From c6567abbf1cbb10c28c86e6c4d41ace920c58c68 Mon Sep 17 00:00:00 2001
From: Yiyu Zhou <yiyuzhou19@gmail.com>
Date: Sun, 9 Nov 2025 20:05:06 -0800
Subject: [PATCH 001/551] aroccPackages.latest-unwrapped: 0-unstable-2025-03-05
 -> 0-unstable-2025-11-09

---
 pkgs/development/compilers/arocc/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/compilers/arocc/default.nix b/pkgs/development/compilers/arocc/default.nix
index 2372e60c421d..47bb659cbde6 100644
--- a/pkgs/development/compilers/arocc/default.nix
+++ b/pkgs/development/compilers/arocc/default.nix
@@ -2,18 +2,18 @@
   lib,
   fetchFromGitHub,
   callPackage,
-  zig_0_14,
+  zig,
 }:
 let
   versions = [
     {
-      zig = zig_0_14;
-      version = "0-unstable-2025-03-05";
+      inherit zig;
+      version = "0-unstable-2025-11-09";
       src = fetchFromGitHub {
         owner = "Vexu";
         repo = "arocc";
-        rev = "8c6bab43ba351fc045a1d262d8a8da4a11215e37";
-        hash = "sha256-J5Cj9UMwAMwH2JGby13FIKl5Qbj4N4XpSSY7zL21aoY=";
+        rev = "3fb778c201718bd82bf1f08cd46ea133c4697b76";
+        hash = "sha256-Hac+rhf7wB3KTs2OIfdcGVq2+H/81yXMl3cq//LUeRk=";
       };
     }
   ];

From bf1ac8a0a52e5b946181a1a7c3dc6ec37842d3ff Mon Sep 17 00:00:00 2001
From: Oliver Davies <oliver@oliverdavies.uk>
Date: Sat, 3 Jan 2026 00:21:13 +0000
Subject: [PATCH 002/551] maintainers: add opdavies

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 6d0c3f8174b3..0f3973e2eef9 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -19757,6 +19757,12 @@
     name = "Oops418";
     githubId = 93655215;
   };
+  opdavies = {
+    email = "oliver+github@oliverdavies.uk";
+    github = "opdavies";
+    githubId = 339813;
+    name = "Oliver Davies";
+  };
   opeik = {
     email = "sandro@stikic.com";
     github = "opeik";

From 57410aee82a312b091f6c41c5044b13bd1baea65 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 23 Feb 2026 00:38:15 +0000
Subject: [PATCH 003/551] rdfind: 1.7.0 -> 1.8.0

---
 pkgs/by-name/rd/rdfind/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/rd/rdfind/package.nix b/pkgs/by-name/rd/rdfind/package.nix
index 107fc932af99..12c771fef7aa 100644
--- a/pkgs/by-name/rd/rdfind/package.nix
+++ b/pkgs/by-name/rd/rdfind/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdfind";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchurl {
     url = "https://rdfind.pauldreik.se/rdfind-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-eMRjFS4dnk/Rv+uDuckt9ef8TF+Tx9Qm+x9++ivk3yk=";
+    sha256 = "sha256-Ci0NMgAswtwBNO57ZJvMgR7PsvjZ9nKqR2qFEVLnrzU=";
   };
 
   buildInputs = [ nettle ];

From 7ddead5bd25692179e80f558a8d4cf6dd01ea063 Mon Sep 17 00:00:00 2001
From: Teddy Ni <3806110+tjni@users.noreply.github.com>
Date: Mon, 18 May 2026 21:40:08 -0700
Subject: [PATCH 004/551] python3Packages.geoip2: allow local networking on
 Darwin

Assisted-by: Codex (GPT-5.5)
---
 pkgs/development/python-modules/geoip2/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/geoip2/default.nix b/pkgs/development/python-modules/geoip2/default.nix
index b90d1c34edb5..d6dd6a5e6f2a 100644
--- a/pkgs/development/python-modules/geoip2/default.nix
+++ b/pkgs/development/python-modules/geoip2/default.nix
@@ -50,6 +50,8 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "geoip2" ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "GeoIP2 webservice client and database reader";
     homepage = "https://github.com/maxmind/GeoIP2-python";

From ddc2a75716e6d70da10aca91771f2dd66057cf5c Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Fri, 22 May 2026 02:27:36 +0300
Subject: [PATCH 005/551] python3Packages.unicodedata2: modernize and migrate
 to pyproject

---
 .../python-modules/unicodedata2/default.nix         | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/unicodedata2/default.nix b/pkgs/development/python-modules/unicodedata2/default.nix
index d4a809922cab..cdff4b2fc877 100644
--- a/pkgs/development/python-modules/unicodedata2/default.nix
+++ b/pkgs/development/python-modules/unicodedata2/default.nix
@@ -3,18 +3,21 @@
   buildPythonPackage,
   fetchPypi,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "unicodedata2";
   version = "17.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit version pname;
+    inherit (finalAttrs) version pname;
     sha256 = "sha256-15lD0VP19r++P1Wl7GEZhRhL2jf87bPsx1Mi2CrmrTs=";
   };
 
+  build-system = [ setuptools ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "unicodedata2" ];
@@ -22,8 +25,8 @@ buildPythonPackage rec {
   meta = {
     description = "Backport and updates for the unicodedata module";
     homepage = "https://github.com/mikekap/unicodedata2";
-    changelog = "https://github.com/fonttools/unicodedata2/releases/tag/${version}";
+    changelog = "https://github.com/fonttools/unicodedata2/releases/tag/${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ sternenseemann ];
   };
-}
+})

From 57a48d81f4739e7545cc0994af6a704fb4bc5ec6 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Tue, 26 May 2026 22:33:14 +0000
Subject: [PATCH 006/551] libpcap: enable RDMA for all supported platforms

---
 pkgs/by-name/li/libpcap/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libpcap/package.nix b/pkgs/by-name/li/libpcap/package.nix
index fefde4c82aa9..5abab91f1a89 100644
--- a/pkgs/by-name/li/libpcap/package.nix
+++ b/pkgs/by-name/li/libpcap/package.nix
@@ -12,7 +12,7 @@
   pkg-config,
   rdma-core,
   withBluez ? false,
-  withRdma ? false,
+  withRdma ? lib.meta.availableOn stdenv.hostPlatform rdma-core,
   withRemote ? false,
 
   # for passthru.tests

From c346537ee0f56c1156b74eca98e86cafd91b5b2d Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Fri, 5 Jun 2026 06:19:12 +0300
Subject: [PATCH 007/551] cups: add `doc` output

out: 10920K -> 9224K
doc: 0K -> 1700K
---
 pkgs/by-name/cu/cups/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix
index dd12a5dcef57..10abd55a5977 100644
--- a/pkgs/by-name/cu/cups/package.nix
+++ b/pkgs/by-name/cu/cups/package.nix
@@ -14,7 +14,6 @@
   systemdLibs,
   acl,
   gmp,
-  darwin,
   libusb1 ? null,
   gnutls ? null,
   avahi ? null,
@@ -40,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     "lib"
     "dev"
     "man"
+    "doc"
   ];
 
   postPatch = ''

From 6f501e939a7173d4650d9028ebd4ab0ec968bbb2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 18:08:28 +0000
Subject: [PATCH 008/551] python3Packages.smg-grpc-servicer: 0.5.5 -> 0.5.6

---
 pkgs/development/python-modules/smg-grpc-servicer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/smg-grpc-servicer/default.nix b/pkgs/development/python-modules/smg-grpc-servicer/default.nix
index c367990e4103..0727201f056a 100644
--- a/pkgs/development/python-modules/smg-grpc-servicer/default.nix
+++ b/pkgs/development/python-modules/smg-grpc-servicer/default.nix
@@ -14,7 +14,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "smg-grpc-servicer";
-  version = "0.5.5";
+  version = "0.5.6";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -23,7 +23,7 @@ buildPythonPackage (finalAttrs: {
     format = "setuptools";
     pname = "smg_grpc_servicer";
     inherit (finalAttrs) version;
-    hash = "sha256-g3SCR/WjoSpxoq1a+Elvf9z+kAvb8nGgayMRMR/q4d8=";
+    hash = "sha256-uOXwaldTdomIj2fqen1bHwgAOKPIqtoSkJhSkkXRhcA=";
   };
 
   build-system = [

From 6c665fe667f08361bca4eb88450ca080809f6202 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Fri, 3 Jul 2026 16:47:18 +0000
Subject: [PATCH 009/551] python3Packages.absl-py: modernize

---
 pkgs/development/python-modules/absl-py/default.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/absl-py/default.nix b/pkgs/development/python-modules/absl-py/default.nix
index 21552b076199..c5c8f206ac2d 100644
--- a/pkgs/development/python-modules/absl-py/default.nix
+++ b/pkgs/development/python-modules/absl-py/default.nix
@@ -4,8 +4,7 @@
   fetchFromGitHub,
   hatchling,
 }:
-
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "absl-py";
   version = "2.3.1";
   pyproject = true;
@@ -13,7 +12,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "abseil";
     repo = "abseil-py";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-U8doys7SoOhtUkF0dsCFKnM9ItOoi5a6cK6zGOe/U8s=";
   };
 
@@ -27,8 +26,8 @@ buildPythonPackage rec {
   meta = {
     description = "Abseil Python Common Libraries";
     homepage = "https://github.com/abseil/abseil-py";
-    changelog = "https://github.com/abseil/abseil-py/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/abseil/abseil-py/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})

From 9a13708a730b65a7bd62869951aa9023be61fd9d Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Fri, 3 Jul 2026 16:49:02 +0000
Subject: [PATCH 010/551] python3Packages.absl-py: 2.3.1 -> 2.5.0

---
 pkgs/development/python-modules/absl-py/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/absl-py/default.nix b/pkgs/development/python-modules/absl-py/default.nix
index c5c8f206ac2d..691665b8cd61 100644
--- a/pkgs/development/python-modules/absl-py/default.nix
+++ b/pkgs/development/python-modules/absl-py/default.nix
@@ -6,14 +6,14 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "absl-py";
-  version = "2.3.1";
+  version = "2.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "abseil";
     repo = "abseil-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-U8doys7SoOhtUkF0dsCFKnM9ItOoi5a6cK6zGOe/U8s=";
+    hash = "sha256-BnR9QnZ5AaSlboQuQnX4UKGjAVVpyzMLZ68Do3VZrE0=";
   };
 
   build-system = [ hatchling ];

From 0dd4000289edecb3ca42e82a4fa79417fca87334 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 11 Jul 2026 10:48:15 +0200
Subject: [PATCH 011/551] python3Packages.dbus-python: Switch to `finalAttrs`
 pattern

It was not supported when 6ffea0de4c13c1987adec5e06f369514c1b15eb2 was introduced.
---
 .../python-modules/dbus-python/default.nix    | 132 +++++++++---------
 1 file changed, 66 insertions(+), 66 deletions(-)

diff --git a/pkgs/development/python-modules/dbus-python/default.nix b/pkgs/development/python-modules/dbus-python/default.nix
index ed518d645081..fe04c86a5a55 100644
--- a/pkgs/development/python-modules/dbus-python/default.nix
+++ b/pkgs/development/python-modules/dbus-python/default.nix
@@ -16,83 +16,83 @@
   dbus-glib,
 }:
 
-lib.fix (
-  finalPackage:
-  buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
+  pname = "dbus-python";
+  version = "1.4.0";
+  pyproject = true;
+
+  disabled = isPyPy;
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchPypi {
     pname = "dbus-python";
-    version = "1.4.0";
-    pyproject = true;
+    inherit (finalAttrs) version;
+    hash = "sha256-mRZm5Jj2Db8+Sbi3Z49VWbimUDT99hquYs3s232Jx3A=";
+  };
 
-    disabled = isPyPy;
+  patches = [
+    # reduce required dependencies
+    # https://gitlab.freedesktop.org/dbus/dbus-python/-/merge_requests/23
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/d5e19698a8d6e1485f05b67a5b2daa2392819aaf.patch";
+      hash = "sha256-Rmj/ByRLiLnIF3JsMBElJugxsG8IARcBdixLhoWgIYU=";
+    })
+  ];
 
-    outputs = [
-      "out"
-      "dev"
-    ];
+  postPatch = ''
+    # we provide patchelf natively, not through the python package
+    sed -i '/patchelf/d' pyproject.toml
 
-    src = fetchPypi {
-      inherit pname version;
-      hash = "sha256-mRZm5Jj2Db8+Sbi3Z49VWbimUDT99hquYs3s232Jx3A=";
-    };
+    patchShebangs test/*.sh
+  '';
 
-    patches = [
-      # reduce required dependencies
-      # https://gitlab.freedesktop.org/dbus/dbus-python/-/merge_requests/23
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/d5e19698a8d6e1485f05b67a5b2daa2392819aaf.patch";
-        hash = "sha256-Rmj/ByRLiLnIF3JsMBElJugxsG8IARcBdixLhoWgIYU=";
-      })
-    ];
+  nativeBuildInputs = [
+    dbus # build systems checks for `dbus-run-session` in PATH
+    meson
+    meson-python
+    pkg-config
+  ];
 
-    postPatch = ''
-      # we provide patchelf natively, not through the python package
-      sed -i '/patchelf/d' pyproject.toml
+  buildInputs = [
+    dbus
+    dbus-glib
+  ];
 
-      patchShebangs test/*.sh
-    '';
+  mesonFlags = [
+    (lib.mesonBool "tests" finalAttrs.finalPackage.doInstallCheck)
+  ];
 
-    nativeBuildInputs = [
-      dbus # build systems checks for `dbus-run-session` in PATH
-      meson
-      meson-python
-      pkg-config
-    ];
+  # workaround bug in meson-python
+  # https://github.com/mesonbuild/meson-python/issues/240
+  postInstall = ''
+    mkdir -p $dev/lib
+    mv $out/${python.sitePackages}/.dbus_python.mesonpy.libs/pkgconfig/ $dev/lib
+  '';
 
-    buildInputs = [
-      dbus
-      dbus-glib
-    ];
+  # make sure the Cflags in the pkgconfig file are correct and make the structure backwards compatible
+  postFixup = ''
+    ln -s $dev/include/*/dbus_python/dbus-1.0/ $dev/include/dbus-1.0
+  '';
 
-    mesonFlags = [ (lib.mesonBool "tests" finalPackage.doInstallCheck) ];
+  nativeCheckInputs = [ dbus.out ];
 
-    # workaround bug in meson-python
-    # https://github.com/mesonbuild/meson-python/issues/240
-    postInstall = ''
-      mkdir -p $dev/lib
-      mv $out/${python.sitePackages}/.dbus_python.mesonpy.libs/pkgconfig/ $dev/lib
-    '';
+  checkPhase = ''
+    runHook preCheck
 
-    # make sure the Cflags in the pkgconfig file are correct and make the structure backwards compatible
-    postFixup = ''
-      ln -s $dev/include/*/dbus_python/dbus-1.0/ $dev/include/dbus-1.0
-    '';
+    meson test -C build --no-rebuild --print-errorlogs --timeout-multiplier 0
 
-    nativeCheckInputs = [ dbus.out ];
+    runHook postCheck
+  '';
 
-    checkPhase = ''
-      runHook preCheck
-
-      meson test -C build --no-rebuild --print-errorlogs --timeout-multiplier 0
-
-      runHook postCheck
-    '';
-
-    meta = {
-      description = "Python DBus bindings";
-      homepage = "https://gitlab.freedesktop.org/dbus/dbus-python";
-      license = lib.licenses.mit;
-      platforms = dbus.meta.platforms;
-      maintainers = [ ];
-    };
-  }
-)
+  meta = {
+    description = "Python DBus bindings";
+    homepage = "https://gitlab.freedesktop.org/dbus/dbus-python";
+    license = lib.licenses.mit;
+    platforms = dbus.meta.platforms;
+    maintainers = [ ];
+  };
+})

From 8045ba2f61c0cf7f680d2c02059da539aa4da188 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 11 Jul 2026 02:17:02 +0200
Subject: [PATCH 012/551] python315Packages.dbus-python: Fix runtime error

Using dbus-python on Python 3.15 would fail with:

    SystemError: type _dbus_bindings.Connection has the Py_TPFLAGS_MANAGED_WEAKREF flag but not Py_TPFLAGS_HAVE_GC flag

See https://gitlab.freedesktop.org/dbus/dbus-python/-/work_items/59

This would also break tests, except we are not actually running them.
---
 pkgs/development/python-modules/dbus-python/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/python-modules/dbus-python/default.nix b/pkgs/development/python-modules/dbus-python/default.nix
index fe04c86a5a55..b17a32510ba5 100644
--- a/pkgs/development/python-modules/dbus-python/default.nix
+++ b/pkgs/development/python-modules/dbus-python/default.nix
@@ -41,6 +41,14 @@ buildPythonPackage (finalAttrs: {
       url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/d5e19698a8d6e1485f05b67a5b2daa2392819aaf.patch";
       hash = "sha256-Rmj/ByRLiLnIF3JsMBElJugxsG8IARcBdixLhoWgIYU=";
     })
+
+    # Fix on Python 3.15, the patch did not achieve what it aimed for anyway.
+    # https://gitlab.freedesktop.org/dbus/dbus-python/-/work_items/59
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/ebecd1747c382a57ad8e47d0e32112cdbd454b40.patch";
+      hash = "sha256-Hg4o+FPJvQ1/RW9fd8UJg/YEeVOvbJCov7SS7bT0vvs=";
+      revert = true;
+    })
   ];
 
   postPatch = ''

From 0e7f37444a87d3004b7ad7f6a81d606f43393576 Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Sat, 11 Jul 2026 02:03:51 +0200
Subject: [PATCH 013/551] python3Packages.dbus-python: Re-enable tests

This was missed in f2355396eafb598a817bd8d86e45832fde18221e.

`tests` option switched to `feature` type, which mapped the old `true` value to `auto`:
  https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/37c3f5a1f62bbaddbf49f28a3122bd406395d57a

Additionally, a `pygobject3` dependency has been introduced, which causes the `auto`-enabled tests to be disabled when missing:
https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/1614ee768ea45ba87d9dc7ad4db2254efe51d0fd
---
 pkgs/development/python-modules/dbus-python/default.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/dbus-python/default.nix b/pkgs/development/python-modules/dbus-python/default.nix
index b17a32510ba5..fc648cdf7d1d 100644
--- a/pkgs/development/python-modules/dbus-python/default.nix
+++ b/pkgs/development/python-modules/dbus-python/default.nix
@@ -14,6 +14,9 @@
   # native dependencies
   dbus,
   dbus-glib,
+
+  # test dependencies
+  pygobject3,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -70,8 +73,12 @@ buildPythonPackage (finalAttrs: {
     dbus-glib
   ];
 
+  checkInputs = [
+    pygobject3
+  ];
+
   mesonFlags = [
-    (lib.mesonBool "tests" finalAttrs.finalPackage.doInstallCheck)
+    (lib.mesonEnable "tests" finalAttrs.finalPackage.doInstallCheck)
   ];
 
   # workaround bug in meson-python

From 6f9dfd69ed5533ae177c8ddedc2c8e2cc1c962fb Mon Sep 17 00:00:00 2001
From: alper-han <89567766+alper-han@users.noreply.github.com>
Date: Wed, 8 Jul 2026 01:29:04 +0300
Subject: [PATCH 014/551] crossmacro-daemon: 1.2.1 -> 1.3.1

- Apply missing Native AOT optimization flags (PublishAot, StripSymbols, etc.).
- Move zlib to buildInputs to resolve cross-compilation target library linkage.
---
 pkgs/by-name/cr/crossmacro-daemon/package.nix | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cr/crossmacro-daemon/package.nix b/pkgs/by-name/cr/crossmacro-daemon/package.nix
index c19cf34e5b24..b4e69eeef038 100644
--- a/pkgs/by-name/cr/crossmacro-daemon/package.nix
+++ b/pkgs/by-name/cr/crossmacro-daemon/package.nix
@@ -14,13 +14,13 @@
 
 buildDotnetModule rec {
   pname = "crossmacro-daemon";
-  version = "1.2.1";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "alper-han";
     repo = "CrossMacro";
     tag = "v${version}";
-    hash = "sha256-lMXp7ItwpZ14ATRKuR7Q8/FhfMNQ+YCgHL13oj6iBNs=";
+    hash = "sha256-2L25A2OO2Ju6n1QlblNBtKva1PfbidFz/QESjLBVuSU=";
   };
 
   projectFile = "src/CrossMacro.Daemon/CrossMacro.Daemon.csproj";
@@ -44,7 +44,16 @@ buildDotnetModule rec {
     zlib
   ];
 
-  dotnetFlags = [ "-p:Version=${version}" ];
+  dotnetFlags = [
+    "-p:PublishAot=true"
+    "-p:PublishReadyToRun=false"
+    "-p:OptimizationPreference=Speed"
+    "-p:StripSymbols=true"
+    "-p:IlcTrimMetadata=true"
+    "-p:DebugType=None"
+    "-p:DebugSymbols=false"
+    "-p:Version=${version}"
+  ];
 
   postInstall = ''
     install -Dm644 scripts/assets/io.github.alper_han.crossmacro.policy \

From 18a0495c84a903589ff467b295ad7fd026f8568d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 16 Jul 2026 03:14:20 +0000
Subject: [PATCH 015/551] tree-sitter: 0.26.9 -> 0.26.11

---
 pkgs/by-name/tr/tree-sitter/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index 5c2f8655c625..657ec93f04f1 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -130,17 +130,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tree-sitter";
-  version = "0.26.9";
+  version = "0.26.11";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "tree-sitter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ohVhW4AEKX5VspqBePtfxbJGkjmJnNkf5ntU3RUxF+0=";
+    hash = "sha256-YXnmVM90sEH8kqgqCygpeCAyvggMIsv+oXi0SJOvMRM=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-3egxdusYHQs8PadxGZ44+VWtlTcGBrcqlWMUyUzpWnY=";
+  cargoHash = "sha256-kHDjPRhBUYlxLWYSv6cn6U1QDIWwCgHeIz2A5yCi1yo=";
 
   cargoBuildFeatures = lib.optionals wasmSupport [ "wasm" ];
 

From cbb6959f319444d74f59a3b5de20ef2e652fc603 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Mon, 2 Mar 2026 22:20:31 +0100
Subject: [PATCH 016/551] texinfo: 7.2 -> 7.3

---
 pkgs/development/tools/misc/texinfo/common.nix   | 2 +-
 pkgs/development/tools/misc/texinfo/packages.nix | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index 00dd5a5811a5..e4439dc9a487 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
   patches =
     patches
     ++ optional (
-      interactive && versionAtLeast version "7.2"
+      interactive && versionAtLeast version "7.2" && versionOlder version "7.3"
     ) ./fix-test-suite-failures-with-perl-5.42.patch
     ++ optional crossBuildTools ./cross-tools-flags.patch;
 
diff --git a/pkgs/development/tools/misc/texinfo/packages.nix b/pkgs/development/tools/misc/texinfo/packages.nix
index c7c49d788643..5208d62ffb71 100644
--- a/pkgs/development/tools/misc/texinfo/packages.nix
+++ b/pkgs/development/tools/misc/texinfo/packages.nix
@@ -66,7 +66,7 @@ let
 in
 {
   texinfo7 = buildTexinfo {
-    version = "7.2";
-    hash = "sha256-AynXeI++8RP6gsuAiJyhl6NEzg33ZG/gAJdMXXFDY6Y=";
+    version = "7.3";
+    hash = "sha256-UfdOsPUc+phzuFJk391dRuiVfslbiPD7di9j2eFkxy4=";
   };
 }

From 8faec7a14645ab696e6631426e2cc4d915ae1202 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 9 Jul 2026 21:04:28 -0400
Subject: [PATCH 017/551] git: fix darwin crashes when dealing with unicode
 filenames

---
 pkgs/by-name/gi/git/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix
index a6fe8a13efc3..3aa66809b005 100644
--- a/pkgs/by-name/gi/git/package.nix
+++ b/pkgs/by-name/gi/git/package.nix
@@ -133,6 +133,12 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://lore.kernel.org/git/20260504101429.340123-1-joerg@thalheim.io/raw";
       hash = "sha256-44EPfEJ39LjPWjqjFb52EKNaJGzYxZzJaJOis8QnazU=";
     })
+    # Fix fortify darwin crashes when dealing with unicode filenames.
+    (fetchurl {
+      name = "darwin-unicode-filename-fix.patch";
+      url = "https://lore.kernel.org/git/20260704233724.16928-1-ihar.hrachyshka@gmail.com/raw";
+      hash = "sha256-lpGz3nFKQvFDtW2TtQLx/684ECJVBLGPGqip0XEtOdU=";
+    })
   ]
   ++ lib.optionals withSsh [
     # Hard-code the ssh executable to ${pkgs.openssh}/bin/ssh instead of

From f424a73f4b9e26fe0f88e7922e6d6d04b1d663fc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Jul 2026 01:19:35 +0000
Subject: [PATCH 018/551] cryptsetup: 2.8.6 -> 2.8.7

---
 pkgs/by-name/cr/cryptsetup/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cr/cryptsetup/package.nix b/pkgs/by-name/cr/cryptsetup/package.nix
index 21ae5fc76b40..0ff0e32e1742 100644
--- a/pkgs/by-name/cr/cryptsetup/package.nix
+++ b/pkgs/by-name/cr/cryptsetup/package.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cryptsetup";
-  version = "2.8.6";
+  version = "2.8.7";
 
   outputs = [
     "bin"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor finalAttrs.version}/"
       + "cryptsetup-${finalAttrs.version}.tar.xz";
-    hash = "sha256-gAQmX9mTiF0I97Yz2+BWhR3hohAwdhOk693HQ/zO/lo=";
+    hash = "sha256-53bw04HobKYQQsRXBpSR/o4KwoZ4DHw7Hk+ZIavJYdo=";
   };
 
   patches = [

From b2a077778ebe0b3df43eef885e798cdbad8c7a38 Mon Sep 17 00:00:00 2001
From: Adriel Velazquez <AdrielVelazquez@gmail.com>
Date: Sun, 7 Jun 2026 12:02:30 -0400
Subject: [PATCH 019/551] fleet-{desktop,orbit}: init at 1.55.0

---
 pkgs/by-name/fl/fleet-desktop/package.nix     | 61 ++++++++++++++
 .../fl/fleet-orbit/0001-orbit-nixos.patch     | 81 +++++++++++++++++++
 .../0002-osqueryd-path-override.patch         | 40 +++++++++
 .../fleet-orbit/0003-osquery-log-path.patch   | 29 +++++++
 .../fl/fleet-orbit/0004-scripts-nixos.patch   | 33 ++++++++
 pkgs/by-name/fl/fleet-orbit/package.nix       | 70 ++++++++++++++++
 6 files changed, 314 insertions(+)
 create mode 100644 pkgs/by-name/fl/fleet-desktop/package.nix
 create mode 100644 pkgs/by-name/fl/fleet-orbit/0001-orbit-nixos.patch
 create mode 100644 pkgs/by-name/fl/fleet-orbit/0002-osqueryd-path-override.patch
 create mode 100644 pkgs/by-name/fl/fleet-orbit/0003-osquery-log-path.patch
 create mode 100644 pkgs/by-name/fl/fleet-orbit/0004-scripts-nixos.patch
 create mode 100644 pkgs/by-name/fl/fleet-orbit/package.nix

diff --git a/pkgs/by-name/fl/fleet-desktop/package.nix b/pkgs/by-name/fl/fleet-desktop/package.nix
new file mode 100644
index 000000000000..63e665ed0b52
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-desktop/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  buildGoModule,
+  fleet-orbit,
+  gtk3,
+  libayatana-appindicator,
+  nixosTests,
+  pkg-config,
+  versionCheckHook,
+}:
+
+buildGoModule {
+  pname = "fleet-desktop";
+  inherit (fleet-orbit) version src;
+  __structuredAttrs = true;
+
+  vendorHash = "sha256-fhACxmzJY0PEQmMbjQxlfQh5ZJ+7a4um0s8xFQq+57w=";
+
+  env.CGO_ENABLED = "1";
+
+  subPackages = [ "orbit/cmd/desktop" ];
+
+  goFlags = [ "-buildvcs=false" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${fleet-orbit.version}"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    gtk3
+    libayatana-appindicator
+  ];
+
+  postInstall = ''
+    mv "$out/bin/desktop" "$out/bin/fleet-desktop"
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.tests = {
+    inherit (nixosTests) orbit;
+  };
+
+  meta = {
+    description = "Fleet's desktop tray application";
+    homepage = "https://github.com/fleetdm/fleet";
+    changelog = "https://github.com/fleetdm/fleet/releases/tag/orbit-v${fleet-orbit.version}";
+    license = lib.licenses.mit;
+    mainProgram = "fleet-desktop";
+    maintainers = with lib.maintainers; [ adrielvelazquez ];
+    platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
+  };
+}
diff --git a/pkgs/by-name/fl/fleet-orbit/0001-orbit-nixos.patch b/pkgs/by-name/fl/fleet-orbit/0001-orbit-nixos.patch
new file mode 100644
index 000000000000..64b62718ff63
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-orbit/0001-orbit-nixos.patch
@@ -0,0 +1,81 @@
+diff --git a/orbit/pkg/scripts/exec_nonwindows.go b/orbit/pkg/scripts/exec_nonwindows.go
+index cedbd73..b16d150 100644
+--- a/orbit/pkg/scripts/exec_nonwindows.go
++++ b/orbit/pkg/scripts/exec_nonwindows.go
+@@ -6,14 +6,49 @@ import (
+ 	"context"
+ 	"os"
+ 	"os/exec"
+ 	"path/filepath"
++	"strings"
+ 	"time"
+ 
+ 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+ 	"github.com/fleetdm/fleet/v4/server/fleet"
+ )
+ 
++// patchShebang replaces common shebang paths with NixOS-style paths.
++func patchShebang(contents []byte) []byte {
++	script := string(contents)
++
++	if !strings.HasPrefix(script, "#!") {
++		return contents
++	}
++
++	firstLineEnd := strings.Index(script, "\n")
++	if firstLineEnd == -1 {
++		firstLineEnd = len(script)
++	}
++
++	shebang := script[:firstLineEnd]
++	rest := script[firstLineEnd:]
++
++	replacements := map[string]string{
++		"#!/bin/bash":        "#!/run/current-system/sw/bin/bash",
++		"#!/bin/sh":          "#!/run/current-system/sw/bin/sh",
++		"#!/bin/zsh":         "#!/run/current-system/sw/bin/zsh",
++		"#!/usr/bin/python":  "#!/run/current-system/sw/bin/python",
++		"#!/usr/bin/python3": "#!/run/current-system/sw/bin/python3",
++	}
++
++	for old, new := range replacements {
++		if strings.HasPrefix(shebang, old) {
++			shebang = new + strings.TrimPrefix(shebang, old)
++			break
++		}
++	}
++
++	return []byte(shebang + rest)
++}
++
+ func ExecCmd(ctx context.Context, scriptPath string, env []string) (output []byte, exitCode int, err error) {
+ 	// initialize to -1 in case the process never starts
+ 	exitCode = -1
+ 
+ 	contents, err := os.ReadFile(scriptPath)
+@@ -21,17 +56,25 @@ func ExecCmd(ctx context.Context, scriptPath string, env []string) (output []byt
+ 	if err != nil {
+ 		return nil, -1, ctxerr.Wrapf(ctx, err, "opening script for validation %s", scriptPath)
+ 	}
+-	directExecute, err := fleet.ValidateShebang(string(contents))
++	patchedContents := patchShebang(contents)
++	if string(patchedContents) != string(contents) {
++		err = os.WriteFile(scriptPath, patchedContents, 0o600)
++		if err != nil {
++			return nil, -1, ctxerr.Wrapf(ctx, err, "writing patched script %s", scriptPath)
++		}
++	}
++
++	directExecute, err := fleet.ValidateShebang(string(patchedContents))
+ 	if err != nil {
+ 		return nil, -1, ctxerr.Wrapf(ctx, err, "validating script %s", scriptPath)
+ 	}
+ 
+-	cmd := exec.CommandContext(ctx, "/bin/sh", scriptPath)
++	cmd := exec.CommandContext(ctx, "/run/current-system/sw/bin/sh", scriptPath)
+ 
+ 	if directExecute {
+ 		err = os.Chmod(scriptPath, 0o700) // nolint:gosec // G302
+ 		if err != nil {
+ 			return nil, -1, ctxerr.Wrapf(ctx, err, "marking script as executable %s", scriptPath)
+ 		}
diff --git a/pkgs/by-name/fl/fleet-orbit/0002-osqueryd-path-override.patch b/pkgs/by-name/fl/fleet-orbit/0002-osqueryd-path-override.patch
new file mode 100644
index 000000000000..411e96f21302
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-orbit/0002-osqueryd-path-override.patch
@@ -0,0 +1,40 @@
+diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go
+index ed6f10d..c4518fd 100644
+--- a/orbit/cmd/orbit/orbit.go
++++ b/orbit/cmd/orbit/orbit.go
+@@ -112,6 +112,16 @@ func main() {
+ 			Usage:   "Path to the Fleet server certificate chain",
+ 			EnvVars: []string{"ORBIT_FLEET_CERTIFICATE"},
+ 		},
++		&cli.StringFlag{
++			Name:    "osqueryd-path",
++			Usage:   "Override the path to the osqueryd binary",
++			EnvVars: []string{"NIX_ORBIT_OSQUERYD_PATH"},
++		},
++		&cli.StringFlag{
++			Name:    "desktop-path",
++			Usage:   "Override the path to the Fleet Desktop binary",
++			EnvVars: []string{"NIX_ORBIT_DESKTOP_PATH"},
++		},
+ 		&cli.StringFlag{
+ 			Name:    "fleet-desktop-alternative-browser-host",
+ 			Usage:   "Alternative host:port to use for Fleet Desktop in the browser (this may be required when using TLS client authentication in the Fleet server)",
+@@ -623,7 +633,17 @@ func orbitAction(c *cli.Context) error {
+ 	var updater *update.Updater
+ 	var updateRunner *update.Runner
+ 	var osqueryVersion string
+-	if !c.Bool("disable-updates") || c.Bool("dev-mode") {
++	if override := c.String("osqueryd-path"); override != "" {
++		log.Info().Msgf("Overriding osqueryd path: %s", override)
++		osquerydPath = override
++	}
++	if override := c.String("desktop-path"); override != "" {
++		log.Info().Msgf("Overriding Fleet Desktop path: %s", override)
++		desktopPath = override
++	}
++	if osquerydPath != "" && (!c.Bool("fleet-desktop") || desktopPath != "") {
++		log.Info().Msg("Using externally supplied component paths")
++	} else if !c.Bool("disable-updates") || c.Bool("dev-mode") {
+ 		updater, err := update.NewUpdater(opt)
+ 		if err != nil {
+ 			return fmt.Errorf("create updater: %w", err)
diff --git a/pkgs/by-name/fl/fleet-orbit/0003-osquery-log-path.patch b/pkgs/by-name/fl/fleet-orbit/0003-osquery-log-path.patch
new file mode 100644
index 000000000000..a57f3d7f017d
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-orbit/0003-osquery-log-path.patch
@@ -0,0 +1,29 @@
+diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go
+index ed6f10d..54af34b 100644
+--- a/orbit/cmd/orbit/orbit.go
++++ b/orbit/cmd/orbit/orbit.go
+@@ -242,6 +242,11 @@ func main() {
+ 			Usage:   "Sets a custom osquery database directory, it must be an absolute path",
+ 			EnvVars: []string{"ORBIT_OSQUERY_DB"},
+ 		},
++		&cli.StringFlag{
++			Name:    "osquery-log-path",
++			Usage:   "Path to osquery log file",
++			EnvVars: []string{"NIX_ORBIT_OSQUERY_LOG_PATH"},
++		},
+ 		&cli.BoolFlag{
+ 			Name:    "fleet-managed-host-identity-certificate",
+ 			Usage:   "Configures fleetd to use TPM-backed key to sign HTTP requests. This functionality is licensed under the Fleet EE License. Usage requires a current Fleet EE subscription.",
+@@ -862,7 +867,11 @@ func orbitAction(c *cli.Context) error {
+ 		optionsAfterFlagfile []osquery.Option
+ 	)
+ 	options = append(options, osquery.WithDataPath(c.String("root-dir"), ""))
+-	options = append(options, osquery.WithLogPath(filepath.Join(c.String("root-dir"), "osquery_log")))
++	osqueryLogPath := c.String("osquery-log-path")
++	if osqueryLogPath == "" {
++		osqueryLogPath = filepath.Join(c.String("root-dir"), "osquery_log")
++	}
++	options = append(options, osquery.WithLogPath(osqueryLogPath))
+ 	optionsAfterFlagfile = append(optionsAfterFlagfile, osquery.WithFlags(
+ 		[]string{"--database_path", osqueryDB},
+ 	))
diff --git a/pkgs/by-name/fl/fleet-orbit/0004-scripts-nixos.patch b/pkgs/by-name/fl/fleet-orbit/0004-scripts-nixos.patch
new file mode 100644
index 000000000000..fbcff826ca1d
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-orbit/0004-scripts-nixos.patch
@@ -0,0 +1,33 @@
+diff --git a/server/fleet/scripts.go b/server/fleet/scripts.go
+index 4ae230e..930a520 100644
+--- a/server/fleet/scripts.go
++++ b/server/fleet/scripts.go
+@@ -387,8 +387,8 @@ const (
+ // anchored, so that it matches to the end of the line
+ var (
+ 	scriptHashbangValidation       = regexp.MustCompile(`^#!\s*(:?/usr)?/bin/(ba|z)?sh(?:\s*|\s+.*)$`)
+-	ErrUnsupportedInterpreter      = errors.New(`Interpreter not supported. Supported interpreters are "#!/bin/sh", "#!/bin/bash", "#!/bin/zsh", "#!/usr/bin/env python3", or an absolute path to "python" / "python3".`)
+-	ErrUnsupportedShellInterpreter = errors.New(`Interpreter not supported. Shell scripts must run in "#!/bin/sh", "#!/bin/bash", or "#!/bin/zsh."`)
++	ErrUnsupportedInterpreter      = errors.New(`Interpreter not supported. Supported interpreters are "#!/bin/sh", "#!/bin/bash", "#!/bin/zsh", "#!/run/current-system/sw/bin/sh", "#!/run/current-system/sw/bin/bash", "#!/run/current-system/sw/bin/zsh", "#!/usr/bin/env sh", "#!/usr/bin/env bash", "#!/usr/bin/env zsh", "#!/usr/bin/env python3", or an absolute path to "python" / "python3".`)
++	ErrUnsupportedShellInterpreter = errors.New(`Interpreter not supported. Shell scripts must run in "#!/bin/sh", "#!/bin/bash", "#!/bin/zsh", "#!/run/current-system/sw/bin/sh", "#!/run/current-system/sw/bin/bash", "#!/run/current-system/sw/bin/zsh", or their "/usr/bin/env" equivalents.`)
+ )
+ 
+ type ShebangKind int
+@@ -454,7 +454,7 @@ func shebangInfo(contents string) (kind shebangKind, directExecute bool, err err
+ 	// Support env-based shebangs like "#!/usr/bin/env python3"
+ 	if base == "env" {
+ 		// Require env to be in /bin or /usr/bin (common, predictable locations)
+-		if !strings.HasPrefix(interp, "/bin/") && !strings.HasPrefix(interp, "/usr/bin/") {
++		if !strings.HasPrefix(interp, "/bin/") && !strings.HasPrefix(interp, "/usr/bin/") && !strings.HasPrefix(interp, "/run/current-system/sw/bin/") {
+ 			return shebangNone, false, ErrUnsupportedInterpreter
+ 		}
+ 
+@@ -486,7 +486,7 @@ func shebangInfo(contents string) (kind shebangKind, directExecute bool, err err
+ 
+ 	switch {
+ 	case base == "sh" || base == "bash" || base == "zsh":
+-		if !strings.HasPrefix(interp, "/bin/") && !strings.HasPrefix(interp, "/usr/bin/") {
++		if !strings.HasPrefix(interp, "/bin/") && !strings.HasPrefix(interp, "/usr/bin/") && !strings.HasPrefix(interp, "/run/current-system/sw/bin/") {
+ 			return shebangNone, false, ErrUnsupportedInterpreter
+ 		}
+ 		return shebangShell, true, nil
diff --git a/pkgs/by-name/fl/fleet-orbit/package.nix b/pkgs/by-name/fl/fleet-orbit/package.nix
new file mode 100644
index 000000000000..0404c214a29a
--- /dev/null
+++ b/pkgs/by-name/fl/fleet-orbit/package.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nixosTests,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "fleet-orbit";
+  version = "1.55.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "fleetdm";
+    repo = "fleet";
+    tag = "orbit-v${finalAttrs.version}";
+    hash = "sha256-gaS6A9Zfpb/VMQMAO5qI0lIaohD8jj4KWFRTU0OeqMo=";
+  };
+
+  vendorHash = "sha256-fhACxmzJY0PEQmMbjQxlfQh5ZJ+7a4um0s8xFQq+57w=";
+
+  env.CGO_ENABLED = "1";
+
+  subPackages = [ "orbit/cmd/orbit" ];
+
+  goFlags = [ "-buildvcs=false" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/fleetdm/fleet/v4/orbit/pkg/build.Version=${finalAttrs.version}"
+    "-X=github.com/fleetdm/fleet/v4/orbit/pkg/build.Commit=0000000000000000000000000000000000000000"
+    "-X=github.com/fleetdm/fleet/v4/orbit/pkg/build.Date=1970-01-01T00:00:00Z"
+  ];
+
+  patches = [
+    ./0001-orbit-nixos.patch
+    ./0002-osqueryd-path-override.patch
+    ./0003-osquery-log-path.patch
+    ./0004-scripts-nixos.patch
+  ];
+
+  doInstallCheck = true;
+  versionCheckProgramArg = "version";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.tests = {
+    inherit (nixosTests) orbit;
+  };
+
+  meta = {
+    description = "Fleet's lightweight osquery manager";
+    homepage = "https://github.com/fleetdm/fleet";
+    changelog = "https://github.com/fleetdm/fleet/releases/tag/orbit-v${finalAttrs.version}";
+    license = with lib.licenses; [
+      mit
+      {
+        shortName = "fleet-ee";
+        fullName = "Fleet Enterprise Edition License";
+        url = "https://github.com/fleetdm/fleet/blob/orbit-v${finalAttrs.version}/ee/LICENSE";
+        free = false;
+      }
+    ];
+    mainProgram = "orbit";
+    maintainers = with lib.maintainers; [ adrielvelazquez ];
+    platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
+  };
+})

From 5f2b39c55e6db61debb484b3e9c7ab568d308651 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Wed, 24 Jun 2026 15:26:05 -0400
Subject: [PATCH 020/551] webkitgtk_{4_1,6_0}: drop unused libidn dependency

This dependency was introduced in
https://github.com/NixOS/nixpkgs/commit/3fa62094395bd89e7978f224eec2e31729fc26e5
in 2017. It appears to be unused, with the only reference in the WebKit
source tree being in
`Source/ThirdParty/libwebrtc/Source/third_party/yasm/ABOUT-NLS`. We are
having some difficulty tracing why it was added at all, so we are not
100% sure this is correct, but `webkitgtk_6_0` still builds with this.
---
 pkgs/development/libraries/webkitgtk/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index eab3b229eda7..43d215a9ac97 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -42,7 +42,6 @@
   nettle,
   libtasn1,
   p11-kit,
-  libidn,
   libedit,
   readline,
   libGL,
@@ -160,7 +159,6 @@ clangStdenv.mkDerivation (finalAttrs: {
     libgbm
     libgcrypt
     libgpg-error
-    libidn
     libintl
     lcms2
     libpthread-stubs

From 15ee69f741133a6ffe57d1963917ac30c9ece52c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9C=E5=9D=82=E9=9B=85?=
 <23130178+ShadowRZ@users.noreply.github.com>
Date: Fri, 24 Jul 2026 13:23:52 +0800
Subject: [PATCH 021/551] mjpegtools: disable building gtk2 programs

---
 pkgs/by-name/mj/mjpegtools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mj/mjpegtools/package.nix b/pkgs/by-name/mj/mjpegtools/package.nix
index 157948c85891..fb6511452c38 100644
--- a/pkgs/by-name/mj/mjpegtools/package.nix
+++ b/pkgs/by-name/mj/mjpegtools/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchurl,
-  gtk2,
   libdv,
   libjpeg,
   libpng,
@@ -46,12 +45,13 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
   ]
   ++ lib.optionals (!withMinimal) [
-    gtk2
     libx11
     SDL
     SDL_gfx
   ];
 
+  configureFlags = [ "--without-gtk" ];
+
   env.NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${lib.getDev SDL}/include/SDL";
 
   postPatch = ''

From 1a1799214f7237f8036636d8a362380eeb30ef05 Mon Sep 17 00:00:00 2001
From: Oliver Davies <oliver@oliverdavies.uk>
Date: Fri, 24 Apr 2026 17:20:22 +0100
Subject: [PATCH 022/551] sculpin: init at 3.3.1

---
 pkgs/by-name/sc/sculpin/package.nix | 30 +++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 pkgs/by-name/sc/sculpin/package.nix

diff --git a/pkgs/by-name/sc/sculpin/package.nix b/pkgs/by-name/sc/sculpin/package.nix
new file mode 100644
index 000000000000..90adca3eab5d
--- /dev/null
+++ b/pkgs/by-name/sc/sculpin/package.nix
@@ -0,0 +1,30 @@
+{
+  fetchFromGitHub,
+  lib,
+  php,
+}:
+
+php.buildComposerProject2 rec {
+  __structuredAttrs = true;
+
+  pname = "sculpin";
+  version = "3.3.1";
+
+  src = fetchFromGitHub {
+    owner = "sculpin";
+    repo = "sculpin";
+    tag = version;
+    hash = "sha256-WoLqLe6UGzlDTRNpB75O2CT31EZkpHQZ6vPQIK/K/8Q=";
+  };
+
+  vendorHash = "sha256-y2W4GZNC7atxHkboNVWd2CWPDqWU2XIyWGC5Q47QqQs=";
+
+  meta = {
+    description = "PHP static site generator";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/sculpin/sculpin";
+    maintainers = with lib.maintainers; [ opdavies ];
+    inherit (php.meta) platforms;
+    mainProgram = "sculpin";
+  };
+}

From 778afcfd83cd0f469202fa8de9d790dd83b323bb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Jul 2026 15:10:32 +0000
Subject: [PATCH 023/551] libarchive: 3.8.8 -> 3.8.9

---
 pkgs/by-name/li/libarchive/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix
index fe81d018859c..ccc42c457d12 100644
--- a/pkgs/by-name/li/libarchive/package.nix
+++ b/pkgs/by-name/li/libarchive/package.nix
@@ -32,13 +32,13 @@
 assert xarSupport -> libxml2 != null;
 stdenv.mkDerivation (finalAttrs: {
   pname = "libarchive";
-  version = "3.8.8";
+  version = "3.8.9";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-l8xh+z6lP7VnxMIf9tfoSByerjwN6Z4dE3JNA9zS3LM=";
+    hash = "sha256-/CoInUlOiFvR83mEeV3Tx+2SQGywWDQ4nY+NstE/cP4=";
   };
 
   outputs = [

From ceeda24713827547ba4d252b8475fd3143127c26 Mon Sep 17 00:00:00 2001
From: NilaTheDragon <nilathedragon@pm.me>
Date: Wed, 29 Jul 2026 16:17:39 +0200
Subject: [PATCH 024/551] gnome-desktop: expose OpenGL driver path to thumbnail
 sandbox

---
 pkgs/by-name/gn/gnome-desktop/bubblewrap-paths.patch | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/gn/gnome-desktop/bubblewrap-paths.patch b/pkgs/by-name/gn/gnome-desktop/bubblewrap-paths.patch
index c31e093f4b7e..9cee631288af 100644
--- a/pkgs/by-name/gn/gnome-desktop/bubblewrap-paths.patch
+++ b/pkgs/by-name/gn/gnome-desktop/bubblewrap-paths.patch
@@ -2,7 +2,7 @@ diff --git a/libgnome-desktop/gnome-desktop-thumbnail-script.c b/libgnome-deskto
 index ddcc1511..546c2a36 100644
 --- a/libgnome-desktop/gnome-desktop-thumbnail-script.c
 +++ b/libgnome-desktop/gnome-desktop-thumbnail-script.c
-@@ -555,9 +555,9 @@ add_bwrap (GPtrArray   *array,
+@@ -555,9 +555,10 @@ add_bwrap (GPtrArray   *array,
    g_return_val_if_fail (script->s_infile != NULL, FALSE);
  
    add_args (array,
@@ -12,6 +12,7 @@ index ddcc1511..546c2a36 100644
 +	    "@bubblewrap_bin@",
 +	    "--ro-bind", "@storeDir@", "@storeDir@",
 +	    "--ro-bind-try", "/run/current-system", "/run/current-system",
++	    "--ro-bind-try", "/run/opengl-driver", "/run/opengl-driver",
  	    NULL);
  
    /* These directories might be symlinks into /usr/... */

From dd8369d9982ee5812c5c568f4539d383c1351b28 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 29 Jul 2026 14:43:33 +0000
Subject: [PATCH 025/551] libnghttp2: 1.69.0 -> 1.70.0

---
 pkgs/by-name/ng/nghttp2/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ng/nghttp2/package.nix b/pkgs/by-name/ng/nghttp2/package.nix
index 209717165a3b..0151aa916190 100644
--- a/pkgs/by-name/ng/nghttp2/package.nix
+++ b/pkgs/by-name/ng/nghttp2/package.nix
@@ -44,11 +44,11 @@ assert enableJemalloc -> enableApp;
 
 stdenv.mkDerivation rec {
   pname = "nghttp2";
-  version = "1.69.0";
+  version = "1.70.0";
 
   src = fetchurl {
     url = "https://github.com/nghttp2/nghttp2/releases/download/v${version}/nghttp2-${version}.tar.bz2";
-    hash = "sha256-PxhfWxw+d4heuc8/LE2ksan3OiS/WVe4KRg60Tf4Lcg=";
+    hash = "sha256-j6yh94qpmsO8F2ina34PazbY5qYsE4GHUbHSBfAvlAU=";
   };
 
   outputs = [

From d08b2c1d9c00bcbc35073c065012346ff4a432e7 Mon Sep 17 00:00:00 2001
From: NilaTheDragon <nilathedragon@pm.me>
Date: Wed, 29 Jul 2026 19:29:27 +0200
Subject: [PATCH 026/551] microsoft-rush: init at 5.178.0

---
 pkgs/by-name/mi/microsoft-rush/package.nix | 121 +++++++++++++++++++++
 pkgs/by-name/mi/microsoft-rush/update.sh   |   8 ++
 2 files changed, 129 insertions(+)
 create mode 100644 pkgs/by-name/mi/microsoft-rush/package.nix
 create mode 100755 pkgs/by-name/mi/microsoft-rush/update.sh

diff --git a/pkgs/by-name/mi/microsoft-rush/package.nix b/pkgs/by-name/mi/microsoft-rush/package.nix
new file mode 100644
index 000000000000..b569137f2e27
--- /dev/null
+++ b/pkgs/by-name/mi/microsoft-rush/package.nix
@@ -0,0 +1,121 @@
+{
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  lib,
+  makeWrapper,
+  nodejs,
+  pnpm_10,
+  pnpmConfigHook,
+  stdenv,
+  testers,
+  yq,
+}:
+
+let
+  pnpm = pnpm_10;
+  rushWorkspace = "@microsoft/rush...";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "microsoft-rush";
+  version = "5.178.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "rushstack";
+    tag = "@microsoft/rush_v${finalAttrs.version}";
+    hash = "sha256-e3M/wbdstVUZR0ShEHO7Bemz2BYHZn7tIIZP33UrRu8=";
+  };
+
+  # We have to patch some files to build rush with pnpm,
+  # as the repo is designed to be built with rush itself
+  postPatch = ''
+    # Rush usually places the pnpm lock file in a subdirectory (common/temp/default),
+    # but we need it at the root of the workspace
+    #
+    # But for this to work, we need to patch a few things:
+    # - We remove rush-specific overrides and checksums
+    # - We set injectWorkspacePackages to true to avoid ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
+    # - We adjust the importer paths be relative to the root of the workspace instead of the common/temp/default subdirectory
+    ${lib.getExe yq} -y '
+      del(.overrides, .packageExtensionsChecksum, .pnpmfileChecksum)
+      | .settings.injectWorkspacePackages = true
+      | .importers |= with_entries(.key |= sub("^\\.\\./\\.\\./\\.\\./"; ""))
+    ' common/config/subspaces/default/pnpm-lock.yaml > pnpm-lock.yaml
+
+    # Since rush doesn't provide a committed pnpm workspace file, we synthesize one from the pnpm lock file
+    ${lib.getExe yq} -y \
+      '{ packages: (.importers | keys | map(select(. != "."))) }' \
+      pnpm-lock.yaml > pnpm-workspace.yaml
+  '';
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      postPatch
+      env
+      pnpmWorkspaces
+      ;
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-3zRdVvJQTT7jBaOm4SdM76LmikjaTjVCkZXZK+MFf7A=";
+  };
+
+  pnpmWorkspaces = [ rushWorkspace ];
+
+  env = {
+    npm_config_auto_install_peers = "false";
+    npm_config_inject_workspace_packages = "true";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    nodejs
+    pnpm
+    pnpmConfigHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm --filter '${rushWorkspace}' --recursive --if-present run _phase:lite-build
+    pnpm --filter '${rushWorkspace}' --recursive --if-present run _phase:build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    pnpm --filter @microsoft/rush deploy --prod --offline "$out/libexec/microsoft-rush"
+
+    for command in rush rush-pnpm rushx; do
+      makeWrapper ${nodejs}/bin/node "$out/bin/$command" \
+        --add-flags "$out/libexec/microsoft-rush/bin/$command"
+    done
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+      inherit (finalAttrs) version;
+      command = "HOME=$TMPDIR rush --help";
+    };
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "Scalable monorepo manager for the web";
+    homepage = "https://rushjs.io";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nilathedragon ];
+    inherit (nodejs.meta) platforms;
+    mainProgram = "rush";
+  };
+})
diff --git a/pkgs/by-name/mi/microsoft-rush/update.sh b/pkgs/by-name/mi/microsoft-rush/update.sh
new file mode 100755
index 000000000000..50340675c57c
--- /dev/null
+++ b/pkgs/by-name/mi/microsoft-rush/update.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update nodejs
+# shellcheck shell=bash
+
+set -euo pipefail
+
+version="$(npm view @microsoft/rush version)"
+nix-update "$UPDATE_NIX_ATTR_PATH" --version "$version" --build --test

From 106695500c7f595311b588720f6edc1be29f155a Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Mon, 15 Jun 2026 02:34:05 +0300
Subject: [PATCH 027/551] gawk: `finalAttrs`

does not change the eval
---
 pkgs/tools/text/gawk/default.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 87d2946e6160..210c78f909c7 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   removeReferencesTo,
   runtimeShellPackage,
   texinfo,
@@ -24,12 +23,12 @@
 
 assert (doCheck && stdenv.hostPlatform.isLinux) -> glibcLocales != null;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gawk" + lib.optionalString interactive "-interactive";
   version = "5.4.1";
 
   src = fetchurl {
-    url = "mirror://gnu/gawk/gawk-${version}.tar.xz";
+    url = "mirror://gnu/gawk/gawk-${finalAttrs.version}.tar.xz";
     hash = "sha256-B/b3NCt/6+QxP8LCVCrZPWT+IK2HFyABCfEFqCb1/Tc=";
   };
 
@@ -129,4 +128,4 @@ stdenv.mkDerivation rec {
     ];
     mainProgram = "gawk";
   };
-}
+})

From d588d92eefc8e6ca3f8dfe4a1eecafe8eaa03d77 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Mon, 15 Jun 2026 02:34:05 +0300
Subject: [PATCH 028/551] gawk: `__structuredAttrs` & `enableParallelBuilding`

`nix store make-content-addressed` gives the same output
before and after this change.
---
 pkgs/tools/text/gawk/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 210c78f909c7..955c6b8d892f 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -49,7 +49,9 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional (!interactive) "man";
 
+  __structuredAttrs = true;
   strictDeps = true;
+  enableParallelBuilding = true;
 
   # no-pma fix
   nativeBuildInputs = [

From 920d9cd88229240a65f38beccffcf06fe71f1071 Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Fri, 31 Jul 2026 20:57:31 +0300
Subject: [PATCH 029/551] minimal-bootstrap.binutils{,-static}: 2.46.0 -> 2.47

---
 pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix | 4 ++--
 pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
index eb34c121e9da..b87911c27e31 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
@@ -20,11 +20,11 @@ let
   # Based on https://github.com/ZilchOS/bootstrap-from-tcc/blob/2e0c68c36b3437386f786d619bc9a16177f2e149/using-nix/2a1-static-binutils.nix
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "binutils";
-  version = "2.46.0";
+  version = "2.47";
 
   src = fetchurl {
     url = "mirror://gnu/binutils/binutils-${version}.tar.xz";
-    hash = "sha256-11qU9Nc+ekCG91E+Z+Q56Pzcu3Jv/mP0ZhdE5iVrLPI=";
+    hash = "sha256-FUqyO2AHDo8nATwil38RKUJdZ9HorNbhMBDmF4EeTP8=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
index e29e884a2dfd..7740d9ba05e2 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
@@ -20,11 +20,11 @@
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "binutils-static";
-  version = "2.46.0";
+  version = "2.47";
 
   src = fetchurl {
     url = "mirror://gnu/binutils/binutils-${version}.tar.xz";
-    hash = "sha256-11qU9Nc+ekCG91E+Z+Q56Pzcu3Jv/mP0ZhdE5iVrLPI=";
+    hash = "sha256-FUqyO2AHDo8nATwil38RKUJdZ9HorNbhMBDmF4EeTP8=";
   };
 
   patches = [

From d5deacb2261ee1c05ce06e941b61b3b149ab542b Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Fri, 31 Jul 2026 20:50:36 +0300
Subject: [PATCH 030/551] minimal-bootstrap.coreutils-{musl,static}: 9.10 ->
 9.11

---
 pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix   | 4 ++--
 pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
index 1eb87b40cdae..e0ece9d12347 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
@@ -15,11 +15,11 @@
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "bootstrap-coreutils-musl";
-  version = "9.10";
+  version = "9.11";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz";
-    hash = "sha256-4L3h+2hQlEf8cjzyUX6KjH+kZ2mRm7dJDtNQoukjhWI=";
+    hash = "sha256-IDO4owScBr/0mp486nK99Gg7zQy+uXUhHdVtuvi3Nq4=";
   };
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
index 6c92f12bf58b..934510e9d8ac 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
@@ -19,11 +19,11 @@
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "coreutils-static";
-  version = "9.10";
+  version = "9.11";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz";
-    hash = "sha256-4L3h+2hQlEf8cjzyUX6KjH+kZ2mRm7dJDtNQoukjhWI=";
+    hash = "sha256-IDO4owScBr/0mp486nK99Gg7zQy+uXUhHdVtuvi3Nq4=";
   };
 
   configureFlags = [

From 9d91a0b8d87581bd053ec16f68e8eb70f91c78df Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Fri, 31 Jul 2026 20:51:26 +0300
Subject: [PATCH 031/551] minimal-bootstrap.findutils{,-static}: 4.10.0 ->
 4.11.0

---
 .../os-specific/linux/minimal-bootstrap/findutils/default.nix | 4 ++--
 pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
index 96531fbbe67d..1025f6b246c0 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
@@ -14,11 +14,11 @@
 }:
 let
   pname = "findutils";
-  version = "4.10.0";
+  version = "4.11.0";
 
   src = fetchurl {
     url = "mirror://gnu/findutils/findutils-${version}.tar.xz";
-    hash = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU=";
+    hash = "sha256-v9GcsGzHHzNS1WfpAoTYzawCrIl3S76t8LUzsMEUMv0=";
   };
 in
 bash.runCommand "${pname}-${version}"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
index b183888ce033..23075374a189 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
@@ -17,11 +17,11 @@
 }:
 let
   pname = "findutils-static";
-  version = "4.10.0";
+  version = "4.11.0";
 
   src = fetchurl {
     url = "mirror://gnu/findutils/findutils-${version}.tar.xz";
-    hash = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU=";
+    hash = "sha256-v9GcsGzHHzNS1WfpAoTYzawCrIl3S76t8LUzsMEUMv0=";
   };
 in
 bash.runCommand "${pname}-${version}"

From be7d828eef866dd2d72a12684d29942f1e6a8c64 Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Fri, 31 Jul 2026 20:52:01 +0300
Subject: [PATCH 032/551] minimal-bootstrap.gawk{,-static}: 5.3.2 -> 5.4.1

Added the same patch that is also vendored for the top-level package.
---
 .../linux/minimal-bootstrap/gawk/default.nix  | 13 ++-
 .../gawk/node-struct-without-gmp-mpfr.patch   | 79 +++++++++++++++++++
 .../linux/minimal-bootstrap/gawk/static.nix   | 12 ++-
 3 files changed, 100 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
index 551c2029bee0..91158c05a727 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
@@ -7,6 +7,7 @@
   tinycc,
   gnumake,
   gnugrep,
+  gnupatch,
   gnused,
   gnutar,
   gzip,
@@ -15,12 +16,16 @@
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "gawk";
-  version = "5.3.2";
+
+  version = "5.4.1";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/gawk-${version}.tar.gz";
-    hash = "sha256-hjmhqI+0EaG+AmY3OdA+kCptMTtcb+Ak0L/rM0GhmhE=";
+    hash = "sha256-izsOqDkwMRo/MJBdPOiY0yxhA8L+INapC0A0EXGxdN4=";
   };
+  patches = [
+    ./node-struct-without-gmp-mpfr.patch
+  ];
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -28,6 +33,7 @@ bash.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [
       tinycc.compiler
+      gnupatch
       gnumake
       gnused
       gnugrep
@@ -48,6 +54,9 @@ bash.runCommand "${pname}-${version}"
     tar xzf ${src}
     cd gawk-${version}
 
+    # Patch
+    ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
     # Configure
     export CC="tcc -B ${tinycc.libs}/lib"
     export AR="tcc -ar"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch b/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch
new file mode 100644
index 000000000000..01f660c191e8
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch
@@ -0,0 +1,79 @@
+From bf85f8a3175af703597082d4c7e0abc2066a44d3 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Tue, 14 Jul 2026 10:14:50 +0300
+Subject: [PATCH] Workaround fix for systems without MPFR and GMP.
+
+---
+ ChangeLog |  8 ++++++++
+ awk.h     | 23 ++++++++++++++---------
+ 2 files changed, 22 insertions(+), 9 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 6a955eed..42bd2c48 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -3,6 +3,14 @@
+ 	* builtin.c (do_dump_node): Add the size of each object to
+ 	the printout.
+ 
++	Unrelated: Make things works when built on systems without
++	the GMP and MPFR libraries.  Thanks to Thomas Trepl <ttrepl@yahoo.de>
++	and Bruce Dubbs <bdubbs@linuxfromscratch.org> for the reports.
++
++	* awk.h (struct exp_node): Add alignment padding when we don't
++	have MPFR. This is a hack, pending a total refactoring of
++	the NODE structure.
++
+ 2026-07-08         Arnold D. Robbins     <arnold@skeeve.com>
+ 
+ 	* 5.4.1: Release tar ball made.
+diff --git a/awk.h b/awk.h
+index dbad0d81..f4a84300 100644
+--- a/awk.h
++++ b/awk.h
+@@ -406,17 +406,24 @@ typedef struct exp_node {
+ 		} nodep;
+ 
+ 		struct {
+-#ifdef HAVE_MPFR
+ 			union {
+ 				AWKNUM fltnum;
++#ifdef HAVE_MPFR
+ 				mpfr_t mpnum;
+ 				mpz_t mpi;
+-			} nm;
+-			int rndmode;
+ #else
+-			AWKNUM fltnum;
+-			int for_alignment_only;	// especially on 32-bit
+-#endif
++				// 7/2026:
++				// This is a workaround for systems that build
++				// gawk without MPFR and GMP.  The NODE struct
++				// desperately needs to be refactored.
++#if SIZEOF_VOID_P == 4
++				char alignment[28];
++#else	// SIZEOF_VOID_P != 4
++				char alignment[48];
++#endif	// SIZEOF_VOID_P != 4
++#endif	// HAVE_MPFR
++			} nm;
++			int rndmode;	// only used for MPFR.
+ 			char *sp;
+ 			size_t slen;
+ 			int idx;
+@@ -561,10 +568,8 @@ typedef struct exp_node {
+ #ifdef HAVE_MPFR
+ #define mpg_numbr	sub.val.nm.mpnum
+ #define mpg_i		sub.val.nm.mpi
+-#define numbr		sub.val.nm.fltnum
+-#else
+-#define numbr		sub.val.fltnum
+ #endif
++#define numbr		sub.val.nm.fltnum
+ #define typed_re	sub.val.typre
+ 
+ /*
+-- 
+2.54.0
+
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
index d35bb47674d6..861d4a7f36b7 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
@@ -6,6 +6,7 @@
   bash,
   gcc,
   binutils,
+  gnupatch,
   gnumake,
   gnused,
   gnugrep,
@@ -18,12 +19,15 @@
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "gawk-static";
-  version = "5.3.2";
+  version = "5.4.1";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/gawk-${version}.tar.gz";
-    hash = "sha256-hjmhqI+0EaG+AmY3OdA+kCptMTtcb+Ak0L/rM0GhmhE=";
+    hash = "sha256-izsOqDkwMRo/MJBdPOiY0yxhA8L+INapC0A0EXGxdN4=";
   };
+  patches = [
+    ./node-struct-without-gmp-mpfr.patch
+  ];
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -32,6 +36,7 @@ bash.runCommand "${pname}-${version}"
     nativeBuildInputs = [
       gcc
       binutils
+      gnupatch
       gnumake
       gnused
       gnugrep
@@ -55,6 +60,9 @@ bash.runCommand "${pname}-${version}"
     tar xf ${src}
     cd gawk-${version}
 
+    # Patch
+    ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
     # Configure
     bash ./configure \
       --prefix=$out \

From 985bc462dac0af1721c0dc6048560453e1603869 Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Fri, 31 Jul 2026 20:52:21 +0300
Subject: [PATCH 033/551] minimal-bootstrap.glibc: 2.42 -> 2.44

---
 pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
index f156f862ecc0..cf71f17513f1 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
@@ -20,11 +20,11 @@
 }:
 let
   pname = "glibc";
-  version = "2.42";
+  version = "2.44";
 
   src = fetchurl {
     url = "mirror://gnu/libc/glibc-${version}.tar.xz";
-    hash = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8=";
+    hash = "sha256-N/YA8r7zxegwAUcFlWiyouQKetbMxlzpQlVtSUKcxmc=";
   };
 
   linkerFile =

From 4af58188ea8c21ac34cf72dd9a5ba2b8deb448ed Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Fri, 31 Jul 2026 20:52:45 +0300
Subject: [PATCH 034/551] minimal-bootstrap.gnused-static: 4.9 -> 4.10

Added linux-headers to the include path, the new version of the
vendored gnulib depends on a few headers.
---
 .../os-specific/linux/minimal-bootstrap/gnused/static.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
index 90346ee634ba..e8a39c7fbc67 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
@@ -13,16 +13,17 @@
   diffutils,
   findutils,
   gnutar,
+  linux-headers,
   xz,
 }:
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "gnused-static";
-  version = "4.9";
+  version = "4.10";
 
   src = fetchurl {
     url = "mirror://gnu/sed/sed-${version}.tar.xz";
-    hash = "sha256-biJrcy4c1zlGStaGK9Ghq6QteYKSLaelNRljHSSXUYE=";
+    hash = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc=";
   };
 in
 bash.runCommand "${pname}-${version}"
@@ -60,7 +61,8 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
-      --disable-nls
+      --disable-nls \
+      CFLAGS="-I${linux-headers}/include"
 
     # Build
     make -j $NIX_BUILD_CORES

From e8532079faacabf96c1ab9162cd46b9558aa43f1 Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Fri, 31 Jul 2026 20:53:09 +0300
Subject: [PATCH 035/551] minimal-bootstrap.patchelf-static: 0.18.0 -> 0.19.1

---
 pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
index 622dc2846468..b84c0ae20b28 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
@@ -17,11 +17,11 @@
 }:
 let
   pname = "patchelf-static";
-  version = "0.18.0";
+  version = "0.19.1";
 
   src = fetchurl {
     url = "https://github.com/NixOS/patchelf/releases/download/${version}/patchelf-${version}.tar.gz";
-    sha256 = "sha256-ZN4Q5Ma4uDedt+h/WAMPM26nR8BRXzgRMugQ2/hKhuc=";
+    sha256 = "sha256-SREIco8SDOBbU5k0tBp1AjUDGm34q8a0flev994VCU0=";
   };
 in
 bash.runCommand "${pname}-${version}"

From 1f15a58e9671545ad638c0ce21ab36009a3638a6 Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Fri, 31 Jul 2026 20:53:22 +0300
Subject: [PATCH 036/551] minimal-bootstrap.python: 3.14.4 -> 3.14.6

---
 pkgs/os-specific/linux/minimal-bootstrap/python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
index ff04626a6336..0b870ca6d3d1 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
@@ -19,11 +19,11 @@
 }:
 let
   pname = "python";
-  version = "3.14.4";
+  version = "3.14.6";
 
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${version}/Python-${version}.tar.xz";
-    hash = "sha256-2SPFEwPjjiSRNvwb3zVo1W7LAyFO/e9IUWF209f6rvg=";
+    hash = "sha256-FDsd3e+uw70uIeO4ObNKK3+5hCJyiDxXZCDWBenzDGM=";
   };
 
   patches = [

From ba616b59f2d3cc8b81f143c7298b0a8f5b42c08a Mon Sep 17 00:00:00 2001
From: Marie Ramlow <me@nycode.dev>
Date: Tue, 19 May 2026 11:43:34 +0200
Subject: [PATCH 037/551] proxyt: init at 0.0.7

---
 pkgs/by-name/pr/proxyt/package.nix | 55 ++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 pkgs/by-name/pr/proxyt/package.nix

diff --git a/pkgs/by-name/pr/proxyt/package.nix b/pkgs/by-name/pr/proxyt/package.nix
new file mode 100644
index 000000000000..37962bc86288
--- /dev/null
+++ b/pkgs/by-name/pr/proxyt/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "proxyt";
+  version = "0.0.7";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "jaxxstorm";
+    repo = "proxyt";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6+MgmhacH0oZY9ksZdBpv/tH4su8EBtHOiBIbR3ZXxo=";
+  };
+
+  vendorHash = "sha256-eAOU4DRnvfHdIc3cXMCAHbw7AZJWkEk/u3ae+K43CVc=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/jaxxstorm/proxyt/cmd.Version=${finalAttrs.version}"
+  ];
+
+  env = {
+    CGO_ENABLED = "0";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd proxyt \
+      --bash <($out/bin/proxyt completion bash) \
+      --fish <($out/bin/proxyt completion fish) \
+      --zsh <($out/bin/proxyt completion zsh)
+  '';
+
+  meta = {
+    changelog = "https://github.com/jaxxstorm/proxyt/releases/${finalAttrs.version}";
+    description = "Simple proxy for the Tailscale control plane";
+    homepage = "https://github.com/jaxxstorm/proxyt";
+    license = lib.licenses.mit;
+    mainProgram = "proxyt";
+    maintainers = with lib.maintainers; [ marie ];
+  };
+})

From b7970fa66e050e0ce2c3783ba1775073375cc676 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marco=20=22Capypara=22=20K=C3=B6pcke?= <hello@capypara.de>
Date: Sun, 2 Aug 2026 13:55:47 +0200
Subject: [PATCH 038/551] vala: 0.56.18 -> 0.56.19

---
 pkgs/development/compilers/vala/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 47d32565ac18..17847cb1ae04 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -127,8 +127,8 @@ let
 in
 rec {
   vala_0_56 = generic {
-    version = "0.56.18";
-    hash = "sha256-8q/+fUCrY9uOe57MP2vcnC/H4xNMhP8teV9IL+kmo4I=";
+    version = "0.56.19";
+    hash = "sha256-WtfLv8wN5htAPWeXye9gRVv769jhYq7DO1sLCXrfudU=";
   };
 
   vala = vala_0_56;

From 64927122870a0587642a82bd40b808e3c109f77f Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 20:01:05 +0200
Subject: [PATCH 039/551] linuxHeaders: enable structuredAttrs

---
 pkgs/os-specific/linux/kernel-headers/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index e5952533eb02..d74c405ca284 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -108,7 +108,7 @@ let
       # Skip clean on darwin, case-sensitivity issues.
       buildPhase =
         lib.optionalString (!stdenvNoCC.buildPlatform.isDarwin) ''
-          make mrproper $makeFlags
+          make mrproper "''${makeFlags[@]}"
         ''
         + (
           if stdenvNoCC.hostPlatform.isAndroid then
@@ -118,12 +118,12 @@ let
             ''
           else
             ''
-              make headers $makeFlags
+              make headers "''${makeFlags[@]}"
             ''
         );
 
       checkPhase = ''
-        make headers_check $makeFlags
+        make headers_check "''${makeFlags[@]}"
       '';
 
       # The following command requires rsync:
@@ -144,6 +144,8 @@ let
 
       inherit passthru;
 
+      __structuredAttrs = true;
+
       meta = {
         description = "Header files and scripts for Linux kernel";
         license = lib.licenses.gpl2Only;

From 39953932fe81c37cc02b3a321dd439c79af487d7 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 20:11:26 +0200
Subject: [PATCH 040/551] glibc: enable structuredAttrs

---
 pkgs/development/libraries/glibc/common.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 5e391970a271..972250e1a894 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -347,6 +347,8 @@ stdenv.mkDerivation (
 
       doCheck = false; # fails
 
+      __structuredAttrs = true;
+
       meta =
 
         {

From a6df78ba9b0295f37e6aff63d971b6901160f57c Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 21:01:49 +0200
Subject: [PATCH 041/551] xz: enable structuredAttrs

