lua5_3 ];
-
-    installPhase = ''
-      mkdir -p $out/share/kak/autoload/plugins/
-      cp quickscope.* $out/share/kak/autoload/plugins/
-      # substituteInPlace does not like the pipe
-      sed -e 's,[|] *lua,|${lua5_3}/bin/lua,' quickscope.kak >$out/share/kak/autoload/plugins/quickscope.kak
+    postInstall = ''
+      substituteInPlace $out/share/kak/autoload/plugins/quickscope-kak/quickscope.kak \
+        --replace-fail '|lua ' '|${lib.getExe lua5_5} '
    '';

    meta = {
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -20421,6 +20421,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  vim-cooklang = buildVimPlugin {
+    pname = "vim-cooklang";
+    version = "0-unstable-2024-01-24";
+    src = fetchFromGitHub {
+      owner = "luizribeiro";
+      repo = "vim-cooklang";
+      rev = "ba334ed1668ddf82ad46beea5354aa6398093ec6";
+      hash = "sha256-vWlk7G1V4DLC0G0f3GLEG3JsvAwJ637CPocmMmFxQek=";
+    };
+    meta.homepage = "https://github.com/luizribeiro/vim-cooklang/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
  vim-cool = buildVimPlugin {
    pname = "vim-cool";
    version = "0-unstable-2025-02-19";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1456,6 +1456,7 @@ https://github.com/flazz/vim-colorschemes/,,
 https://github.com/jonbri/vim-colorstepper/,,
 https://github.com/tpope/vim-commentary/,,
 https://github.com/luan/vim-concourse/,,
+https://github.com/luizribeiro/vim-cooklang/,,
 https://github.com/romainl/vim-cool/,,
 https://github.com/octol/vim-cpp-enhanced-highlight/,,
 https://github.com/mhinz/vim-crates/,,
--- a/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
  mktplcRef = {
    name = "amazon-q-vscode";
    publisher = "AmazonWebServices";
-    version = "2.7.0";
-    hash = "sha256-8B22RMQFTSpTuS96DxqjbN8DI8i6q8EULDmJU5d+Tug=";
+    version = "2.8.0";
+    hash = "sha256-QloFWdBDcFccs+SHYS9NSUjsnxr4nDFYuL/ox7JiJes=";
  };

  meta = {
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-dUWGAI6AtFbMToKDAUxiEzsPspfka6kitMJ9+l1moz0=";
+          hash = "sha256-2o18oW1xrFwwp6Gb1aUY/4XFDiWUYeHSENiniizqOB4=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-y/z/tqieh+mdrUXfq7wqgRXndvdmKQ5ocsEwhFN/N3c=";
+          hash = "sha256-Y7A0qTIOSwAt1+B0s3crlEQm6066CVm+SMSzd/2FQ5k=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-fzywaeVkfUKgVDEnsKn3jIuKFOoiyT1Gpy332cn7ZfA=";
+          hash = "sha256-70u6O0Dhji5g4KDT3nrNvVOr8Wt7gh25ztT5rbDpe2U=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.289";
+      version = "2.1.291";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2380,8 +2380,8 @@ let
        mktplcRef = {
          name = "vscode-vibrancy-continued";
          publisher = "illixion";
-          version = "1.1.93";
-          hash = "sha256-n5YlwRPA2BQ4uxMeoV0pUta5X3J0lzHUKyePZxrHiFs=";
+          version = "1.4.0";
+          hash = "sha256-o0/aEgRIaiz5lDm6XY1g+koAP1s28mXUnbm60eu8h+c=";
        };
        meta = {
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";
--- a/pkgs/applications/editors/vscode/extensions/ndonfris.fish-lsp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ndonfris.fish-lsp/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    publisher = "ndonfris";
    name = "fish-lsp";
-    version = "0.1.22";
-    hash = "sha256-rbxjPThdqVSbE6aZ8pcN2awMNypPaN0KQ/BzgO2Aqog=";
+    version = "0.1.24";
+    hash = "sha256-0elBQaO6j7mkex9bBqnXGjOgeMwo7lEQ+DBhJkeOD94=";
  };

  meta = {
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -34,16 +34,16 @@ let

  hash =
    {
-      x86_64-linux = "sha256-DJy86gcOmg/GLeXHj+4BqA+OMveK2mZNlzH2xRdQO34=";
-      aarch64-linux = "sha256-1SM07NDHqmsbS/PDvfFlMKBLzgE8lfEG03L2Xg9uW8U=";
-      aarch64-darwin = "sha256-kjCAvrwZTsF4wqBrYbyxODdndkBsI7i9Pk/DKG+Ry6I=";
-      armv7l-linux = "sha256-3jVAei1IX2Ij7FY7z++22bui9yIEr2qZUXtQzgAmgq0=";
+      x86_64-linux = "sha256-0yAx6eIT1ZUyrzzzL8uLNXoc3RBBeWe09bW6MENtwNw=";
+      aarch64-linux = "sha256-lgmnZVxLwqEBs0P/IqqR9meLRtlWW5FMBgi9fy5Xf6Y=";
+      aarch64-darwin = "sha256-hqZPHMn04LX8RJaVMJlHQvS9Yee5jZY3I4xeJLJlk7A=";
+      armv7l-linux = "sha256-GB7b8BXnMzHwAG2N4Chypet0kPVKODLPaZxLKnAqJtw=";
    }
    .${system} or throwSystem;

  # Please backport all compatible updates to the stable release.
  # This is important for the extension ecosystem.
-  version = "1.139.1";
+  version = "1.140.0";

  # The update server (update.code.visualstudio.com) expects the version path
  # segment in X.Y.Z form, so we normalize X.Y to X.Y.0 (e.g. "1.110" → "1.110.0").
@@ -51,7 +51,7 @@ let
  downloadVersion = lib.versions.pad 3 version;

  # This is used for VS Code - Remote SSH test
-  rev = "04c0d99f4fb0d8afe6ce4f0c58e31e183ac3e4b1";
+  rev = "07f806f999227108933c2e30515b26eecc1fda74";
 in
 buildVscode {
  pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -84,7 +84,7 @@ buildVscode {
    src = fetchurl {
      name = "vscode-server-${rev}.tar.gz";
      url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-4s41uMC5DPIX/u6Yc6GcHi7kFM8BpZidZ8h+DvhBaJQ=";
+      hash = "sha256-H2XuevLt4hUrTxvt94HqKCM0OBc+uYMaDz9yHF191qw=";
    };
    stdenv = stdenvNoCC;
  };
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -154,7 +154,7 @@ stdenv.mkDerivation {
    changelog = "https://www.firefox.com/en-US/firefox/${version}/releasenotes/";
    description = "Mozilla Firefox, free web browser (binary package)";
    homepage = "https://www.mozilla.org/firefox/";
-    license = {
+    license = lib.licenses.mkLicense {
      shortName = "firefox";
      fullName = "Firefox Terms of Use";
      url = "https://www.mozilla.org/about/legal/terms/firefox/";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -200,13 +200,13 @@
    "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
  },
  "clevercloud_clevercloud": {
-    "hash": "sha256-JKjsEGICQnYZAd/Ywu7OLQaCqqeAyn9AiRIvNYt4BA8=",
+    "hash": "sha256-mVwkTnVgnRMoECI05s4uUaO1VO3ZD2eS4rw8RoLtOJw=",
    "homepage": "https://registry.terraform.io/providers/clevercloud/clevercloud",
    "owner": "CleverCloud",
    "repo": "terraform-provider-clevercloud",
-    "rev": "v2.2.1",
+    "rev": "v2.3.0",
    "spdx": "Apache-2.0",
-    "vendorHash": "sha256-BeFD02YByrmdvIMIYlLQqYGQkfD53Dxeox5EzKd5SJA="
+    "vendorHash": "sha256-lfdc8+yyKzTJqfYQoiAvbtEaIN4TE9hHikyjd2bmfKM="
  },
  "cloudamqp_cloudamqp": {
    "hash": "sha256-WD4ZIUTg8xGfxa4oqA7EGVwcggBzJK/MRchxdldypqU=",
@@ -580,13 +580,13 @@
    "vendorHash": "sha256-KcaKxpiI9kAaBJ33ATVOJ6hm5HtGg1IAFfZU/Sf4gm4="
  },
  "hashicorp_external": {
-    "hash": "sha256-SiTFDI5s/wSyGd1iKe3cHYlyoPueT+nc3DqpcG7zkg4=",
+    "hash": "sha256-i9BEq7T3BZaTPpMs13obJyCdQB0/ZPLyOukbz8tZODQ=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/external",
    "owner": "hashicorp",
    "repo": "terraform-provider-external",
-    "rev": "v2.4.1",
+    "rev": "v2.4.2",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gv54RqpkWri5yL40ajcLnqzF0XvMEzFoFEEV2/g1paE="
+    "vendorHash": "sha256-kkCiz73W5RT0Zw+euWD9bnBpe5enVOT4mTJ5daszU4s="
  },
  "hashicorp_google": {
    "hash": "sha256-NTGkDJvCvChsRRkrI+ShMyZ6+QQoiBk0vdBjvFGYogE=",
@@ -1418,13 +1418,13 @@
    "vendorHash": null
  },
  "ubiquiti-community_unifi": {
-    "hash": "sha256-rtRuqcADrEq6hodytLJ8z67nJjjZ6LTmFKgRd1GAd+A=",
+    "hash": "sha256-GQFSi57+oebB9OiySbDD6gu8YDqKWCkIx31yORJIpVk=",
    "homepage": "https://registry.terraform.io/providers/ubiquiti-community/unifi",
    "owner": "ubiquiti-community",
    "repo": "terraform-provider-unifi",
-    "rev": "v0.56.1",
+    "rev": "v0.59.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CtqDFTVJqbPF5riVrEdtLZhOxtK1MU2SbTf8xClksQw="
+    "vendorHash": "sha256-XH3Z47i7WTiZ+WrUadoRABcXD8ZkeXnJHINKkAHseE8="
  },
  "ucloud_ucloud": {
    "hash": "sha256-kqBVVJW+rT8coZUDf64Dd0ljAOMxfAkr57WoeKB6Gs4=",
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -318,6 +318,17 @@ stdenv.mkDerivation (
          url = "https://github.com/gnuradio/gnuradio/commit/d8814e0c3ef68372e5a1093603ef602e2119cd8a.patch";
          hash = "sha256-TQxqsce1AhSjdwaG2IP11QTeOgdJHN6cAAnznBl8eM8=";
        })
+        # Needed for the patch below to be able to apply
+        (fetchpatch {
+          url = "https://github.com/gnuradio/gnuradio/commit/56d230fd33fa2e8d6dc3685c9545589f21a6a1fd.patch";
+          hash = "sha256-N6Y7B1EJKQxWlpu3E7sjNgivva8+x0V2DlBQMXYLXbA=";
+        })
+        # Fixes a test failing due to precision. See:
+        # https://github.com/gnuradio/gnuradio/pull/8181
+        (fetchpatch {
+          url = "https://github.com/gnuradio/gnuradio/commit/aee9fd3f79389c4282a98e8d62c8405c73fd91df.patch";
+          hash = "sha256-UtYAJqqmydGs2EP4JOTGrQ6OgvL/jwGVwlhG4xxj8SU=";
+        })
      ];
      passthru = shared.passthru // {
        # Deps that are potentially overridden and are used inside GR plugins - the same version must
--- a/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix
@@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-vertical-canvas";
-  version = "1.6.4";
+  version = "1.6.5";

  src = fetchFromGitHub {
    owner = "Aitum";
    repo = "obs-vertical-canvas";
    rev = version;
-    sha256 = "sha256-cWiC4e+ZojTuNAaNwuBQ1pPlchdiuTsVhWMHvcyxx2A=";
+    sha256 = "sha256-F28AqKOvBfalo5kG/pNzZ8lz4rcd7LRxdqq9g0lv+hA=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/build-support/fetchgit/default.nix
+++ b/pkgs/build-support/fetchgit/default.nix
@@ -269,7 +269,7 @@ lib.makeOverridable (
            // meta.identifiers or { };
          };