---
 pkgs/by-name/xz/xz/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/xz/xz/package.nix b/pkgs/by-name/xz/xz/package.nix
index 62460c88acd4..1313bc1779a2 100644
--- a/pkgs/by-name/xz/xz/package.nix
+++ b/pkgs/by-name/xz/xz/package.nix
@@ -77,6 +77,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     changelog = "https://github.com/tukaani-project/xz/releases/tag/v${finalAttrs.version}";
     description = "General-purpose data compression software, successor of LZMA";

From 04155a77f60f5f8ab14436d7742d40d3dc22001f Mon Sep 17 00:00:00 2001
From: Arthur Gautier <baloo@superbaloo.net>
Date: Sun, 2 Aug 2026 19:43:12 +0000
Subject: [PATCH 042/551] lix: boost is required to build against lix/libutil

This fixes compilation errors like:
```
In file included from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/error-trace.hh:11,
                 from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/error.hh:18,
                 from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/async.hh:4,
                 from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/async-io.hh:4,
                 from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/archive.hh:4,
                 from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/hash.hh:6,
                 from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libstore/realisation.hh:6,
                 from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libstore/build-result.hh:4,
                 from ../src/plugin.cc:3:
/nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/fmt.hh:6:10: fatal error: boost/format.hpp: No such file or directory
    6 | #include <boost/format.hpp>
      |          ^~~~~~~~~~~~~~~~~~
compilation terminated.
```
---
 pkgs/tools/package-management/lix/common-lix.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index fdd550e8c8d1..c3de69bbf779 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -311,6 +311,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = [
     boehmgc
+    boost
     nlohmann_json
   ];
 

From aafeee7fba2cfb77debd7260b8baccc687e56bb7 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 21:54:04 +0200
Subject: [PATCH 043/551] gnu-config: enable structuredAttrs

---
 pkgs/by-name/gn/gnu-config/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gn/gnu-config/package.nix b/pkgs/by-name/gn/gnu-config/package.nix
index 80baba133a06..fc52ff2e9b6d 100644
--- a/pkgs/by-name/gn/gnu-config/package.nix
+++ b/pkgs/by-name/gn/gnu-config/package.nix
@@ -67,6 +67,8 @@ stdenv.mkDerivation {
 
   strictDeps = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Attempt to guess a canonical system name";
     homepage = "https://savannah.gnu.org/projects/config";

From 1cd690ae5471ccd59a6858df17f51bd6c317e908 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 22:55:15 +0200
Subject: [PATCH 044/551] coreutils: enable strictDeps

---
 pkgs/by-name/co/coreutils/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/co/coreutils/package.nix b/pkgs/by-name/co/coreutils/package.nix
index 9a47b436ae3d..54a1e1ff3f49 100644
--- a/pkgs/by-name/co/coreutils/package.nix
+++ b/pkgs/by-name/co/coreutils/package.nix
@@ -162,6 +162,8 @@ stdenv.mkDerivation (finalAttrs: {
     # TODO(@Ericson2314): Investigate whether Darwin could benefit too
     ++ optional (isCross && stdenv.hostPlatform.libc != "glibc") libiconv;
 
+  strictDeps = true;
+
   hardeningDisable = [ "trivialautovarinit" ];
 
   configureFlags = [

From 876cd695b696d82d1b151e62d2a9eae03428683d Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 22:55:38 +0200
Subject: [PATCH 045/551] coreutils: enable structuredAttrs, use --replace-fail

---
 pkgs/by-name/co/coreutils/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/co/coreutils/package.nix b/pkgs/by-name/co/coreutils/package.nix
index 54a1e1ff3f49..696a0844475e 100644
--- a/pkgs/by-name/co/coreutils/package.nix
+++ b/pkgs/by-name/co/coreutils/package.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     # sandbox does not allow setgid
     sed '2i echo Skipping chmod setgid test && exit 77' -i ./tests/chmod/setgid.sh
     substituteInPlace ./tests/install/install-C.sh \
-      --replace 'mode3=2755' 'mode3=1755'
+      --replace-fail 'mode3=2755' 'mode3=1755'
 
     # Fails on systems with a rootfs. Looks like a bug in the test, see
     # https://lists.gnu.org/archive/html/bug-coreutils/2019-12/msg00000.html
@@ -273,6 +273,8 @@ stdenv.mkDerivation (finalAttrs: {
     '';
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/coreutils/";
     description = "GNU Core Utilities";

From aa9c93970fedc5dd068ce79bfbdb11155aafba5b Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 22:57:32 +0200
Subject: [PATCH 046/551] autoconf269: enable structuredAttrs, use finalAttrs

---
 pkgs/development/tools/misc/autoconf/2.69.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/autoconf/2.69.nix b/pkgs/development/tools/misc/autoconf/2.69.nix
index 046c885e9955..ca2f881db326 100644
--- a/pkgs/development/tools/misc/autoconf/2.69.nix
+++ b/pkgs/development/tools/misc/autoconf/2.69.nix
@@ -6,12 +6,12 @@
   perl,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "autoconf";
   version = "2.69";
 
   src = fetchurl {
-    url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
+    url = "mirror://gnu/autoconf/autoconf-${finalAttrs.version}.tar.xz";
     sha256 = "113nlmidxy9kjr45kg9x3ngar4951mvag1js2a3j8nxcz34wxsv4";
   };
 
@@ -41,6 +41,8 @@ stdenv.mkDerivation rec {
 
   doInstallCheck = false; # fails
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/autoconf/";
     description = "Part of the GNU Build System";
@@ -59,4 +61,4 @@ stdenv.mkDerivation rec {
 
     platforms = lib.platforms.all;
   };
-}
+})

From 4869f0e3d6a5352b1a9536df832b40c507ed045a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 22:57:47 +0200
Subject: [PATCH 047/551] autoconf: enable structuredAttrs, use finalAttrs

---
 pkgs/development/tools/misc/autoconf/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/autoconf/default.nix b/pkgs/development/tools/misc/autoconf/default.nix
index 818117f1bb12..c311d32ac713 100644
--- a/pkgs/development/tools/misc/autoconf/default.nix
+++ b/pkgs/development/tools/misc/autoconf/default.nix
@@ -12,7 +12,7 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "autoconf";
   version = "2.73";
   outputs = [
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   ];
 
   src = fetchurl {
-    url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
+    url = "mirror://gnu/autoconf/autoconf-${finalAttrs.version}.tar.xz";
     hash = "sha256-n9ZyschCX6wvpn+gR3uZCYcmi5D/NtXwFtrle+DWtS4=";
   };
 
@@ -57,6 +57,8 @@ stdenv.mkDerivation rec {
     export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/autoconf/";
     description = "Part of the GNU Build System";
@@ -75,4 +77,4 @@ stdenv.mkDerivation rec {
 
     platforms = lib.platforms.all;
   };
-}
+})

From 733fcf93e58e2644158713acff7feda59dfea030 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 22:58:41 +0200
Subject: [PATCH 048/551] automake116x: enable structuredAttrs, use finalAttrs

---
 pkgs/development/tools/misc/automake/automake-1.16.x.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
index 8751317729fa..308ebc9e9f3f 100644
--- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
@@ -7,12 +7,12 @@
   updateAutotoolsGnuConfigScriptsHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "automake";
   version = "1.16.5";
 
   src = fetchurl {
-    url = "mirror://gnu/automake/automake-${version}.tar.xz";
+    url = "mirror://gnu/automake/automake-${finalAttrs.version}.tar.xz";
     sha256 = "0sdl32qxdy7m06iggmkkvf7j520rmmgbsjzbm7fgnxwxdp6mh7gh";
   };
 
@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
   # "fixed" path in generated files!
   dontPatchShebangs = true;
 
+  __structuredAttrs = true;
+
   meta = {
     branch = "1.16";
     homepage = "https://www.gnu.org/software/automake/";
@@ -48,4 +50,4 @@ stdenv.mkDerivation rec {
     '';
     platforms = lib.platforms.all;
   };
-}
+})

From 0043d4fbc70882acde1d150ccc17ac95e884266a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 22:58:53 +0200
Subject: [PATCH 049/551] automake: enable structuredAttrs, use finalAttrs

---
 pkgs/development/tools/misc/automake/automake-1.18.x.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/automake/automake-1.18.x.nix b/pkgs/development/tools/misc/automake/automake-1.18.x.nix
index 7d1a496081db..1149cf78bde1 100644
--- a/pkgs/development/tools/misc/automake/automake-1.18.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.18.x.nix
@@ -7,12 +7,12 @@
   updateAutotoolsGnuConfigScriptsHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "automake";
   version = "1.18.1";
 
   src = fetchurl {
-    url = "mirror://gnu/automake/automake-${version}.tar.xz";
+    url = "mirror://gnu/automake/automake-${finalAttrs.version}.tar.xz";
     hash = "sha256-FoqjYyeDUbia9WaERI9SWlvOUHnQtoQr2RD90/FkaIc=";
   };
 
@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
   # "fixed" path in generated files!
   dontPatchShebangs = true;
 
+  __structuredAttrs = true;
+
   meta = {
     branch = "1.18";
     homepage = "https://www.gnu.org/software/automake/";
@@ -48,4 +50,4 @@ stdenv.mkDerivation rec {
     '';
     platforms = lib.platforms.all;
   };
-}
+})

From 4f61d6c8e9967e36f853348b930254f74f02ab3b Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:07:59 +0200
Subject: [PATCH 050/551] findutils: enable strictDeps

---
 pkgs/tools/misc/findutils/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index 5e2d0fbe6f3c..366d5f3431d3 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -31,6 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
   buildInputs = [ coreutils ]; # bin/updatedb script needs to call sort
 
+  strictDeps = true;
+
   # Since glibc-2.25 the i686 tests hang reliably right after test-sleep.
   doCheck =
     !stdenv.hostPlatform.isDarwin

From 48a056c33cfeb3f5cc174e544d56adc75f253f04 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:08:08 +0200
Subject: [PATCH 051/551] findutils: enable structuredAttrs

---
 pkgs/tools/misc/findutils/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index 366d5f3431d3..b52fb1c5bd1d 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -81,6 +81,8 @@ stdenv.mkDerivation (finalAttrs: {
   # or you can check libc/include/sys/cdefs.h in bionic source code
   hardeningDisable = lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify";
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/findutils/";
     changelog = "https://cgit.git.savannah.gnu.org/cgit/findutils.git/tree/NEWS?h=v${finalAttrs.version}";

From 53400743749740cbb266557070ad1fa9339021db Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:12:27 +0200
Subject: [PATCH 052/551] gnused: enable strictDeps

---
 pkgs/tools/text/gnused/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index 7f1cfe514425..a1e793e6eba5 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -24,6 +24,9 @@ stdenv.mkDerivation rec {
     updateAutotoolsGnuConfigScriptsHook
     perl
   ];
+
+  strictDeps = true;
+
   preConfigure = "patchShebangs ./build-aux/help2man";
 
   # Prevents attempts of running 'help2man' on cross-built binaries.

From 75af460bdbd16c197469a5502bcd72b80e90b2e1 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:20:40 +0200
Subject: [PATCH 053/551] patchelf: enable structuredAttrs, modernize

---
 pkgs/development/tools/misc/patchelf/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/tools/misc/patchelf/default.nix b/pkgs/development/tools/misc/patchelf/default.nix
index 086e18e94185..041e18531cb9 100644
--- a/pkgs/development/tools/misc/patchelf/default.nix
+++ b/pkgs/development/tools/misc/patchelf/default.nix
@@ -9,13 +9,13 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "patchelf";
   version = "0.15.2";
 
   src = fetchurl {
-    url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-F3RfVkFZyOIo/EEtplogSLhGxLa0Igt3y/IkFuAvLXw=";
+    url = "https://github.com/NixOS/patchelf/releases/download/${finalAttrs.version}/patchelf-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-F3RfVkFZyOIo/EEtplogSLhGxLa0Igt3y/IkFuAvLXw=";
   };
 
   strictDeps = true;
@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
   # fails 8 out of 24 tests, problems when loading libc.so.6
   doCheck = stdenv.name == "stdenv-linux";
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/NixOS/patchelf";
     license = lib.licenses.gpl3Plus;
@@ -35,4 +37,4 @@ stdenv.mkDerivation rec {
     maintainers = [ ];
     platforms = lib.platforms.all;
   };
-}
+})

From 1938a54c07a338678f53a1098dd18a17790cee8c Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:29:41 +0200
Subject: [PATCH 054/551] findutils: use --replace-fail

---
 pkgs/tools/misc/findutils/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index b52fb1c5bd1d..7540239528f0 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   postPatch = ''
-    substituteInPlace xargs/xargs.c --replace 'char default_cmd[] = "echo";' 'char default_cmd[] = "${lib.getExe' coreutils "echo"}";'
+    substituteInPlace xargs/xargs.c --replace-fail 'char default_cmd[] = "echo";' 'char default_cmd[] = "${lib.getExe' coreutils "echo"}";'
   '';
 
   patches = [

From 195fd12e68f7e2e83f2f7df102503b1fb47f2579 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:40:10 +0200
Subject: [PATCH 055/551] diffutils: enable strictDeps

---
 pkgs/by-name/di/diffutils/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/di/diffutils/package.nix b/pkgs/by-name/di/diffutils/package.nix
index ecbd00ec0094..0bd3a9f3cf97 100644
--- a/pkgs/by-name/di/diffutils/package.nix
+++ b/pkgs/by-name/di/diffutils/package.nix
@@ -42,6 +42,8 @@ stdenv.mkDerivation rec {
   # If no explicit coreutils is given, use the one from stdenv.
   buildInputs = [ coreutils ];
 
+  strictDeps = true;
+
   # Disable stack-related gnulib tests on x86_64-darwin because they have problems running under
   # Rosetta 2: test-c-stack hangs, test-sigsegv-catch-stackoverflow and test-sigaction fail.
   # Disable all gnulib tests when building on Darwin due to test-nl_langinfo-mt failure

From b5c3bd029bf468da96331f737aca74b4a77965fb Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:40:21 +0200
Subject: [PATCH 056/551] diffutils: enable structuredAttrs, use finalAttrs

---
 pkgs/by-name/di/diffutils/package.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/di/diffutils/package.nix b/pkgs/by-name/di/diffutils/package.nix
index 0bd3a9f3cf97..ad36dd91eed9 100644
--- a/pkgs/by-name/di/diffutils/package.nix
+++ b/pkgs/by-name/di/diffutils/package.nix
@@ -12,12 +12,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "diffutils";
   version = "3.12";
 
   src = fetchurl {
-    url = "mirror://gnu/diffutils/diffutils-${version}.tar.xz";
+    url = "mirror://gnu/diffutils/diffutils-${finalAttrs.version}.tar.xz";
     hash = "sha256-fIt/n8hgkUH96pzs6FJJ0whiQ5H/Yd7a9Sj8szdyff0=";
   };
 
@@ -80,6 +80,8 @@ stdenv.mkDerivation rec {
   # Test failure on QEMU only (#300550)
   doCheck = !stdenv.buildPlatform.isRiscV64;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/diffutils/diffutils.html";
     description = "Commands for showing the differences between files (diff, cmp, etc.)";
@@ -90,4 +92,4 @@ stdenv.mkDerivation rec {
       helsinki-Jo
     ];
   };
-}
+})

From 2dd210f97759d908eb12aeb001c9e6957f3e23ee Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:41:23 +0200
Subject: [PATCH 057/551] gnum4: enable structuredAttrs

---
 pkgs/by-name/gn/gnum4/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gn/gnum4/package.nix b/pkgs/by-name/gn/gnum4/package.nix
index 73c5be0ac04e..78e02d2698fa 100644
--- a/pkgs/by-name/gn/gnum4/package.nix
+++ b/pkgs/by-name/gn/gnum4/package.nix
@@ -47,6 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional stdenv.hostPlatform.isMinGW "CFLAGS=-fno-stack-protector";
 
+  __structuredAttrs = true;
+
   meta = {
     description = "GNU M4, a macro processor";
     longDescription = ''

From 5fb27e0291facb7a80e7c091944952efffb7dc11 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:45:19 +0200
Subject: [PATCH 058/551] gettext: enable structuredAttrs, use finalAttrs

---
 pkgs/development/libraries/gettext/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 6814348c1d24..7c3333a95d17 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -12,12 +12,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gettext";
   version = "1.0";
 
   src = fetchurl {
-    url = "mirror://gnu/gettext/${pname}-${version}.tar.gz";
+    url = "mirror://gnu/gettext/gettext-${finalAttrs.version}.tar.gz";
     hash = "sha256-hdmbecmBpASHTALgNCF2z3XHaY4rUf5BAxz2Um2XTxo=";
   };
   patches = [
@@ -103,6 +103,8 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   enableParallelChecking = false; # fails sometimes
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Well integrated set of translation tools and documentation";
 
@@ -135,4 +137,4 @@ stdenv.mkDerivation rec {
 
 // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
   makeFlags = [ "CFLAGS=-D_FORTIFY_SOURCE=0" ];
-}
+})

From 5530de9cca3fb9f3c17d5bc87a9bfdae5da5734b Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:48:27 +0200
Subject: [PATCH 059/551] bison: enable structuredAttrs

---
 pkgs/by-name/bi/bison/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/bi/bison/package.nix b/pkgs/by-name/bi/bison/package.nix
index db0d43a5a3ca..ec4c397b80ab 100644
--- a/pkgs/by-name/bi/bison/package.nix
+++ b/pkgs/by-name/bi/bison/package.nix
@@ -50,6 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
   # TODO: enable doInstallCheck unconditionally when fixed upstream.
   doInstallCheck = !stdenv.cc.isClang;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/bison/";
     description = "Yacc-compatible parser generator";

From 3211eabb3132faa5621c179ee1bd7afbcb9a3620 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:51:46 +0200
Subject: [PATCH 060/551] gettext: move makeFlags into the main attrset

This saves a big reformatting with finalAttrs and is maybe a bit cleaner?
---
 pkgs/development/libraries/gettext/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 7c3333a95d17..aa242f4e262a 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -45,6 +45,10 @@ stdenv.mkDerivation (finalAttrs: {
     "gl_cv_func_wcwidth_works=yes"
   ];
 
+  makeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "CFLAGS=-D_FORTIFY_SOURCE=0"
+  ];
+
   postPatch = ''
     # Older versions of gettext come with a copy of `extern-inline.m4` that is not compatible with clang 18.
     # When a project uses gettext + autoreconfPhase, autoreconfPhase will invoke `autopoint -f`, which will
@@ -133,8 +137,4 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;
   };
-}
-
-// lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-  makeFlags = [ "CFLAGS=-D_FORTIFY_SOURCE=0" ];
 })

From 67d950f1b9c6b4aa3ab4c97a1accaa4133e5bb2b Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 00:03:32 +0200
Subject: [PATCH 061/551] gmp: enable structuredAttrs, use finalAttrs

The flags "--disable-static --enable-shared" must be split for structuredAttrs,
the other changes to configureFlags are cosmetic (but consistent).
---
 pkgs/development/libraries/gmp/6.x.nix | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 76b54b479c5d..6a81bdf49c04 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -14,19 +14,19 @@
 # files.
 
 let
-  inherit (lib) optional;
+  inherit (lib) optionals;
 in
 
 let
-  self = stdenv.mkDerivation rec {
+  self = stdenv.mkDerivation (finalAttrs: {
     pname = "gmp${lib.optionalString cxx "-with-cxx"}";
     version = "6.3.0";
 
     src = fetchurl {
       # we need to use bz2, others aren't in bootstrapping stdenv
       urls = [
-        "mirror://gnu/gmp/gmp-${version}.tar.bz2"
-        "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2"
+        "mirror://gnu/gmp/gmp-${finalAttrs.version}.tar.bz2"
+        "ftp://ftp.gmplib.org/pub/gmp-${finalAttrs.version}/gmp-${finalAttrs.version}.tar.bz2"
       ];
       hash = "sha256-rCghGnz7YJuuLiyNYFjWbI/pZDT3QM9v4uR7AA0cIMs=";
     };
@@ -65,11 +65,18 @@ let
       # broken on multicore CPUs). Avoid this impurity.
       "--build=${stdenv.buildPlatform.config}"
     ]
-    ++ optional (cxx && stdenv.hostPlatform.isDarwin) "CPPFLAGS=-fexceptions"
-    ++ optional (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.is64bit) "ABI=64"
+    ++ optionals (cxx && stdenv.hostPlatform.isDarwin) [
+      "CPPFLAGS=-fexceptions"
+    ]
+    ++ optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.is64bit) [
+      "ABI=64"
+    ]
     # to build a .dll on windows, we need --disable-static + --enable-shared
     # see https://gmplib.org/manual/Notes-for-Particular-Systems.html
-    ++ optional (!withStatic && stdenv.hostPlatform.isPE) "--disable-static --enable-shared";
+    ++ optionals (!withStatic && stdenv.hostPlatform.isPE) [
+      "--disable-static"
+      "--enable-shared"
+    ];
 
     doCheck = true; # not cross;
 
@@ -77,6 +84,8 @@ let
 
     enableParallelBuilding = true;
 
+    __structuredAttrs = true;
+
     meta = {
       homepage = "https://gmplib.org/";
       description = "GNU multiple precision arithmetic library";
@@ -112,6 +121,6 @@ let
       platforms = lib.platforms.all;
       maintainers = with lib.maintainers; [ coolcuber ];
     };
-  };
+  });
 in
 self

From 2e412b377ae5686d64f6e5b8a800ba492c6f7db3 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 00:12:50 +0200
Subject: [PATCH 062/551] libmpc: enable structuredAttrs

---
 pkgs/by-name/li/libmpc/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libmpc/package.nix b/pkgs/by-name/li/libmpc/package.nix
index 4bfea7b7bd24..d29fcc4dc70b 100644
--- a/pkgs/by-name/li/libmpc/package.nix
+++ b/pkgs/by-name/li/libmpc/package.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true; # not cross;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Library for multiprecision complex arithmetic with exact rounding";
 

From a2f8d03cf5d4a93d99affdd2fd714630dd7eddb6 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 00:38:46 +0200
Subject: [PATCH 063/551] mpfr: enable structuredAttrs, use finalAttrs

---
 pkgs/by-name/mp/mpfr/package.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/mp/mpfr/package.nix b/pkgs/by-name/mp/mpfr/package.nix
index f9db385a11cb..579523e45309 100644
--- a/pkgs/by-name/mp/mpfr/package.nix
+++ b/pkgs/by-name/mp/mpfr/package.nix
@@ -12,14 +12,14 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   version = "4.2.2";
   pname = "mpfr";
 
   src = fetchurl {
     urls = [
-      "https://www.mpfr.org/${pname}-${version}/${pname}-${version}.tar.xz"
-      "mirror://gnu/mpfr/${pname}-${version}.tar.xz"
+      "https://www.mpfr.org/mpfr-${finalAttrs.version}/mpfr-${finalAttrs.version}.tar.xz"
+      "mirror://gnu/mpfr/mpfr-${finalAttrs.version}.tar.xz"
     ];
     hash = "sha256-tnugOD736KhWNzTi6InvXsPDuJigHQD6CmhprYHGzgE=";
   };
@@ -67,10 +67,12 @@ stdenv.mkDerivation rec {
       # Expect the text in format of '<title>GNU MPFR version 4.1.1</title>'
       new_version="$(curl -s https://www.mpfr.org/mpfr-current/ |
           pcre2grep -o1 '<title>GNU MPFR version ([0-9.]+)</title>')"
-      update-source-version ${pname} "$new_version"
+      update-source-version ${finalAttrs.pname} "$new_version"
     '';
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.mpfr.org/";
     description = "Library for multiple-precision floating-point arithmetic";
@@ -92,4 +94,4 @@ stdenv.mkDerivation rec {
     maintainers = [ ];
     platforms = lib.platforms.all;
   };
-}
+})

From 56f1baddcabcd18431e340e6f372bcc1016e1163 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 00:50:21 +0200
Subject: [PATCH 064/551] zlib: enable structuredAttrs

---
 pkgs/development/libraries/zlib/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index d1ade7177909..a400e4b60c63 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -161,6 +161,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit minizip;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://zlib.net";
     description = "Lossless data-compression library";

From 48e25ca7b0604842834caac87129dc27e15b51ac Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 00:54:53 +0200
Subject: [PATCH 065/551] texinfo: enable structuredAttrs

---
 pkgs/development/tools/misc/texinfo/common.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index 00dd5a5811a5..590a98b73fdf 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -141,6 +141,8 @@ stdenv.mkDerivation {
     done
   '';
 
+  __structuredAttrs = true;
+
   meta = meta // {
     branch = version;
   };

From 88a48995c2ceca3321f8b8992020ac84be2a4549 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 00:58:51 +0200
Subject: [PATCH 066/551] bash: enable structuredAttrs

---
 pkgs/shells/bash/5.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 5e89c04d4934..07726320556e 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -261,6 +261,8 @@ lib.warnIf (withDocs != null)
       });
     };
 
+    __structuredAttrs = true;
+
     meta = {
       homepage = "https://www.gnu.org/software/bash/";
       description =

From bbb94bc73cb8bd7323535648a9b51f016a5e2666 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 01:04:39 +0200
Subject: [PATCH 067/551] isl_0_{20,23,24,27}: enable structuredAttrs

---
 pkgs/development/libraries/isl/generic.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/isl/generic.nix b/pkgs/development/libraries/isl/generic.nix
index 8988e8faf982..232057fe03e7 100644
--- a/pkgs/development/libraries/isl/generic.nix
+++ b/pkgs/development/libraries/isl/generic.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation {
 
   makeFlags = lib.optional stdenv.hostPlatform.isPE "LDFLAGS=-no-undefined";
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://libisl.sourceforge.io/";
     license = lib.licenses.lgpl21;

From 5d290f6ac16f8f5bbc608776ac7a36de4fbcf955 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 01:10:42 +0200
Subject: [PATCH 068/551] gnugrep: enable strictDeps

---
 pkgs/by-name/gn/gnugrep/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gn/gnugrep/package.nix b/pkgs/by-name/gn/gnugrep/package.nix
index 9f0ecedd8792..de2964c6b781 100644
--- a/pkgs/by-name/gn/gnugrep/package.nix
+++ b/pkgs/by-name/gn/gnugrep/package.nix
@@ -63,6 +63,8 @@ stdenv.mkDerivation {
   ]
   ++ lib.optional (!stdenv.hostPlatform.isWindows) runtimeShellPackage;
 
+  strictDeps = true;
+
   # cygwin: FAIL: multibyte-white-space
   # freebsd: FAIL mb-non-UTF8-performance
   # x86_64-darwin: fails 'stack-overflow' tests on Rosetta 2 emulator

From 877c99aeb3a2ab0e2315a6daa22fefe9d90935f1 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 01:10:54 +0200
Subject: [PATCH 069/551] gnugrep: enable structuredAttrs

---
 pkgs/by-name/gn/gnugrep/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gn/gnugrep/package.nix b/pkgs/by-name/gn/gnugrep/package.nix
index de2964c6b781..e5ae6241a47b 100644
--- a/pkgs/by-name/gn/gnugrep/package.nix
+++ b/pkgs/by-name/gn/gnugrep/package.nix
@@ -99,6 +99,8 @@ stdenv.mkDerivation {
     NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/grep/";
     description = "GNU implementation of the Unix grep command";

From acd187492f929376d6d024985543a3c8fbcca23b Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 02:02:31 +0200
Subject: [PATCH 070/551] attr: enable strictDeps

---
 pkgs/development/libraries/attr/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/attr/default.nix b/pkgs/development/libraries/attr/default.nix
index 10891ece56a8..f47b57212062 100644
--- a/pkgs/development/libraries/attr/default.nix
+++ b/pkgs/development/libraries/attr/default.nix
@@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gettext ];
 
+  strictDeps = true;
+
   postPatch = ''
     for script in install-sh include/install-sh; do
       patchShebangs $script

From 00262951342b4157cb1c83d0fadeee44cfa6ba40 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 02:02:39 +0200
Subject: [PATCH 071/551] attr: enable structuredAttrs, use finalAttrs

---
 pkgs/development/libraries/attr/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/attr/default.nix b/pkgs/development/libraries/attr/default.nix
index f47b57212062..fbab3ffe14c2 100644
--- a/pkgs/development/libraries/attr/default.nix
+++ b/pkgs/development/libraries/attr/default.nix
@@ -10,12 +10,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "attr";
   version = "2.6.0";
 
   src = fetchurl {
-    url = "mirror://savannah/attr/attr-${version}.tar.gz";
+    url = "mirror://savannah/attr/attr-${finalAttrs.version}.tar.gz";
     hash = "sha256-1C+jdFExgLtIyxGkZpb0iCQOUST/HmrYiwq/9waYVhI=";
   };
 
@@ -40,6 +40,8 @@ stdenv.mkDerivation rec {
   # See nixos/tests/attr.nix
   doCheck = false;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://savannah.nongnu.org/projects/attr/";
     description = "Library and tools for manipulating extended attributes";
@@ -47,6 +49,6 @@ stdenv.mkDerivation rec {
     badPlatforms = lib.platforms.microblaze;
     license = lib.licenses.gpl2Plus;
     teams = [ lib.teams.security-review ];
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "attr_project" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "attr_project" finalAttrs.version;
   };
-}
+})

From 4bbf95ce5360b96edb196de61f2ae2d3967dec02 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 00:45:41 +0200
Subject: [PATCH 072/551] bintools-wrapper: enable structuredAttrs

Required substitutions are either explicitly exported in bash code
or live in env, so this should just work (?)
---
 pkgs/build-support/bintools-wrapper/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 1a9ce996c0dd..69dc6afc9f93 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -478,6 +478,8 @@ stdenvNoCC.mkDerivation {
       apple-sdk.__spliced.buildTarget or apple-sdk;
   };
 
+  __structuredAttrs = true;
+
   meta =
     let
       bintools_ = optionalAttrs (bintools != null) bintools;

From da2e58bdb3c12c1369480c95dfc56c3663f26120 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 3 Aug 2026 19:15:56 +0000
Subject: [PATCH 073/551] ada: 3.4.4 -> 4.0.0

---
 pkgs/by-name/ad/ada/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ad/ada/package.nix b/pkgs/by-name/ad/ada/package.nix
index 79878f5a553b..4afbdecb59de 100644
--- a/pkgs/by-name/ad/ada/package.nix
+++ b/pkgs/by-name/ad/ada/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ada";
-  version = "3.4.4";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "ada-url";
     repo = "ada";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kfUbsqQ+CsqnySKgeL1GFJLcDe1Irivp4CoZG93BZYg=";
+    hash = "sha256-TvjoLUKO2+YgS1mlyglLb+rBLTO/SWSBVA2S34Z6kMI=";
   };
 
   nativeBuildInputs = [

From 15c5c3bfd639ac53e597ee45b60de531fa3e371e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ga=C3=ABl=20James?= <gaeljames@gmail.com>
Date: Mon, 3 Aug 2026 15:36:02 +0200
Subject: [PATCH 074/551] python3Packages.fastapi: 0.139.0 -> 0.141.1

---
 pkgs/development/python-modules/fastapi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 1be0d0d05b02..dd805f9b5a4e 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -41,7 +41,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastapi";
-  version = "0.139.0";
+  version = "0.141.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -49,7 +49,7 @@ buildPythonPackage (finalAttrs: {
     owner = "tiangolo";
     repo = "fastapi";
     tag = finalAttrs.version;
-    hash = "sha256-c4balkkmBv7zKRQnYRpRohVjP23m0HvtdiVrJtgNKYo=";
+    hash = "sha256-5P9aDMS7gLti2CBlrucvjgl4Od1mti9ityPdqxI1RIM=";
   };
 
   build-system = [ pdm-backend ];

From 6e8d3200c15ed8bf00dd1a30a95154ceefaa573b Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Tue, 4 Aug 2026 01:17:35 +0200
Subject: [PATCH 075/551] sdl3: 3.4.12 -> 3.4.14

Changelog: https://github.com/libsdl-org/SDL/releases/tag/release-3.4.14
---
 pkgs/by-name/sd/sdl3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index 9345096f3fa7..c3c6c7af9c6f 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -70,7 +70,7 @@ assert lib.assertMsg (ibusSupport -> dbusSupport) "SDL3 requires dbus support to
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3";
-  version = "3.4.12";
+  version = "3.4.14";
 
   outputs = [
     "lib"
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libsdl-org";
     repo = "SDL";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-b6l3HgdhqIe9LazJmLivbCJgbKPAS8S54fuB9xvgalI=";
+    hash = "sha256-HzV5Fq+PhJr/dQBCVm2WL1BdaI4GG+W+B0scttjdRuQ=";
   };
 
   postPatch =

From 0e2ae96228d85c31335f6e224bda30280e042f3d Mon Sep 17 00:00:00 2001
From: Yifei Sun <ysun@hey.com>
Date: Wed, 5 Aug 2026 16:38:08 +0200
Subject: [PATCH 076/551] nixVersions.git: 2.35pre20260619 -> 2.36pre20260804

---
 pkgs/tools/package-management/nix/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index f4e16059c591..e5759acb7273 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -208,12 +208,12 @@ lib.makeExtensible (
           src = fetchFromGitHub {
             owner = "NixOS";
             repo = "nix";
-            rev = "f8bb823a23bf6d62f4c8feb792a77702d7a49fe1";
-            hash = "sha256-eWBQ01zjUjTF6VyWzmt6fN6jI+vlCDtqYaJG1McIKpc=";
+            rev = "d8c24e6118d6fb323d4fcd2f311cda9c748452fa";
+            hash = "sha256-SbXYrP5NKa1ySGHvPWE0e39PMOczcyeiXTaxMFsv1vs=";
           };
         in
         (nixDependencies.callPackage ./modular/packages.nix {
-          version = "2.35pre20260619_${lib.substring 0 8 src.rev}";
+          version = "2.36pre20260804_${lib.substring 0 8 src.rev}";
           inherit teams;
           otherSplices = generateSplicesForNixComponents "nixComponents_git";
           src = removeFunctionalTests commonDisabledTests src;

From ffa600c96f16cf8a244fa71de6acedd095aacd64 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Wed, 5 Aug 2026 12:10:18 -0500
Subject: [PATCH 077/551] luaPackages.dkjson: 2.10-1 -> 2.11-1

---
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 12eb150be38c..4b3e5339398c 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -811,15 +811,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "dkjson";
-      version = "2.10-1";
+      version = "2.11-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/dkjson-2.10-1.rockspec";
-          sha256 = "0h49fv93h6n32xwwgwvrhb6w5rzvgjzyls6m9xhmcd94pbkih8v2";
+          url = "mirror://luarocks/dkjson-2.11-1.rockspec";
+          sha256 = "0fkgsqfd0k7pq9j3d1hrhsiha7dc145fbf7hqw0r7lzmp03vjfai";
         }).outPath;
       src = fetchurl {
-        url = "https://dkolf.de/dkjson-lua/dkjson-2.10.tar.gz";
-        sha256 = "092v9m13h7zl89qfgywbs22wdvniwr2lr3shjqrn91f4nl39xiz8";
+        url = "https://dkolf.de/dkjson-lua/dkjson-2.11.tar.gz";
+        sha256 = "16725vrd5apdxapj641cc0x218vp0ylfcf0z24wfffxwh7v9l5ks";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.6";

From f6ad1dd41af3db5f3bcd89d92c74bca768377ae8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 6 Aug 2026 02:36:41 +0000
Subject: [PATCH 078/551] libblake3: 1.8.5 -> 1.8.6

---
 pkgs/by-name/li/libblake3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libblake3/package.nix b/pkgs/by-name/li/libblake3/package.nix
index 08740597b3a3..74cc4afc1445 100644
--- a/pkgs/by-name/li/libblake3/package.nix
+++ b/pkgs/by-name/li/libblake3/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libblake3";
-  version = "1.8.5";
+  version = "1.8.6";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "BLAKE3-team";
     repo = "BLAKE3";
     tag = finalAttrs.version;
-    hash = "sha256-4Oany3uk0759YIZgD1gsONSFU1Mn/GAMvsSeP33J9Ts=";
+    hash = "sha256-dCRtXHTJnDSJQ2T5bux+ND4e+5uRIoUFn5gYXvMfZi8=";
   };
 
   sourceRoot = finalAttrs.src.name + "/c";

From 49f78952ada9a4260c3c90f54ed467de5f55196f Mon Sep 17 00:00:00 2001
From: r0chd <oskarrochowiak@gmail.com>
Date: Thu, 9 Jul 2026 00:26:42 +0200
Subject: [PATCH 079/551] polkit: use finalAttrs instead of rec, drop unused
 fetchpatch

---
 pkgs/by-name/po/polkit/package.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/po/polkit/package.nix b/pkgs/by-name/po/polkit/package.nix
index 723f80bcdc74..62a872bcd4cd 100644
--- a/pkgs/by-name/po/polkit/package.nix
+++ b/pkgs/by-name/po/polkit/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   pkg-config,
   glib,
   expat,
@@ -40,7 +39,7 @@ let
   system = "/run/current-system/sw";
   setuid = "/run/wrappers/bin";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "polkit";
   version = "127";
 
@@ -54,7 +53,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "polkit-org";
     repo = "polkit";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-YTugETy0rqu/bv53jV1UeGqSK79bRXR52EJNcTblvzo=";
   };
 
@@ -193,4 +192,4 @@ stdenv.mkDerivation rec {
     ];
     teams = [ lib.teams.freedesktop ];
   };
-}
+})

From 42bcfc615e27531473411f03163a042b61e6e9f6 Mon Sep 17 00:00:00 2001
From: r0chd <oskarrochowiak@gmail.com>
Date: Thu, 9 Jul 2026 00:29:43 +0200
Subject: [PATCH 080/551] polkit: add useConsoleKit option for session tracking

---
 pkgs/by-name/po/polkit/package.nix | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/po/polkit/package.nix b/pkgs/by-name/po/polkit/package.nix
index 62a872bcd4cd..381463f368af 100644
--- a/pkgs/by-name/po/polkit/package.nix
+++ b/pkgs/by-name/po/polkit/package.nix
@@ -21,6 +21,7 @@
   docbook_xml_dtd_412,
   gtk-doc,
   coreutils,
+  useConsoleKit ? false,
   useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
   systemdLibs,
   elogind,
@@ -43,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "polkit";
   version = "127";
 
+  disallowedReferences = lib.optional useConsoleKit systemdLibs;
+
   outputs = [
     "bin"
     "dev"
@@ -94,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
     dbus
     duktape
   ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && !useConsoleKit) [
     # On Linux, fall back to elogind when systemd support is off.
     (if useSystemd then systemdLibs else elogind)
   ];
@@ -145,7 +148,14 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dsystemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
-    "-Dsession_tracking=${if useSystemd then "logind" else "elogind"}"
+    "-Dsession_tracking=${
+      if useSystemd then
+        "logind"
+      else if useConsoleKit then
+        "ConsoleKit"
+      else
+        "elogind"
+    }"
   ];
 
   inherit doCheck;

From 935889d0981ce4128e6489bc1c9fc834ca649001 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Thu, 6 Aug 2026 16:38:07 -0700
Subject: [PATCH 081/551] duckdb: fix cross compilation

Assisted-by: Codex (GPT-5.6-Sol)
---
 pkgs/by-name/du/duckdb/package.nix | 41 ++++++++++++++++++++----------
 1 file changed, 28 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix
index 9c86d318fa57..555ba3a1cf12 100644
--- a/pkgs/by-name/du/duckdb/package.nix
+++ b/pkgs/by-name/du/duckdb/package.nix
@@ -5,15 +5,33 @@
   cmake,
   ninja,
   openssl,
-  openjdk11,
   python3,
-  unixodbc,
-  withJdbc ? false,
-  withOdbc ? false,
   versionCheckHook,
 }:
 
 let
+  canExecute = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  # Keep this in sync with DuckDBPlatform() in DuckDB's platform.hpp.
+  duckdbPlatform =
+    let
+      os =
+        if stdenv.hostPlatform.isWindows then
+          "windows"
+        else if stdenv.hostPlatform.isDarwin then
+          "osx"
+        else if stdenv.hostPlatform.isFreeBSD then
+          "freebsd"
+        else
+          "linux";
+      arch =
+        if stdenv.hostPlatform.isAarch64 then
+          "arm64"
+        else if stdenv.hostPlatform.is64bit then
+          "amd64"
+        else
+          "i686";
+    in
+    "${os}_${arch}${lib.optionalString stdenv.hostPlatform.isMusl "_musl"}${lib.optionalString stdenv.hostPlatform.isMinGW "_mingw"}";
   versions = lib.importJSON ./versions.json;
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -40,22 +58,19 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     python3
   ];
-  buildInputs = [
-    openssl
-  ]
-  ++ lib.optionals withJdbc [ openjdk11 ]
-  ++ lib.optionals withOdbc [ unixodbc ];
+  buildInputs = [ openssl ];
 
   cmakeFlags = [
     (lib.cmakeFeature "DUCKDB_EXTENSION_CONFIGS" "${finalAttrs.src}/.github/config/in_tree_extensions.cmake")
-    (lib.cmakeBool "BUILD_ODBC_DRIVER" withOdbc)
-    (lib.cmakeBool "JDBC_DRIVER" withJdbc)
     (lib.cmakeFeature "OVERRIDE_GIT_DESCRIBE" "v${finalAttrs.version}-0-g${finalAttrs.rev}")
     # development settings
-    (lib.cmakeBool "BUILD_UNITTESTS" finalAttrs.doInstallCheck)
+    (lib.cmakeBool "BUILD_UNITTESTS" finalAttrs.finalPackage.doInstallCheck)
+  ]
+  ++ lib.optionals (!canExecute) [
+    (lib.cmakeFeature "DUCKDB_EXPLICIT_PLATFORM" duckdbPlatform)
   ];
 
-  doInstallCheck = true;
+  doInstallCheck = canExecute;
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

From 7e52e1b78e196ca9a562863301379282848275c4 Mon Sep 17 00:00:00 2001
From: Adriel Velazquez <AdrielVelazquez@gmail.com>
Date: Sun, 7 Jun 2026 12:02:44 -0400
Subject: [PATCH 082/551] nixos/orbit: init module

---
 nixos/modules/module-list.nix               |   1 +
 nixos/modules/services/monitoring/orbit.nix | 182 ++++++++++++++++++++
 nixos/tests/all-tests.nix                   |   1 +
 nixos/tests/orbit.nix                       |  47 +++++
 pkgs/by-name/fl/fleet-desktop/package.nix   |   5 +-
 pkgs/by-name/fl/fleet-orbit/package.nix     |   5 +-
 6 files changed, 239 insertions(+), 2 deletions(-)
 create mode 100644 nixos/modules/services/monitoring/orbit.nix
 create mode 100644 nixos/tests/orbit.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index de6172266d5e..308f51bd18a5 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1067,6 +1067,7 @@
   ./services/monitoring/nezha.nix
   ./services/monitoring/ocsinventory-agent.nix
   ./services/monitoring/opentelemetry-collector.nix
+  ./services/monitoring/orbit.nix
   ./services/monitoring/osquery.nix
   ./services/monitoring/parsedmarc.nix
   ./services/monitoring/perses.nix
diff --git a/nixos/modules/services/monitoring/orbit.nix b/nixos/modules/services/monitoring/orbit.nix
new file mode 100644
index 000000000000..bbaa7f3a0627
--- /dev/null
+++ b/nixos/modules/services/monitoring/orbit.nix
@@ -0,0 +1,182 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.orbit;
+in
+{
+  options.services.orbit = {
+    enable = lib.mkEnableOption "Fleet Orbit agent" // {
+      description = "Enable the Fleet Orbit agent.";
+      example = lib.literalExpression ''
+        # Use an enrollment secret from a plaintext file managed outside the Nix store.
+        {
+          services.orbit = {
+            enable = true;
+            fleetUrl = "https://fleet.example.com";
+            enrollSecretPath = "/etc/fleet/enroll-secret";
+
+            desktop.enable = true;
+          };
+        }
+
+        # Use an enrollment secret from sops-nix.
+        { config, ... }:
+        {
+          sops.secrets.fleet-orbit-enroll-secret = { };
+
+          services.orbit = {
+            enable = true;
+            fleetUrl = "https://fleet.example.com";
+            enrollSecretPath = config.sops.secrets.fleet-orbit-enroll-secret.path;
+
+            desktop.enable = true;
+          };
+        }
+      '';
+    };
+
+    orbitPackage = lib.mkPackageOption pkgs "fleet-orbit" { };
+
+    osqueryPackage = lib.mkPackageOption pkgs "osquery" { };
+
+    desktop = {
+      enable = lib.mkEnableOption "Fleet Desktop tray application";
+
+      package = lib.mkPackageOption pkgs "fleet-desktop" { };
+
+      alternativeBrowserHost = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "fleet-browser.example.com";
+        description = ''
+          Alternative host to use for Fleet Desktop browser URLs. This can be
+          required when Fleet uses TLS client authentication.
+        '';
+      };
+    };
+
+    fleetUrl = lib.mkOption {
+      type = lib.types.str;
+      example = "https://fleet.example.com";
+      description = "The base URL of the Fleet server.";
+    };
+
+    enrollSecretPath = lib.mkOption {
+      type = lib.types.path;
+      example = "/run/secrets/fleet-enroll-secret";
+      description = ''
+        Path to a file containing the enroll secret for authenticating to the Fleet server.
+        This should point to a secret outside the Nix store, for example a sops-nix or agenix
+        secret path.
+      '';
+    };
+
+    fleetCertificate = lib.mkOption {
+      type = lib.types.path;
+      default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+      defaultText = lib.literalExpression "\"\${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt\"";
+      description = "Path to the Fleet server certificate chain.";
+    };
+
+    debug = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable debug logging.";
+    };
+
+    devMode = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Run Orbit in development mode.";
+    };
+
+    enableScripts = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable Fleet script execution.";
+    };
+
+    endUserEmail = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "user@example.com";
+      description = "End-user email to pass to Orbit.";
+    };
+
+    fleetManagedHostIdentityCertificate = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Configure Orbit to use Fleet-managed host identity certificates.
+        This requires a Fleet Enterprise Edition subscription.
+      '';
+    };
+
+    hostIdentifier = lib.mkOption {
+      type = lib.types.nullOr (
+        lib.types.enum [
+          "uuid"
+          "instance"
+        ]
+      );
+      default = null;
+      example = "uuid";
+      description = "Host identifier mode to use when Orbit and osquery enroll to Fleet.";
+    };
+
+    insecure = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Disable TLS certificate verification.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.orbit = {
+      description = "Fleet Orbit agent";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+
+      environment = lib.filterAttrs (_: value: value != null) {
+        ORBIT_FLEET_URL = cfg.fleetUrl;
+        ORBIT_ENROLL_SECRET_PATH = "%d/enroll-secret";
+        ORBIT_FLEET_CERTIFICATE = cfg.fleetCertificate;
+        ORBIT_DEBUG = lib.boolToString cfg.debug;
+        ORBIT_DEV_MODE = lib.boolToString cfg.devMode;
+        ORBIT_ENABLE_SCRIPTS = lib.boolToString cfg.enableScripts;
+        ORBIT_END_USER_EMAIL = cfg.endUserEmail;
+        ORBIT_FLEET_MANAGED_HOST_IDENTITY_CERTIFICATE = lib.boolToString cfg.fleetManagedHostIdentityCertificate;
+        ORBIT_HOST_IDENTIFIER = cfg.hostIdentifier;
+        ORBIT_INSECURE = lib.boolToString cfg.insecure;
+        ORBIT_FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST = cfg.desktop.alternativeBrowserHost;
+
+        ORBIT_DISABLE_KEYSTORE = "true";
+        ORBIT_DISABLE_UPDATES = "true";
+        ORBIT_FLEET_DESKTOP = lib.boolToString cfg.desktop.enable;
+        ORBIT_LOG_FILE = "/var/log/orbit/orbit.log";
+        ORBIT_OSQUERY_DB = "/var/lib/orbit/osquery.db";
+        ORBIT_ROOT_DIR = "/var/lib/orbit";
+        NIX_ORBIT_OSQUERYD_PATH = lib.getExe' cfg.osqueryPackage "osqueryd";
+        NIX_ORBIT_OSQUERY_LOG_PATH = "/var/log/orbit/osquery";
+        NIX_ORBIT_DESKTOP_PATH = if cfg.desktop.enable then lib.getExe cfg.desktop.package else null;
+      };
+
+      serviceConfig = {
+        ExecStart = lib.getExe cfg.orbitPackage;
+        LoadCredential = [ "enroll-secret:${cfg.enrollSecretPath}" ];
+        StateDirectory = "orbit";
+        LogsDirectory = "orbit";
+        TimeoutStartSec = 0;
+        Restart = "always";
+        RestartSec = 60;
+        KillMode = "control-group";
+        KillSignal = "SIGTERM";
+      };
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index f892390cefd5..e77eec5f9f55 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1296,6 +1296,7 @@ in
   openvswitch = runTest ./openvswitch.nix;
   optee = runTestOn [ "aarch64-linux" ] ./optee.nix;
   orangefs = runTest ./orangefs.nix;
+  orbit = runTestOn [ "x86_64-linux" ] ./orbit.nix;
   orthanc = runTest ./orthanc.nix;
   os-prober = handleTestOn [ "x86_64-linux" ] ./os-prober.nix { };
   osquery = handleTestOn [ "x86_64-linux" ] ./osquery.nix { };
diff --git a/nixos/tests/orbit.nix b/nixos/tests/orbit.nix
new file mode 100644
index 000000000000..2c9b1cfbc7a1
--- /dev/null
+++ b/nixos/tests/orbit.nix
@@ -0,0 +1,47 @@
+{ ... }:
+
+{
+  name = "orbit";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.etc."fleet/enroll-secret".text = "test-secret";
+
+      services.orbit = {
+        enable = true;
+        orbitPackage = pkgs.writeShellApplication {
+          name = "orbit";
+          text = ''
+            test "$ORBIT_FLEET_URL" = "https://fleet.example.test"
+            test -r "$ORBIT_ENROLL_SECRET_PATH"
+            test "$(cat "$ORBIT_ENROLL_SECRET_PATH")" = "test-secret"
+            test -x "$NIX_ORBIT_OSQUERYD_PATH"
+            sleep infinity
+          '';
+        };
+        osqueryPackage = pkgs.writeShellApplication {
+          name = "osqueryd";
+          text = "echo osquery";
+        };
+        desktop = {
+          enable = true;
+          package = pkgs.writeShellApplication {
+            name = "fleet-desktop";
+            text = "echo fleet-desktop";
+          };
+          alternativeBrowserHost = "fleet-browser.example.test";
+        };
+        fleetUrl = "https://fleet.example.test";
+        enrollSecretPath = "/etc/fleet/enroll-secret";
+        debug = true;
+        enableScripts = true;
+        hostIdentifier = "uuid";
+      };
+    };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("orbit.service")
+  '';
+}
diff --git a/pkgs/by-name/fl/fleet-desktop/package.nix b/pkgs/by-name/fl/fleet-desktop/package.nix
index 63e665ed0b52..162dc3617700 100644
--- a/pkgs/by-name/fl/fleet-desktop/package.nix
+++ b/pkgs/by-name/fl/fleet-desktop/package.nix
@@ -54,7 +54,10 @@ buildGoModule {
     changelog = "https://github.com/fleetdm/fleet/releases/tag/orbit-v${fleet-orbit.version}";
     license = lib.licenses.mit;
     mainProgram = "fleet-desktop";
-    maintainers = with lib.maintainers; [ adrielvelazquez ];
+    maintainers = with lib.maintainers; [
+      adrielvelazquez
+      faukah
+    ];
     platforms = lib.platforms.linux;
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
   };
diff --git a/pkgs/by-name/fl/fleet-orbit/package.nix b/pkgs/by-name/fl/fleet-orbit/package.nix
index 0404c214a29a..ac56a97c4d34 100644
--- a/pkgs/by-name/fl/fleet-orbit/package.nix
+++ b/pkgs/by-name/fl/fleet-orbit/package.nix
@@ -63,7 +63,10 @@ buildGoModule (finalAttrs: {
       }
     ];
     mainProgram = "orbit";
-    maintainers = with lib.maintainers; [ adrielvelazquez ];
+    maintainers = with lib.maintainers; [
+      adrielvelazquez
+      faukah
+    ];
     platforms = lib.platforms.linux;
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
   };

From 35bf5426bff1a58d31ca08dcb4b0876ec727c01e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 7 Aug 2026 06:56:20 +0000
Subject: [PATCH 083/551] unbound: 1.25.2 -> 1.26.0

---
 pkgs/by-name/un/unbound/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index a90eb0b1d364..2dba1d12c66d 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -63,13 +63,13 @@ assert lib.assertMsg (
 ) "unbound: withDoQ requires OpenSSL with QUIC support (OpenSSL >= 3.5)";
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.25.2";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "unbound";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-zt0JpVmct7w6ay+p8CdH6SGt/rL/v//e7K3MT8KZfOY=";
+    hash = "sha256-ESRboc5vwsNZ/Yynl2JGRWhH1QEYZumoTzgSvN3NbSU=";
   };
 
   outputs = [

From a8c66f9011e8714ade1458b2ad44ab1b679acd4d Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Fri, 7 Aug 2026 08:56:26 +0200
Subject: [PATCH 084/551] python3Packages.python-jenkins: Drop setuptools
 dependency

setuptools isn't used, so drop it.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 pkgs/development/python-modules/python-jenkins/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-jenkins/default.nix b/pkgs/development/python-modules/python-jenkins/default.nix
index 85ee49cea231..a2a41863d7be 100644
--- a/pkgs/development/python-modules/python-jenkins/default.nix
+++ b/pkgs/development/python-modules/python-jenkins/default.nix
@@ -6,7 +6,6 @@
   mock,
   pbr,
   pyyaml,
-  setuptools,
   six,
   multi-key-dict,
   testscenarios,
@@ -40,7 +39,6 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     pbr
     pyyaml
-    setuptools
     six
     multi-key-dict
     requests

From c32b01ce6dacf9d1f24e2d96f6fc7081bf16d03d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Sat, 11 Jul 2026 10:29:10 +0200
Subject: [PATCH 085/551] python3Packages.pbr: use setuptools_80

For jenkins-job-builder.
---
 pkgs/development/python-modules/pbr/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index d0ea8d49103c..48b2fad0aa8e 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -4,7 +4,7 @@
   callPackage,
   distutils,
   fetchPypi,
-  setuptools,
+  setuptools_80,
 }:
 
 buildPythonPackage rec {
@@ -17,11 +17,11 @@ buildPythonPackage rec {
     hash = "sha256-tGAE7DClMkZyaD7ISK7Z6PxQCw0mHUCjIpwtK7/O3Ck=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     distutils # for distutils.command in pbr/packaging.py
-    setuptools # for pkg_resources
+    setuptools_80 # for pkg_resources
   ];
 
   # check in passthru.tests.pytest to escape infinite recursion with fixtures

From 95fc5507b78df8940ecc247bf780c9101045f34d Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Fri, 7 Aug 2026 08:04:51 +0200
Subject: [PATCH 086/551] python3Packages.testscenarios: Drop setuptools
 dependency

setuptools isn't used, so drop it.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 pkgs/development/python-modules/testscenarios/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/testscenarios/default.nix b/pkgs/development/python-modules/testscenarios/default.nix
index 1daf777f6ede..7cc142fd2344 100644
--- a/pkgs/development/python-modules/testscenarios/default.nix
+++ b/pkgs/development/python-modules/testscenarios/default.nix
@@ -5,7 +5,6 @@
 
   # build-system
   pbr,
-  setuptools,
 
   # dependencies
   testtools,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     pbr
-    setuptools
   ];
 
   propagatedBuildInputs = [

From b8c70d6f18afa014d22ec98ef7ca34f13ef677eb Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Fri, 7 Aug 2026 08:57:06 +0200
Subject: [PATCH 087/551] python3Packages.testtools: Drop setuptools dependency

setuptools isn't used, so drop it.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 pkgs/development/python-modules/testtools/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/development/python-modules/testtools/default.nix b/pkgs/development/python-modules/testtools/default.nix
index 0ea71bcbe6af..0ceb7f1b7db5 100644
--- a/pkgs/development/python-modules/testtools/default.nix
+++ b/pkgs/development/python-modules/testtools/default.nix
@@ -7,9 +7,6 @@
   # build-system
   hatchling,
   hatch-vcs,
-
-  # dependencies
-  setuptools,
 }:
 
 buildPythonPackage rec {
@@ -29,8 +26,6 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [ "fixtures" ];
 
-  propagatedBuildInputs = lib.optionals (pythonAtLeast "3.12") [ setuptools ];
-
   # testscenarios has a circular dependency on testtools
   doCheck = false;
 

From 96a11d00505a49b5a328651bdd41c26e6187f8af Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Wed, 5 Aug 2026 19:43:36 +0200
Subject: [PATCH 088/551] jenkins-job-builder: 6.4.4 -> 6.5.0

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 .../python-modules/jenkins-job-builder/default.nix        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/jenkins-job-builder/default.nix b/pkgs/development/python-modules/jenkins-job-builder/default.nix
index 83e64b65474b..ef3de8c5dee7 100644
--- a/pkgs/development/python-modules/jenkins-job-builder/default.nix
+++ b/pkgs/development/python-modules/jenkins-job-builder/default.nix
@@ -10,7 +10,7 @@
   six,
   stevedore,
   pytestCheckHook,
-  setuptools,
+  setuptools_80,
   testtools,
   pytest-mock,
   nixosTests,
@@ -18,21 +18,21 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jenkins-job-builder";
-  version = "6.4.4";
+  version = "6.5.0";
   pyproject = true;
 
   # forge at opendev.org does not provide release tarballs
   src = fetchPypi {
     pname = "jenkins_job_builder";
     inherit (finalAttrs) version;
-    hash = "sha256-7PpCDpe3KLRpt+R/Nu+qxdDxLKWVqTiCPK3j+nNaum8=";
+    hash = "sha256-9E3tWR9olpAZrloh/dxsIztz2PJJfRJrPUzMvpuLFJ0=";
   };
 
   postPatch = ''
     export HOME=$(mktemp -d)
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     pbr

From aeac5f8550eee870bfce858ab9b5a717571bad1b Mon Sep 17 00:00:00 2001
From: Eamon Caton <eamon@cy2sec.comm.eng.osaka-u.ac.jp>
Date: Mon, 27 Jul 2026 09:26:29 +0900
Subject: [PATCH 089/551] poppler: fix mat2 build on Darwin by backporting
 upstream bugfix

---
 pkgs/development/libraries/poppler/default.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index c0a00366eac2..cff1f3cbff63 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   fetchFromGitLab,
+  fetchpatch,
   cairo,
   clang-tools,
   cmake,
@@ -62,7 +63,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "poppler-${suffix}";
-  version = "26.06.0"; # beware: updates often break cups-filters build, check scribus too!
+  version = "26.06.0";
 
   outputs = [
     "out"
@@ -74,6 +75,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-TLTlo9yMte7HUciiPIuhn2H5be3AzQfSruawyOLPa6Q=";
   };
 
+  patches = [
+    # Backports Darwin crash fix from upstream
+    # https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1743
+    (fetchpatch {
+      name = "darwin-mutex-lock-crash.patch";
+      url = "https://gitlab.freedesktop.org/poppler/poppler/-/commit/08f4bca6a669f9fce75dbab743db559a86591738.patch";
+      hash = "sha256-+eWqVK/v3Ys9k2+z/dCoS2o82m039UER1StMUW4PIgM=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja

From 0d6d1e535f58b354b262bc56c96a365bcbb21d2c Mon Sep 17 00:00:00 2001
From: Eamon Caton <eamon@cy2sec.comm.eng.osaka-u.ac.jp>
Date: Wed, 29 Jul 2026 12:51:19 +0900
Subject: [PATCH 090/551] poppler: add gtk3 to test closure for unit tests

---
 pkgs/development/libraries/poppler/default.nix | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index cff1f3cbff63..580d1fbfb73e 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -40,6 +40,7 @@
   cups-filters,
   gdal,
   gegl,
+  gtk3,
   inkscape,
   scribus,
   vips,
@@ -195,9 +196,17 @@ stdenv.mkDerivation (finalAttrs: {
       gdal = gdal.override { usePoppler = true; };
       python-poppler-qt5 = python3.pkgs.poppler-qt5;
 
-      pkg-config = testers.hasPkgConfigModules {
-        package = finalAttrs.finalPackage;
-      };
+      pkg-config =
+        testers.hasPkgConfigModules {
+          package = finalAttrs.finalPackage;
+        }
+        // lib.optionalAttrs (!minimal) {
+          # Poppler skips tests unless GTK3 is detected; add to closure
+          poppler-with-gtk-tests = finalAttrs.finalPackage.overrideAttrs (old: {
+            pname = "${old.pname}-gtk-tests";
+            buildInputs = old.buildInputs ++ [ gtk3 ];
+          });
+        };
     };
   };
 

From ea6542782d73f7a516052acfc458a78869e53df6 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 2 Aug 2026 14:52:55 +0200
Subject: [PATCH 091/551] nixos/nginx: generally turn off
 MemoryDenyWriteExecute

See #384302 for the issues associated with it.
---
 nixos/modules/services/web-servers/nginx/default.nix     | 6 +-----
 pkgs/servers/http/nginx/modules/lua-upstream/package.nix | 2 --
 pkgs/servers/http/nginx/modules/lua/package.nix          | 2 --
 3 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 0a0ccf403ebc..6bf841a0c527 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -1614,11 +1614,7 @@ in
           ];
           RestrictNamespaces = true;
           LockPersonality = true;
-          MemoryDenyWriteExecute =
-            !(
-              (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules)
-              || (lib.getName cfg.package == "openresty")
-            );
+          MemoryDenyWriteExecute = false; # for pcre2 & several plugins
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           RemoveIPC = true;
diff --git a/pkgs/servers/http/nginx/modules/lua-upstream/package.nix b/pkgs/servers/http/nginx/modules/lua-upstream/package.nix
index 02e24a2dae9d..8467c16d66e9 100644
--- a/pkgs/servers/http/nginx/modules/lua-upstream/package.nix
+++ b/pkgs/servers/http/nginx/modules/lua-upstream/package.nix
@@ -19,8 +19,6 @@ mkNginxPlugin (finalAttrs: {
 
   buildInputs = [ luajit_openresty ];
 
-  allowMemoryWriteExecute = true;
-
   meta = {
     description = "Expose Lua API to ngx_lua for Nginx upstreams";
     homepage = "https://github.com/openresty/lua-upstream-nginx-module";
diff --git a/pkgs/servers/http/nginx/modules/lua/package.nix b/pkgs/servers/http/nginx/modules/lua/package.nix
index f8f45586e4ab..fff949d6a66c 100644
--- a/pkgs/servers/http/nginx/modules/lua/package.nix
+++ b/pkgs/servers/http/nginx/modules/lua/package.nix
@@ -23,8 +23,6 @@ mkNginxPlugin (finalAttrs: {
     export LUAJIT_INC="$(realpath ${luajit_openresty}/include/luajit-*)"
   '';
 
-  allowMemoryWriteExecute = true;
-
   meta = {
     description = "Embed the Power of Lua";
     homepage = "https://github.com/openresty/lua-nginx-module";

From 9ace30d98e53f0a54f897262d0247437274db244 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 2 Aug 2026 14:53:42 +0200
Subject: [PATCH 092/551] nixos/{gitea,forgejo}: remove MemoryDenyWriteExecute

We don't use the experimental pcre2 allocator anymore that originally
hid the problem.
---
 nixos/modules/services/misc/forgejo.nix | 2 +-
 nixos/modules/services/misc/gitea.nix   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 6834ca2008ea..5ed68d6df619 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -777,7 +777,7 @@ in
         ];
         RestrictNamespaces = true;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         RemoveIPC = true;
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 3a0f637c5ca6..6c334776462a 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -953,7 +953,7 @@ in
         ++ lib.optional (useSendmail && config.services.postfix.enable) "AF_NETLINK";
         RestrictNamespaces = true;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         RemoveIPC = true;

From 009945d81e58f62d708948506f32df3faadb004a Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 4 Aug 2026 00:22:17 +0200
Subject: [PATCH 093/551] nixos/mympd: rm MemoryDenyWriteExecute

This package has a direct dependency on pcre2. By removing the sealloc
allocator, which allows MemoryDenyWriteExecute, but is experimental and
not recommended for production, this option needs to be turned off
again.
---
 nixos/modules/services/audio/mympd.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/audio/mympd.nix b/nixos/modules/services/audio/mympd.nix
index 3e728abaa4de..5f0b027d33bf 100644
--- a/nixos/modules/services/audio/mympd.nix
+++ b/nixos/modules/services/audio/mympd.nix
@@ -108,7 +108,7 @@ in
         DynamicUser = true;
         ExecStart = lib.getExe cfg.package;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         PrivateDevices = true;
         ProtectClock = true;
         ProtectControlGroups = true;

From 202b9427162d400954dbf6bb6fb385bdafb5a6b3 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 4 Aug 2026 00:23:10 +0200
Subject: [PATCH 094/551] nixos/mysql: rm MemoryDenyWriteExecute

This package has a direct dependency on pcre2. By removing the sealloc
allocator, which allows MemoryDenyWriteExecute, but is experimental and
not recommended for production, this option needs to be turned off
again.
---
 nixos/modules/services/databases/mysql.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index cfd7c8c76af3..9c3d31ea0616 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -752,7 +752,7 @@ in
             "AF_INET6"
           ];
           LockPersonality = true;
-          MemoryDenyWriteExecute = true;
+          MemoryDenyWriteExecute = false; # pcre2 jit
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           PrivateMounts = true;

From 10f3e6999aecc8119ec12ad7a3b9704bde0d0ce2 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 4 Aug 2026 00:23:31 +0200
Subject: [PATCH 095/551] nixos/cyrus-imap: rm MemoryDenyWriteExecute

This package has a direct dependency on pcre2. By removing the sealloc
allocator, which allows MemoryDenyWriteExecute, but is experimental and
not recommended for production, this option needs to be turned off
again.
---
 nixos/modules/services/mail/cyrus-imap.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/mail/cyrus-imap.nix b/nixos/modules/services/mail/cyrus-imap.nix
index 32a9869dd3c7..94b7d35850a8 100644
--- a/nixos/modules/services/mail/cyrus-imap.nix
+++ b/nixos/modules/services/mail/cyrus-imap.nix
@@ -355,7 +355,7 @@ in
         PrivateDevices = true;
         ProtectSystem = "full";
         CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectControlGroups = true;

From bff0736024ebf610dc6bd298ab0e5eb7ea7e0c01 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 4 Aug 2026 00:23:46 +0200
Subject: [PATCH 096/551] nixos/dovecot: rm MemoryDenyWriteExecute

This package has a direct dependency on pcre2. By removing the sealloc
allocator, which allows MemoryDenyWriteExecute, but is experimental and
not recommended for production, this option needs to be turned off
again.
---
 nixos/modules/services/mail/dovecot.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index 48b0795c53c1..950ac5859b62 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -1061,7 +1061,7 @@ in
           "CAP_SYS_RESOURCE"
         ];
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         NoNewPrivileges = false; # e.g for sendmail
         OOMPolicy = "continue";
         PrivateTmp = true;

From 8bddb1da20c473bbad815632af120e388cc78c55 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 4 Aug 2026 00:23:58 +0200
Subject: [PATCH 097/551] nixos/postfix: rm MemoryDenyWriteExecute

This package has a direct dependency on pcre2. By removing the sealloc
allocator, which allows MemoryDenyWriteExecute, but is experimental and
not recommended for production, this option needs to be turned off
again.
---
 nixos/modules/services/mail/postfix.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 7839796f1a91..758e8c95c470 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -1011,7 +1011,7 @@ in
             PrivateDevices = true;
             ProtectSystem = "full";
             CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
-            MemoryDenyWriteExecute = true;
+            MemoryDenyWriteExecute = false; # pcre2 jit
             ProtectKernelModules = true;
             ProtectKernelTunables = true;
             ProtectControlGroups = true;

From 3f216b4311b2a5531ce91eb10d370dc3335e028b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 4 Aug 2026 00:24:12 +0200
Subject: [PATCH 098/551] nixos/suricata: rm MemoryDenyWriteExecute

This package has a direct dependency on pcre2. By removing the sealloc
allocator, which allows MemoryDenyWriteExecute, but is experimental and
not recommended for production, this option needs to be turned off
again.
---
 nixos/modules/services/networking/suricata/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/suricata/default.nix b/nixos/modules/services/networking/suricata/default.nix
index 2e17655fc1e8..68b44b9d753d 100644
--- a/nixos/modules/services/networking/suricata/default.nix
+++ b/nixos/modules/services/networking/suricata/default.nix
@@ -270,7 +270,7 @@ in
               ProtectSystem = "strict";
               DevicePolicy = "closed";
               LockPersonality = true;
-              MemoryDenyWriteExecute = true;
+              MemoryDenyWriteExecute = false; # pcre2 jit
               ProtectHostname = true;
               ProtectProc = true;
               ProtectKernelLogs = true;

From 1c1d9c499dfd4d82537d333b85bcb818f8eed49d Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 4 Aug 2026 00:24:35 +0200
Subject: [PATCH 099/551] nixos/unit: rm MemoryDenyWriteExecute

This package has a direct dependency on pcre2. By removing the sealloc
allocator, which allows MemoryDenyWriteExecute, but is experimental and
not recommended for production, this option needs to be turned off
again.
---
 nixos/modules/services/web-servers/unit/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-servers/unit/default.nix b/nixos/modules/services/web-servers/unit/default.nix
index 301f01b5cf48..a1f6be076e2f 100644
--- a/nixos/modules/services/web-servers/unit/default.nix
+++ b/nixos/modules/services/web-servers/unit/default.nix
@@ -139,7 +139,7 @@ in
           "AF_INET6"
         ];
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         PrivateMounts = true;

From 1e9bd5d98ffecc4401b30b13b99e0c3945273e7b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 2 Aug 2026 14:51:49 +0200
Subject: [PATCH 100/551] pcre2: remove withJitSealloc

Replaces/Closes #384302

The problem with this allocator is that it's unstable not recommended
for general use. Remove it entirely.

This means that software using pcre2 and MemoryDenyWriteExecute=yes in
their units is broken with this commit.
---
 pkgs/by-name/pc/pcre2/package.nix             | 7 +------
 pkgs/development/interpreters/php/default.nix | 3 ---
 2 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/pkgs/by-name/pc/pcre2/package.nix b/pkgs/by-name/pc/pcre2/package.nix
index d846f87c0e42..91f18224b430 100644
--- a/pkgs/by-name/pc/pcre2/package.nix
+++ b/pkgs/by-name/pc/pcre2/package.nix
@@ -3,9 +3,6 @@
   stdenv,
   fetchurl,
   updateAutotoolsGnuConfigScriptsHook,
-  # Causes consistent segfaults on ELFv1 PPC64 when trying to use Perl regex in gnugrep
-  # https://github.com/PCRE2Project/pcre2/issues/762
-  withJitSealloc ? !(stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isAbiElfv1),
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -28,9 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-pcre2-32"
     # only enable jit on supported platforms which excludes Apple Silicon, see https://github.com/zherczeg/sljit/issues/51
     "--enable-jit=${if stdenv.hostPlatform.isS390x then "no" else "auto"}"
-  ]
-  # fix pcre jit in systemd units that set MemoryDenyWriteExecute=true like gitea
-  ++ lib.optional withJitSealloc "--enable-jit-sealloc";
+  ];
 
   outputs = [
     "bin"
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 28d68b002166..2222676354bd 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -12,9 +12,6 @@ let
     let
       base = callPackage ./generic.nix {
         stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
-        pcre2 = pcre2.override {
-          withJitSealloc = false; # See https://bugs.php.net/bug.php?id=78927 and https://bugs.php.net/bug.php?id=78630
-        };
         inherit version hash;
       };
     in

From b8633aab225ee3848c8273e95bdd0d754f8a6123 Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Fri, 7 Aug 2026 21:59:18 -0400
Subject: [PATCH 101/551] libcanberra: replace systemd dependency with
 systemdLibs

---
 pkgs/by-name/li/libcanberra/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libcanberra/package.nix b/pkgs/by-name/li/libcanberra/package.nix
index c9148035ba31..95edb352b9bf 100644
--- a/pkgs/by-name/li/libcanberra/package.nix
+++ b/pkgs/by-name/li/libcanberra/package.nix
@@ -12,8 +12,8 @@
   gst_all_1,
   libvorbis,
   libcap,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
   withAlsa ? stdenv.hostPlatform.isLinux,
   alsa-lib,
 }:
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional (gtkSupport == "gtk2") gtk2-x11
   ++ lib.optional (gtkSupport == "gtk3") gtk3-x11
   ++ lib.optional stdenv.hostPlatform.isLinux libcap
-  ++ lib.optional withSystemd systemd
+  ++ lib.optional withSystemd systemdLibs
   ++ lib.optional withAlsa alsa-lib;
 
   configureFlags = [

From 27d2abf6dda2494b19095ea6ba9cd05ff71bd8f9 Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Fri, 7 Aug 2026 22:07:52 -0400
Subject: [PATCH 102/551] appstream: replace systemd dependency with
 systemdLibs

---
 pkgs/development/libraries/appstream/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/appstream/default.nix b/pkgs/development/libraries/appstream/default.nix
index 095a87c4d853..61d93622913e 100644
--- a/pkgs/development/libraries/appstream/default.nix
+++ b/pkgs/development/libraries/appstream/default.nix
@@ -32,13 +32,13 @@
   pango,
   librsvg,
   bash-completion,
-  systemd,
+  systemdLibs,
   nixosTests,
   testers,
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
     && stdenv.hostPlatform.emulatorAvailable buildPackages,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -115,7 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
     bash-completion
   ]
   ++ lib.optionals withSystemd [
-    systemd
+    systemdLibs
   ];
 
   mesonFlags = [

From 062b060406e488282234810378a438e205d8404c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Aug 2026 07:29:58 +0000
Subject: [PATCH 103/551] graphviz: 15.1.0 -> 15.1.1

---
 pkgs/by-name/gr/graphviz/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/graphviz/package.nix b/pkgs/by-name/gr/graphviz/package.nix
index 6eae0490bca2..1a0439dbe8cc 100644
--- a/pkgs/by-name/gr/graphviz/package.nix
+++ b/pkgs/by-name/gr/graphviz/package.nix
@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphviz";
-  version = "15.1.0";
+  version = "15.1.1";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     tag = finalAttrs.version;
-    hash = "sha256-5v/ib8hwqHrJLs+jvDGvg0aJiKIt8ipXEd1EUzew7XU=";
+    hash = "sha256-nDuLQfYu0fzJXS8/oH6Bv9gGuLK+FwwgbPQE+nVKelw=";
   };
 
   nativeBuildInputs = [

From 72ae5b355f3c9d9d101e4cfd18d47007228b0c0d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Aug 2026 08:31:34 +0000
Subject: [PATCH 104/551] libsodium: 1.0.22-unstable-2026-07-08 ->
 1.0.22-unstable-2026-07-31

---
 pkgs/by-name/li/libsodium/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libsodium/package.nix b/pkgs/by-name/li/libsodium/package.nix
index 4b27cbb4c759..240617b896eb 100644
--- a/pkgs/by-name/li/libsodium/package.nix
+++ b/pkgs/by-name/li/libsodium/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsodium";
-  version = "1.0.22-unstable-2026-07-08";
+  version = "1.0.22-unstable-2026-07-31";
 
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "libsodium";
-    rev = "77a422c85a3b8b487de50c811b38d18394831ba6";
-    hash = "sha256-Ahka2PnrmYvTLjZMzik5mFsxhDpMLRMKT/I5ftUb0Xc=";
+    rev = "701aa826b97dc84a353d70a551d49dc26da539c5";
+    hash = "sha256-vJK7nuvy22EWCdau9cn4HOvO8XDiVQXwf/zwhq9R9Jg=";
   };
 
   outputs = [

From 14f4b7af5a50acfeac4814d0554576a3f8d43ec4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Aug 2026 09:44:26 +0000
Subject: [PATCH 105/551] geoclue2: 2.8.1 -> 2.8.2

---
 pkgs/by-name/ge/geoclue2/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ge/geoclue2/package.nix b/pkgs/by-name/ge/geoclue2/package.nix
index 951d6e1444c1..a2cf3a7ee8ee 100644
--- a/pkgs/by-name/ge/geoclue2/package.nix
+++ b/pkgs/by-name/ge/geoclue2/package.nix
@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geoclue";
-  version = "2.8.1";
+  version = "2.8.2";
 
   outputs = [
     "out"
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "geoclue";
     repo = "geoclue";
     tag = finalAttrs.version;
-    hash = "sha256-CyZhUMAa2vMUi61sL+gGBZFxGo0lu7Cm68fTjcbblTg=";
+    hash = "sha256-fjF0yd3+b+q3gTW2PpPNFE6zQafilj/g9rXWSgs/XGE=";
   };
 
   patches = [

From 4a7534d8a03f667c3cb2e29f047e9d8adf1f6f77 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 8 Aug 2026 16:29:59 +0300
Subject: [PATCH 106/551] fmt: unconditionalize patch

---
 pkgs/development/libraries/fmt/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/fmt/default.nix b/pkgs/development/libraries/fmt/default.nix
index 641a91d75629..a3bcaac532e9 100644
--- a/pkgs/development/libraries/fmt/default.nix
+++ b/pkgs/development/libraries/fmt/default.nix
@@ -106,7 +106,7 @@ in
     version = "12.2.0";
     hash = "sha256-Tc7PmNxUv7ajw6GaHPGEEtrD/fl6is7RB8TPestJa1o=";
 
-    patches = lib.optionals stdenv.is32bit [
+    patches = [
       # fix build on 32-bit targets
       # FIXME: remove in next update
       (fetchpatch {

From f8629eeb4bd1f78b65bad68576a6d560a10f47ce Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:45:13 +0000
Subject: [PATCH 107/551] perlPackages.CSSMinifierXS: 0.13 -> 0.15

Fixes CVE-2026-13593.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 34f6193bc6a3..42bf62c3f28c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7965,10 +7965,10 @@ with self;
 
   CSSMinifierXS = buildPerlPackage {
     pname = "CSS-Minifier-XS";
-    version = "0.13";
+    version = "0.15";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/G/GT/GTERMARS/CSS-Minifier-XS-0.13.tar.gz";
-      hash = "sha256-xBnjCM3IKvHCXWuNB7L/JjR6Yit6Y+wghWq+jbQFH4I=";
+      url = "mirror://cpan/authors/id/G/GT/GTERMARS/CSS-Minifier-XS-0.15.tar.gz";
+      hash = "sha256-iprSIxYtpGceP4EsSlXyl3OUg70xar2kH0wn6K3XhVM=";
     };
     buildInputs = [ TestDiagINC ];
     meta = {

From 27574bbdf94ffde412ac7343ae367dca5785e4d8 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:47:39 +0000
Subject: [PATCH 108/551] perlPackages.CGISession: 4.48 -> 4.49

Fixes CVE-2026-56016 in CGI::Session::ID::md5. The fix replaces rand()
with Crypt::SysRandom.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 42bf62c3f28c..6ad90958887a 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4627,12 +4627,15 @@ with self;
 
   CGISession = buildPerlModule {
     pname = "CGI-Session";
-    version = "4.48";
+    version = "4.49";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MA/MARKSTOS/CGI-Session-4.48.tar.gz";
-      hash = "sha256-RnVkYcJM52ZrgQjduW26thJpnfMBLIDvEQFmGf4VVPc=";
+      url = "mirror://cpan/authors/id/M/MA/MARKSTOS/CGI-Session-4.49.tar.gz";
+      hash = "sha256-X9iKgwo19UUmeH8DauXkp9FLYcQUzSmthjG/RuaXEgc=";
     };
-    propagatedBuildInputs = [ CGI ];
+    propagatedBuildInputs = [
+      CGI
+      CryptSysRandom
+    ];
     meta = {
       description = "Persistent session data in CGI applications";
       license = lib.licenses.artistic1;

From aa5e047da036ff9e1165a1323e09e49b438537c8 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:48:17 +0000
Subject: [PATCH 109/551] perlPackages.HTMLGumbo: 0.18 -> 0.20

Fixes CVE-2025-15646.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6ad90958887a..71ceeeb645a2 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16376,10 +16376,10 @@ with self;
 
   HTMLGumbo = buildPerlModule {
     pname = "HTML-Gumbo";
-    version = "0.18";
+    version = "0.20";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RUZ/HTML-Gumbo-0.18.tar.gz";
-      hash = "sha256-v1C2HCRlbMP8lYYC2AqcfQFyR6842Nv6Dp3sW3VCXV8=";
+      url = "mirror://cpan/authors/id/B/BP/BPS/HTML-Gumbo-0.20.tar.gz";
+      hash = "sha256-ImEK+8bIfgZ92E9/EZo9J4Ie1kEwNFU8Ga694iEdiDU=";
     };
     propagatedBuildInputs = [ AlienLibGumbo ];
     meta = {

From 9f90bb0e193dab691d56860e75aa226e9013e7cc Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Sat, 8 Aug 2026 17:36:40 +0200
Subject: [PATCH 110/551] python3Packages.unittestCheckHook: make discover
 optional

---
 .../interpreters/python/hooks/unittest-check-hook.sh       | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh b/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh
index 3ee947e278e6..151ea81cf134 100644
--- a/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh
@@ -10,11 +10,16 @@ unittestCheckPhase() {
     local -a flagsArray=()
 
     # Compatibility layer to the obsolete unittestFlagsArray
+    if [[ -z "${dontUseUnittestDiscover-}" ]]; then
+      flagsArray+=("discover")
+    fi
+
     eval "flagsArray+=(${unittestFlagsArray[*]-})"
 
     concatTo flagsArray unittestFlags
+
     echoCmd 'unittest flags' "${flagsArray[@]}"
-    @pythonCheckInterpreter@ -m unittest discover "${flagsArray[@]}"
+    @pythonCheckInterpreter@ -m unittest "${flagsArray[@]}"
 
     runHook postCheck
     echo "Finished executing unittestCheckPhase"

From 11acdf3f307c8aa708e62655b7eab4832ac732eb Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:49:28 +0000
Subject: [PATCH 111/551] perlPackages.StringUtil: 1.34 -> 1.36

Fixes CVE-2026-14895. Upstream switched from Module::Build to
ExtUtils::MakeMaker in 1.35.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 71ceeeb645a2..7b34c7e62275 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -32174,14 +32174,13 @@ with self;
     };
   };
 
-  StringUtil = buildPerlModule {
+  StringUtil = buildPerlPackage {
     pname = "String-Util";
-    version = "1.34";
+    version = "1.36";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/B/BA/BAKERSCOT/String-Util-1.34.tar.gz";
-      hash = "sha256-MZzozWZTQeVlIfoVXZYqGTKOkNn3A2dlklzN4mclxGk=";
+      url = "mirror://cpan/authors/id/B/BA/BAKERSCOT/String-Util-1.36.tar.gz";
+      hash = "sha256-UXsasyVm/U1ei+I9mTOc47/+4pEsX/KfXclYcP9Pyw4=";
     };
-    buildInputs = [ ModuleBuildTiny ];
     meta = {
       description = "String processing utility functions";
       homepage = "https://github.com/scottchiefbaker/String-Util";

From d3988cb7a81aa4dd16169f0d7db4c99513033c48 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Fri, 5 Jun 2026 06:24:46 +0300
Subject: [PATCH 112/551] iproute2: add `man` output

out: 5112K -> 4460K
man: 0K -> 652K
---
 pkgs/by-name/ip/iproute2/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index 2ad8fa7c8a26..e43cf30bec6b 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation rec {
     "out"
     "dev"
     "scripts"
+    "man"
   ];
 
   configureFlags = [

From d24d4b22cf1283f86b9b7ab9119f8b7745b6684b Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Fri, 5 Jun 2026 06:24:46 +0300
Subject: [PATCH 113/551] iproute2: remove seemingly useless `DOCDIR`

also use `--replace-fail` instead of `--replace`

`nix store make-content-addressed` gives the same output
before and after this change
---
 pkgs/by-name/ip/iproute2/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index e43cf30bec6b..886f42955dd2 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace Makefile \
-      --replace "CC := gcc" "CC ?= $CC"
+      --replace-fail "CC := gcc" "CC ?= $CC"
   '';
 
   outputs = [
@@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
   makeFlags = [
     "PREFIX=$(out)"
     "SBINDIR=$(out)/sbin"
-    "DOCDIR=$(TMPDIR)/share/doc/${pname}" # Don't install docs
     "HDRDIR=$(dev)/include/iproute2"
   ]
   ++ lib.optionals stdenv.hostPlatform.isStatic [

From 03c97e7c65791fb395d90c5ed530d354d7180518 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Thu, 11 Jun 2026 01:50:52 +0300
Subject: [PATCH 114/551] iproute2: use `finalAttrs`

does not change the derivation
---
 pkgs/by-name/ip/iproute2/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index 886f42955dd2..ba4c27edf6ff 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -16,12 +16,12 @@
   pkgsStatic,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "iproute2";
   version = "7.1.0";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/net/iproute2/iproute2-${version}.tar.xz";
+    url = "mirror://kernel/linux/utils/net/iproute2/iproute2-${finalAttrs.version}.tar.xz";
     hash = "sha256-/Z+huVgJQXFXyoPdcpV+MmG9vOiWNTy5NvgK8LM6S1w=";
   };
 
@@ -105,4 +105,4 @@ stdenv.mkDerivation rec {
       fpletz
     ];
   };
-}
+})

From f4d68ec73cb33eccd8edbf5e4b69c169c7fa2175 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Thu, 11 Jun 2026 01:38:17 +0300
Subject: [PATCH 115/551] iproute2: `strictDeps` & `__structuredAttrs`

`nix store make-content-addressed` gives the same output
before and after this change
---
 pkgs/by-name/ip/iproute2/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index ba4c27edf6ff..dd3baede3a0f 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -86,6 +86,8 @@ stdenv.mkDerivation (finalAttrs: {
     libbpf
   ];
 
+  __structuredAttrs = true;
+  strictDeps = true;
   enableParallelBuilding = true;
 
   passthru.updateScript = gitUpdater {

From 33aaeca55443b2db97567b97ea26b700953a12ea Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sat, 8 Aug 2026 17:24:20 -0400
Subject: [PATCH 116/551] shadow: 4.20.0 -> 4.20.2

Diff: https://github.com/shadow-maint/shadow/compare/4.20.0...4.20.2
---
 pkgs/by-name/sh/shadow/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sh/shadow/package.nix b/pkgs/by-name/sh/shadow/package.nix
index f47476196c2a..5c3c506ca15f 100644
--- a/pkgs/by-name/sh/shadow/package.nix
+++ b/pkgs/by-name/sh/shadow/package.nix
@@ -33,13 +33,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shadow";
-  version = "4.20.0";
+  version = "4.20.2";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
     repo = "shadow";
     tag = finalAttrs.version;
-    hash = "sha256-UafTyfK+pmW2wyAQnvHov9KIorf1HSc6haskfv7auHs=";
+    hash = "sha256-uZQHIRjuXl1QQE5VCbdT6c+NEhFzb06WbjhH2wplU1E=";
   };
 
   outputs = [

From 5aacebcd9eca53ef64b5eba79121dab6e36cb459 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Sun, 9 Aug 2026 05:40:55 +0200
Subject: [PATCH 117/551] python3Packages.jsonpatch: migrate to pyproject

---
 pkgs/development/python-modules/jsonpatch/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jsonpatch/default.nix b/pkgs/development/python-modules/jsonpatch/default.nix
index 962ab4d756c7..2255e6fc1e36 100644
--- a/pkgs/development/python-modules/jsonpatch/default.nix
+++ b/pkgs/development/python-modules/jsonpatch/default.nix
@@ -4,12 +4,13 @@
   fetchFromGitHub,
   jsonpointer,
   pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "jsonpatch";
   version = "1.33";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stefankoegl";
@@ -18,7 +19,9 @@ buildPythonPackage rec {
     hash = "sha256-JHBB64LExzHQVoFF2xcsqGlNWX/YeEBa1M/TmfeQLWI=";
   };
 
-  propagatedBuildInputs = [ jsonpointer ];
+  build-system = [ setuptools ];
+
+  dependencies = [ jsonpointer ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 

From b35f431c0db72720057c30a247c847ccad84846f Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Sun, 9 Aug 2026 05:41:50 +0200
Subject: [PATCH 118/551] python3Packages.jsonpatch: use finalAttrs,
 __structuredAttrs

---
 pkgs/development/python-modules/jsonpatch/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/jsonpatch/default.nix b/pkgs/development/python-modules/jsonpatch/default.nix
index 2255e6fc1e36..ebff042dfe12 100644
--- a/pkgs/development/python-modules/jsonpatch/default.nix
+++ b/pkgs/development/python-modules/jsonpatch/default.nix
@@ -7,15 +7,17 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "jsonpatch";
   version = "1.33";
+
+  __structuredAttrs = true;
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stefankoegl";
     repo = "python-json-patch";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-JHBB64LExzHQVoFF2xcsqGlNWX/YeEBa1M/TmfeQLWI=";
   };
 
@@ -35,4 +37,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})

From a1f52543006d25261136adff8917b5743ac9887a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Aug 2026 11:08:04 +0000
Subject: [PATCH 119/551] libffi: 3.7.1 -> 3.8.0

---
 pkgs/by-name/li/libffiReal/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libffiReal/package.nix b/pkgs/by-name/li/libffiReal/package.nix
index 069f6508d0ce..3d34ab9f068a 100644
--- a/pkgs/by-name/li/libffiReal/package.nix
+++ b/pkgs/by-name/li/libffiReal/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libffi";
-  version = "3.7.1";
+  version = "3.8.0";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-1emmY43b0lE921RRjrZ+S75vpwe8wBwQ9iEvCgiNgZ0=";
+    hash = "sha256-faPi2aFx6woDj1kuytP/K7JVDzSW2Hs7Ka0M9EMMDbQ=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus

From 670a1650c2b924f116a77b493b306bbf2ec7f104 Mon Sep 17 00:00:00 2001
From: robin <me@robinwobin.dev>
Date: Sun, 9 Aug 2026 13:52:17 +0200
Subject: [PATCH 120/551] luajit_2_1: 2.1.1774638290 -> 2.1.1785577137

closes https://github.com/NixOS/nixpkgs/issues/548383

Co-authored-by: june <me@koi.rip>
---
 pkgs/development/interpreters/luajit/2.1.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/interpreters/luajit/2.1.nix b/pkgs/development/interpreters/luajit/2.1.nix
index 84c188166673..e7f48f19a432 100644
--- a/pkgs/development/interpreters/luajit/2.1.nix
+++ b/pkgs/development/interpreters/luajit/2.1.nix
@@ -8,13 +8,13 @@
 callPackage ./default.nix {
   # The patch version is the timestamp of the git commit,
   # obtain via `cat $(nix-build -A luajit_2_1.src)/.relver`
-  version = "2.1.1774638290";
+  version = "2.1.1785577137";
 
   src = fetchFromGitHub {
     owner = "LuaJIT";
     repo = "LuaJIT";
-    rev = "fbb36bb6bfa88716a47c58bcf9ce9f2ef752abac";
-    hash = "sha256-BqH66q38mJpIYJgPiSPt7I0B3VLBvuDRRTiMJ7ldkBI=";
+    rev = "4886b676a698acc4bbdf54adfabb3e33a8c020e8";
+    hash = "sha256-3nTyPcphBQN2segb5bxBgvrWHodN/ckRy4AGS8lDL44=";
   };
 
   inherit self passthruFun;

From 933765c9ecd54627caeaf66de401bed8a2ddb7c9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 9 Aug 2026 13:42:10 +0200
Subject: [PATCH 121/551] nspr: 4.39 -> 4.40

https://github.com/mozilla/nspr/releases/tag/NSPR_4_40_RTM
---
 pkgs/by-name/ns/nspr/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ns/nspr/package.nix b/pkgs/by-name/ns/nspr/package.nix
index 372a7b3f067f..9784147f643b 100644
--- a/pkgs/by-name/ns/nspr/package.nix
+++ b/pkgs/by-name/ns/nspr/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nspr";
-  version = "4.39";
+  version = "4.40";
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${finalAttrs.version}/src/nspr-${finalAttrs.version}.tar.gz";
-    hash = "sha256-u9Au6HpVZ2Bjpj5byBngIn3iZmtHMHsqATRBTN9CNo4=";
+    hash = "sha256-wMGITGJ/Pbeng/fHMUxpUiayBDaWeR0VUZ5+BXjBm9w=";
   };
 
   patches = [
@@ -53,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
+    changelog = "https://github.com/mozilla/nspr/releases/tag/NSPR_${lib.concatStringsSep "_" (lib.splitVersion finalAttrs.version)}_RTM";
     homepage = "https://firefox-source-docs.mozilla.org/nspr/index.html";
     description = "Netscape Portable Runtime, a platform-neutral API for system-level and libc-like functions";
     maintainers = with lib.maintainers; [

From a617c0f9ec4a370e7dd74ae403089c4da733cfe9 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sun, 9 Aug 2026 17:48:30 +0200
Subject: [PATCH 122/551] python3Packages.tkinter: build with tcl/tk 9.0 for
 python 3.14+

Upstream Python 3.14 ships with tcl/tk 9.0 since Python 3.14.7 [1].

For Python 3.15+, also the tkinter documentation states that binary
releases are bundled with tcl/tk 9.0 [2].

[1] https://github.com/python/cpython/issues/124111
[2] https://docs.python.org/3.15/library/tkinter.html
---
 pkgs/top-level/python-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 733cdd484cf1..760f75e394dd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -20458,8 +20458,8 @@ self: super: with self; {
         # Tcl/Tk 9.0 support in Tkinter is not quite ready yet:
         # - https://github.com/python/cpython/issues/124111
         # - https://github.com/python/cpython/issues/104568
-        tcl = pkgs.tcl-8_6;
-        tk = pkgs.tk-8_6;
+        tcl = if pythonAtLeast "3.14" then pkgs.tcl-9_0 else pkgs.tcl-8_6;
+        tk = if pythonAtLeast "3.14" then pkgs.tk-9_0 else pkgs.tk-8_6;
       };
 
   tkinter-gl = callPackage ../development/python-modules/tkinter-gl { };

From 416c8cc9a08bf3dac7e51a1c49aea1c23a54721f Mon Sep 17 00:00:00 2001
From: averyv <avery@averyv.me>
Date: Sat, 16 May 2026 22:38:33 +0100
Subject: [PATCH 123/551] mbedtls: enable __structuredAttrs

---
 pkgs/by-name/mb/mbedtls/generic.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/mb/mbedtls/generic.nix b/pkgs/by-name/mb/mbedtls/generic.nix
index b74fe03e288e..8204cd73e95f 100644
--- a/pkgs/by-name/mb/mbedtls/generic.nix
+++ b/pkgs/by-name/mb/mbedtls/generic.nix
@@ -19,6 +19,7 @@
 stdenv.mkDerivation rec {
   pname = "mbedtls";
   inherit version;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Mbed-TLS";

From 5a2bdee423b8107ee7f157c3158b407610b426ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 9 Aug 2026 09:04:52 -0700
Subject: [PATCH 124/551] python3Packages.openai: 2.41.1 -> 2.53.0

Diff: https://github.com/openai/openai-python/compare/v2.41.1...v2.53.0

Changelog: https://github.com/openai/openai-python/blob/v2.53.0/CHANGELOG.md
---
 .../python-modules/openai/default.nix         | 42 +++++++++++++------
 1 file changed, 29 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index 41871cd05921..b1dbf302ec82 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -21,11 +21,17 @@
   aiohttp,
   httpx-aiohttp,
 
+  # optional-dependencies (bedock)
+  botocore,
+
   # optional-dependencies (datalib)
   numpy,
   pandas,
   pandas-stubs,
 
+  # optional-dependencies (httpx2)
+  httpx2,
+
   # optional-dependencies (realtime)
   websockets,
 
@@ -36,7 +42,7 @@
   pytestCheckHook,
   dirty-equals,
   inline-snapshot,
-  nest-asyncio,
+  jsonschema,
   pytest-asyncio,
   pytest-mock,
   pytest-xdist,
@@ -49,16 +55,16 @@
   withVoiceHelpers ? true,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "openai";
-  version = "2.41.1";
+  version = "2.53.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "openai-python";
-    tag = "v${version}";
-    hash = "sha256-jSkBxZY5POlrznhBwFMR2NcL92uGRSYI6BDDC3C7RfU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XwiSIKjYD07zhx8uIO8wsPWdAASBCJ5KqFUgdk+uaUU=";
   };
 
   postPatch = ''substituteInPlace pyproject.toml --replace-fail "hatchling==1.26.3" "hatchling"'';
@@ -78,21 +84,29 @@ buildPythonPackage rec {
     tqdm
     typing-extensions
   ]
-  ++ lib.optionals withAiohttp optional-dependencies.aiohttp
-  ++ lib.optionals withDatalib optional-dependencies.datalib
-  ++ lib.optionals withRealtime optional-dependencies.realtime
-  ++ lib.optionals withVoiceHelpers optional-dependencies.voice-helpers;
+  ++ lib.optionals withAiohttp finalAttrs.passthru.optional-dependencies.aiohttp
+  ++ lib.optionals withDatalib finalAttrs.passthru.optional-dependencies.datalib
+  ++ lib.optionals withRealtime finalAttrs.passthru.optional-dependencies.realtime
+  ++ lib.optionals withVoiceHelpers finalAttrs.passthru.optional-dependencies.voice-helpers;
 
   optional-dependencies = {
     aiohttp = [
       aiohttp
       httpx-aiohttp
     ];
+    bedrock = [
+      botocore
+    ];
     datalib = [
       numpy
       pandas
       pandas-stubs
     ];
+    httpx2 = [
+      anyio
+      httpx
+      httpx2
+    ];
     realtime = [
       websockets
     ];
@@ -108,12 +122,14 @@ buildPythonPackage rec {
     pytestCheckHook
     dirty-equals
     inline-snapshot
-    nest-asyncio
+    jsonschema
     pytest-asyncio
     pytest-mock
     pytest-xdist
     respx
-  ];
+  ]
+  # including pandas-stubs would cause infinite recursion
+  ++ lib.concatAttrValues (lib.removeAttrs finalAttrs.passthru.optional-dependencies [ "datalib" ]);
 
   disabledTestPaths = [
     # Test makes network requests
@@ -126,8 +142,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python client library for the OpenAI API";
     homepage = "https://github.com/openai/openai-python";
-    changelog = "https://github.com/openai/openai-python/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/openai/openai-python/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.malo ];
   };
-}
+})

From cd5bb46c12bebc844ee81cbb8a3068bd2c90d18b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 9 Aug 2026 09:20:36 -0700
Subject: [PATCH 125/551] python3Packages.openai: don't propagate optional
 dependencies

---
 pkgs/development/python-modules/openai/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index b1dbf302ec82..60af6eade212 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -49,10 +49,10 @@
   respx,
 
   # optional-dependencies toggle
-  withAiohttp ? true,
+  withAiohttp ? false,
   withDatalib ? false,
-  withRealtime ? true,
-  withVoiceHelpers ? true,
+  withRealtime ? false,
+  withVoiceHelpers ? false,
 }:
 
 buildPythonPackage (finalAttrs: {

From b5fa4928ecbdcdd2d5f71f5654ddfcb7848ce72b Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Sun, 9 Aug 2026 18:03:02 +0200
Subject: [PATCH 126/551] gogdl: 1.2.2 -> 1.3.0

Changelog:
https://github.com/Heroic-Games-Launcher/heroic-gogdl/releases/tag/v1.3.0
Diff:
https://github.com/Heroic-Games-Launcher/heroic-gogdl/compare/v1.2.2...v1.3.0

Co-authored-by: Keenan Weaver <keenanweaver@protonmail.com>
---
 pkgs/by-name/go/gogdl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/go/gogdl/package.nix b/pkgs/by-name/go/gogdl/package.nix
index 85547311f399..a05251742aec 100644
--- a/pkgs/by-name/go/gogdl/package.nix
+++ b/pkgs/by-name/go/gogdl/package.nix
@@ -6,7 +6,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gogdl";
-  version = "1.2.2";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -14,7 +14,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     repo = "heroic-gogdl";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-gXAlZa4rml8fH54jpOIXZN0/1iieLpZwpii5ICHQ2Sc=";
+    hash = "sha256-tTd41ufxPObXwLpA1F0HXNEROnJwHt4WpojsRnNLml0=";
   };
 
   build-system = with python3Packages; [

From 0ef4cd19ecb4d9789a6e1d22d3795f7ca11f051f Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Sun, 9 Aug 2026 18:11:59 +0200
Subject: [PATCH 127/551] legendary-gl: 0.20.34 -> 0.21.0; modernize

Changelog: https://github.com/legendary-gl/legendary/releases/tag/0.21.0
Diff: https://github.com/legendary-gl/legendary/compare/0.20.34...0.21.0

Co-authored-by: Keenan Weaver <keenanweaver@protonmail.com>
---
 pkgs/by-name/le/legendary-gl/package.nix | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/le/legendary-gl/package.nix b/pkgs/by-name/le/legendary-gl/package.nix
index a002532fa7bd..7a95a86a08b4 100644
--- a/pkgs/by-name/le/legendary-gl/package.nix
+++ b/pkgs/by-name/le/legendary-gl/package.nix
@@ -1,27 +1,28 @@
 {
   lib,
-  gitUpdater,
+  nix-update-script,
   fetchFromGitHub,
   python3Packages,
 }:
 
-python3Packages.buildPythonApplication {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "legendary-gl"; # Name in pypi
-  version = "0.20.34";
+  version = "0.21.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "legendary-gl";
     repo = "legendary";
-    rev = "56d439ed2d3d9f34e2b08fa23e627c23a487b8d6";
-    hash = "sha256-yCHeeEGw+9gtRMGyIhbStxJhmSM/1Fqly7HSRDkZILQ=";
+    tag = finalAttrs.version;
+    hash = "sha256-k5zVjXibYWS0F1by1uNOynuun9WfU0WuK3ResqsG7I0=";
   };
 
   build-system = with python3Packages; [
-    setuptools
+    uv-build
   ];
 
   dependencies = with python3Packages; [
+    pycryptodomex
     requests
     filelock
   ];
@@ -31,7 +32,7 @@ python3Packages.buildPythonApplication {
 
   pythonImportsCheck = [ "legendary" ];
 
-  passthru.updateScript = gitUpdater { };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Free and open-source Epic Games Launcher alternative";
@@ -40,4 +41,4 @@ python3Packages.buildPythonApplication {
     maintainers = with lib.maintainers; [ equirosa ];
     mainProgram = "legendary";
   };
-}
+})

From f0afd34d132c7ea396141ee0ee6493b5ae1a3d8e Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Sun, 9 Aug 2026 18:18:14 +0200
Subject: [PATCH 128/551] heroic{,-unwrapped}: 2.22.0 -> 2.22.1; use nixpkgs
 legendary-gl

Changelog:
https://github.com/Heroic-Games-Launcher/HeroicGamesLauncher/releases/tag/v2.22.1
Diff:
https://github.com/Heroic-Games-Launcher/HeroicGamesLauncher/compare/v2.22.0...v2.22.1

pin electron version
use nixpkgs `legendary-gl`

Co-authored-by: Keenan Weaver <keenanweaver@protonmail.com>
---
 .../fix-non-steam-shortcuts.patch             |  6 +--
 .../by-name/he/heroic-unwrapped/legendary.nix | 45 -------------------
 pkgs/by-name/he/heroic-unwrapped/package.nix  | 15 ++++---
 3 files changed, 11 insertions(+), 55 deletions(-)
 delete mode 100644 pkgs/by-name/he/heroic-unwrapped/legendary.nix

diff --git a/pkgs/by-name/he/heroic-unwrapped/fix-non-steam-shortcuts.patch b/pkgs/by-name/he/heroic-unwrapped/fix-non-steam-shortcuts.patch
index 7b46473245f7..2c771441ca8a 100644
--- a/pkgs/by-name/he/heroic-unwrapped/fix-non-steam-shortcuts.patch
+++ b/pkgs/by-name/he/heroic-unwrapped/fix-non-steam-shortcuts.patch
@@ -1,11 +1,11 @@
 diff --git a/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts b/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts
-index ebef6aa4..c8bd853d 100644
+index 28c917ce..f3b09c55 100644
 --- a/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts
 +++ b/src/backend/shortcuts/nonesteamgame/nonesteamgame.ts
-@@ -252,7 +252,7 @@ async function addNonSteamGame(props: {
+@@ -255,7 +255,7 @@ async function addNonSteamGame(game: Game): Promise<boolean> {
      // add new Entry
      const newEntry = {} as ShortcutEntry
-     newEntry.AppName = props.gameInfo.title
+     newEntry.AppName = gameInfo.title
 -    newEntry.Exe = `"${app.getPath('exe')}"`
 +    newEntry.Exe = `"heroic"`
      newEntry.StartDir = `"${process.cwd()}"`
diff --git a/pkgs/by-name/he/heroic-unwrapped/legendary.nix b/pkgs/by-name/he/heroic-unwrapped/legendary.nix
deleted file mode 100644
index 2f968468aeba..000000000000
--- a/pkgs/by-name/he/heroic-unwrapped/legendary.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  lib,
-  gitUpdater,
-  fetchFromGitHub,
-  python3Packages,
-}:
-
-python3Packages.buildPythonApplication (finalAttrs: {
-  pname = "legendary-heroic";
-  version = "0.20.43";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "Heroic-Games-Launcher";
-    repo = "legendary";
-    tag = finalAttrs.version;
-    hash = "sha256-EQBrj+GOmVD0ZEArOk1Me4LLKbs6Ezl1lTzD0k5uUsQ=";
-  };
-
-  build-system = with python3Packages; [
-    setuptools
-  ];
-
-  dependencies = with python3Packages; [
-    requests
-    requests-futures
-    filelock
-    pycryptodomex
-  ];
-
-  pythonImportsCheck = [ "legendary" ];
-
-  passthru.updateScript = gitUpdater { };
-
-  meta = {
-    description = "Free and open-source Epic Games Launcher alternative";
-    longDescription = ''
-      This is the Heroic Games Launcher's fork of legendary.
-    '';
-    homepage = "https://github.com/Heroic-Games-Launcher/legendary";
-    license = lib.licenses.gpl3;
-    maintainers = [ ];
-    mainProgram = "legendary";
-  };
-})
diff --git a/pkgs/by-name/he/heroic-unwrapped/package.nix b/pkgs/by-name/he/heroic-unwrapped/package.nix
index 8f0bdf3cbe88..397ce98563be 100644
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@@ -12,9 +12,10 @@
   makeWrapper,
   # Electron updates can break Heroic, so try to use same version as upstream.
   # If the used electron version is higher than upstream's then the node-abi package might need to be updated
-  electron,
+  electron_43,
   vulkan-helper,
   gogdl,
+  legendary-gl,
   nile,
   comet-gog_heroic,
   umu-launcher,
@@ -22,20 +23,20 @@
 
 let
   pnpm = pnpm_10;
+  electron = electron_43;
 
-  legendary = callPackage ./legendary.nix { };
   epic-integration = callPackage ./epic-integration.nix { };
   comet-gog = comet-gog_heroic;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "heroic-unwrapped";
-  version = "2.22.0";
+  version = "2.22.1";
 
   src = fetchFromGitHub {
     owner = "Heroic-Games-Launcher";
     repo = "HeroicGamesLauncher";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RDJDeL5exEzF2BhEWoiXWsTpV5hytrB6RDoXV0mTWTw=";
+    hash = "sha256-CpbCXmvfwXT16ZG/6fwPWSjBwK02ykJ/GuZk1VcW+tU=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -47,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-lPHL6pA39hvEtq5WkcAXfcY3a0VPseQL/nI+oEjIZeE=";
+    hash = "sha256-NrglT9vtDMAYXmZ4G3vifvLXu1yS6xbp+cqE6B6vQFc=";
   };
 
   nativeBuildInputs = [
@@ -96,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     ln -s \
       "${lib.getExe gogdl}" \
-      "${lib.getExe legendary}" \
+      "${lib.getExe legendary-gl}" \
       "${lib.getExe nile}" \
       "${lib.getExe comet-gog}" \
       "${lib.getExe vulkan-helper}" \
@@ -131,7 +132,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    inherit epic-integration legendary;
+    inherit epic-integration;
   };
 
   meta = {

From 4c66635ceb0fc92946ddd287558cb3440c6d0e41 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 16:44:35 +0200
Subject: [PATCH 129/551] bison: enable strictDeps, rework hack

---
 pkgs/by-name/bi/bison/package.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/bi/bison/package.nix b/pkgs/by-name/bi/bison/package.nix
index ec4c397b80ab..b108cc896905 100644
--- a/pkgs/by-name/bi/bison/package.nix
+++ b/pkgs/by-name/bi/bison/package.nix
@@ -28,10 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     "host"
   ];
 
-  # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell
-  # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong
-  # cannot add bash to buildInputs due to infinite recursion
-  strictDeps = stdenv.hostPlatform != stdenv.buildPlatform;
+  strictDeps = true;
 
   nativeBuildInputs = [
     m4
@@ -40,6 +37,13 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional stdenv.hostPlatform.isSunOS help2man;
   propagatedBuildInputs = [ m4 ];
 
+  # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell
+  # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong
+  # cannot add bash to buildInputs due to infinite recursion
+  postFixup = lib.optionalString (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) ''
+    patchShebangs --build $out/bin/yacc
+  '';
+
   enableParallelBuilding = true;
   # tests are flaky / timing sensitive on FreeBSD
   enableParallelChecking = !stdenv.hostPlatform.isFreeBSD;

From 82f41ea74450c3dada7bc877f6b43578883b036f Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 15:33:14 +0200
Subject: [PATCH 130/551] gnugrep: use finalAttrs, substituteInPlace

---
 pkgs/by-name/gn/gnugrep/package.nix | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/gn/gnugrep/package.nix b/pkgs/by-name/gn/gnugrep/package.nix
index e5ae6241a47b..03b965b7268b 100644
--- a/pkgs/by-name/gn/gnugrep/package.nix
+++ b/pkgs/by-name/gn/gnugrep/package.nix
@@ -15,16 +15,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-let
-  version = "3.12";
-in
-
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnugrep";
-  inherit version;
+  version = "3.12";
 
   src = fetchurl {
-    url = "mirror://gnu/grep/grep-${version}.tar.xz";
+    url = "mirror://gnu/grep/grep-${finalAttrs.version}.tar.xz";
     hash = "sha256-JkmyfA6Q5jLq3NdXvgbG6aT0jZQd5R58D4P/dkCKB7k=";
   };
 
@@ -39,13 +35,9 @@ stdenv.mkDerivation {
   # - on Musl: https://github.com/NixOS/nixpkgs/pull/228714
   # - on x86_64-darwin: https://github.com/NixOS/nixpkgs/pull/228714#issuecomment-1576826330
   # - when building on Darwin (cross-compilation): test-nl_langinfo-mt fails
-  postPatch =
-    if stdenv.hostPlatform.isMusl || stdenv.buildPlatform.isDarwin then
-      ''
-        sed -i 's:gnulib-tests::g' Makefile.in
-      ''
-    else
-      null;
+  postPatch = lib.optionalString (stdenv.hostPlatform.isMusl || stdenv.buildPlatform.isDarwin) ''
+    substituteInPlace Makefile.in --replace-fail "gnulib-tests" ""
+  '';
 
   nativeCheckInputs = [
     perl
@@ -120,7 +112,7 @@ stdenv.mkDerivation {
     teams = [ lib.teams.security-review ];
     platforms = lib.platforms.all;
     mainProgram = "grep";
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version // {
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version // {
       product = "grep";
     };
   };
@@ -128,4 +120,4 @@ stdenv.mkDerivation {
   passthru = {
     inherit pcre2;
   };
-}
+})

From 2c27e0e3ae83b81425193d5b4951584e43265798 Mon Sep 17 00:00:00 2001
From: Johan Herland <johan@herland.net>
Date: Mon, 10 Aug 2026 10:02:24 +0000
Subject: [PATCH 131/551] hdrhistogram_c: fix pkgsStatic build

pkgsStatic uses a fully static musl toolchain (crtbeginT.o) which cannot
link shared objects. The upstream CMakeLists uses its own
HDR_HISTOGRAM_BUILD_SHARED option (not BUILD_SHARED_LIBS) to build both
libraries unconditionally, causing a linker failure.

Disable shared library and programs builds for static targets. Add a
postInstall symlink libhdr_histogram.a -> libhdr_histogram_static.a so
that the installed pkg-config file (-lhdr_histogram) resolves correctly.

Fixes: https://github.com/NixOS/nixpkgs/issues/549561
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 pkgs/by-name/hd/hdrhistogram_c/package.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pkgs/by-name/hd/hdrhistogram_c/package.nix b/pkgs/by-name/hd/hdrhistogram_c/package.nix
index 3ebcbe73e089..4c0f3a16cfeb 100644
--- a/pkgs/by-name/hd/hdrhistogram_c/package.nix
+++ b/pkgs/by-name/hd/hdrhistogram_c/package.nix
@@ -32,6 +32,20 @@ stdenv.mkDerivation (finalAttrs: {
     validatePkgConfig
   ];
 
+  cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [
+    (lib.cmakeBool "HDR_HISTOGRAM_BUILD_SHARED" false)
+    # Examples and tests depend on the shared library target; skip them in
+    # static builds (tests still run for the regular pkgs.hdrhistogram_c build).
+    (lib.cmakeBool "HDR_HISTOGRAM_BUILD_PROGRAMS" false)
+  ];
+
+  # The .pc file always references -lhdr_histogram, but in static builds only
+  # libhdr_histogram_static.a is produced. Provide a symlink so pkg-config
+  # consumers find the right archive.
+  postInstall = lib.optionalString stdenv.hostPlatform.isStatic ''
+    ln -s $out/lib/libhdr_histogram_static.a $out/lib/libhdr_histogram.a
+  '';
+
   doCheck = true;
 
   passthru = {

From 94143794fa17ce4d0e40a6e007b2d11a62be0a40 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 4 Jul 2026 13:37:28 -0300
Subject: [PATCH 132/551] taws: init at 1.2.1

---
 pkgs/by-name/ta/taws/package.nix | 54 ++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 pkgs/by-name/ta/taws/package.nix

diff --git a/pkgs/by-name/ta/taws/package.nix b/pkgs/by-name/ta/taws/package.nix
new file mode 100644
index 000000000000..e222c05139b9
--- /dev/null
+++ b/pkgs/by-name/ta/taws/package.nix
@@ -0,0 +1,54 @@
+{
+  buildPackages,
+  fetchFromGitHub,
+  installShellFiles,
+  lib,
+  rustPlatform,
+  stdenv,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "taws";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "huseyinbabal";
+    repo = "taws";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-76dC5ZLhQkItqGdWkq+U8mzimjDAAkzzpopx8ZPHCx4=";
+  };
+
+  cargoHash = "sha256-62Pk1RRx0eErGWNCYEyw0jFoNp97a+1kn5brgd81P5k=";
+
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  postInstall =
+    let
+      taws =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          "$out/bin/taws"
+        else
+          lib.getExe buildPackages.taws;
+    in
+    ''
+      installShellCompletion --cmd taws \
+        --bash <(${taws} completion bash) \
+        --fish <(${taws} completion fish) \
+        --zsh <(${taws} completion zsh)
+    '';
+
+  meta = {
+    description = "Terminal-based AWS resource viewer and manager";
+    homepage = "https://github.com/huseyinbabal/taws";
+    changelog = "https://github.com/huseyinbabal/taws/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    mainProgram = "taws";
+    maintainers = [ lib.maintainers.EpicEric ];
+    platforms = lib.platforms.all;
+  };
+})

From 54d7f724c55705fcf4d39967d30891074ae9cbbb Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Mon, 10 Aug 2026 19:01:05 +0200
Subject: [PATCH 133/551] python3Packages.typing-inspection: 0.4.2 -> 0.4.3

Changelog: https://github.com/pydantic/typing-inspection/blob/v0.4.3/HISTORY.md
Diff: https://github.com/pydantic/typing-inspection/compare/v0.4.2...v0.4.3
---
 .../python-modules/typing-inspection/default.nix       | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/typing-inspection/default.nix b/pkgs/development/python-modules/typing-inspection/default.nix
index 2da9cae3ad60..5237c7d7ee01 100644
--- a/pkgs/development/python-modules/typing-inspection/default.nix
+++ b/pkgs/development/python-modules/typing-inspection/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "typing-inspection";
-  version = "0.4.2";
+  version = "0.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "typing-inspection";
     tag = "v${version}";
-    hash = "sha256-aGScO+FLEJ5IyI6hBqdsiKJRN7vEG36V5131nhVZEbc=";
+    hash = "sha256-jNAMYV9mpUnClLOahQyLisBkOfELcmjKavKJgyxkQr4=";
   };
 
   build-system = [ hatchling ];
@@ -31,12 +31,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # broken by intentional 3.14.7 behavior change
-    # reported upstream: https://github.com/pydantic/typing-inspection/issues/55
-    "test_literal_values_unhashable_type"
-  ];
-
   meta = {
     changelog = "https://github.com/pydantic/typing-inspection/blob/${src.tag}/HISTORY.md";
     description = "Runtime typing introspection tools";

From 7b6d7a9c5b4a2838f2a25ab4ffdf1326491ad822 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Mon, 10 Aug 2026 19:01:40 +0200
Subject: [PATCH 134/551] python3Packages.typing-inspection: use finalAttrs

---
 .../python-modules/typing-inspection/default.nix          | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/typing-inspection/default.nix b/pkgs/development/python-modules/typing-inspection/default.nix
index 5237c7d7ee01..f763f5f68778 100644
--- a/pkgs/development/python-modules/typing-inspection/default.nix
+++ b/pkgs/development/python-modules/typing-inspection/default.nix
@@ -7,7 +7,7 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "typing-inspection";
   version = "0.4.3";
   pyproject = true;
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "typing-inspection";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-jNAMYV9mpUnClLOahQyLisBkOfELcmjKavKJgyxkQr4=";
   };
 
@@ -32,10 +32,10 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/pydantic/typing-inspection/blob/${src.tag}/HISTORY.md";
+    changelog = "https://github.com/pydantic/typing-inspection/blob/${finalAttrs.src.tag}/HISTORY.md";
     description = "Runtime typing introspection tools";
     homepage = "https://github.com/pydantic/typing-inspection";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

From 28d2b87c1bcb39bb60d1e5c08a66b02f11c404f2 Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Sat, 8 Aug 2026 21:53:21 -0400
Subject: [PATCH 135/551] libinput: specify propagatedBuildOutputs to keep
 `bin` out of `dev` output

---
 pkgs/development/libraries/libinput/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 17ef7da85270..924696025cf1 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -61,6 +61,8 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
+  propagatedBuildOutputs = [ "out" ];
+
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libinput";

From 58abfa5c4a15ddbe2d9bf6b466d7775ac0409b43 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 11 Aug 2026 11:18:07 +0000
Subject: [PATCH 136/551] mimalloc: 3.3.2 -> 3.4.5

---
 pkgs/by-name/mi/mimalloc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/mimalloc/package.nix b/pkgs/by-name/mi/mimalloc/package.nix
index 6f4c2362a33e..810596fdfe03 100644
--- a/pkgs/by-name/mi/mimalloc/package.nix
+++ b/pkgs/by-name/mi/mimalloc/package.nix
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mimalloc";
-  version = "3.3.2";
+  version = "3.4.5";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "mimalloc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GZ37qQVDe9jgMb4Coe5oKvgaLTspZDlSkS5rdy1MfUU=";
+    hash = "sha256-vNVZw2YsDkf0GcdFTNb/fXMQLQYvoc8P425LupPShpo=";
   };
 
   doCheck = !stdenv.hostPlatform.isStatic;

From 16cf4a503d4016ccbd43276cf0da4baf8fc00b51 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 12:20:45 +0200
Subject: [PATCH 137/551] elfutils: enable strictDeps

---
 pkgs/by-name/el/elfutils/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/el/elfutils/package.nix b/pkgs/by-name/el/elfutils/package.nix
index a66af1cb091b..e101ea7cf1ad 100644
--- a/pkgs/by-name/el/elfutils/package.nix
+++ b/pkgs/by-name/el/elfutils/package.nix
@@ -113,6 +113,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedNativeBuildInputs = [ setupDebugInfoDirs ];
 
+  strictDeps = true;
+
   hardeningDisable = [ "strictflexarrays3" ];
 
   configureFlags = [

From 79a0d9bcb3d0c9fa33cd0de36faea4520e5282e9 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 12:21:03 +0200
Subject: [PATCH 138/551] elfutils: enable structuredAttrs

---
 pkgs/by-name/el/elfutils/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/el/elfutils/package.nix b/pkgs/by-name/el/elfutils/package.nix
index e101ea7cf1ad..b0124617be22 100644
--- a/pkgs/by-name/el/elfutils/package.nix
+++ b/pkgs/by-name/el/elfutils/package.nix
@@ -146,6 +146,8 @@ stdenv.mkDerivation (finalAttrs: {
     rev-prefix = "elfutils-";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://sourceware.org/elfutils/";
     description = "Set of utilities to handle ELF objects";

From 522dff49c09ccd06162a42757cd113ddef9a44f2 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 12:26:35 +0200
Subject: [PATCH 139/551] gnutls: enable strictDeps

---
 pkgs/by-name/gn/gnutls/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gn/gnutls/package.nix b/pkgs/by-name/gn/gnutls/package.nix
index c132697abbd7..257b36c69775 100644
--- a/pkgs/by-name/gn/gnutls/package.nix
+++ b/pkgs/by-name/gn/gnutls/package.nix
@@ -173,6 +173,8 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ nettle ];
 
+  strictDeps = true;
+
   inherit doCheck;
   # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` breaks tests.
   # Also empty files won't work, and we want to avoid potentially impure /etc/

From 34ed5d8fcf1f744d282f5c0f398d6c35d99d9287 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 12:26:52 +0200
Subject: [PATCH 140/551] gnutls: enable structuredAttrs, use finalAttrs

---
 pkgs/by-name/gn/gnutls/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/gn/gnutls/package.nix b/pkgs/by-name/gn/gnutls/package.nix
index 257b36c69775..df21d5943035 100644
--- a/pkgs/by-name/gn/gnutls/package.nix
+++ b/pkgs/by-name/gn/gnutls/package.nix
@@ -58,12 +58,12 @@ let
   util-linux = util-linuxMinimal;
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnutls";
   version = "3.8.13";
 
   src = fetchurl {
-    url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
+    url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor finalAttrs.version}/gnutls-${finalAttrs.version}.tar.xz";
     hash = "sha256-/+2Owb8JwkJtTxSq43feR1O1PlN9aF5gTpmosWypyX4=";
   };
 
@@ -217,6 +217,8 @@ stdenv.mkDerivation rec {
     static = pkgsStatic.gnutls;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "GNU Transport Layer Security Library";
 
@@ -238,6 +240,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ vcunat ];
     platforms = lib.platforms.all;
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version;
   };
-}
+})

From ab0d16db059bf354c8a3d8d154131b4e1137250d Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 13:04:08 +0200
Subject: [PATCH 141/551] ed: enable structuredAttrs

---
 pkgs/by-name/ed/ed/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ed/ed/package.nix b/pkgs/by-name/ed/ed/package.nix
index 8d97434a822d..11d4f49f4742 100644
--- a/pkgs/by-name/ed/ed/package.nix
+++ b/pkgs/by-name/ed/ed/package.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/ed/";
     description = "GNU implementation of the standard Unix editor";

From 49076b4ec84292406e66262a7ed7d028dcfe6a6c Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Mon, 10 Aug 2026 21:26:20 -0400
Subject: [PATCH 142/551] expat: 2.8.2 -> 2.8.3

changelog: https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes
diff: https://github.com/libexpat/libexpat/compare/R_2_8_2...R_2_8_3

Fixes: CVE-2026-72522
---
 pkgs/by-name/ex/expat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index 2e831ef025da..d0d13e37da6f 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -23,13 +23,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "expat";
-  version = "2.8.2";
+  version = "2.8.3";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tagFor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-OtibhYjmZEvU5JmBSA1IshKJ7rvNTwoaSvscKfmbarQ=";
+    hash = "sha256-9iVt+QyQZ3PTRNoIRAK30+TyLtQbGlnJiQmKg9PqDIU=";
   };
 
   strictDeps = true;

From b85b77fdb06f04a41b24f11c887f960ba244df17 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 13:04:36 +0200
Subject: [PATCH 143/551] libtool_1_5: enable strictDeps

---
 pkgs/development/tools/misc/libtool/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/tools/misc/libtool/default.nix b/pkgs/development/tools/misc/libtool/default.nix
index 2fcc7a03626d..648340ad081a 100644
--- a/pkgs/development/tools/misc/libtool/default.nix
+++ b/pkgs/development/tools/misc/libtool/default.nix
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ m4 ];
   buildInputs = [ perl ];
 
+  strictDeps = true;
+
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
   # "fixed" path in generated files!
   dontPatchShebangs = true;

From 7231d4909aea12f3639ff43bb7d9d856963730e9 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 13:04:52 +0200
Subject: [PATCH 144/551] libtool_1_5: enable structuredAttrs, use finalAttrs

---
 pkgs/development/tools/misc/libtool/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/libtool/default.nix b/pkgs/development/tools/misc/libtool/default.nix
index 648340ad081a..7258279ff072 100644
--- a/pkgs/development/tools/misc/libtool/default.nix
+++ b/pkgs/development/tools/misc/libtool/default.nix
@@ -6,12 +6,12 @@
   perl,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libtool";
   version = "1.5.26";
 
   src = fetchurl {
-    url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
+    url = "mirror://gnu/libtool/libtool-${finalAttrs.version}.tar.gz";
     sha256 = "029ggq5kri1gjn6nfqmgw4w920gyfzscjjxbsxxidal5zqsawd8w";
   };
 
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
   dontPatchShebangs = true;
   dontFixLibtool = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Generic library support script";
 
@@ -45,4 +47,4 @@ stdenv.mkDerivation rec {
 
     mainProgram = "libtool";
   };
-}
+})

From d9d827b829edfa651b86542c34e2a1bfb4e27002 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 13:05:49 +0200
Subject: [PATCH 145/551] libtool: enable structuredAttrs, use finalAttrs

---
 pkgs/development/tools/misc/libtool/libtool2.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index 43bc3f4e4852..6f63c5a25249 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -13,12 +13,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libtool";
   version = "2.6.2";
 
   src = fetchurl {
-    url = "mirror://gnu/libtool/${pname}-${version}.tar.gz";
+    url = "mirror://gnu/libtool/libtool-${finalAttrs.version}.tar.gz";
     hash = "sha256-JK2zqprgNccPq6NEr1fXMhXriSgQRa9sfM0wd1H4sL8=";
   };
 
@@ -68,6 +68,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "GNU Libtool, a generic library support script";
     longDescription = ''
@@ -85,4 +87,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     mainProgram = "libtool";
   };
-}
+})

From c651e6c110948c81ea7ec5c86e46e9fa6fdd93a2 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 13:16:14 +0200
Subject: [PATCH 146/551] libiconv: enable strictDeps

---
 pkgs/development/libraries/libiconv/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/libiconv/default.nix b/pkgs/development/libraries/libiconv/default.nix
index 294e7a81d5e4..a90ea21d6cfb 100644
--- a/pkgs/development/libraries/libiconv/default.nix
+++ b/pkgs/development/libraries/libiconv/default.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
   # https://git.savannah.gnu.org/cgit/config.git/commit/?id=e4786449e1c26716e3f9ea182caf472e4dbc96e0
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
+  strictDeps = true;
+
   # https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593
   hardeningDisable = lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify";
 

From a3a46b2ed29773f210a0afa433f43c0ff8357cb8 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 13:18:39 +0200
Subject: [PATCH 147/551] gnupatch: enable structuredAttrs

---
 pkgs/by-name/gn/gnupatch/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gn/gnupatch/package.nix b/pkgs/by-name/gn/gnupatch/package.nix
index e32573c05048..361365accfb3 100644
--- a/pkgs/by-name/gn/gnupatch/package.nix
+++ b/pkgs/by-name/gn/gnupatch/package.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "GNU Patch, a program to apply differences to files";
     mainProgram = "patch";

From 7d70798391429da7a7911a5fc07b6e0de84dd413 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 14:09:24 +0200
Subject: [PATCH 148/551] gnumake: enable structuredAttrs, use hash

---
 pkgs/by-name/gn/gnumake/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/gn/gnumake/package.nix b/pkgs/by-name/gn/gnumake/package.nix
index 9f2aa3d764e9..bde1af39133b 100644
--- a/pkgs/by-name/gn/gnumake/package.nix
+++ b/pkgs/by-name/gn/gnumake/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnu/make/make-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-3Rb7HWe/q3mnL16DkHNcSePo5wtJRaFasfgd23hlj7M=";
+    hash = "sha256-3Rb7HWe/q3mnL16DkHNcSePo5wtJRaFasfgd23hlj7M=";
   };
 
   # To update patches:
@@ -82,6 +82,8 @@ stdenv.mkDerivation (finalAttrs: {
     gnumakeWithGuile = gnumake.override { guileSupport = true; };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Tool to control the generation of non-source files from sources";
     longDescription = ''

From 3bda6b678a764205b2437d761d3ca05a345f0e26 Mon Sep 17 00:00:00 2001
From: Kyle Chui <kyle.chui+github@pm.me>
Date: Tue, 14 Jul 2026 17:17:43 +0200
Subject: [PATCH 149/551] auto-patchelf: add --relativize-rpath argument for
 inferring `$ORIGIN`

This adds a `--relativize-rpath` flag, which infers `$ORIGIN` for a
shared object's RUNPATH entries if the object and entry both fall under a path
provided to auto-patchelf via `--paths`.

Sometimes Python wheels distribute shared objects in multiple directories,
where the objects in one directory depend on shared objects in another
directory. The RUNPATH entries that declare where to find the dependent objects
are usually provided as absolute paths, which breaks if the objects are moved
around.
---
 .../au/auto-patchelf/source/auto-patchelf.py  | 70 +++++++++++++++++--
 1 file changed, 66 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py b/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
index bda5329a1df3..b16c98096360 100644
--- a/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
+++ b/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
@@ -240,6 +240,35 @@ def find_first_matching_rpath_with_origin(binary: Path, lib_dir: Path, rpaths: l
             return Path(rpath)
     return None
 
+
+def relativize_rpath_to_origin(*, binary_path: Path, rpath_entries: list[Path], containing_path: Path) -> list[Path]:
+    """
+    Rewrite absolute RPATH entries to use $ORIGIN when the entry sits
+    under containing_path (the --paths entry the binary was found
+    under).
+
+    The resulting RPATH is relocatable: as long as the directory layout
+    within containing_path is preserved, the whole tree can be moved
+    and the binary will still find its dependencies.
+
+    Entries that already contain $ORIGIN are left untouched.
+    Entries outside containing_path are also left absolute.
+    """
+    containing_norm: Path = Path(os.path.normpath(containing_path))
+    new_rpath_entries: list[Path] = []
+    for entry in rpath_entries:
+        if "$ORIGIN" in entry.as_posix():
+            new_rpath_entries.append(entry)
+            continue
+        entry_norm: Path = Path(os.path.normpath(entry))
+        if not entry_norm.is_relative_to(containing_norm):
+            new_rpath_entries.append(entry)
+            continue
+        rel = os.path.relpath(entry_norm, binary_path.parent)
+        new_rpath_entries.append(Path("$ORIGIN") / rel)
+    return new_rpath_entries
+
+
 class Event(Protocol):
     """Protocol for loggable events that occur during the auto-patchelf process."""
     def to_human_readable_str(self) -> str: ...
@@ -317,7 +346,18 @@ class Logger:
 
 
 
-def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], append_rpaths: list[Path] = [], keep_libc: bool = False, preserve_origin: bool = False, extra_args: list[str] = []) -> list[Dependency]:
+def auto_patchelf_file(
+    *,
+    logger: Logger,
+    runtime_deps: list[Path],
+    append_rpaths: list[Path] = [],
+    keep_libc: bool = False,
+    preserve_origin: bool = False,
+    relativize_rpath: bool = False,
+    extra_args: list[str] = [],
+    path: Path,
+    containing_path: Path
+) -> list[Dependency]:
     try:
         with open_elf(path) as elf:
 
@@ -436,6 +476,9 @@ def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], app
             if "$ORIGIN" in existing_rpath:
                 rpath.append(Path(existing_rpath))
 
+    if relativize_rpath:
+        rpath = relativize_rpath_to_origin(binary_path=path, rpath_entries=rpath, containing_path=containing_path)
+
     # Dedup the rpath
     rpath_str = ":".join(dict.fromkeys(map(Path.as_posix, rpath)))
 
@@ -458,6 +501,7 @@ def auto_patchelf(
         append_rpaths: list[Path] = [],
         keep_libc: bool = False,
         preserve_origin: bool = False,
+        relativize_rpath: bool = False,
         add_existing: bool = True,
         extra_args: list[str] = []) -> None:
 
@@ -472,9 +516,20 @@ def auto_patchelf(
     populate_cache(lib_dirs)
 
     dependencies = []
-    for path in chain.from_iterable(glob(p, '*', recursive) for p in paths_to_patch):
-        if not path.is_symlink() and path.is_file():
-            dependencies += auto_patchelf_file(logger, path, runtime_deps, append_rpaths, keep_libc, preserve_origin, extra_args)
+    for containing_path in paths_to_patch:
+        for path in glob(containing_path, '*', recursive):
+            if not path.is_symlink() and path.is_file():
+                dependencies += auto_patchelf_file(
+                    logger=logger,
+                    runtime_deps=runtime_deps,
+                    append_rpaths=append_rpaths,
+                    keep_libc=keep_libc,
+                    preserve_origin=preserve_origin,
+                    relativize_rpath=relativize_rpath,
+                    extra_args=extra_args,
+                    path=path,
+                    containing_path=containing_path
+                )
 
     missing = [dep for dep in dependencies if not dep.found]
 
@@ -560,6 +615,12 @@ def main() -> None:
         action="store_true",
         help="When possible, replace absolute RPATH entries with original $ORIGIN entries that resolve to the same directory.",
     )
+    parser.add_argument(
+        "--relativize-rpath",
+        dest="relativize_rpath",
+        action="store_true",
+        help="Rewrite absolute RPATH entries to use $ORIGIN when the binary and the entry live under the same --paths root, so the patched tree is relocatable.",
+    )
     parser.add_argument(
         "--ignore-existing",
         dest="add_existing",
@@ -597,6 +658,7 @@ def main() -> None:
         append_rpaths=args.append_rpaths,
         keep_libc=args.keep_libc,
         preserve_origin=args.preserve_origin,
+        relativize_rpath=args.relativize_rpath,
         add_existing=args.add_existing,
         extra_args=args.extra_args)
 

From 191fb7ce4035608c2d56a1750d0acd9aa3582b1c Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Tue, 11 Aug 2026 13:06:05 +0300
Subject: [PATCH 150/551] tests.auto-patchelf-hook-relativize-rpath: init

This adds a test for the introduced --relativize-rpath cmdline arg.
---
 .../default.nix                               | 88 +++++++++++++++++++
 .../lib-baz.c                                 | 10 +++
 .../main.py                                   | 10 +++
 pkgs/test/default.nix                         |  2 +
 4 files changed, 110 insertions(+)
 create mode 100644 pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix
 create mode 100644 pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c
 create mode 100644 pkgs/test/auto-patchelf-hook-relativize-rpath/main.py

diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix b/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix
new file mode 100644
index 000000000000..1d1d93025ba9
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix
@@ -0,0 +1,88 @@
+{
+  lib,
+  stdenv,
+  tests,
+  autoPatchelfHook,
+  patchelf,
+  python3,
+}:
+
+let
+  foo = tests.stdenv-inputs.foo;
+
+  # Produce a tree containing lib/{baz.so,libs/foo.so},
+  # with src/lib/libbaz.so calling code from src/lib/libs/libfoo.so.
+  # These have absolute paths.
+  baz-bundle = stdenv.mkDerivation {
+    name = "baz-bundle";
+
+    buildCommand = ''
+      mkdir -p $out/lib/libs
+      cp ${(lib.getDev foo)}/lib/libfoo.so $out/lib/libs/
+
+      mkdir -p $out/lib/
+      $CC -shared -lfoo -L$out/lib/libs -o $out/lib/libbaz.so ${./lib-baz.c}
+    '';
+
+    # No references to the foo store path.
+    disallowedReferences = [
+      (lib.getDev foo)
+    ];
+  };
+
+  # Make baz-bundle relocatable, by running autopatchelf with the `--relativize-rpath` flag.
+  # This will replace the `RPATH` of `$out/lib/libbaz.so` from `$out/lib/libs` to `$ORIGIN/libs`.
+  baz-bundle-relocatable = stdenv.mkDerivation {
+    name = "baz-bundle-relocatable";
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+    ];
+
+    autoPatchelfFlags = [ "--relativize-rpath" ];
+
+    dontUnpack = true;
+
+    # we don't set buildCommand because we want to ensure fixupPhase
+    # (containing autoPatchelfHook) is run.
+    installPhase = ''
+      mkdir -p $out
+      cp -R ${baz-bundle}/lib $out/lib
+    '';
+
+    # Now these two .so files refer neither to `baz-bundle`, nor contain self-references.
+    disallowedReferences = [
+      baz-bundle
+      "out"
+    ];
+  };
+
+in
+# Pretend a user consumed `baz-bundle-relocatable` as an artifact,
+# copied to ./libs/baz-bundle, and calls `baz` from `libbaz.so` from their code.
+# Ensure this works, which requires `baz()` to still be able to find `foo()`.
+stdenv.mkDerivation {
+  name = "auto-patchelf-hook-relativize-rpath";
+  nativeBuildInputs = [
+    patchelf
+    python3
+  ];
+
+  buildCommand = ''
+    mkdir -p libs/baz-bundle
+    cp -R ${baz-bundle-relocatable}/lib/* libs/baz-bundle/
+
+    echo "RPATHs:"
+    echo -n "libs/baz-bundle/libbaz.so:     "
+    patchelf --print-rpath libs/baz-bundle/libbaz.so
+    echo -n "libs/baz-bundle/lib/libfoo.so: "
+    patchelf --print-rpath libs/baz-bundle/libs/libfoo.so
+
+    cp ${./main.py} main.py
+    python main.py |& tee /dev/stderr | grep -q "foo returned 42"
+
+    touch $out
+  '';
+
+  meta.platforms = lib.platforms.linux;
+}
diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c b/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c
new file mode 100644
index 000000000000..e1f62fc5979c
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c
@@ -0,0 +1,10 @@
+#include <stdio.h>
+
+extern unsigned int foo(void);
+
+extern unsigned int baz(void)
+{
+    fprintf(stderr, "about to call foo()\n");
+    fprintf(stderr, "foo returned %d\n", foo());
+    return 0;
+}
diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py b/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py
new file mode 100644
index 000000000000..cae15e3da5f0
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py
@@ -0,0 +1,10 @@
+from pathlib import Path
+import ctypes
+
+lib_path = Path(__file__).parent / "libs/baz-bundle/libbaz.so"
+lib = ctypes.CDLL(str(lib_path))
+
+lib.baz.restype = ctypes.c_uint
+lib.baz.argtypes = []
+
+lib.baz()
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 35f3f2c8aa82..6acbd0ea637f 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -247,6 +247,8 @@ in
 
   auto-patchelf-hook-preserve-origin = callPackage ./auto-patchelf-hook-preserve-origin { };
 
+  auto-patchelf-hook-relativize-rpath = callPackage ./auto-patchelf-hook-relativize-rpath { };
+
   # Accumulate all passthru.tests from arrayUtilities into a single attribute set.
   arrayUtilities = recurseIntoAttrs (
     concatMapAttrs (

From 312c732c5e94977dc03be5fb159fde6a27af7f61 Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Tue, 11 Aug 2026 15:31:35 -0400
Subject: [PATCH 151/551] samba: replace systemd dependency with systemdLibs

---
 pkgs/servers/samba/4.x.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 5ca73ec6c351..8e4e3fa43eda 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -21,7 +21,7 @@
   zlib,
   liburing,
   gnutls,
-  systemd,
+  systemdLibs,
   samba,
   talloc,
   jansson,
@@ -167,7 +167,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ optionals stdenv.hostPlatform.isLinux [
     liburing
-    systemd
+    systemdLibs
   ]
   ++ optionals stdenv.hostPlatform.isDarwin [ libiconv ]
   ++ optionals enableLDAP [

From e74710c0a2d413cafb017d807cb695b887c14351 Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Tue, 11 Aug 2026 15:35:43 -0400
Subject: [PATCH 152/551] udisks: replace systemd dependency with systemdLibs

---
 pkgs/by-name/ud/udisks/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ud/udisks/package.nix b/pkgs/by-name/ud/udisks/package.nix
index bcbb9d450506..1ef578029cf0 100644
--- a/pkgs/by-name/ud/udisks/package.nix
+++ b/pkgs/by-name/ud/udisks/package.nix
@@ -8,7 +8,7 @@
   autoreconfHook,
   gtk-doc,
   acl,
-  systemd,
+  systemdLibs,
   glib,
   libatasmart,
   polkit,
@@ -111,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     libgudev
     libblockdev
     acl
-    systemd
+    systemdLibs
     glib
     libatasmart
     polkit

From 16f4316b147f18e0752c5fd85c8a395fb5386188 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 16:23:43 +0200
Subject: [PATCH 153/551] libedit: enable strictDeps

---
 pkgs/by-name/li/libedit/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libedit/package.nix b/pkgs/by-name/li/libedit/package.nix
index b74e107981a8..0b585969d1e6 100644
--- a/pkgs/by-name/li/libedit/package.nix
+++ b/pkgs/by-name/li/libedit/package.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
     ncurses
   ];
 
+  strictDeps = true;
+
   # GCC automatically include `stdc-predefs.h` while Clang does not do this by
   # default. While Musl is ISO 10646 compliant, it does not define
   # __STDC_ISO_10646__.