-          env = {
+          env = derivationArgs.env or { } // {
            NIX_PREFETCH_GIT_CHECKOUT_HOOK = finalAttrs.postCheckout;
          };

--- a/pkgs/by-name/an/android-mic/package.nix
+++ b/pkgs/by-name/an/android-mic/package.nix
@@ -24,13 +24,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "android-mic";
-  version = "2.2.9";
+  version = "2.2.10";

  src = fetchFromGitHub {
    owner = "teamclouday";
    repo = "AndroidMic";
    tag = finalAttrs.version;
-    hash = "sha256-YhkHK795WeRaGUIaBNWNAkaL836muFRZAZRmP0FEC6g=";
+    hash = "sha256-cJIA3JMh0pHf3zUDfPK4tqv5fIuNoPdUbEsrEnIepP8=";
  };

  sourceRoot = "${finalAttrs.src.name}/RustApp";
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '`git rev-parse --short HEAD`' '"${finalAttrs.version}"'
  '';

-  cargoHash = "sha256-Ar7kdIXl/2H3c83x7uw977PwShYqV4e2O9HXEeiZeAM=";
+  cargoHash = "sha256-tsgRqVVR2P8PTgb04CHj2dVDdMa7sFTqPptOAgzxl2g=";

  __structuredAttrs = true;
  strictDeps = true;
--- a/pkgs/by-name/ap/apm-cli/package.nix
+++ b/pkgs/by-name/ap/apm-cli/package.nix
@@ -7,7 +7,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "apm-cli";
-  version = "0.32.0";
+  version = "0.33.0";
  pyproject = true;

  __structuredAttrs = true;
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "microsoft";
    repo = "apm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yGgLFNwvJkZx0yX8PtUjeg/XdCYBD7YRb0OXoA8knno=";
+    hash = "sha256-MTxk7lBEoL9DRSxRxBN6BvjYAK7NOpmDVVId/4Ix8FA=";
  };

  postPatch = ''
--- a/pkgs/by-name/ar/archipelago/package.nix
+++ b/pkgs/by-name/ar/archipelago/package.nix
@@ -17,10 +17,10 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "archipelago";
-  version = "0.6.7";
+  version = "0.6.8";
  src = fetchurl {
    url = "https://github.com/ArchipelagoMW/Archipelago/releases/download/${finalAttrs.version}/Archipelago_${finalAttrs.version}_linux-x86_64.AppImage";
-    hash = "sha256-a5UazzqGu7q4Zg1AYHnbQjCTQNdcNaL/gZUjYV3Rk5Q=";
+    hash = "sha256-EoH7e5gWvZGfkHMJPOr8s7GAQUP8IGv8NLcEFwB2JA4=";
  };

  dontUnpack = true;
@@ -74,16 +74,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

-  preFixup = ''
-    patchelf \
-      --replace-needed libcrypto.so.1.0.0 libcrypto.so \
-      --replace-needed libssl.so.1.0.0 libssl.so \
-      $out/lib/opt/Archipelago/EnemizerCLI/System.Security.Cryptography.Native.OpenSsl.so
-
-    patchelf --replace-needed liblttng-ust.so.0 liblttng-ust.so \
-      $out/lib/opt/Archipelago/EnemizerCLI/libcoreclrtraceptprovider.so
-  '';
-
  passthru.updateScript = nix-update-script { };

  meta = {
--- a/pkgs/by-name/au/autenticacao-gov-pt-bin/package.nix
+++ b/pkgs/by-name/au/autenticacao-gov-pt-bin/package.nix
@@ -49,13 +49,13 @@ let
  };

 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "autenticacao-gov-pt-bin";
-  version = "3.14.0";
+  version = "3.15.0";

  src = fetchurl {
-    url = "https://github.com/amagovpt/autenticacao.gov/releases/download/v${version}/pteid-mw-${version}.flatpak";
-    hash = "sha256-eOUW3sWG8ujihqNuTvYbwzQh9sP5nS4YxL2kHngQ/V0=";
+    url = "https://github.com/amagovpt/autenticacao.gov/releases/download/v${finalAttrs.version}/pteid-mw-${finalAttrs.version}.flatpak";
+    hash = "sha256-Npbu1ZL+YW40jWbbLDnZ6gkhm+nHwBAQMCwHFOU03Ok=";
  };

  dontConfigure = true;
@@ -96,14 +96,14 @@ stdenv.mkDerivation rec {

  unpackPhase = ''
    ostree init --repo=pteid --mode=archive-z2
-    ostree static-delta apply-offline --repo=pteid ${src}
+    ostree static-delta apply-offline --repo=pteid ${finalAttrs.src}
    ostree checkout --repo=pteid -U $(cd pteid/objects && echo */*.commit | sed -E "s/\/|\.commit$//g") pteid_out
  '';

  desktopItems = [
    (makeDesktopItem {
-      name = pname;
-      exec = pname;
+      name = finalAttrs.pname;
+      exec = finalAttrs.meta.mainProgram;
      desktopName = "Autenticação.gov";
      genericName = "Portuguese eID Data";
      comment = "Middleware for Electronic Identification in Portugal";
@@ -123,7 +123,7 @@ stdenv.mkDerivation rec {
  '';

  postInstall = ''
-    makeWrapper "${proot}/bin/proot" "$out/bin/${pname}" \
+    makeWrapper "${proot}/bin/proot" "$out/bin/${finalAttrs.meta.mainProgram}" \
      --add-flags "-b" \
      --add-flags "$out/app:/app" \
      --add-flags "$out/app/bin/eidguiV2" \
@@ -139,6 +139,7 @@ stdenv.mkDerivation rec {
  '';

  meta = {
+    changelog = "https://github.com/amagovpt/autenticacao.gov/releases/tag/v${finalAttrs.version}";
    description = "Middleware for Electronic Identification in Portugal (with precompiled binaries by AMA)";
    homepage = "https://www.autenticacao.gov.pt/";
    license = lib.licenses.eupl12;
@@ -164,6 +165,8 @@ stdenv.mkDerivation rec {
      official binary avoids this limitation and provides full functionality.
    '';
    maintainers = with lib.maintainers; [ vaavaav ];
+    mainProgram = "autenticacao-gov-pt-bin";
    platforms = lib.platforms.linux;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
-}
+})
--- a/pkgs/by-name/ba/bakoma_ttf/package.nix
+++ b/pkgs/by-name/ba/bakoma_ttf/package.nix
@@ -1,4 +1,5 @@
 {
+  lib,
  stdenvNoCC,
  fetchurl,
  installFonts,
@@ -19,11 +20,9 @@ stdenvNoCC.mkDerivation {
  meta = {
    description = "TrueType versions of the Computer Modern and AMS TeX Fonts";
    homepage = "https://www.ctan.org/tex-archive/fonts/cm/ps-type1/bakoma/ttf/";
-    license = {
+    license = lib.licenses.mkLicense {
      shortName = "bakoma-fonts";
      fullName = "BaKoMa Fonts Licence";
-      free = true;
-      redistributable = true;
    };
  };
 }
--- a/pkgs/by-name/ba/bat/package.nix
+++ b/pkgs/by-name/ba/bat/package.nix
@@ -6,6 +6,7 @@
  less,
  installShellFiles,
  makeWrapper,
+  libgit2,
  zlib,
  versionCheckHook,
 }:
@@ -25,6 +26,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-WRLCs1hrwFT3tya9CzKUuh5g+6fYqKDtv3yvDx8Wws8=";

+  env.LIBGIT2_NO_VENDOR = 1;
+
  nativeBuildInputs = [
    pkg-config
    installShellFiles
@@ -32,6 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  ];

  buildInputs = [
+    libgit2
    zlib
  ];

--- a/pkgs/by-name/ba/bazel_9/package.nix
+++ b/pkgs/by-name/ba/bazel_9/package.nix
@@ -29,7 +29,7 @@
  cctools,
  # Allow to independently override the jdks used to build and run respectively
  jdk_headless,
-  version ? "9.1.1",
+  version ? "9.2.0",
 }:

 let
@@ -89,7 +89,7 @@ let

  src = fetchzip {
    url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-NwZQcycUMAzos1wLdSlwv2EjhDcPVJgQTkLT57AjFvI=";
+    hash = "sha256-sL6fIV2K/00nx1+SrQTWnsPqfg6amHx4053UZNwgg0o=";
    stripRoot = false;
  };

--- a/pkgs/by-name/bi/binaryninja-free/package.nix
+++ b/pkgs/by-name/bi/binaryninja-free/package.nix
@@ -102,7 +102,8 @@ stdenv.mkDerivation (finalAttrs: {
    }";
    description = "Interactive decompiler, disassembler, debugger";
    homepage = "https://binary.ninja/";
-    license = {
+    license = lib.licenses.mkLicense {
+      shortName = "binary-ninja";
      fullName = "Binary Ninja Free Software License";
      url = "https://docs.binary.ninja/about/license.html#free-license";
      free = false;
--- a/pkgs/by-name/bo/boringssl/package.nix
+++ b/pkgs/by-name/bo/boringssl/package.nix
@@ -13,12 +13,12 @@
 # reference: https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20250818.0/BUILDING.md
 stdenv.mkDerivation (finalAttrs: {
  pname = "boringssl";
-  version = "0.20260803.0";
+  version = "0.20260929.0";

  src = fetchgit {
    url = "https://boringssl.googlesource.com/boringssl";
    tag = finalAttrs.version;
-    hash = "sha256-GmaXG6I2euA+Q7naO2Oxu+P4mK37RbgwW5iM7ync6Gg=";
+    hash = "sha256-ccqhnaYFSLp0dkv8PpdFvz+lzV0X9nL23O3rj5RRA0c=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ca/camunda-modeler/package.nix
+++ b/pkgs/by-name/ca/camunda-modeler/package.nix
@@ -10,11 +10,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "camunda-modeler";
-  version = "5.51.1";
+  version = "5.52.0";

  src = fetchurl {
    url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-JzrLhC6zQhKNRgMQYcyrt7vdrt7QQtCCg/8GoqV1hco=";
+    hash = "sha256-I5xjqaYCJZbWQW23gxpubwmADbVZPK1UYx7w/q9+Iwg=";
  };
  sourceRoot = "camunda-modeler-${version}-linux-x64";

--- a/pkgs/by-name/ca/cargo-binstall/package.nix
+++ b/pkgs/by-name/ca/cargo-binstall/package.nix
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-binstall";
-  version = "1.25.1";
+  version = "1.25.2";

  src = fetchFromGitHub {
    owner = "cargo-bins";
    repo = "cargo-binstall";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w5goXns4ROnJI0MZ2KsZampdNLUubxBO7So8xYFffzg=";
+    hash = "sha256-/aqbL8ZW8E//EL61SruDq57LolGscs8cAw+hLLlJBHg=";
  };