From 40495abefe7c80ae88500626d79ca385d23461c9 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 16:23:56 +0200
Subject: [PATCH 154/551] libedit: enable structuredAttrs

---
 pkgs/by-name/li/libedit/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libedit/package.nix b/pkgs/by-name/li/libedit/package.nix
index 0b585969d1e6..fd14cb442404 100644
--- a/pkgs/by-name/li/libedit/package.nix
+++ b/pkgs/by-name/li/libedit/package.nix
@@ -52,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
       xargs sed -i -e 's,-lncurses[a-z]*,-L${ncurses.out}/lib -lncursesw,g'
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "http://www.thrysoee.dk/editline/";
     changelog = "https://www.thrysoee.dk/editline/#changelog";

From 338dc981d72996a3cf6b8b4e5ebcb2e3578745d5 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 16:24:04 +0200
Subject: [PATCH 155/551] libev: enable strictDeps

---
 pkgs/by-name/li/libev/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libev/package.nix b/pkgs/by-name/li/libev/package.nix
index e51b04890ee6..eee649862706 100644
--- a/pkgs/by-name/li/libev/package.nix
+++ b/pkgs/by-name/li/libev/package.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
+  strictDeps = true;
+
   configureFlags = lib.optional static "LDFLAGS=-static";
 
   makeFlags =

From 30197d3e6e665fdffe5d31878f1e07b7786333a8 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 16:24:23 +0200
Subject: [PATCH 156/551] libev: enable structuredAttrs

---
 pkgs/by-name/li/libev/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libev/package.nix b/pkgs/by-name/li/libev/package.nix
index eee649862706..cdb8e7264232 100644
--- a/pkgs/by-name/li/libev/package.nix
+++ b/pkgs/by-name/li/libev/package.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
       "LDFLAGS+=-lws2_32"
     ]);
 
+  __structuredAttrs = true;
+
   meta = {
     description = "High-performance event loop/event model with lots of features";
     homepage = "https://software.schmorp.de/pkg/libev.html";

From c73a39460b19ba377bed99e588edb81ebbe64942 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 16:24:41 +0200
Subject: [PATCH 157/551] rhash: enable strictDeps

---
 pkgs/by-name/rh/rhash/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/rh/rhash/package.nix b/pkgs/by-name/rh/rhash/package.nix
index e8ef05814fee..8bfe6af91648 100644
--- a/pkgs/by-name/rh/rhash/package.nix
+++ b/pkgs/by-name/rh/rhash/package.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ which ];
   buildInputs = lib.optionals stdenv.hostPlatform.isFreeBSD [ gettext ];
 
+  strictDeps = true;
+
   # configure script is not autotools-based, doesn't support these options
   dontAddStaticConfigureFlags = true;
 

From 088ba535bbc5de88b49f33a27e2af7c531e9cc78 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 16:24:55 +0200
Subject: [PATCH 158/551] rhash: enable structuredAttrs, use tag/hash

---
 pkgs/by-name/rh/rhash/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/rh/rhash/package.nix b/pkgs/by-name/rh/rhash/package.nix
index 8bfe6af91648..29adb0a1e712 100644
--- a/pkgs/by-name/rh/rhash/package.nix
+++ b/pkgs/by-name/rh/rhash/package.nix
@@ -14,8 +14,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "rhash";
     repo = "RHash";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-9/kFI38PG3AKsdDqEV/wEzSel9IlQQ/pvOyhU/N/aV0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9/kFI38PG3AKsdDqEV/wEzSel9IlQQ/pvOyhU/N/aV0=";
   };
 
   nativeBuildInputs = [ which ];
@@ -48,6 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
     "install-lib-so-link"
   ];
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://rhash.sourceforge.net/";
     description = "Console utility and library for computing and verifying hash sums of files";

From e3fe4e8207d622547c821dacdbc88fdd93daea0a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 16:25:04 +0200
Subject: [PATCH 159/551] nettle: enable strictDeps

---
 pkgs/development/libraries/nettle/generic.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/nettle/generic.nix b/pkgs/development/libraries/nettle/generic.nix
index b626e137c427..9f45e01cd93b 100644
--- a/pkgs/development/libraries/nettle/generic.nix
+++ b/pkgs/development/libraries/nettle/generic.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ gnum4 ];
   propagatedBuildInputs = [ gmp ];
 
+  strictDeps = true;
+
   configureFlags =
     # runtime selection of HW-accelerated code; it's default since 3.7
     [ "--enable-fat" ]

From 911921f0a3251222124e5bc09963451148e8cce3 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 16:25:14 +0200
Subject: [PATCH 160/551] nettle: enable structuredAttrs

---
 pkgs/development/libraries/nettle/generic.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/nettle/generic.nix b/pkgs/development/libraries/nettle/generic.nix
index 9f45e01cd93b..9494a282a1df 100644
--- a/pkgs/development/libraries/nettle/generic.nix
+++ b/pkgs/development/libraries/nettle/generic.nix
@@ -42,6 +42,8 @@ stdenv.mkDerivation {
 
   patches = lib.optional (stdenv.hostPlatform.system == "i686-cygwin") ./cygwin.patch;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Cryptographic library";
 

From 9b751352cb50a6544ccdcd0af906e385da421052 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 16:27:23 +0200
Subject: [PATCH 161/551] mpdecimal: enable strictDeps

---
 pkgs/by-name/mp/mpdecimal/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/mp/mpdecimal/package.nix b/pkgs/by-name/mp/mpdecimal/package.nix
index ca1d0bba4969..a814f21c13e9 100644
--- a/pkgs/by-name/mp/mpdecimal/package.nix
+++ b/pkgs/by-name/mp/mpdecimal/package.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   postInstall = ''

From 96635cdcabe8f58e2d2f6f7825d1ba48f71f9e93 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 16:27:34 +0200
Subject: [PATCH 162/551] mpdecimal: enable structuredAttrs

---
 pkgs/by-name/mp/mpdecimal/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/mp/mpdecimal/package.nix b/pkgs/by-name/mp/mpdecimal/package.nix
index a814f21c13e9..0d90dec4f5aa 100644
--- a/pkgs/by-name/mp/mpdecimal/package.nix
+++ b/pkgs/by-name/mp/mpdecimal/package.nix
@@ -34,6 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
     echo -n $cxx >> $dev/nix-support/propagated-build-inputs
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Library for arbitrary precision decimal floating point arithmetic";
 

From 53c7fb0c804e8b8a5cad426dca1cebcb8b508409 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 24 Jul 2026 15:17:12 +0200
Subject: [PATCH 163/551] asciidoc: enable structuredAttrs, use tag

---
 pkgs/by-name/as/asciidoc/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/as/asciidoc/package.nix b/pkgs/by-name/as/asciidoc/package.nix
index 5aee5a2d9108..8ceb6a06a487 100644
--- a/pkgs/by-name/as/asciidoc/package.nix
+++ b/pkgs/by-name/as/asciidoc/package.nix
@@ -151,7 +151,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   src = fetchFromGitHub {
     owner = "asciidoc-py";
     repo = "asciidoc-py";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-td3C7xTWfSzdo9Bbz0dHW2oPaCQYmUE9H2sUFfg5HH0=";
   };
 
@@ -320,6 +320,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     runHook postCheck
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Text-based document generation system";
     longDescription = ''

From bb25905f349f181c434fb8e097dd82dbea1ae2a6 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 24 Jul 2026 15:17:28 +0200
Subject: [PATCH 164/551] auto-patchelf: enable structuredAttrs

---
 pkgs/by-name/au/auto-patchelf/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/au/auto-patchelf/package.nix b/pkgs/by-name/au/auto-patchelf/package.nix
index 7823a55c72e5..031e780f89c9 100644
--- a/pkgs/by-name/au/auto-patchelf/package.nix
+++ b/pkgs/by-name/au/auto-patchelf/package.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Automatically patch ELF binaries using patchelf";
     mainProgram = "auto-patchelf";

From 672b952591dc27ba2f02758e56f934e69d1aa785 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 24 Jul 2026 15:17:45 +0200
Subject: [PATCH 165/551] gtest: enable structuredAttrs, use tag

---
 pkgs/by-name/gt/gtest/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/gt/gtest/package.nix b/pkgs/by-name/gt/gtest/package.nix
index 49d5de368f04..0dc51ba9446a 100644
--- a/pkgs/by-name/gt/gtest/package.nix
+++ b/pkgs/by-name/gt/gtest/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "google";
     repo = "googletest";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-HIHMxAUR4bjmFLoltJeIAVSulVQ6kVuIT2Ku+lwAx/4=";
   };
 
@@ -64,6 +64,8 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional withAbseil "-DGTEST_HAS_ABSL=ON";
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Google's framework for writing C++ tests";
     homepage = "https://github.com/google/googletest";

From 0c23120b99ee6476766835928a96c550dd66d780 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 24 Jul 2026 15:18:10 +0200
Subject: [PATCH 166/551] gtk-doc: enable structuredAttrs, use finalAttrs

---
 pkgs/by-name/gt/gtk-doc/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/gt/gtk-doc/package.nix b/pkgs/by-name/gt/gtk-doc/package.nix
index 9f58e9fb8f75..475149609a7b 100644
--- a/pkgs/by-name/gt/gtk-doc/package.nix
+++ b/pkgs/by-name/gt/gtk-doc/package.nix
@@ -14,7 +14,7 @@
   dblatex,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "gtk-doc";
   version = "1.36.1";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gtk-doc";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-8hB43BCAtT1B7/ak2i0FAlYD3Kb4rNCWfsJ+wqGu3FA=";
   };
 
@@ -85,12 +85,14 @@ python3.pkgs.buildPythonApplication rec {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
-    changelog = "https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/${src.tag}/NEWS";
+    changelog = "https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/${finalAttrs.src.tag}/NEWS";
     description = "Tools to extract documentation embedded in GTK and GNOME source code";
     homepage = "https://gitlab.gnome.org/GNOME/gtk-doc";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ pSub ];
     teams = [ lib.teams.gnome ];
   };
-}
+})

From 72b0888cd3b54840fc92394e02279f678c267cae Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 24 Jul 2026 15:18:48 +0200
Subject: [PATCH 167/551] ninja: enable structuredAttrs

---
 pkgs/by-name/ni/ninja/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ni/ninja/package.nix b/pkgs/by-name/ni/ninja/package.nix
index 29196bd5db6a..d1d05942e316 100644
--- a/pkgs/by-name/ni/ninja/package.nix
+++ b/pkgs/by-name/ni/ninja/package.nix
@@ -114,6 +114,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.updateScript = nix-update-script { };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Small build system with a focus on speed";
     mainProgram = "ninja";

From fa5bcd11712a0db9676124a3a7752cc49fa6471d Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 24 Jul 2026 15:19:03 +0200
Subject: [PATCH 168/551] zlib-ng: enable structuredAttrs, use tag

---
 pkgs/by-name/zl/zlib-ng/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/zl/zlib-ng/package.nix b/pkgs/by-name/zl/zlib-ng/package.nix
index 6d813b919db7..5bf6295a3e2c 100644
--- a/pkgs/by-name/zl/zlib-ng/package.nix
+++ b/pkgs/by-name/zl/zlib-ng/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "zlib-ng";
     repo = "zlib-ng";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-6GlHCnx9dQtmViPnvHnMS+l9Z+g6M8ynrSxLhLtmAKU=";
   };
 
@@ -46,6 +46,8 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals withZlibCompat [ "-DZLIB_COMPAT=ON" ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Zlib data compression library for the next generation systems";
     homepage = "https://github.com/zlib-ng/zlib-ng";

From ac0e8148b7b637728b832f03b0d400c0b17f63fe Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 24 Jul 2026 20:32:01 +0200
Subject: [PATCH 169/551] ngtcp2{,-gnutls}: enable structuredAttrs, use
 finalAttrs

---
 pkgs/development/libraries/ngtcp2/default.nix | 2 ++
 pkgs/development/libraries/ngtcp2/gnutls.nix  | 8 +++++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index a7f342c6eaf7..da1b9559dda0 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -56,6 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit curl;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/ngtcp2/ngtcp2";
     changelog = "https://github.com/ngtcp2/ngtcp2/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix
index 3de8d611a9d4..92b39359eae1 100644
--- a/pkgs/development/libraries/ngtcp2/gnutls.nix
+++ b/pkgs/development/libraries/ngtcp2/gnutls.nix
@@ -11,14 +11,14 @@
   curlWithGnuTls,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ngtcp2";
   version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = "ngtcp2";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-BBV4nNtSWQOFuwVOeH3LJEUeF7v4LVhGbfcrkroBAvc=";
   };
 
@@ -43,6 +43,8 @@ stdenv.mkDerivation rec {
     inherit curlWithGnuTls;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/ngtcp2/ngtcp2";
     description = "Effort to implement RFC9000 QUIC protocol";
@@ -52,7 +54,7 @@ stdenv.mkDerivation rec {
       vcunat # for knot-dns
     ];
   };
-}
+})
 
 /*
   Why split from ./default.nix?

From a146e75868551d71b6a8ee9ca3df650afdfdb0e6 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 16:07:26 +0200
Subject: [PATCH 170/551] ninja: enable strictDeps

---
 pkgs/by-name/ni/ninja/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ni/ninja/package.nix b/pkgs/by-name/ni/ninja/package.nix
index d1d05942e316..39a2ada4da2a 100644
--- a/pkgs/by-name/ni/ninja/package.nix
+++ b/pkgs/by-name/ni/ninja/package.nix
@@ -52,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt.bin
   ];
 
+  strictDeps = true;
+
   patches = [
     ./0001-spawn-sh-instead-of-bin-sh.patch
   ]

From 9bcd63e541f8700682f3892a57aef4862317f08d Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 16:56:21 +0200
Subject: [PATCH 171/551] gtest: enable strictDeps

---
 pkgs/by-name/gt/gtest/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gt/gtest/package.nix b/pkgs/by-name/gt/gtest/package.nix
index 0dc51ba9446a..fec50046d186 100644
--- a/pkgs/by-name/gt/gtest/package.nix
+++ b/pkgs/by-name/gt/gtest/package.nix
@@ -56,6 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
     re2
   ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
   ]

From 4645c076877016315471eef418289eb40ac165fc Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 10:38:29 +0200
Subject: [PATCH 172/551] autoconf269: enable strictDeps

---
 pkgs/development/tools/misc/autoconf/2.69.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/tools/misc/autoconf/2.69.nix b/pkgs/development/tools/misc/autoconf/2.69.nix
index ca2f881db326..147dcd16ad7e 100644
--- a/pkgs/development/tools/misc/autoconf/2.69.nix
+++ b/pkgs/development/tools/misc/autoconf/2.69.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [ m4 ];
 
+  strictDeps = true;
+
   # Work around a known issue in Cygwin.  See
   # http://thread.gmane.org/gmane.comp.sysutils.autoconf.bugs/6822 for
   # details.

From e86ec915a5d377c51027944647d31961e9aa4636 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 10:38:43 +0200
Subject: [PATCH 173/551] autoconf269: use sri hash

---
 pkgs/development/tools/misc/autoconf/2.69.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/misc/autoconf/2.69.nix b/pkgs/development/tools/misc/autoconf/2.69.nix
index 147dcd16ad7e..2c8f7fb75851 100644
--- a/pkgs/development/tools/misc/autoconf/2.69.nix
+++ b/pkgs/development/tools/misc/autoconf/2.69.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnu/autoconf/autoconf-${finalAttrs.version}.tar.xz";
-    sha256 = "113nlmidxy9kjr45kg9x3ngar4951mvag1js2a3j8nxcz34wxsv4";
+    hash = "sha256-ZOvOyfisWySHElqGp3YNJZGsnh09vVlIljP53mKldoQ=";
   };
 
   nativeBuildInputs = [

From bef5e44caf45df44d7ce3857b0dfc3edcd9d664f Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 10:42:38 +0200
Subject: [PATCH 174/551] automake116x: use sri hash

---
 pkgs/development/tools/misc/automake/automake-1.16.x.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
index 308ebc9e9f3f..11ca834015a7 100644
--- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnu/automake/automake-${finalAttrs.version}.tar.xz";
-    sha256 = "0sdl32qxdy7m06iggmkkvf7j520rmmgbsjzbm7fgnxwxdp6mh7gh";
+    hash = "sha256-8B1YzW2dd/vcqetLvV6tGYgij9tz1veiAfX41rEYtGk=";
   };
 
   strictDeps = true;

From 2f81cc90301d0bb3a2876ce3fc95617398d23d3e Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 15:07:46 +0200
Subject: [PATCH 175/551] ngtcp2{,-gnutls}: enable strictDeps

---
 pkgs/development/libraries/ngtcp2/default.nix | 2 ++
 pkgs/development/libraries/ngtcp2/gnutls.nix  | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index da1b9559dda0..20dac13831d2 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -36,6 +36,8 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional withJemalloc jemalloc;
 
+  strictDeps = true;
+
   cmakeFlags = [
     # The examples try to link against `ngtcp2_crypto_ossl` and `ngtcp2` libraries.
     # This works in the dynamic case where the targets have the same name, but not here where they're suffixed with `_static`.
diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix
index 92b39359eae1..476334552e79 100644
--- a/pkgs/development/libraries/ngtcp2/gnutls.nix
+++ b/pkgs/development/libraries/ngtcp2/gnutls.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [ gnutls ];
 
+  strictDeps = true;
+
   configureFlags = [ "--with-gnutls=yes" ];
   enableParallelBuilding = true;
 

From 5baff07c874a068ca598dfacf36f9e0b213c9efa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 12 Aug 2026 09:54:05 +0200
Subject: [PATCH 176/551] luajit_2_1: 2.1.1785577137 -> 2.1.1785763465

I saw some fixes for changes done in the parent commit in nixpkgs.
---
 pkgs/development/interpreters/luajit/2.1.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/interpreters/luajit/2.1.nix b/pkgs/development/interpreters/luajit/2.1.nix
index e7f48f19a432..a227695f2cc4 100644
--- a/pkgs/development/interpreters/luajit/2.1.nix
+++ b/pkgs/development/interpreters/luajit/2.1.nix
@@ -8,13 +8,13 @@
 callPackage ./default.nix {
   # The patch version is the timestamp of the git commit,
   # obtain via `cat $(nix-build -A luajit_2_1.src)/.relver`
-  version = "2.1.1785577137";
+  version = "2.1.1785763465";
 
   src = fetchFromGitHub {
     owner = "LuaJIT";
     repo = "LuaJIT";
-    rev = "4886b676a698acc4bbdf54adfabb3e33a8c020e8";
-    hash = "sha256-3nTyPcphBQN2segb5bxBgvrWHodN/ckRy4AGS8lDL44=";
+    rev = "1edc3e52b67eaf6ce5f809be8e17d6862594b8bc";
+    hash = "sha256-mcOvVJ7AaoHrbEXxznpOkFoY7Kbd2aWMoOmyx5B4FIg=";
   };
 
   inherit self passthruFun;

From 7d3b01a9ffa51e7b71a0ff0021f55d0ce711a69f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 12 Aug 2026 10:45:06 +0200
Subject: [PATCH 177/551] lmdb: 0.9.35 -> 0.9.36

https://github.com/LMDB/lmdb/blob/LMDB_0.9.36/libraries/liblmdb/CHANGES
Let's avoid 1.0 for now.  For example, some projects/users have issues
because 1.0 can't use 0.9 DBs and vice versa.
---
 pkgs/by-name/lm/lmdb/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lm/lmdb/package.nix b/pkgs/by-name/lm/lmdb/package.nix
index 41c92ea0c8b6..f228bf12fd4f 100644
--- a/pkgs/by-name/lm/lmdb/package.nix
+++ b/pkgs/by-name/lm/lmdb/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "lmdb";
-  version = "0.9.35";
+  version = "0.9.36";
 
   src = fetchFromGitLab {
     domain = "git.openldap.org";
     owner = "openldap";
     repo = "openldap";
     rev = "LMDB_${version}";
-    sha256 = "sha256-XkOeVqzKojRLojBLkXB0V9lypJnL5ZmGAwutn6aRQIU=";
+    sha256 = "sha256-iOwjUqR2ChCEUDsIFEetVktCD7Mx3R5JgHE+qIhBd5I=";
   };
 
   postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb";

From 137c05240f839a0084fc1e60427ebf9a34fe5aec Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Thu, 6 Aug 2026 13:55:46 +0200
Subject: [PATCH 178/551] gstreamer: 1.28.5 -> 1.28.6

---
 pkgs/development/libraries/gstreamer/bad/default.nix         | 4 ++--
 pkgs/development/libraries/gstreamer/base/default.nix        | 4 ++--
 pkgs/development/libraries/gstreamer/core/default.nix        | 4 ++--
 pkgs/development/libraries/gstreamer/devtools/default.nix    | 4 ++--
 pkgs/development/libraries/gstreamer/ges/default.nix         | 4 ++--
 pkgs/development/libraries/gstreamer/good/default.nix        | 4 ++--
 pkgs/development/libraries/gstreamer/libav/default.nix       | 4 ++--
 pkgs/development/libraries/gstreamer/rtsp-server/default.nix | 4 ++--
 pkgs/development/libraries/gstreamer/ugly/default.nix        | 4 ++--
 9 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index f470d9e7f161..d91572296421 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -116,7 +116,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-bad";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -125,7 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad-${finalAttrs.version}.tar.xz";
-    hash = "sha256-2K9V+u8pWMGoZjdRR17kb1Fkh3z02MWRPqkG7xgK63E=";
+    hash = "sha256-Zjbywiic7aUsSrqXEzjIHitXgNM4G9NnPBwRbsh1h8M=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 4415abbd5931..2f1f0f06feea 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-${finalAttrs.version}.tar.xz";
-    hash = "sha256-d28ZIo+R/SW79U2YUFl+FYUH9ZSHKlK5toFOJCm0Pqo=";
+    hash = "sha256-C6aZx8bGb0umQL54yziiRxWt2Wg/PjoZn1Np3FpPBKw=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index fcc1de6d9920..0c959452333b 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -40,7 +40,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "bin"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${finalAttrs.version}.tar.xz";
-    hash = "sha256-pan3g4CbF6jrd09KdpWyy4y6axVSASmQb4fq8w5/hGk=";
+    hash = "sha256-Yra58K0xR6bdZCCsZKkRgLFOmQaVvd01O5YEFhHQUso=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index e1e8cf9e4637..2dbcdc766ad8 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-devtools";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${finalAttrs.version}.tar.xz";
-    hash = "sha256-dFkEXbMdbkRgC8vgEdySV1AmiHDnuQ9+ego69KIcCeU=";
+    hash = "sha256-FNQfquA2GSUflZWdPVe/ZcYQaDiztUIY3JXHE14euhM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 005a3f90c3a9..0bef33df0348 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-editing-services";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-editing-services/gst-editing-services-${finalAttrs.version}.tar.xz";
-    hash = "sha256-0C+d99108qUCQ6b6XjJ8+71cEhKc57bnPXDAhTJJGog=";
+    hash = "sha256-PRUeUJfWhsWJCudvFMV+4ZU4/WHGz2NxcfkLMJyv1Tw=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 987295f7ac0a..ab6bf03ba581 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -78,7 +78,7 @@ assert raspiCameraSupport -> hostSupportsRaspiCamera;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-good";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${finalAttrs.version}.tar.xz";
-    hash = "sha256-WLRdJKHXeznXu32czG4tdrvyhhiZjDNcFj8Y5vlKkyQ=";
+    hash = "sha256-sMYgpLGLbukxtMQ7vxdg0whmbcN/cwp+fxrTJ+Wc4t8=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 3714fb286d9c..6731f09fb1e9 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-libav";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${finalAttrs.version}.tar.xz";
-    hash = "sha256-RShUZWBW8LFlEaHZrU8mef9eWofIn5DPfuXewAXdseQ=";
+    hash = "sha256-cebq+0//KmbRuwuo0HgiTf5+M5cwfYwLuj3CNgbgj1E=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 5fdb31e1ddd8..742fbc362821 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-rtsp-server";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-rtsp-server/gst-rtsp-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fhn93rEmG+vD7Dl4V/7dXHcSm2arUniP2trQURdWYiU=";
+    hash = "sha256-DLclsTUfdeiIA8Vd3eofJ74JUj3c1/KasYJw4YKipGM=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index b524bc2fac7f..4ad03256c94e 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-ugly";
-  version = "1.28.5";
+  version = "1.28.6";
 
   outputs = [
     "out"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${finalAttrs.version}.tar.xz";
-    hash = "sha256-DvTPnDyaXndqbKjRkKMYYzkbaBmAJSFDuCKymqgx4SA=";
+    hash = "sha256-7iedoTp0D9fwYNYxpnMiP6O8yMM9NQyNAmS9Myok7Ng=";
   };
 
   separateDebugInfo = true;

From a0ea1f703ad59e366a2a4df1ccb47aef3e107a51 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Thu, 6 Aug 2026 17:02:41 +0200
Subject: [PATCH 179/551] python3Packages.gst-python: 1.28.5 -> 1.28.6

---
 pkgs/development/python-modules/gst-python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 1934d3a14ea6..af6a9347b0e3 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "gst-python";
-  version = "1.28.5";
+  version = "1.28.6";
 
   pyproject = false;
 
@@ -32,7 +32,7 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-python/gst-python-${version}.tar.xz";
-    hash = "sha256-CsRhtXALl2aZiqaGQ5BkyvWMpP2vhI39R3tadwCxdsw=";
+    hash = "sha256-NNWEQMU7VJWhI9Ckt7ervG6XkqWyGVTbhqB5Gxb24BI=";
   };
 
   patches = [

From 8b008fc26835247a527558d4e125f482f937499e Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Wed, 12 Aug 2026 12:24:45 +0200
Subject: [PATCH 180/551] gst_all_1.gst-plugins-base: refactor mesonFlags

---
 .../libraries/gstreamer/base/default.nix      | 104 +++++++++++-------
 1 file changed, 67 insertions(+), 37 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 2f1f0f06feea..087c8c50b3d1 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -129,37 +129,48 @@ stdenv.mkDerivation (finalAttrs: {
     libdrm
   ];
 
-  mesonFlags = [
-    "-Dglib_debug=disabled" # cast checks should be disabled on stable releases
-    "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
-    # See https://github.com/GStreamer/gst-plugins-base/blob/d64a4b7a69c3462851ff4dcfa97cc6f94cd64aef/meson_options.txt#L15 for a list of choices
-    "-Dgl_winsys=${
-      lib.concatStringsSep "," (
+  mesonFlags =
+    let
+      # For a list of choices, see
+      # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/blob/d529453528a5dd11c15eab788cce6676141134b7/subprojects/gst-plugins-base/meson.options#L14-1
+      # unsupported platforms: win32, winrt, android
+      # deprecated/ancient platforms: dispmanx, eagl
+      # TODO: should we add egl, surfaceless, viv-fb, gbm?
+      # (on Linux, autodiscovery would automatically add egl and surfaceless)
+      # 'egl', 'surfaceless', 'viv-fb', 'gbm',
+      enabledGlWinSys =
         lib.optional enableX11 "x11"
         ++ lib.optional enableWayland "wayland"
-        ++ lib.optional enableCocoa "cocoa"
-      )
-    }"
-    (lib.mesonEnable "introspection" withIntrospection)
-    (lib.mesonEnable "doc" enableDocumentation)
-    (lib.mesonEnable "libvisual" false)
-    (lib.mesonEnable "tremor" false) # unmaintained in nixpkgs, just use regular libvorbis instead
-    (lib.mesonEnable "vorbis" true)
-  ]
-  ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "-Dtests=disabled"
-  ]
-  ++ lib.optionals (!enableX11) [
-    "-Dx11=disabled"
-    "-Dxi=disabled"
-    "-Dxshm=disabled"
-    "-Dxvideo=disabled"
-  ]
-  # TODO How to disable Wayland?
-  ++ lib.optional (!enableGl) "-Dgl=disabled"
-  ++ lib.optional (!enableAlsa) "-Dalsa=disabled"
-  ++ lib.optional (!enableCdparanoia) "-Dcdparanoia=disabled"
-  ++ lib.optional stdenv.hostPlatform.isDarwin "-Ddrm=disabled";
+        ++ lib.optional enableCocoa "cocoa";
+    in
+    lib.mapAttrsToList lib.mesonEnable {
+      orc = true;
+      orc-compiler = true;
+      nls = true;
+
+      glib_debug = false; # cast checks should be disabled on stable releases
+      examples = false; # requires many dependencies and probably not useful for our users
+      introspection = withIntrospection;
+      doc = enableDocumentation;
+
+      tests = finalAttrs.finalPackage.doCheck;
+
+      libvisual = false;
+      tremor = false; # unmaintained in nixpkgs, just use regular libvorbis instead
+      vorbis = true;
+
+      x11 = enableX11;
+      xi = enableX11;
+      xshm = enableX11;
+      xvideo = enableX11;
+
+      # TODO How to disable Wayland?
+      gl = enableGl;
+      alsa = enableAlsa;
+      cdparanoia = enableCdparanoia;
+      drm = !stdenv.hostPlatform.isDarwin;
+    }
+    ++ [ (lib.mesonOption "gl_winsys" (lib.concatStringsSep "," enabledGlWinSys)) ];
 
   postPatch = ''
     patchShebangs \
@@ -194,20 +205,39 @@ stdenv.mkDerivation (finalAttrs: {
     waylandEnabled = enableWayland;
 
     updateScript = directoryListingUpdater { odd-unstable = true; };
-  };
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = true;
+    };
+  };
 
   meta = {
     description = "Base GStreamer plug-ins and helper libraries";
     homepage = "https://gstreamer.freedesktop.org";
     license = lib.licenses.lgpl2Plus;
-    pkgConfigModules = [
-      "gstreamer-audio-1.0"
-      "gstreamer-base-1.0"
-      "gstreamer-net-1.0"
-      "gstreamer-video-1.0"
-    ];
+    pkgConfigModules = lib.map (m: "gstreamer-${m}-1.0") (
+      [
+        "allocators"
+        "app"
+        "audio"
+        "fft"
+        "pbutils"
+        "plugins-base"
+        "riff"
+        "rtp"
+        "rtsp"
+        "sdp"
+        "tag"
+      ]
+      ++ lib.optionals enableGl [
+        "gl"
+        "gl-egl"
+        "gl-prototypes"
+      ]
+      ++ lib.optional (enableGl && enableWayland) "gl-wayland"
+      ++ lib.optional (enableGl && enableX11) "gl-x11"
+    );
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ tmarkus ];
   };

From 3c13877d44d36f7c6f3f8c4ad3e76602d197d7b3 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Tue, 11 Aug 2026 17:46:51 +0200
Subject: [PATCH 181/551] gst_all_1.gst-plugins-good: refactor mesonFlags

---
 .../libraries/gstreamer/good/default.nix      | 85 +++++++++----------
 1 file changed, 41 insertions(+), 44 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index ab6bf03ba581..00b47201a47e 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   replaceVars,
   meson,
   nasm,
@@ -16,8 +15,6 @@
   libGL,
   libv4l,
   libdv,
-  libavc1394,
-  libiec61883,
   libvpx,
   libdrm,
   speex,
@@ -53,6 +50,10 @@
   libxext,
   libxdamage,
   ncurses,
+  enableFireWire ? stdenv.hostPlatform.isLinux,
+  libavc1394,
+  libiec61883,
+  enableOSS ? stdenv.hostPlatform.isLinux,
   enableWayland ? stdenv.hostPlatform.isLinux,
   wayland,
   wayland-protocols,
@@ -200,9 +201,11 @@ stdenv.mkDerivation (finalAttrs: {
     libGL
     libv4l
     libpulseaudio
+    libgudev
+  ]
+  ++ lib.optionals enableFireWire [
     libavc1394
     libiec61883
-    libgudev
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     apple-sdk_gstreamer
@@ -214,45 +217,38 @@ stdenv.mkDerivation (finalAttrs: {
     libjack2
   ];
 
-  mesonFlags = [
-    "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
-    "-Dglib_debug=disabled" # cast checks should be disabled on stable releases
-    (lib.mesonEnable "doc" enableDocumentation)
-    (lib.mesonEnable "asm" true)
-  ]
-  ++ lib.optionals (!qt5Support) [
-    "-Dqt5=disabled"
-  ]
-  ++ lib.optionals (!qt6Support) [
-    "-Dqt6=disabled"
-  ]
-  ++ lib.optionals (!gtkSupport) [
-    "-Dgtk3=disabled"
-  ]
-  ++ lib.optionals (!enableX11) [
-    "-Dximagesrc=disabled" # Linux-only
-  ]
-  ++ lib.optionals (!enableJack) [
-    "-Djack=disabled"
-  ]
-  ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
-    "-Ddv1394=disabled" # Linux only
-    "-Doss4=disabled" # Linux only
-    "-Doss=disabled" # Linux only
-    "-Dpulse=disabled" # TODO check if we can keep this enabled
-    "-Dv4l2-gudev=disabled" # Linux-only
-    "-Dv4l2=disabled" # Linux-only
-  ]
-  ++ (
-    if raspiCameraSupport then
-      [
-        "-Drpi-lib-dir=${libraspberrypi}/lib"
-      ]
-    else
-      [
-        "-Drpicamsrc=disabled"
-      ]
-  );
+  mesonFlags =
+    lib.mapAttrsToList lib.mesonEnable {
+      orc = true;
+      orc-compiler = true;
+      nls = true;
+
+      tests = finalAttrs.finalPackage.doCheck;
+
+      examples = false; # requires many dependencies and probably not useful for our users
+      glib_debug = false; # cast checks should be disabled on stable releases
+      doc = enableDocumentation;
+      asm = true;
+      qt5 = qt5Support;
+      qt6 = qt6Support;
+      gtk3 = gtkSupport;
+      ximagesrc = enableX11; # Linux-only
+      jack = enableJack;
+
+      # Linux only
+      dv1394 = enableFireWire;
+      oss = enableOSS;
+      oss4 = enableOSS;
+      pulse = stdenv.hostPlatform.isLinux; # TODO check if we can keep this enabled
+      v4l2 = stdenv.hostPlatform.isLinux;
+      v4l2-gudev = stdenv.hostPlatform.isLinux;
+
+      rpicamsrc = raspiCameraSupport;
+    }
+    ++ lib.optionals raspiCameraSupport [
+      (lib.mesonOption "rpi-header-dir" "${lib.getDev libraspberrypi}/include")
+      (lib.mesonOption "rpi-lib-dir" "${lib.getLib libraspberrypi}/lib")
+    ];
 
   postPatch = ''
     patchShebangs \
@@ -264,7 +260,7 @@ stdenv.mkDerivation (finalAttrs: {
     NIX_LDFLAGS =
       # linking error on Darwin
       # https://github.com/NixOS/nixpkgs/pull/70690#issuecomment-553694896
-      "-lncurses";
+      lib.optionalString stdenv.hostPlatform.isDarwin "-lncurses";
   };
 
   # fails 1 tests with "Unexpected critical/warning: g_object_set_is_valid_property: object class 'GstRtpStorage' has no property named ''"
@@ -273,6 +269,7 @@ stdenv.mkDerivation (finalAttrs: {
   # must be explicitly set since 5590e365
   dontWrapQtApps = true;
 
+  # Note: gst-plugins-good produces no pkg-config files unless building static libraries
   preFixup = ''
     moveToOutput "lib/gstreamer-1.0/pkgconfig" "$dev"
   '';

From 1dc7c8fac4dce2a3d07c15271ab83510a868eb28 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 23:01:37 +0200
Subject: [PATCH 182/551] libffi: enable structuredAttrs

---
 pkgs/by-name/li/libffiReal/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libffiReal/package.nix b/pkgs/by-name/li/libffiReal/package.nix
index 3d34ab9f068a..89031a595b68 100644
--- a/pkgs/by-name/li/libffiReal/package.nix
+++ b/pkgs/by-name/li/libffiReal/package.nix
@@ -73,6 +73,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Foreign function call interface library";
     longDescription = ''

From 6ac83a376257ad84178d59e76d1fd72ee49c6937 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 13:23:49 +0200
Subject: [PATCH 183/551] minimal-bootstrap: stage0: enable structuredAttrs for
 libc in dummyStdenv

---
 pkgs/stdenv/linux/stage0.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/stdenv/linux/stage0.nix b/pkgs/stdenv/linux/stage0.nix
index 9fa4bb162efd..e423f7208f05 100644
--- a/pkgs/stdenv/linux/stage0.nix
+++ b/pkgs/stdenv/linux/stage0.nix
@@ -70,6 +70,7 @@ if minbootSupported then
             ln -s ${libcPackage}/lib $out/lib
             ln -s ${libcPackage}/include $out/include
           '';
+          __structuredAttrs = true;
           passthru.isFromBootstrapFiles = true;
         };
         gcc-unwrapped = compilerPackage;
@@ -157,6 +158,7 @@ else
           + lib.optionalString (localSystem.libc == "musl") ''
             ln -s ${bootstrapTools}/include-libc $out/include
           '';
+          __structuredAttrs = true;
           passthru.isFromBootstrapFiles = true;
         };
         gcc-unwrapped = bootstrapTools;

From e8434ae083d0cb4182b5e511d823dae31299aad5 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 14:23:09 +0200
Subject: [PATCH 184/551] minimal-bootstrap: stage2: move NIX_CFLAGS_COMPILE
 override into env

---
 pkgs/stdenv/linux/default.nix | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index c9b64c3086e8..80ffaef377d3 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -519,12 +519,13 @@ in
 
         # TODO(amjoseph): It is not yet entirely clear why this is necessary.
         # Something strange is going on with xgcc and libstdc++ on pkgsMusl.
-        patchelf = super.patchelf.overrideAttrs (
-          previousAttrs:
-          lib.optionalAttrs super.stdenv.hostPlatform.isMusl {
-            NIX_CFLAGS_COMPILE = (previousAttrs.NIX_CFLAGS_COMPILE or "") + " -static-libstdc++";
-          }
-        );
+        patchelf = super.patchelf.overrideAttrs (previousAttrs: {
+          env =
+            previousAttrs.env or { }
+            // lib.optionalAttrs super.stdenv.hostPlatform.isMusl {
+              NIX_CFLAGS_COMPILE = (previousAttrs.env.NIX_CFLAGS_COMPILE or "") + " -static-libstdc++";
+            };
+        });
 
       };
     }

From 9b7c6984563be8b629e9532c31de800bf06bca0c Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 14:13:23 +0200
Subject: [PATCH 185/551] libidn2: enable structuredAttrs, use finalAttrs

---
 pkgs/development/libraries/libidn2/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/libidn2/default.nix b/pkgs/development/libraries/libidn2/default.nix
index 3d06a7410c5e..8b34a2842082 100644
--- a/pkgs/development/libraries/libidn2/default.nix
+++ b/pkgs/development/libraries/libidn2/default.nix
@@ -14,12 +14,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libidn2";
   version = "2.3.8";
 
   src = fetchurl {
-    url = "https://ftp.gnu.org/gnu/libidn/libidn2-${version}.tar.gz";
+    url = "https://ftp.gnu.org/gnu/libidn/libidn2-${finalAttrs.version}.tar.gz";
     hash = "sha256-9VeRG/YXFiHh9y/zX1sYJbs1tS7UUyXc3ukx5dPAeHo=";
   };
 
@@ -44,6 +44,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ libunistring ] ++ lib.optional stdenv.hostPlatform.isDarwin libiconv;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/libidn/#libidn2";
     description = "Free software implementation of IDNA2008 and TR46";
@@ -65,6 +67,6 @@ stdenv.mkDerivation rec {
     ];
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ fpletz ];
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version;
   };
-}
+})

From 67f2ae770a79ca7e3adee6f62300ebf1d538b33a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 14:40:22 +0200
Subject: [PATCH 186/551] libidn2: remove unused argument

---
 pkgs/development/libraries/libidn2/no-bootstrap-reference.nix | 1 -
 pkgs/stdenv/linux/default.nix                                 | 1 -
 2 files changed, 2 deletions(-)

diff --git a/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix b/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix
index ff8c47915067..773dfb6efe0f 100644
--- a/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix
+++ b/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix
@@ -4,7 +4,6 @@
   libidn2,
   libunistring,
   runCommandLocal,
-  patchelf,
 }:
 # Construct a copy of libidn2.* where all (transitive) libc references (in .bin)
 # get replaced by a new one, so that there's no reference to bootstrap tools.
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index c9b64c3086e8..64070e7747f6 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -853,7 +853,6 @@ in
               inherit (self)
                 stdenv
                 runCommandLocal
-                patchelf
                 libunistring
                 ;
             };

From 7611d6ee9aa7518c29a4a86dc6732b5af15377c4 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 14:22:37 +0200
Subject: [PATCH 187/551] binutils-patchelfed-ld: enable structuredAttrs

---
 pkgs/stdenv/linux/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index c9b64c3086e8..002380ca3e03 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -505,6 +505,7 @@ in
             dontUnpack = true;
             dontBuild = true;
             strictDeps = true;
+            __structuredAttrs = true;
             # We wouldn't need to *copy* all, but it's easier and the result is temporary anyway.
             installPhase = ''
               mkdir -p "$out"/bin

From 8f933eda6c2aecd109ce1005dcce431983a36647 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 14:58:41 +0200
Subject: [PATCH 188/551] gzip: enable strictDeps

---
 pkgs/tools/compression/gzip/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 6aafcf6481df..badf811447c0 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [ runtimeShellPackage ];
 
+  strictDeps = true;
+
   makeFlags = [
     "SHELL=/bin/sh"
     "GREP=grep"

From 3fff8a9301dc1d382776cb44483e777204cdb68f Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 14:58:52 +0200
Subject: [PATCH 189/551] gzip: enable structuredAttrs

---
 pkgs/tools/compression/gzip/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index badf811447c0..707a46ad6efe 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -89,6 +89,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests.makecheck = gzip.overrideAttrs { doCheck = true; };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/gzip/";
     description = "GNU zip compression program";

From 242747fe8a8c16368471b9339f77f531d4b2525e Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 18:20:17 +0200
Subject: [PATCH 190/551] autoconf-archive: enable structuredAttrs

---
 pkgs/by-name/au/autoconf-archive/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/au/autoconf-archive/package.nix b/pkgs/by-name/au/autoconf-archive/package.nix
index 8a3e537001e7..deca81bdad53 100644
--- a/pkgs/by-name/au/autoconf-archive/package.nix
+++ b/pkgs/by-name/au/autoconf-archive/package.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ xz ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Archive of autoconf m4 macros";
     homepage = "https://www.gnu.org/software/autoconf-archive/";

From 4101a91e99d5927bd40a99f844026331f080885e Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 18:20:37 +0200
Subject: [PATCH 191/551] dns-root-data: enable strictDeps, enable
 structuredAttrs

---
 pkgs/by-name/dn/dns-root-data/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/dn/dns-root-data/package.nix b/pkgs/by-name/dn/dns-root-data/package.nix
index 88499b9fba9d..87517dc95c4e 100644
--- a/pkgs/by-name/dn/dns-root-data/package.nix
+++ b/pkgs/by-name/dn/dns-root-data/package.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation {
     cp ${./root.ds} $out/root.ds
   '';
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.iana.org/domains/root/files";
     description = "DNS root data including root hints and DNSSEC root trust anchor + key";

From 7c6ad2e2ca8c860df9fce06ed8f5f2b8860d6327 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 20:33:36 +0200
Subject: [PATCH 192/551] libuv: enable strictDeps

---
 pkgs/by-name/li/libuv/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libuv/package.nix b/pkgs/by-name/li/libuv/package.nix
index bcbf5472a7e2..2a29d1bc79d9 100644
--- a/pkgs/by-name/li/libuv/package.nix
+++ b/pkgs/by-name/li/libuv/package.nix
@@ -162,6 +162,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  strictDeps = true;
+
   # This is part of the Darwin bootstrap, so we don’t always get
   # `libutil.dylib` automatically propagated through the SDK.
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [

From 9c7408f7726d53c754e3ec488ebd210c58863631 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 20:34:22 +0200
Subject: [PATCH 193/551] expat: enable structuredAttrs

---
 pkgs/by-name/ex/expat/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index d0d13e37da6f..cbc79fe484c8 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -72,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     changelog = "https://github.com/libexpat/libexpat/blob/${tagFor finalAttrs.version}/expat/Changes";
     homepage = "https://libexpat.github.io/";

From 723fcbddfc2c2777a2551891afc558d7d87187e2 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 20:34:58 +0200
Subject: [PATCH 194/551] libssh2: enable strictDeps

---
 pkgs/by-name/li/libssh2/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libssh2/package.nix b/pkgs/by-name/li/libssh2/package.nix
index b7c88dfc5eb7..2f8a48adcf06 100644
--- a/pkgs/by-name/li/libssh2/package.nix
+++ b/pkgs/by-name/li/libssh2/package.nix
@@ -114,6 +114,8 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [ openssl ]; # see Libs: in libssh2.pc
   buildInputs = [ zlib ] ++ lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64;
 
+  strictDeps = true;
+
   passthru.tests = {
     inherit
       aria2

From 802b74024344bacc11a737db3f72bc2d7d289945 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 20:35:05 +0200
Subject: [PATCH 195/551] libssh2: enable structuredAttrs

---
 pkgs/by-name/li/libssh2/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libssh2/package.nix b/pkgs/by-name/li/libssh2/package.nix
index 2f8a48adcf06..1e2299e9075e 100644
--- a/pkgs/by-name/li/libssh2/package.nix
+++ b/pkgs/by-name/li/libssh2/package.nix
@@ -126,6 +126,8 @@ stdenv.mkDerivation (finalAttrs: {
     curl = (curl.override { scpSupport = true; }).tests.withCheck;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Client-side C library implementing the SSH2 protocol";
     homepage = "https://www.libssh2.org";

From 2d8dde5339215717a4e83eac00c48cc9bc09dbd1 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 20:38:50 +0200
Subject: [PATCH 196/551] cunit: enable strictDeps

---
 pkgs/by-name/cu/cunit/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/cu/cunit/package.nix b/pkgs/by-name/cu/cunit/package.nix
index 7d9ee6b0f51d..6d7c7a30255f 100644
--- a/pkgs/by-name/cu/cunit/package.nix
+++ b/pkgs/by-name/cu/cunit/package.nix
@@ -19,6 +19,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [ libtool ];
 
+  strictDeps = true;
+
   src = fetchurl {
     url = "mirror://sourceforge/cunit/CUnit/${finalAttrs.version}/CUnit-${finalAttrs.version}.tar.bz2";
     sha256 = "057j82da9vv4li4z5ri3227ybd18nzyq81f6gsvhifs5z0vr3cpm";

From 6328665df8135963ff9b29b74cc72dbef5757bbd Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 20:38:56 +0200
Subject: [PATCH 197/551] cunit: enable structuredAttrs

---
 pkgs/by-name/cu/cunit/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/cu/cunit/package.nix b/pkgs/by-name/cu/cunit/package.nix
index 6d7c7a30255f..8c8db5d947bd 100644
--- a/pkgs/by-name/cu/cunit/package.nix
+++ b/pkgs/by-name/cu/cunit/package.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "057j82da9vv4li4z5ri3227ybd18nzyq81f6gsvhifs5z0vr3cpm";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Unit Testing Framework for C";
 

From f3dc70c259c80eca1c86a1aaa21ab4220f52d367 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 20:41:40 +0200
Subject: [PATCH 198/551] gdbm: enable strictDeps

---
 pkgs/by-name/gd/gdbm/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gd/gdbm/package.nix b/pkgs/by-name/gd/gdbm/package.nix
index a31390c4ea3b..1ad4a0bf2f95 100644
--- a/pkgs/by-name/gd/gdbm/package.nix
+++ b/pkgs/by-name/gd/gdbm/package.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
+  strictDeps = true;
+
   hardeningDisable = [ "strictflexarrays3" ];
 
   configureFlags = [ (lib.enableFeature true "libgdbm-compat") ];

From b79b63239a611d9fcd98683e4a7cd1691d7c69c0 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 20:41:52 +0200
Subject: [PATCH 199/551] gdbm: enable structuredAttrs

---
 pkgs/by-name/gd/gdbm/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gd/gdbm/package.nix b/pkgs/by-name/gd/gdbm/package.nix
index 1ad4a0bf2f95..df4c6eae1247 100644
--- a/pkgs/by-name/gd/gdbm/package.nix
+++ b/pkgs/by-name/gd/gdbm/package.nix
@@ -65,6 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/gdbm/";
     description = "GNU dbm key/value database library";

From c13c277dbde4ed41bea290522a3c53d46fd61f48 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 21:09:13 +0200
Subject: [PATCH 200/551] libevent: enable strictDeps

---
 pkgs/by-name/li/libevent/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libevent/package.nix b/pkgs/by-name/li/libevent/package.nix
index d220a63c4963..35f8e2ceb62c 100644
--- a/pkgs/by-name/li/libevent/package.nix
+++ b/pkgs/by-name/li/libevent/package.nix
@@ -59,6 +59,8 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs =
     lib.optional sslSupport openssl ++ lib.optional stdenv.hostPlatform.isCygwin findutils;
 
+  strictDeps = true;
+
   doCheck = false; # needs the net
 
   postInstall = lib.optionalString sslSupport ''

From 6c859e663663292c93358380d240ffc248372edd Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 21:09:31 +0200
Subject: [PATCH 201/551] libevent: enable structuredAttrs, use hash

---
 pkgs/by-name/li/libevent/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libevent/package.nix b/pkgs/by-name/li/libevent/package.nix
index 35f8e2ceb62c..05d16036ed14 100644
--- a/pkgs/by-name/li/libevent/package.nix
+++ b/pkgs/by-name/li/libevent/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Don't define BIO_get_init() for LibreSSL 3.5+
     (fetchpatch {
       url = "https://github.com/libevent/libevent/commit/883630f76cbf512003b81de25cd96cb75c6cf0f9.patch";
-      sha256 = "sha256-VPJqJUAovw6V92jpqIXkIR1xYGbxIWxaHr8cePWI2SU=";
+      hash = "sha256-VPJqJUAovw6V92jpqIXkIR1xYGbxIWxaHr8cePWI2SU=";
     })
   ];
 
@@ -72,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Event notification library";
     mainProgram = "event_rpcgen.py";

From fd87d300945c8f0179de468eac34df32e32296d3 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 21:15:48 +0200
Subject: [PATCH 202/551] libtasn1: enable strictDeps

---
 pkgs/by-name/li/libtasn1/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libtasn1/package.nix b/pkgs/by-name/li/libtasn1/package.nix
index 7de5f9bc2b74..5516233d7ccc 100644
--- a/pkgs/by-name/li/libtasn1/package.nix
+++ b/pkgs/by-name/li/libtasn1/package.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
     perl
   ];
 
+  strictDeps = true;
+
   doCheck = true;
   preCheck =
     if stdenv.hostPlatform.isDarwin then "export DYLD_LIBRARY_PATH=`pwd`/lib/.libs" else null;

From 64ebebdab1d4c7ff231777ea904211bd345d6294 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 21:16:04 +0200
Subject: [PATCH 203/551] libtasn1: enable structuredAttrs

---
 pkgs/by-name/li/libtasn1/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libtasn1/package.nix b/pkgs/by-name/li/libtasn1/package.nix
index 5516233d7ccc..3bd5a828f519 100644
--- a/pkgs/by-name/li/libtasn1/package.nix
+++ b/pkgs/by-name/li/libtasn1/package.nix
@@ -42,6 +42,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit gnutls samba qemu;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/libtasn1/";
     description = "ASN.1 library";

From 64856d04debcb459cfbaeb7957f6fc8b2885714d Mon Sep 17 00:00:00 2001
From: Johan Herland <johan@herland.net>
Date: Wed, 5 Aug 2026 11:06:46 +0200
Subject: [PATCH 204/551] python3Packages.datamodel-code-generator: fix failing
 test on Darwin

---
 .../python-modules/datamodel-code-generator/default.nix        | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/datamodel-code-generator/default.nix b/pkgs/development/python-modules/datamodel-code-generator/default.nix
index 875cb53d382d..4ab9cc01b5a9 100644
--- a/pkgs/development/python-modules/datamodel-code-generator/default.nix
+++ b/pkgs/development/python-modules/datamodel-code-generator/default.nix
@@ -123,6 +123,9 @@ buildPythonPackage (finalAttrs: {
     "test_type_checking_imports_default_to_runtime_imports_for_modular_pydantic_ruff"
   ];
 
+  # Some of the tests use localhost networking.
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "datamodel_code_generator" ];
 
   meta = {

From ab0b6d2c82044a68c6d895d4b80a44016a9bb927 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 21:17:49 +0200
Subject: [PATCH 205/551] net-tools: enable strictDeps

---
 pkgs/os-specific/linux/net-tools/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix
index cad8c516b766..3916b6186501 100644
--- a/pkgs/os-specific/linux/net-tools/default.nix
+++ b/pkgs/os-specific/linux/net-tools/default.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation rec {
     "man"
   ];
 
+  strictDeps = true;
+
   meta = {
     homepage = "http://net-tools.sourceforge.net/";
     description = "Set of tools for controlling the network subsystem in Linux";

From a66df804a468a6c922c75f45bcc87b02d6d4043d Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 21:18:09 +0200
Subject: [PATCH 206/551] net-tools: enable structuredAttrs, use finalAttrs,
 hash

---
 pkgs/os-specific/linux/net-tools/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix
index 3916b6186501..719014c1a04c 100644
--- a/pkgs/os-specific/linux/net-tools/default.nix
+++ b/pkgs/os-specific/linux/net-tools/default.nix
@@ -5,13 +5,13 @@
   fetchpatch,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "net-tools";
   version = "2.10";
 
   src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-smJDWlJB6Jv6UcPKvVEzdTlS96e3uT8y4Iy52W9YDWk=";
+    url = "mirror://sourceforge/net-tools/net-tools-${finalAttrs.version}.tar.xz";
+    hash = "sha256-smJDWlJB6Jv6UcPKvVEzdTlS96e3uT8y4Iy52W9YDWk=";
   };
 
   patches = [
@@ -46,10 +46,12 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "http://net-tools.sourceforge.net/";
     description = "Set of tools for controlling the network subsystem in Linux";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
   };
-}
+})

From 2ffabbce38775c46ea2ad3b48ed7c082c33d0f24 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 21:27:08 +0200
Subject: [PATCH 207/551] libxml2: enable structuredAttrs

---
 pkgs/development/libraries/libxml2/common.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/libxml2/common.nix b/pkgs/development/libraries/libxml2/common.nix
index 61c40a95ffe3..6fbae9218df3 100644
--- a/pkgs/development/libraries/libxml2/common.nix
+++ b/pkgs/development/libraries/libxml2/common.nix
@@ -153,6 +153,8 @@ stdenv'.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://gitlab.gnome.org/GNOME/libxml2";
     description = "XML parsing library for C";

From b7fc755c29d91e82925cd41e16a69d4b7c43cee2 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 02:21:11 +0200
Subject: [PATCH 208/551] zstd: enable strictDeps

---
 pkgs/tools/compression/zstd/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 03d06ce67bcf..07b04ddf69f1 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -45,6 +45,8 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs = lib.optional stdenv.hostPlatform.isUnix bashNonInteractive;
 
+  strictDeps = true;
+
   patches = [
     # This patches makes sure we do not attempt to use the MD5 implementation
     # of the host platform when running the tests

From 61a3d2b3c016c7c865d321b1156e878ffb6b6bd6 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 02:21:24 +0200
Subject: [PATCH 209/551] zstd: enable structuredAttrs, use tag

---
 pkgs/tools/compression/zstd/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 07b04ddf69f1..4000a273168d 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "zstd";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-tNFWIT9ydfozB8dWcmTMuZLCQmQudTFJIkSr0aG7S44=";
   };
 
@@ -146,6 +146,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Zstandard real-time compression algorithm";
     longDescription = ''

From 223da789c8100732b67ac8c7bcfa0a046608a37e Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 02:55:44 +0200
Subject: [PATCH 210/551] libgcrypt: enable structuredAttrs, use finalAttrs

---
 pkgs/by-name/li/libgcrypt/package.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/libgcrypt/package.nix b/pkgs/by-name/li/libgcrypt/package.nix
index 20f8cad0a141..e50f8656c1c0 100644
--- a/pkgs/by-name/li/libgcrypt/package.nix
+++ b/pkgs/by-name/li/libgcrypt/package.nix
@@ -16,12 +16,12 @@
 
 assert enableCapabilities -> stdenv.hostPlatform.isLinux;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libgcrypt";
   version = "1.12.2";
 
   src = fetchurl {
-    url = "mirror://gnupg/libgcrypt/${pname}-${version}.tar.bz2";
+    url = "mirror://gnupg/libgcrypt/libgcrypt-${finalAttrs.version}.tar.bz2";
     hash = "sha256-fOM8JJIiGgQ2+WqFACFenz49y1/SanV81BXnqEO6vV4=";
   };
 
@@ -118,13 +118,15 @@ stdenv.mkDerivation rec {
     inherit gnupg libotr rsyslog;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/libgcrypt/";
-    changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=${pname}.git;a=blob;f=NEWS;hb=refs/tags/${pname}-${version}";
+    changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob;f=NEWS;hb=refs/tags/libgcrypt-${finalAttrs.version}";
     description = "General-purpose cryptographic library";
     license = lib.licenses.lgpl2Plus;
     platforms = lib.platforms.all;
     maintainers = [ ];
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnupg" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnupg" finalAttrs.version;
   };
-}
+})

From 978442edde457484a4c04618927532399d08c3cc Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:06:11 +0200
Subject: [PATCH 211/551] tzdata: enable strictDeps, enable structuredAttrs

---
 pkgs/by-name/tz/tzdata/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/tz/tzdata/package.nix b/pkgs/by-name/tz/tzdata/package.nix
index 75cb3cc49134..7e3f8f38535d 100644
--- a/pkgs/by-name/tz/tzdata/package.nix
+++ b/pkgs/by-name/tz/tzdata/package.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   propagatedBuildOutputs = [ ];
 
+  strictDeps = true;
+
   makeFlags = [
     "TOPDIR=${placeholder "out"}"
     "TZDIR=${placeholder "out"}/share/zoneinfo"
@@ -113,6 +115,8 @@ stdenv.mkDerivation (finalAttrs: {
   # minor releases.
   passthru.tests = postgresql;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "http://www.iana.org/time-zones";
     description = "Database of current and historical time zones";

From 515a68fad06e1025e930a6b4916e78faeb3e1413 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:07:43 +0200
Subject: [PATCH 212/551] swig: enable structuredAttrs, use tag

---
 pkgs/by-name/sw/swig/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/sw/swig/package.nix b/pkgs/by-name/sw/swig/package.nix
index 7b7b7e01a8f3..6afb32b575f8 100644
--- a/pkgs/by-name/sw/swig/package.nix
+++ b/pkgs/by-name/sw/swig/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "swig";
     repo = "swig";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-jsi83v9sg0n5kUfDACqdNAS2VuLSyxv+pe2LRcO4Khc=";
   };
 
@@ -43,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     changelog = "https://github.com/swig/swig/blob/${finalAttrs.src.rev}/CHANGES.current";
     description = "Interface compiler that connects C/C++ code to higher-level languages";

From f53d3b8607a3cd5d713521a13892043535a2ce20 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:12:38 +0200
Subject: [PATCH 213/551] publicsuffix-list: enable strictDeps, enable
 structuredAttrs

---
 pkgs/by-name/pu/publicsuffix-list/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix
index d6c15745fa64..4484241146d4 100644
--- a/pkgs/by-name/pu/publicsuffix-list/package.nix
+++ b/pkgs/by-name/pu/publicsuffix-list/package.nix
@@ -18,6 +18,8 @@ stdenvNoCC.mkDerivation {
 
   dontBuild = true;
 
+  strictDeps = true;
+
   installPhase = ''
     runHook preInstall
 
@@ -28,6 +30,8 @@ stdenvNoCC.mkDerivation {
 
   passthru.updateScript = unstableGitUpdater { };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://publicsuffix.org/";
     description = "Cross-vendor public domain suffix database";

From 4a2272cd68b28ea803a23ef42fc04da00858bbd7 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:15:52 +0200
Subject: [PATCH 214/551] lzo: enable structuredAttrs

---
 pkgs/by-name/lz/lzo/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/lz/lzo/package.nix b/pkgs/by-name/lz/lzo/package.nix
index a3ecb16bb807..c5deccd3be13 100644
--- a/pkgs/by-name/lz/lzo/package.nix
+++ b/pkgs/by-name/lz/lzo/package.nix
@@ -30,6 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
     "doc"
   ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Real-time data (de)compression library";
     longDescription = ''

From 8f6f404a44bf4b56835b6338c34463b2f0120a37 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:16:01 +0200
Subject: [PATCH 215/551] lzo: use sri hash

---
 pkgs/by-name/lz/lzo/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/lz/lzo/package.nix b/pkgs/by-name/lz/lzo/package.nix
index c5deccd3be13..da806c6a1e24 100644
--- a/pkgs/by-name/lz/lzo/package.nix
+++ b/pkgs/by-name/lz/lzo/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.oberhumer.com/opensource/lzo/download/lzo-${finalAttrs.version}.tar.gz";
-    sha256 = "0wm04519pd3g8hqpjqhfr72q8qmbiwqaxcs3cndny9h86aa95y60";
+    hash = "sha256-wPiSlDIIJm+bZUOzrjCPq2KExckOYnkxRG+0m0IhoHI=";
   };
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];

From 49e12b0826d421d2c77ff5ab4b65a5bfc747c0ac Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:17:06 +0200
Subject: [PATCH 216/551] libxslt: enable structuredAttrs

---
 pkgs/by-name/li/libxslt/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libxslt/package.nix b/pkgs/by-name/li/libxslt/package.nix
index da39812157a4..e0303ba11235 100644
--- a/pkgs/by-name/li/libxslt/package.nix
+++ b/pkgs/by-name/li/libxslt/package.nix
@@ -97,6 +97,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://gitlab.gnome.org/GNOME/libxslt";
     description = "C library and tools to do XSL transformations";

From 7072d88d5e8593a9e4aecbee46bcc39e7a76f6a0 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:26:09 +0200
Subject: [PATCH 217/551] nghttp2: enable strictDeps

---
 pkgs/by-name/ng/nghttp2/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ng/nghttp2/package.nix b/pkgs/by-name/ng/nghttp2/package.nix
index 0151aa916190..9c0c5dedfbef 100644
--- a/pkgs/by-name/ng/nghttp2/package.nix
+++ b/pkgs/by-name/ng/nghttp2/package.nix
@@ -77,6 +77,8 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals enablePython [ python3 ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   configureFlags = [

From a2b20fc065590f34f82a9e81d71568466c883bba Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:26:20 +0200
Subject: [PATCH 218/551] nghttp2: enable structuredAttrs, use finalAttrs

---
 pkgs/by-name/ng/nghttp2/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ng/nghttp2/package.nix b/pkgs/by-name/ng/nghttp2/package.nix
index 9c0c5dedfbef..68a42a1826af 100644
--- a/pkgs/by-name/ng/nghttp2/package.nix
+++ b/pkgs/by-name/ng/nghttp2/package.nix
@@ -42,12 +42,12 @@ assert enableHpack -> enableApp;
 assert enableHttp3 -> enableApp;
 assert enableJemalloc -> enableApp;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "nghttp2";
   version = "1.70.0";
 
   src = fetchurl {
-    url = "https://github.com/nghttp2/nghttp2/releases/download/v${version}/nghttp2-${version}.tar.bz2";
+    url = "https://github.com/nghttp2/nghttp2/releases/download/v${finalAttrs.version}/nghttp2-${finalAttrs.version}.tar.bz2";
     hash = "sha256-j6yh94qpmsO8F2ina34PazbY5qYsE4GHUbHSBfAvlAU=";
   };
 
@@ -118,6 +118,8 @@ stdenv.mkDerivation rec {
     inherit curl libsoup_3;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "HTTP/2 C library and tools";
     longDescription = ''
@@ -131,10 +133,10 @@ stdenv.mkDerivation rec {
     '';
 
     homepage = "https://nghttp2.org/";
-    changelog = "https://github.com/nghttp2/nghttp2/releases/tag/v${version}";
+    changelog = "https://github.com/nghttp2/nghttp2/releases/tag/v${finalAttrs.version}";
     # News articles with changes summary can be found here: https://nghttp2.org/blog/archives/
     license = lib.licenses.mit;
     maintainers = [ ];
     platforms = lib.platforms.all;
   };
-}
+})

From 24a79c448adbafabce5dab7a879fd7bdd00216ce Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:27:56 +0200
Subject: [PATCH 219/551] musl-fts: enable strictDeps

---
 pkgs/by-name/mu/musl-fts/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/mu/musl-fts/package.nix b/pkgs/by-name/mu/musl-fts/package.nix
index 09c7cedb009b..ba9b64c3515f 100644
--- a/pkgs/by-name/mu/musl-fts/package.nix
+++ b/pkgs/by-name/mu/musl-fts/package.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   meta = {

From 72103b68c4cb3570d65339f6f5228800a19ed86a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:28:10 +0200
Subject: [PATCH 220/551] musl-fts: enable structuredAttrs, use tag

---
 pkgs/by-name/mu/musl-fts/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/mu/musl-fts/package.nix b/pkgs/by-name/mu/musl-fts/package.nix
index ba9b64c3515f..6ba3b321df29 100644
--- a/pkgs/by-name/mu/musl-fts/package.nix
+++ b/pkgs/by-name/mu/musl-fts/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "void-linux";
     repo = "musl-fts";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "Azw5qrz6OKDcpYydE6jXzVxSM5A8oYWAztrHr+O/DOE=";
   };
 
@@ -26,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/void-linux/musl-fts";
     description = "Implementation of fts(3) for musl-libc";

From bef44b5305824f6c055ac6833d2fe371e8681b38 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:28:35 +0200
Subject: [PATCH 221/551] musl-obstack: enable strictDeps

---
 pkgs/by-name/mu/musl-obstack/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/mu/musl-obstack/package.nix b/pkgs/by-name/mu/musl-obstack/package.nix
index e0172eb8aab9..8915e8b452b5 100644
--- a/pkgs/by-name/mu/musl-obstack/package.nix
+++ b/pkgs/by-name/mu/musl-obstack/package.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   meta = {

From b8ce44e58235e158993a474b3fd01dca5f383aef Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:28:44 +0200
Subject: [PATCH 222/551] musl-obstack: enable structuredAttrs, use tag

---
 pkgs/by-name/mu/musl-obstack/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/mu/musl-obstack/package.nix b/pkgs/by-name/mu/musl-obstack/package.nix
index 8915e8b452b5..cbd56e5bb559 100644
--- a/pkgs/by-name/mu/musl-obstack/package.nix
+++ b/pkgs/by-name/mu/musl-obstack/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "void-linux";
     repo = "musl-obstack";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "sha256-oydS7FubUniMHAUWfg84OH9+CZ0JCrTXy7jzwOyJzC8=";
   };
 
@@ -30,6 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/void-linux/musl-obstack";
     description = "Extraction of the obstack functions and macros from GNU libiberty for use with musl-libc";

From 0e99956984de69eb3697918b3eed08b1a32be120 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:31:54 +0200
Subject: [PATCH 223/551] nghttp3: enable strictDeps

---
 pkgs/by-name/ng/nghttp3/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix
index 852ebfce6194..d6f5302983c8 100644
--- a/pkgs/by-name/ng/nghttp3/package.nix
+++ b/pkgs/by-name/ng/nghttp3/package.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_SHARED_LIB" (!stdenv.hostPlatform.isStatic))
     (lib.cmakeBool "ENABLE_STATIC_LIB" stdenv.hostPlatform.isStatic)

From 6d8416f4edb57e05b18b65400b4fc6ec2fb387eb Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:32:10 +0200
Subject: [PATCH 224/551] nghttp3: enable structuredAttrs

---
 pkgs/by-name/ng/nghttp3/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix
index d6f5302983c8..94cbf454b4d2 100644
--- a/pkgs/by-name/ng/nghttp3/package.nix
+++ b/pkgs/by-name/ng/nghttp3/package.nix
@@ -37,6 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit curl;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/ngtcp2/nghttp3";
     changelog = "https://github.com/ngtcp2/nghttp3/releases/tag/v${finalAttrs.version}";

From 68ee3c81244ca4758ac07ed08ce248579e444db4 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:34:01 +0200
Subject: [PATCH 225/551] libarchive: enable strictDeps

---
 pkgs/by-name/li/libarchive/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix
index fe81d018859c..0f587a6260ac 100644
--- a/pkgs/by-name/li/libarchive/package.nix
+++ b/pkgs/by-name/li/libarchive/package.nix
@@ -108,6 +108,8 @@ stdenv.mkDerivation (finalAttrs: {
     acl
   ];
 
+  strictDeps = true;
+
   hardeningDisable = [
     "strictflexarrays3"
   ]

From 27ff9592b5b79aabcc68f38b38546b339a25af71 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:34:08 +0200
Subject: [PATCH 226/551] libarchive: enable structuredAttrs

---
 pkgs/by-name/li/libarchive/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix
index 0f587a6260ac..7c0d0c9459e5 100644
--- a/pkgs/by-name/li/libarchive/package.nix
+++ b/pkgs/by-name/li/libarchive/package.nix
@@ -142,6 +142,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "http://libarchive.org";
     description = "Multi-format archive and compression library";

From 1637d349797dc8e7fc6848c2d4dd6859469a4366 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:55:32 +0200
Subject: [PATCH 227/551] brotli: enable strictDeps

---
 pkgs/by-name/br/brotli/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/br/brotli/package.nix b/pkgs/by-name/br/brotli/package.nix
index c6cc9bc0e8bb..d4d4467c1fa6 100644
--- a/pkgs/by-name/br/brotli/package.nix
+++ b/pkgs/by-name/br/brotli/package.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
+  strictDeps = true;
+
   cmakeFlags = lib.optional staticOnly "-DBUILD_SHARED_LIBS=OFF";
 
   outputs = [

From 89aa16b64250fc43ec2b6a933ac79b4ddcd0aaf0 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 11:55:40 +0200
Subject: [PATCH 228/551] brotli: enable structuredAttrs

---
 pkgs/by-name/br/brotli/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/br/brotli/package.nix b/pkgs/by-name/br/brotli/package.nix
index d4d4467c1fa6..6d26a2de5ac5 100644
--- a/pkgs/by-name/br/brotli/package.nix
+++ b/pkgs/by-name/br/brotli/package.nix
@@ -62,6 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
     updateScript = nix-update-script { };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/google/brotli";
     changelog = "https://github.com/google/brotli/blob/${finalAttrs.src.tag}/CHANGELOG.md";

From 75bd101d2665506521cdbd83f13931f33c64c332 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 14:58:16 +0200
Subject: [PATCH 229/551] util-linux: enable strictDeps

---
 pkgs/by-name/ut/util-linux/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index bfabdf565486..55d629c08d0a 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -171,6 +171,8 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals ncursesSupport [ ncurses ]
   ++ lib.optionals systemdSupport [ systemdLibs ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   postInstall = ''

From 3fc9dda8d5a113be2ea0dc2b55a0db59d9c03916 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 14:58:26 +0200
Subject: [PATCH 230/551] util-linux: enable structuredAttrs

---
 pkgs/by-name/ut/util-linux/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index 55d629c08d0a..46c428876cac 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -231,6 +231,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.kernel.org/pub/linux/utils/util-linux/";
     description = "Set of system utilities for Linux";

From cc022802b463ba3e11fed6426e007205eba2ef64 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 15:12:39 +0200
Subject: [PATCH 231/551] python3: enable strictDeps

---
 pkgs/development/interpreters/python/cpython/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index e9440614cf34..895394823001 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -366,6 +366,8 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ buildInputs;
 
+  strictDeps = true;
+
   prePatch = optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace configure --replace-fail '`/usr/bin/arch`' '"i386"'
   '';

From 6699a477c8a29f824f1190c9c48ae1907465432a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 15:37:49 +0200
Subject: [PATCH 232/551] python3-bootstrap: enable strictDeps, enable
 structuredAttrs

---
 pkgs/development/python-modules/bootstrap/build/default.nix    | 3 +++
 .../development/python-modules/bootstrap/flit-core/default.nix | 3 +++
 .../development/python-modules/bootstrap/installer/default.nix | 3 +++
 .../development/python-modules/bootstrap/packaging/default.nix | 3 +++
 4 files changed, 12 insertions(+)

diff --git a/pkgs/development/python-modules/bootstrap/build/default.nix b/pkgs/development/python-modules/bootstrap/build/default.nix
index 0d693e2dde58..dbd713e10482 100644
--- a/pkgs/development/python-modules/bootstrap/build/default.nix
+++ b/pkgs/development/python-modules/bootstrap/build/default.nix
@@ -37,6 +37,9 @@ let
 
           runHook postInstall
         '';
+
+        strictDeps = true;
+        __structuredAttrs = true;
       }
       // attrs
     );
diff --git a/pkgs/development/python-modules/bootstrap/flit-core/default.nix b/pkgs/development/python-modules/bootstrap/flit-core/default.nix
index 67b8a00ee0ee..5b5858e598cc 100644
--- a/pkgs/development/python-modules/bootstrap/flit-core/default.nix
+++ b/pkgs/development/python-modules/bootstrap/flit-core/default.nix
@@ -31,4 +31,7 @@ stdenv.mkDerivation {
 
     runHook postInstall
   '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
 }
diff --git a/pkgs/development/python-modules/bootstrap/installer/default.nix b/pkgs/development/python-modules/bootstrap/installer/default.nix
index 9f396bb6275a..2e0c1729bf4b 100644
--- a/pkgs/development/python-modules/bootstrap/installer/default.nix
+++ b/pkgs/development/python-modules/bootstrap/installer/default.nix
@@ -31,4 +31,7 @@ stdenv.mkDerivation {
 
     runHook postInstall
   '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
 }
diff --git a/pkgs/development/python-modules/bootstrap/packaging/default.nix b/pkgs/development/python-modules/bootstrap/packaging/default.nix
index 8f429e5f5c65..e0e067060641 100644
--- a/pkgs/development/python-modules/bootstrap/packaging/default.nix
+++ b/pkgs/development/python-modules/bootstrap/packaging/default.nix
@@ -28,4 +28,7 @@ stdenv.mkDerivation {
 
     runHook postInstall
   '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
 }

From c330f7459666d77c6d5866a47eec640669397a1c Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 15:15:53 +0200
Subject: [PATCH 233/551] help2man: enable structuredAttrs

---
 pkgs/by-name/he/help2man/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/he/help2man/package.nix b/pkgs/by-name/he/help2man/package.nix
index aee62e34cb57..7e19937f788d 100644
--- a/pkgs/by-name/he/help2man/package.nix
+++ b/pkgs/by-name/he/help2man/package.nix
@@ -56,6 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
     chmod +x $out/bin/help2man
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Generate man pages from `--help' output";
     mainProgram = "help2man";

From 76e94ff2d0220b29ebb12223b732f9c8e0d115c7 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 16:26:39 +0200
Subject: [PATCH 234/551] argp-standalone: enable strictDeps

---
 pkgs/by-name/ar/argp-standalone/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ar/argp-standalone/package.nix b/pkgs/by-name/ar/argp-standalone/package.nix
index 3064c3c94f83..470d33de7454 100644
--- a/pkgs/by-name/ar/argp-standalone/package.nix
+++ b/pkgs/by-name/ar/argp-standalone/package.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
   ];
 
+  strictDeps = true;
+
   doCheck = true;
 
   meta = {

From 0d1ecdbf033355eeffa9b0f9f959fcd9640c87b0 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 16:30:26 +0200
Subject: [PATCH 235/551] argp-standalone: enable structuredAttrs

---
 pkgs/by-name/ar/argp-standalone/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ar/argp-standalone/package.nix b/pkgs/by-name/ar/argp-standalone/package.nix
index 470d33de7454..a0aacd8ca60b 100644
--- a/pkgs/by-name/ar/argp-standalone/package.nix
+++ b/pkgs/by-name/ar/argp-standalone/package.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/argp-standalone/argp-standalone";
     description = "Standalone version of arguments parsing functions from Glibc";

From 5f3cc208a38376e196c3259a2186371e9dd0bb8a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 16:50:28 +0200
Subject: [PATCH 236/551] dash: enable structuredAttrs

---
 pkgs/by-name/da/dash/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/da/dash/package.nix b/pkgs/by-name/da/dash/package.nix
index 1b1e6ceeef9d..916d5e54daa3 100644
--- a/pkgs/by-name/da/dash/package.nix
+++ b/pkgs/by-name/da/dash/package.nix
@@ -63,6 +63,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "http://gondor.apana.org.au/~herbert/dash/";
     description = "POSIX-compliant implementation of /bin/sh that aims to be as small as possible";

From 8afda891b48915ece358dbf2d8cdb5b4e07a17f9 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 16:56:04 +0200
Subject: [PATCH 237/551] getopt: enable strictDeps

---
 pkgs/by-name/ge/getopt/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ge/getopt/package.nix b/pkgs/by-name/ge/getopt/package.nix
index 27014776c148..a92d820f0323 100644
--- a/pkgs/by-name/ge/getopt/package.nix
+++ b/pkgs/by-name/ge/getopt/package.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation (finalAttrs: {
   # attempt to use C library functions without declaring them, which is raised as an error.
   env.NIX_CFLAGS_COMPILE = "-D__GNU_LIBRARY__";
 
+  strictDeps = true;
+
   makeFlags = [
     "WITHOUT_GETTEXT=1"
     "LIBCGETOPT=0"

From d9df72fe201997739b39878191e9f3795b12a6bc Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 16:56:13 +0200
Subject: [PATCH 238/551] getopt: enable structuredAttrs

---
 pkgs/by-name/ge/getopt/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ge/getopt/package.nix b/pkgs/by-name/ge/getopt/package.nix
index a92d820f0323..866ce3db12ee 100644
--- a/pkgs/by-name/ge/getopt/package.nix
+++ b/pkgs/by-name/ge/getopt/package.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
     "CC:=$(CC)"
   ];
 
+  __structuredAttrs = true;
+
   meta = {
     platforms = lib.platforms.unix;
     homepage = "http://frodo.looijaard.name/project/getopt";

From 363309e1b8697370a9f42bdd905246a669a78b93 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 16:56:31 +0200
Subject: [PATCH 239/551] libpfm: enable strictDeps

---
 pkgs/by-name/li/libpfm/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libpfm/package.nix b/pkgs/by-name/li/libpfm/package.nix
index 87dcac45923c..f5eafce1fe89 100644
--- a/pkgs/by-name/li/libpfm/package.nix
+++ b/pkgs/by-name/li/libpfm/package.nix
@@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = lib.optional stdenv.hostPlatform.isMinGW windows.libgnurx;
 
+  strictDeps = true;
+
   meta = {
     description = "Helper library to program the performance monitoring events";
     longDescription = ''

From f2d074fb4c6b58eff64d48feece0df871fa9e38a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 16:56:47 +0200
Subject: [PATCH 240/551] libpfm: enable structuredAttrs

---
 pkgs/by-name/li/libpfm/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libpfm/package.nix b/pkgs/by-name/li/libpfm/package.nix
index f5eafce1fe89..d68516dcec02 100644
--- a/pkgs/by-name/li/libpfm/package.nix
+++ b/pkgs/by-name/li/libpfm/package.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Helper library to program the performance monitoring events";
     longDescription = ''

From 107cb3287c2a51ff1434dfd2429c4c2006d4cc98 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 16:57:38 +0200
Subject: [PATCH 241/551] nss-cacert: enable strictDeps

---
 pkgs/by-name/ca/cacert/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
index c4052964cd91..46b8321e3dba 100644
--- a/pkgs/by-name/ca/cacert/package.nix
+++ b/pkgs/by-name/ca/cacert/package.nix
@@ -70,6 +70,8 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ buildcatrust ];
 
+  strictDeps = true;
+
   buildPhase = ''
     mkdir unbundled hashed
     buildcatrust \

From 0e72b80587d46282c9b1a7f5ea8f5a9a98a1c9ab Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 5 Aug 2026 16:57:47 +0200
Subject: [PATCH 242/551] nss-cacert: enable structuredAttrs

---
 pkgs/by-name/ca/cacert/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
index 46b8321e3dba..9ee779721bf0 100644
--- a/pkgs/by-name/ca/cacert/package.nix
+++ b/pkgs/by-name/ca/cacert/package.nix
@@ -249,5 +249,7 @@ stdenv.mkDerivation {
       };
   };
 
+  __structuredAttrs = true;
+
   inherit meta;
 }

From 0389af1b9fe92ffdf73df91cc2fcb98fef1cc06b Mon Sep 17 00:00:00 2001
From: iridiae <264424593+iridiae@users.noreply.github.com>
Date: Wed, 12 Aug 2026 20:45:50 +0200
Subject: [PATCH 243/551] mathematica: 15.0.0 -> 15.0.1

---
 pkgs/by-name/ma/mathematica/versions.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pkgs/by-name/ma/mathematica/versions.nix b/pkgs/by-name/ma/mathematica/versions.nix
index 5fbd2ecd61b0..f583158a94e9 100644
--- a/pkgs/by-name/ma/mathematica/versions.nix
+++ b/pkgs/by-name/ma/mathematica/versions.nix
@@ -4,6 +4,20 @@
     nix --extra-experimental-features nix-command hash file <installer-file>
 */
 [
+  {
+    version = "15.0.1";
+    lang = "en";
+    language = "English";
+    hash = "sha256-7N5FJoj0gTGNwY3Q+8hJGZi+ze6IRRMnwu6nLEv3cF4=";
+    installer = "Wolfram_15.0.1_LIN.sh";
+  }
+  {
+    version = "15.0.1";
+    lang = "en";
+    language = "English";
+    hash = "sha256-VzK8CuOhk4sOO5CL4z3rfpY5631F2RN6c0Dh8cExeeg=";
+    installer = "Wolfram_15.0.1.sh";
+  }
   {
     version = "15.0.0";
     lang = "en";

From 65e0685245cc06ba6db5aaa457f6aed0b03de104 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 12 Aug 2026 21:53:07 +0200
Subject: [PATCH 244/551] libtasn1: use optionalString, newer $(...) bash
 syntax

---
 pkgs/by-name/li/libtasn1/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libtasn1/package.nix b/pkgs/by-name/li/libtasn1/package.nix
index 3bd5a828f519..8e27bac39404 100644
--- a/pkgs/by-name/li/libtasn1/package.nix
+++ b/pkgs/by-name/li/libtasn1/package.nix
@@ -35,8 +35,9 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   doCheck = true;
-  preCheck =
-    if stdenv.hostPlatform.isDarwin then "export DYLD_LIBRARY_PATH=`pwd`/lib/.libs" else null;
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export DYLD_LIBRARY_PATH=$(pwd)/lib/.libs
+  '';
 
   passthru.tests = {
     inherit gnutls samba qemu;

From 709a758bfcd66bdecf728767aa69714b7c35e8ad Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 12 Aug 2026 22:20:24 +0100
Subject: [PATCH 245/551] zvbi: 0.2.44 -> 0.2.45

Changes: https://github.com/zapping-vbi/zvbi/compare/v0.2.44...v0.2.45
---
 pkgs/by-name/zv/zvbi/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/zv/zvbi/package.nix b/pkgs/by-name/zv/zvbi/package.nix
index 50c58744efab..ea33b1e12e8e 100644
--- a/pkgs/by-name/zv/zvbi/package.nix
+++ b/pkgs/by-name/zv/zvbi/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zvbi";
-  version = "0.2.44";
+  version = "0.2.45";
 
   src = fetchFromGitHub {
     owner = "zapping-vbi";
     repo = "zvbi";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-knc9PejugU6K4EQflfz91keZr3ZJqZu2TKFQFFJrxiI=";
+    hash = "sha256-Nkg/Y7tHYAEi3ndbiJwwutVrGCOIE5RUCNQW3j12BkM=";
   };
 
   configureFlags = lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [

From 2c8a0461d23ba38d0f3ebc041e4b935dd5c7f1ef Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Wed, 12 Aug 2026 19:44:47 -0400
Subject: [PATCH 246/551] ci/nixpkgs-vet: use temporary Nix store

On Darwin, nixpkgs-vet fails on nix-store --init:

error: creating directory '/nix/store/.links': Operation not permitted

It happens because in contrast to Linux, /nix/store is not a private r/w
directory but the actual host /nix/store (sandboxed r/o, with existing
.links not visible).

Use a temporary writable store for all platforms.
---
 ci/nixpkgs-vet.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ci/nixpkgs-vet.nix b/ci/nixpkgs-vet.nix
index 6bdf92eedb3f..9dd200064994 100644
--- a/ci/nixpkgs-vet.nix
+++ b/ci/nixpkgs-vet.nix
@@ -31,6 +31,7 @@ runCommand "nixpkgs-vet"
     env.NIXPKGS_VET_NIX_PACKAGE = nix;
   }
   ''
+    export NIX_STORE_DIR=$(mktemp -d)
     export NIX_STATE_DIR=$(mktemp -d)
     $NIXPKGS_VET_NIX_PACKAGE/bin/nix-store --init
 

From 1b5674a21ba58a9366a8af6256c60dfd43ed52f3 Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Thu, 13 Aug 2026 13:12:40 +0300
Subject: [PATCH 247/551] Revert "minimal-bootstrap.glibc: 2.42 -> 2.44"

This reverts commit 985bc462dac0af1721c0dc6048560453e1603869.
---
 pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
index cf71f17513f1..f156f862ecc0 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
@@ -20,11 +20,11 @@
 }:
 let
   pname = "glibc";
-  version = "2.44";
+  version = "2.42";
 
   src = fetchurl {
     url = "mirror://gnu/libc/glibc-${version}.tar.xz";
-    hash = "sha256-N/YA8r7zxegwAUcFlWiyouQKetbMxlzpQlVtSUKcxmc=";
+    hash = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8=";
   };
 
   linkerFile =

From efef4deb458e5d0234c7ebf3b15e3abf984019a9 Mon Sep 17 00:00:00 2001
From: Leon Klingele <git@leonklingele.de>
Date: Thu, 13 Aug 2026 21:46:55 +0200
Subject: [PATCH 248/551] go_1_26: 1.26.5 -> 1.26.6

---
 pkgs/development/compilers/go/1.26.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.26.nix b/pkgs/development/compilers/go/1.26.nix
index b9c04a91729c..9f52b27211ef 100644
--- a/pkgs/development/compilers/go/1.26.nix
+++ b/pkgs/development/compilers/go/1.26.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.26.5";
+  version = "1.26.6";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-SVvkvIcXasVnOS5bQRar2YRm0z17SdQedkzMaXay3EI=";
+    hash = "sha256-oHIcVMaIkBRI13rZs+x+p8R0cwdV/4kTgukuy5P/LLE=";
   };
 
   strictDeps = true;

From 31775096ecdabf36a6b14d7aa411bfd36ff27dbc Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 10 Jun 2026 17:06:48 -0700
Subject: [PATCH 249/551] libcamera: 0.7.0 -> 0.7.1

Release notes: https://git.libcamera.org/libcamera/libcamera.git/tag/?h=v0.7.1

Lots of new features which require changes to the meson configuration.

In particular, SDL2 depends on libcamera, so that option is currently
gated behind the qcam option (even though it applies to the cam app as
well) to break the cycle. Since jpeg is dependent on SDL2, it's gated
the same way.
---
 pkgs/by-name/li/libcamera/package.nix | 35 ++++++++++++++++++---------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/li/libcamera/package.nix b/pkgs/by-name/li/libcamera/package.nix
index 8930cd4d6aee..6da854a41368 100644
--- a/pkgs/by-name/li/libcamera/package.nix
+++ b/pkgs/by-name/li/libcamera/package.nix
@@ -18,21 +18,26 @@
   python3Packages,
   udev,
   libpisp,
+  libglvnd,
   withTracing ? lib.meta.availableOn stdenv.hostPlatform lttng-ust,
   lttng-ust, # withTracing
-  withQcam ? false,
-  qt6, # withQcam
-  libtiff, # withQcam
+  withSoftispGPU ? true, # software ISP GPU acceleration
+  withQcam ? false, # cannot be enabled per default as it causes infinite recursion
+  # withQcam
+  qt6,
+  libjpeg,
+  libtiff,
+  SDL2,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-W9pRE8/0Cf2EEP5bbvy4FsDSeKKSklfJb6T48ZN4dzE=";
+    hash = "sha256-JE0OuhsCL9DAYrVC0/6RlvgOdy+ehO6Bv9M8NtgolkI=";
   };
 
   outputs = [
@@ -87,10 +92,13 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals stdenv.hostPlatform.isAarch [ libpisp ]
   ++ lib.optionals withTracing [ lttng-ust ]
+  ++ lib.optionals withSoftispGPU [ libglvnd ]
   ++ lib.optionals withQcam [
+    libjpeg
     libtiff
     qt6.qtbase
     qt6.qttools
+    SDL2
   ];
 
   nativeBuildInputs = [
@@ -109,22 +117,27 @@ stdenv.mkDerivation rec {
   ++ lib.optional withQcam qt6.wrapQtAppsHook;
 
   mesonFlags = [
-    "-Dv4l2=true"
+    (lib.mesonEnable "v4l2" true)
     (lib.mesonEnable "tracing" withTracing)
     (lib.mesonEnable "qcam" withQcam)
-    "-Dlibunwind=disabled"
-    "-Dlc-compliance=disabled" # tries unconditionally to download gtest when enabled
+    (lib.mesonEnable "apps-output-dng" withQcam)
+    (lib.mesonEnable "cam-output-sdl2" withQcam)
+    (lib.mesonEnable "cam-jpeg" withQcam)
+    (lib.mesonEnable "softisp-gpu" withSoftispGPU)
+    (lib.mesonEnable "libunwind" false)
+    (lib.mesonEnable "libdw" false)
+    (lib.mesonEnable "lc-compliance" false) # tries unconditionally to download gtest when enabled
     # Avoid blanket -Werror to evade build failures on less
     # tested compilers.
-    "-Dwerror=false"
+    (lib.mesonBool "werror" false)
     # Documentation breaks binary compatibility.
     # Given that upstream also provides public documentation,
     # we can disable it here.
-    "-Ddocumentation=disabled"
+    (lib.mesonEnable "documentation" false)
   ]
   ++ lib.optionals stdenv.hostPlatform.isAarch [
     # we don't have tensorflow-lite to build this
-    "-Drpi-awb-nn=disabled"
+    (lib.mesonEnable "rpi-awb-nn" false)
   ];
 
   env = {

From 038675afe21c6abaf00a1954160fb90a1f35b9c5 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Mon, 13 Jul 2026 08:16:24 -0700
Subject: [PATCH 250/551] libcamera: 0.7.1 -> 0.7.2

Changelog: https://gitlab.freedesktop.org/camera/libcamera/-/releases/v0.7.2
---
 pkgs/by-name/li/libcamera/package.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libcamera/package.nix b/pkgs/by-name/li/libcamera/package.nix
index 6da854a41368..403a2f70c0bf 100644
--- a/pkgs/by-name/li/libcamera/package.nix
+++ b/pkgs/by-name/li/libcamera/package.nix
@@ -10,6 +10,7 @@
   libdrm,
   libevent,
   libyaml,
+  libyuv,
   gst_all_1,
   gtest,
   graphviz,
@@ -32,12 +33,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-JE0OuhsCL9DAYrVC0/6RlvgOdy+ehO6Bv9M8NtgolkI=";
+    hash = "sha256-vhFkeT1j2KKm+CVvGrtH5BEYJSEdaX7N7DRdA0a9EWk=";
   };
 
   outputs = [
@@ -85,6 +86,8 @@ stdenv.mkDerivation rec {
     # pycamera
     python3Packages.pybind11
 
+    libyuv
+
     # yamlparser
     libyaml
 

From 0524a6c5bbd4d88b1f85fcb4ead061918b0aae26 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Fri, 29 May 2026 22:23:58 +0000
Subject: [PATCH 251/551] rsync: enable strictDeps

`nix-build -A rsync` on x86_64-linux is bit-for-bit identical
before and after this change. same with `pkgsMusl.rsync`.
---
 pkgs/by-name/rs/rsync/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix
index a39a47765b4d..7d29c5995e63 100644
--- a/pkgs/by-name/rs/rsync/package.nix
+++ b/pkgs/by-name/rs/rsync/package.nix
@@ -5,6 +5,7 @@
   fetchpatch,
 
   updateAutotoolsGnuConfigScriptsHook,
+  bashNonInteractive,
   perl,
   python3,
   libiconv,
@@ -58,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    bashNonInteractive
     libiconv
     zlib
     popt
@@ -109,6 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   doCheck = true;
+  strictDeps = true;
 
   __darwinAllowLocalNetworking = true;
 

From 65e9f2c04429a9f8787f2d376092a2829ec5d307 Mon Sep 17 00:00:00 2001
From: Jamie Magee <jamie.magee@gmail.com>
Date: Sat, 1 Aug 2026 19:41:49 -0700
Subject: [PATCH 252/551] libpisp: 1.2.1 -> 1.7.0

---
 pkgs/by-name/li/libpisp/package.nix | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/li/libpisp/package.nix b/pkgs/by-name/li/libpisp/package.nix
index 6ee36b13ea8a..01f247bf2650 100644
--- a/pkgs/by-name/li/libpisp/package.nix
+++ b/pkgs/by-name/li/libpisp/package.nix
@@ -7,28 +7,19 @@
   ninja,
   boost,
   nlohmann_json,
-  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpisp";
-  version = "1.2.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "libpisp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YshU7G5Rov67CVwFbf5ENp2j5ptAvkVrlMu85KmnEpk=";
+    hash = "sha256-hzJA8hoOXf2Lswwz9t0StJ9JJP8ICWJlstzSsli4Yqs=";
   };
 
-  patches = [
-    # fix build with glibc 2.42 & -Werror
-    (fetchpatch {
-      url = "https://github.com/raspberrypi/libpisp/commit/f2bbf7e000d3f11cac235b8ea1291722080a016c.patch";
-      hash = "sha256-vrdmVadyjlAnZtmBahOs/hlKPrkh/BF3LvrTPM9D15Q=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
     meson

From 278d4d59cf8b300aa63ca22905d3d563ebf6273d Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Fri, 14 Aug 2026 13:03:58 +0800
Subject: [PATCH 253/551] ffmpeg_9: 9.0 -> 9.0.1

---
 pkgs/development/libraries/ffmpeg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index 9a37a2d12637..492830ac3f5d 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -36,8 +36,8 @@ let
   };
 
   v9 = {
-    version = "9.0";
-    hash = "sha256-LbHwxvylAPh5lb/H+o+9eMVTB9X+tphrxYYX0cqAL0k=";
+    version = "9.0.1";
+    hash = "sha256-9Vnryl9jSSXRfvt2jPsNp7vHWL0KYdWA29D2zDRAZ+0=";
   };
 in
 

From 64710d6cc7c15eb7c25d7cc1de01fc3e6ecfed30 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 14 Aug 2026 12:23:25 +0200
Subject: [PATCH 254/551] nodejs_22,nodejs_24: fix builds with Ada 4.x

---
 pkgs/development/web/nodejs/v22.nix | 12 ++++++++++++
 pkgs/development/web/nodejs/v24.nix | 12 ++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index d80eb73a7e84..0d5558cc85ca 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -57,6 +57,18 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
+
+      # TODO: remove when support for Ada 4.x has landed upstream
+      (fetchpatch2 {
+        url = "https://github.com/nodejs/node/commit/eb1a49b0aec9e05cbb59f093d38f0a92818b7de1.patch?full_index=1";
+        hash = "sha256-LmLbsRZKkOGXzqDQxNrK/B8TGIrsr4pXIUEv3P6C9Sc=";
+        excludes = [ "deps/*" ];
+      })
+      (fetchpatch2 {
+        url = "https://github.com/nodejs/node/commit/064e2eee1ec7b17c4bc6e36befc2935eee80d0f7.patch?full_index=1";
+        hash = "sha256-RcmWiTpWYwA952nNmhaiq4zw/iuVAXFnuTeuB6ltR1U=";
+        includes = [ "test/fixtures/wpt/url/resources/urltestdata.json" ];
+      })
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
       # Fix builds with shared llhttp
diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 262990f1826e..ad0cdcc637b7 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -62,6 +62,18 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
+
+      # TODO: remove when support for Ada 4.x has landed upstream
+      (fetchpatch2 {
+        url = "https://github.com/nodejs/node/commit/eb1a49b0aec9e05cbb59f093d38f0a92818b7de1.patch?full_index=1";
+        hash = "sha256-LmLbsRZKkOGXzqDQxNrK/B8TGIrsr4pXIUEv3P6C9Sc=";
+        excludes = [ "deps/*" ];
+      })
+      (fetchpatch2 {
+        url = "https://github.com/nodejs/node/commit/064e2eee1ec7b17c4bc6e36befc2935eee80d0f7.patch?full_index=1";
+        hash = "sha256-RcmWiTpWYwA952nNmhaiq4zw/iuVAXFnuTeuB6ltR1U=";
+        includes = [ "test/fixtures/wpt/url/resources/urltestdata.json" ];
+      })
     ]
     ++ gypPatches
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [

From 8e1d4e81b470df70bf12a775082d3ba20ca6666f Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 2 Aug 2026 23:12:37 +0200
Subject: [PATCH 255/551] gnused: enable structuredAttrs, use finalAttrs, hash

---
 pkgs/tools/text/gnused/default.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index a1e793e6eba5..ba45205c1359 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -6,13 +6,13 @@
   perl,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnused";
   version = "4.10";
 
   src = fetchurl {
-    url = "mirror://gnu/sed/sed-${version}.tar.xz";
-    sha256 = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc=";
+    url = "mirror://gnu/sed/sed-${finalAttrs.version}.tar.xz";
+    hash = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc=";
   };
 
   outputs = [
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
   ];
 
   strictDeps = true;
+  __structuredAttrs = true;
 
   preConfigure = "patchShebangs ./build-aux/help2man";
 
@@ -53,4 +54,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ mic92 ];
     mainProgram = "sed";
   };
-}
+})

From 1716f7964658f9a9987398b6405c87dcfa711234 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 18:47:18 +0200
Subject: [PATCH 256/551] jq: enable structuredAttrs

---
 pkgs/by-name/jq/jq/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/jq/jq/package.nix b/pkgs/by-name/jq/jq/package.nix
index 762562f1c7b3..fdd171b08316 100644
--- a/pkgs/by-name/jq/jq/package.nix
+++ b/pkgs/by-name/jq/jq/package.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   strictDeps = true;
+  __structuredAttrs = true;
   enableParallelBuilding = true;
 
   buildInputs = lib.optionals onigurumaSupport [ oniguruma ];

From e1a664891adcca96b92b78a1a3edc3d6d79c5b38 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 4 Aug 2026 20:33:47 +0200
Subject: [PATCH 257/551] libuv: enable structuredAttrs, use tag, reorder args

pkgsStatic is also only used for passthru.tests
---
 pkgs/by-name/li/libuv/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libuv/package.nix b/pkgs/by-name/li/libuv/package.nix
index 2a29d1bc79d9..a3c6476bd7fb 100644
--- a/pkgs/by-name/li/libuv/package.nix
+++ b/pkgs/by-name/li/libuv/package.nix
@@ -7,7 +7,6 @@
   darwin,
   libtool,
   pkg-config,
-  pkgsStatic,
 
   # for passthru.tests
   bind,
@@ -19,6 +18,7 @@
   neovim,
   nodejs,
   ocamlPackages,
+  pkgsStatic,
   python3,
   testers,
 }:
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libuv";
     repo = "libuv";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Y9Nph2LkT1qnOYTW3WCumWWwORnI4P7HxzBjUlGaL7M=";
   };
 
@@ -211,6 +211,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Multi-platform support library with a focus on asynchronous I/O";
     homepage = "https://libuv.org/";

From fdb44f23c76087dd7b34d45147071250bc21197a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 15:46:13 +0200
Subject: [PATCH 258/551] libuv: remove test hack

All instances of "-lutil" in
https://github.com/libuv/libuv/blob/v1.52.1/Makefile.am
are already followed by "-lm"
---
 pkgs/by-name/li/libuv/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/li/libuv/package.nix b/pkgs/by-name/li/libuv/package.nix
index a3c6476bd7fb..c16084e0ac39 100644
--- a/pkgs/by-name/li/libuv/package.nix
+++ b/pkgs/by-name/li/libuv/package.nix
@@ -151,8 +151,6 @@ stdenv.mkDerivation (finalAttrs: {
     in
     lib.optionalString (finalAttrs.finalPackage.doCheck) ''
       sed '/${tdRegexp}/d' -i test/test-list.h
-      # https://github.com/libuv/libuv/issues/4794
-      substituteInPlace Makefile.am --replace-fail -lutil "-lutil -lm"
     '';
 
   nativeBuildInputs = [

From a3c24cd214fea98863b733343c7ee8b21740fd96 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Thu, 13 Aug 2026 23:09:40 +0200
Subject: [PATCH 259/551] git: enable strictDeps

---
 pkgs/by-name/gi/git/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix
index 3aa66809b005..98938fd81afb 100644
--- a/pkgs/by-name/gi/git/package.nix
+++ b/pkgs/by-name/gi/git/package.nix
@@ -213,6 +213,8 @@ stdenv.mkDerivation (finalAttrs: {
     buildPackages.stdenv.cc
   ];
 
+  strictDeps = true;
+
   env = {
     # required to support pthread_cancel()
     NIX_LDFLAGS =

From c0c3749ea6d3f7597613b6428fddffad1c30cd54 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 17:26:31 +0200
Subject: [PATCH 260/551] git: remove uses of *FlagsArray

Since structuredAttrs are enabled, the *Flags variables already are arrays.
---
 pkgs/by-name/gi/git/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix
index 98938fd81afb..f20fdd8eaf3e 100644
--- a/pkgs/by-name/gi/git/package.nix
+++ b/pkgs/by-name/gi/git/package.nix
@@ -236,7 +236,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   preBuild = ''
-    makeFlagsArray+=( perllibdir=$out/$(perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}') )
+    makeFlags+=( perllibdir=$out/$(perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}') )
   '';
 
   makeFlags = [
@@ -282,7 +282,7 @@ stdenv.mkDerivation (finalAttrs: {
         ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES}}
         SHELL="$SHELL"
     )
-    concatTo flagsArray makeFlags makeFlagsArray buildFlags buildFlagsArray
+    concatTo flagsArray makeFlags buildFlags
     echoCmd 'build flags' "''${flagsArray[@]}"
   ''
   + lib.optionalString withManual ''
@@ -343,7 +343,7 @@ stdenv.mkDerivation (finalAttrs: {
         ''${enableParallelInstalling:+-j''${NIX_BUILD_CORES}}
         SHELL="$SHELL"
     )
-    concatTo flagsArray makeFlags makeFlagsArray installFlags installFlagsArray
+    concatTo flagsArray makeFlags installFlags
     echoCmd 'install flags' "''${flagsArray[@]}"
 
     # Install git-subtree.
@@ -486,7 +486,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   installCheckTarget = "test";
 
-  # see also installCheckFlagsArray
+  # see also installCheckFlags in preInstallCheck
   installCheckFlags = [
     "DEFAULT_TEST_TARGET=prove"
     "PERL_PATH=${buildPackages.perl}/bin/perl"
@@ -510,7 +510,7 @@ stdenv.mkDerivation (finalAttrs: {
       NIX_BUILD_CORES=32
     fi
 
-    installCheckFlagsArray+=(
+    installCheckFlags+=(
       GIT_PROVE_OPTS="--jobs $NIX_BUILD_CORES --failures --state=failed,save"
       GIT_TEST_INSTALLED=$out/bin
       ${lib.optionalString (!svnSupport) "NO_SVN_TESTS=y"}

From e70344ac2d05ef5864c06b91b7933a0c28544c87 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:16:23 +0200
Subject: [PATCH 261/551] abseil*: enable structuredAttrs

---
 pkgs/by-name/ab/abseil-cpp_202505/package.nix | 2 ++
 pkgs/by-name/ab/abseil-cpp_202508/package.nix | 2 ++
 pkgs/by-name/ab/abseil-cpp_202601/package.nix | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/pkgs/by-name/ab/abseil-cpp_202505/package.nix b/pkgs/by-name/ab/abseil-cpp_202505/package.nix
index 9dd41332758e..2485b170ce43 100644
--- a/pkgs/by-name/ab/abseil-cpp_202505/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202505/package.nix
@@ -45,6 +45,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
diff --git a/pkgs/by-name/ab/abseil-cpp_202508/package.nix b/pkgs/by-name/ab/abseil-cpp_202508/package.nix
index 4c5a7b415cfe..c15d08514b2d 100644
--- a/pkgs/by-name/ab/abseil-cpp_202508/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202508/package.nix
@@ -50,6 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
diff --git a/pkgs/by-name/ab/abseil-cpp_202601/package.nix b/pkgs/by-name/ab/abseil-cpp_202601/package.nix
index f71a2aedf920..15d8d2a42a22 100644
--- a/pkgs/by-name/ab/abseil-cpp_202601/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202601/package.nix
@@ -39,6 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ gtest ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";

From 2a0f4fb6e574840e844943f173c2bd8a058ccf22 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:16:37 +0200
Subject: [PATCH 262/551] boost-build: enable strictDeps

---
 pkgs/by-name/bo/boost-build/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/bo/boost-build/package.nix b/pkgs/by-name/bo/boost-build/package.nix
index de41ba27871a..2c5ed9507a89 100644
--- a/pkgs/by-name/bo/boost-build/package.nix
+++ b/pkgs/by-name/bo/boost-build/package.nix
@@ -58,6 +58,8 @@ stdenv.mkDerivation {
     bison
   ];
 
+  strictDeps = true;
+
   buildPhase = ''
     runHook preBuild
     ./bootstrap.sh

From 6f695ecc0ae5df297890dcfa0a1265406ae747f4 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:16:55 +0200
Subject: [PATCH 263/551] boost-build: enable structuredAttrs, use tag

---
 pkgs/by-name/bo/boost-build/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/bo/boost-build/package.nix b/pkgs/by-name/bo/boost-build/package.nix
index 2c5ed9507a89..732b35fd8fda 100644
--- a/pkgs/by-name/bo/boost-build/package.nix
+++ b/pkgs/by-name/bo/boost-build/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     useBoost.src or (fetchFromGitHub {
       owner = "boostorg";
       repo = "build";
-      rev = defaultVersion;
+      tag = defaultVersion;
       sha256 = "1r4rwlq87ydmsdqrik4ly5iai796qalvw7603mridg2nwcbbnf54";
     });
 
@@ -78,6 +78,8 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.boost.org/build/";
     license = lib.licenses.boost;

From b970e996081be10e3c41ba6b2ac80bb2ce8090bd Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:17:10 +0200
Subject: [PATCH 264/551] catch2: enable strictDeps

---
 pkgs/by-name/ca/catch2/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ca/catch2/package.nix b/pkgs/by-name/ca/catch2/package.nix
index 5d8315120c08..3e45188b1c63 100644
--- a/pkgs/by-name/ca/catch2/package.nix
+++ b/pkgs/by-name/ca/catch2/package.nix
@@ -18,6 +18,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
+  strictDeps = true;
+
   cmakeFlags = [ "-H.." ];
 
   meta = {

From a512cc03d66083c8ea983b7c9c22381a12cb0199 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:17:23 +0200
Subject: [PATCH 265/551] catch2: enable structuredAttrs, use tag/hash

---
 pkgs/by-name/ca/catch2/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/catch2/package.nix b/pkgs/by-name/ca/catch2/package.nix
index 3e45188b1c63..1565a2d1ae73 100644
--- a/pkgs/by-name/ca/catch2/package.nix
+++ b/pkgs/by-name/ca/catch2/package.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-XnT2ziES94Y4uzWmaxSw7nWegJFQjAqFUG8PkwK5nLU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XnT2ziES94Y4uzWmaxSw7nWegJFQjAqFUG8PkwK5nLU=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -22,6 +22,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [ "-H.." ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Multi-paradigm automated test framework for C++ and Objective-C (and, maybe, C)";
     homepage = "http://catch-lib.net";

From 63c29e785dc57df76a0923c0bce3223b552d3121 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:17:31 +0200
Subject: [PATCH 266/551] eigen: enable strictDeps

---
 pkgs/by-name/ei/eigen/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ei/eigen/package.nix b/pkgs/by-name/ei/eigen/package.nix
index c127636f24c3..811cfc4414ac 100644
--- a/pkgs/by-name/ei/eigen/package.nix
+++ b/pkgs/by-name/ei/eigen/package.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     ctestCheckHook
   ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "EIGEN_LEAVE_TEST_IN_ALL_TARGET" true) # Build tests in parallel
   ];

From ccad2c35cc6e36eff126dbba35a4a49b9120d35a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:17:40 +0200
Subject: [PATCH 267/551] eigen: enable structuredAttrs

---
 pkgs/by-name/ei/eigen/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ei/eigen/package.nix b/pkgs/by-name/ei/eigen/package.nix
index 811cfc4414ac..8b1c86f12fd8 100644
--- a/pkgs/by-name/ei/eigen/package.nix
+++ b/pkgs/by-name/ei/eigen/package.nix
@@ -49,6 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
   # too many flaky tests
   doCheck = false;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://eigen.tuxfamily.org";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";

From 643d4dd16962eef129e6ccb3924e1810391c8366 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:17:48 +0200
Subject: [PATCH 268/551] gbenchmark: enable strictDeps

---
 pkgs/by-name/gb/gbenchmark/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix
index fffc36fdfbbf..ad99c1ee5b0e 100644
--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeCheckInputs = lib.optionals (glibcLocales != null) [ glibcLocales ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "BENCHMARK_USE_BUNDLED_GTEST" false)
     (lib.cmakeBool "BENCHMARK_ENABLE_WERROR" false)

From 9bf76edf5a200c2b4c4e514caf341f3df062284b Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:18:03 +0200
Subject: [PATCH 269/551] gbenchmark: enable structuredAttrs

---
 pkgs/by-name/gb/gbenchmark/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix
index ad99c1ee5b0e..d9440337a1a2 100644
--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -75,6 +75,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit prometheus-cpp;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Microbenchmark support library";
     homepage = "https://github.com/google/benchmark";

From 9c865cbc73b4a308ca5da4ca15e14ffd5809731c Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:18:47 +0200
Subject: [PATCH 270/551] maturin: enable structuredAttrs

---
 pkgs/by-name/ma/maturin/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index fae97effb3b9..4576351fb4b2 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -48,6 +48,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     updateScript = nix-update-script { };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Build and publish Rust crates Python packages";
     longDescription = ''

From b46d3023494e8bb95fc550a731005896d63fa655 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:18:56 +0200
Subject: [PATCH 271/551] re2: enable strictDeps

---
 pkgs/by-name/re/re2/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/re/re2/package.nix b/pkgs/by-name/re/re2/package.nix
index 06249cd01c8f..22b4a96df6fa 100644
--- a/pkgs/by-name/re/re2/package.nix
+++ b/pkgs/by-name/re/re2/package.nix
@@ -43,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = [ abseil-cpp ] ++ lib.optionals (!stdenv.hostPlatform.isStatic) [ icu ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "RE2_BUILD_TESTING" true)
     (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--timeout;999999")

From 6502d61f22617795474d3539d599cd8b12cba3a0 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:19:10 +0200
Subject: [PATCH 272/551] re2: enable structuredAttrs, use tag

---
 pkgs/by-name/re/re2/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/re/re2/package.nix b/pkgs/by-name/re/re2/package.nix
index 22b4a96df6fa..06bc5bd10c12 100644
--- a/pkgs/by-name/re/re2/package.nix
+++ b/pkgs/by-name/re/re2/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-0J1HVk+eR7VN0ymucW9dNlT36j16XIfCzcs1EVyEIEU=";
   };
 
@@ -62,6 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
     haskell-re2 = haskellPackages.re2;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Regular expression library";
     longDescription = ''

From f93982ce4da94ba29eb09a28b94e6a1d28aadf53 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:23:39 +0200
Subject: [PATCH 273/551] lua: enable strictDeps

---
 pkgs/development/interpreters/lua-5/interpreter.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix
index c4fc149074ee..8128f4416944 100644
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@@ -82,6 +82,8 @@ stdenv.mkDerivation (
     nativeBuildInputs = [ makeWrapper ];
     buildInputs = [ readline ];
 
+    strictDeps = true;
+
     inherit patches;
 
     postPatch = ''

From d45d9dc17fb47307cdb97c0d4807a7f57c3fe381 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 00:23:49 +0200
Subject: [PATCH 274/551] lua: enable structuredAttrs

---
 pkgs/development/interpreters/lua-5/interpreter.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix
index 8128f4416944..c7cc52a75a5e 100644
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@@ -219,6 +219,8 @@ stdenv.mkDerivation (
         );
       };
 
+    __structuredAttrs = true;
+
     meta = {
       homepage = "https://www.lua.org";
       description = "Powerful, fast, lightweight, embeddable scripting language";

From b2dbab49281688bdf6e2bfc72cf165e1c77c4c53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 11 Aug 2026 19:33:42 -0700
Subject: [PATCH 275/551] cpio: patch CVE-2026-66484, CVE-2026-66485, and
 CVE-2026-66486

---
 pkgs/by-name/cp/cpio/package.nix | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/cp/cpio/package.nix b/pkgs/by-name/cp/cpio/package.nix
index d53c81fe6919..30e608bda31f 100644
--- a/pkgs/by-name/cp/cpio/package.nix
+++ b/pkgs/by-name/cp/cpio/package.nix
@@ -2,7 +2,9 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   autoreconfHook,
+  texinfo,
 
   # for passthru.tests
   git,
@@ -20,7 +22,29 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-k3YQuXwymh7JJoVT+3gAN7z/8Nz/6XJevE/ZwaqQdds=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-66484.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=e2b9cbdd3354d2b1569b7390d1bc15c1930559ad";
+      hash = "sha256-WjphVpMaI/ePg8MTZx+vvilKzpRAAzhAFwCwrbsPLRE=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-66485.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=3cd514031371d8aeeaf2048aa10103e02831aaa9";
+      hash = "sha256-YDlROEYYlZERNzzlx1cQD29gV5IrU01aVcZ/sKpWrRo=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-66486.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=2ff9600c9ef32e88759843cdbde74c8db5ae9b30";
+      excludes = [ "NEWS" ];
+      hash = "sha256-qi9/9xhKnIyPpji63RgzbnnHZsJgwRnQVMaMiLxQipk=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    texinfo # for makeinfo
+  ];
 
   separateDebugInfo = true;
 

From 1e1128d44308d31fef7d5372bafe89d9bd496eca Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Fri, 14 Aug 2026 22:32:14 +0200
Subject: [PATCH 276/551] libpq: 18.4 -> 18.16

Release Notes:
https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

Note: 18.5 was not shipped due to a regression.
---
 pkgs/servers/sql/postgresql/libpq.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index 5ea0c5113225..96c05fdf54c6 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -40,14 +40,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpq";
-  version = "18.4";
+  version = "18.6";
 
   src = fetchFromGitHub {
     owner = "postgres";
     repo = "postgres";
     # rev, not tag, on purpose: see generic.nix.
-    rev = "refs/tags/REL_18_4";
-    hash = "sha256-Ac/Dqcj8vjcW3my5vsnKaMiQqTq/HPtUzckJ3SMyrfA=";
+    rev = "refs/tags/REL_18_6";
+    hash = "sha256-ySffxlG7jlNyzx++BmIN+WuaQ9TMAJt/qER9wIjd6B8=";
   };
 
   __structuredAttrs = true;

From f1f02f03cf9a86b9b703ee27840aca9e35e8fc24 Mon Sep 17 00:00:00 2001
From: Yiyu Zhou <yiyu@yiyuzhou.io>
Date: Fri, 14 Aug 2026 13:54:25 -0700
Subject: [PATCH 277/551] aroccPackages.latest-unwrapped: 0-unstable-2025-11-09
 -> 0-unstable-2026-04-02

---
 pkgs/development/compilers/arocc/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/arocc/default.nix b/pkgs/development/compilers/arocc/default.nix
index 47bb659cbde6..a017b60b9a4e 100644
--- a/pkgs/development/compilers/arocc/default.nix
+++ b/pkgs/development/compilers/arocc/default.nix
@@ -8,12 +8,12 @@ let
   versions = [
     {
       inherit zig;
-      version = "0-unstable-2025-11-09";
+      version = "0-unstable-2026-04-02";
       src = fetchFromGitHub {
         owner = "Vexu";
         repo = "arocc";
-        rev = "3fb778c201718bd82bf1f08cd46ea133c4697b76";
-        hash = "sha256-Hac+rhf7wB3KTs2OIfdcGVq2+H/81yXMl3cq//LUeRk=";
+        rev = "5f5a050569a95ecc40a426f0c3666ae7ef987ede";
+        hash = "sha256-f8Z0SXWx5Uia2TCMB5SUpcO8+xUnaWk32Oknva7xcxw=";
       };
     }
   ];

From f9ef1d4ae61cf45819bd74866656e10f009beec8 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Fri, 14 Aug 2026 19:28:12 -0300
Subject: [PATCH 278/551] sandhole: 0.10.2 -> 0.10.3

---
 pkgs/by-name/sa/sandhole/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/sa/sandhole/package.nix b/pkgs/by-name/sa/sandhole/package.nix
index 50dc64b57804..bd445eb813e8 100644
--- a/pkgs/by-name/sa/sandhole/package.nix
+++ b/pkgs/by-name/sa/sandhole/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sandhole";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchFromGitHub {
     owner = "EpicEric";
     repo = "sandhole";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iU9rMBiI+nlEqGthb/zHKsG/KPdBd16BKUsvzyCR0UY=";
+    hash = "sha256-9Bs8J+aHxKoHX8ksxe/iwl297rVyKDk4nm3+vzzh7Lo=";
   };
 
-  cargoHash = "sha256-PX2tRsNC60S2sc6kVuRS7uqFvX4CYV37v7HOqspEb7M=";
+  cargoHash = "sha256-DQWVTI7cwVuqWSXMkAw4RwRtp1SXeJj0idP3C68QTT4=";
 
   nativeBuildInputs = [
     cmake
@@ -52,7 +52,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
     homepage = "https://sandhole.com.br";
     changelog = "https://github.com/EpicEric/sandhole/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.mit;
+    license = lib.licenses.agpl3Plus;
     mainProgram = "sandhole";
     maintainers = with lib.maintainers; [ EpicEric ];
     platforms = lib.platforms.all;

From dac0cee4b760a8e8a02104e586fbff2021f67fe1 Mon Sep 17 00:00:00 2001
From: matthewcroughan <matt@croughan.sh>
Date: Sat, 15 Aug 2026 01:08:19 +0100
Subject: [PATCH 279/551] python3Packages.matplotlib: fix 64 bit -> 32 bit
 cross

---
 pkgs/development/python-modules/matplotlib/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index eb6e218d354c..ca9677848d91 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -110,6 +110,7 @@ buildPythonPackage (finalAttrs: {
     ffmpeg-headless
     freetype
     qhull
+    pybind11
     libraqm
   ]
   ++ lib.optionals enableGtk3 [
@@ -123,7 +124,6 @@ buildPythonPackage (finalAttrs: {
   build-system = [
     certifi
     numpy
-    pybind11
     meson-python
     setuptools-scm
   ];

From b120c4cd31beae0905cdbae44422175e0dac6f3c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 15 Aug 2026 08:42:28 +0000
Subject: [PATCH 280/551] publicsuffix-list: 0-unstable-2026-07-25 ->
 0-unstable-2026-08-14

---
 pkgs/by-name/pu/publicsuffix-list/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix
index d6c15745fa64..7eea2c3139bd 100644
--- a/pkgs/by-name/pu/publicsuffix-list/package.nix
+++ b/pkgs/by-name/pu/publicsuffix-list/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2026-07-25";
+  version = "0-unstable-2026-08-14";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "e1b8015c3b2f0f4f8c18659c2480fc1a22c07b20";
-    hash = "sha256-F+OmANpg7I4dBFL7PM3oJlhpDzfxrRTfo+50lQHdU2M=";
+    rev = "a77cfe0674a4b05c6e2448c01f3cb2c965a1b6d8";
+    hash = "sha256-b/8hOFxgnoGQHGfgZ3Xz8H4Gu5ssxwHOCHswX2uQHMc=";
   };
 
   dontBuild = true;

From 219eb510152380ee0a36bcd9e55ea36d2a423cef Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sat, 15 Aug 2026 13:06:33 +0200
Subject: [PATCH 281/551] libpfm: use hash, --replace-fail, group env variables

---
 pkgs/by-name/li/libpfm/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/li/libpfm/package.nix b/pkgs/by-name/li/libpfm/package.nix
index d68516dcec02..e2c1362ea74a 100644
--- a/pkgs/by-name/li/libpfm/package.nix
+++ b/pkgs/by-name/li/libpfm/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://sourceforge/perfmon2/libpfm4/libpfm-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-0YuXdkx1VSjBBR03bjNUXQ62DG6/hWgENoE/pbBMw9E=";
+    hash = "sha256-0YuXdkx1VSjBBR03bjNUXQ62DG6/hWgENoE/pbBMw9E=";
   };
 
   # Don't install libpfm.so on windows as it doesn't exist
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   # See: https://github.com/NixOS/nixpkgs/pull/252982#discussion_r1314346216
   postPatch = ''
     substituteInPlace config.mk examples/Makefile \
-      --replace '($(SYS),WINDOWS)' '($(SYS),Windows)'
+      --replace-fail '($(SYS),WINDOWS)' '($(SYS),Windows)'
   '';
 
   makeFlags = [
@@ -33,8 +33,10 @@ stdenv.mkDerivation (finalAttrs: {
     "SYS=${stdenv.hostPlatform.uname.system}"
   ];
 
-  env.NIX_CFLAGS_COMPILE = "-Wno-error";
-  env.CONFIG_PFMLIB_SHARED = if enableShared then "y" else "n";
+  env = {
+    NIX_CFLAGS_COMPILE = "-Wno-error";
+    CONFIG_PFMLIB_SHARED = if enableShared then "y" else "n";
+  };
 
   buildInputs = lib.optional stdenv.hostPlatform.isMinGW windows.libgnurx;
 

From faa34e1e7ec3b291375e562f52db3c0cef814ae4 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Thu, 13 Aug 2026 23:56:28 +0200
Subject: [PATCH 282/551] auto-patchelf: enable strictDeps

---
 pkgs/by-name/au/auto-patchelf/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/au/auto-patchelf/package.nix b/pkgs/by-name/au/auto-patchelf/package.nix
index 031e780f89c9..4d5cf55f3236 100644
--- a/pkgs/by-name/au/auto-patchelf/package.nix
+++ b/pkgs/by-name/au/auto-patchelf/package.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation {
 
   buildInputs = [ pythonEnv ];
 
+  strictDeps = true;
+
   src = ./source;
 
   buildPhase = ''

From e9c40c11afed1a6135abd5947b8ca924e8678048 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Fri, 24 Jul 2026 21:50:07 -0400
Subject: [PATCH 283/551] stb: 0-unstable-2023-01-29 -> 0-unstable-2026-04-15

Nothing major, just some updates and adding an updateScript. many
packages rely on a later version since it ships with a new image
resizing header that the current version does not have. Let's get this
updated to reduce the amount of duplicated packages in nixpkgs.
---
 pkgs/by-name/st/stb/package.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/stb/package.nix b/pkgs/by-name/st/stb/package.nix
index 3283dcc11f17..cd3e8b268a66 100644
--- a/pkgs/by-name/st/stb/package.nix
+++ b/pkgs/by-name/st/stb/package.nix
@@ -4,17 +4,18 @@
   fetchFromGitHub,
   copyPkgconfigItems,
   makePkgconfigItem,
+  unstableGitUpdater,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "stb";
-  version = "0-unstable-2023-01-29";
+  version = "0-unstable-2026-04-15";
 
   src = fetchFromGitHub {
     owner = "nothings";
     repo = "stb";
-    rev = "5736b15f7ea0ffb08dd38af21067c314d6a3aae9";
-    hash = "sha256-s2ASdlT3bBNrqvwfhhN6skjbmyEnUgvNOrvhgUSRj98=";
+    rev = "31c1ad37456438565541f4919958214b6e762fb4";
+    hash = "sha256-m2yNUlA37hDkKQVrQ+R8nufHfW/cXLnMo+n1X1Cyun0=";
   };
 
   nativeBuildInputs = [ copyPkgconfigItems ];
@@ -42,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = {
     description = "Single-file public domain libraries for C/C++";
     homepage = "https://github.com/nothings/stb";

From a47159a51a7f37e59cca3b2c0cd8ac44b5c6fa84 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Sat, 15 Aug 2026 16:17:08 -0400
Subject: [PATCH 284/551] noctalia{,-greeter}: Remove stb override

Unneeded since stb has been updated
---
 pkgs/by-name/no/noctalia-greeter/package.nix | 14 +-------------
 pkgs/by-name/no/noctalia/package.nix         | 14 +-------------
 2 files changed, 2 insertions(+), 26 deletions(-)

diff --git a/pkgs/by-name/no/noctalia-greeter/package.nix b/pkgs/by-name/no/noctalia-greeter/package.nix
index e223372a8a8a..2025ae76565b 100644
--- a/pkgs/by-name/no/noctalia-greeter/package.nix
+++ b/pkgs/by-name/no/noctalia-greeter/package.nix
@@ -28,18 +28,6 @@
   nix-update-script,
 }:
 
-let
-  # nixpkgs stb doesn't have stb_image_resize2.h which noctalia-greeter needs
-  stb' = stb.overrideAttrs {
-    version = "0-unstable-2025-10-26";
-    src = fetchFromGitHub {
-      owner = "nothings";
-      repo = "stb";
-      rev = "f1c79c02822848a9bed4315b12c8c8f3761e1296";
-      hash = "sha256-BlyXJtAI7WqXCTT3ylww8zoG0hBxaojJnQDvdQOXJPE=";
-    };
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "noctalia-greeter";
   version = "1.2.1";
@@ -73,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxkbcommon
     nlohmann_json
     pango
-    stb'
+    stb
     tomlplusplus
     wayland
     wayland-protocols
diff --git a/pkgs/by-name/no/noctalia/package.nix b/pkgs/by-name/no/noctalia/package.nix
index 445d0e3dd69b..db034268800e 100644
--- a/pkgs/by-name/no/noctalia/package.nix
+++ b/pkgs/by-name/no/noctalia/package.nix
@@ -49,18 +49,6 @@
   gitMinimal,
 }:
 
-let
-  # nixpkgs stb doesn't have stb_image_resize2.h which noctalia needs
-  stb' = stb.overrideAttrs {
-    version = "0-unstable-2025-10-26";
-    src = fetchFromGitHub {
-      owner = "nothings";
-      repo = "stb";
-      rev = "f1c79c02822848a9bed4315b12c8c8f3761e1296";
-      hash = "sha256-BlyXJtAI7WqXCTT3ylww8zoG0hBxaojJnQDvdQOXJPE=";
-    };
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
@@ -111,7 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
     pipewire
     polkit
     sdbus-cpp_2
-    stb'
+    stb
     systemdLibs
     tomlplusplus
     wayland

From 9ebef1f4f325e71c294b1fa85afb61f46bd26b05 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Sat, 15 Aug 2026 16:40:26 -0400
Subject: [PATCH 285/551] various: remove stb_image.h fetchers

These should all be fine with stb_image.h from stb in nixpkgs, and they
build correctly with it. I am not, however, able to test them, so there
may be good reason to revert this patch.
---
 pkgs/by-name/_2/_2ship2harkinian/package.nix | 9 ++-------
 pkgs/by-name/sh/shipwright/package.nix       | 9 ++-------
 pkgs/by-name/sp/spaghettikart/package.nix    | 9 ++-------
 pkgs/by-name/st/starship-sf64/package.nix    | 9 ++-------
 4 files changed, 8 insertions(+), 28 deletions(-)

diff --git a/pkgs/by-name/_2/_2ship2harkinian/package.nix b/pkgs/by-name/_2/_2ship2harkinian/package.nix
index ed77e1b5e6ab..c14a56940da2 100644
--- a/pkgs/by-name/_2/_2ship2harkinian/package.nix
+++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix
@@ -19,6 +19,7 @@
   libpulseaudio,
   libzip,
   nlohmann_json,
+  stb,
   SDL2,
   spdlog,
   tinyxml-2,
@@ -82,12 +83,6 @@ let
     '';
   };
 
-  stb' = fetchurl {
-    name = "stb_image.h";
-    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
-    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
-  };
-
   stormlib' = applyPatches {
     src = fetchFromGitHub {
       owner = "ladislav-zezula";
@@ -213,7 +208,7 @@ stdenv.mkDerivation (finalAttrs: {
   preConfigure = ''
     # mirror 2ship's stb
     mkdir stb
-    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
     cp ${stb_impl} ./stb/${stb_impl.name}
     substituteInPlace libultraship/cmake/dependencies/common.cmake \
       --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
diff --git a/pkgs/by-name/sh/shipwright/package.nix b/pkgs/by-name/sh/shipwright/package.nix
index 6315867c2555..d1c4f44aa6ac 100644
--- a/pkgs/by-name/sh/shipwright/package.nix
+++ b/pkgs/by-name/sh/shipwright/package.nix
@@ -25,6 +25,7 @@
   nlohmann_json,
   tinyxml-2,
   spdlog,
+  stb,
   writeTextFile,
   fixDarwinDylibNames,
   applyPatches,
@@ -83,12 +84,6 @@ let
     '';
   };
 
-  stb' = fetchurl {
-    name = "stb_image.h";
-    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
-    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
-  };
-
   stormlib' = applyPatches {
     src = fetchFromGitHub {
       owner = "ladislav-zezula";
@@ -208,7 +203,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   preConfigure = ''
     mkdir stb
-    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
     cp ${stb_impl} ./stb/${stb_impl.name}
     substituteInPlace libultraship/cmake/dependencies/common.cmake \
       --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
diff --git a/pkgs/by-name/sp/spaghettikart/package.nix b/pkgs/by-name/sp/spaghettikart/package.nix
index 0d8068583ed5..18372e4063e5 100644
--- a/pkgs/by-name/sp/spaghettikart/package.nix
+++ b/pkgs/by-name/sp/spaghettikart/package.nix
@@ -24,6 +24,7 @@
   SDL2,
   SDL2_net,
   spdlog,
+  stb,
   tinyxml-2,
   tomlplusplus,
   zenity,
@@ -83,12 +84,6 @@ let
     '';
   };
 
-  stb' = fetchurl {
-    name = "stb_image.h";
-    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
-    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
-  };
-
   stormlib' = applyPatches {
     src = fetchFromGitHub {
       owner = "ladislav-zezula";
@@ -219,7 +214,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   preConfigure = ''
     mkdir stb
-    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
     cp ${stb_impl} ./stb/${stb_impl.name}
     substituteInPlace libultraship/cmake/dependencies/common.cmake \
       --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
diff --git a/pkgs/by-name/st/starship-sf64/package.nix b/pkgs/by-name/st/starship-sf64/package.nix
index e0aabc29488d..0bf4a9a49bc3 100644
--- a/pkgs/by-name/st/starship-sf64/package.nix
+++ b/pkgs/by-name/st/starship-sf64/package.nix
@@ -24,6 +24,7 @@
   nlohmann_json,
   SDL2,
   spdlog,
+  stb,
   tinyxml-2,
   zenity,
   sdl_gamecontrollerdb,
@@ -76,12 +77,6 @@ let
     '';
   };
 
-  stb' = fetchurl {
-    name = "stb_image.h";
-    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
-    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
-  };
-
   stormlib' = applyPatches {
     src = fetchFromGitHub {
       owner = "ladislav-zezula";
@@ -195,7 +190,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   preConfigure = ''
     mkdir stb
-    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
     cp ${stb_impl} ./stb/${stb_impl.name}
     substituteInPlace libultraship/cmake/dependencies/common.cmake \
       --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"

From e119515fbb4b58ffaa3239bac5450d542a60b297 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sat, 15 Aug 2026 18:32:14 -0400
Subject: [PATCH 286/551] python3Packages.pyarrow: use pure tzdata in tests

test_orc.py tests may fail on darwin because they try to read from
/usr/share/zoneinfo which may not work in darwin sandbox.

This was reported multiple times, see:
https://github.com/NixOS/nixpkgs/pull/477944
https://github.com/NixOS/nixpkgs/pull/485004
https://github.com/NixOS/nixpkgs/issues/483241

I also hit it myself in my personal flake CI.

This patch switches the test to use pure tzdata to avoid the sandbox
issue for darwin and re-enables one of previously skipped test_orc.py
cases (for both platforms).

Fixes #483241
---
 pkgs/development/python-modules/pyarrow/default.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index f21dac9e39cc..d911cff61143 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -21,6 +21,7 @@
   scikit-build-core,
   setuptools,
   setuptools-scm,
+  tzdata,
 }:
 
 let
@@ -121,8 +122,6 @@ buildPythonPackage rec {
     "pyarrow/tests/test_csv.py::TestThreadedCSVTableRead::test_cancellation"
     # expects arrow-cpp headers to be bundled.
     "pyarrow/tests/test_cpp_internals.py::test_pyarrow_include"
-    # Searches for TZDATA in /usr.
-    "pyarrow/tests/test_orc.py::test_example_using_json"
     # AssertionError: assert 'Europe/Monaco' == 'Europe/Paris'
     "pyarrow/tests/test_types.py::test_dateutil_tzinfo_to_string"
     # These fail with xxx_fixture not found.
@@ -168,6 +167,13 @@ buildPythonPackage rec {
   disabledTests = [ "GcsFileSystem" ];
 
   preCheck = ''
+    # Prepare r/w zoneinfo that test_orc can then copy and modify.
+    export TZDIR="$TMPDIR/zoneinfo"
+    cp -R "${tzdata}/${python.sitePackages}/tzdata/zoneinfo" "$TZDIR"
+    chmod -R u+w "$TZDIR"
+    substituteInPlace pyarrow/tests/test_orc.py \
+      --replace-fail "Path('/usr/share/zoneinfo')" "Path('$TZDIR')"
+
     export PARQUET_TEST_DATA="${arrow-cpp.env.PARQUET_TEST_DATA}"
     shopt -s extglob
     rm -r pyarrow/!(conftest.py|tests)

From dc1618565dccb3246eebc9f9b0fa1be9770225eb Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 16 Aug 2026 11:56:25 +0200
Subject: [PATCH 287/551] strace: enable strictDeps

---
 pkgs/by-name/st/strace/package.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix
index 77345bd6a3ae..a93b32106f78 100644
--- a/pkgs/by-name/st/strace/package.nix
+++ b/pkgs/by-name/st/strace/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   perl,
+  bashNonInteractive,
   libunwind,
   buildPackages,
   gitUpdater,
@@ -30,15 +31,18 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  # libunwind for -k.
-  # On RISC-V platforms, LLVM's libunwind implementation is unsupported by strace.
-  # The build will silently fall back and -k will not work on RISC-V.
   buildInputs = [
+    bashNonInteractive # for strace-log-merge shebang
+    # libunwind for -k.
+    # On RISC-V platforms, LLVM's libunwind implementation is unsupported by strace.
+    # The build will silently fall back and -k will not work on RISC-V.
     libunwind
   ]
   # -kk
   ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform elfutils) elfutils;
 
+  strictDeps = true;
+
   configureFlags = [
     "--enable-mpers=check"
   ]

From 8c5882a4d84e1fa359b95a345d664301cb277327 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 16 Aug 2026 11:57:10 +0200
Subject: [PATCH 288/551] strace: enable structuredAttrs, move
 enableParallelBuilding

So this option doesn't interrupt the lists of various inputs.
---
 pkgs/by-name/st/strace/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix
index a93b32106f78..1919c9e29903 100644
--- a/pkgs/by-name/st/strace/package.nix
+++ b/pkgs/by-name/st/strace/package.nix
@@ -29,8 +29,6 @@ stdenv.mkDerivation (finalAttrs: {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl ];
 
-  enableParallelBuilding = true;
-
   buildInputs = [
     bashNonInteractive # for strace-log-merge shebang
     # libunwind for -k.
@@ -41,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   # -kk
   ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform elfutils) elfutils;
 
+  enableParallelBuilding = true;
   strictDeps = true;
 
   configureFlags = [
@@ -54,6 +53,8 @@ stdenv.mkDerivation (finalAttrs: {
     rev-prefix = "v";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://strace.io/";
     description = "System call tracer for Linux";

From c82ff0ab02ecd25cd9f43fb10d9418f260983736 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 15:30:56 +0200
Subject: [PATCH 289/551] makeSetupHook: use explicit substitution and enable
 structuredAttrs

---
 doc/release-notes/rl-2611.section.md            |  2 ++
 pkgs/build-support/trivial-builders/default.nix | 10 ++++------
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 33cdf427dd32..15a83e96970d 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -136,6 +136,8 @@
   [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
   for details.
 
+- `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
+
 - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
 
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index b33f75e34676..4f4b6a9e5911 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -735,7 +735,6 @@ rec {
       meta ? { },
       passthru ? { },
       substitutions ? { },
-      __structuredAttrs ? false,
     }@args:
     script:
     runCommand name
@@ -745,10 +744,6 @@ rec {
           # Make the position of the derivation accurate.
           # Since not having `name` is deprecated, this should be fairly accurate.
           pos = lib.unsafeGetAttrPos "name" args;
-          # TODO(@Artturin:) substitutions should be inside the env attrset
-          # but users are likely passing non-substitution arguments through substitutions
-          # turn off __structuredAttrs to unbreak substituteAll
-          inherit __structuredAttrs;
           pname = name;
           version = "26.05pre-git";
           inherit meta;
@@ -756,6 +751,7 @@ rec {
           inherit propagatedBuildInputs;
           inherit propagatedNativeBuildInputs;
           strictDeps = true;
+          __structuredAttrs = true;
           # TODO 2023-01, no backport: simplify to inherit passthru;
           passthru =
             passthru
@@ -771,7 +767,9 @@ rec {
           recordPropagatedDependencies
         ''
         + lib.optionalString (substitutions != { }) ''
-          substituteAll ${script} $out/nix-support/setup-hook
+          substitute ${script} $out/nix-support/setup-hook ${
+            lib.concatMapAttrsStringSep " " (name: _: "--subst-var ${name}") substitutions
+          }
         ''
       );
 

From ed9d6018dfe4026a463ee82b576bf67ee304f3f7 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 15:42:30 +0200
Subject: [PATCH 290/551] checkPhaseThreadLimitHook: remove explicit
 __structuredAttrs = true

---
 pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix b/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix
index 6bd9bda7135a..5171993b8856 100644
--- a/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix
+++ b/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix
@@ -6,8 +6,6 @@
 makeSetupHook {
   name = "check-phase-thread-limit-hook";
 
-  __structuredAttrs = true;
-
   meta = {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ grimmauld ];

From e2bdadcc7cc7a02368a22a139a1c14bac9ab553f Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 15:42:46 +0200
Subject: [PATCH 291/551] pnpmBuildHook: remove explicit __structuredAttrs =
 true

---
 pkgs/by-name/pn/pnpmBuildHook/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/pn/pnpmBuildHook/package.nix b/pkgs/by-name/pn/pnpmBuildHook/package.nix
index 361c15a16b99..0c86980d53b8 100644
--- a/pkgs/by-name/pn/pnpmBuildHook/package.nix
+++ b/pkgs/by-name/pn/pnpmBuildHook/package.nix
@@ -6,5 +6,4 @@ makeSetupHook {
   # the config hook must also be used.
   name = "pnpm-build-hook";
 
-  __structuredAttrs = true;
 } ./pnpm-build-hook.sh

From 90c611df0c285d56480c5aa72d2ec0f27c9dcf6d Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 16 Aug 2026 15:48:21 +0200
Subject: [PATCH 292/551] glibc: 2.42-67 -> 2.42-84, fixes CVE-2026-6368 &
 CVE-2026-6791

Closes #551399
Closes #551398

The most recent fixes from #537324 are now part of the 2.42 branch.
---
 ...or-inet_ntop-failure-in-ns_sprintrrf.patch |   69 -
 ...s-as-unknown-in-ns_sprintrrf-CVE-202.patch |  134 -
 ...r-overreads-in-ns_sprintrrf-CVE-2026.patch |   66 -
 .../libraries/glibc/2.42-master.patch         | 3259 +++++++++++++++++
 pkgs/development/libraries/glibc/common.nix   |   11 +-
 5 files changed, 3260 insertions(+), 279 deletions(-)
 delete mode 100644 pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
 delete mode 100644 pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
 delete mode 100644 pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch

diff --git a/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch b/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
deleted file mode 100644
index 5e55d1242bb4..000000000000
--- a/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 4d9c6b19fcb34fab03fb7dab8f6d36a2cc4ef982 Mon Sep 17 00:00:00 2001
-From: Florian Weimer <fweimer@redhat.com>
-Date: Fri, 19 Jun 2026 18:22:20 +0200
-Subject: [PATCH 1/3] resolv: Check for inet_ntop failure in ns_sprintrrf
-
-This makes the output more consistent (either failure or complete
-output) and helps with systematic testing with varying buffer
-sizes.
-
-Reviewed-by: Carlos O'Donell <carlos@redhat.com>
-Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
-(cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a)
----
- resolv/ns_print.c | 18 +++++++++++-------
- 1 file changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/resolv/ns_print.c b/resolv/ns_print.c
-index cef2212fd2..cb680fb74e 100644
---- a/resolv/ns_print.c
-+++ b/resolv/ns_print.c
-@@ -140,8 +140,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 	switch (type) {
- 	case ns_t_a:
- 	  if (rdlen != (size_t)NS_INADDRSZ)
--			goto formerr;
--		(void) inet_ntop(AF_INET, rdata, buf, buflen);
-+		  goto formerr;
-+		if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
-+		  return -1;
- 		addlen(strlen(buf), &buf, &buflen);
- 		break;
- 
-@@ -307,9 +308,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 	    }
- 
- 	case ns_t_aaaa:
--	  if (rdlen != (size_t)NS_IN6ADDRSZ)
--			goto formerr;
--		(void) inet_ntop(AF_INET6, rdata, buf, buflen);
-+		if (rdlen != (size_t)NS_IN6ADDRSZ)
-+		  goto formerr;
-+		if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL)
-+		  return -1;
- 		addlen(strlen(buf), &buf, &buflen);
- 		break;
- 
-@@ -400,7 +402,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 			goto formerr;
- 
- 		/* Address. */
--		(void) inet_ntop(AF_INET, rdata, buf, buflen);
-+		if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
-+		  return -1;
- 		addlen(strlen(buf), &buf, &buflen);
- 		rdata += NS_INADDRSZ;
- 
-@@ -542,7 +545,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 			if (rdata + pbyte >= edata) goto formerr;
- 			memset(&a, 0, sizeof(a));
- 			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
--			(void) inet_ntop(AF_INET6, &a, buf, buflen);
-+			if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
-+			  return -1;
- 			addlen(strlen(buf), &buf, &buflen);
- 			rdata += sizeof(a) - pbyte;
- 		}
--- 
-2.54.0
-
diff --git a/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch b/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
deleted file mode 100644
index 5b39165a43b0..000000000000
--- a/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From 103658e72f5aaeb36a5e405f9abaa1b687488fc1 Mon Sep 17 00:00:00 2001
-From: Florian Weimer <fweimer@redhat.com>
-Date: Fri, 19 Jun 2026 18:22:20 +0200
-Subject: [PATCH 2/3] resolv: More types as unknown in ns_sprintrrf
- (CVE-2026-5435)
-
-Specifically, CERT, TKEY, TSIG, OPT.  This removes the buggy
-implementations of TSIG, fixing bug 34033, and partially
-fixing bug 34069.
-
-Reviewed-by: Carlos O'Donell <carlos@redhat.com>
-Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
-(cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
----
- resolv/ns_print.c | 96 -----------------------------------------------
- 1 file changed, 96 deletions(-)
-
-diff --git a/resolv/ns_print.c b/resolv/ns_print.c
-index cb680fb74e..8c876b147e 100644
---- a/resolv/ns_print.c
-+++ b/resolv/ns_print.c
-@@ -437,96 +437,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 		break;
- 	    }
- 
--	case ns_t_cert: {
--		u_int c_type, key_tag, alg;
--		int n;
--		unsigned int siz;
--		char base64_cert[8192], tmp[40];
--		const char *leader;
--
--		c_type  = ns_get16(rdata); rdata += NS_INT16SZ;
--		key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
--		alg = (u_int) *rdata++;
--
--		len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg));
--		T(addstr(tmp, len, &buf, &buflen));
--		siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
--		if (siz > sizeof(base64_cert) * 3/4) {
--			const char *str = "record too long to print";
--			T(addstr(str, strlen(str), &buf, &buflen));
--		}
--		else {
--			len = b64_ntop(rdata, edata-rdata, base64_cert, siz);
--
--			if (len < 0)
--				goto formerr;
--			else if (len > 15) {
--				T(addstr(" (", 2, &buf, &buflen));
--				leader = "\n\t\t";
--				spaced = 0;
--			}
--			else
--				leader = " ";
--
--			for (n = 0; n < len; n += 48) {
--				T(addstr(leader, strlen(leader),
--					 &buf, &buflen));
--				T(addstr(base64_cert + n, MIN(len - n, 48),
--					 &buf, &buflen));
--			}
--			if (len > 15)
--				T(addstr(" )", 2, &buf, &buflen));
--		}
--		break;
--	    }
--
--	case ns_t_tkey: {
--		/* KJD - need to complete this */
--		u_long t;
--		int mode, err, keysize;
--
--		/* Algorithm name. */
--		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
--		T(addstr(" ", 1, &buf, &buflen));
--
--		/* Inception. */
--		t = ns_get32(rdata);  rdata += NS_INT32SZ;
--		len = SPRINTF((tmp, "%lu ", t));
--		T(addstr(tmp, len, &buf, &buflen));
--
--		/* Expiration. */
--		t = ns_get32(rdata);  rdata += NS_INT32SZ;
--		len = SPRINTF((tmp, "%lu ", t));
--		T(addstr(tmp, len, &buf, &buflen));
--
--		/* Mode , Error, Key Size. */
--		/* Priority, Weight, Port. */
--		mode = ns_get16(rdata);  rdata += NS_INT16SZ;
--		err  = ns_get16(rdata);  rdata += NS_INT16SZ;
--		keysize  = ns_get16(rdata);  rdata += NS_INT16SZ;
--		len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
--		T(addstr(tmp, len, &buf, &buflen));
--
--		/* XXX need to dump key, print otherdata length & other data */
--		break;
--	    }
--
--	case ns_t_tsig: {
--		/* BEW - need to complete this */
--		int n;
--
--		T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
--		T(addstr(" ", 1, &buf, &buflen));
--		rdata += 8; /*%< time */
--		n = ns_get16(rdata); rdata += INT16SZ;
--		rdata += n; /*%< sig */
--		n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
--		sprintf(buf, "%d", ns_get16(rdata));
--		rdata += INT16SZ;
--		addlen(strlen(buf), &buf, &buflen);
--		break;
--	    }
--
- 	case ns_t_a6: {
- 		struct in6_addr a;
- 		int pbyte, pbit;
-@@ -561,12 +471,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 		break;
- 	    }
- 
--	case ns_t_opt: {
--		len = SPRINTF((tmp, "%u bytes", class));
--		T(addstr(tmp, len, &buf, &buflen));
--		break;
--	    }
--
- 	default:
- 		snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type);
- 		comment = errbuf;
--- 
-2.54.0
-
diff --git a/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch b/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
deleted file mode 100644
index 8bde49f159e0..000000000000
--- a/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 2290143edc27486196815874dca5a528c118a73f Mon Sep 17 00:00:00 2001
-From: Florian Weimer <fweimer@redhat.com>
-Date: Fri, 19 Jun 2026 18:22:20 +0200
-Subject: [PATCH 3/3] resolv: Fix buffer overreads in ns_sprintrrf
- (CVE-2026-6238)
-
-Check that the RDATA payload does not require more than RDATALEN
-bytes while processing it.  The fixes cover A6, LOC records.
-(CERT, TKEY, TSIG were fixed before, by switching to the generic
-formatter.)
-
-The vulnerable LOC record handling was first introduced before
-glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f.
-
-CERT, TSIG, TKEY handling came with commit
-b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2.
-
-A6 record handling was introduced in commit
-91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c
-(ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc
-2.7.
-
-This fixes bug 34069.
-
-Reviewed-by: Carlos O'Donell <carlos@redhat.com>
-Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
-(cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)
----
- resolv/ns_print.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/resolv/ns_print.c b/resolv/ns_print.c
-index 8c876b147e..6832255a25 100644
---- a/resolv/ns_print.c
-+++ b/resolv/ns_print.c
-@@ -318,7 +318,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 	case ns_t_loc: {
- 		char t[255];
- 
--		/* XXX protocol format checking? */
-+		if (rdlen != 16)
-+		  goto formerr;
- 		(void) loc_ntoa(rdata, t);
- 		T(addstr(t, strlen(t), &buf, &buflen));
- 		break;
-@@ -452,13 +453,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- 
- 		/* address suffix: provided only when prefix len != 128 */
- 		if (pbit < 128) {
--			if (rdata + pbyte >= edata) goto formerr;
-+			unsigned int bytelen = sizeof(a) - pbyte;
-+			if (edata - rdata < bytelen) goto formerr;
- 			memset(&a, 0, sizeof(a));
--			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
-+			memcpy(&a.s6_addr[pbyte], rdata, bytelen);
- 			if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
- 			  return -1;
- 			addlen(strlen(buf), &buf, &buflen);
--			rdata += sizeof(a) - pbyte;
-+			rdata += bytelen;
- 		}
- 
- 		/* prefix name: provided only when prefix len > 0 */
--- 
-2.54.0
-
diff --git a/pkgs/development/libraries/glibc/2.42-master.patch b/pkgs/development/libraries/glibc/2.42-master.patch
index a7bdf93961db..8abd567ee32b 100644
--- a/pkgs/development/libraries/glibc/2.42-master.patch
+++ b/pkgs/development/libraries/glibc/2.42-master.patch
@@ -7913,3 +7913,3262 @@ index 86ae5019a6..17b5565d0f 100644
  		    /* Enlarge the buffer.  */
  		    wstr = (wchar_t *) realloc (*strptr,
  						newsize * sizeof (wchar_t));
+
+commit b866ef29773b22a1343ff9084374775114350b78
+Author: Maciej W. Rozycki <macro@redhat.com>
+Date:   Wed May 27 12:57:10 2026 -0400
+
+    support: Implement 'xfmemopen' for seamless 'fmemopen' use
+    
+    Add 'xfmemopen' wrapper for seamless 'fmemopen' use in tests, following
+    'xfopen', 'xfclose', etc., and providing a standardized error reporting
+    facility.
+    
+    Reviewed-by: Florian Weimer <fweimer@redhat.com>
+    (cherry picked from commit fe709cc24578ecfd2ff5b07e10e3829fcb55075b)
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+
+diff --git a/support/Makefile b/support/Makefile
+index d41278eeab..f67f38130a 100644
+--- a/support/Makefile
++++ b/support/Makefile
+@@ -134,6 +134,7 @@ libsupport-routines = \
+   xfclose \
+   xfdopendir \
+   xfgets \
++  xfmemopen \
+   xfopen \
+   xfork \
+   xfread \
+diff --git a/support/xfmemopen.c b/support/xfmemopen.c
+new file mode 100644
+index 0000000000..f1dbc72c67
+--- /dev/null
++++ b/support/xfmemopen.c
+@@ -0,0 +1,31 @@
++/* fmemopen with error checking.
++   Copyright (C) 2025 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <support/xstdio.h>
++
++#include <support/check.h>
++#include <stdlib.h>
++
++FILE *
++xfmemopen (void *mem, size_t len, const char *mode)
++{
++  FILE *fp = fmemopen (mem, len, mode);
++  if (fp == NULL)
++    FAIL_EXIT1 ("fmemopen (mode \"%s\"): %m", mode);
++  return fp;
++}
+diff --git a/support/xstdio.h b/support/xstdio.h
+index c3fdf9496f..70b83f11da 100644
+--- a/support/xstdio.h
++++ b/support/xstdio.h
+@@ -27,6 +27,7 @@ __BEGIN_DECLS
+ FILE *xfopen (const char *path, const char *mode);
+ void xfclose (FILE *);
+ FILE *xfreopen (const char *path, const char *mode, FILE *stream);
++FILE *xfmemopen (void *mem, size_t len, const char *mode);
+ void xfread (void *ptr, size_t size, size_t nmemb, FILE *stream);
+ char *xfgets (char *s, int size, FILE *stream);
+ 
+
+commit 97926e9017f3faeaacce9337f1288460f5e6ec7d
+Author: Maciej W. Rozycki <macro@redhat.com>
+Date:   Wed May 27 12:57:10 2026 -0400
+
+    stdio-common: Reject insufficient character data in scanf [BZ #12701]
+    
+    Reject invalid formatted scanf character data with the 'c' conversion
+    where there is not enough input available to satisfy the field width
+    requested.  It is required by ISO C that this conversion matches a
+    sequence of characters of exactly the number specified by the field
+    width and it is also already documented as such in our own manual:
+    
+    "It reads precisely the next N characters, and fails if it cannot get
+    that many."
+    
+    Currently a matching success is instead incorrectly produced where the
+    EOF condition is encountered before the required number of characters
+    has been retrieved, and the characters actually obtained are stored in
+    the buffer provided.
+    
+    Add test cases accordingly and remove placeholders from 'c' conversion
+    input data for the existing scanf tests.
+    
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    
+    [This is a modified version of commit 2b16c76609, which tests for the
+    old behavior and only includes the test cases, for older branches
+    and downstream backports - DJ]
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+
+diff --git a/localedata/Makefile b/localedata/Makefile
+index 4a23593cca..bff5c0bc71 100644
+--- a/localedata/Makefile
++++ b/localedata/Makefile
+@@ -236,6 +236,7 @@ tests = \
+   bug-iconv-trans \
+   bug-setlocale1 \
+   bug-usesetlocale \
++  tst-bz12701-lc \
+   tst-bz13988 \
+   tst-c-utf8-consistency \
+   tst-digits \
+diff --git a/localedata/tst-bz12701-lc.c b/localedata/tst-bz12701-lc.c
+new file mode 100644
+index 0000000000..23c2ab7d2a
+--- /dev/null
++++ b/localedata/tst-bz12701-lc.c
+@@ -0,0 +1,218 @@
++/* Verify scanf field width handling with the 'lc' conversion (BZ #12701).
++   Copyright (C) 2025-2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <locale.h>
++#include <stddef.h>
++#include <stdio.h>
++#include <string.h>
++#include <wchar.h>
++
++#include <libc-diag.h>
++#include <support/check.h>
++#include <support/next_to_fault.h>
++#include <support/xstdio.h>
++
++/* Compare character-wise the initial part of the wide character object
++   pointed to by WS corresponding to wide characters obtained by the
++   conversion of first N bytes of the multibyte character object pointed
++   to by S.  */
++
++static int
++tst_bz12701_lc_memcmp (const wchar_t *ds, const char *s, size_t n)
++{
++  size_t nc = mbsnrtowcs (NULL, &s, n, 0, NULL);
++
++  struct support_next_to_fault ntf;
++  ntf = support_next_to_fault_allocate (nc * sizeof (wchar_t));
++  wchar_t *ss = (wchar_t *) ntf.buffer;
++
++  mbsnrtowcs (ss, &s, n, nc, NULL);
++  int r = wmemcmp (ds, ss, nc);
++
++  support_next_to_fault_free (&ntf);
++
++  return r;
++}
++
++/* Verify various aspects of field width handling, including the data
++   obtained, the number of bytes consumed, and the stream position.  */
++
++static int
++do_test (void)
++{
++  if (setlocale (LC_ALL, "pl_PL.UTF-8") == NULL)
++    FAIL_EXIT1 ("setlocale (LC_ALL, \"pl_PL.UTF-8\")");
++
++  /* Part of a tongue-twister in Polish, which says:
++     "On a rainy morning cuckoos and warblers, rather than starting
++     on earthworms, stuffed themselves fasted with the flesh of cress."  */
++  static const char s[126] = "Dżdżystym rankiem gżegżółki i piegże, "
++			     "zamiast wziąć się za dżdżownice, "
++			     "nażarły się na czczo miąższu rzeżuchy";
++
++  const char *sp = s;
++  size_t nc;
++  TEST_VERIFY_EXIT ((nc = mbsnrtowcs (NULL, &sp, sizeof (s), 0, NULL)) == 108);
++
++  struct support_next_to_fault ntfo, ntfi;
++  ntfo = support_next_to_fault_allocate (nc * sizeof (wchar_t));
++  ntfi = support_next_to_fault_allocate (sizeof (s));
++  wchar_t *e = (wchar_t *) ntfo.buffer + nc;
++  char *b = ntfi.buffer;
++
++  wchar_t *c;
++  FILE *f;
++  int ic;
++  int n;
++  int i;
++
++  memcpy (ntfi.buffer, s, sizeof (s));
++
++  ic = i = 0;
++  f = xfmemopen (b, sizeof (s), "r");
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  /* Avoid: "warning: zero width in gnu_scanf format [-Werror=format=]".  */
++  DIAG_PUSH_NEEDS_COMMENT;
++  DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wformat");
++  TEST_VERIFY_EXIT (fscanf (f, "%0lc%n", c, &n) == 1);
++  DIAG_POP_NEEDS_COMMENT;
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 1;
++  i += n;
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 2);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 1;
++  i += n;
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%1lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 1;
++  i += n;
++
++  c = e - 2;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 3);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 2;
++  i += n;
++
++  c = e - 4;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%4lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 4);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 4;
++  i += n;
++
++  c = e - 8;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%8lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 8);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 8;
++  i += n;
++
++  c = e - 16;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%16lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 20);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 16;
++  i += n;
++
++  c = e - 32;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%32lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 38);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 32;
++  i += n;
++
++  c = e - (nc - ic);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_COMPARE (fscanf (f, "%64lc%n", c, &n), 1);
++  TEST_COMPARE (n , 49);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, sizeof (s) - i) == 0);
++
++  TEST_VERIFY_EXIT (ftell (f) == sizeof (s));
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  ic = i = 0;
++  f = xfmemopen (b, 3, "r");
++
++  c = e - 2;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 3);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 2;
++  i += n;
++
++  c = e - (nc - ic);
++  TEST_VERIFY_EXIT (feof (f) == 0);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == EOF);
++  TEST_VERIFY_EXIT (n == 3);
++
++  TEST_VERIFY_EXIT (ftell (f) == 3);
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  ic = i = 0;
++  f = xfmemopen (b, 3, "r");
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++  ic += 1;
++  i += n;
++
++  c = e - (nc - ic);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 2);
++  TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, 3 - i) == 0);
++
++  TEST_VERIFY_EXIT (ftell (f) == 3);
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  support_next_to_fault_free (&ntfi);
++  support_next_to_fault_free (&ntfo);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/stdio-common/Makefile b/stdio-common/Makefile
+index e52c333808..fdb545242e 100644
+--- a/stdio-common/Makefile
++++ b/stdio-common/Makefile
+@@ -260,6 +260,7 @@ tests := \
+   tllformat \
+   tst-bz11319 \
+   tst-bz11319-fortify2 \
++  tst-bz12701-c \
+   tst-cookie \
+   tst-dprintf-length \
+   tst-fclose-devzero \
+diff --git a/stdio-common/tst-bz12701-c.c b/stdio-common/tst-bz12701-c.c
+new file mode 100644
+index 0000000000..4f3616fbfd
+--- /dev/null
++++ b/stdio-common/tst-bz12701-c.c
+@@ -0,0 +1,169 @@
++/* Verify scanf field width handling with the 'c' conversion (BZ #12701).
++   Copyright (C) 2025-2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <stdio.h>
++#include <string.h>
++
++#include <libc-diag.h>
++#include <support/check.h>
++#include <support/next_to_fault.h>
++#include <support/xstdio.h>
++
++/* Verify various aspects of field width handling, including the data
++   obtained, the number of bytes consumed, and the stream position.  */
++
++static int
++do_test (void)
++{
++  static const char s[43] = "The quick brown fox jumps over the lazy dog";
++  struct support_next_to_fault ntfo, ntfi;
++  ntfo = support_next_to_fault_allocate (sizeof (s));
++  ntfi = support_next_to_fault_allocate (sizeof (s));
++  char *e = ntfo.buffer + sizeof (s);
++  char *b = ntfi.buffer;
++
++  char *c;
++  FILE *f;
++  int n;
++  int i;
++
++  memcpy (ntfi.buffer, s, sizeof (s));
++
++  i = 0;
++  f = xfmemopen (b, sizeof (s), "r");
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  /* Avoid: "warning: zero width in gnu_scanf format [-Werror=format=]".  */
++  DIAG_PUSH_NEEDS_COMMENT;
++  DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wformat");
++  TEST_VERIFY_EXIT (fscanf (f, "%0c%n", c, &n) == 1);
++  DIAG_POP_NEEDS_COMMENT;
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%1c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 2;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 2);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 4;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%4c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 4);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 8;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%8c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 8);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 16;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%16c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 16);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - (sizeof (s) - i);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%32c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 10);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, sizeof (s) - i) == 0);
++
++  TEST_VERIFY_EXIT (ftell (f) == sizeof (s));
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  i = 0;
++  f = xfmemopen (b, 3, "r");
++
++  c = e - 1;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - 2;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 2);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - (3 - i);
++  TEST_VERIFY_EXIT (feof (f) == 0);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == EOF);
++  TEST_VERIFY_EXIT (n == 2);
++
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  i = 0;
++  f = xfmemopen (b, 3, "r");
++
++  c = e - 2;
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 2);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++  i += n;
++
++  c = e - (3 - i);
++  TEST_VERIFY_EXIT (ftell (f) == i);
++  TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++  TEST_VERIFY_EXIT (n == 1);
++  TEST_VERIFY_EXIT (memcmp (c, s + i, 3 - i) == 0);
++
++  TEST_VERIFY_EXIT (ftell (f) == 3);
++  TEST_VERIFY_EXIT (feof (f) != 0);
++
++  xfclose (f);
++
++  support_next_to_fault_free (&ntfi);
++  support_next_to_fault_free (&ntfo);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+
+commit 6cebb0b80fd783e442a8ad27c3f52cde52a9cac7
+Author: DJ Delorie <dj@redhat.com>
+Date:   Wed May 27 12:57:10 2026 -0400
+
+    stdio-common: Allow partially-filled %mc buffers [BZ #12701]
+    
+    This is a backwards-compatible alternative to the main solution to
+    the %mc part of 12701.  The allocated buffer is expanded to the
+    requested size and NUL padded, but truncated reads are allowed.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+
+diff --git a/localedata/Makefile b/localedata/Makefile
+index bff5c0bc71..e212facef0 100644
+--- a/localedata/Makefile
++++ b/localedata/Makefile
+@@ -237,6 +237,7 @@ tests = \
+   bug-setlocale1 \
+   bug-usesetlocale \
+   tst-bz12701-lc \
++  tst-bz12701-lc2 \
+   tst-bz13988 \
+   tst-c-utf8-consistency \
+   tst-digits \
+diff --git a/localedata/tst-bz12701-lc2.c b/localedata/tst-bz12701-lc2.c
+new file mode 100644
+index 0000000000..b24e86df0b
+--- /dev/null
++++ b/localedata/tst-bz12701-lc2.c
+@@ -0,0 +1,47 @@
++/* Verify scanf memory handling with the 'c' conversion (BZ #12701).
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <stdio.h>
++#include <malloc.h>
++#include <string.h>
++
++#include <libc-diag.h>
++#include <support/check.h>
++#include <support/next_to_fault.h>
++#include <support/xstdio.h>
++
++static int
++do_test (void)
++{
++  wchar_t *c = NULL;
++  int i;
++
++  TEST_VERIFY (sscanf ("1234", "%30mlc", &c) == 1);
++
++  TEST_VERIFY (c != NULL);
++  TEST_COMPARE_BLOB (c, 5 * sizeof (wchar_t),
++		     L"1234\0", 5 * sizeof (wchar_t));
++  for (i = 5; i < 30; i ++)
++    TEST_VERIFY (c[i] == L'\0');
++
++  TEST_VERIFY (malloc_usable_size (c) >= 30 * sizeof(wchar_t));
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/stdio-common/Makefile b/stdio-common/Makefile
+index fdb545242e..27e7ea20f0 100644
+--- a/stdio-common/Makefile
++++ b/stdio-common/Makefile
+@@ -261,6 +261,7 @@ tests := \
+   tst-bz11319 \
+   tst-bz11319-fortify2 \
+   tst-bz12701-c \
++  tst-bz12701-c2 \
+   tst-cookie \
+   tst-dprintf-length \
+   tst-fclose-devzero \
+diff --git a/stdio-common/tst-bz12701-c2.c b/stdio-common/tst-bz12701-c2.c
+new file mode 100644
+index 0000000000..5f9ca7c592
+--- /dev/null
++++ b/stdio-common/tst-bz12701-c2.c
+@@ -0,0 +1,46 @@
++/* Verify scanf memory handling with the 'c' conversion (BZ #12701).
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <stdio.h>
++#include <malloc.h>
++#include <string.h>
++
++#include <libc-diag.h>
++#include <support/check.h>
++#include <support/next_to_fault.h>
++#include <support/xstdio.h>
++
++static int
++do_test (void)
++{
++  char *c = NULL;
++  int i;
++
++  TEST_VERIFY (sscanf ("1234", "%30mc", &c) == 1);
++
++  TEST_VERIFY (c != NULL);
++  TEST_COMPARE_BLOB (c, 5, "1234\0", 5);
++  for (i = 5; i < 30; i ++)
++    TEST_VERIFY (c[i] == '\0');
++
++  TEST_VERIFY (malloc_usable_size (c) >= 30);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
+index 17b5565d0f..90a1886951 100644
+--- a/stdio-common/vfscanf-internal.c
++++ b/stdio-common/vfscanf-internal.c
+@@ -780,9 +780,9 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 		    conv_error ();					      \
+ 		} while (0)
+ #ifdef COMPILE_WSCANF
+-	      STRING_ARG (str, char, 100);
++	      STRING_ARG (str, char, (width > 0 ? width : 1));
+ #else
+-	      STRING_ARG (str, char, (width > 1024 ? 1024 : width));
++	      STRING_ARG (str, char, (width > 0 ? width : 1));
+ #endif
+ 
+ 	      c = inchar ();
+@@ -891,6 +891,11 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 
+ 	      if (!(flags & SUPPRESS))
+ 		{
++		  /* If the buffer isn't completely filled, pad it with NULs.  */
++		  if (flags & MALLOC)
++		    while (width-- > 0)
++		      *str++ = '\0';
++
+ 		  if ((flags & MALLOC) && str - *strptr != strsize)
+ 		    {
+ 		      char *cp = (char *) realloc (*strptr, str - *strptr);
+@@ -908,7 +913,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 	  if (width == -1)
+ 	    width = 1;
+ 
+-	  STRING_ARG (wstr, wchar_t, (width > 1024 ? 1024 : width));
++	  STRING_ARG (wstr, wchar_t, (width > 0 ? width : 1));
+ 
+ 	  c = inchar ();
+ 	  if (__glibc_unlikely (c == EOF))
+@@ -1044,6 +1049,11 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 
+ 	  if (!(flags & SUPPRESS))
+ 	    {
++	      /* If the buffer isn't completely filled, pad it with NULs.  */
++	      if (flags & MALLOC)
++		while (width-- > 0)
++		  *wstr++ = L'\0';
++
+ 	      if ((flags & MALLOC) && wstr - (wchar_t *) *strptr != strsize)
+ 		{
+ 		  wchar_t *cp = (wchar_t *) realloc (*strptr,
+
+commit 748699d9385fc298f7d3369af0a015a6d88b7e64
+Author: Sam James <sam@gentoo.org>
+Date:   Sat Jun 6 20:32:27 2026 +0100
+
+    elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]
+    
+    dbe5065f2166be20e57a24f246a40d50e001a05d and ae589cb84df10825fc545a45c7007a5f79409bf1
+    cater for setups where ld.so.conf{,.d} is required to find runtime support
+    libraries, but tst-glibc-hwcaps-prepend-cache clobbers the created ld.so.conf
+    with its own entry.
+    
+    Fix it to instead use the ld.so.conf.d created in ae589cb84df10825fc545a45c7007a5f79409bf1
+    to co-exist with existing entries.
+    
+    Bug: https://bugs.gentoo.org/976773
+    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31901
+    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34210
+    Tested-by: Andreas K. Hüttel <dilfridge@gentoo.org>
+    Reported-by: Eli Schwartz <eschwartz@gentoo.org>
+    Reviewed-by: Andreas K. Hüttel <dilfridge@gentoo.org>
+    (cherry picked from commit d0cc9bf859d0434e397530d75a6507f13db79fba)
+
+diff --git a/elf/tst-glibc-hwcaps-prepend-cache.c b/elf/tst-glibc-hwcaps-prepend-cache.c
+index b7df3962b5..2d51c22328 100644
+--- a/elf/tst-glibc-hwcaps-prepend-cache.c
++++ b/elf/tst-glibc-hwcaps-prepend-cache.c
+@@ -46,7 +46,7 @@ do_test (void)
+ 
+   {
+     /* Install the default implementation of libmarkermod1.so.  */
+-    char *conf_path = xasprintf ("%s/ld.so.conf", support_sysconfdir_prefix);
++    char *conf_path = xasprintf ("%s/ld.so.conf.d/hwcaps.conf", support_sysconfdir_prefix);
+     xmkdirp (support_sysconfdir_prefix, 0777);
+     support_write_file_string (conf_path, "/glibc-test/lib\n");
+     free (conf_path);
+
+commit f671746f6c3ae511432b5666953be668267159f8
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Tue Jun 9 07:28:02 2026 +0200
+
+    iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
+    
+    When tentatively converting characters on behalf of
+    __gconv_transliterate, do not create a persistent error.  Just
+    produce a local error, and rely on __gconv_transliterate to
+    produce the error if all transliteration options are exhausted.
+    
+    This fixes transliteration of “½” to ASCII, which cannot use the
+    “ 1⁄2 ” alternative.  Eventually, the “ 1/2 ” alternative is chosen,
+    but the error sticks.  Therefore, iconv exited with status 1 before
+    this change.
+    
+    Adjust iconv/tst-iconv_prog.sh to test both C and en_US.UTF-8 locales.
+    This requires changing the way the ICONV template is defined, so that
+    run_program_env is evaluated multiple times.
+    
+    Fixes commit 9a4b0eaf726f5404c6683d5c7c5e86f61c3f3fbc ("iconv: do not
+    report error exit with transliteration [BZ #32448]"),
+    commit 6cbf845fcdc76131d0e674cee454fe738b69c69d ("iconv: Preserve
+    iconv -c error exit on invalid inputs (bug 32046)"), and bug 34236.
+    
+    Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+    (cherry picked from commit e9325bd7d04aacc45cf39505e279b1ca9de22c08)
+
+diff --git a/iconv/Makefile b/iconv/Makefile
+index 9a94a41ba4..028d24ffc3 100644
+--- a/iconv/Makefile
++++ b/iconv/Makefile
+@@ -138,7 +138,8 @@ $(objpfx)test-iconvconfig.out: $(objpfx)iconvconfig
+ 	 rm -f $$tmp) > $@; \
+ 	$(evaluate-test)
+ 
+-$(objpfx)tst-iconv_prog.out: tst-iconv_prog.sh $(objpfx)iconv_prog
++$(objpfx)tst-iconv_prog.out: tst-iconv_prog.sh $(objpfx)iconv_prog \
++  $(gen-locales)
+ 	$(BASH) $< $(common-objdir) '$(test-wrapper-env)' \
+ 		 '$(run-program-env)' > $@; \
+ 	$(evaluate-test)
+diff --git a/iconv/loop.c b/iconv/loop.c
+index 1378d23147..74b2a3e26d 100644
+--- a/iconv/loop.c
++++ b/iconv/loop.c
+@@ -144,8 +144,10 @@
+     if (irreversible == NULL)						      \
+       {									      \
+ 	/* This means we are in call from __gconv_transliterate.  In this     \
+-	   case we are not doing any error recovery ourselves.  */	      \
+-	result = __gconv_mark_illegal_input (step_data);		      \
++	   case we are not doing any error recovery ourselves.  Do not create \
++	   a persistent error state.  If __gconv_transliterate exhausts all   \
++	   alternatives, it will call __gconv_mark_illegal_input itself.  */  \
++	result = __GCONV_ILLEGAL_INPUT;					      \
+ 	break;								      \
+       }									      \
+ 									      \
+diff --git a/iconv/tst-iconv_prog.sh b/iconv/tst-iconv_prog.sh
+index e2a43280d2..7d7948b7aa 100644
+--- a/iconv/tst-iconv_prog.sh
++++ b/iconv/tst-iconv_prog.sh
+@@ -27,10 +27,10 @@ LIBPATH=$codir:$codir/iconvdata
+ 
+ # How the start the iconv(1) program.  $from is not defined/expanded yet.
+ ICONV='
++$test_wrapper_env $run_program_env
+ $codir/elf/ld.so --library-path $LIBPATH --inhibit-rpath ${from}.so
+ $codir/iconv/iconv_prog
+ '
+-ICONV="$test_wrapper_env $run_program_env $ICONV"
+ 
+ TIMEOUTFACTOR=${TIMEOUTFACTOR:-1}
+ 
+@@ -218,6 +218,7 @@ testarray=(
+ "\x00\x00;;INVALID;UTF-8;1"
+ "\x00\x00;;UTF-8;INVALID;1"
+ "\xc3\xa9;;UTF-8;ASCII//TRANSLIT;0"
++"X\xc2\xbdY;;UTF-8;ASCII//TRANSLIT;0"
+ )
+ 
+ # Requires $twobyte input, $c flag, $from, and $to to be set; sets $ret
+@@ -278,12 +279,21 @@ check_errtest_result ()
+   fi
+ }
+ 
+-for testcommand in "${testarray[@]}"; do
+-  twobyte="$(echo "$testcommand" | cut -d";" -f 1)"
+-  c="$(echo "$testcommand" | cut -d";" -f 2)"
+-  from="$(echo "$testcommand" | cut -d";" -f 3)"
+-  to="$(echo "$testcommand" | cut -d";" -f 4)"
+-  eret="$(echo "$testcommand" | cut -d";" -f 5)"
+-  execute_test
+-  check_errtest_result
+-done
++run_test_array ()
++{
++  for testcommand in "${testarray[@]}"; do
++    twobyte="$(echo "$testcommand" | cut -d";" -f 1)"
++    c="$(echo "$testcommand" | cut -d";" -f 2)"
++    from="$(echo "$testcommand" | cut -d";" -f 3)"
++    to="$(echo "$testcommand" | cut -d";" -f 4)"
++    eret="$(echo "$testcommand" | cut -d";" -f 5)"
++    execute_test
++    check_errtest_result
++  done
++}
++
++echo "info: testing C locale"
++run_test_array
++echo "info: testing en_US.UTF-8 locale"
++run_program_env="$run_program_env LC_ALL=en_US.UTF-8"
++run_test_array
+
+commit f6713070c6accac5c93d96c1d580833afacde3f5
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Wed May 13 08:32:24 2026 -0300
+
+    arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
+    
+    _dl_runtime_resolve and _dl_runtime_profile only preserved the integer
+    argument registers (r0-r3) across the inner call to _dl_fixup /
+    _dl_profile_fixup.  Two related ABI requirements demand more:
+    
+      * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the
+        function being resolved.  Recent GCC emits VFP instructions inside
+        the fixup routines, clobbering them, so the resolved function sees
+        corrupted arguments (BZ 34144).
+    
+      * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers
+        reachable through the dynamic linker) must only corrupt integer
+        core registers.  IFUNC resolvers, audit modules, and interposed
+        malloc invoked during symbol resolution may also use VFP, even on
+        softfp ABI builds (BZ 15792).
+    
+    Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31
+    when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup
+    call.  Whether VFP is usable is a property of the hardware, not of
+    the ABI glibc was built with, so the decision is gated on AT_HWCAP at
+    runtime in both hardfp and softfp builds; hardfp builds will always
+    find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU
+    correctly skip the save.
+    
+    For _dl_runtime_profile the save area is slipped in just before the
+    bl to _dl_profile_fixup; the outgoing framesizep argument is
+    recomputed to account for the extra frame, and both the fast path
+    (no audit framesize) and the slow path (audit wraps with
+    pltenter/pltexit) traverse the restore before splitting.
+    
+    Checked on arm-linux-gnueabihf.
+    
+    Tested-by: Aurelien Jarno <aurelien@aurel32.net>
+    Reviewed-by: Wilco Dijkstra  <Wilco.Dijkstra@arm.com>
+    (cherry picked from commit 1111fbdd3e7ebed402800bc23e67055eaae0d972)
+
+diff --git a/sysdeps/arm/Makefile b/sysdeps/arm/Makefile
+index 9c4fd6b236..be9e46aeeb 100644
+--- a/sysdeps/arm/Makefile
++++ b/sysdeps/arm/Makefile
+@@ -30,6 +30,25 @@ $(objpfx)tst-armtlsdescloc: $(objpfx)tst-armtlsdesclocmod.so
+ $(objpfx)tst-armtlsdescextnow: $(objpfx)tst-armtlsdescextnowmod.so
+ $(objpfx)tst-armtlsdescextlazy: $(objpfx)tst-armtlsdescextlazymod.so
+ endif
++
++tests += \
++  tst-bz34144 \
++  tst-bz34144-audit \
++  # tests
++modules-names += \
++  tst-bz34144-auditmod \
++  tst-bz34144-mod \
++  # modules-names
++$(objpfx)tst-bz34144: $(objpfx)tst-bz34144-mod.so
++$(objpfx)tst-bz34144-audit: $(objpfx)tst-bz34144-mod.so
++$(objpfx)tst-bz34144-audit.out: $(objpfx)tst-bz34144-auditmod.so
++# Use lazy binding to check if _dl_runtime_resolve correctly save/restore
++# the VFP state.
++LDFLAGS-tst-bz34144 = -Wl,-z,lazy
++# With LD_AUDIT, lazy resolution goes through _dl_runtime_profile, which
++# must also save/restore VFP state (BZ 34144).
++LDFLAGS-tst-bz34144-audit = -Wl,-z,lazy
++tst-bz34144-audit-ENV = LD_AUDIT=$(objpfx)tst-bz34144-auditmod.so
+ endif
+ endif
+ 
+diff --git a/sysdeps/arm/dl-trampoline.S b/sysdeps/arm/dl-trampoline.S
+index fffac55050..ef358d48bc 100644
+--- a/sysdeps/arm/dl-trampoline.S
++++ b/sysdeps/arm/dl-trampoline.S
+@@ -20,6 +20,7 @@
+ #define NO_THUMB
+ #include <sysdep.h>
+ #include <libc-symbols.h>
++#include <rtld-global-offsets.h>
+ 
+ 	.text
+ 	.globl _dl_runtime_resolve
+@@ -36,13 +37,40 @@ _dl_runtime_resolve:
+ 	@	ip contains &GOT[n+3] (pointer to function)
+ 	@	lr points to &GOT[2]
+ 
+-	@ Save arguments.  We save r4 to realign the stack.
++	@ Save arguments.  We save r4 to realign the stack and to hold
++	@ the hwcap value used to decide whether to save VFP registers.
+ 	push	{r0-r4}
+ 	cfi_adjust_cfa_offset (20)
+ 	cfi_rel_offset (r0, 0)
+ 	cfi_rel_offset (r1, 4)
+ 	cfi_rel_offset (r2, 8)
+ 	cfi_rel_offset (r3, 12)
++	cfi_rel_offset (r4, 16)
++
++#ifdef SHARED
++	@ Preserve all call-clobbered VFP registers across _dl_fixup.
++	@ VFP may be used by IFUNC resolvers, audit modules, interposed
++	@ malloc, and the __aeabi_mem* helpers required by RTABI32,
++	@ which mandates that those helpers only corrupt integer core
++	@ registers.
++	LDR_GLOBAL (r4, r3, C_SYMBOL_NAME(_rtld_global_ro), \
++		    RTLD_GLOBAL_RO_DL_HWCAP_OFFSET)
++
++	tst	r4, #HWCAP_ARM_VFP
++	beq	.Lno_vfp_save
++
++# define VFP_STACK_REQ (32*8 + 8)
++	sub	sp, sp, VFP_STACK_REQ
++	cfi_adjust_cfa_offset (VFP_STACK_REQ)
++	mov	r3, sp
++	.inst	0xeca30b20	@ vstmia r3!, {d0-d15}
++	tst	r4, #HWCAP_ARM_VFPD32
++	beq	1f
++	.inst	0xece30b20	@ vstmia r3!, {d16-d31}
++1:	.inst	0xeef12a10	@ vmrs r2, fpscr
++	str	r2, [r3]
++.Lno_vfp_save:
++#endif /* SHARED */
+ 
+ 	@ get pointer to linker struct
+ 	ldr	r0, [lr, #-4]
+@@ -59,8 +87,23 @@ _dl_runtime_resolve:
+ 	@ save the return
+ 	mov	ip, r0
+ 
+-	@ get arguments and return address back.  We restore r4
+-	@ only to realign the stack.
++#ifdef SHARED
++	tst	r4, #HWCAP_ARM_VFP
++	beq	.Lno_vfp_restore
++	mov	r3, sp
++	.inst	0xecb30b20	@ vldmia r3!, {d0-d15}
++	tst	r4, #HWCAP_ARM_VFPD32
++	beq	2f
++	.inst	0xecf30b20	@ vldmia r3!, {d16-d31}
++2:	ldr	r2, [r3]
++	.inst	0xeee12a10	@ vmsr fpscr, r2
++	add	sp, sp, VFP_STACK_REQ
++	cfi_adjust_cfa_offset (-VFP_STACK_REQ)
++.Lno_vfp_restore:
++#endif /* SHARED */
++
++	@ get arguments and return address back.  We restore r4 to
++	@ its original value as well.
+ 	pop	{r0-r4,lr}
+ 	cfi_adjust_cfa_offset (-24)
+ 
+@@ -124,14 +167,71 @@ _dl_runtime_profile:
+ 	add	r3, sp, #8
+ 	stmia	r3!, {r0,r1}
+ 
++	@ Preserve all call-clobbered VFP registers across
++	@ _dl_profile_fixup.  See the matching comment in
++	@ _dl_runtime_resolve above for the rationale (BZ 34144,
++	@ BZ 15792).
++	@
++	@ Stack layout below the current sp (which becomes the new sp
++	@ after the sub):
++	@   sp +  0 ..   3: outgoing arg (framesizep) for _dl_profile_fixup
++	@   sp +  4 ..   7: saved hwcap (so we can test it after the call)
++	@   sp +  8 ..  11: saved r2 (used as scratch for LDR_GLOBAL)
++	@   sp + 12 ..  15: padding (for 8-byte alignment of the VFP area)
++	@   sp + 16 .. 16+VFP_STACK_REQ-1: VFP regs + fpscr
++#define VFP_PROFILE_STACK (16 + VFP_STACK_REQ)
++	sub	sp, sp, #VFP_PROFILE_STACK
++	cfi_adjust_cfa_offset (VFP_PROFILE_STACK)
++
++	@ r2 holds the retaddr (3rd arg to _dl_profile_fixup); spill
++	@ it so we can use it as the LDR_GLOBAL destination.
++	str	r2, [sp, #8]
++
++	LDR_GLOBAL (r2, ip, C_SYMBOL_NAME(_rtld_global_ro), \
++		    RTLD_GLOBAL_RO_DL_HWCAP_OFFSET)
++	str	r2, [sp, #4]
++
++	tst	r2, #HWCAP_ARM_VFP
++	beq	.Lprofile_no_vfp_save
++	add	ip, sp, #16
++	.inst	0xecac0b20	@ vstmia ip!, {d0-d15}
++	tst	r2, #HWCAP_ARM_VFPD32
++	beq	7f
++	.inst	0xecec0b20	@ vstmia ip!, {d16-d31}
++7:	.inst	0xeef12a10	@ vmrs r2, fpscr
++	str	r2, [ip]
++.Lprofile_no_vfp_save:
++
++	@ Restore r2 (retaddr) for _dl_profile_fixup.
++	ldr	r2, [sp, #8]
++
+ 	@ Set up extra args for _dl_profile_fixup.
+-	@ r2 and r3 are already loaded.
+-	add	ip, sp, #208
++	@ The framesize slot is at the old sp+208, which is the new
++	@ sp + VFP_PROFILE_STACK + 208 -- compute in two steps because
++	@ the combined offset is not encodable as an ARM immediate.
++	add	ip, sp, #VFP_PROFILE_STACK
++	add	ip, ip, #208
+ 	str	ip, [sp, #0]
+ 
+ 	@ call profiling fixup routine
+ 	bl	_dl_profile_fixup
+ 
++	@ Restore VFP registers.  r0 holds the resolved function
++	@ address; r1/r2/ip are caller-saved by the call.
++	ldr	r1, [sp, #4]
++	tst	r1, #HWCAP_ARM_VFP
++	beq	.Lprofile_no_vfp_restore
++	add	ip, sp, #16
++	.inst	0xecbc0b20	@ vldmia ip!, {d0-d15}
++	tst	r1, #HWCAP_ARM_VFPD32
++	beq	8f
++	.inst	0xecfc0b20	@ vldmia ip!, {d16-d31}
++8:	ldr	r2, [ip]
++	.inst	0xeee12a10	@ vmsr fpscr, r2
++.Lprofile_no_vfp_restore:
++	add	sp, sp, #VFP_PROFILE_STACK
++	cfi_adjust_cfa_offset (-VFP_PROFILE_STACK)
++
+ 	@ The address to call is now in r0.
+ 
+ 	@ Check whether we're wrapping this function.
+diff --git a/sysdeps/arm/tst-bz34144-audit.c b/sysdeps/arm/tst-bz34144-audit.c
+new file mode 100644
+index 0000000000..8f1084fa0a
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144-audit.c
+@@ -0,0 +1,32 @@
++/* Test that lazy PLT resolution via _dl_runtime_profile preserves
++   caller-saved VFP registers used to pass double arguments (BZ 34144).
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <support/test-driver.h>
++
++extern void test_float_args (double a, double b, double c, double d,
++			     double e, double f, double g, double h);
++
++static int
++do_test (void)
++{
++  test_float_args (2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0);
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/sysdeps/arm/tst-bz34144-auditmod.c b/sysdeps/arm/tst-bz34144-auditmod.c
+new file mode 100644
+index 0000000000..ada9f126c2
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144-auditmod.c
+@@ -0,0 +1,50 @@
++/* Minimal audit module used by tst-bz34144-audit to force PLT calls
++   to go through _dl_runtime_profile instead of _dl_runtime_resolve.
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <link.h>
++#include <stddef.h>
++#include <stdint.h>
++
++unsigned int
++la_version (unsigned int v)
++{
++  return v;
++}
++
++unsigned int
++la_objopen (struct link_map *l, Lmid_t lmid, uintptr_t *cookie)
++{
++  return LA_FLG_BINDFROM | LA_FLG_BINDTO;
++}
++
++uintptr_t
++la_symbind32 (Elf32_Sym *sym, unsigned int ndx, uintptr_t *refcook,
++	      uintptr_t *defcook, unsigned int *flags, const char *symname)
++{
++  return sym->st_value;
++}
++
++Elf32_Addr
++la_arm_gnu_pltenter (Elf32_Sym *sym, unsigned int ndx, uintptr_t *refcook,
++		     uintptr_t *defcook, La_arm_regs *regs,
++		     unsigned int *flags, const char *symname,
++		     long int *framesizep)
++{
++  return sym->st_value;
++}
+diff --git a/sysdeps/arm/tst-bz34144-mod.c b/sysdeps/arm/tst-bz34144-mod.c
+new file mode 100644
+index 0000000000..be6b54bf91
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144-mod.c
+@@ -0,0 +1,28 @@
++/* DSO used by tst-bz34144.
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <stdlib.h>
++
++void
++test_float_args (double a, double b, double c, double d,
++		 double e, double f, double g, double h)
++{
++  if (a != 2.0 || b != 3.0 || c != 4.0 || d != 5.0
++      || e != 6.0 || f != 7.0 || g != 8.0 || h != 9.0)
++    abort ();
++}
+diff --git a/sysdeps/arm/tst-bz34144.c b/sysdeps/arm/tst-bz34144.c
+new file mode 100644
+index 0000000000..61e41b3945
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144.c
+@@ -0,0 +1,32 @@
++/* Test that lazy PLT resolution preserves caller-saved VFP registers
++   used to pass double arguments (BZ 34144).
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <support/test-driver.h>
++
++extern void test_float_args (double a, double b, double c, double d,
++			     double e, double f, double g, double h);
++
++static int
++do_test (void)
++{
++  test_float_args (2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0);
++  return 0;
++}
++
++#include <support/test-driver.c>
+
+commit 0be5a6a72a4a3132bc211720d2b6949a84f54dc3
+Author: John David Anglin <danglin@gcc.gnu.org>
+Date:   Tue Jun 23 13:41:10 2026 -0400
+
+    hppa: Fix missing call to __feraiseexcept (BZ 34306)
+    
+    The feupdateenv function is supposed to raise exceptions after
+    installing the environment represented by its envp argument.
+    This was accidentally missed on hppa.
+    
+    The failure to raise exceptions was noticed by the failure of
+    the math/test-narrowing-trap test.
+    
+    Signed-off-by: John David Anglin <dave.anglin@bell.net>
+
+diff --git a/sysdeps/hppa/fpu/feupdateenv.c b/sysdeps/hppa/fpu/feupdateenv.c
+index 46b83cc7a0..a3d3de33e4 100644
+--- a/sysdeps/hppa/fpu/feupdateenv.c
++++ b/sysdeps/hppa/fpu/feupdateenv.c
+@@ -24,6 +24,7 @@ __feupdateenv (const fenv_t *envp)
+ {
+   union { unsigned long long l; unsigned int sw[2]; } s;
+   fenv_t temp;
++
+   /* Get the current exception status */
+   __asm__ ("fstd %%fr0,0(%1)	\n\t"
+            "fldd 0(%1),%%fr0	\n\t"
+@@ -46,6 +47,10 @@ __feupdateenv (const fenv_t *envp)
+ 
+   /* Install new environment.  */
+   __fesetenv (&temp);
++
++  /* Raise exceptions.  */
++  __feraiseexcept (temp.__status_word >> 27);
++
+   /* Success.  */
+   return 0;
+ }
+
+commit 54929540335ef339ac66a8c28e3f4c22ebae2630
+Author: Fabian Rast <fabian.rast@tum.de>
+Date:   Thu Jun 11 14:30:37 2026 +0200
+
+    rtld: cache cpuid results on the stack for intel
+    
+    dl_init_cacheinfo retrieves various information about cache
+    sizes, using the cpuid instruction on x86.
+    Previously, the same cpuid leaves were queried multiple times.
+    This behavior caused intel_check_word to prominently show up in
+    profiles of dynamic loader startup on the Intel(R) Xeon(R) Gold 6430.
+    The big performance impact could not be reproduced on other Intel cpus.
+    
+    This patch reduces the number of cpuid queries on startup
+    by caching their results on the stack for reuse when searching for a
+    different cache size value.
+    This approach does not change the overall design of
+    the cache enumeration code (repeated calls to handle_* functions).
+    The values are cached on the stack instead of globally (e.g.
+    in the cpu_features global) because they are never needed after
+    early initialization.
+    
+    The cache is only active for Intel cpus, because it has not yet
+    been shown through benchmarks that it meaningfully improves performance
+    for other processors.
+    
+    Signed-off-by: Fabian Rast <fabian.rast@tum.de>
+    Reviewed-by: Sunil K Pandey <skpgkp2@gmail.com>
+    (cherry picked from commit df83fa8813eb53dcb232462a4f6dd00c873115f0)
+
+diff --git a/sysdeps/x86/dl-cacheinfo.h b/sysdeps/x86/dl-cacheinfo.h
+index 6f9bb08a19..201d3ad278 100644
+--- a/sysdeps/x86/dl-cacheinfo.h
++++ b/sysdeps/x86/dl-cacheinfo.h
+@@ -98,6 +98,15 @@ static const struct intel_02_cache_info
+ 
+ #define nintel_02_known (sizeof (intel_02_known) / sizeof (intel_02_known [0]))
+ 
++/* Cache for redundant cpuid queries in handle_intel, intel_check_word and
++   get_common_cache_info.  Currently, this has only been shown to significantly
++   improve performance on a specific Intel CPU (Xeon 6430).  */
++struct intel_cpuid_cache
++{
++  unsigned char leaf2_valid, leaf4_valid; /* Number of cached (sub)leaves.  */
++  unsigned int leaf2[4], leaf4[0x10][4];
++};
++
+ static int
+ intel_02_known_compare (const void *p1, const void *p2)
+ {
+@@ -118,7 +127,8 @@ static long int
+ __attribute__ ((noinline))
+ intel_check_word (int name, unsigned int value, bool *has_level_2,
+ 		  bool *no_level_2_or_3,
+-		  const struct cpu_features *cpu_features)
++		  const struct cpu_features *cpu_features,
++		  struct intel_cpuid_cache *cache)
+ {
+   if ((value & 0x80000000) != 0)
+     /* The register value is reserved.  */
+@@ -152,7 +162,21 @@ intel_check_word (int name, unsigned int value, bool *has_level_2,
+ 	  unsigned int round = 0;
+ 	  while (1)
+ 	    {
+-	      __cpuid_count (4, round, eax, ebx, ecx, edx);
++	      if (round < cache->leaf4_valid)
++		/* Subleaf was queried before.  Do not execute cpuid again.  */
++		eax = cache->leaf4[round][0], ebx = cache->leaf4[round][1],
++		ecx = cache->leaf4[round][2], edx = cache->leaf4[round][3];
++	      else if (round == cache->leaf4_valid
++		       && round < sizeof(cache->leaf4)/sizeof(*cache->leaf4))
++		{
++		  /* Cache the cpuid result if we have space.  */
++		  __cpuid_count (4, round, eax, ebx, ecx, edx);
++		  cache->leaf4[round][0] = eax, cache->leaf4[round][1] = ebx;
++		  cache->leaf4[round][2] = ecx, cache->leaf4[round][3] = edx;
++		  cache->leaf4_valid++;
++		}
++	      else
++		__cpuid_count (4, round, eax, ebx, ecx, edx);
+ 
+ 	      enum { null = 0, data = 1, inst = 2, uni = 3 } type = eax & 0x1f;
+ 	      if (type == null)
+@@ -247,7 +271,8 @@ intel_check_word (int name, unsigned int value, bool *has_level_2,
+ 
+ 
+ static long int __attribute__ ((noinline))
+-handle_intel (int name, const struct cpu_features *cpu_features)
++handle_intel (int name, const struct cpu_features *cpu_features,
++	      struct intel_cpuid_cache *cache)
+ {
+   unsigned int maxidx = cpu_features->basic.max_cpuid;
+ 
+@@ -260,41 +285,33 @@ handle_intel (int name, const struct cpu_features *cpu_features)
+   long int result = 0;
+   bool no_level_2_or_3 = false;
+   bool has_level_2 = false;
+-  unsigned int eax;
+-  unsigned int ebx;
+-  unsigned int ecx;
+-  unsigned int edx;
+-  __cpuid (2, eax, ebx, ecx, edx);
++  int i;
++
++  if (!cache->leaf2_valid)
++    {
++      __cpuid (2, cache->leaf2[0], cache->leaf2[1],
++		  cache->leaf2[2], cache->leaf2[3]);
++      cache->leaf2_valid = 1;
++    }
+ 
+   /* The low byte of EAX of CPUID leaf 2 should always return 1 and it
+      should be ignored.  If it isn't 1, use CPUID leaf 4 instead.  */
+-  if ((eax & 0xff) != 1)
++  if ((cache->leaf2[0] & 0xff) != 1)
+     return intel_check_word (name, 0xff, &has_level_2, &no_level_2_or_3,
+-			     cpu_features);
+-  else
+-    {
+-      eax &= 0xffffff00;
+-
+-      /* Process the individual registers' value.  */
+-      result = intel_check_word (name, eax, &has_level_2,
+-				 &no_level_2_or_3, cpu_features);
+-      if (result != 0)
+-	return result;
++			     cpu_features, cache);
+ 
+-      result = intel_check_word (name, ebx, &has_level_2,
+-				 &no_level_2_or_3, cpu_features);
+-      if (result != 0)
+-	return result;
+-
+-      result = intel_check_word (name, ecx, &has_level_2,
+-				 &no_level_2_or_3, cpu_features);
+-      if (result != 0)
+-	return result;
++  /* Process all descriptors in leaf 2.  */
++  result = intel_check_word (name, cache->leaf2[0]&0xffffff00, &has_level_2,
++			    &no_level_2_or_3, cpu_features, cache);
++  if (result != 0)
++    return result;
+ 
+-      result = intel_check_word (name, edx, &has_level_2,
+-				 &no_level_2_or_3, cpu_features);
++  for (i = 1; i < 4; i++)
++    {
++      result = intel_check_word (name, cache->leaf2[i], &has_level_2,
++				&no_level_2_or_3, cpu_features, cache);
+       if (result != 0)
+-	return result;
++        return result;
+     }
+ 
+   if (name >= _SC_LEVEL2_CACHE_SIZE && name <= _SC_LEVEL3_CACHE_LINESIZE
+@@ -611,7 +628,7 @@ handle_hygon (int name)
+ 
+ static void
+ get_common_cache_info (long int *shared_ptr, long int * shared_per_thread_ptr, unsigned int *threads_ptr,
+-                long int core)
++                long int core, struct intel_cpuid_cache *cache)
+ {
+   unsigned int eax;
+   unsigned int ebx;
+@@ -669,7 +686,14 @@ get_common_cache_info (long int *shared_ptr, long int * shared_per_thread_ptr, u
+           int check = 0x1 | (threads_l3 == 0) << 1;
+           do
+             {
+-              __cpuid_count (4, i++, eax, ebx, ecx, edx);
++              if (cache != NULL && i < cache->leaf4_valid)
++                eax = cache->leaf4[i][0], ebx = cache->leaf4[i][1],
++                ecx = cache->leaf4[i][2], edx = cache->leaf4[i][3];
++              else
++                /* Do not attempt to cache queries at this point,
++		   because get_common_cache_info is called last.  */
++                __cpuid_count (4, i, eax, ebx, ecx, edx);
++              i++;
+ 
+               /* There seems to be a bug in at least some Pentium Ds
+                  which sometimes fail to iterate all cache parameters.
+@@ -849,35 +873,38 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+ 
+   if (cpu_features->basic.kind == arch_kind_intel)
+     {
+-      data = handle_intel (_SC_LEVEL1_DCACHE_SIZE, cpu_features);
+-      shared = handle_intel (_SC_LEVEL3_CACHE_SIZE, cpu_features);
++      struct intel_cpuid_cache cache;
++      cache.leaf2_valid = cache.leaf4_valid = 0;
++
++      data = handle_intel (_SC_LEVEL1_DCACHE_SIZE, cpu_features, &cache);
++      shared = handle_intel (_SC_LEVEL3_CACHE_SIZE, cpu_features, &cache);
+       shared_per_thread = shared;
+ 
+       level1_icache_size
+-	= handle_intel (_SC_LEVEL1_ICACHE_SIZE, cpu_features);
++	= handle_intel (_SC_LEVEL1_ICACHE_SIZE, cpu_features, &cache);
+       level1_icache_linesize
+-	= handle_intel (_SC_LEVEL1_ICACHE_LINESIZE, cpu_features);
++	= handle_intel (_SC_LEVEL1_ICACHE_LINESIZE, cpu_features, &cache);
+       level1_dcache_size = data;
+       level1_dcache_assoc
+-	= handle_intel (_SC_LEVEL1_DCACHE_ASSOC, cpu_features);
++	= handle_intel (_SC_LEVEL1_DCACHE_ASSOC, cpu_features, &cache);
+       level1_dcache_linesize
+-	= handle_intel (_SC_LEVEL1_DCACHE_LINESIZE, cpu_features);
++	= handle_intel (_SC_LEVEL1_DCACHE_LINESIZE, cpu_features, &cache);
+       level2_cache_size
+-	= handle_intel (_SC_LEVEL2_CACHE_SIZE, cpu_features);
++	= handle_intel (_SC_LEVEL2_CACHE_SIZE, cpu_features, &cache);
+       level2_cache_assoc
+-	= handle_intel (_SC_LEVEL2_CACHE_ASSOC, cpu_features);
++	= handle_intel (_SC_LEVEL2_CACHE_ASSOC, cpu_features, &cache);
+       level2_cache_linesize
+-	= handle_intel (_SC_LEVEL2_CACHE_LINESIZE, cpu_features);
++	= handle_intel (_SC_LEVEL2_CACHE_LINESIZE, cpu_features, &cache);
+       level3_cache_size = shared;
+       level3_cache_assoc
+-	= handle_intel (_SC_LEVEL3_CACHE_ASSOC, cpu_features);
++	= handle_intel (_SC_LEVEL3_CACHE_ASSOC, cpu_features, &cache);
+       level3_cache_linesize
+-	= handle_intel (_SC_LEVEL3_CACHE_LINESIZE, cpu_features);
++	= handle_intel (_SC_LEVEL3_CACHE_LINESIZE, cpu_features, &cache);
+       level4_cache_size
+-	= handle_intel (_SC_LEVEL4_CACHE_SIZE, cpu_features);
++	= handle_intel (_SC_LEVEL4_CACHE_SIZE, cpu_features, &cache);
+ 
+       get_common_cache_info (&shared, &shared_per_thread, &threads,
+-			     level2_cache_size);
++			     level2_cache_size, &cache);
+     }
+   else if (cpu_features->basic.kind == arch_kind_zhaoxin)
+     {
+@@ -898,7 +925,7 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+       level3_cache_linesize = handle_zhaoxin (_SC_LEVEL3_CACHE_LINESIZE);
+ 
+       get_common_cache_info (&shared, &shared_per_thread, &threads,
+-			     level2_cache_size);
++			     level2_cache_size, NULL);
+     }
+   else if (cpu_features->basic.kind == arch_kind_amd)
+     {
+
+commit f2f55eac9e6f1167486f2694dea88adf87c77fdd
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Declare __p_class_syms, __p_type_syms for internal use
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit 360f352c9a6da545d798ef3015e73ca114f0d230)
+
+diff --git a/include/resolv.h b/include/resolv.h
+index 4dbbac3800..d5ad9994b9 100644
+--- a/include/resolv.h
++++ b/include/resolv.h
+@@ -70,6 +70,11 @@ libc_hidden_proto (__libc_res_nameinquery)
+ extern __typeof (__res_queriesmatch) __libc_res_queriesmatch;
+ libc_hidden_proto (__libc_res_queriesmatch)
+ 
++extern const struct res_sym __p_class_syms[];
++libresolv_hidden_proto (__p_class_syms)
++extern const struct res_sym __p_type_syms[];
++libresolv_hidden_proto (__p_type_syms)
++
+ /* Variant of res_hnok which operates on binary (but uncompressed) names.  */
+ bool __res_binary_hnok (const unsigned char *dn) attribute_hidden;
+ 
+diff --git a/resolv/res_debug.c b/resolv/res_debug.c
+index 73af0c72fe..6bf9962916 100644
+--- a/resolv/res_debug.c
++++ b/resolv/res_debug.c
+@@ -390,8 +390,6 @@ p_fqname(const u_char *cp, const u_char *msg, FILE *file) {
+  * that C_ANY is a qclass but not a class.  (You can ask for records of class
+  * C_ANY, but you can't have any records of that class in the database.)
+  */
+-extern const struct res_sym __p_class_syms[];
+-libresolv_hidden_proto (__p_class_syms)
+ const struct res_sym __p_class_syms[] = {
+   {C_IN,    (char *) "IN"},
+   {C_CHAOS, (char *) "CHAOS"},
+@@ -426,8 +424,6 @@ const struct res_sym __p_update_section_syms[] attribute_hidden = {
+  * Names of RR types and qtypes.  The list is incomplete because its
+  * size is part of the ABI.
+  */
+-extern const struct res_sym __p_type_syms[];
+-libresolv_hidden_proto (__p_type_syms)
+ const struct res_sym __p_type_syms[] = {
+   {ns_t_a,      (char *) "A",     (char *) "address"},
+   {ns_t_ns,     (char *) "NS",    (char *) "name server"},
+
+commit 3c27e5170c456a69807348de8586c123f62a51f6
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
+    
+    The p_class and p_type results could overwrite each other if both
+    were unknown.  Format unknown values with CLASS and TYPE prefixes,
+    as in RFC 3597.  Handle A6 separately because it cannot be added
+    to __p_type_syms for ABI reasons.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit f69b7f95e3694177546faec25d88bb266885c3b8)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index cef2212fd2..e75c39eaa8 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -78,6 +78,24 @@ ns_sprintrr(const ns_msg *handle, const ns_rr *rr,
+ }
+ libresolv_hidden_def (ns_sprintrr)
+ 
++/* Writes the class/type symbol NUMBER to *BUF, using the name from
++   *SYMS if possible.  If NUMBER is not found in *SYMS, print the
++   number with PREFIX.  */
++static int
++addsym (const struct res_sym *syms, int number, const char *prefix,
++	char **buf, size_t *buflen)
++{
++  for (; syms->name != NULL; syms++)
++    if (number == syms->number)
++      {
++	T (addstr (" ", 1, buf, buflen));
++	return addstr (syms->name, strlen (syms->name), buf, buflen);
++      }
++  char tmp[20];
++  int len = snprintf (tmp, sizeof (tmp), " %s%d", prefix, number);
++  return addstr (tmp, len, buf, buflen);
++}
++
+ /*%
+  *	Convert the fields of an RR into presentation format.
+  *
+@@ -128,11 +146,21 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	/*
+ 	 * TTL, Class, Type.
+ 	 */
+-	T(x = ns_format_ttl(ttl, buf, buflen));
+-	addlen(x, &buf, &buflen);
+-	len = SPRINTF((tmp, " %s %s", p_class(class), p_type(type)));
+-	T(addstr(tmp, len, &buf, &buflen));
+-	T(spaced = addtab(x + len, 16, spaced, &buf, &buflen));
++	{
++	  char *start = buf;
++
++	  T (x = ns_format_ttl (ttl, buf, buflen));
++	  addlen (x, &buf, &buflen);
++	  T (addsym (__p_class_syms, class, "CLASS", &buf, &buflen));
++	  if (type == ns_t_a6)
++	    /* A6 is not part of __p_type_syms, which is exported.
++	       Adding A6 there would change its size.  Handle it here.  */
++	    T (addstr (" A6", 3, &buf, &buflen));
++	  else
++	    T (addsym (__p_type_syms, type, "TYPE", &buf, &buflen));
++
++	  T (spaced = addtab(buf - start, 16, spaced, &buf, &buflen));
++	}
+ 
+ 	/*
+ 	 * RData.
+
+commit 509d819cea20f5d6c615eed1f869cc930effd9d2
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Improve formatting of unknown records in ns_sprintrrf
+    
+    Do not add the "unknown RR type" comment.  After adding the TYPE
+    prefix, the number is largely redundant.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit d58415eb17d457a160af99f9e8ab164404ca151b)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index e75c39eaa8..3d38876483 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -115,7 +115,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 
+ 	const char *comment;
+ 	char tmp[100];
+-	char errbuf[40];
+ 	int len, x;
+ 
+ 	/*
+@@ -590,20 +589,18 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 		T(addstr(tmp, len, &buf, &buflen));
+ 		break;
+ 	    }
+-
+ 	default:
+-		snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type);
+-		comment = errbuf;
++		comment = "";
+ 		goto hexify;
+ 	}
+ 	return (buf - obuf);
+  formerr:
+-	comment = "RR format error";
++	comment = " ; RR format error";
+  hexify: {
+ 	int n, m;
+ 	char *p;
+ 
+-	len = SPRINTF((tmp, "\\# %u%s\t; %s", (unsigned)(edata - rdata),
++	len = SPRINTF((tmp, "\\# %u%s%s", (unsigned)(edata - rdata),
+ 		       rdlen != 0U ? " (" : "", comment));
+ 	T(addstr(tmp, len, &buf, &buflen));
+ 	while (rdata < edata) {
+
+commit 05dc6da0b4e12dbc60d3705e4961b823d3f7026d
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Check for inet_ntop failure in ns_sprintrrf
+    
+    This makes the output more consistent (either failure or complete
+    output) and helps with systematic testing with varying buffer
+    sizes.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index 3d38876483..e58df5f35a 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -167,8 +167,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	switch (type) {
+ 	case ns_t_a:
+ 	  if (rdlen != (size_t)NS_INADDRSZ)
+-			goto formerr;
+-		(void) inet_ntop(AF_INET, rdata, buf, buflen);
++		  goto formerr;
++		if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
++		  return -1;
+ 		addlen(strlen(buf), &buf, &buflen);
+ 		break;
+ 
+@@ -334,9 +335,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	    }
+ 
+ 	case ns_t_aaaa:
+-	  if (rdlen != (size_t)NS_IN6ADDRSZ)
+-			goto formerr;
+-		(void) inet_ntop(AF_INET6, rdata, buf, buflen);
++		if (rdlen != (size_t)NS_IN6ADDRSZ)
++		  goto formerr;
++		if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL)
++		  return -1;
+ 		addlen(strlen(buf), &buf, &buflen);
+ 		break;
+ 
+@@ -427,7 +429,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 			goto formerr;
+ 
+ 		/* Address. */
+-		(void) inet_ntop(AF_INET, rdata, buf, buflen);
++		if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
++		  return -1;
+ 		addlen(strlen(buf), &buf, &buflen);
+ 		rdata += NS_INADDRSZ;
+ 
+@@ -569,7 +572,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 			if (rdata + pbyte >= edata) goto formerr;
+ 			memset(&a, 0, sizeof(a));
+ 			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
+-			(void) inet_ntop(AF_INET6, &a, buf, buflen);
++			if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
++			  return -1;
+ 			addlen(strlen(buf), &buf, &buflen);
+ 			rdata += sizeof(a) - pbyte;
+ 		}
+
+commit 299e1d25c32c5f9ef78ddd6cbfd0c6a09a1f4227
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
+    
+    Specifically, CERT, TKEY, TSIG, OPT.  This removes the buggy
+    implementations of TSIG, fixing bug 34033, and partially
+    fixing bug 34069.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index e58df5f35a..ab68bf2cb7 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -464,96 +464,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 		break;
+ 	    }
+ 
+-	case ns_t_cert: {
+-		u_int c_type, key_tag, alg;
+-		int n;
+-		unsigned int siz;
+-		char base64_cert[8192], tmp[40];
+-		const char *leader;
+-
+-		c_type  = ns_get16(rdata); rdata += NS_INT16SZ;
+-		key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
+-		alg = (u_int) *rdata++;
+-
+-		len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg));
+-		T(addstr(tmp, len, &buf, &buflen));
+-		siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
+-		if (siz > sizeof(base64_cert) * 3/4) {
+-			const char *str = "record too long to print";
+-			T(addstr(str, strlen(str), &buf, &buflen));
+-		}
+-		else {
+-			len = b64_ntop(rdata, edata-rdata, base64_cert, siz);
+-
+-			if (len < 0)
+-				goto formerr;
+-			else if (len > 15) {
+-				T(addstr(" (", 2, &buf, &buflen));
+-				leader = "\n\t\t";
+-				spaced = 0;
+-			}
+-			else
+-				leader = " ";
+-
+-			for (n = 0; n < len; n += 48) {
+-				T(addstr(leader, strlen(leader),
+-					 &buf, &buflen));
+-				T(addstr(base64_cert + n, MIN(len - n, 48),
+-					 &buf, &buflen));
+-			}
+-			if (len > 15)
+-				T(addstr(" )", 2, &buf, &buflen));
+-		}
+-		break;
+-	    }
+-
+-	case ns_t_tkey: {
+-		/* KJD - need to complete this */
+-		u_long t;
+-		int mode, err, keysize;
+-
+-		/* Algorithm name. */
+-		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+-		T(addstr(" ", 1, &buf, &buflen));
+-
+-		/* Inception. */
+-		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+-		len = SPRINTF((tmp, "%lu ", t));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* Expiration. */
+-		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+-		len = SPRINTF((tmp, "%lu ", t));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* Mode , Error, Key Size. */
+-		/* Priority, Weight, Port. */
+-		mode = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		err  = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		keysize  = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* XXX need to dump key, print otherdata length & other data */
+-		break;
+-	    }
+-
+-	case ns_t_tsig: {
+-		/* BEW - need to complete this */
+-		int n;
+-
+-		T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
+-		T(addstr(" ", 1, &buf, &buflen));
+-		rdata += 8; /*%< time */
+-		n = ns_get16(rdata); rdata += INT16SZ;
+-		rdata += n; /*%< sig */
+-		n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
+-		sprintf(buf, "%d", ns_get16(rdata));
+-		rdata += INT16SZ;
+-		addlen(strlen(buf), &buf, &buflen);
+-		break;
+-	    }
+-
+ 	case ns_t_a6: {
+ 		struct in6_addr a;
+ 		int pbyte, pbit;
+@@ -588,11 +498,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 		break;
+ 	    }
+ 
+-	case ns_t_opt: {
+-		len = SPRINTF((tmp, "%u bytes", class));
+-		T(addstr(tmp, len, &buf, &buflen));
+-		break;
+-	    }
+ 	default:
+ 		comment = "";
+ 		goto hexify;
+
+commit cb4c62448047c043981deea84e5e01eccf8b36d4
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
+    
+    Check that the RDATA payload does not require more than RDATALEN
+    bytes while processing it.  The fixes cover A6, LOC records.
+    (CERT, TKEY, TSIG were fixed before, by switching to the generic
+    formatter.)
+    
+    The vulnerable LOC record handling was first introduced before
+    glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f.
+    
+    CERT, TSIG, TKEY handling came with commit
+    b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2.
+    
+    A6 record handling was introduced in commit
+    91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c
+    (ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc
+    2.7.
+    
+    This fixes bug 34069.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index ab68bf2cb7..f9dd086804 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -345,7 +345,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	case ns_t_loc: {
+ 		char t[255];
+ 
+-		/* XXX protocol format checking? */
++		if (rdlen != 16)
++		  goto formerr;
+ 		(void) loc_ntoa(rdata, t);
+ 		T(addstr(t, strlen(t), &buf, &buflen));
+ 		break;
+@@ -479,13 +480,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 
+ 		/* address suffix: provided only when prefix len != 128 */
+ 		if (pbit < 128) {
+-			if (rdata + pbyte >= edata) goto formerr;
++			unsigned int bytelen = sizeof(a) - pbyte;
++			if (edata - rdata < bytelen) goto formerr;
+ 			memset(&a, 0, sizeof(a));
+-			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
++			memcpy(&a.s6_addr[pbyte], rdata, bytelen);
+ 			if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
+ 			  return -1;
+ 			addlen(strlen(buf), &buf, &buflen);
+-			rdata += sizeof(a) - pbyte;
++			rdata += bytelen;
+ 		}
+ 
+ 		/* prefix name: provided only when prefix len > 0 */
+
+commit 296fb7f4a2b35db13efef52609f8efc00291b2a8
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Fri Jun 19 18:22:20 2026 +0200
+
+    resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
+    
+    This test case covers both input buffer overreads and output buffer
+    overflows.  It should systematically cover these issues.
+    
+    I used code auto-generation for updating the test expectations for
+    truncated RDATA in TXT, ISDN records, after writing the rest
+    of the test by hand.
+    
+    Assisted-by: LLM
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+    (cherry picked from commit 4ba0b79b9596e5a4951cc9eaa1546a55e543e083)
+
+diff --git a/resolv/Makefile b/resolv/Makefile
+index 088a22ea18..c6d73b411c 100644
+--- a/resolv/Makefile
++++ b/resolv/Makefile
+@@ -98,6 +98,7 @@ tests += \
+   tst-ns_name \
+   tst-ns_name_compress \
+   tst-ns_name_pton \
++  tst-ns_sprintrr \
+   tst-res_hconf_reorder \
+   tst-res_hnok \
+   tst-resolv-aliases \
+@@ -331,5 +332,6 @@ $(objpfx)tst-ns_name: $(objpfx)libresolv.so
+ $(objpfx)tst-ns_name.out: tst-ns_name.data
+ $(objpfx)tst-ns_name_compress: $(objpfx)libresolv.so
+ $(objpfx)tst-ns_name_pton: $(objpfx)libresolv.so
++$(objpfx)tst-ns_sprintrr: $(objpfx)libresolv.so
+ $(objpfx)tst-res_hnok: $(objpfx)libresolv.so
+ $(objpfx)tst-p_secstodate: $(objpfx)libresolv.so
+diff --git a/resolv/tst-ns_sprintrr.c b/resolv/tst-ns_sprintrr.c
+new file mode 100644
+index 0000000000..34739b5924
+--- /dev/null
++++ b/resolv/tst-ns_sprintrr.c
+@@ -0,0 +1,329 @@
++/* Tests for the ns_sprintrr function.
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <arpa/nameser.h>
++
++#include <alloc_buffer.h>
++#include <arpa/inet.h>
++#include <libc-diag.h>
++#include <stdbool.h>
++#include <string.h>
++#include <support/check.h>
++#include <support/next_to_fault.h>
++
++#include <stdio.h>
++
++/* Regions that test_one_record uses for input and output.  */
++static struct support_next_to_fault ntf_in;
++static struct support_next_to_fault ntf_out;
++
++/* This is used by test_one_record to construct the packet.   */
++static const char packet_prefix[] =
++  /* DNS response with one question, one answer record.  */
++  "AA\x81\x80\0\1\0\1\0\0\0\0"
++  /* Question: www.example.org/IN/ANY.  */
++  "\3www\7example\3org\0\0\xff\0\1"
++  /* Response: compression reference.  */
++  "\xc0\x0c";
++
++/* Use ns_sprintrr to format a DNS record (starting with
++   packet_prefix) of type RTYPE, with a record payload of RDATALEN
++   bytes starting at RDATA.  Check successful formatting against
++   EXPECTED.  Try various truncated input and output buffers to catch
++   overreads and buffer overflows, using ntf_in and ntf_out above.  */
++static void
++test_one_record (uint16_t rtype, const char *rdata, size_t rdatalen,
++                 const char *expected)
++{
++  struct rr_header
++  {
++    uint16_t typ;
++    uint16_t cls;
++    uint32_t ttl;
++    uint16_t rdatalen;
++    uint16_t pad;
++  } hdr =
++    {
++      .typ = htons (rtype),
++      .cls = htons (ns_c_in),
++      .ttl = htonl (86400),     /* One day.  */
++      .rdatalen = htons (rdatalen),
++    };
++  enum { hdrlen = offsetof (struct rr_header, pad) };
++  TEST_COMPARE (hdrlen, 10);
++
++  /* Construct the packet from packet_prefix, hdr, and rdata.  */
++  unsigned char packet[512];
++  size_t packetlen;
++  {
++    struct alloc_buffer buf = alloc_buffer_create (packet, sizeof (packet));
++    alloc_buffer_copy_bytes (&buf, packet_prefix, sizeof (packet_prefix) - 1);
++    alloc_buffer_copy_bytes (&buf, &hdr, hdrlen);
++    alloc_buffer_copy_bytes (&buf, rdata, rdatalen);
++    packetlen = sizeof (packet) - alloc_buffer_size (&buf);
++  }
++
++  /* Parse the record.   */
++  ns_msg msg;
++  TEST_COMPARE (ns_initparse (packet, packetlen, &msg), 0);
++  ns_rr rr;
++  TEST_COMPARE (ns_parserr (&msg, ns_s_an, 0, &rr), 0);
++
++  /* Try sizes up to this limit.  Go a bit beyond the expected size to
++     check for errors.  */
++  size_t max_result_size = strlen (expected) + 16;
++
++  bool success = false;
++  for (size_t result_size = 1; result_size <= max_result_size; ++result_size)
++    {
++      char *result_start = ntf_out.buffer + ntf_out.length - result_size;
++      memset (result_start, 'X', result_size);
++
++      /* ns_sprintrr was deprecated in 2.34.  */
++      DIAG_PUSH_NEEDS_COMMENT;
++      DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wdeprecated-declarations");
++      int ret = ns_sprintrr (&msg, &rr, NULL, NULL, result_start, result_size);
++      DIAG_POP_NEEDS_COMMENT;
++
++      if (ret > 0)
++        {
++          TEST_COMPARE_STRING (result_start, expected);
++          TEST_COMPARE (ret, strlen (expected));
++          success = true;
++        }
++      else
++        {
++          TEST_VERIFY (!success);
++          TEST_COMPARE (ret, -1);
++        }
++    }
++  TEST_VERIFY (success);
++
++  /* Test with truncated RDATA.   */
++  for (size_t rdata_size = 0; rdata_size <= rdatalen; ++rdata_size)
++    {
++      size_t truncated_packet_size = packetlen - rdatalen + rdata_size;
++      unsigned char *packet_start
++        = ((unsigned char *) ntf_in.buffer + ntf_in.length
++           - truncated_packet_size);
++      memcpy (packet_start, packet, truncated_packet_size);
++      /* Patch in the updated RDATA length field.  */
++      uint16_t new_rdatalen = htons (rdata_size);
++      memcpy (packet_start + truncated_packet_size - rdata_size - 2,
++              &new_rdatalen, 2);
++
++      ns_msg msg;
++      TEST_COMPARE (ns_initparse (packet_start, truncated_packet_size, &msg),
++                    0);
++      ns_rr rr;
++      TEST_COMPARE (ns_parserr (&msg, ns_s_an, 0, &rr), 0);
++
++      size_t result_size = strlen (expected) + 1;
++      char *result_start = ntf_out.buffer + ntf_out.length - result_size;
++      memset (result_start, 'X', result_size);
++
++      /* ns_sprintrr was deprecated in 2.34.  */
++      DIAG_PUSH_NEEDS_COMMENT;
++      DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wdeprecated-declarations");
++      int ret = ns_sprintrr (&msg, &rr, NULL, NULL, result_start, result_size);
++      DIAG_POP_NEEDS_COMMENT;
++
++      /* This flag indicates whether the output is syntactically
++         correct.  In some cases, truncation may still yield a valid
++         payload.  */
++      bool broken = rdata_size < rdatalen;
++      switch (rtype)
++        {
++        case ns_t_wks:
++          /* WKS records use all trailing bytes for the port bitmap.  */
++          broken = rdata_size < 5;
++          break;
++        case ns_t_nsap:
++          /* Uses all bytes that are available.  */
++          broken = false;
++          break;
++        case ns_t_txt:
++          /* Truncation produces a valid payload if it occurs right
++             after a complete string in the TXT payload.  */
++          broken = false;
++          for (size_t pos = 0; pos < rdata_size; )
++            {
++              unsigned int slen = rdata[pos] & 0xff;
++              if (pos + 1 + slen > rdata_size)
++                {
++                  broken = true;
++                  break;
++                }
++              pos += 1 + slen;
++            }
++          break;
++        case ns_t_isdn:
++          /* The second field is optional.  If it is present, it must
++             not be truncated.  */
++          broken = rdata_size < 6 || (rdata_size > 6 && rdata_size < rdatalen);
++          break;
++        case ns_t_a6:
++          /* The first A6 subtest contains a trailing domain name,
++             which is ignored and not formatted.  */
++          if (rdata_size > 0 && rdata[0] == 0)
++            broken = rdata_size < 17;
++          break;
++        case ns_t_cert:
++        case ns_t_tkey:
++        case ns_t_tsig:
++          /* Only generic printing, which does not validate anything.  */
++          broken = false;
++          break;
++        }
++
++      if (broken)
++        {
++          if (strstr (result_start, "RR format error") != NULL)
++            /* No further checks if an error indicator has been added
++               to the output.  */
++            ;
++          else
++            TEST_COMPARE (ret, -1);
++        }
++      else
++        TEST_VERIFY (ret > 0);
++    }
++}
++
++static int
++do_test (void)
++{
++  ntf_in = support_next_to_fault_allocate (512);
++  ntf_out = support_next_to_fault_allocate (256);
++
++#define T(rtype, rdata, expected) \
++  test_one_record (rtype, rdata, sizeof (rdata) - 1, expected)
++  T (ns_t_a, "\xc0\0\2\1", "www.example.org.\t1D IN A\t\t192.0.2.1");
++  T (ns_t_cname, "\4www1\4prod\xc0\x10",
++     "www.example.org.\t1D IN CNAME\twww1.prod.example.org.");
++  T (ns_t_hinfo, "\5first\6second",
++     "www.example.org.\t1D IN HINFO\t\"first\" \"second\"");
++  T (ns_t_isdn, "\5first\6second",
++     "www.example.org.\t1D IN ISDN\t\"first\" \"second\"");
++  /* Bug: Extra space at the end in the text representation of ISDN RRs.  */
++  T (ns_t_isdn, "\5first", "www.example.org.\t1D IN ISDN\t\"first\" ");
++  T (ns_t_soa,
++     "\2ns\xc0\x10\12hostmaster\xc0\x10"
++     "\0\0\0\1\0\0\0\2\0\0\0\3\0\0\0\4\0\0\0\5",
++     "www.example.org.\t1D IN SOA\tns.example.org. hostmaster.example.org. (\n"
++     "\t\t\t\t\t1\t\t; serial\n"
++     "\t\t\t\t\t2S\t\t; refresh\n"
++     "\t\t\t\t\t3S\t\t; retry\n"
++     "\t\t\t\t\t4S\t\t; expiry\n"
++     "\t\t\t\t\t5S )\t\t; minimum\n");
++  T (ns_t_mx, "\0\xa\2mx\xc0\x10",
++     "www.example.org.\t1D IN MX\t10 mx.example.org.");
++  T (ns_t_px, "\0\xa\3px1\xc0\x10\3px2\xc0\x10",
++     "www.example.org.\t1D IN PX\t10 px1.example.org. px2.example.org.");
++  T (ns_t_x25, "\4X.25",
++     "www.example.org.\t1D IN X25\t\"X.25\"");
++  T (ns_t_txt, "\1A\2BC\3DEF",
++     "www.example.org.\t1D IN TXT\t\"A\" \"BC\" \"DEF\"");
++  T (ns_t_nsap, "",
++     "www.example.org.\t1D IN NSAP\t");
++  T (ns_t_nsap, "\1",
++     "www.example.org.\t1D IN NSAP\t01");
++  T (ns_t_nsap, "\1\2",
++     "www.example.org.\t1D IN NSAP\t01.02");
++  T (ns_t_nsap, "\1\2\3",
++     "www.example.org.\t1D IN NSAP\t01.0203");
++  T (ns_t_nsap, "\1\2\3\4",
++     "www.example.org.\t1D IN NSAP\t01.0203.04");
++  T (ns_t_nsap,
++     "\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20\21\22\23\24\25\26\27\30\31\32"
++     "\33\34\35\36\37\40\41\42\43\44\45\46\47\50\51\52\53\54\55\56\57\60\61"
++     "\62\63\64\65\66\67\70\71\72\73\74\75\76\77\100\101\102\103\104\105\106"
++     "\107\110\111\112\113\114\115\116\117\120\121\122\123\124\125\126\127"
++     "\130\131\132\133\134\135\136\137\140\141\142\143\144\145\146\147\150"
++     "\151\152\153\154\155\156\157\160\161\162\163\164\165\166\167\170\171"
++     "\172\173\174\175\176\177\200\201\202\203\204\205\206\207\210\211\212"
++     "\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233"
++     "\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254"
++     "\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275"
++     "\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316"
++     "\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337"
++     "\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360"
++     "\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377",
++     "www.example.org.\t1D IN NSAP\t"
++     "01.0203.0405.0607.0809.0A0B.0C0D.0E0F.1011.1213.1415.1617.1819.1A1B"
++     ".1C1D.1E1F.2021.2223.2425.2627.2829.2A2B.2C2D.2E2F.3031.3233.3435.3637"
++     ".3839.3A3B.3C3D.3E3F.4041.4243.4445.4647.4849.4A4B.4C4D.4E4F.5051.5253"
++     ".5455.5657.5859.5A5B.5C5D.5E5F.6061.6263.6465.6667.6869.6A6B.6C6D.6E6F"
++     ".7071.7273.7475.7677.7879.7A7B.7C7D.7E7F.8081.8283.8485.8687.8889.8A8B"
++     ".8C8D.8E8F.9091.9293.9495.9697.9899.9A9B.9C9D.9E9F.A0A1.A2A3.A4A5.A6A7"
++     ".A8A9.AAAB.ACAD.AEAF.B0B1.B2B3.B4B5.B6B7.B8B9.BABB.BCBD.BEBF.C0C1.C2C3"
++     ".C4C5.C6C7.C8C9.CACB.CCCD.CECF.D0D1.D2D3.D4D5.D6D7.D8D9.DADB.DCDD.DEDF"
++     ".E0E1.E2E3.E4E5.E6E7.E8E9.EAEB.ECED.EEEF.F0F1.F2F3.F4F5.F6F7.F8F9.FAFB"
++     ".FCFD.FEFF");
++  T (ns_t_aaaa, "\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x34",
++     "www.example.org.\t1D IN AAAA\t2001:db8::1234");
++  /* Example from RFC 1876.  The loc_ntoa format is different from the
++     official text representation.  */
++  T (ns_t_loc,
++     "\000\063\026\023\211\027\055\320\160\276\025\360\000\230\215\040",
++     "www.example.org.\t1D IN LOC"
++     "\t42 21 54.000 N 71 06 18.000 W -24.00m 30.00m 10000.00m 10.00m");
++  T (ns_t_naptr,
++     "\0\1\0\2\5flags\7service\2.*\5naptr\xc0\x10",
++     "www.example.org.\t1D IN NAPTR\t1 2 \"flags\" \"service\" \".*\""
++     " naptr.example.org.");
++  T (ns_t_srv,
++     "\0\1\0\2\0\x50\4www1\xc0\x10",
++     "www.example.org.\t1D IN SRV\t1 2 80 www1.example.org.");
++  T (ns_t_rp, "\3rp1\xc0\x10\3rp2\xc0\x10",
++     "www.example.org.\t1D IN RP\trp1.example.org. rp2.example.org.");
++  T (ns_t_wks, "\xc0\0\2\1\6\0\0\0\0\0\0\0\0\0\0\200",
++     "www.example.org.\t1D IN WKS\t192.0.2.1 6 ( \n\t\t\t\t80 )");
++  T (ns_t_cert, "\0\1\x04\xd2\0blob",
++     "www.example.org.\t1D IN CERT\t\\# 9 (\n"
++     "\t00 01 04 d2 00 62 6c 6f 62 )\t\t\t; .....blob");
++  T (ns_t_tkey, "\4algo\0\0\0\0\1\0\0\0\2\0\3\0\4"
++     "\0\5\xa1\xa2\xa3\xa4\xa5\0\3\xb1\xb2\xb3",
++     "www.example.org.\t1D IN TYPE249\t\\# 30 (\n"
++     "\t04 61 6c 67 6f 00 00 00 00 01 00 00 00 02 00 03 ; .algo...........\n"
++     "\t00 04 00 05 a1 a2 a3 a4 a5 00 03 b1 b2 b3 )\t; ..............");
++  T (ns_t_tsig, "\4algo\0"
++     "\0\20\xdd\xcd\x64\x10\xe9\x21\x34\x1a\x8e\xe0\xa1\x9a\x30\xfc\x3b\xd1"
++     "\0\2\0\3\0\5other",
++     "www.example.org.\t1D IN TSIG\t\\# 35 (\n"
++     "\t04 61 6c 67 6f 00 00 10 dd cd 64 10 e9 21 34 1a ; .algo.....d..!4.\n"
++     "\t8e e0 a1 9a 30 fc 3b d1 00 02 00 03 00 05 6f 74 ; ....0.;.......ot\n"
++     "\t68 65 72 )\t\t\t\t\t; her");
++  T (ns_t_a6,
++     "\0\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x34\6prefix\xc0\x10",
++     "www.example.org.\t1D IN A6\t0 2001:db8::1234");
++  T (ns_t_a6,
++     "\0\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x35",
++     "www.example.org.\t1D IN A6\t0 2001:db8::1235");
++  T (ns_t_a6, "\200\6prefix\xc0\x10",
++     "www.example.org.\t1D IN A6\t128  prefix.example.org.");
++  T (ns_t_a6, "\x20\0\0\0\0\0\0\0\0\0\0\x12\x36\6prefix\xc0\x10",
++     "www.example.org.\t1D IN A6\t32 ::1236 prefix.example.org.");
++#undef T
++
++  support_next_to_fault_free (&ntf_in);
++  support_next_to_fault_free (&ntf_out);
++  return 0;
++}
++
++#include <support/test-driver.c>
+
+commit 7414631f8aec8b9cee1a8311506e1fdcd9b94c0d
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Tue Apr 14 10:50:37 2026 -0300
+
+    posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)
+    
+    The parse_tilde function previously used strndupa to allocate memory
+    for the parsed username on the stack, and since the input is
+    user-defined, this can lead to a stack overflow.
+    
+    This patch fixes the issue by replacing strndupa with scratch_buffer,
+    by reusing the buffer used in the __getpwnam_r call.
+    
+    The new “tst-wordexp-tilde.c” test is a test-container to avoid using
+    system-defined NSS modules.
+    
+    Checked on x86_64-linux-gnu and i686-linux-gnu.
+    
+    (cherry picked from commit 07c24f35392b727e6100d33edfdf811a6c68c218)
+
+diff --git a/posix/Makefile b/posix/Makefile
+index 0b29c9aa4e..595c6b3ec2 100644
+--- a/posix/Makefile
++++ b/posix/Makefile
+@@ -356,6 +356,7 @@ tests-internal := \
+ tests-container := \
+   bug-ga2 \
+   tst-vfork3 \
++  tst-wordexp-tilde \
+   # tests-container
+ 
+ tests-time64 := \
+diff --git a/posix/tst-wordexp-tilde.c b/posix/tst-wordexp-tilde.c
+new file mode 100644
+index 0000000000..1661603681
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.c
+@@ -0,0 +1,244 @@
++/* Test wordexp tilde expansion with large usernames (BZ 34091).
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <pwd.h>
++#include <stdio.h>
++#include <string.h>
++#include <wordexp.h>
++#include <stdlib.h>
++#include <sys/resource.h>
++
++#include <support/check.h>
++#include <support/support.h>
++#include <support/xunistd.h>
++#include <support/namespace.h>
++
++typedef void (*func_callback_t)(void);
++
++static void
++subprocess_small_stack (void *closure)
++{
++  struct rlimit rl;
++  TEST_COMPARE (getrlimit (RLIMIT_STACK, &rl), 0);
++  rl.rlim_cur = 512 * 1024;
++  TEST_COMPARE (setrlimit (RLIMIT_STACK, &rl), 0);
++
++  func_callback_t func_test = closure;
++  func_test ();
++}
++
++/* Build a string "~<padding>/tail" where <padding> is LEN bytes of the
++   character CH.  The caller must free the result.  */
++static char *
++make_tilde_input (char ch, size_t len, const char *tail)
++{
++  /* ~  +  len  +  /  +  tail  +  \0 */
++  size_t taillen = tail != NULL ? strlen (tail) : 0;
++  size_t total = 1 + len + 1 + taillen + 1;
++  char *buf = xmalloc (total);
++  buf[0] = '~';
++  memset (buf + 1, ch, len);
++  buf[1 + len] = '/';
++  if (tail != NULL)
++    memcpy (buf + 1 + len + 1, tail, taillen);
++  buf[total - 1] = '\0';
++  return buf;
++}
++
++/* Test 1: A very long username must not crash.  The username will not match
++   any real user, so wordexp returns ~<long>/rest.  */
++static void
++test_long_username (void)
++{
++  printf ("info: test_long_username_no_crash\n");
++
++  static const char REST[] = "rest";
++
++  /* 1 MiB username — well beyond any reasonable stack frame.  */
++  const size_t long_len = 1024 * 1024;
++  char *input = make_tilde_input ('A', long_len, REST);
++
++  wordexp_t we = { 0 };
++  int ret = wordexp (input, &we, 0);
++  /* The (non-existent) username is invalid, so wordexp falls back to
++     literal output: ~AAA…/rest.  */
++  TEST_COMPARE (ret, 0);
++  TEST_COMPARE (we.we_wordc, 1);
++
++  /* Verify prefix: '~' followed by long_len 'A's.  */
++  const char *result = we.we_wordv[0];
++  TEST_COMPARE (result[0], '~');
++  TEST_COMPARE (strlen (result),
++	        1 /* ~ */ + long_len + sizeof (REST));
++  for (size_t j = 1; j <= long_len; j++)
++    if (result[j] != 'A')
++      {
++	printf ("  mismatch at position %zu: expected 'A', got '%c'\n",
++		j, result[j]);
++	support_record_failure ();
++	break;
++      }
++  /* Verify the tail after the username.  */
++  TEST_COMPARE_STRING (result + 1 + long_len, "/rest");
++
++  wordfree (&we);
++  free (input);
++}
++
++/* Test 2: A username that just exceeds the default scratch_buffer inline
++   size (1024 bytes) exercises the scratch_buffer_set_array_size growth path
++   without being excessively large.  */
++static void
++test_scratch_buffer_growth (void)
++{
++  printf ("info: test_scratch_buffer_growth\n");
++
++  const size_t len = 2048;
++  char *input = make_tilde_input ('x', len, NULL);
++
++  wordexp_t we = { 0 };
++  int ret = wordexp (input, &we, 0);
++  TEST_COMPARE (ret, 0);
++  TEST_COMPARE (we.we_wordc, 1);
++
++  /* ~xxx…/ — the trailing slash makes a separate empty component, but
++     wordexp merges it into the single token ~xxx…/.  */
++  const char *result = we.we_wordv[0];
++  TEST_COMPARE (result[0], '~');
++  for (size_t j = 1; j <= len; j++)
++    if (result[j] != 'x')
++      {
++	printf ("  mismatch at position %zu\n", j);
++	support_record_failure ();
++	break;
++      }
++  TEST_COMPARE (result[1 + len], '/');
++
++  wordfree (&we);
++  free (input);
++}
++
++/* Test 3: ~root still resolves to the correct home directory through the
++   __getpwnam_r path.  */
++static void
++test_known_user (void)
++{
++  printf ("info: test_known_user\n");
++
++  /* Look up root's home directory for comparison.  */
++  struct passwd *pw = getpwnam ("root");
++  if (pw == NULL || pw->pw_dir == NULL)
++    {
++      printf ("  SKIP: cannot look up root\n");
++      return;
++    }
++
++  char *expected = xasprintf ("%s/file", pw->pw_dir);
++
++  wordexp_t we = { 0 };
++  TEST_COMPARE (wordexp ("~root/file", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 1);
++  TEST_COMPARE_STRING (we.we_wordv[0], expected);
++
++  wordfree (&we);
++  free (expected);
++}
++
++/* Test 4: Bare tilde expands to $HOME.  */
++static void
++test_bare_tilde (void)
++{
++  printf ("info: test_bare_tilde\n");
++
++  const char *home = getenv ("HOME");
++  if (home == NULL)
++    {
++      printf ("  SKIP: HOME is not set\n");
++      return;
++    }
++
++  wordexp_t we = { 0 };
++  TEST_COMPARE (wordexp ("~", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 1);
++  TEST_COMPARE_STRING (we.we_wordv[0], home);
++
++  wordfree (&we);
++}
++
++/* Test 5: Short non-existent username falls back to literal ~username output,
++   exercising the invalid-login-name path.  */
++static void
++test_unknown_user (void)
++{
++  printf ("info: test_unknown_user\n");
++
++  /* Pick a username that is extremely unlikely to exist.  */
++  wordexp_t we = { 0 };
++  TEST_COMPARE (wordexp ("~no_such_user_xyzzy42", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 1);
++  TEST_COMPARE_STRING (we.we_wordv[0], "~no_such_user_xyzzy42");
++
++  wordfree (&we);
++}
++
++/* Test 6: Tilde with username and WRDE_APPEND — exercises parse_tilde's
++   interaction with the WRDE_APPEND word list.  */
++static void
++test_tilde_with_append (void)
++{
++  printf ("info: test_tilde_with_append\n");
++
++  const char *home = getenv ("HOME");
++  if (home == NULL)
++    {
++      printf ("  SKIP: HOME is not set\n");
++      return;
++    }
++
++  wordexp_t we = { 0 };
++  TEST_COMPARE (wordexp ("first", &we, 0), 0);
++
++  TEST_COMPARE (wordexp ("~/path", &we, WRDE_APPEND), 0);
++  TEST_COMPARE (we.we_wordc, 2);
++  TEST_COMPARE_STRING (we.we_wordv[0], "first");
++
++  char *expected = xasprintf ("%s/path", home);
++  TEST_COMPARE_STRING (we.we_wordv[1], expected);
++
++  wordfree (&we);
++  free (expected);
++}
++
++static int
++do_test (void)
++{
++  test_known_user ();
++  test_bare_tilde ();
++  test_unknown_user ();
++  test_tilde_with_append ();
++
++  support_isolate_in_subprocess (subprocess_small_stack,
++				 test_long_username);
++
++  support_isolate_in_subprocess (subprocess_small_stack,
++				 test_scratch_buffer_growth);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/posix/tst-wordexp-tilde.root/etc/group b/posix/tst-wordexp-tilde.root/etc/group
+new file mode 100644
+index 0000000000..1dbf9013ee
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/group
+@@ -0,0 +1 @@
++root:x:0:
+diff --git a/posix/tst-wordexp-tilde.root/etc/nsswitch.conf b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf
+new file mode 100644
+index 0000000000..098a8d5938
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf
+@@ -0,0 +1,3 @@
++passwd: files
++group:  files
++shadow: files
+diff --git a/posix/tst-wordexp-tilde.root/etc/passwd b/posix/tst-wordexp-tilde.root/etc/passwd
+new file mode 100644
+index 0000000000..eb85a552ad
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/passwd
+@@ -0,0 +1 @@
++root:x:0:0:root:/root:/bin/sh
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index 9df4bb7424..731d1650e9 100644
+--- a/posix/wordexp.c
++++ b/posix/wordexp.c
+@@ -335,17 +335,29 @@ parse_tilde (char **word, size_t *word_length, size_t *max_length,
+   else
+     {
+       /* Look up user name in database to get home directory */
+-      char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
+-      struct passwd pwd, *tpwd;
+-      int result;
++      size_t userlen = i - (1 + *offset);
++      /* tmpbuf contains both the user and the __getpwnam_r working area.  */
+       struct scratch_buffer tmpbuf;
+       scratch_buffer_init (&tmpbuf);
++      if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))
++	return WRDE_NOSPACE;
++      char *user = tmpbuf.data;
++      memcpy (user, &words[1 + *offset], userlen);
++      user[userlen] = '\0';
+ 
+-      while ((result = __getpwnam_r (user, &pwd, tmpbuf.data, tmpbuf.length,
++      struct passwd pwd, *tpwd;
++      int result;
++      while ((result = __getpwnam_r (user,
++				     &pwd,
++				     tmpbuf.data + userlen + 1,
++				     tmpbuf.length - userlen - 1,
+ 				     &tpwd)) != 0
+ 	     && errno == ERANGE)
+-	if (!scratch_buffer_grow (&tmpbuf))
+-	  return WRDE_NOSPACE;
++	{
++	  if (!scratch_buffer_grow_preserve (&tmpbuf))
++	    return WRDE_NOSPACE;
++	  user = tmpbuf.data;
++	}
+ 
+       if (result == 0 && tpwd != NULL && pwd.pw_dir)
+ 	*word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
+
+commit 8be3551ccb4e17e93ad82152de56d2c90de21f97
+Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date:   Mon Apr 13 16:33:30 2026 -0300
+
+    posix: Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368)
+    
+    The previous implementation saved a copy of the wordexp_t struct at
+    entry and blindly restored it on error via (*pwordexp = old_word).
+    This is incorrect when WRDE_APPEND is set because w_addword may have
+    called realloc on we_wordv during partial processing before the error
+    was detected.  If realloc relocated the buffer, the saved we_wordv
+    pointer is dangling; restoring it causes a use-after-free in the
+    caller (e.g. via wordfree), and the relocated buffer is leaked.
+    
+    Fix this by duplicating the we_wordv pointer array at entry when
+    WRDE_APPEND is set, so that all subsequent realloc calls inside
+    w_addword operate on the copy.
+    
+    This change also fixes a POSIX conformance issue: if the WRDE_APPEND
+    flag is specified, pwordexp->we_wordc and pwordexp->we_wordv shall
+    not be modified.
+    
+    Also fix two pre-existing error return paths in the '"' and '\'' cases
+    that returned directly from w_addword failures instead of going through
+    do_error, which would leak the saved array (and previously would also
+    skip the word cleanup).
+    
+    Checked on x86_64-linux-gnu and i686-linux-gnu.
+    
+    Reviewed-by: DJ Delorie <dj@redhat.com>
+    (cherry picked from commit e2cefe16c37a617df9f11407cb00a272a6098823)
+
+diff --git a/posix/Makefile b/posix/Makefile
+index 595c6b3ec2..a12c49c0ed 100644
+--- a/posix/Makefile
++++ b/posix/Makefile
+@@ -326,6 +326,7 @@ tests := \
+   tst-wait3 \
+   tst-wait4 \
+   tst-waitid \
++  tst-wordexp-append \
+   tst-wordexp-nocmd \
+   tst-wordexp-reuse \
+   tstgetopt \
+diff --git a/posix/tst-wordexp-append.c b/posix/tst-wordexp-append.c
+new file mode 100644
+index 0000000000..87f388f0a7
+--- /dev/null
++++ b/posix/tst-wordexp-append.c
+@@ -0,0 +1,393 @@
++/* Test for wordexp with WRDE_APPEND flag.
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <wordexp.h>
++#include <string.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <malloc.h>
++
++#include <support/check.h>
++#include <support/support.h>
++
++static unsigned int relocating_reallocs;
++
++/* w_addword grows we_wordv with realloc, make every call guaranteed to
++   relocate the block.  This makes BZ 34090 regression more deterministic.  */
++void *
++realloc (void *ptr, size_t size)
++{
++  if (ptr == NULL)
++    return malloc (size);
++  if (size == 0)
++    {
++      free (ptr);
++      return NULL;
++    }
++
++  void *new = malloc (size);
++  if (new == NULL)
++    return NULL;
++
++  /* Copy only what is valid in the old block to avoid reading past it.  */
++  size_t old = malloc_usable_size (ptr);
++  memcpy (new, ptr, old < size ? old : size);
++  /* Clobber the old block so that a stale we_wordv pointer restored on the
++     error path reads garbage instead of the old contents, which might
++     otherwise survive intact and mask the bug.  */
++  memset (ptr, 0x5a, old);
++  free (ptr);
++  relocating_reallocs++;
++  return new;
++}
++
++/* Verify that all words in we match the expected NULL-terminated
++   array.  */
++static void
++check_words (const wordexp_t *we, const char *const *expected)
++{
++  size_t i;
++  for (i = 0; expected[i] != NULL; i++)
++    {
++      TEST_VERIFY (i < we->we_wordc);
++      TEST_COMPARE_STRING (we->we_wordv[we->we_offs + i], expected[i]);
++    }
++  TEST_COMPARE (we->we_wordc, i);
++}
++
++#define CHECK_WORDS(we, ...) \
++  do {								\
++    const char *const expected_[] = { __VA_ARGS__, NULL };	\
++    check_words (we, expected_);				\
++  } while (0)
++
++/* Test 1: WRDE_APPEND + WRDE_BADCHAR preserves we_wordc.  */
++static void
++test_append_badchar_preserves_count (void)
++{
++  printf ("info: test_append_badchar_preserves_count\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("one two three", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 3);
++
++  size_t saved_count = we.we_wordc;
++
++  /* ')' triggers WRDE_BADCHAR and  "extra" would be a new word if the
++     expansion succeeded, exercising the w_addword path before the error
++     is detected.  */
++  TEST_COMPARE (wordexp ("extra )", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (we.we_wordc, saved_count);
++
++  wordfree (&we);
++}
++
++/* Test 2: WRDE_APPEND + WRDE_BADCHAR preserves the we_wordv pointer even
++   when internal realloc would move the buffer.  */
++static void
++test_append_badchar_preserves_pointer (void)
++{
++  printf ("info: test_append_badchar_preserves_pointer\n");
++  wordexp_t we = { 0 };
++
++  /* Use many words so that the initial we_wordv allocation is
++     non-trivial and a later realloc is more likely to move it.  */
++  TEST_COMPARE (wordexp ("a b c d e f g h", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 8);
++
++  char **saved_wordv = we.we_wordv;
++  size_t saved_count = we.we_wordc;
++  unsigned int saved_reallocs = relocating_reallocs;
++
++  /* The interposed realloc guarantees the internal we_wordv buffer moves
++     during parsing, so the pointer-stability check below is meaningful.  */
++  TEST_COMPARE (wordexp ("append )", &we, WRDE_APPEND), WRDE_BADCHAR);
++  /* Verify that a relocating realloc actually happened during the failed
++     call, otherwise the pointer-stability check is vacuous.  */
++  TEST_VERIFY (relocating_reallocs > saved_reallocs);
++  TEST_COMPARE (we.we_wordc, saved_count);
++  TEST_VERIFY (we.we_wordv == saved_wordv);
++
++  wordfree (&we);
++}
++
++/* Test 3: After a failed WRDE_APPEND the original words are still accessible
++   and correct.  */
++static void
++test_append_badchar_words_intact (void)
++{
++  printf ("info: test_append_badchar_words_intact\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("alpha beta gamma", &we, 0), 0);
++  CHECK_WORDS (&we, "alpha", "beta", "gamma");
++
++  TEST_COMPARE (wordexp ("delta )", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++  /* Words must still be intact.  */
++  CHECK_WORDS (&we, "alpha", "beta", "gamma");
++  /* The NULL terminator must still be present.  */
++  TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++  wordfree (&we);
++}
++
++/* Test 4: Successful WRDE_APPEND still works (regression test).  */
++static void
++test_append_success (void)
++{
++  printf ("info: test_append_success\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("hello", &we, 0), 0);
++  TEST_COMPARE (we.we_wordc, 1);
++
++  char **saved_wordv = we.we_wordv;
++
++  TEST_COMPARE (wordexp ("world", &we, WRDE_APPEND), 0);
++  TEST_COMPARE (we.we_wordc, 2);
++  /* A successful append works on a fresh copy of the array, so the
++     caller-visible pointer must have changed.  */
++  TEST_VERIFY (we.we_wordv != saved_wordv);
++  CHECK_WORDS (&we, "hello", "world");
++
++  wordfree (&we);
++}
++
++/* Test 5: Successful append after a failed append — the implementation must
++   recover and allow further use of the wordexp_t.  */
++static void
++test_append_success_after_failure (void)
++{
++  printf ("info: test_append_success_after_failure\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("first", &we, 0), 0);
++  CHECK_WORDS (&we, "first");
++
++  TEST_COMPARE (wordexp ("bad |", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++  /* State must be exactly as before the failed call.  */
++  CHECK_WORDS (&we, "first");
++
++  /* A subsequent successful append must work.  */
++  TEST_COMPARE (wordexp ("second third", &we, WRDE_APPEND), 0);
++  CHECK_WORDS (&we, "first", "second", "third");
++
++  wordfree (&we);
++}
++
++/* Test 6: Multiple consecutive failed appends do not corrupt state.  */
++static void
++test_append_multiple_failures (void)
++{
++  printf ("info: test_append_multiple_failures\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("keep this", &we, 0), 0);
++  CHECK_WORDS (&we, "keep", "this");
++
++  size_t saved_count = we.we_wordc;
++  char **saved_wordv = we.we_wordv;
++
++  /* Each of these bad characters must leave the state unchanged.  */
++  TEST_COMPARE (wordexp ("x )", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (wordexp ("x |", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (wordexp ("x ;", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (wordexp ("x &", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (wordexp ("x <", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (wordexp ("x >", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++  TEST_COMPARE (we.we_wordc, saved_count);
++  TEST_VERIFY (we.we_wordv == saved_wordv);
++  CHECK_WORDS (&we, "keep", "this");
++
++  wordfree (&we);
++}
++
++/* Test 7: WRDE_APPEND with WRDE_SYNTAX error (unterminated quote) also
++   preserves state.  */
++static void
++test_append_syntax_error (void)
++{
++  printf ("info: test_append_syntax_error\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("original", &we, 0), 0);
++  CHECK_WORDS (&we, "original");
++
++  char **saved_wordv = we.we_wordv;
++  size_t saved_count = we.we_wordc;
++
++  /* Unterminated double quote triggers WRDE_SYNTAX.  */
++  TEST_COMPARE (wordexp ("\"unterminated", &we, WRDE_APPEND), WRDE_SYNTAX);
++
++  TEST_COMPARE (we.we_wordc, saved_count);
++  TEST_VERIFY (we.we_wordv == saved_wordv);
++  CHECK_WORDS (&we, "original");
++
++  wordfree (&we);
++}
++
++/* Test 8: Error without WRDE_APPEND still works (regression test for the
++   non-APPEND code path in do_error).  */
++static void
++test_no_append_error (void)
++{
++  printf ("info: test_no_append_error\n");
++  wordexp_t we = { 0 };
++
++  /* Simple failure without WRDE_APPEND.  */
++  TEST_COMPARE (wordexp ("bad |", &we, 0), WRDE_BADCHAR);
++
++  /* After failure without WRDE_APPEND the struct should be safe to
++     reuse — start fresh.  */
++  TEST_COMPARE (wordexp ("ok", &we, 0), 0);
++  CHECK_WORDS (&we, "ok");
++
++  wordfree (&we);
++}
++
++/* Test 9: WRDE_BADCHAR on the very first character (no partial words added
++   before the error).  */
++static void
++test_append_badchar_immediate (void)
++{
++  printf ("info: test_append_badchar_immediate\n");
++  wordexp_t we = { 0 };
++
++  TEST_COMPARE (wordexp ("hello world", &we, 0), 0);
++  CHECK_WORDS (&we, "hello", "world");
++
++  char **saved_wordv = we.we_wordv;
++  size_t saved_count = we.we_wordc;
++
++  /* The bad character is the very first byte — no w_addword call happens
++     before the error.  */
++  TEST_COMPARE (wordexp ("|", &we, WRDE_APPEND), WRDE_BADCHAR);
++  TEST_COMPARE (we.we_wordc, saved_count);
++  TEST_VERIFY (we.we_wordv == saved_wordv);
++
++  wordfree (&we);
++}
++
++/* Test 10: WRDE_APPEND into an empty wordexp_t (initial call uses WRDE_APPEND
++   with a zeroed struct — unusual but allowed).  */
++static void
++test_append_into_empty (void)
++{
++  printf ("info: test_append_into_empty\n");
++  wordexp_t we = { 0 };
++
++  /* First call with WRDE_APPEND on a zeroed struct.  The implementation
++     must handle we_wordv == NULL gracefully.  */
++  TEST_COMPARE (wordexp ("solo", &we, WRDE_APPEND), 0);
++  TEST_COMPARE (we.we_wordc, 1);
++  CHECK_WORDS (&we, "solo");
++
++  wordfree (&we);
++}
++
++/* Verify that the leading we_offs slots are all NULL.  */
++static void
++check_offs_null (const wordexp_t *we)
++{
++  for (size_t i = 0; i < we->we_offs; i++)
++    TEST_VERIFY (we->we_wordv[i] == NULL);
++}
++
++/* Test 11: successful WRDE_APPEND with WRDE_DOOFFS and a non-zero we_offs.
++   The leading offset slots must stay NULL and words must land at
++   we_wordv[we_offs + i] across both the initial and the appended call.  */
++static void
++test_dooffs_append_success (void)
++{
++  printf ("info: test_dooffs_append_success\n");
++  wordexp_t we = { 0 };
++  we.we_offs = 2;
++
++  TEST_COMPARE (wordexp ("one two", &we, WRDE_DOOFFS), 0);
++  TEST_COMPARE (we.we_offs, 2);
++  check_offs_null (&we);
++  CHECK_WORDS (&we, "one", "two");
++
++  TEST_COMPARE (wordexp ("three", &we, WRDE_APPEND | WRDE_DOOFFS), 0);
++  TEST_COMPARE (we.we_offs, 2);
++  check_offs_null (&we);
++  CHECK_WORDS (&we, "one", "two", "three");
++  /* The NULL terminator must sit right after the last word.  */
++  TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++  wordfree (&we);
++}
++
++/* Test 12: failed WRDE_APPEND with WRDE_DOOFFS preserves we_wordc, the
++   we_wordv pointer, the words and the leading NULL offset slots.  This
++   exercises the we_offs arithmetic in the array duplication and in the
++   error-path cleanup (we_wordv[we_offs + --we_wordc]).  */
++static void
++test_dooffs_append_error_preserves_state (void)
++{
++  printf ("info: test_dooffs_append_error_preserves_state\n");
++  wordexp_t we = { 0 };
++  we.we_offs = 3;
++
++  TEST_COMPARE (wordexp ("alpha beta", &we, WRDE_DOOFFS), 0);
++  check_offs_null (&we);
++  CHECK_WORDS (&we, "alpha", "beta");
++
++  char **saved_wordv = we.we_wordv;
++  size_t saved_count = we.we_wordc;
++  unsigned int saved_reallocs = relocating_reallocs;
++
++  /* "gamma" is a partial word added via w_addword (forcing a relocating
++     realloc of we_wordv) before ')' triggers WRDE_BADCHAR.  */
++  TEST_COMPARE (wordexp ("gamma )", &we, WRDE_APPEND | WRDE_DOOFFS),
++		WRDE_BADCHAR);
++  TEST_VERIFY (relocating_reallocs > saved_reallocs);
++
++  TEST_COMPARE (we.we_offs, 3);
++  TEST_COMPARE (we.we_wordc, saved_count);
++  TEST_VERIFY (we.we_wordv == saved_wordv);
++  check_offs_null (&we);
++  CHECK_WORDS (&we, "alpha", "beta");
++  TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++  wordfree (&we);
++}
++
++static int
++do_test (void)
++{
++  test_append_badchar_preserves_count ();
++  test_append_badchar_preserves_pointer ();
++  test_append_badchar_words_intact ();
++  test_append_success ();
++  test_append_success_after_failure ();
++  test_append_multiple_failures ();
++  test_append_syntax_error ();
++  test_no_append_error ();
++  test_append_badchar_immediate ();
++  test_append_into_empty ();
++  test_dooffs_append_success ();
++  test_dooffs_append_error_preserves_state ();
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index 731d1650e9..50b0d7a256 100644
+--- a/posix/wordexp.c
++++ b/posix/wordexp.c
+@@ -35,6 +35,7 @@
+ #include <scratch_buffer.h>
+ #include <_itoa.h>
+ #include <assert.h>
++#include <intprops.h>
+ 
+ /*
+  * This is a recursive-descent-style word expansion routine.
+@@ -2224,6 +2225,12 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+   char ifs_white[4];
+   wordexp_t old_word = *pwordexp;
+ 
++  /* When WRDE_APPEND is set we work on a copy of the we_wordv array so that
++     the caller's original pointer is never invalidated by realloc inside
++     w_addword.  The saved_wordv keeps the original; on success we free it,
++     on non-NOSPACE error we free the working copy and restore the original.  */
++  char **saved_wordv = NULL;
++
+   if (flags & WRDE_REUSE)
+     {
+       /* Minimal implementation of WRDE_REUSE for now */
+@@ -2258,6 +2265,23 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ 	  pwordexp->we_offs = 0;
+ 	}
+     }
++  else if (pwordexp->we_wordv != NULL)
++    {
++      /* WRDE_APPEND with an existing word list: duplicate the array so that
++	 realloc during parsing does not invalidate the caller's pointer.  The
++	 strings themselves are shared.  */
++      size_t num_p;
++      char **dup;
++      if (INT_ADD_WRAPV (pwordexp->we_offs, pwordexp->we_wordc, &num_p)
++	  || INT_ADD_WRAPV (num_p, 1, &num_p))
++	return WRDE_NOSPACE;
++      dup = __libc_reallocarray (NULL, num_p, sizeof *dup);
++      if (dup == NULL)
++	return WRDE_NOSPACE;
++      memcpy (dup, pwordexp->we_wordv, num_p * sizeof *dup);
++      saved_wordv = pwordexp->we_wordv;
++      pwordexp->we_wordv = dup;
++    }
+ 
+   /* Find out what the field separators are.
+    * There are two types: whitespace and non-whitespace.
+@@ -2338,7 +2362,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ 	    error = w_addword (pwordexp, NULL);
+ 
+ 	    if (error)
+-	      return error;
++	      goto do_error;
+ 	  }
+ 
+ 	break;
+@@ -2356,7 +2380,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ 	    error = w_addword (pwordexp, NULL);
+ 
+ 	    if (error)
+-	      return error;
++	      goto do_error;
+ 	  }
+ 
+ 	break;
+@@ -2422,10 +2446,18 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ 
+   /* There was a word separator at the end */
+   if (word == NULL) /* i.e. w_newword */
+-    return 0;
++    {
++      free (saved_wordv);
++      return 0;
++    }
+ 
+-  /* There was no field separator at the end */
+-  return w_addword (pwordexp, word);
++  /* There was no field separator at the end.  The only possible error
++     from w_addword is WRDE_NOSPACE.  */
++  error = w_addword (pwordexp, word);
++  if (error != 0)
++    goto do_error;
++  free (saved_wordv);
++  return 0;
+ 
+ do_error:
+   /* Error:
+@@ -2436,11 +2468,30 @@ do_error:
+   free (word);
+ 
+   if (error == WRDE_NOSPACE)
+-    return WRDE_NOSPACE;
++    {
++      /* we_wordc and we_wordv are updated to reflect any words that were
++	 successfully expanded.  The old array is obsolete.  */
++      free (saved_wordv);
++      return WRDE_NOSPACE;
++    }
+ 
+-  if ((flags & WRDE_APPEND) == 0)
+-    wordfree (pwordexp);
++  if (flags & WRDE_APPEND)
++    {
++      /* POSIX 2024 states that for in other error cases, if the WRDE_APPEND
++	 flag was specified, we_wordc and we_wordv shall not be modified.
++
++	 Free strings appended during this call, discard the working copy of
++	 we_wordv, and restore the caller's original pointer.  */
++      while (pwordexp->we_wordc > old_word.we_wordc)
++	free (pwordexp->we_wordv[pwordexp->we_offs + --pwordexp->we_wordc]);
++      free (pwordexp->we_wordv);
++      pwordexp->we_wordv = saved_wordv;
++    }
++  else
++    {
++      wordfree (pwordexp);
++      *pwordexp = old_word;
++    }
+ 
+-  *pwordexp = old_word;
+   return error;
+ }
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 3d1fb9398dd8..1c95152d3f66 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -51,7 +51,7 @@
 