-  cargoHash = "sha256-CambvGJ7Mk9bj5P590VdHUKky0iSkJ+dR+BYNkmpQ+I=";
+  cargoHash = "sha256-WzaGzQQh4GY4yUD7w9bDS86j6I9ASJb2M6g6x4jJE7E=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ca/cargo-clone/package.nix
+++ b/pkgs/by-name/ca/cargo-clone/package.nix
@@ -3,6 +3,7 @@
  rustPlatform,
  fetchFromGitHub,
  pkg-config,
+  libgit2,
  openssl,
  zlib,
 }:
@@ -20,9 +21,12 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-AFCCXZKm6XmiaayOqvGhMzjyMwAqVK1GZccWHWV5/9c=";

+  env.LIBGIT2_NO_VENDOR = 1;
+
  nativeBuildInputs = [ pkg-config ];

  buildInputs = [
+    libgit2
    openssl
    zlib
  ];
--- a/pkgs/by-name/ca/cargo-crev/package.nix
+++ b/pkgs/by-name/ca/cargo-crev/package.nix
@@ -6,6 +6,7 @@
  perl,
  pkg-config,
  curl,
+  libgit2,
  libiconv,
  openssl,
  gitMinimal,
@@ -24,6 +25,8 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-CYvvwgDZ+yAr7kLGEVZLVx7+sZUc5vu85AT5xLJBSbQ=";

+  env.LIBGIT2_NO_VENDOR = 1;
+
  preCheck = ''
    export HOME=$(mktemp -d)
    git config --global user.name "Nixpkgs Test"
@@ -36,6 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  ];

  buildInputs = [
+    libgit2
    openssl
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
--- a/pkgs/by-name/ca/cargo-outdated/package.nix
+++ b/pkgs/by-name/ca/cargo-outdated/package.nix
@@ -3,6 +3,7 @@
  rustPlatform,
  fetchFromGitHub,
  pkg-config,
+  libgit2,
  openssl,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -18,9 +19,14 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-51UjhAC2boNgW5kc7WxZOxcnXirw1E07CjLRcj/GEOM=";

+  env.LIBGIT2_NO_VENDOR = 1;
+
  nativeBuildInputs = [ pkg-config ];

-  buildInputs = [ openssl ];
+  buildInputs = [
+    libgit2
+    openssl
+  ];

  meta = {
    description = "Cargo subcommand for displaying when Rust dependencies are out of date";
--- a/pkgs/by-name/ca/cargo-udeps/package.nix
+++ b/pkgs/by-name/ca/cargo-udeps/package.nix
@@ -4,6 +4,7 @@
  rustPlatform,
  fetchFromGitHub,
  pkg-config,
+  libgit2,
  openssl,
  libiconv,
 }:
@@ -21,10 +22,13 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-DGfAsBucFRFJkjmJkpTpNfQO79jaNa5NezXKf7hYYeM=";

+  env.LIBGIT2_NO_VENDOR = 1;
+
  nativeBuildInputs = [ pkg-config ];

  # TODO figure out how to use provided curl instead of compiling curl from curl-sys
  buildInputs = [
+    libgit2
    openssl
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
--- a/pkgs/by-name/cl/claude-code/manifest.zst.json
+++ b/pkgs/by-name/cl/claude-code/manifest.zst.json
@@ -1,62 +1,61 @@
 {
-  "version": "2.1.289",
+  "version": "2.1.291",
  "manifestSignatureEnforcement": "flag",
-  "commit": "736d26eef42d1e3017e07e6d5bd0970b8c3a068f",
-  "modsCommit": "52c76441cae91f6891e4712306bffb057ff6fec5",
-  "buildDate": "2026-10-03T19:39:42Z",
+  "commit": "f7d32cfe47f735a7e70c5cce1ff6044b24692b4c",
+  "modsCommit": "2bfb629dfaff0c8318047a4beb93cf1dc5b58b18",
+  "buildDate": "2026-10-06T02:42:33Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude.zst",
-      "checksum": "44404b386c30be106533bbd260b689d22cedb6956a6ae70118ba96a32711a82b",
-      "size": 76604429,
+      "checksum": "2f750a99ce662a1f5d586a88e1a13463c9e88ae9e55a492878a82e46685414f5",
+      "size": 77709814,
      "bundle": {
-        "checksum": "ee67e3f1ea60471c9e78f7c4b1cf30be832862afeec0b80805207d3eee140046",
-        "size": 76620437
+        "checksum": "614337527cc1322f79021a909803906aace475a013b14cf2924012e6bb40a6bb",
+        "size": 77720906
      }
    },
    "darwin-x64": {
      "binary": "claude.zst",
-      "checksum": "104d246d33eecb9750b26eecae258ec81bb02cf8cda8ccd6cbc2d00f6664d176",
-      "size": 80786935,
+      "checksum": "91e8b3e811cbd1c95ce848e2e7067c686a5c27b98f3594b21c9de3159a2e73d0",
+      "size": 81924067,
      "bundle": {
-        "checksum": "1a416eb22c68a7a35ad50a28a6eaa56227ddb50ea661786ffb67677b134894ac",
-        "size": 80788940
+        "checksum": "8bef52ddf0dc51d08e1c3cb594671324edb9398da35c83d8a6bb84f6de6a5a0e",
+        "size": 81922297
      }
    },
    "linux-arm64": {
      "binary": "claude.zst",
-      "checksum": "9bae454cf4f886a2c7833746a9253d877b65c24c4c4403689a573bc47bf4b35a",
-      "size": 85691403
+      "checksum": "1516c691c7ca10ca0a09d00160c006dfdb1f44263c928e6e4360363717de03f6",
+      "size": 86807536
    },
    "linux-x64": {
      "binary": "claude.zst",
-      "checksum": "66f72a868a42ca10e5462ab78a88fd9f5576486f59b32a0afc5910ab4b73b765",
-      "size": 86429541
+      "checksum": "659b2a4f57441eae2bad4e1ee67f93c26fe630863683463f48c7000ebeda8372",
+      "size": 87530446
    },
    "linux-arm64-musl": {
      "binary": "claude.zst",
-      "checksum": "84f9baadb049624c58165510498427269ce0c07b31d597ac21c370808c359549",
-      "size": 84096543
+      "checksum": "1375f3eb6216e3135bc74246fc8302d3f717792a587196bfca52b78408c4df83",
+      "size": 85206110
    },
    "linux-x64-musl": {
      "binary": "claude.zst",
-      "checksum": "4ef0cfc150a4c8cf82bd4a726828980aae965e6db8084d00191befab9234f123",
-      "size": 84854125
+      "checksum": "e3c4559aeed8bfbd665c769dabc04d6b6fa54ec704db80f36153b9272bd63236",
+      "size": 85976967
    },
    "win32-x64": {
      "binary": "claude.exe.zst",
-      "checksum": "e1f0154146bb2618ea9943fa25778362182f8f1bf6c65f8dfd1a68a9a1d2b897",
-      "size": 88725729
+      "checksum": "693ddb8ce8ddaf9f1514c394d7997d2b6d02037e41960ff6864b83b0428b71fd",
+      "size": 89823809
    },
    "win32-arm64": {
      "binary": "claude.exe.zst",
-      "checksum": "2ddfd5eeaff95051dc32e0b03e441f97fc10af43747402194fa7793e21827348",
-      "size": 85047493
+      "checksum": "661f032008df3727922f7087ef08900d4d5728a14544316d1e68ee43e74c339d",
+      "size": 86165279
    }
  },
  "sdkCompat": {
    "testedWrapperVersions": [
-      "0.3.250",
      "0.3.251",
      "0.3.252",
      "0.3.257",
--- a/pkgs/by-name/co/codex-acp/package.nix
+++ b/pkgs/by-name/co/codex-acp/package.nix
@@ -10,16 +10,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "codex-acp";
-  version = "1.13.1";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "agentclientprotocol";
    repo = "codex-acp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lVsj8RqE8XwCblOBSk3B4Nckx4h1o1BHMRrmpkhrIEw=";
+    hash = "sha256-bSxt9vtFnIrdZDmFJdYAfqkgm4BrGYKe420RamPkZvg=";
  };

-  npmDepsHash = "sha256-jXXvfg2bPZlvkNBZUw3ptpoOy9wOcvl2B8J0HnpX79c=";
+  npmDepsHash = "sha256-7v7QE0cmYsd3JGu0VoT53yZ1rb9wYB+tXt05G1EEvz8=";

  nativeBuildInputs = [ makeBinaryWrapper ];

--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -29,13 +29,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codex";
-  version = "0.160.0";
+  version = "0.160.1";

  src = fetchFromGitHub {
    owner = "openai";
    repo = "codex";
    tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-UFPv9UK0MBYZfpZ3QlkTXa19ykHwIEo3JdwPtUUrJls=";
+    hash = "sha256-9oXMysQ+v4txGIhPsgh45xAAqWYglZjhdS50uxMPHz4=";
  };

  sourceRoot = "${finalAttrs.src.name}/codex-rs";
--- a/pkgs/by-name/co/comrak/package.nix
+++ b/pkgs/by-name/co/comrak/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "comrak";
-  version = "0.55.0";
+  version = "0.56.0";

  src = fetchFromGitHub {
    owner = "kivikakk";
    repo = "comrak";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-uxOCxuOL3iMMVPZCG0tE9To7lJp94ILf2crm/ShCChE=";
+    sha256 = "sha256-BCBnCwEJSHBQZ7Sa6nbn4USfI+L79a8LtkVb81W8rqw=";
  };

-  cargoHash = "sha256-fn9y6Hwtw3vUq5BES796IsyNXHQm8YydmYUDWbXUA3o=";
+  cargoHash = "sha256-1yW3rGZujuVgNzm+mN9oig3YP89JXE2No70RW01per4=";

  meta = {
    description = "CommonMark-compatible GitHub Flavored Markdown parser and formatter";
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -72,12 +72,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  meta = {
    description = "Use GitHub Copilot with any editor or IDE via the Language Server Protocol";
    homepage = "https://github.com/features/copilot";
-    license = {
+    license = lib.licenses.mkLicense {
      deprecated = false;
      free = false;
      fullName = "GitHub Copilot Product Specific Terms";
      redistributable = false;
-      shortName = "GitHub Copilot License";
+      shortName = "GitHub-Copilot-License";
      url = "https://github.com/customer-terms/github-copilot-product-specific-terms";
    };
    sourceProvenance = with lib.sourceTypes; [
--- a/pkgs/by-name/da/dawarich/sources.json
+++ b/pkgs/by-name/da/dawarich/sources.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.15.2",
-  "hash": "sha256-HEEg0kcs5CTcplUn30kbo8JShqThKKuzBhvR+Cl7SCs=",
+  "version": "1.15.3",
+  "hash": "sha256-FaPKk6Y9ayPk/cPAxcS1tvfjjJ8KqAYyx21yS/Sdeyo=",
  "npmHash": "sha256-Xe9FDNDJxx2Vt+ByXz8JX2cAPg+Y/sUeHeWePHEp0/0="
 }
--- a/pkgs/by-name/de/delta/package.nix
+++ b/pkgs/by-name/de/delta/package.nix
@@ -6,10 +6,12 @@
  installShellFiles,
  pkg-config,
  oniguruma,
+  libgit2,
  stdenv,
  git,
  zlib,
  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@@ -32,6 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  buildInputs = [
    oniguruma
+    libgit2
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    zlib
@@ -41,6 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  env = {
    RUSTONIG_SYSTEM_LIBONIG = true;
+    LIBGIT2_NO_VENDOR = 1;
  };

  postInstall = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
@@ -68,7 +72,9 @@ rustPlatform.buildRustPackage (finalAttrs: {

  nativeInstallCheckInputs = [
    versionCheckHook
+    writableTmpDirAsHomeHook
  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
  doInstallCheck = true;

  meta = {
--- a/pkgs/by-name/di/diffnav/package.nix
+++ b/pkgs/by-name/di/diffnav/package.nix
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "diffnav";
-  version = "0.12.0";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "dlvhdr";
    repo = "diffnav";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DrEbo9YYg4FCXQXuIkbPxO5Z3ZOPZJYeGoLoP/vT0Y0=";
+    hash = "sha256-eeNhsTT9IrSQ5dvPHJJvGL/k5ard4oLVzhqd+NV/vBw=";
  };