 let
   version = "2.42";
-  patchSuffix = "-67";
+  patchSuffix = "-84";
   sha256 = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8=";
 in
 
@@ -116,15 +116,6 @@ stdenv.mkDerivation (
       # enable parallel & reproducible build of glibcLocales
       ./0001-localedata-allow-reproducible-parallel-install-of-lo.patch
       ./0002-Makeconfig-make-inst_complocaledir-overridable.patch
-
-      # Security fixes.
-      #
-      # Can be dropped on 2.44. The first patch is only to make it
-      # easier to backport the fix for CVE-2026-6238 and it seems
-      # useful in its own right anyhow.
-      ./0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
-      ./0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
-      ./0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
     ]
     /*
       NVCC does not support ARM intrinsics. Since <math.h> is pulled in by almost

From 6d27518c88e9dfecc2a0474f42627f88c7170b3a Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sun, 16 Aug 2026 10:30:20 -0400
Subject: [PATCH 293/551] nix-output-monitor: allow overriding generated
 package more easily

I would find this useful for developing patches out-of-tree and using the
patched version in other packages (as this allows me to use an overlay
instead of re-defining the entire nom package).
---
 pkgs/by-name/ni/nix-output-monitor/package.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ni/nix-output-monitor/package.nix b/pkgs/by-name/ni/nix-output-monitor/package.nix
index f6f4dda17d45..2787df1ff622 100644
--- a/pkgs/by-name/ni/nix-output-monitor/package.nix
+++ b/pkgs/by-name/ni/nix-output-monitor/package.nix
@@ -3,6 +3,7 @@
   haskellPackages,
   installShellFiles,
   lib,
+  extraComposeFunctions ? [ ],
 }:
 let
   inherit (haskell.lib.compose) justStaticExecutables overrideCabal;
@@ -27,7 +28,10 @@ let
   };
   raw-pkg = haskellPackages.callPackage ./generated-package.nix { };
 in
-lib.pipe raw-pkg [
-  (overrideCabal overrides)
-  justStaticExecutables
-]
+lib.pipe raw-pkg (
+  [
+    (overrideCabal overrides)
+    justStaticExecutables
+  ]
+  ++ extraComposeFunctions
+)

From 4b38845072b859992c4d437256d0707ee957e17f Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Fri, 7 Aug 2026 19:04:33 +0200
Subject: [PATCH 294/551] rtmpdump: fix pkg-config include directory

---
 pkgs/by-name/rt/rtmpdump/package.nix | 38 ++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/rt/rtmpdump/package.nix b/pkgs/by-name/rt/rtmpdump/package.nix
index b84a0f644b31..b70006410d9c 100644
--- a/pkgs/by-name/rt/rtmpdump/package.nix
+++ b/pkgs/by-name/rt/rtmpdump/package.nix
@@ -2,6 +2,8 @@
   lib,
   stdenv,
   fetchgit,
+  testers,
+  versionCheckHook,
   zlib,
   gnutlsSupport ? false,
   gnutls,
@@ -12,7 +14,7 @@
 
 assert (gnutlsSupport || opensslSupport);
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rtmpdump";
   version = "2.6";
 
@@ -23,6 +25,18 @@ stdenv.mkDerivation {
     hash = "sha256-rwMA9eougKnkpG+fe6vZIwOBt2CC1d9qI9a079EbE5o=";
   };
 
+  postPatch = ''
+    for file in rtmp{dump.1,gw.8}{,.html} librtmp/librtmp.3{,.html}; do
+      substituteInPlace "$file" \
+        --replace-fail "RTMPDump v2.4" "RTMPDump v${finalAttrs.version}"
+    done
+
+    for file in Makefile librtmp/Makefile; do
+      substituteInPlace "$file" \
+        --replace-fail "VERSION=v2.4" "VERSION=v${finalAttrs.version}"
+    done
+  '';
+
   preBuild = ''
     makeFlagsArray+=(CC="$CC")
   '';
@@ -44,18 +58,38 @@ stdenv.mkDerivation {
   ]
   ++ lib.optional opensslSupport openssl;
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--help";
+  doInstallCheck = true;
+
   outputs = [
     "out"
     "dev"
   ];
 
+  # incdir hardcoded to ${prefix}/include, but we move includes to -dev
+  # pkg-config version field is specified without "v" prefix
+  postFixup = ''
+    substituteInPlace $dev/lib/pkgconfig/librtmp.pc \
+      --replace-fail 'incdir=''${prefix}/include' "incdir=$dev/include" \
+      --replace-fail 'Version: v${finalAttrs.version}' 'Version: ${finalAttrs.version}'
+  '';
+
   separateDebugInfo = true;
 
+  passthru.tests.pkg-config = testers.hasPkgConfigModules {
+    package = finalAttrs.finalPackage;
+    versionCheck = true;
+  };
+
   meta = {
     description = "Toolkit for RTMP streams";
     homepage = "https://rtmpdump.mplayerhq.hu/";
+    changelog = "https://rtmpdump.mplayerhq.hu/ChangeLog";
     license = lib.licenses.gpl2Plus;
+    mainProgram = "rtmpdump";
+    pkgConfigModules = [ "librtmp" ];
     platforms = lib.platforms.unix;
     maintainers = [ ];
   };
-}
+})

From 19745ce59c1539beb3cb936d2f0226cb8b26e239 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Fri, 7 Aug 2026 19:05:35 +0200
Subject: [PATCH 295/551] rtmpdump: adopt

---
 pkgs/by-name/rt/rtmpdump/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/rt/rtmpdump/package.nix b/pkgs/by-name/rt/rtmpdump/package.nix
index b70006410d9c..f09b5c92387f 100644
--- a/pkgs/by-name/rt/rtmpdump/package.nix
+++ b/pkgs/by-name/rt/rtmpdump/package.nix
@@ -90,6 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "rtmpdump";
     pkgConfigModules = [ "librtmp" ];
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })

From 53e6f17d063a67f37f957dbd8949fcbd315c87c5 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Fri, 7 Aug 2026 19:06:10 +0200
Subject: [PATCH 296/551] tinyalsa: unstable-2022-06-05 ->
 2.0.0-unstable-2026-07-27

---
 pkgs/by-name/ti/tinyalsa/package.nix | 44 ++++++++++++++++------------
 1 file changed, 25 insertions(+), 19 deletions(-)

diff --git a/pkgs/by-name/ti/tinyalsa/package.nix b/pkgs/by-name/ti/tinyalsa/package.nix
index f90680f8f41b..157a104b223a 100644
--- a/pkgs/by-name/ti/tinyalsa/package.nix
+++ b/pkgs/by-name/ti/tinyalsa/package.nix
@@ -1,43 +1,49 @@
 {
   lib,
   stdenv,
+  testers,
   fetchFromGitHub,
-  cmake,
+  meson,
+  ninja,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tinyalsa";
-  version = "unstable-2022-06-05";
+  version = "2.0.0-unstable-2026-07-27";
 
   src = fetchFromGitHub {
     owner = "tinyalsa";
     repo = "tinyalsa";
-    rev = "3d70d227e7dfd1be6f8f420a5aae164a2b4126e0";
-    hash = "sha256-RHeF3VShy+LYFtJK+AEU7swIr5/rnpg2fdllnH9cFCk=";
+    rev = "9fab97ca07184371ecad81154d1dadb09d0fa7cf";
+    hash = "sha256-+/wz0pwyF1kulUA5kjFGVOwbSkunEU+WzsZf/UsCEVk=";
   };
 
+  separateDebugInfo = true;
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  outputs = [
+    "out"
+    "dev"
+    "bin"
+  ];
+
   nativeBuildInputs = [
-    cmake
+    meson
+    ninja
   ];
 
-  cmakeFlags = [
-    "-DTINYALSA_USES_PLUGINS=ON"
-  ];
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=sign-compare"
-  ];
-
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "cmake_minimum_required(VERSION 3.1)" "cmake_minimum_required(VERSION 3.10)"
-  '';
+  passthru.tests.pkg-config = testers.hasPkgConfigModules {
+    package = finalAttrs.finalPackage;
+    versionCheck = false;
+  };
 
   meta = {
     homepage = "https://github.com/tinyalsa/tinyalsa";
     description = "Tiny library to interface with ALSA in the Linux kernel";
     license = lib.licenses.mit;
+    pkgConfigModules = [ "tinyalsa" ];
     maintainers = [ ];
     platforms = with lib.platforms; linux;
   };
-}
+})

From 5abd5b424bab34da4150639a4510f8b3adfe00a4 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Fri, 7 Aug 2026 19:07:22 +0200
Subject: [PATCH 297/551] tinyalsa: adopt

---
 pkgs/by-name/ti/tinyalsa/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ti/tinyalsa/package.nix b/pkgs/by-name/ti/tinyalsa/package.nix
index 157a104b223a..809fcb47ffda 100644
--- a/pkgs/by-name/ti/tinyalsa/package.nix
+++ b/pkgs/by-name/ti/tinyalsa/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Tiny library to interface with ALSA in the Linux kernel";
     license = lib.licenses.mit;
     pkgConfigModules = [ "tinyalsa" ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
     platforms = with lib.platforms; linux;
   };
 })

From 1d337c342efb05cf5b20e664372c71e62c485125 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Fri, 14 Aug 2026 09:30:44 +0200
Subject: [PATCH 298/551] rsync: 3.4.4 -> 3.5.0

https://download.samba.org/pub/rsync/NEWS#3.5.0

Fixes 33 security issues in path handling and the daemon protocol.

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
---
 pkgs/by-name/rs/rsync/package.nix | 59 ++++++++++++++++++++++---------
 1 file changed, 43 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix
index a39a47765b4d..ce828249f536 100644
--- a/pkgs/by-name/rs/rsync/package.nix
+++ b/pkgs/by-name/rs/rsync/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
 
   updateAutotoolsGnuConfigScriptsHook,
   perl,
@@ -29,27 +28,33 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rsync";
-  version = "3.4.4";
+  version = "3.5.0";
 
   src = fetchurl {
     # signed with key 9FEF 112D CE19 A0DC 7E88  2CB8 1BB2 4997 A853 5F6F
     url = "mirror://samba/rsync/src/rsync-${finalAttrs.version}.tar.gz";
-    hash = "sha256-vYjPgvplPaMjFPsikTZAfFyQ+A0XWNj0sJF2eHfY+pY=";
+    hash = "sha256-x//R72U+mVQPZh5HywC3+crR7muXI5mxb5PWcmVuDTM=";
   };
 
-  patches = [
-    # Fixes test failure on darwin
-    (fetchpatch {
-      url = "https://github.com/RsyncProject/rsync/commit/e1c5f0e93a75dd45f32f3b92ba221ef158ac2e5f.patch";
-      hash = "sha256-pg65K9BCTq/WvS5icK6KT28ARccFKedp2445wLYdRsE=";
-      excludes = [
-        ".github/workflows/cygwin-build.yml"
-      ];
-    })
-  ];
+  patches = [ ];
+
+  # Remove with the first upstream release that links t_acl against the snprintf fallback.
+  postPatch = ''
+    substituteInPlace Makefile.in \
+      --replace-fail 'T_ACL_OBJ = t_acl.o lib/acl.o' 'T_ACL_OBJ = t_acl.o lib/acl.o lib/snprintf.o'
+  '';
 
   preBuild = ''
-    patchShebangs ./runtests.py
+    patchShebangs ./runtests.py ./support/rrsync
+
+    # patchShebangs ignores non-executable test sources and embedded shebangs.
+    substituteInPlace \
+      testsuite/{daemon-namecvt-{empty-response,newline-token},rrsync-{sender-parent-pin,symlink}}_test.py \
+      --replace-fail '#!/usr/bin/env python3' '#!${python3}/bin/python3'
+
+    substituteInPlace \
+      testsuite/rsync-ssl-stunnel-{ca-required,hostname-check}_test.py \
+      --replace-fail '#!/usr/bin/env bash' '#!${stdenv.shell}'
   '';
 
   nativeBuildInputs = [
@@ -103,9 +108,31 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
-  # Test fails when built in a chroot store
+  # These require set-id, chown, xattrs, or unrestricted /proc/self/fd,
+  # which the Linux Nix build sandbox does not provide.
   preCheck = ''
-    rm testsuite/chgrp.test
+    export RSYNC_EXCLUDE=${
+      lib.concatStringsSep "," (
+        lib.optionals stdenv.hostPlatform.isLinux [
+          "chmod-option"
+          "chmod-setid"
+          "chown-fake"
+          "fake-super-backup-fifo-regression"
+          "protected-regular"
+          "rrsync-backup-dir-inband-pivot"
+          "rrsync-pull-delivers-content"
+          "variety-symlink-traversal"
+          "variety"
+        ]
+        # This test assumes that every Linux libc provides glibc malloc stats.
+        ++ lib.optional stdenv.hostPlatform.isMusl "misc-coverage"
+        # These require a native compiler and dynamic interposition.
+        ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+          "link-dest-symlink-enotsup"
+          "partial-protected-regular-retry-linux"
+        ]
+      )
+    }
   '';
 
   doCheck = true;

From a9c473dbce8bfb1e2cdd9ecf5cebc3219323230a Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Sun, 16 Aug 2026 20:23:51 +0200
Subject: [PATCH 299/551] gst_all_1.gst-libav: remove ffmpeg pin

GStreamer 1.28.6 adds support for ffmpeg 9.
---
 pkgs/development/libraries/gstreamer/libav/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 6731f09fb1e9..0d637b250465 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -9,8 +9,7 @@
   gstreamer,
   gst-plugins-base,
   gettext,
-  # FIXME: unpin when upstream supports ffmpeg 9
-  ffmpeg_8-headless,
+  ffmpeg-headless,
   # Checks meson.is_cross_build(), so even canExecute isn't enough.
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
@@ -51,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     gstreamer
     gst-plugins-base
-    ffmpeg_8-headless
+    ffmpeg-headless
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     apple-sdk_gstreamer

From d1db2c4b534628ac6b94024df500f02fa0f9345f Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Sun, 16 Aug 2026 16:33:37 -0400
Subject: [PATCH 300/551] pipewire: replace systemd dependency with systemdLibs

---
 pkgs/by-name/pi/pipewire/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index 144def6c59a9..981c7f867324 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -12,8 +12,8 @@
   elogind,
   libinotify-kqueue,
   epoll-shim,
-  systemd,
-  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, # enableSystemd=false maintained by maintainers.highghlow.
+  systemdLibs,
+  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs, # enableSystemd=false maintained by maintainers.highghlow.
   pkg-config,
   docutils,
   doxygen,
@@ -157,7 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ (
     if enableSystemd then
-      [ systemd ]
+      [ systemdLibs ]
     else if stdenv.hostPlatform.isLinux then
       [
         elogind

From 0bd88d4b5d341189f6da3319e9607d92275a6aca Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Sun, 16 Aug 2026 23:20:58 +0200
Subject: [PATCH 301/551] tinyalsa: set updateScript

---
 pkgs/by-name/ti/tinyalsa/package.nix | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ti/tinyalsa/package.nix b/pkgs/by-name/ti/tinyalsa/package.nix
index 809fcb47ffda..de827704e4c8 100644
--- a/pkgs/by-name/ti/tinyalsa/package.nix
+++ b/pkgs/by-name/ti/tinyalsa/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   testers,
+  unstableGitUpdater,
   fetchFromGitHub,
   meson,
   ninja,
@@ -33,9 +34,14 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
   ];
 
-  passthru.tests.pkg-config = testers.hasPkgConfigModules {
-    package = finalAttrs.finalPackage;
-    versionCheck = false;
+  passthru = {
+    updateScript = unstableGitUpdater {
+      tagPrefix = "v";
+    };
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      versionCheck = false;
+    };
   };
 
   meta = {

From c33881bc35d24c80334fe93f87d1bea0b69e3f2b Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Mon, 10 Aug 2026 20:59:59 +0200
Subject: [PATCH 302/551] libnice: fix devdoc and refactor mesonFlags

---
 pkgs/by-name/li/libnice/package.nix | 48 ++++++++++++++++++++---------
 1 file changed, 34 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index a946663f2f4c..a032ea4eaeab 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -6,16 +6,21 @@
   meson,
   ninja,
   pkg-config,
-  python3,
-  gobject-introspection,
-  gtk-doc,
-  docbook_xsl,
-  docbook_xml_dtd_412,
   glib,
   gupnp-igd,
   gst_all_1,
   gnutls,
+  enableDocumentation ? stdenv.buildPlatform == stdenv.hostPlatform,
+  gtk-doc,
+  docbook_xsl,
+  docbook_xml_dtd_412,
   graphviz,
+  python3,
+  withIntrospection ?
+    lib.meta.availableOn stdenv.hostPlatform gobject-introspection
+    && stdenv.hostPlatform.emulatorAvailable buildPackages,
+  buildPackages,
+  gobject-introspection,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -27,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     "out"
     "dev"
   ]
-  ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
+  ++ lib.optionals enableDocumentation [ "devdoc" ];
 
   src = fetchurl {
     url = "https://libnice.freedesktop.org/releases/libnice-${finalAttrs.version}.tar.gz";
@@ -51,18 +56,26 @@ stdenv.mkDerivation (finalAttrs: {
     ./musl.patch
   ];
 
+  # specifies <1.30, but also works with later versions
+  postPatch = ''
+    substituteInPlace docs/reference/libnice/meson.build \
+      --replace-fail "version: '<1.30', " ""
+  '';
+
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
-    python3
+  ]
+  ++ lib.optionals withIntrospection [
     gobject-introspection
-
-    # documentation
+  ]
+  ++ lib.optionals enableDocumentation [
     gtk-doc
     docbook_xsl
     docbook_xml_dtd_412
     graphviz
+    python3
   ];
 
   buildInputs = [
@@ -76,11 +89,18 @@ stdenv.mkDerivation (finalAttrs: {
     glib
   ];
 
-  mesonFlags = [
-    "-Dgtk_doc=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}"
-    "-Dintrospection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}"
-    "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
-  ];
+  mesonFlags = lib.mapAttrsToList lib.mesonEnable {
+    gtk_doc = enableDocumentation;
+    introspection = withIntrospection;
+
+    # requires many dependencies and probably not useful for our users
+    examples = false;
+    tests = finalAttrs.finalPackage.doCheck;
+
+    gstreamer = true;
+
+    glib_debug = false;
+  };
 
   # Tests are flaky
   # see https://github.com/NixOS/nixpkgs/pull/53293#issuecomment-453739295

From bd50939c8a8fdcf13902c84cccae40d8a7e5b60e Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Mon, 10 Aug 2026 21:01:21 +0200
Subject: [PATCH 303/551] libnice: adopt

---
 pkgs/by-name/li/libnice/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index a032ea4eaeab..5a75de403604 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -122,5 +122,6 @@ stdenv.mkDerivation (finalAttrs: {
       lgpl21
       mpl11
     ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })

From e7f2b610e7aa820bee4522ca5e01c0e3bb45e85d Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Mon, 10 Aug 2026 21:04:25 +0200
Subject: [PATCH 304/551] libnice: declare and test meta.pkgConfigModules

---
 pkgs/by-name/li/libnice/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index 5a75de403604..cd906b1a74db 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  testers,
   fetchurl,
   fetchpatch,
   meson,
@@ -106,6 +107,8 @@ stdenv.mkDerivation (finalAttrs: {
   # see https://github.com/NixOS/nixpkgs/pull/53293#issuecomment-453739295
   doCheck = false;
 
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
   meta = {
     changelog = "https://gitlab.freedesktop.org/libnice/libnice/-/blob/${finalAttrs.version}/NEWS";
     description = "GLib ICE implementation";
@@ -117,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
       It provides a GLib-based library, libnice and a Glib-free library,
       libstun as well as GStreamer elements.'';
     homepage = "https://libnice.freedesktop.org/";
+    pkgConfigModules = [ "nice" ];
     platforms = lib.platforms.unix;
     license = with lib.licenses; [
       lgpl21

From ebdf6ac4571e8f4fb5f9d68b02fea16a3f9b8b25 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Sun, 16 Aug 2026 18:12:03 +0200
Subject: [PATCH 305/551] libnice: use fetchFromGitLab and set updateScript

Fetching the source from Gitlab allows nix-update to automatically
detect the latest version.
---
 pkgs/by-name/li/libnice/package.nix | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index cd906b1a74db..5a0590c209f5 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -2,8 +2,9 @@
   lib,
   stdenv,
   testers,
-  fetchurl,
+  fetchFromGitLab,
   fetchpatch,
+  nix-update-script,
   meson,
   ninja,
   pkg-config,
@@ -35,9 +36,12 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals enableDocumentation [ "devdoc" ];
 
-  src = fetchurl {
-    url = "https://libnice.freedesktop.org/releases/libnice-${finalAttrs.version}.tar.gz";
-    hash = "sha256-YY/E6N45O3GbFkHB2O7AGCbU050VrekmedIhx/Xk5w0=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "libnice";
+    repo = "libnice";
+    tag = finalAttrs.version;
+    hash = "sha256-UPppE5kBois0jJwsHKefBC8iTfSIkPZXV6XnUBnEFn8=";
   };
 
   patches = [
@@ -107,7 +111,10 @@ stdenv.mkDerivation (finalAttrs: {
   # see https://github.com/NixOS/nixpkgs/pull/53293#issuecomment-453739295
   doCheck = false;
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
 
   meta = {
     changelog = "https://gitlab.freedesktop.org/libnice/libnice/-/blob/${finalAttrs.version}/NEWS";

From d6e761a9557061da749b62192da8f077511857f6 Mon Sep 17 00:00:00 2001
From: qubitnano <146656568+qubitnano@users.noreply.github.com>
Date: Sun, 16 Aug 2026 20:44:05 -0400
Subject: [PATCH 306/551] mongodb-7_0: 7.0.39 -> 7.0.40

https://www.mongodb.com/docs/manual/release-notes/7.0-changelog/#7040-changelog

Fixes: CVE-2026-18688
Fixes: CVE-2026-18690
Fixes: CVE-2026-18691
Fixes: CVE-2026-18693
Fixes: CVE-2026-18694
Fixes: CVE-2026-18695
Fixes: CVE-2026-18696
Fixes: CVE-2026-18697
Fixes: CVE-2026-18698
Fixes: CVE-2026-18699
Fixes: CVE-2026-18700
Fixes: CVE-2026-18701
Fixes: CVE-2026-18702
Fixes: CVE-2026-18705
Fixes: CVE-2026-18708
Fixes: CVE-2026-18709
Fixes: CVE-2026-18712
---
 pkgs/servers/nosql/mongodb/7.0.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/nosql/mongodb/7.0.nix b/pkgs/servers/nosql/mongodb/7.0.nix
index b4254c47be61..32b1c935c26b 100644
--- a/pkgs/servers/nosql/mongodb/7.0.nix
+++ b/pkgs/servers/nosql/mongodb/7.0.nix
@@ -21,8 +21,8 @@ let
 in
 buildMongoDB {
   inherit avxSupport;
-  version = "7.0.39";
-  hash = "sha256-VB20nhb0mMf9xVs/R4i+4wWoqHoDNWNouDw3FRehBP8=";
+  version = "7.0.40";
+  hash = "sha256-0KDqI/tMxklGkOvXcehmufiWvmNrf8Jj2llCH91gNlw=";
   patches = [
     # ModuleNotFoundError: No module named 'mongo_tooling_metrics':
     # NameError: name 'SConsToolingMetrics' is not defined:

From 7e7b9a88ded097a98c4866b4063600c593ef630a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 3 Aug 2026 13:16:49 +0200
Subject: [PATCH 307/551] libiconv: enable structuredAttrs, use finalAttrs, use
 hash

---
 pkgs/development/libraries/libiconv/default.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/libiconv/default.nix b/pkgs/development/libraries/libiconv/default.nix
index a90ea21d6cfb..2e24e6a509e0 100644
--- a/pkgs/development/libraries/libiconv/default.nix
+++ b/pkgs/development/libraries/libiconv/default.nix
@@ -10,13 +10,13 @@
 
 # assert !stdenv.hostPlatform.isLinux || stdenv.hostPlatform != stdenv.buildPlatform; # TODO: improve on cross
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libiconv";
   version = "1.19";
 
   src = fetchurl {
-    url = "mirror://gnu/libiconv/${pname}-${version}.tar.gz";
-    sha256 = "sha256-iN2WqMBGTsoUT8eRrmDNMc2O54Mh5nOX4l/AlcShmqY=";
+    url = "mirror://gnu/libiconv/libiconv-${finalAttrs.version}.tar.gz";
+    hash = "sha256-iN2WqMBGTsoUT8eRrmDNMc2O54Mh5nOX4l/AlcShmqY=";
   };
 
   enableParallelBuilding = true;
@@ -84,7 +84,9 @@ stdenv.mkDerivation rec {
   # remove after gnulib is updated
   ++ lib.optional stdenv.hostPlatform.isCygwin "gl_cv_clean_version_stddef=yes";
 
-  passthru = { inherit setupHooks; };
+  passthru = { inherit (finalAttrs) setupHooks; };
+
+  __structuredAttrs = true;
 
   meta = {
     description = "Iconv(3) implementation";
@@ -108,4 +110,4 @@ stdenv.mkDerivation rec {
     # This library is not needed on GNU platforms.
     hydraPlatforms = with lib.platforms; cygwin ++ darwin ++ freebsd;
   };
-}
+})

From 9a92753202c6ba793a35654da71d7a5288186280 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 14 Aug 2026 22:09:27 +0200
Subject: [PATCH 308/551] glib: enable structuredAttrs

---
 pkgs/by-name/gl/glib/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix
index d504331900ce..b671ab262978 100644
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -366,6 +366,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "C library of programming buildings blocks";
     homepage = "https://gitlab.gnome.org/GNOME/glib";

From fffccc637f9d91e2a75bd2a073f3229c6f5e90d3 Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Mon, 17 Aug 2026 14:32:40 +0200
Subject: [PATCH 309/551] zip: remove rec in favor of finalAttrs

---
 pkgs/by-name/zi/zip/package.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/zi/zip/package.nix b/pkgs/by-name/zi/zip/package.nix
index 3bf6b8a1641a..07d985fcc19c 100644
--- a/pkgs/by-name/zi/zip/package.nix
+++ b/pkgs/by-name/zi/zip/package.nix
@@ -10,13 +10,15 @@
 
 assert enableNLS -> libnatspec != null;
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zip";
   version = "3.0";
 
   src = fetchurl {
     urls = [
-      "ftp://ftp.info-zip.org/pub/infozip/src/zip${lib.replaceStrings [ "." ] [ "" ] version}.tgz"
+      "ftp://ftp.info-zip.org/pub/infozip/src/zip${
+        lib.replaceStrings [ "." ] [ "" ] finalAttrs.version
+      }.tgz"
       "https://src.fedoraproject.org/repo/pkgs/zip/zip30.tar.gz/7b74551e63f8ee6aab6fbc86676c0d37/zip30.tar.gz"
     ];
     sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h";
@@ -88,4 +90,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ RossComputerGuy ];
     mainProgram = "zip";
   };
-}
+})

From 0642347f9dbbafcfc3d1d960d1a8cf88fcb35aac Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Mon, 17 Aug 2026 14:39:01 +0200
Subject: [PATCH 310/551] zip: fetch build fix from debian

---
 .../zi/zip/12-fix-build-with-gcc-14.patch     | 56 -------------------
 pkgs/by-name/zi/zip/package.nix               | 10 +++-
 2 files changed, 7 insertions(+), 59 deletions(-)
 delete mode 100644 pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch

diff --git a/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch b/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch
deleted file mode 100644
index 58d070a3c2b9..000000000000
--- a/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From: Santiago Vila <sanvila@debian.org>
-Subject: Fix build with gcc-14
-Bug-Debian: https://bugs.debian.org/1075706
-X-Debian-version: 3.0-14
-
---- a/unix/configure
-+++ b/unix/configure
-@@ -514,14 +514,16 @@
-   echo Check for $func
-   echo "int main(){ $func(); return 0; }" > conftest.c
-   $CC $BFLAG -o conftest conftest.c >/dev/null 2>/dev/null
--  [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_`echo $func | tr '[a-z]' '[A-Z]'`"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_`echo $func | tr '[a-z]' '[A-Z]'`"
- done
- 
- 
- echo Check for memset
- echo "int main(){ char k; memset(&k,0,0); return 0; }" > conftest.c
- $CC -o conftest conftest.c >/dev/null 2>/dev/null
--[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DZMEM"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DZMEM"
- 
- 
- echo Check for memmove
-@@ -551,7 +553,8 @@
- }
- _EOF_
- $CC $CFLAGS -c conftest.c >/dev/null 2>/dev/null
--[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_ERRNO"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_ERRNO"
- 
- 
- echo Check for directory libraries
-@@ -567,7 +570,8 @@
-     $CC -o conftest conftest.c -l$lib >/dev/null 2>/dev/null
-     [ $? -eq 0 ] && OPT=-l$lib && break
-   done
--  if [ ${OPT} ]; then
-+  # glibc-based systems do not need this
-+  if true; then
-     LFLAGS2="${LFLAGS2} ${OPT}"
-   else
-     CFLAGS="${CFLAGS} -DNO_DIR"
-@@ -629,7 +633,8 @@
- }
- _EOF_
- $CC ${CFLAGS} -c conftest.c > /dev/null 2>/dev/null
--[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_VALLOC"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_VALLOC"
- 
- 
- echo Check for /usr/local/bin and /usr/local/man
diff --git a/pkgs/by-name/zi/zip/package.nix b/pkgs/by-name/zi/zip/package.nix
index 07d985fcc19c..5a103ecef2ed 100644
--- a/pkgs/by-name/zi/zip/package.nix
+++ b/pkgs/by-name/zi/zip/package.nix
@@ -6,6 +6,7 @@
   libnatspec ? null,
   libiconv,
   fetchpatch,
+  fetchDebianPatch,
 }:
 
 assert enableNLS -> libnatspec != null;
@@ -46,9 +47,12 @@ stdenv.mkDerivation (finalAttrs: {
     #     zip I/O error: No such file or directory
     #     zip error: Could not create output file (was replacing the original zip file)
     #     make[2]: *** [CreateJars.gmk:659: /build/source/build/linux-x86_64-normal-server-release/images/src.zip] Error 1
-    #
-    # Source: Debian
-    ./12-fix-build-with-gcc-14.patch
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "16";
+      patch = "fix-build-with-gcc-14.patch";
+      hash = "sha256-C966AdPV5E44cJ1L28iFvmXq3frjNiW6PoHiOOusS04=";
+    })
     (fetchpatch {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/zip/files/zip-3.0-pic.patch?id=d37d095fc7a2a9e4a8e904a7bf0f597fe99df85a";
       hash = "sha256-OXgC9KqiOpH/o/bSabt3LqtoT/xifqfkvpLLPfPz+1c=";

From d06149fb16148dd0945a04045ee545cd7dc37f42 Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Mon, 17 Aug 2026 13:47:15 +0200
Subject: [PATCH 311/551] zip: fix buffer overflow

Fixes: CVE-2018-13410
---
 pkgs/by-name/zi/zip/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/zi/zip/package.nix b/pkgs/by-name/zi/zip/package.nix
index 5a103ecef2ed..22b7bab6170a 100644
--- a/pkgs/by-name/zi/zip/package.nix
+++ b/pkgs/by-name/zi/zip/package.nix
@@ -80,6 +80,14 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/zip/files/zip-3.0-zipnote-freeze.patch?id=d37d095fc7a2a9e4a8e904a7bf0f597fe99df85a";
       hash = "sha256-EVr7YS3IytnCRjAYUlkg05GA/kaAY9NRFG7uDt0QLAY=";
     })
+    # Fix buffer overflow (CVE-2018-13410).
+    # See: https://seclists.org/fulldisclosure/2018/Jul/24
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "16";
+      patch = "buffer-overflow-cve-2018-13410.patch";
+      hash = "sha256-Hgy0yrBuSX2XWN1PNASQbjiXfyzSScwHQ+o0fv6Sgs4=";
+    })
   ]
   ++ lib.optionals (enableNLS && !stdenv.hostPlatform.isCygwin) [ ./natspec-gentoo.patch.bz2 ];
 

From dd9b9f6c0b6d8f4b0a9de973958689169dd57c70 Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Mon, 17 Aug 2026 13:47:40 +0200
Subject: [PATCH 312/551] zip: fix command injection

There is no CVE assigned yet. See:
https://security-tracker.debian.org/tracker/TEMP-1143866-6DBA82
---
 pkgs/by-name/zi/zip/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/zi/zip/package.nix b/pkgs/by-name/zi/zip/package.nix
index 22b7bab6170a..e67be89c2a9b 100644
--- a/pkgs/by-name/zi/zip/package.nix
+++ b/pkgs/by-name/zi/zip/package.nix
@@ -88,6 +88,14 @@ stdenv.mkDerivation (finalAttrs: {
       patch = "buffer-overflow-cve-2018-13410.patch";
       hash = "sha256-Hgy0yrBuSX2XWN1PNASQbjiXfyzSScwHQ+o0fv6Sgs4=";
     })
+    # Command injection in zip -T for specially crafted file
+    # names. See: https://seclists.org/oss-sec/2026/q3/494
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "16";
+      patch = "fix-command-injection.patch";
+      hash = "sha256-cfE98l98KkPfDS5KT/DB2bqFNPTbHBKyJ7W2+iKgaGI=";
+    })
   ]
   ++ lib.optionals (enableNLS && !stdenv.hostPlatform.isCygwin) [ ./natspec-gentoo.patch.bz2 ];
 

From 44da7d4f09c3dc5480e0b065ef92b850b47daf11 Mon Sep 17 00:00:00 2001
From: abstracts33d <abstract.s33d@gmail.com>
Date: Mon, 17 Aug 2026 16:33:50 +0200
Subject: [PATCH 313/551] qt6.qtdeclarative: backport QTBUG-147153
 InternalClass crash fix

QV4's InternalClass::changeMember returns a stale property index when
cleanInternalClass rebuilds the transition hierarchy, which happens
after 255 redundant transitions from add/delete/re-add property churn
on a JS object. The rebuilt object may hold all surviving members
inline with no out-of-line memberData, so a store through the stale
index dereferences null. Long-running QML applications crash with
SIGSEGV in QV4::Object::insertMember; reported against quickshell
based desktop shells (noctalia-dev/noctalia#3992) with a deterministic
reproducer.

Upstream fix qt/qtdeclarative@624e90bb5e (Pick-to: 6.12 6.11 6.8) is
not in any released Qt yet (absent from 6.11.1). Patch applies to
6.11.1 with offsets only.
---
 .../libraries/qt-6/modules/qtdeclarative/default.nix     | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index cfcdb5f6c59a..113d717a5f6e 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -57,6 +57,15 @@ qtModule {
       url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.diff";
       hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA=";
     })
+
+    # backport fix for a QV4 heap corruption crash on JS objects with
+    # add/delete/re-add property churn (QTBUG-147153); crashes e.g.
+    # quickshell-based shells like noctalia-shell
+    # https://bugreports.qt.io/browse/QTBUG-147153
+    (fetchpatch {
+      url = "https://github.com/qt/qtdeclarative/commit/624e90bb5e89837d4b759b43e2120b059d98a41e.diff";
+      hash = "sha256-7duTYpHZusVNDMlkm19dCppEWBejjTbc0sy3QvJG65s=";
+    })
   ];
 
   cmakeFlags = [

From f3bfdc3eda6f33d41ee7869b7f0d944d98b7c6ab Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 17 Aug 2026 22:37:34 +0100
Subject: [PATCH 314/551] chromaprint: 1.6.0 -> 1.6.1

Changes: https://github.com/acoustid/chromaprint/releases/tag/v1.6.1
---
 pkgs/by-name/ch/chromaprint/package.nix | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/ch/chromaprint/package.nix b/pkgs/by-name/ch/chromaprint/package.nix
index 1f4a27adb643..f08c1c0e914e 100644
--- a/pkgs/by-name/ch/chromaprint/package.nix
+++ b/pkgs/by-name/ch/chromaprint/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   fetchurl,
   cmake,
   ninja,
@@ -17,23 +16,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chromaprint";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "acoustid";
     repo = "chromaprint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G3HIMgbjaAXsC+8nt7mkj58xA62qwA8FC+PfTGblhNg=";
+    hash = "sha256-Es903zeZ++9/Xb/npUU3rB0V87DVqwT9uTMbQdSzfJI=";
   };
 
-  patches = [
-    # fix generated pkg-config files
-    (fetchpatch {
-      url = "https://github.com/acoustid/chromaprint/commit/782ef6bb5f6498e35f8e275f76998fbd5ffa36d6.patch";
-      hash = "sha256-drUfAMzTrqqB5UbzOnfPq6XD3HI+3sxyJJSTCa0BmD8=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja

From 14c7ad6b248e901a645a7c0612399b76e120b75f Mon Sep 17 00:00:00 2001
From: Adam Thompson-Sharpe <adamthompsonsharpe@gmail.com>
Date: Mon, 17 Aug 2026 19:08:52 -0400
Subject: [PATCH 315/551] umple: make update script compatible with
 nixpkgs-update

Without this, nixpkgs-update seems to check for the old version in the
`package.nix` file with a substring like `x.y.z"`, which fails. This
changes the package to directly include the version in the Nix file.

This is arguably a bug with nixpkgs-update (it would probably make sense
to check _all_ affected files for the old version), but this is the
simplest fix.