-  vendorHash = "sha256-2OzHyBPsylQVXhPlqk2owEhiibFi3H1UENvGGDdzGss=";
+  vendorHash = "sha256-5A1O3QbiWx3xF8Mp3Pm1rT40UrYCBm0NuHtk/c217IE=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/do/docker-sbx/package.nix
+++ b/pkgs/by-name/do/docker-sbx/package.nix
@@ -15,9 +15,9 @@
 }:
 let
  hashes = {
-    "x86_64-linux" = "sha256-PrFbhETpaaqo1jclC+8PK/kMsDCroKcBala45fzdJf4=";
-    "aarch64-linux" = "sha256-Ma46iMwIN0PllWn+3WofUns73WxWfVjlvGDGwK8ZpUA=";
-    "aarch64-darwin" = "sha256-6fybO66cVyilcm9JubNgkyhRnaV288mf2Ofl0TcAinw=";
+    "x86_64-linux" = "sha256-qJy0OAB167IJOBA7yY7GMyf76r5Dpx8Fdd2yhaBR6rQ=";
+    "aarch64-linux" = "sha256-ajxF31L/MnIrsz5NLGb5kg4oS5o63roXr8/Oo600bv8=";
+    "aarch64-darwin" = "sha256-lH5ogmxisS3i+gulsKZ6lTkRojISA8BPfAmCzPwPFpQ=";
  };
  platformName = {
    "x86_64-linux" = "linux-amd64";
@@ -27,7 +27,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "docker-sbx";
-  version = "0.43.0";
+  version = "0.47.0";
  src =
    let
      throwPlat = throw "Unsupported platform ${stdenvNoCC.hostPlatform.system}";
--- a/pkgs/by-name/dr/drupal/package.nix
+++ b/pkgs/by-name/dr/drupal/package.nix
@@ -8,18 +8,18 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "drupal";
-  version = "11.4.7";
+  version = "11.4.8";

  src = fetchFromGitLab {
    domain = "git.drupalcode.org";
    owner = "project";
    repo = "drupal";
    tag = finalAttrs.version;
-    hash = "sha256-bVF5forQOEaXbriSxf6U1n/eQCwkMIHMvY4LwIx0fRE=";
+    hash = "sha256-t0zDtYAAj0DJd+vUmflVjBShvGwpeE/d4Xt7Xh0bxOU=";
  };

  composerNoPlugins = false;
-  vendorHash = "sha256-/mFF7HIjj3b/4zQRfGSD2FyPljoMNJWly6K4hc05uOE=";
+  vendorHash = "sha256-YIEMBCe2WuQV1fxqLVsUUZ+5Go4EylNp/c2nBZUN1WI=";

  passthru = {
    tests = {
--- a/pkgs/by-name/dy/dyalog/package.nix
+++ b/pkgs/by-name/dy/dyalog/package.nix
@@ -191,7 +191,8 @@ stdenv.mkDerivation (finalAttrs: {
    }.htm";
    description = "Dyalog APL interpreter";
    homepage = "https://www.dyalog.com";
-    license = {
+    license = lib.licenses.mkLicense {
+      shortName = "dyalog";
      fullName = "Dyalog License";
      url = licenseUrl;
      free = false;
--- a/pkgs/by-name/ed/edhm-ui/package.nix
+++ b/pkgs/by-name/ed/edhm-ui/package.nix
@@ -114,12 +114,12 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/BlueMystical/EDHM_UI";
    license = [
      lib.licenses.gpl3Plus
-      {
+      (lib.licenses.mkLicense {
        shortName = "edhm-custom";
        fullName = "EDHM Custom Restrictive License - Non-redistributable";
        free = false;
        redistributable = false;
-      }
+      })
    ];
    maintainers = with lib.maintainers; [
      graysontinker
--- a/pkgs/by-name/ef/efivar/package.nix
+++ b/pkgs/by-name/ef/efivar/package.nix
@@ -40,6 +40,26 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://github.com/rhboot/efivar/commit/f521cd7f584c95d8308659ab9d89d750e2bd76da.patch";
      hash = "sha256-I19UIS0tNTsEipuoMQPlTEwih1RrYPz9Q4Wy98u1z0Q=";
    })
+  ]
+  # fix 32-bit builds
+  # Can remove once https://github.com/rhboot/efivar/pull/301 is merged
+  ++ lib.optionals stdenv.hostPlatform.is32bit [
+    (fetchpatch {
+      url = "https://github.com/rhboot/efivar/commit/a629c47059e76f971269b76f0f00cee2e991f427.patch";
+      hash = "sha256-qdl6EZ6/ovjUQQ7ViIkGQ2BP1eu4pnOwrezZKidSg5A=";
+    })
+    (fetchpatch {
+      url = "https://github.com/rhboot/efivar/commit/05aa7e2030acc2b0386972617dc76fcc268c79b1.patch";
+      hash = "sha256-CtodF4t2mHeJ6ajsuxljWsWwPovbISEfAAZJgc4gS0Y=";
+    })
+    (fetchpatch {
+      url = "https://github.com/rhboot/efivar/commit/41ebf550bb206aad6d82022d2f91e846b74bad04.patch";
+      hash = "sha256-fAVdtG8To6/pDKiGtvBaCd8rMYZTRh4Td7uVI8/42Rg=";
+    })
+    (fetchpatch {
+      url = "https://github.com/rhboot/efivar/commit/3633172fdace9cd1b233eb997ad4128d102ae010.patch";
+      hash = "sha256-lQ/MQ9mwhaTzwnp9PNEYfn6TIC71kIhwGuKSSYdFheA=";
+    })
  ];

  makeFlags = [
@@ -56,7 +76,5 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/rhboot/efivar";
    platforms = lib.platforms.linux;
    license = lib.licenses.lgpl21Only;
-    # See https://github.com/NixOS/nixpkgs/issues/388309
-    broken = stdenv.hostPlatform.is32bit;
  };
 })
--- a/pkgs/by-name/et/etcd_3_5/package.nix
+++ b/pkgs/by-name/et/etcd_3_5/package.nix
@@ -7,11 +7,11 @@
 }:

 let
-  version = "3.5.33";
-  etcdSrcHash = "sha256-XrFuYT1IOkwroRAHFOvgLQUcyBJ8LUrWse7xzG5GOWM=";
-  etcdServerVendorHash = "sha256-j+nZL9yXnsPhBWZNOA2KI/L3bY1IajSI3KnjvZmHGhE=";
-  etcdUtlVendorHash = "sha256-+0sduuTcLodiKdgJT8NzprC6XLwOo5ONwl/k8FwfEuU=";
-  etcdCtlVendorHash = "sha256-OqMcTekZB5Otoio49wvV3zKNtE9ZA+7nd3D2vQOR6Fo=";
+  version = "3.5.34";
+  etcdSrcHash = "sha256-yiAELU14Aq1tFiUu59an5l8KzGUsUku4saUFqsSdTy0=";
+  etcdServerVendorHash = "sha256-IeuoXNdKLOffPO3uVVDMccLCRH/BKENLVYiTRxEieos=";
+  etcdUtlVendorHash = "sha256-+jM9JJsuB7KhAWt4P6b9olBycIXGpuDPfrSzl8rrOHo=";
+  etcdCtlVendorHash = "sha256-h40HJ/GhCgYcIlVPqjRXPBY4pdbX8c5cd7Zy0kuNxpg=";

  src = fetchFromGitHub {
    owner = "etcd-io";
--- a/pkgs/by-name/et/etcd_3_6/package.nix
+++ b/pkgs/by-name/et/etcd_3_6/package.nix
@@ -9,11 +9,11 @@
 }:

 let
-  version = "3.6.14";
-  etcdSrcHash = "sha256-kALMdhbZSzc+WLAjiSFQL093TTm/sQ2C2keQch8cB7E=";
-  etcdCtlVendorHash = "sha256-9aOCatgY5ov/b4NuYlK6osSP06WavUXMnf+UZHG3Qrc=";
-  etcdUtlVendorHash = "sha256-ABDOp5QenMh4sCrMDQtXdtumcolyVSDb9H2vMWBSQYI=";
-  etcdServerVendorHash = "sha256-H0C6rPP0QOYQxPmHKw/z90Am/VXQRrp1lDlOI1LHGYQ=";
+  version = "3.6.15";
+  etcdSrcHash = "sha256-rnipUdLe5cZNouEuk86Wl8GDav3pk3stuGYj1ZTjy90=";
+  etcdCtlVendorHash = "sha256-2rWlwRaZ00iZqE2IHQtICmVVN6DvRNPYtnmqSS8fU0E=";
+  etcdUtlVendorHash = "sha256-bhnYxDB8xB7As938IVlvHAViqxlLKIDjye17VD5tPiQ=";
+  etcdServerVendorHash = "sha256-p0ka3KRlfaQmK3UPwjNICdtqjixgvs1oTQWxY0pOrq8=";

  src = fetchFromGitHub {
    owner = "etcd-io";
--- a/pkgs/by-name/ev/evilwm/package.nix
+++ b/pkgs/by-name/ev/evilwm/package.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    homepage = "http://www.6809.org.uk/evilwm/";
    description = "Minimalist window manager for the X Window System";
-    license = {
+    license = lib.licenses.mkLicense {
      shortName = "evilwm";
      fullName = "Custom, inherited from aewm and 9wm";
      url = "https://www.6809.org.uk/evilwm/";
--- a/pkgs/by-name/ex/exegol/package.nix
+++ b/pkgs/by-name/ex/exegol/package.nix
@@ -67,13 +67,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
    changelog = "https://github.com/ThePorgs/Exegol/releases/tag/${finalAttrs.src.tag}";
    license = with lib.licenses; [
      gpl3Only
-      {
+      (mkLicense {
+        shortName = "esl10";
        fullName = "Exegol Software License (ESL) - Version 1.0";
        url = "https://docs.exegol.com/legal/software-license";
        # Please use exegol4 if you prefer to avoid the unfree version of Exegol.
        free = false;
        redistributable = false;
-      }
+      })
    ];
    mainProgram = "exegol";
    maintainers = with lib.maintainers; [
--- a/pkgs/by-name/fa/fastp/package.nix
+++ b/pkgs/by-name/fa/fastp/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fastp";
-  version = "1.3.7";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "OpenGene";
    repo = "fastp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CgsFm05sj+ZQADoQtDbyxsMqwxQTuVtwDdJVPwF2rOs=";
+    hash = "sha256-PaQ3+Prc9gacZAscgo4Ub5I29J2mqOEMq0yIWniB2TQ=";
  };

  buildInputs = [
--- a/pkgs/by-name/fe/fennel-ls/package.nix
+++ b/pkgs/by-name/fe/fennel-ls/package.nix
@@ -2,10 +2,14 @@
  lib,
  stdenv,
  fetchFromSourcehut,
-  lua,
-  luaPackages,
+  lua5_5,
  pandoc,
 }:
+
+let
+  lua = lua5_5;
+  luaPackages = lua.pkgs;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "fennel-ls";
  version = "0.2.4";
--- a/pkgs/by-name/fl/fleet-orbit/package.nix
+++ b/pkgs/by-name/fl/fleet-orbit/package.nix
@@ -55,12 +55,12 @@ buildGoModule (finalAttrs: {
    changelog = "https://github.com/fleetdm/fleet/releases/tag/orbit-v${finalAttrs.version}";
    license = with lib.licenses; [
      mit
-      {
+      (lib.licenses.mkLicense {
        shortName = "fleet-ee";
        fullName = "Fleet Enterprise Edition License";
        url = "https://github.com/fleetdm/fleet/blob/orbit-v${finalAttrs.version}/ee/LICENSE";
        free = false;
-      }
+      })
    ];
    mainProgram = "orbit";
    maintainers = with lib.maintainers; [
--- a/pkgs/by-name/fn/fn-cli/package.nix
+++ b/pkgs/by-name/fn/fn-cli/package.nix
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "fn";
-  version = "0.6.69";
+  version = "0.6.70";

  src = fetchFromGitHub {
    owner = "fnproject";
    repo = "cli";
    rev = finalAttrs.version;
-    hash = "sha256-IRySxSBCCLfjMkkbHF8tAl59rSM58394dAPYElZzIjc=";
+    hash = "sha256-ClN5k1+Ja4ptY95atEe4ihFkarhw4rItllbpsT0QIkI=";
  };

  vendorHash = null;
--- a/pkgs/by-name/fn/fnlfmt/package.nix
+++ b/pkgs/by-name/fn/fnlfmt/package.nix
@@ -2,10 +2,14 @@
  lib,
  stdenv,
  fetchFromSourcehut,
-  lua,
-  luaPackages,
+  lua5_5,
 }:

+let
+  lua = lua5_5;
+  luaPackages = lua.luaOnBuild.pkgs;
+in
+
 stdenv.mkDerivation (finalAttrs: {
  pname = "fnlfmt";
  version = "0.3.2";
--- a/pkgs/by-name/fn/fnox/package.nix
+++ b/pkgs/by-name/fn/fnox/package.nix
@@ -5,6 +5,7 @@
  rustPlatform,
  perl,
  pkg-config,
+  openssl,
  dbus,
  udev,
  cacert,
@@ -33,13 +34,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
    pkg-config
  ];

-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+  buildInputs = [
+    openssl
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
    dbus
    udev
  ];

  nativeCheckInputs = [ cacert ];
-  env.SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+  env = {
+    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    OPENSSL_NO_VENDOR = 1;
+  };

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
--- a/pkgs/by-name/fr/freeipmi/package.nix
+++ b/pkgs/by-name/fr/freeipmi/package.nix
@@ -10,12 +10,12 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.6.19";
+  version = "1.6.20";
  pname = "freeipmi";

  src = fetchurl {
    url = "mirror://gnu/freeipmi/freeipmi-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-+Vwrc3l8SgNBpCp7PEPvtglUxBMNCCrTSP1A2lVLToU=";
+    sha256 = "sha256-nMZEUw7mKf+5TW/SCefLSouK5md/idLcRh7+2bLnCfI=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
--- a/pkgs/by-name/fr/fromager/package.nix
+++ b/pkgs/by-name/fr/fromager/package.nix
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "fromager";
-  version = "0.97.0";
+  version = "0.101.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "python-wheel-build";
    repo = "fromager";
    tag = finalAttrs.version;
-    hash = "sha256-u+avrDFOWhpPMXjY5ZlAprjinkUxY1nUqbGtndrbMkY=";
+    hash = "sha256-3zDHBVwjPCwqGFuwXw6+l1tZH4aguoVuwh8O7HuZG2M=";
  };

  build-system = with python3Packages; [
@@ -55,15 +55,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
    writableTmpDirAsHomeHook
  ];

-  # Some tests launch ignored background requests to placeholder URLs. Avoid
-  # backoff retries: https://github.com/python-wheel-build/fromager/pull/1348
+  # Bootstrap tests leave resolver cache warm-up requests unmocked. Avoid
+  # HTTP retry backoffs when those requests fail in the sandbox.
+  # Remove after https://github.com/python-wheel-build/fromager/pull/1362
  env.FROMAGER_HTTP_RETRIES = 0;

-  # Tests share repository directories and race during setup:
-  # https://github.com/python-wheel-build/fromager/pull/1349
-  dontUsePytestXdist = true;
-  pytestFlags = [ "--numprocesses=0" ];
-
  pythonImportsCheck = [
    "fromager"
  ];
--- a/pkgs/by-name/gd/gdbuspp/package.nix
+++ b/pkgs/by-name/gd/gdbuspp/package.nix
@@ -2,13 +2,13 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch2,
  meson,
  ninja,
  glib,
  pkg-config,
  nix-update-script,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
  pname = "gdbuspp";
  version = "3";
@@ -19,6 +19,20 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-LwEUNBQ7BUyoTm8tBgE4hwL7AbimCY/grQus8lWSI/M=";
  };

+  patches = [
+    (fetchpatch2 {
+      # Require C++20 for abseil-cpp 202608.
+      url = "https://github.com/OpenVPN/gdbuspp/commit/7462325fb03d318658eaa9fecfc34f46cc5705fc.patch?full_index=1";
+      hash = "sha256-gO2wi20CGb83TgIz/tJTJFcaVPasQStJzY/ICzGWWZw=";
+    })
+  ];
+
+  # The upstream patch's proxy.cpp hunk has context from post-v3 refactors.
+  patchFlags = [
+    "-p1"
+    "--fuzz=2"
+  ];
+
  postPatch = ''
    patchShebangs --build ./scripts/get-git-ref
  '';
--- a/pkgs/by-name/gf/gfal2/fix-tape-endpoint-info-aggregate.patch
+++ b/pkgs/by-name/gf/gfal2/fix-tape-endpoint-info-aggregate.patch
@@ -0,0 +1,11 @@
+--- a/src/plugins/http/gfal_http_plugin.h
+++ b/src/plugins/http/gfal_http_plugin.h
+@@ -95,8 +95,6 @@
+         std::string sitename;
+         std::string uri;
+         std::string version;
+-
+-        tape_endpoint_info() = default;
+     } tape_endpoint_info_t;
+
+     typedef std::map<std::string, bool> TokenAccessMap;
--- a/pkgs/by-name/gf/gfal2/package.nix
+++ b/pkgs/by-name/gf/gfal2/package.nix
@@ -32,9 +32,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-Dt6xA7U4aPKFZmO2iAiYM99w5ZIZNQJ+JXzuVItIlBM=";
  };

+  patches = [
+    # gcc 16: C++20 drops aggregate init for structs with a defaulted ctor
+    ./fix-tape-endpoint-info-aggregate.patch
+  ];
+
  passthru.enablePluginStatus = {
    # TODO: Change back to `true` once dcap is fixed on Darwin.
-    dcap = !dcap.meta.broken;
+    dcap = !stdenv.hostPlatform.isDarwin;
    file = true;
    gridftp = false;
    # davix-copy's dependency gsoap is currently only available on Linux.
--- a/pkgs/by-name/gh/ghostunnel/package.nix
+++ b/pkgs/by-name/gh/ghostunnel/package.nix
@@ -7,29 +7,29 @@

 buildGoModule (finalAttrs: {
  pname = "ghostunnel";
-  version = "1.10.0";
+  version = "1.11.2";

  src = fetchFromGitHub {
    owner = "ghostunnel";
    repo = "ghostunnel";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BntQCauAgnaiNn31nrVEsHFvQv7zK6D0z/rInbCVTr0=";
+    hash = "sha256-FZwWyX4sfsbzjAOCf69WDsCbgqOgLfaSWpxK+1BUoMU=";
  };

-  patches = [
-    # upstream left an untidied go.mod/go.sum in v1.10.0
-    ./pkg-errors.patch
-  ];
-
-  vendorHash = "sha256-pd7fTP0BAgpd4mD8ZG8Ak9fFF2sC0JGCDbPG8tAnWvw=";
+  vendorHash = "sha256-POmVaRIKO11R0xbLIkxy4S+nCJZ1sHtAaRNlw54aeBg=";

  deleteVendor = true;

-  # These tests don't exist for Linux, and on Darwin they attempt to use the macOS Keychain
-  # which doesn't work from a nix build. Presumably other platform implementations of the
-  # certstore would have similar issues, so it probably makes sense to skip them in
-  # general wherever they are available.
-  checkFlags = [ "-skip=^Test(ImportDelete|Signer|Certificate)(RSA|ECDSA|EC)$" ];
+  checkFlags = [
+    # These tests don't exist for Linux, and on Darwin they attempt to use the macOS Keychain
+    # which doesn't work from a nix build. Presumably other platform implementations of the
+    # certstore would have similar issues, so it probably makes sense to skip them in
+    # general wherever they are available.
+    "-skip=^Test(ImportDelete|Signer|Certificate)(RSA|ECDSA|EC)$"
+    # These tests should work in the nix build, since they only use local networking. For some
+    # reason they aren't working though.
+    "-skip=^TestACMEInitialIssuance"
+  ];

  passthru.tests = {
    nixos = nixosTests.ghostunnel;
--- a/pkgs/by-name/gh/ghostunnel/pkg-errors.patch
+++ b/pkgs/by-name/gh/ghostunnel/pkg-errors.patch
@@ -1,26 +0,0 @@
-diff --git a/go.mod b/go.mod
-index d06c2e9117..f560c1cc69 100644
--- a/go.mod
-+++ b/go.mod
-@@ -192,6 +192,7 @@
- 	github.com/nwaples/rardecode v1.1.3 // indirect
- 	github.com/pelletier/go-toml/v2 v2.3.0 // indirect
- 	github.com/pierrec/lz4 v2.6.1+incompatible // indirect
-+	github.com/pkg/errors v0.9.1 // indirect
- 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
- 	github.com/prometheus/client_model v0.6.2 // indirect
- 	github.com/prometheus/common v0.67.5 // indirect
-diff --git a/go.sum b/go.sum
-index 4dea0025f3..1edce71302 100644
--- a/go.sum
-+++ b/go.sum
-@@ -460,6 +460,9 @@
- github.com/pierrec/lz4 v2.6.1+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
- github.com/pires/go-proxyproto v0.11.0 h1:gUQpS85X/VJMdUsYyEgyn59uLJvGqPhJV5YvG68wXH4=
- github.com/pires/go-proxyproto v0.11.0/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
-+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
- github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
- github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
- github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
--- a/pkgs/by-name/gi/git-doc/package.nix
+++ b/pkgs/by-name/gi/git-doc/package.nix
@@ -0,0 +1,11 @@
+{ gitFull, lib }:
+if gitFull ? doc then
+  lib.addMetaAttrs {
+    description = "Additional documentation for Git";
+    longDescription = ''
+      This package contains additional documentation (HTML and text files) that
+      are referenced in the man pages of Git.
+    '';
+  } gitFull.doc
+else
+  throw "'git-doc' can't be evaluated as 'gitFull doesn't expose a 'doc' attribute"
--- a/pkgs/by-name/gi/git-graph/package.nix
+++ b/pkgs/by-name/gi/git-graph/package.nix
@@ -3,12 +3,18 @@
  rustPlatform,
  fetchFromGitHub,
  stdenv,
+  pkg-config,
+  libgit2,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "git-graph";
  version = "0.8.0";

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "git-bahn";
    repo = "git-graph";
@@ -18,6 +24,19 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-MGa9QKCEu7t3y7AKAm++/8+C+PjAY1dFAFIxpr4c9ks=";

+  env.LIBGIT2_NO_VENDOR = 1;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ libgit2 ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  doInstallCheck = true;
+
  meta = {
    description = "Command line tool to show clear git graphs arranged for your branching model";
    homepage = "https://github.com/git-bahn/git-graph";
--- a/pkgs/by-name/gi/git/package.nix
+++ b/pkgs/by-name/gi/git/package.nix
@@ -57,6 +57,7 @@
  cargo,
  rustc,
  nix-update-script,
+  withBreakingChanges ? false,
 }:

 assert osxkeychainSupport -> stdenv.hostPlatform.isDarwin;
@@ -267,7 +268,8 @@ stdenv.mkDerivation (finalAttrs: {
  # See https://github.com/Homebrew/homebrew-core/commit/dfa3ccf1e7d3901e371b5140b935839ba9d8b706
  ++ lib.optional stdenv.hostPlatform.isDarwin "TKFRAMEWORK=/nonexistent"
  # Starting with future Git version 3.0.0, rust will be mandatory. For now, it's optional.
-  ++ lib.optional (!rustSupport) "NO_RUST=YesPlease";
+  ++ lib.optional (!rustSupport) "NO_RUST=YesPlease"
+  ++ lib.optional withBreakingChanges "WITH_BREAKING_CHANGES=YesPlease";

  disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
    buildPackages.runtimeShellPackage
--- a/pkgs/by-name/gi/gitFull/package.nix
+++ b/pkgs/by-name/gi/gitFull/package.nix
@@ -0,0 +1,11 @@
+{ git, stdenv, ... }@args:
+git.override (
+  {
+    svnSupport = stdenv.buildPlatform == stdenv.hostPlatform;
+    guiSupport = true;
+    sendEmailSupport = stdenv.buildPlatform == stdenv.hostPlatform;
+    withSsh = true;
+    withLibsecret = !stdenv.hostPlatform.isDarwin;
+  }
+  // removeAttrs args [ "git" ]
+)
--- a/pkgs/by-name/gi/gitMinimal/package.nix
+++ b/pkgs/by-name/gi/gitMinimal/package.nix
@@ -0,0 +1,23 @@
+{
+  git,
+  stdenv,
+  curl,
+  curlMinimal,
+  ...
+}@args:
+git.override (
+  {
+    withManual = false;
+    osxkeychainSupport = false;
+    pythonSupport = false;
+    perlSupport = false;
+    rustSupport = false; # Needed for bootstrap
+    withpcre2 = false;
+    curl = if stdenv.hostPlatform.isFreeBSD then curlMinimal else curl; # Needed for FreeBSD bootstrap
+  }
+  // removeAttrs args [
+    "git"
+    "curl"
+    "curlMinimal"
+  ]
+)
--- a/pkgs/by-name/gi/gitSVN/package.nix
+++ b/pkgs/by-name/gi/gitSVN/package.nix
@@ -0,0 +1 @@
+{ git, ... }@args: git.override ({ svnSupport = true; } // removeAttrs args [ "git" ])
--- a/pkgs/by-name/gi/github-copilot-app/package.nix
+++ b/pkgs/by-name/gi/github-copilot-app/package.nix
@@ -111,7 +111,8 @@ stdenv.mkDerivation {

        # Update desktop file to use the new executable name
        substituteInPlace $out/share/applications/*.desktop \
-          --replace-fail "Exec=github" "Exec=github-copilot-app"
+          --replace-fail "Exec=github" "Exec=github-copilot-app" \
+          --replace-fail "StartupWMClass=github" "StartupWMClass=github-copilot-app"
      ''
  )
  + ''
--- a/pkgs/by-name/go/go-jet/package.nix
+++ b/pkgs/by-name/go/go-jet/package.nix
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "go-jet";
-  version = "2.16.0";
+  version = "2.16.1";

  src = fetchFromGitHub {
    owner = "go-jet";
    repo = "jet";
    rev = "v${version}";
-    sha256 = "sha256-mp+sweZTF+4/Hs9vRx6W7M3rlBz8ubSXHmrwC1QwsuE=";
+    sha256 = "sha256-Kdwa3u+WNa2pay/kGsfo3/U0/R9dr35n1Lv+yiF5WqU=";
  };

  vendorHash = "sha256-g7YIZ6o+a5N2gZCNu7j1FV+JiAp9t1ffLuIslGUehuA=";
--- a/pkgs/by-name/go/gom/package.nix
+++ b/pkgs/by-name/go/gom/package.nix
@@ -36,6 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
    meson
    ninja
    pkg-config
+    python3
  ];

  buildInputs = [
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -180,7 +180,7 @@ let

  linux = stdenvNoCC.mkDerivation (finalAttrs: {
    inherit pname meta;
-    version = "154.0.8037.97";
+    version = "155.0.8059.39";

    src =
      let
@@ -195,8 +195,8 @@ let
        url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_${debArch}.deb";
        hash =
          {
-            amd64 = "sha256-pO2+lemwHbbJuX16EyMSHtoYNitWIN8Gq6wbWb7oAFM=";
-            arm64 = "sha256-6LWJkIrHmguL24t/xWgkonIh1W+5dX1FQQZf5dH7944=";
+            amd64 = "sha256-xYqg8s1mF5yfBQ4GLIgtJ6qbn4wrfHP+40mFYLXtCzg=";
+            arm64 = "sha256-NVZJRYCnHs7hXL6zts4jvzrzYLwFPZDTEFJBwiR9pSs=";
          }
          .${debArch};
      };
@@ -306,11 +306,11 @@ let

  darwin = stdenvNoCC.mkDerivation (finalAttrs: {
    inherit pname meta;
-    version = "154.0.8037.98";
+    version = "155.0.8059.40";

    src = fetchurl {
-      url = "https://dl.google.com/release2/chrome/oesfoc5zcpr4zxi27ozbzxre4i_154.0.8037.98/GoogleChrome-154.0.8037.98.dmg";
-      hash = "sha256-f4XN7EJjK0grKvxf6O4EvPcwCCzsEyjABB14hjL1dUI=";
+      url = "https://dl.google.com/release2/chrome/lr7fpw3uxyyx5tnf7oone26c6m_155.0.8059.40/GoogleChrome-155.0.8059.40.dmg";
+      hash = "sha256-AEwDm1wMe+PWH6UlTisJXDclN4rhmcZT8yS3D0rtiUw=";
    };

    dontPatch = true;
--- a/pkgs/by-name/gr/graphite/package.nix
+++ b/pkgs/by-name/gr/graphite/package.nix
@@ -29,13 +29,13 @@
 }:

 let
-  version = "0-unstable-2026-09-15";
-  rev = "fdf6cfe296e308c45aa5696a88a947feec2fe67a";
+  version = "0-unstable-2026-10-05";
+  rev = "e38fab22455c45068fcd1eb976afb0c088fa222d";

-  srcHash = "sha256-k0C6ocP0lHwG402pmDHO0BLQ6DsK0Y4NqXLMJHHnBao=";
-  shaderHash = "sha256-LReut68Cwoz/YmXaLiVnccg+RerMrKqEWhiWGyx5k+Q=";
-  cargoHash = "sha256-/XEsrJed6rdsOpWFq6+trK9ylcH7v8g2XCExEI335jY=";
-  npmHash = "sha256-Cay+aZcZGAU2vKAs7nub/YVcQ/sxsruWhjZ9KkqXHuc=";
+  srcHash = "sha256-lKNJwRJRrtLh/0cQNFnBss2DYZp8UkoP0pkI1pQEB0Y=";
+  shaderHash = "sha256-SBJt5iEBvHM4cirnrBVUHtC0bnw8ZUQW9oEs6P02AKc=";
+  cargoHash = "sha256-5WhnrB+8eZSQ1dPJlG+pFffR3VF12NUkCn0AAoDByYM=";
+  npmHash = "sha256-VUNW+YfBvJc3EyigULBdv4Uqb+vKgTjrDMOAVk1DCvI=";

  brandingRev = "6687dc6d3d8552948458d00d35e2bee3a40ab66b";
  brandingHash = "sha256-yD4O50gz2mtby1h4o+9PqjMfYmTbBOX6XDc5Ez5fgnY=";
@@ -185,12 +185,13 @@ stdenv.mkDerivation (finalAttrs: {
    # which are licensed under the separate Graphite Branding License.
    license = with lib.licenses; [
      asl20
-      {
+      (mkLicense {
+        shortName = "graphite";
        fullName = "Graphite Branding License";
        url = "https://graphite.art/license/#branding";
        free = false;
        redistributable = true;
-      }
+      })
    ];
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ timon ];
--- a/pkgs/by-name/gr/greed/package.nix
+++ b/pkgs/by-name/gr/greed/package.nix
@@ -1,40 +1,28 @@
 {
  lib,
-  stdenv,
  fetchFromGitLab,
-  ncurses,
-  asciidoctor,
  gitUpdater,
+  rustPlatform,
 }:

-stdenv.mkDerivation (finalAttrs: {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "greed";
-  version = "4.5";
+  version = "5.2";

  src = fetchFromGitLab {
    owner = "esr";
    repo = "greed";
    tag = finalAttrs.version;
-    hash = "sha256-S2K6nn4WS1gOvhlYK/UH1hfA0pzij4w5SeP004WVZik=";
+    hash = "sha256-zhbx+4ZtsIAVfQ99FndLwGWnqf4QeZHDBUynBDFVssM=";
  };

+  cargoHash = "sha256-AT7o6uMdV6NtsbZwjh/r9OUMH7glaOeFfMvMJxVwXtA=";
+
  postPatch = ''
    substituteInPlace Makefile \
-      --replace-fail "-lcurses" "-lncurses" \
      --replace-fail "/usr/games/lib/greed.hs" "/var/lib/greed/greed.hs"
  '';

-  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  buildInputs = [
-    ncurses
-  ];
-
-  nativeBuildInputs = [
-    asciidoctor
-  ];
-
  passthru = {
    updateScript = gitUpdater { };
  };
--- a/pkgs/by-name/ha/halloy/package.nix
+++ b/pkgs/by-name/ha/halloy/package.nix
@@ -101,7 +101,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    mkdir -p "$APP_DIR/MacOS"
    cp -r ${finalAttrs.src}/assets/macos/Halloy.app/Contents/* "$APP_DIR"

-    substituteInPlace "$APP_DIR/Info.plist" \
+    substitute \
+      "${finalAttrs.src}/assets/macos/Info.plist.in" \
+      "$APP_DIR/Info.plist" \
      --replace-fail "{{ VERSION }}" "${finalAttrs.version}" \
      --replace-fail "{{ BUILD }}" "${finalAttrs.version}-nixpkgs"

--- a/pkgs/by-name/ha/harmonoid/package.nix
+++ b/pkgs/by-name/ha/harmonoid/package.nix
@@ -95,7 +95,8 @@ stdenv.mkDerivation (finalAttrs: {
      "aarch64-linux"
      "aarch64-darwin"
    ];
-    license = {
+    license = lib.licenses.mkLicense {
+      shortName = "polyFormStrict100";
      fullName = "PolyForm Strict License 1.0.0";
      url = "https://polyformproject.org/licenses/strict/1.0.0/";
      free = false;
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -2,6 +2,8 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
+  installShellFiles,
+  stdenv,
  nix-update-script,
  versionCheckHook,
  vscode-extensions,
@@ -32,6 +34,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "--package=harper-ls"
  ];

+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd harper-cli \
+      --bash <($out/bin/harper-cli completion bash) \
+      --fish <($out/bin/harper-cli completion fish) \
+      --zsh <($out/bin/harper-cli completion zsh)
+  '';
+
  passthru = {
    tests.vscode = vscode-extensions.elijah-potter.harper;
    updateScript = nix-update-script {
--- a/pkgs/by-name/hc/hcloud/package.nix
+++ b/pkgs/by-name/hc/hcloud/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "hcloud";
-  version = "1.69.0";
+  version = "1.70.0";

  src = fetchFromGitHub {
    owner = "hetznercloud";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YsfG24cbUXBred1hKZolQcUYaFCCOR2swELwiSfUheg=";
+    hash = "sha256-aPp8Yso/jURZbm4iKkdEcNqrrqK5SrTg6g7v12KPHGo=";
  };

-  vendorHash = "sha256-2vEcJr0aHLTQFIb6gsutbZfQH+u+Ed/IP9Tdqqmspuk=";
+  vendorHash = "sha256-JruFGjUz+8ecnHBc6Z19GYD/86CBrTijFSWQgVq1Hhc=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/he/heroic-unwrapped/fix-non-steam-shortcuts.patch
+++ b/pkgs/by-name/he/heroic-unwrapped/fix-non-steam-shortcuts.patch
@@ -0,0 +1,18 @@
+diff --git a/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts b/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts
+index 41730f1..495282b 100644
+--- a/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts
+++ b/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts
+@@ -326,11 +326,8 @@ async function buildShortcutEntryConfig(gameInfo: GameInfo): Promise<{
+     // parameters out). The best we can do here is search for an
+     // `heroic` wrapper executable (which these types of packages make
+     // available) and launch it
+-    const heroicWrapper = await searchForExecutableOnPath('heroic')
+-    if (heroicWrapper) {
+-      exe = `"${heroicWrapper}"`
+-      startDir = `"${dirname(heroicWrapper)}"`
+-    }
+    exe = `"heroic"`
+    startDir = `"${userHome}"`
+   }
+ 
+   if (isFlatpak) {
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@@ -59,6 +59,11 @@ stdenv.mkDerivation (finalAttrs: {
    makeWrapper
  ];

+  patches = [
+    # Make Heroic create Steam shortcuts (to non-steam games) with the correct path to heroic.
+    ./fix-non-steam-shortcuts.patch
+  ];
+
  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

  buildPhase = ''
@@ -81,10 +86,10 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    mkdir -p "$out/opt/heroic"
-    cp -r dist/*-unpacked/resources "$out/opt/heroic"
+    mkdir -p "$out/share/heroic"
+    cp -r dist/*-unpacked/resources "$out/share/heroic"

-    bin_dir="$out/opt/heroic/resources/app.asar.unpacked/build/bin"
+    bin_dir="$out/share/heroic/resources/app.asar.unpacked/build/bin"

    # Clean up prebuilt binaries
    rm -r "$bin_dir"
@@ -115,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
        )
      }" \
      --add-flags --disable-gpu-compositing \
-      --add-flags $out/opt/heroic/resources/app.asar \
+      --add-flags $out/share/heroic/resources/app.asar \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"

    install -D "flatpak/com.heroicgameslauncher.hgl.desktop" "$out/share/applications/com.heroicgameslauncher.hgl.desktop"
--- a/pkgs/by-name/i1/i18next-cli/package-lock.json
+++ b/pkgs/by-name/i1/i18next-cli/package-lock.json
--- a/pkgs/by-name/i1/i18next-cli/package.nix
+++ b/pkgs/by-name/i1/i18next-cli/package.nix
@@ -6,13 +6,13 @@
 }:
 buildNpmPackage rec {
  pname = "i18next-cli";
-  version = "1.74.1";
+  version = "1.74.6";

  src = fetchFromGitHub {
    owner = "i18next";
    repo = "i18next-cli";
    tag = "v${version}";
-    hash = "sha256-Kqz4OUuqq6WzP1lZttJKYawSQ6pEpG2UjBjGu9oKa3I=";
+    hash = "sha256-+dUvJa5R5OLThpGD01SmtPuB1f6b0kDnSmSLKCHs+nA=";
  };

  # NOTE: Generating lock-file
@@ -21,7 +21,7 @@ buildNpmPackage rec {
    cp ${./package-lock.json} package-lock.json
  '';

-  npmDepsHash = "sha256-m5VMXE7ceVqZmNdAbSnjYmbkX5Fp8teCcU6iv58BNhw=";
+  npmDepsHash = "sha256-twPHPy4FWwwr/irl5bXI6wnN/3+Y8F76p0NQ2nN3s5c=";

  passthru.updateScript = nix-update-script {
    extraArgs = [ "--generate-lockfile" ];
--- a/pkgs/by-name/id/idnkit/package.nix
+++ b/pkgs/by-name/id/idnkit/package.nix
@@ -23,7 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    homepage = "https://jprs.co.jp/idn/index-e.html";
    description = "Provides functionalities about i18n domain name processing";
-    license = {
+    license = lib.licenses.mkLicense {
+      shortName = "oscl11";
      fullName = "Open Source Code License version 1.1";
      url = "https://jprs.co.jp/idn/idnkit2-OSCL.txt";
    };
--- a/pkgs/by-name/in/inngest/package.nix
+++ b/pkgs/by-name/in/inngest/package.nix
@@ -10,14 +10,14 @@
  testers,
 }:
 let
-  version = "1.43.0";
+  version = "1.45.1";
  websiteRev = "159c0ac611e85ec85ffe0a8c8bf2c4a0330bdb38";

  src = fetchFromGitHub {
    owner = "inngest";
    repo = "inngest";
    tag = "v${version}";
-    hash = "sha256-4/xKqjSeRV11kGi7MJFCRmm3+86vxmzj9QEQD144KJk=";
+    hash = "sha256-HdQHZb1JSPBe4zRbRSj4C2EtH91RUqZZxFHZpk5GRno=";
  };

  website = fetchFromGitHub {
@@ -42,7 +42,7 @@ let
      pnpm = pnpm_10;
      sourceRoot = "${finalAttrs.src.name}/ui";
      fetcherVersion = 4;
-      hash = "sha256-9Aud9JUj2C/Bow7lB+P/BgniQXJa2MVqI7TcPICgxrI=";
+      hash = "sha256-zYosPseMgRdMPB07BXwfVD3KPR+uLaltbuzxJburSr0=";
    };
    pnpmRoot = "ui";

--- a/pkgs/by-name/ja/ja2-stracciatella/package.nix
+++ b/pkgs/by-name/ja/ja2-stracciatella/package.nix
@@ -104,7 +104,8 @@ stdenv.mkDerivation rec {
    # Fails to build on x86_64-linux as of 2025-03-16 and potentially earlier
    broken = true;
    description = "Jagged Alliance 2, with community fixes";
-    license = {
+    license = lib.licenses.mkLicense {
+      shortName = "strategyFirst";
      fullName = "Strategy First Inc. Source Code License Agreement";
      url = "https://github.com/ja2-stracciatella/ja2-stracciatella/blob/master/SFI%20Source%20Code%20license%20agreement.txt";
      free = false;
--- a/pkgs/by-name/ja/jarl/package.nix
+++ b/pkgs/by-name/ja/jarl/package.nix
@@ -1,21 +1,21 @@
 {
  lib,
+  stdenv,
  rustPlatform,
  fetchFromGitHub,
  git,
-  versionCheckHook,
-  nix-update-script,
+  installShellFiles,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "jarl";
-  version = "0.5.0";
+  version = "0.6.0-unstable-2026-08-30"; # TODO revert unstable with next version

  src = fetchFromGitHub {
    owner = "etiennebacher";
    repo = "jarl";
-    tag = finalAttrs.version;
-    hash = "sha256-MFP1xMNnJ9mfHuUu6hqE9B7nRgI2HfXBpblo3sFnAwo=";
+    rev = "0abcc17f335010419fa9cae463d746ad1343477e";
+    hash = "sha256-zUOCHL/AKDzOmWbnpP6BccEJ+tmtRvI1vQ+T/sCnXvY=";
  };

  postPatch = ''
@@ -25,10 +25,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
                   '(?:/nix)?/(?:build)/(?:nix[\-0-9]+/)?'
  '';

-  cargoHash = "sha256-Rhv9Wku/bRl28nrXYof+6VAgl2K4ysILRQa1v19r0pU=";
+  cargoHash = "sha256-TnpkGOs8/IFJ1trzMijOTmX3BR2P3GsBhyv0GVCwHsc=";

  # integrations test require git at build time (jarl >= 0.5.0)
-  nativeBuildInputs = [ git ];
+  nativeBuildInputs = [
+    git
+    installShellFiles
+  ];

  # Don't run integration_tests for jarl-lsp, because it doesn't see
  # the CARGO_BIN_EXE_jarl env var even if exported in preCheck
@@ -40,16 +43,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
    # "--test integration_tests"
  ];

-  nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
  doInstallCheck = true;

+  # TODO: Upstream also provides Elvish and PowerShell completions,
+  # but `installShellCompletion` only has support for Bash, Zsh and Fish at the moment.
  postInstall = ''
    rm $out/bin/xtask_codegen
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd jarl \
+      --bash <(COMPLETE=bash $out/bin/jarl) \
+      --fish <(COMPLETE=fish $out/bin/jarl) \
+      --zsh <(COMPLETE=zsh $out/bin/jarl) \
  '';

-  passthru.updateScript = nix-update-script { };
-
  meta = {
    description = "Just another R linter";
    homepage = "https://jarl.etiennebacher.com";
--- a/pkgs/by-name/jp/jpsxdec/package.nix
+++ b/pkgs/by-name/jp/jpsxdec/package.nix
@@ -71,7 +71,8 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/m35/jpsxdec/blob/${finalAttrs.src.rev}/jpsxdec/doc/CHANGES.txt";
    description = "Cross-platform PlayStation 1 audio and video converter";
    homepage = "https://jpsxdec.blogspot.com/";
-    license = {
+    license = lib.licenses.mkLicense {
+      shortName = "jpsxdec";
      url = "https://raw.githubusercontent.com/m35/jpsxdec/${finalAttrs.src.rev}/.github/LICENSE.md";
      free = true;
    };
--- a/pkgs/by-name/ka/kache/package.nix
+++ b/pkgs/by-name/ka/kache/package.nix
@@ -0,0 +1,73 @@
+{
+  cacert,
+  fetchFromGitHub,
+  lib,
+  rustPlatform,
+  stdenv,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "kache";
+  version = "1.0.0";
+  __structuredAttrs = true;
+
+  outputs = [ "out" ] ++ lib.optional stdenv.hostPlatform.isUnix "shims";
+
+  src = fetchFromGitHub {
+    owner = "kunobi-ninja";
+    repo = "kache";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Kbww7mmdUAASh1sbjdoqoosSA76EALJata+Aa8SJUnE=";
+  };
+
+  cargoHash = "sha256-/qpQMj48/wp+Ui8OWpdCdqptv1ON/xLLdslVmumZhIY=";
+
+  nativeCheckInputs = [ cacert ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  cargoBuildFlags = [
+    "-p"
+    "kache"
+  ];
+  cargoTestFlags = [
+    "-p"
+    "kache"
+    "--bins" # exclude integration tests
+  ];
+
+  checkFlags =
+    lib.optionals stdenv.hostPlatform.isLinux [
+      # This test assumes reads update access times, which fails on noatime filesystems.
+      "--skip=unit_prune::tests::probes_whether_reads_move_an_armed_access_time"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # The tmutil xattr test shells out to /usr/bin/tmutil which isn't in the sandbox.
+      "--skip=store::tests::test_exclude_from_indexing_sets_tmutil_xattr"
+      # Nix's sandbox rejects sandbox_apply for these nested sandbox fixtures.
+      # The regular macOS CI job runs both against real allowed/denied processes.
+      "--skip=fallback::macos::tests::policy_distinguishes_denied_and_allowed_output"
+      "--skip=sandbox_preflight_bypasses_denied_server_but_keeps_allowed_server"
+    ];
+
+  doInstallCheck = true;
+
+  # planner_client / remote_backend tests bind 127.0.0.1
+  __darwinAllowLocalNetworking = true;
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isUnix ''
+    mkdir -p "$shims/bin"
+    for name in cc c++ gcc g++ clang clang++; do
+      ln -s "$out/bin/kache" "$shims/bin/$name"
+    done
+    # Let another kache on PATH recognize and skip this shim directory.
+    touch "$shims/bin/.kache-shims"
+  '';
+
+  meta = {
+    description = "Zero-copy, content-addressed build cache for Rust, C/C++ and more";
+    homepage = "https://github.com/kunobi-ninja/kache";
+    license = lib.licenses.asl20;
+    mainProgram = "kache";
+    maintainers = with lib.maintainers; [ stefanboca ];
+  };
+})
--- a/pkgs/by-name/ka/kakoune-lsp/package.nix
+++ b/pkgs/by-name/ka/kakoune-lsp/package.nix
@@ -8,18 +8,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "kakoune-lsp";
-  version = "21.0.2";
+  version = "22.0.0";

  src = fetchFromGitHub {
    owner = "kakoune-lsp";
    repo = "kakoune-lsp";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-nY/DOXE7youb/xpUU7T0t23vSMrGqlEa6qs5tclDE88=";
+    hash = "sha256-G4L9FOS097U7pLpYTnsUF0FK7UjQ9oQRTtH0ifsL5Ks=";
  };

  patches = [ (replaceVars ./Hardcode-perl.patch { inherit perl; }) ];

-  cargoHash = "sha256-1ktWlguBYURqIEotG9D4953bJm0TMM7+BzufFqXUibk=";
+  cargoHash = "sha256-QL2uE0hZtrZFJm3KpnTDXACjPY4gNefP76QjD0ZOLMo=";

  meta = {
    description = "Kakoune Language Server Protocol Client";
--- a/pkgs/by-name/ku/kubeone/package.nix
+++ b/pkgs/by-name/ku/kubeone/package.nix
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "kubeone";
-  version = "1.14.3";
+  version = "1.14.4";

  src = fetchFromGitHub {
    owner = "kubermatic";
    repo = "kubeone";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-JQK3t+3zvWKyEusL1V0e22rSg00dLwm98xa4Q+bwomo=";
+    hash = "sha256-mZCTz8Cuay8hvSh5344gRZalDQWhPGsioc08/sZgaBE=";
  };

-  vendorHash = "sha256-wjYwVm5hX58xQvb173Ma6iE9VzMy1hwu7R2TRTHoJXo=";
+  vendorHash = "sha256-bcCZ5u77bpisP6All2D5bvvVIEaQjB3SBqSWy9iFQLY=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ku/kubeseal/package.nix
+++ b/pkgs/by-name/ku/kubeseal/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "kubeseal";
-  version = "0.39.1";
+  version = "0.40.0";

  src = fetchFromGitHub {
    owner = "bitnami";
    repo = "sealed-secrets";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vmvKD6Rk/xCw0hpGmus9JOG2JBStqzTSl09QGYMcOjQ=";
+    hash = "sha256-lhN9rIi6C3+fVnh2cv11sVYG5uxpJAIWOemyde8Xkb4=";
  };

-  vendorHash = "sha256-JzBl9jOGYstoimv8bdy2t1DSvchFMl73zdxeY1Vagog=";
+  vendorHash = "sha256-6+SKSChuU+JZzCcPVeiQ6VhF/bCVwv2Uo4+7+h8aZVs=";

  subPackages = [ "cmd/kubeseal" ];

--- a/pkgs/by-name/li/libreswan/package.nix
+++ b/pkgs/by-name/li/libreswan/package.nix
@@ -51,11 +51,11 @@ in

 stdenv.mkDerivation rec {
  pname = "libreswan";
-  version = "5.4";
+  version = "5.4.1";

  src = fetchurl {
    url = "https://download.libreswan.org/libreswan-${version}.tar.gz";
-    hash = "sha256-0mNAz2JTFsyRJ+BbOSIUokoQiJ9PHZlAwupkurcQqFU=";
+    hash = "sha256-ew+Qyag7OtlrQw2FSVB062JlmQJMlzeJwbC2z/Ay7hA=";
  };

  strictDeps = true;
--- a/pkgs/by-name/li/libretroPackages/cores/fuse.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/fuse.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fuse";
-  version = "0-unstable-2026-09-06";
+  version = "0-unstable-2026-09-26";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "fuse-libretro";
-    rev = "958105a90ad2b5825ad002ba563cc3f9f879d763";
-    hash = "sha256-pJbknBsJRlpNujefW6Oll7Dd1khnOyS0cZeNeiIUb4g=";
+    rev = "e997e2bc32c888348f862f69f2c53babfedf7791";
+    hash = "sha256-QAHWuyqmlAvzDzJL6qEvTlCfzltbFPZf/XPCvo/TTcE=";
  };

  meta = {
--- a/pkgs/by-name/li/linien-gui/package.nix
+++ b/pkgs/by-name/li/linien-gui/package.nix
@@ -1,26 +1,18 @@
 {
  lib,
-  python3,
+  python3Packages,
  qt5,
 }:

-let
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      numpy = super.numpy_1;
-    };
-  };
-in
-python.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "linien-gui";
  pyproject = true;

-  inherit (python.pkgs.linien-common) src version;
+  inherit (python3Packages.linien-common) src version;

  sourceRoot = "${src.name}/linien-gui";

-  build-system = with python.pkgs; [
+  build-system = with python3Packages; [
    setuptools
  ];
  nativeBuildInputs = [
@@ -33,7 +25,7 @@ python.pkgs.buildPythonApplication rec {
    qt5.qtwayland
  ];

-  dependencies = with python.pkgs; [
+  dependencies = with python3Packages; [
    appdirs
    click
    pyqtgraph
@@ -49,12 +41,6 @@ python.pkgs.buildPythonApplication rec {
    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
  '';

-  passthru = {
-    # Useful for creating .withPackages environments, see NOTE near
-    # `python3Packages.linien-common.meta.broken`.
-    inherit python;
-  };
-
  meta = {
    description = "Graphical user interface of the Linien spectroscopy lock application";
    mainProgram = "linien";
--- a/pkgs/by-name/li/links2/gcc-16.patch
+++ b/pkgs/by-name/li/links2/gcc-16.patch
@@ -0,0 +1,19 @@
+Description: Fix FTBFS with GCC 16
+Bug-Debian: https://bugs.debian.org/1128763
+Origin: vendor, https://src.fedoraproject.org/rpms/links/c/e1c0e9e73ba04d2512ea9307750bf0081f8379b7
+Author: Filipe Rosset <rosset.filipe@gmail.com>
+Last-Update: 2026-03-24
+
+--- a/ftp.c
+++ b/ftp.c
+@@ -768,7 +768,8 @@
+ } while (0)
+ 		A(ftp_head);
+ 		ud = stracpy(get_url_data(c->url));
+-		if (strchr(cast_const_char ud, POST_CHAR)) *strchr(cast_const_char ud, POST_CHAR) = 0;
+		char *p;
+		if ((p = (char *)strchr(cast_const_char ud, POST_CHAR))) *p = 0;
+ 		s0 = init_str();
+ 		s0l = 0;
+ 		add_conv_str(&s0, &s0l, ud, (int)strlen(cast_const_char ud), -1);
+
--- a/pkgs/by-name/li/links2/package.nix
+++ b/pkgs/by-name/li/links2/package.nix
@@ -57,6 +57,8 @@ stdenv.mkDerivation (finalAttrs: {
    bzip2
  ];

+  patches = [ ./gcc-16.patch ];
+
  configureFlags = [
    "--with-ssl"
  ]
@@ -76,6 +78,5 @@ stdenv.mkDerivation (finalAttrs: {
    mainProgram = "links";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.unix;
-    broken = true;
  };
 })
--- a/pkgs/by-name/li/livekit/package.nix
+++ b/pkgs/by-name/li/livekit/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "livekit";
-  version = "1.13.7";
+  version = "1.13.8";

  src = fetchFromGitHub {
    owner = "livekit";
    repo = "livekit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-1nV2xhfG1axCw2kgMUdxeKe4cL0fU3GDwMyaMF8N2QA=";
+    hash = "sha256-h8hFRBRpP7RHfZIxTHzfP0F0qq02q0Fiz/Wk8pNHvtM=";
  };

-  vendorHash = "sha256-mQ8mmZP/2KoA/LDcMeLBhsION+24DYj3ld/+5n+fwCU=";
+  vendorHash = "sha256-HdetQI/c3h+Y/bXDM98yoryzqAZQZuDA0bNFEHcPW3U=";

  subPackages = [ "cmd/server" ];

--- a/pkgs/by-name/ly/ly/package.nix
+++ b/pkgs/by-name/ly/ly/package.nix
@@ -8,21 +8,21 @@
  stdenv,
  versionCheckHook,
  x11Support ? true,
-  zig_0_16,
+  zig_0_17,
  nix-update-script,
 }:
 let
-  zig = zig_0_16;
+  zig = zig_0_17;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ly";
-  version = "1.4.1";
+  version = "1.5.0";

  src = fetchFromCodeberg {
    owner = "fairyglade";
    repo = "ly";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FiHSUqAxJurlQuXEkpglWrd2tCqKZuucB4mipFGI4II=";
+    hash = "sha256-inrfs8c9ga1IJM1xm6KVxWpp2iubHSGpEM5s5hyJdcE=";
  };

  nativeBuildInputs = [
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
  zigDeps = zig.fetchDeps {
    inherit (finalAttrs) src pname version;
    fetchAll = true;
-    hash = "sha256-ZTGQhsDTpWfG4giM0WsfCjlDVr4htC6WWBpSGyKZUr0=";
+    hash = "sha256-ZaWJuJkQyx5eQlwOVmdz3BCrYddDNmKnP7QVYARSFp8=";
  };

  postConfigure = ''
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`{ git, ... }@args: git.override ({ svnSupport = true; } // removeAttrs args [ "git" ])`