Logs: https://nixpkgs-update-logs.nix-community.org/umple/2026-08-16.log
---
 pkgs/by-name/um/umple/package.nix |  6 +++---
 pkgs/by-name/um/umple/update.sh   | 12 ++++++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/um/umple/package.nix b/pkgs/by-name/um/umple/package.nix
index fcd3d706f3e1..37f557c82c01 100644
--- a/pkgs/by-name/um/umple/package.nix
+++ b/pkgs/by-name/um/umple/package.nix
@@ -12,7 +12,7 @@
 }:
 let
   versions = lib.importJSON ./versions.json;
-  inherit (versions.umple) version longVersion;
+  inherit (versions.umple) longVersion;
 
   # Required for bootstrapping
   umpleJar = fetchurl versions.umpleJar;
@@ -28,12 +28,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "umple";
-  inherit version;
+  version = "1.37.0";
 
   src = fetchFromGitHub {
     owner = "umple";
     repo = "umple";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-BPy1L3bzvKoywM0srv36SXVe8psaY/m0bljy30z5dr8=";
   };
 
diff --git a/pkgs/by-name/um/umple/update.sh b/pkgs/by-name/um/umple/update.sh
index 0ec6f3e14525..b55b84c6eb29 100755
--- a/pkgs/by-name/um/umple/update.sh
+++ b/pkgs/by-name/um/umple/update.sh
@@ -42,17 +42,17 @@ umpleUrl="https://github.com/umple/umple/releases/download/$latestTag/$umpleName
 umpleHash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 \
   "$(nix-prefetch-url "$umpleUrl")")
 
-# Save version info
+# Save version info.
+# Note that the Nix package version is directly inlined so that nixpkgs-update
+# can properly detect when the version changes in the source
 jq -n \
-  --arg version "$latestVersion" \
   --arg longVersion "$longVersion" \
   --arg revision "$revision" \
-  --arg commitCount "$commitCount" \
+  --argjson commitCount "$commitCount" \
   --arg umpleUrl "$umpleUrl" \
   --arg umpleHash "$umpleHash" \
   '{
     "umple": {
-      "version": $version,
       "longVersion": $longVersion,
       "revision": $revision,
       "commitCount": $commitCount
@@ -63,5 +63,5 @@ jq -n \
     }
   }' > "$location/versions.json"
 
-# Version update is done; use nix-update for hashes and Gradle deps
-nix-update umple --version=skip
+# use nix-update for hashes and Gradle deps
+nix-update umple --version="$latestVersion"

From 39dc0f9c92f48ff52607ab0184eea173897d8c4e Mon Sep 17 00:00:00 2001
From: Adam Thompson-Sharpe <adamthompsonsharpe@gmail.com>
Date: Mon, 17 Aug 2026 19:13:59 -0400
Subject: [PATCH 316/551] umple: 1.37.0 -> 1.37.1

Changelog: https://github.com/umple/umple/releases/tag/v1.37.1
---
 pkgs/by-name/um/umple/deps.json     |  4 ++--
 pkgs/by-name/um/umple/package.nix   |  4 ++--
 pkgs/by-name/um/umple/versions.json | 11 +++++------
 3 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/um/umple/deps.json b/pkgs/by-name/um/umple/deps.json
index 74ff05bdcd87..5d7d7abff810 100644
--- a/pkgs/by-name/um/umple/deps.json
+++ b/pkgs/by-name/um/umple/deps.json
@@ -242,8 +242,8 @@
   "com/google/guava/guava/maven-metadata": {
    "xml": {
     "groupId": "com.google.guava",
-    "lastUpdated": "20260414193116",
-    "release": "33.6.0-jre"
+    "lastUpdated": "20260817142319",
+    "release": "33.7.0-jre"
    }
   },
   "com/google/inject#guice-parent/3.0": {
diff --git a/pkgs/by-name/um/umple/package.nix b/pkgs/by-name/um/umple/package.nix
index 37f557c82c01..cac644b96e5e 100644
--- a/pkgs/by-name/um/umple/package.nix
+++ b/pkgs/by-name/um/umple/package.nix
@@ -28,13 +28,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "umple";
-  version = "1.37.0";
+  version = "1.37.1";
 
   src = fetchFromGitHub {
     owner = "umple";
     repo = "umple";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BPy1L3bzvKoywM0srv36SXVe8psaY/m0bljy30z5dr8=";
+    hash = "sha256-xrq3Qmoq0tWR+9vrp292H3WpcWCYjYeIu1LJPBLvhD4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/um/umple/versions.json b/pkgs/by-name/um/umple/versions.json
index 9ca7502961c5..a551fcffbdf5 100644
--- a/pkgs/by-name/um/umple/versions.json
+++ b/pkgs/by-name/um/umple/versions.json
@@ -1,12 +1,11 @@
 {
   "umple": {
-    "version": "1.37.0",
-    "longVersion": "1.37.0.8543.1593c2b83",
-    "revision": "1593c2b83",
-    "commitCount": "8543"
+    "longVersion": "1.37.1.8673.860b8c752",
+    "revision": "860b8c752",
+    "commitCount": "8673"
   },
   "umpleJar": {
-    "url": "https://github.com/umple/umple/releases/download/v1.37.0/umple-1.37.0.8542.3a8c87689.jar",
-    "hash": "sha256-pBHHbURbe7B5A11tShvHGlSO4XMJPcdM7Iy+ph3PxAE="
+    "url": "https://github.com/umple/umple/releases/download/v1.37.1/umple-1.37.1.8672.ffc0b7ae3.jar",
+    "hash": "sha256-4EWhIxPPkwsS59ZSmpFkZXMRBa/3CTCyQuUWvYcVVC8="
   }
 }

From eab305b472d3262e9c296f6f10d5c502f1e5726f Mon Sep 17 00:00:00 2001
From: Adam Thompson-Sharpe <adamthompsonsharpe@gmail.com>
Date: Mon, 17 Aug 2026 19:40:13 -0400
Subject: [PATCH 317/551] umple-lsp: fix linker mismatch

Assisted-by: Claude Code (Claude Opus 5)
---
 pkgs/by-name/um/umple-lsp/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/um/umple-lsp/package.nix b/pkgs/by-name/um/umple-lsp/package.nix
index e564a15c6aaf..a9f26473dd21 100644
--- a/pkgs/by-name/um/umple-lsp/package.nix
+++ b/pkgs/by-name/um/umple-lsp/package.nix
@@ -15,6 +15,11 @@ let
   # tree-sitter needs a wasi32 clang available at `bin/clang`
   wasi32cc = lib.getExe pkgsCross.wasi32.stdenv.cc;
   wasi-sdk = linkFarm "wasi-sdk" { "bin/clang" = wasi32cc; };
+  # tree-sitter invokes clang with `--target=wasm32-unknown-wasi`, so clang looks
+  # for an unprefixed `wasm-ld` instead of the prefixed one that the cross bintools ship
+  wasm-ld = linkFarm "wasm-ld" {
+    "bin/wasm-ld" = lib.getExe' pkgsCross.wasi32.buildPackages.llvmPackages.lld "wasm-ld";
+  };
 in
 buildNpmPackage (finalAttrs: {
   pname = "umple-lsp";
@@ -43,6 +48,7 @@ buildNpmPackage (finalAttrs: {
     nodejs
     pkgsCross.wasi32.stdenv.cc.bintools
     tree-sitter
+    wasm-ld
   ];
 
   # Stop tree-sitter from trying to fetch its own wasi-sdk

From 849bc6de5f1ab19566e3d2058416e39b63fadeaa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 18 Aug 2026 00:26:53 +0000
Subject: [PATCH 318/551] procps: 4.0.6 -> 4.0.7

---
 pkgs/os-specific/linux/procps-ng/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index ff53296d9aba..78374bdbbfb1 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -23,12 +23,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "procps";
-  version = "4.0.6";
+  version = "4.0.7";
 
   # The project's releases are on SF, but git repo on gitlab.
   src = fetchurl {
     url = "mirror://sourceforge/procps-ng/procps-ng-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Z76m+8OkKlNaAjDJ6JHl3ftNnTlCLUZWWimQ0azhUhY=";
+    hash = "sha256-nSAh9HpFAcZnhiyZQqktGVNpSyHRG80XAug+tZTj1n0=";
   };
 
   outputs = [

From 85b77b299ff84e7f7650a8411fba06cd18457ec6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 18 Aug 2026 00:39:23 +0000
Subject: [PATCH 319/551] torrserver: 142.2 -> 143

---
 pkgs/by-name/to/torrserver/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/to/torrserver/package.nix b/pkgs/by-name/to/torrserver/package.nix
index 9dfc2a8e1ebb..f8bb8d12d59d 100644
--- a/pkgs/by-name/to/torrserver/package.nix
+++ b/pkgs/by-name/to/torrserver/package.nix
@@ -7,15 +7,15 @@
 }:
 buildGo126Module rec {
   pname = "torrserver";
-  version = "142.2";
+  version = "143";
 
   src = fetchFromGitHub {
     owner = "YouROK";
     repo = "TorrServer";
     tag = "MatriX.${version}";
-    sha256 = "sha256-hwlhAQLSLSmQLeaNVt8QKClwkCn9XHN0kyrNllnC06I=";
+    sha256 = "sha256-JP6fvf2OCz5A495YXzuajzuxh7VDb88WZBz2AuaUEUU=";
   };
-  vendorHash = "sha256-CUnIKZ3MDv+ne0Yk8MI4dV0VBbEfz2a04zDxdonnnvE=";
+  vendorHash = "sha256-l4eaMqh2OeUkr812bLnIF4XjLlnQvPxcvhk0v+4I/gU=";
 
   modRoot = "server";
   subPackages = [ "cmd" ];

From 079bcf2560f70325dfcf937984fd4ac85f3f7e80 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:51:10 +0000
Subject: [PATCH 320/551] perlPackages.CryptDSA: 1.21 -> 1.24

Fixes CVE-2026-14570. 1.24 uses Crypt::SysRandom and no longer requires
Crypt::URandom.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 7b34c7e62275..a1000f164ae3 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7124,16 +7124,15 @@ with self;
 
   CryptDSA = buildPerlPackage {
     pname = "Crypt-DSA";
-    version = "1.21";
+    version = "1.24";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.21.tar.gz";
-      hash = "sha256-pGIB6DkOi6O75RER12SJ8x2v2g9qYLCrkxndUr0rMrA=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.24.tar.gz";
+      hash = "sha256-ChY4tvK07+ktbuL0kBzKAtenBWf2uw9Iapu19pvnZ2Y=";
     };
     propagatedBuildInputs = [
       ConvertASN1
       ConvertPEM
       CryptSysRandom
-      CryptURandom
       DataBuffer
       FileWhich
     ];

From b3b347504e08b7e453dcf4fe8c58e7fa36a3aeef Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:52:53 +0000
Subject: [PATCH 321/551] perlPackages.DevelDeprecate: init at 0.01

New runtime dependency of Data::Entropy 0.010.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a1000f164ae3..b5881c17e302 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -9675,6 +9675,24 @@ with self;
     };
   };
 
+  DevelDeprecate = buildPerlPackage {
+    pname = "Devel-Deprecate";
+    version = "0.01";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/O/OV/OVID/Devel-Deprecate-0.01.tar.gz";
+      hash = "sha256-xQLEGoL+JU6XFRJ3ytOk8KQHrTydP2I9J3sDA6PhoS8=";
+    };
+    buildInputs = [ SubOverride ];
+    propagatedBuildInputs = [ DateTime ];
+    meta = {
+      description = "Create deprecation schedules in your code";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   DevelDeprecationsEnvironmental = buildPerlPackage {
     pname = "Devel-Deprecations-Environmental";
     version = "1.101";

From 26c50f57329a0da8224b771b36d1aa9f5ee1c015 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:54:58 +0000
Subject: [PATCH 322/551] perlPackages.DataEntropy: 0.008 -> 0.010

Fixes CVE-2026-18536. 0.010 removes the Random.org sources, which were
the only consumers of HTTP::Lite, and requires Devel::Deprecate.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b5881c17e302..25fbcf8b8f4e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -8228,16 +8228,16 @@ with self;
 
   DataEntropy = buildPerlPackage {
     pname = "Data-Entropy";
-    version = "0.008";
+    version = "0.010";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RR/RRWO/Data-Entropy-0.008.tar.gz";
-      hash = "sha256-GKUrE4boLGuM2zhKOYYdYCIKRCp5DgdwEL5y3YU7Z7M=";
+      url = "mirror://cpan/authors/id/R/RR/RRWO/Data-Entropy-0.010.tar.gz";
+      hash = "sha256-0M8s2wKCAuidw2K42Qtw00WFApOwGQDZoYgqDG8g+Dc=";
     };
     propagatedBuildInputs = [
       CryptRijndael
       CryptURandom
       DataFloat
-      HTTPLite
+      DevelDeprecate
       ParamsClassify
     ];
     meta = {

From b2a490b6534095408f0449fcc565f626df639935 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:55:50 +0000
Subject: [PATCH 323/551] perlPackages.MojoJWT: 0.09 -> 1.02

Fixes CVE-2026-9537. 1.02 requires CryptX at runtime.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 25fbcf8b8f4e..eb7a8f52d1ab 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -23227,13 +23227,16 @@ with self;
 
   MojoJWT = buildPerlModule {
     pname = "Mojo-JWT";
-    version = "0.09";
+    version = "1.02";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-JWT-0.09.tar.gz";
-      hash = "sha256-wE4DmD4MbyvORdCOoucph5yWee+mNLDmjLa4t7SoWIY=";
+      url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-JWT-1.02.tar.gz";
+      hash = "sha256-yBHXkoWMJBFQNyDxJDbjNDZ0k2dUO/vCqV1PgDzmCHQ=";
     };
     buildInputs = [ ModuleBuildTiny ];
-    propagatedBuildInputs = [ Mojolicious ];
+    propagatedBuildInputs = [
+      CryptX
+      Mojolicious
+    ];
     meta = {
       description = "JSON Web Token the Mojo way";
       homepage = "https://github.com/jberger/Mojo-JWT";

From 2f2c8475756fe4a204a20a2d400a68a7d911bfb0 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:56:26 +0000
Subject: [PATCH 324/551] perlPackages.ack: 3.9.0 -> 3.10.0

Fixes CVE-2026-49146. CVE-2026-49145 and CVE-2026-49147 remain unfixed
in 3.10.0.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index eb7a8f52d1ab..7cb3f4f85857 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -116,11 +116,11 @@ with self;
 
   ack = buildPerlPackage rec {
     pname = "ack";
-    version = "3.9.0";
+    version = "3.10.0";
 
     src = fetchurl {
       url = "mirror://cpan/authors/id/P/PE/PETDANCE/ack-v${version}.tar.gz";
-      hash = "sha256-lO1Hfjs/lNEmzscynw6DmfHQzoLHxNiCqUrbFQ5//JA=";
+      hash = "sha256-Zeg8+zinH8pyXpoUqCAe6HHmKfxrECMeEwPdNQG6Vjo=";
     };
 
     outputs = [

From 4114dbc5bcf69cae580a228ff22498a26b9fbe5d Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:57:55 +0000
Subject: [PATCH 325/551] perlPackages.Imager: 1.031 -> 1.034

Fixes CVE-2026-13705, CVE-2026-14454 and CVE-2026-19082.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 7cb3f4f85857..1029c4602890 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17355,10 +17355,10 @@ with self;
 
   Imager = buildPerlPackage rec {
     pname = "Imager";
-    version = "1.031";
+    version = "1.034";
     src = fetchurl {
       url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-${version}.tar.gz";
-      hash = "sha256-kL59G9/F7bfxfPgreeamYUxbAuv+Mm67b2afzaeRNAE=";
+      hash = "sha256-hrWizXGna4QJJJFSGl1WI4Qo8sN1AYMsmVxaMxJg+AM=";
     };
     buildInputs = [
       pkgs.freetype

From 0d1907cd9fc18179000472f036fff8b23b7ffa42 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 15:59:57 +0000
Subject: [PATCH 326/551] perlPackages.HTTPDate: 6.06 -> 6.08

Fixes CVE-2026-14741.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 1029c4602890..6bec15eac311 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16925,10 +16925,10 @@ with self;
 
   HTTPDate = buildPerlPackage {
     pname = "HTTP-Date";
-    version = "6.06";
+    version = "6.08";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Date-6.06.tar.gz";
-      hash = "sha256-e2hRkcasw+dz0fwCyV7h+frpT3d4MXX154wYHMktK1I=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Date-6.08.tar.gz";
+      hash = "sha256-tX2Aym2CHGlJykiydGfUWrp6nHc0ZWIwb6zKeBoAPkQ=";
     };
     propagatedBuildInputs = [ TimeDate ];
     meta = {

From dda5a5d9a982a1b411fdbdf96afdf364140f49db Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 16:38:53 +0000
Subject: [PATCH 327/551] perlPackages.Mojolicious: 9.46 -> 9.48

Fixes CVE-2026-14803 in Mojo::JSON and CVE-2026-15747.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 6bec15eac311..013ba5d8d347 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -22865,10 +22865,10 @@ with self;
 
   Mojolicious = buildPerlPackage {
     pname = "Mojolicious";
-    version = "9.46";
+    version = "9.48";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.46.tar.gz";
-      hash = "sha256-/kc9LK5tLe/pUBgCggc2VoJa0F20TwvIxIQhXi1xaqw=";
+      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.48.tar.gz";
+      hash = "sha256-Jv8EFSgR/VsaNrR9mewhnFiZW6jnsVugKzPQdwpe7pg=";
     };
     meta = {
       description = "Real-time web framework";

From d56e5a7696268bcaa4678acf321a758f9baa3221 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 16:51:31 +0000
Subject: [PATCH 328/551] perlPackages.DBI: 1.648 -> 1.651

Fixes CVE-2026-14380, CVE-2026-14739 and CVE-2026-14740 (1.650), and
CVE-2026-15043, CVE-2026-15392, CVE-2026-60081 and CVE-2026-60082 (1.651).

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 013ba5d8d347..3cc00861f57d 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -10133,11 +10133,11 @@ with self;
 
   DBI = buildPerlPackage {
     pname = "DBI";
-    version = "1.648";
+    version = "1.651";
 
     src = fetchurl {
-      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.648.tgz";
-      hash = "sha256-7yZqrWAQzi6rt+Rl69c8owILxYFQ9pib2Jwrj5usaoY=";
+      url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.651.tgz";
+      hash = "sha256-2mIaI/po4eBPrIJM/T1B6P+6sqs+umQqEkmSQui+UlM=";
     };
 
     env = lib.optionalAttrs stdenv.cc.isGNU {

From eb5ca223180217b72d0b28da37f8f41e241ff9bc Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 16:56:10 +0000
Subject: [PATCH 329/551] perlPackages.JSONXS: 4.03 -> 4.04

4.04 contains the upstream fix for CVE-2025-40928.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 .../perl-modules/JSON-XS-CVE-2025-40928.patch | 31 -------------------
 pkgs/top-level/perl-packages.nix              |  7 ++---
 2 files changed, 3 insertions(+), 35 deletions(-)
 delete mode 100644 pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch

diff --git a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch b/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
deleted file mode 100644
index f1d258c12a3d..000000000000
--- a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
+++ /dev/null
@@ -1,31 +0,0 @@
---- a/XS.xs	2025-09-06 08:34:51.376455632 -0300
-+++ b/XS.xs	2025-09-06 08:35:30.725873619 -0300
-@@ -253,16 +253,16 @@
-   // if we recurse too deep, skip all remaining digits
-   // to avoid a stack overflow attack
-   if (expect_false (--maxdepth <= 0))
--    while (((U8)*s - '0') < 10)
-+    while ((U8)(*s - '0') < 10)
-       ++s;
- 
-   for (;;)
-     {
--      U8 dig = (U8)*s - '0';
-+      U8 dig = *s - '0';
- 
-       if (expect_false (dig >= 10))
-         {
--          if (dig == (U8)((U8)'.' - (U8)'0'))
-+          if (dig == (U8)('.' - '0'))
-             {
-               ++s;
-               json_atof_scan1 (s, accum, expo, 1, maxdepth);
-@@ -282,7 +282,7 @@
-               else if (*s == '+')
-                 ++s;
- 
--              while ((dig = (U8)*s - '0') < 10)
-+              while ((dig = (U8)(*s - '0')) < 10)
-                 exp2 = exp2 * 10 + *s++ - '0';
- 
-               *expo += neg ? -exp2 : exp2;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3cc00861f57d..35fbeedb3f26 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -18646,12 +18646,11 @@ with self;
 
   JSONXS = buildPerlPackage {
     pname = "JSON-XS";
-    version = "4.03";
+    version = "4.04";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.03.tar.gz";
-      hash = "sha256-UVU29F8voafojIgkUzdY0BIdJnq5y0U6G1iHyKVrkGg=";
+      url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.04.tar.gz";
+      hash = "sha256-jv8enzBMViW1mre0IlhBX20+NoHB3atrclUYoBin9eA=";
     };
-    patches = [ ../development/perl-modules/JSON-XS-CVE-2025-40928.patch ];
     propagatedBuildInputs = [ TypesSerialiser ];
     buildInputs = [ CanaryStability ];
     meta = {

From 61d5a4891aaa93359e2d1105282f84d7f960d10d Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 9 Aug 2026 00:51:03 +0000
Subject: [PATCH 330/551] perlPackages.FileFindRule: 0.34 -> 0.35

0.35 contains the upstream fix for CVE-2011-10007.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 .../FileFindRule-CVE-2011-10007.patch         | 25 -------------------
 pkgs/top-level/perl-packages.nix              |  9 +++----
 2 files changed, 3 insertions(+), 31 deletions(-)
 delete mode 100644 pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch

diff --git a/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch b/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch
deleted file mode 100644
index dd8492c60f21..000000000000
--- a/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From ca70a73bb147549e62e74751d924b1dbb59d1707 Mon Sep 17 00:00:00 2001
-From: Stig Palmquist <stig@stig.io>
-Date: Thu, 5 Jun 2025 03:45:50 +0200
-Subject: [PATCH] Fix CVE-2011-10007
-
----
- lib/File/Find/Rule.pm | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/File/Find/Rule.pm b/lib/File/Find/Rule.pm
-index feccc76..d4dc475 100644
---- a/lib/File/Find/Rule.pm
-+++ b/lib/File/Find/Rule.pm
-@@ -420,7 +420,7 @@ sub grep {
- 
-     $self->exec( sub {
-         local *FILE;
--        open FILE, $_ or return;
-+        open FILE, '<', $_ or return;
-         local ($_, $.);
-         while (<FILE>) {
-             for my $p (@pattern) {
--- 
-2.49.0
-
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 35fbeedb3f26..f28e415e9f74 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -13634,14 +13634,11 @@ with self;
 
   FileFindRule = buildPerlPackage {
     pname = "File-Find-Rule";
-    version = "0.34";
+    version = "0.35";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RC/RCLAMP/File-Find-Rule-0.34.tar.gz";
-      hash = "sha256-fm8WzDPrHyn/Jb7lHVE/S4qElHu/oY7bLTzECi1kyv4=";
+      url = "mirror://cpan/authors/id/R/RC/RCLAMP/File-Find-Rule-0.35.tar.gz";
+      hash = "sha256-K9VWKJptRK0u50gDJYuwsAUNJG8egcqrCyY8MDrPDII=";
     };
-    patches = [
-      ../development/perl-modules/FileFindRule-CVE-2011-10007.patch
-    ];
     propagatedBuildInputs = [
       NumberCompare
       TextGlob

From d3a1694c8f48ccce9932b5b10a4c914ff82ec4e5 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 9 Aug 2026 00:56:50 +0000
Subject: [PATCH 331/551] perlPackages.CatalystAuthenticationCredentialHTTP:
 1.018 -> 1.019

1.019 contains the upstream fix for CVE-2025-40920, which uses
Crypt::SysRandom instead of Data::UUID.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index f28e415e9f74..a7b34c72bba8 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -3352,18 +3352,11 @@ with self;
 
   CatalystAuthenticationCredentialHTTP = buildPerlModule {
     pname = "Catalyst-Authentication-Credential-HTTP";
-    version = "1.018";
+    version = "1.019";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/E/ET/ETHER/Catalyst-Authentication-Credential-HTTP-1.018.tar.gz";
-      hash = "sha256-b6GBbe5kSw216gzBXF5xHcLO0gg2JavOcJZSHx1lpSk=";
+      url = "mirror://cpan/authors/id/A/AB/ABRAXXA/Catalyst-Authentication-Credential-HTTP-1.019.tar.gz";
+      hash = "sha256-7IHpbCo/ZYbqQdCI6o6AGx80ABqxnMmmXe+KOMOaW9o=";
     };
-    patches = [
-      (fetchpatch {
-        name = "CVE-2025-40920.patch";
-        url = "https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch";
-        hash = "sha256-WI6JwvY6i3KkQO9HbbSvHPX8mgM8I2cF0UTjF1D14T4=";
-      })
-    ];
     buildInputs = [
       ModuleBuildTiny
       TestException
@@ -3374,7 +3367,6 @@ with self;
       CatalystPluginAuthentication
       ClassAccessor
       CryptSysRandom
-      DataUUID
       StringEscape
     ];
     meta = {

From 7b1e682245c0c05aae0541b1697b472c7f74d578 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 9 Aug 2026 02:51:18 +0000
Subject: [PATCH 332/551] perl: 5.42.0 -> 5.42.3

5.42.3 ships the interpreter fixes and the updated dual-life modules, so
the CVE-2026-8376 patch and every vendoredPerlDistributions entry are
dropped.

perl-cross 1.6.4 has no patch set for 5.42.3, so the perl5-5.42.0 set,
which applies unchanged, is vendored under the name perl-cross expects.

- perl: CVE-2026-13221, CVE-2026-57432, CVE-2026-8376
  https://metacpan.org/release/SHAY/perl-5.42.3/view/pod/perldelta.pod

- HTTP-Tiny 0.096: CVE-2026-7010, CVE-2026-7017
  https://metacpan.org/release/HAARG/HTTP-Tiny-0.096/changes

- Socket 2.041: CVE-2026-12087
  https://metacpan.org/release/PEVANS/Socket-2.041/changes

- Storable 3.37_01: CVE-2026-57433

- Archive-Tar 3.12, Compress-Raw-Bzip2 2.218, Compress-Raw-Zlib 2.222,
  IO-Compress 2.223

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 .../interpreters/perl/CVE-2026-8376.patch     | 20 -----
 .../development/interpreters/perl/default.nix |  4 +-
 .../interpreters/perl/interpreter.nix         | 47 +---------
 .../perl/perl-cross-1.6.4--5.42.3.patch       | 86 +++++++++++++++++++
 4 files changed, 91 insertions(+), 66 deletions(-)
 delete mode 100644 pkgs/development/interpreters/perl/CVE-2026-8376.patch
 create mode 100644 pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch

diff --git a/pkgs/development/interpreters/perl/CVE-2026-8376.patch b/pkgs/development/interpreters/perl/CVE-2026-8376.patch
deleted file mode 100644
index c8ad72298178..000000000000
--- a/pkgs/development/interpreters/perl/CVE-2026-8376.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Targeted patch for CVE-2026-8376, based on 5e7f119eb2bb1181be908701f22bf7068e722f1c but avoids changes to t/re/pat_psycho.t as they do not apply cleanly.
-
-diff --git a/regcomp_study.c b/regcomp_study.c
-index b513454a4258..1602663f4b26 100644
---- a/regcomp_study.c
-+++ b/regcomp_study.c
-@@ -2784,6 +2784,13 @@ Perl_study_chunk(pTHX_
-                                                (U8 *) SvEND(data->last_found))
-                                 - (U8*)s;
-                         l -= old;
-+
-+                        if (l > 0 &&
-+                            (mincount >= SSize_t_MAX / (SSize_t)l
-+                             || old > SSize_t_MAX - mincount * (SSize_t)l)) {
-+                            FAIL("Regexp out of space");
-+                        }
-+
-                         /* Get the added string: */
-                         last_str = newSVpvn_utf8(s  + old, l, UTF);
-                         last_chrs = UTF ? utf8_length((U8*)(s + old),
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index cab0ea1a2268..6cc6f5755ac4 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -73,8 +73,8 @@ in
 rec {
   perl5 = callPackage ./interpreter.nix {
     self = perl5;
-    version = "5.42.0";
-    sha256 = "sha256-4JPvGE1/mhuXl+JGUpb1VRCtttq4hCsMPtUzKWYwltw=";
+    version = "5.42.3";
+    sha256 = "sha256-ETd0CYWDe1zfFfDPq5Miedy0NS+RL+1vwUTotPCCNic=";
     inherit passthruFun;
   };
 }
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index cdb03912b517..4b308c156f02 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -36,8 +36,6 @@ let
   commonPatches = [
     # Do not look in /usr etc. for dependencies.
     ./no-sys-dirs.patch
-
-    ./CVE-2026-8376.patch
   ]
 
   # Fix build on Solaris on x86_64
@@ -83,48 +81,7 @@ let
 
   # Inject fixed CPAN releases for bundled dual-life distributions until the
   # next perl maintenance release includes them.
-  vendoredPerlDistributions = [
-    {
-      # CVE-2026-7010
-      path = "cpan/HTTP-Tiny";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/H/HA/HAARG/HTTP-Tiny-0.094.tar.gz";
-        hash = "sha256-poQemfwbVdFd6VlHzL17dnvsxRxxAhl/qPBE333cB0M=";
-      };
-    }
-    {
-      # CVE-2026-3381, CVE-2026-4176
-      path = "cpan/Compress-Raw-Zlib";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.222.tar.gz";
-        hash = "sha256-Hf19URplVifIGBXTDTurwo+luIRV/wP4sECZ3LUShrg=";
-      };
-    }
-    {
-      # Runtime dependency of IO-Compress 2.220.
-      path = "cpan/Compress-Raw-Bzip2";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.218.tar.gz";
-        hash = "sha256-iRU+ai69pSNJSTsHT6S3VJ/x+QU952E8GKXgXFtBX6g=";
-      };
-    }
-    {
-      # CVE-2026-48962, CVE-2026-48961, CVE-2026-48959
-      path = "cpan/IO-Compress";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.220.tar.gz";
-        hash = "sha256-nZbqKR8sVO82fHOWuFfZO6GsHEsvG84T7Yo+Xz7rtic=";
-      };
-    }
-    {
-      # CVE-2026-42496, CVE-2026-42497, CVE-2026-9538
-      path = "cpan/Archive-Tar";
-      src = fetchurl {
-        url = "mirror://cpan/authors/id/B/BI/BINGOS/Archive-Tar-3.12.tar.gz";
-        hash = "sha256-ARTvObZfSfiWgoOrR3Gdfoj5jXNg/jZJvjMcf1PVgyw=";
-      };
-    }
-  ];
+  vendoredPerlDistributions = [ ];
 
   replaceVendoredPerlDistributions = lib.concatMapStringsSep "\n" (d: ''
     rm -rf ${d.path}
@@ -440,6 +397,8 @@ stdenv.mkDerivation (
       # fixes build failure due to missing d_fdopendir/HAS_FDOPENDIR configure option
       # https://github.com/arsv/perl-cross/pull/159
       ./cross-fdopendir.patch
+
+      ./perl-cross-1.6.4--5.42.3.patch
     ];
 
     depsBuildBuild = [
diff --git a/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch b/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch
new file mode 100644
index 000000000000..853fb8a667a2
--- /dev/null
+++ b/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch
@@ -0,0 +1,86 @@
+perl-cross 1.6.4 ships no patch set for perl 5.42.3. The perl5-5.42.0 set
+applies unchanged, so link it under the name perl-cross looks for. The
+links are per-file because `find cnf/diffs/perl5-$version`, which
+perl-cross uses to collect them, does not descend into a symlinked
+directory.
+
+diff --git a/cnf/diffs/perl5-5.42.3/constant.patch b/cnf/diffs/perl5-5.42.3/constant.patch
+new file mode 120000
+index 0000000..61f792a
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/constant.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/constant.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/dynaloader.patch b/cnf/diffs/perl5-5.42.3/dynaloader.patch
+new file mode 120000
+index 0000000..543415e
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/dynaloader.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/dynaloader.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/findext.patch b/cnf/diffs/perl5-5.42.3/findext.patch
+new file mode 120000
+index 0000000..94ed668
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/findext.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/findext.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/installscripts.patch b/cnf/diffs/perl5-5.42.3/installscripts.patch
+new file mode 120000
+index 0000000..6f715b4
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/installscripts.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/installscripts.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/liblist.patch b/cnf/diffs/perl5-5.42.3/liblist.patch
+new file mode 120000
+index 0000000..5037380
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/liblist.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/liblist.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/makemaker.patch b/cnf/diffs/perl5-5.42.3/makemaker.patch
+new file mode 120000
+index 0000000..cf9fc6c
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/makemaker.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/makemaker.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/posix-makefile.patch b/cnf/diffs/perl5-5.42.3/posix-makefile.patch
+new file mode 120000
+index 0000000..072ba89
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/posix-makefile.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/posix-makefile.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/test-checkcase.patch b/cnf/diffs/perl5-5.42.3/test-checkcase.patch
+new file mode 120000
+index 0000000..6ecc9bc
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/test-checkcase.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/test-checkcase.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/test-makemaker.patch b/cnf/diffs/perl5-5.42.3/test-makemaker.patch
+new file mode 120000
+index 0000000..fc6bcda
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/test-makemaker.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/test-makemaker.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/xconfig.patch b/cnf/diffs/perl5-5.42.3/xconfig.patch
+new file mode 120000
+index 0000000..87ac501
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/xconfig.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/xconfig.patch
+\ No newline at end of file

From d4db41d8bfa5e92019bdf43e5a932f600224afef Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 9 Aug 2026 05:58:49 +0000
Subject: [PATCH 333/551] perlPackages.Yancy: skip tests broken by Mojolicious
 9.48

Mojolicious 9.48 enforces CSRF token validation (CVE-2026-15747); these
tests drive forms without a token and fail with 400 "CSRF token failure".

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index a7b34c72bba8..918a76d21803 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -39604,6 +39604,11 @@ with self;
       MojoliciousPluginOpenAPI
       RoleTiny
     ];
+    # Mojolicious 9.48 enforces CSRF token validation (CVE-2026-15747); these
+    # tests drive forms without a token and fail with 400 "CSRF token failure".
+    preCheck = ''
+      rm t/plugin/auth/github.t t/plugin/form/bootstrap4.t
+    '';
     meta = {
       homepage = "http://preaction.me/yancy/";
       description = "Best Web Framework Deserves the Best CMS";

From 709e8699ab3e17bfdaf02e11cf0e8e2996491360 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 9 Aug 2026 18:59:53 +0000
Subject: [PATCH 334/551] perl: fix CVE-2026-15534

Apply upstream commits 568e6fd238867bb9e99fa3f47cba3169009239e0 and
54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 .../interpreters/perl/CVE-2026-15534-1.patch  | 39 ++++++++++++
 .../interpreters/perl/CVE-2026-15534-2.patch  | 59 +++++++++++++++++++
 .../interpreters/perl/interpreter.nix         |  3 +
 3 files changed, 101 insertions(+)
 create mode 100644 pkgs/development/interpreters/perl/CVE-2026-15534-1.patch
 create mode 100644 pkgs/development/interpreters/perl/CVE-2026-15534-2.patch

diff --git a/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch b/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch
new file mode 100644
index 000000000000..fc8ee2f29ea9
--- /dev/null
+++ b/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch
@@ -0,0 +1,39 @@
+CVE-2026-15534, upstream commit
+568e6fd238867bb9e99fa3f47cba3169009239e0.
+
+diff --git a/regexec.c b/regexec.c
+index 35a727459c4a..29aa73c13cb9 100644
+--- a/regexec.c
++++ b/regexec.c
+@@ -9211,7 +9211,8 @@ NULL
+                     reginfo->poscache_iter = reginfo->poscache_maxiter;
+                 }
+ 
+-                if (reginfo->poscache_iter-- == 0) {
++                if (reginfo->poscache_iter == 1) {
++                    reginfo->poscache_iter--;
+                     /* initialise cache */
+                     const SSize_t size = (reginfo->poscache_maxiter + 7)/8;
+                     regmatch_info_aux *const aux = reginfo->info_aux;
+@@ -9232,11 +9233,10 @@ NULL
+                     );
+                 }
+ 
+-                if (reginfo->poscache_iter < 0) {
++                if (reginfo->poscache_iter == 0) {
+                     /* have we already failed at this position? */
+                     SSize_t offset, mask;
+ 
+-                    reginfo->poscache_iter = -1; /* stop eventual underflow */
+                     offset  = (FLAGS(scan) & 0xf) - 1
+                                 +   (locinput - reginfo->strbeg)
+                                   * (FLAGS(scan)>>4);
+@@ -9252,6 +9252,8 @@ NULL
+                     ST.cache_offset = offset;
+                     ST.cache_mask   = mask;
+                 }
++                else
++                    reginfo->poscache_iter--;
+             }
+ 
+             /* Prefer B over A for minimal matching. */
diff --git a/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch b/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch
new file mode 100644
index 000000000000..b5d0ff5ed3d0
--- /dev/null
+++ b/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch
@@ -0,0 +1,59 @@
+CVE-2026-15534, upstream commit
+54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.
+
+diff --git a/regexec.c b/regexec.c
+index 29aa73c13cb9..66e0c0924059 100644
+--- a/regexec.c
++++ b/regexec.c
+@@ -9202,22 +9202,27 @@ NULL
+                 if (!reginfo->poscache_maxiter) {
+                     /* start the countdown: Postpone detection until we
+                      * know the match is not *that* much linear. */
+-                    reginfo->poscache_maxiter
+-                        =    (reginfo->strend - reginfo->strbeg + 1)
+-                           * (FLAGS(scan)>>4);
+-                    /* possible overflow for long strings and many CURLYX's */
+-                    if (reginfo->poscache_maxiter < 0)
+-                        reginfo->poscache_maxiter = I32_MAX;
+-                    reginfo->poscache_iter = reginfo->poscache_maxiter;
++                    STRLEN len = reginfo->strend - reginfo->strbeg;
++                    /* number of participating WHILEMs */
++                    U8 n = (FLAGS(scan)>>4);
++
++                    /* Only do the calculations and enable the cache if it
++                     * won't overflow. This test is equivalent to:
++                     *    ((len + 1) * n  + 7) <= max(STRLEN)
++                     */
++                    if (len < ((~(STRLEN)0) - 7)/n) {
++                        reginfo->poscache_maxiter = (len + 1) * n;
++                        reginfo->poscache_iter = reginfo->poscache_maxiter;
++                    }
+                 }
+ 
+                 if (reginfo->poscache_iter == 1) {
+                     reginfo->poscache_iter--;
+                     /* initialise cache */
+-                    const SSize_t size = (reginfo->poscache_maxiter + 7)/8;
++                    const STRLEN size = (reginfo->poscache_maxiter + 7)/8;
+                     regmatch_info_aux *const aux = reginfo->info_aux;
+                     if (aux->poscache) {
+-                        if ((SSize_t)reginfo->poscache_size < size) {
++                        if (reginfo->poscache_size < size) {
+                             Renew(aux->poscache, size, char);
+                             reginfo->poscache_size = size;
+                         }
+diff --git a/regexp.h b/regexp.h
+index 057d9ac5011b..d5d40e0a5618 100644
+--- a/regexp.h
++++ b/regexp.h
+@@ -839,8 +839,8 @@ typedef struct {
+     char *cutpoint;      /* (*COMMIT) position (if any) */
+     regmatch_info_aux      *info_aux; /* extra fields that need cleanup */
+     regmatch_info_aux_eval *info_aux_eval; /* extra saved state for (?{}) */
+-    I32  poscache_maxiter; /* how many whilems todo before S-L cache kicks in */
+-    I32  poscache_iter;    /* current countdown from _maxiter to zero */
++    STRLEN poscache_maxiter; /* how many whilems todo before S-L cache kicks in */
++    STRLEN poscache_iter;    /* current countdown from _maxiter to zero */
+     STRLEN poscache_size;  /* size of regmatch_info_aux.poscache */
+     bool intuit;    /* re_intuit_start() is the top-level caller */
+     bool is_utf8_pat;    /* regex is utf8 */
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index 4b308c156f02..ae75db2ead90 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -36,6 +36,9 @@ let
   commonPatches = [
     # Do not look in /usr etc. for dependencies.
     ./no-sys-dirs.patch
+
+    ./CVE-2026-15534-1.patch
+    ./CVE-2026-15534-2.patch
   ]
 
   # Fix build on Solaris on x86_64

From e9b237a50342589b5977481e38c8b6390542f8a6 Mon Sep 17 00:00:00 2001
From: Sergei Volkov <taranarmo@gmail.com>
Date: Tue, 18 Aug 2026 13:02:26 +0200
Subject: [PATCH 335/551] python3Packages.smmap: 6.0.0 -> 5.0.3

The upstream development is continued on 5.x branch with latest release
5.0.3 in 2026 while the 6.0.0 was released in 2023.
The 6.0.0 is marked as yanked on PyPi and replaced by non-breaking 5.0.1

https://pypi.org/project/smmap/#history
https://pypi.org/project/smmap/6.0.0/
---
 pkgs/development/python-modules/smmap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/smmap/default.nix b/pkgs/development/python-modules/smmap/default.nix
index 27ae1788145f..a9d20b2e2bbc 100644
--- a/pkgs/development/python-modules/smmap/default.nix
+++ b/pkgs/development/python-modules/smmap/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "smmap";
-  version = "6.0.0";
+  version = "5.0.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jXkCjqbMEx2l6rCZpdlamY1DxneZVv/+O0VQQJEQdto=";
+    hash = "sha256-TZ3ruLmQB65HFlq8CGcL10y3S1In3af2Q+zMTp61ZCw=";
   };
 
   build-system = [ setuptools ];

From 3b59449299452c19a73f7260c08e689f963477ea Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Sun, 16 Aug 2026 20:31:14 +0200
Subject: [PATCH 336/551] gst_all_1.gst-libav: refactor mesonFlags

---
 pkgs/development/libraries/gstreamer/libav/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 0d637b250465..f9cabab17180 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -56,9 +56,10 @@ stdenv.mkDerivation (finalAttrs: {
     apple-sdk_gstreamer
   ];
 
-  mesonFlags = [
-    (lib.mesonEnable "doc" enableDocumentation)
-  ];
+  mesonFlags = lib.mapAttrsToList lib.mesonEnable {
+    doc = enableDocumentation;
+    tests = finalAttrs.finalPackage.doCheck;
+  };
 
   postPatch = ''
     patchShebangs \

From c1e1f95922c21517f26ff12aa9773b3b94b5ff1e Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Sun, 16 Aug 2026 21:38:22 +0200
Subject: [PATCH 337/551] gst_all_1.gst-libav: remove unused -dev output

---
 pkgs/development/libraries/gstreamer/libav/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index f9cabab17180..6dc5f3abd6e4 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -21,11 +21,6 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "gst-libav";
   version = "1.28.6";
 
-  outputs = [
-    "out"
-    "dev"
-  ];
-
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${finalAttrs.version}.tar.xz";
     hash = "sha256-cebq+0//KmbRuwuo0HgiTf5+M5cwfYwLuj3CNgbgj1E=";

From ddd5b41e787fe88f5efeeaa73c025a34a28d027d Mon Sep 17 00:00:00 2001
From: Patrick Rauscher <prauscher@prauscher.de>
Date: Sat, 15 Aug 2026 10:32:34 +0200
Subject: [PATCH 338/551] maintainers: add prauscher

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ed1f2c3b5540..d22bcea914a1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22936,6 +22936,12 @@
     name = "Pradyuman Vig";
     keys = [ { fingerprint = "240B 57DE 4271 2480 7CE3  EAC8 4F74 D536 1C4C A31E"; } ];
   };
+  prauscher = {
+    email = "prauscher@prauscher.de";
+    github = "prauscher";
+    githubId = 175521;
+    name = "Patrick Rauscher";
+  };
   preisschild = {
     email = "florian@florianstroeger.com";
     github = "Preisschild";

From a868c5fdc77523374076bb59a9aabd442dca4db8 Mon Sep 17 00:00:00 2001
From: Patrick Rauscher <prauscher@prauscher.de>
Date: Sun, 14 Dec 2025 11:22:51 +0100
Subject: [PATCH 339/551] rtl_wmbus: init at d2be82c

---
 pkgs/by-name/rt/rtl_wmbus/package.nix | 62 +++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 pkgs/by-name/rt/rtl_wmbus/package.nix

diff --git a/pkgs/by-name/rt/rtl_wmbus/package.nix b/pkgs/by-name/rt/rtl_wmbus/package.nix
new file mode 100644
index 000000000000..0d49843d11bd
--- /dev/null
+++ b/pkgs/by-name/rt/rtl_wmbus/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  pname = "rtl-wmbus";
+  version = "1.1.0";
+  src = fetchFromGitHub {
+    owner = "xaelsouth";
+    repo = "rtl-wmbus";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-T8cYRkj7w4nAtcPvDkpPTwbDPXUr1qYZtyDtTjHWDMA=";
+
+    # need to fetch revision from git
+    leaveDotGit = true;
+    postFetch = ''
+      # avoid having the whole .git-folder
+      substituteInPlace $out/Makefile --replace-fail "COMMIT_HASH?=\$(shell git log --pretty=format:'%H' -n 1)" "COMMIT_HASH:=$(git -C $out log --pretty=format:'%H' -n 1)"
+
+      rm -rf $out/.git
+    '';
+  };
+
+  # avoid reading the version from git to avoid fetching all tags
+  makeFlags = [
+    "TAG=${finalAttrs.version}"
+    "BRANCH="
+    "CHANGES="
+  ];
+
+  # make install would use /usr/bin
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp build/rtl_wmbus $out/bin
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Software defined receiver for Wireless-M-Bus with RTL-SDR";
+    homepage = "https://github.com/xaelsouth/rtl-wmbus";
+    license = lib.licenses.bsd2;
+    mainProgram = "rtl_wmbus";
+    maintainers = with lib.maintainers; [
+      prauscher
+    ];
+  };
+})

From b8d37bb12fe105e82909caf0b160d3dbb1d54475 Mon Sep 17 00:00:00 2001
From: Eric Berquist <eric.berquist@gmail.com>
Date: Tue, 18 Aug 2026 10:55:55 -0400
Subject: [PATCH 340/551] python3Packages.monty: 2025.3.3 -> 2026.7.16

---
 .../python-modules/monty/default.nix          | 69 +++++++++----------
 1 file changed, 34 insertions(+), 35 deletions(-)

diff --git a/pkgs/development/python-modules/monty/default.nix b/pkgs/development/python-modules/monty/default.nix
index 1ee9626ab6e5..71540c34181e 100644
--- a/pkgs/development/python-modules/monty/default.nix
+++ b/pkgs/development/python-modules/monty/default.nix
@@ -9,42 +9,47 @@
   setuptools-scm,
 
   # dependencies
-  msgpack,
+  numpy,
   ruamel-yaml,
 
   # optional-dependencies
-  coverage,
+  invoke,
+  ipython,
+  msgpack,
+  mypy,
+  myst-parser,
+  orjson,
+  pandas,
+  pint,
+  pydantic,
   pymongo,
   pytest,
   pytest-cov,
-  types-requests,
+  requests,
+  roman-numerals,
+  ruff,
   sphinx,
+  sphinx-markdown-builder,
   sphinx-rtd-theme,
-  orjson,
-  pandas,
-  pydantic,
-  pint,
   torch,
   tqdm,
-  invoke,
-  requests,
+  uv,
 
   # tests
-  ipython,
-  numpy,
   pytestCheckHook,
+  pytest-benchmark,
 }:
 
 buildPythonPackage rec {
   pname = "monty";
-  version = "2025.3.3";
+  version = "2026.7.16";
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "materialsvirtuallab";
+    owner = "materialyzeai";
     repo = "monty";
     tag = "v${version}";
-    hash = "sha256-3UoACKJtPm2BrkJP8z7BFrh3baRyL/S3VwCG3K8AQn0=";
+    hash = "sha256-x5FNw7E3rtrgCWVhMsBpnO+uwu+mB3ELNFdd33+uFds=";
   };
 
   build-system = [
@@ -53,53 +58,47 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    msgpack
+    numpy
     ruamel-yaml
   ];
 
   optional-dependencies = rec {
     ci = [
-      coverage
-      pymongo
+      mypy
       pytest
       pytest-cov
-      types-requests
+      ruff
+      uv
     ]
     ++ optional;
     dev = [ ipython ];
     docs = [
       sphinx
       sphinx-rtd-theme
+      requests
+      invoke
+      myst-parser
+      sphinx-markdown-builder
+      roman-numerals
     ];
     json = [
       orjson
       pandas
+      pint
       pydantic
       pymongo
-    ]
-    ++ lib.optionals (pythonOlder "3.13") [
-      pint
       torch
     ];
     multiprocessing = [ tqdm ];
     optional = dev ++ json ++ multiprocessing ++ serialization;
     serialization = [ msgpack ];
-    task = [
-      invoke
-      requests
-    ];
   };
 
   nativeCheckInputs = [
-    ipython
-    numpy
-    pandas
-    pydantic
-    pymongo
     pytestCheckHook
-    torch
-    tqdm
-  ];
+    pytest-benchmark
+  ]
+  ++ optional-dependencies.optional;
 
   pythonImportsCheck = [ "monty" ];
 
@@ -110,8 +109,8 @@ buildPythonPackage rec {
       standard library. Examples include useful utilities like transparent support for zipped files, useful design
       patterns such as singleton and cached_class, and many more.
     ";
-    homepage = "https://github.com/materialsvirtuallab/monty";
-    changelog = "https://github.com/materialsvirtuallab/monty/releases/tag/${src.tag}";
+    homepage = "https://github.com/materialyzeai/monty";
+    changelog = "https://github.com/materialyzeai/monty/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ psyanticy ];
   };

From f7f53f59dfe9a97d1b17ff847470936b0ed8bbfb Mon Sep 17 00:00:00 2001
From: Eric Berquist <eric.berquist@gmail.com>
Date: Tue, 18 Aug 2026 14:22:00 -0400
Subject: [PATCH 341/551] python3Packages.monty: add myself as maintainer

---
 pkgs/development/python-modules/monty/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/monty/default.nix b/pkgs/development/python-modules/monty/default.nix
index 71540c34181e..1fc1a269a5d8 100644
--- a/pkgs/development/python-modules/monty/default.nix
+++ b/pkgs/development/python-modules/monty/default.nix
@@ -112,6 +112,9 @@ buildPythonPackage rec {
     homepage = "https://github.com/materialyzeai/monty";
     changelog = "https://github.com/materialyzeai/monty/releases/tag/${src.tag}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ psyanticy ];
+    maintainers = with lib.maintainers; [
+      psyanticy
+      berquist
+    ];
   };
 }

From d065e27a7024f2c0b94977b92072f4034c414667 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 16 Aug 2026 03:33:14 +0000
Subject: [PATCH 342/551] systemd: 261.1 -> 261.2

---
 pkgs/os-specific/linux/systemd/default.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 6a7b4b0b7475..d7994b8270e3 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -5,6 +5,7 @@
   pkgsCross,
   testers,
   fetchFromGitHub,
+  fetchpatch,
   buildPackages,
   makeBinaryWrapper,
   ninja,
@@ -203,13 +204,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "261.1";
+  version = "261.2";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4iOitWGdRmGgJjEXGWtq2lEhPtGguma+qrjTShrps2g=";
+    hash = "sha256-w0Fxx+zYBs806whyaKBytGwSgn89ARdukAm6Hp+XlQQ=";
   };
 
   # PATCH POLICY
@@ -239,6 +240,13 @@ stdenv.mkDerivation (finalAttrs: {
     ./0003-add-rootprefix-to-lookup-dir-paths.patch
     ./0004-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
     ./0005-core-don-t-taint-on-unmerged-usr.patch
+    # Remove this with v262
+    # Fixes an issue for switch-to-configuration
+    (fetchpatch {
+      name = "postpone-d-bus-queue-dispatch.patch";
+      url = "https://github.com/systemd/systemd/commit/266b3e50218e2b27cd67d2371c165bf53ad3bf00.patch";
+      hash = "sha256-dEEzZUqicnmgDuXVBV1y0BxzgKbb6Q47Dmxj+O71bFE=";
+    })
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch

From d07615172cfad0be007e8c6d42d4731e82b2190f Mon Sep 17 00:00:00 2001
From: Leon Klingele <git@leonklingele.de>
Date: Wed, 19 Aug 2026 18:54:00 +0200
Subject: [PATCH 343/551] go_1_26: 1.26.6 -> 1.26.7

---
 pkgs/development/compilers/go/1.26.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.26.nix b/pkgs/development/compilers/go/1.26.nix
index 9f52b27211ef..ccb5b67f17af 100644
--- a/pkgs/development/compilers/go/1.26.nix
+++ b/pkgs/development/compilers/go/1.26.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.26.6";
+  version = "1.26.7";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-oHIcVMaIkBRI13rZs+x+p8R0cwdV/4kTgukuy5P/LLE=";
+    hash = "sha256-DtJOrHVRBQhbif6cq8J0K5GgrXuUtZ0602SRjryJVq0=";
   };
 
   strictDeps = true;

From 42cfbb8ab7cf8bf2a446395125328393067addb4 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 19 Aug 2026 20:10:48 +0300
Subject: [PATCH 344/551] qt6: 6.11.1 -> 6.11.2

---
 pkgs/development/libraries/qt-6/fetch.sh      |   2 +-
 .../qt-6/modules/qtdeclarative/default.nix    |  23 --
 .../libraries/qt-6/modules/qtmqtt.nix         |   4 +-
 pkgs/development/libraries/qt-6/srcs.nix      | 336 +++++++++---------
 4 files changed, 171 insertions(+), 194 deletions(-)

diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index bd94b3ae2c48..e97e92bf7f8c 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.1/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.2/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 113d717a5f6e..786229c5651b 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -43,29 +43,6 @@ qtModule {
       hash = "sha256-ESy35OlmsvI4yFQ/rFT8oelOUBCwCmlcbQJvwcTrCig=";
       revert = true;
     })
-
-    # backport fix recommended by KDE
-    (fetchpatch {
-      url = "https://github.com/qt/qtdeclarative/commit/8a2c82be6ad90e3f2a0760d8bab1e3a8cdb2473a.diff";
-      hash = "sha256-3KbyoQPAiRyCwGnwwYV3y0yz2i6UAJcX70EPsXV0ZZM=";
-    })
-
-    # backport required at least for [musescore][1], and perhaps many other
-    # applications.
-    # [1]: https://github.com/musescore/MuseScore/issues/33015
-    (fetchpatch {
-      url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.diff";
-      hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA=";
-    })
-
-    # backport fix for a QV4 heap corruption crash on JS objects with
-    # add/delete/re-add property churn (QTBUG-147153); crashes e.g.
-    # quickshell-based shells like noctalia-shell
-    # https://bugreports.qt.io/browse/QTBUG-147153
-    (fetchpatch {
-      url = "https://github.com/qt/qtdeclarative/commit/624e90bb5e89837d4b759b43e2120b059d98a41e.diff";
-      hash = "sha256-7duTYpHZusVNDMlkm19dCppEWBejjTbc0sy3QvJG65s=";
-    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index c70d2cbd1f88..b5e6c6bc6e19 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -6,13 +6,13 @@
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.11.1";
+  version = "6.11.2";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     tag = "v${version}";
-    hash = "sha256-GWaF4iCPtATL1mJkPHVY0rom8R2FMNWGahE3KWBlfV8=";
+    hash = "sha256-Xg4vfVfYgruRXB6LSWFJWSMtsClJMtML+KhaQExWUGs=";
   };
 
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 93c206858d18..c6688d20db77 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,339 +4,339 @@
 
 {
   qt3d = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt3d-everywhere-src-6.11.1.tar.xz";
-      sha256 = "01q11bs7vjz1s5wdrdjq904dgl2m6l7r8d3vd2kyf7lx0j78qvd6";
-      name = "qt3d-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qt3d-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0adczdz74mlmrb8w7hzjln1902isn7bgfbzpr1r18wasg6j8a4a1";
+      name = "qt3d-everywhere-src-6.11.2.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt5compat-everywhere-src-6.11.1.tar.xz";
-      sha256 = "06qndy534rzabxk9yq07dsl8fj1vd72lmck11r5xbajil3d9zjyg";
-      name = "qt5compat-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qt5compat-everywhere-src-6.11.2.tar.xz";
+      sha256 = "11s225zq0hskkq61rrfhy65aqzdny7np00c75ngnl2ci6gz21hv8";
+      name = "qt5compat-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtactiveqt-everywhere-src-6.11.1.tar.xz";
-      sha256 = "05hcnhxkajry4ha7ykmqr83p16qjipspwxid8l2rxgz80wy6aadv";
-      name = "qtactiveqt-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtactiveqt-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0g3ak3jmh4fqjl0xh3vcj7hlw7k7902b2arqxa304hmh1s0dmblx";
+      name = "qtactiveqt-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtbase = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtbase-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1b616gr7k8byfr2ns4vczs4kj3sznhlrlw9inpb3m8la48qllnfr";
-      name = "qtbase-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtbase-everywhere-src-6.11.2.tar.xz";
+      sha256 = "08ng4gns21a3za3qszzw3yp3a2pxipma1zrl870xi97mrbn00bjv";
+      name = "qtbase-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtcanvaspainter = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1l08zp68q3wcr9v5hh82kw6jqvc1wmnrjn7h9959psx520dwcdly";
-      name = "qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtcanvaspainter-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0q77hc83ynvnagwxa9z0j9rwvlzmyig06kklb7v5zvyfa1ra544a";
+      name = "qtcanvaspainter-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcharts-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0p2icmrwb6am7x2kgk9pnpa8ypi7jiscyaawgi0x31iaihqyvqrz";
-      name = "qtcharts-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtcharts-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0agvnva90diqvllfvrd1smicar6nlv5pjqvwjfg509fih4xyasah";
+      name = "qtcharts-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtconnectivity-everywhere-src-6.11.1.tar.xz";
-      sha256 = "14g5h0wixqy981cnn5f8gkjbji804f18gfjkzbanxd0lljg2h191";
-      name = "qtconnectivity-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtconnectivity-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0dv0bqlvfdphk2a5pzq7fm222h6zvy87k18aaamq7585pmbimc45";
+      name = "qtconnectivity-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdatavis3d-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1b4kcqfq5q79lm70f08qiksxl36laa9dgx9ladjk2xwl1af7n6hy";
-      name = "qtdatavis3d-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdatavis3d-everywhere-src-6.11.2.tar.xz";
+      sha256 = "07b61fkdzkhv3hfa7r6vfadd72bnyk4cgqwws5ns3y6nqlcnjknj";
+      name = "qtdatavis3d-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdeclarative-everywhere-src-6.11.1.tar.xz";
-      sha256 = "193ar0fcfzjjr7mi8i2622vip95qrr3qry949d9lyc5hf3v71rjj";
-      name = "qtdeclarative-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdeclarative-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0c5lqr8kbrfvaxh147d92vqbcirw7wj94sxwx8ih2f3ya5q7nnr1";
+      name = "qtdeclarative-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdoc-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1hd5z6prx2sbr3wxzkynrn2iyjllvkids505l2xg3p272j4b5306";
-      name = "qtdoc-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdoc-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1dsfnlsk0kihz55fnmyrybya9x3s88nam9jfpb5g68vk4n9if9sn";
+      name = "qtdoc-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgraphs-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0qh43qxqg4biyrrsd78nmi4dm3dnbswa95cq8db2k3lans517cc4";
-      name = "qtgraphs-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtgraphs-everywhere-src-6.11.2.tar.xz";
+      sha256 = "08cbzc0146j4d18dlqsw0qbilhcwk1hi9h8n84adsigs9a2hj8cz";
+      name = "qtgraphs-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgrpc-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0l52w91hd2crq6zyh5a8arv07yixnwcr2pya74bxpk2hqpq08ys3";
-      name = "qtgrpc-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtgrpc-everywhere-src-6.11.2.tar.xz";
+      sha256 = "14xdchng4sn90r2cva7wxrqlyzncpwkj11gscm4z73q5y0blcha4";
+      name = "qtgrpc-everywhere-src-6.11.2.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qthttpserver-everywhere-src-6.11.1.tar.xz";
-      sha256 = "01p7li9fvwnz2shx3d9wj9nnnnipya2q0whchyvgjqb8yzy71gq4";
-      name = "qthttpserver-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qthttpserver-everywhere-src-6.11.2.tar.xz";
+      sha256 = "13mxwy5h41c96ykdkxlxcdf2pqv2gswyvyzxrzsj13x55cxpdxgh";
+      name = "qthttpserver-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtimageformats-everywhere-src-6.11.1.tar.xz";
-      sha256 = "04y4pa5krrpyiqn039d6m8bzcxj6pa1m850rz3bmw5xc8ml6rgxj";
-      name = "qtimageformats-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtimageformats-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1y0123s8hry81059w8x46fv0i0425zv99g09cc3m0rabyc08kkff";
+      name = "qtimageformats-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlanguageserver-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1vwavpi8swgs88pfjfddnb9cmsb4k1sjcgywp2rsnm6ay8vqa02h";
-      name = "qtlanguageserver-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlanguageserver-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0ppw27jsqsih48sd0iizfc2jwsxya8z0a9vjjaqhxjplxir45g1q";
+      name = "qtlanguageserver-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlocation-everywhere-src-6.11.1.tar.xz";
-      sha256 = "06z4hbiqki5chhmph131s71czyrjpnjvy3rxb4560vwy55vwx49p";
-      name = "qtlocation-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlocation-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0fn2clzz2wmc3lwzqlkwk07scvmmdhim1ihpxkv7dg8zw3nafl2d";
+      name = "qtlocation-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlottie-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0y969gp64imwh49d5zbnw0wi2yva9fsp6qn58617rs9kvkdzml70";
-      name = "qtlottie-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlottie-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0lj8a90frd265waypkwghabj0r9h5p6vh1dlrjksksyr2qkp2g7m";
+      name = "qtlottie-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtmultimedia-everywhere-src-6.11.1.tar.xz";
-      sha256 = "02lvq1jk6m67m6z0w7vdzxhzmi441j8avvp79mfclfpfvm98w3rr";
-      name = "qtmultimedia-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtmultimedia-everywhere-src-6.11.2.tar.xz";
+      sha256 = "17yd17qm0jxfimkqs843z5m86ciif1pcs8h66vdkqybbxh15wywn";
+      name = "qtmultimedia-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtnetworkauth-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0gan2qjv97d1387jqaiis2gigm6lz5jbk1k10x13w0yc5kr5n7cz";
-      name = "qtnetworkauth-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtnetworkauth-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0nx03zab9jrzkrwali45czswlniwbh0v0nx17wwj8y5bfwqc50qc";
+      name = "qtnetworkauth-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtopenapi = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtopenapi-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0nzl95w5pbfd6mfb6rzv6arz09pcm6siz1n07pgm9rrdr6z083a4";
-      name = "qtopenapi-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtopenapi-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1873byinl4ikm3bncz869fjhn1z2jwj9s0bg3h9ncnn4kl0fp74b";
+      name = "qtopenapi-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtpositioning-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1xbq1xjjbhb41lfp9mli8a5rgqf5pniswv0161v6wa5f04cbkrnm";
-      name = "qtpositioning-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtpositioning-everywhere-src-6.11.2.tar.xz";
+      sha256 = "16blmv0plbh0l214q6phfp7jb18201cyqk66v8555cd38fnibkyq";
+      name = "qtpositioning-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3d-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0vs5bcz62r32gin0g4lb6wdmqrv0ypzar1s9wsza98la7zg8asy7";
-      name = "qtquick3d-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquick3d-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1d1pcy9ipjsipczrassn6h9jq2bx7v1457fg6wx3f9nvivqf3f1s";
+      name = "qtquick3d-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1bvrmjb6m0ynq00ybdghvkbmwm237vff23ng8n4njysf05pns26i";
-      name = "qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquick3dphysics-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0vmqvr68qq0caglackln225xj3p8srdycykw3m44iz458b7j8nhw";
+      name = "qtquick3dphysics-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0sqk8hkkdibv0ayxrvpcbgj3dcwfngpd6qjp2xm15pcbx1q3xrng";
-      name = "qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquickeffectmaker-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1dswhg102b09x3p3iyldmwkhnkphcisl4jp2dbisacz9hirdq8vr";
+      name = "qtquickeffectmaker-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquicktimeline-everywhere-src-6.11.1.tar.xz";
-      sha256 = "09wcx83yxif8r4v81h2jfj3wlj60wnc9k4dsp7hlah4yzm1zclxg";
-      name = "qtquicktimeline-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquicktimeline-everywhere-src-6.11.2.tar.xz";
+      sha256 = "05qxi1gqv02af28rlzlbmxc4v939i920gqblvrfh9i50002z22i5";
+      name = "qtquicktimeline-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtremoteobjects-everywhere-src-6.11.1.tar.xz";
-      sha256 = "06hiiyjpcgn8dp9jmgxj30nlrw73rqb869f0m63scccmqsarhqj0";
-      name = "qtremoteobjects-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtremoteobjects-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1zbwg7pzswibjjx2vgcl3r4v47xhdwk0c9bik8bv3hlyg60rc32y";
+      name = "qtremoteobjects-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtscxml-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0gr0j09isxgii3aivfvr35x40d9n0kj0g2icc7g7bzniwm2m4jcf";
-      name = "qtscxml-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtscxml-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1zrmxhf2a58dynbxij08vxa6x7b6jllcfwvrhlhgpgzqlyxw957m";
+      name = "qtscxml-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsensors-everywhere-src-6.11.1.tar.xz";
-      sha256 = "13ygry3lybkgci6gkrd7k081l01icavzkiyy4g82drbvv9i70q93";
-      name = "qtsensors-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtsensors-everywhere-src-6.11.2.tar.xz";
+      sha256 = "069ij142dvh4spqp9584pfqqj8265x659xb35wcf5s1jzd6y9j38";
+      name = "qtsensors-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialbus-everywhere-src-6.11.1.tar.xz";
-      sha256 = "02pj4jnxc4afl5ymv7w8asggpg0hdj3dbnwwcqd305b8il69qv64";
-      name = "qtserialbus-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtserialbus-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1h9nvwhbfhb5js0458ha653n04d46m70j4gh8gn4bc7njnxcj1lg";
+      name = "qtserialbus-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialport-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0x1r5l3kx7riprf0b2api0bcg0z755fq9vbgmx7px6pxiy4imwws";
-      name = "qtserialport-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtserialport-everywhere-src-6.11.2.tar.xz";
+      sha256 = "13md2wdypib4wjw3mai8hqfyjjs4l67232dnxjr32ks42qv76fnz";
+      name = "qtserialport-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtshadertools-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1z42r414jid12jmhm1yf5kw44j886w01igav0kggkg13kcphax90";
-      name = "qtshadertools-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtshadertools-everywhere-src-6.11.2.tar.xz";
+      sha256 = "070b41mzqf1b7xnxn2mh7ap79s2702a7bcwhd1c6axkmnyw4cl40";
+      name = "qtshadertools-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtspeech-everywhere-src-6.11.1.tar.xz";
-      sha256 = "051z4yf22hkqhy3pkgxq8s77x06k4cd70i9jcmd8f99004cc6df0";
-      name = "qtspeech-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtspeech-everywhere-src-6.11.2.tar.xz";
+      sha256 = "166bqmcffdncyr64zw4h99c9ng19nk30ys371br4j03ikpf0a7cw";
+      name = "qtspeech-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsvg-everywhere-src-6.11.1.tar.xz";
-      sha256 = "154adaicyy5wyz6yc95g3lm4iw9v2zdsd7l5qp107gr490pz0g3z";
-      name = "qtsvg-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtsvg-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0xhq64622f6iz42xj4dn0jjgs4jwd9gbi1zyczxjck58xizk756m";
+      name = "qtsvg-everywhere-src-6.11.2.tar.xz";
     };
   };
   qttasktree = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttasktree-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1mjdwy3i24ggn2g82z5pg3grzhnaxmq7nmvdc7ba8dsdixzvjam2";
-      name = "qttasktree-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttasktree-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1n1yq8hws4yq0raanfkjj2r4z671mic2dspg2p6sc5hny292jxn0";
+      name = "qttasktree-everywhere-src-6.11.2.tar.xz";
     };
   };
   qttools = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttools-everywhere-src-6.11.1.tar.xz";
-      sha256 = "03gmr9zpf0raqcvqk2cpw9lblw907hsl5cb5c2fgm4wwcxd86qcf";
-      name = "qttools-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttools-everywhere-src-6.11.2.tar.xz";
+      sha256 = "07h4nhk02izczi1wz6dh7gab84vzk7rkm30wwq4pwbsibkrmm9wy";
+      name = "qttools-everywhere-src-6.11.2.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttranslations-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0xsnxhiqc3ybwvyn1jbhdf1sjmcf7v4mma6w9sxwg535420jrh1p";
-      name = "qttranslations-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttranslations-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0560cyg3j4fcsq7ikb7rraa8g5ymi9lscmmhqfmryylklz0q85h2";
+      name = "qttranslations-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
-      sha256 = "073y02qmpwxxdqc4pkm6k9frghsjg1zppg2hip5b4hv269xrdim1";
-      name = "qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtvirtualkeyboard-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0bvwci70c4ng5zgzj621a723p22v58cmzbprbz6llkjw99rjcsjc";
+      name = "qtvirtualkeyboard-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwayland-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1cyr5frhglp2krxvpnqk9q426rgp6nr34ngnxpa42m7p0ajqly4m";
-      name = "qtwayland-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwayland-everywhere-src-6.11.2.tar.xz";
+      sha256 = "1pzr4a11dmlbpzfgcm7z95cvnm2r5pq71pg80vsi0aik75g63dwf";
+      name = "qtwayland-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebchannel-everywhere-src-6.11.1.tar.xz";
-      sha256 = "10ld2nh6gd1v2ssbgqlf6w0lsjlqkjdfwqv85mn5krnnf45vbyv9";
-      name = "qtwebchannel-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebchannel-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0pspql8j7yxjvvxwibavb4kw5lidh6a62rcjqbq8ga5xb2bi9czy";
+      name = "qtwebchannel-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebengine-everywhere-src-6.11.1.tar.xz";
-      sha256 = "10vhcvw8j60n0mf38bi3fjcx5v1i0cbfyn4wbqhzqn61qv66d737";
-      name = "qtwebengine-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebengine-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0qy1lyykwwkp288v0y5kqnd1pmz8frzicpgfcldkv4zz02mc20b1";
+      name = "qtwebengine-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebsockets-everywhere-src-6.11.1.tar.xz";
-      sha256 = "1gvgci383dfm4sljqlapdiva7jhks1i2z2ayck0wbj1436hklgi4";
-      name = "qtwebsockets-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebsockets-everywhere-src-6.11.2.tar.xz";
+      sha256 = "18y9ycpmny1czkqz7c97hp7l89vxj34h56y5wf87czy3hg1jbzib";
+      name = "qtwebsockets-everywhere-src-6.11.2.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.11.1";
+    version = "6.11.2";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebview-everywhere-src-6.11.1.tar.xz";
-      sha256 = "0g8k4xs7b0s474x00ds4i8q9b164icdgrdg8ngln10nmf3pwhqld";
-      name = "qtwebview-everywhere-src-6.11.1.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebview-everywhere-src-6.11.2.tar.xz";
+      sha256 = "0k0zi0pzbcvrrjfzhim55rbaar4xrdmpip9y5ppxxnl9xq4y28by";
+      name = "qtwebview-everywhere-src-6.11.2.tar.xz";
     };
   };
 }

From 46882ec24439bbca961caefdd28401679f11fa96 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 20 Aug 2026 07:31:37 +0000
Subject: [PATCH 345/551] gsl-lite: 1.1.0 -> 1.1.1

---
 pkgs/by-name/gs/gsl-lite/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gs/gsl-lite/package.nix b/pkgs/by-name/gs/gsl-lite/package.nix
index 07e497660fd5..dcb5734c1779 100644
--- a/pkgs/by-name/gs/gsl-lite/package.nix
+++ b/pkgs/by-name/gs/gsl-lite/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gsl-lite";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "gsl-lite";
     repo = "gsl-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lX4s/HyDIEhn7PNyCocFYhizTx6CSkSfmGCSU+eqOYw=";
+    hash = "sha256-mTZGYVwQqTz3sfnuB4c+du1jcqVxDYZPIC9yE8nGZH8=";
   };
 
   nativeBuildInputs = [

From cba9f6a8bc84a049c50c4bf0ef86db6f16d99c12 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 20 Aug 2026 17:35:00 +0000
Subject: [PATCH 346/551] ocamlPackages.cohttp: 6.2.2 -> 6.3.0

---
 pkgs/development/ocaml-modules/cohttp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/cohttp/default.nix b/pkgs/development/ocaml-modules/cohttp/default.nix
index 1642868a9d85..d0f5bbb0d751 100644
--- a/pkgs/development/ocaml-modules/cohttp/default.nix
+++ b/pkgs/development/ocaml-modules/cohttp/default.nix
@@ -22,7 +22,7 @@ buildDunePackage (finalAttrs: {
   pname = "cohttp";
   version =
     if lib.versionAtLeast ocaml.version "5.2" then
-      "6.2.2"
+      "6.3.0"
     else if lib.versionAtLeast ocaml.version "4.13" then
       "6.2.1"
     else
@@ -32,7 +32,7 @@ buildDunePackage (finalAttrs: {
     url = "https://github.com/mirage/ocaml-cohttp/releases/download/v${finalAttrs.version}/cohttp-${finalAttrs.version}.tbz";
     hash =
       {
-        "6.2.2" = "sha256-SZzYsJTO5LAP5rn2MiaA+B/ocWHpY6GWsQnBiCYQr2I=";
+        "6.3.0" = "sha256-MRMPaKnwpc2NcbVfBCRW5tNb+LeranGrbXvX29tgeyQ=";
         "6.2.1" = "sha256-ZQgCR3Y0QtHcPNkGeLgjO3mHcvA2rIHNHqreH11mpl8=";
         "5.3.1" = "sha256-9eJz08Lyn/R71+Ftsj4fPWzQGkC+ACCJhbxDTIjUV2s=";
       }

From da3cff637f826510b32895df913c3e6be98bf783 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.erents@gmail.com>
Date: Thu, 20 Aug 2026 20:23:20 +0200
Subject: [PATCH 347/551] tailscale{,-gitops-pusher,-nginx-auth}: 1.102.2 ->
 1.102.3

---
 pkgs/by-name/ta/tailscale/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix
index 3c690470e15f..79a40f7d8075 100644
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@@ -24,7 +24,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "tailscale";
-  version = "1.102.2";
+  version = "1.102.3";
 
   outputs = [
     "out"
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
     owner = "tailscale";
     repo = "tailscale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vqNShvER4jT+8WJCcaSVboXPEP6S3QacmkC39tJkR4g=";
+    hash = "sha256-NzWuMhLCqewkH/vwyfRND8yEubRmUSXe/TYA2ldhFl8=";
   };
 
   vendorHash = "sha256-amKkUPszyhG4N5ZtrB01swBACYq76raSS+SQRneLmwc=";

From 6876731e19df7f9a6c0724a9f22076d84d48af3a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 20 Aug 2026 22:50:18 +0000
Subject: [PATCH 348/551] python3Packages.comet-ml: 3.58.4 -> 3.58.5

---
 pkgs/development/python-modules/comet-ml/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/comet-ml/default.nix b/pkgs/development/python-modules/comet-ml/default.nix
index 15f5ea10c677..e955d026fcb7 100644
--- a/pkgs/development/python-modules/comet-ml/default.nix
+++ b/pkgs/development/python-modules/comet-ml/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "comet-ml";
-  version = "3.58.4";
+  version = "3.58.5";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "comet_ml";
     inherit (finalAttrs) version;
-    hash = "sha256-h5sYsTA4fZcPdN+w/gWrKzCLFstbVmbFuwHUTQ621Dk=";
+    hash = "sha256-OSCDQ20UiYhvmyE2/qLAaIVKf1mfXlM4yUrqhW2C5zo=";
   };
 
   build-system = [

From 27a717d2c4c9fd2af72a16a5d2671a10ac82572d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 20 Aug 2026 23:38:36 +0000
Subject: [PATCH 349/551] reposilite: 3.5.28 -> 3.6.2

---
 pkgs/by-name/re/reposilite/package.nix  |  4 ++--
 pkgs/by-name/re/reposilite/plugins.json | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/re/reposilite/package.nix b/pkgs/by-name/re/reposilite/package.nix
index 46de85e51b36..e7d6454166d6 100644
--- a/pkgs/by-name/re/reposilite/package.nix
+++ b/pkgs/by-name/re/reposilite/package.nix
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "Reposilite";
-  version = "3.5.28";
+  version = "3.6.2";
 
   src = fetchurl {
     url = "https://maven.reposilite.com/releases/com/reposilite/reposilite/${finalAttrs.version}/reposilite-${finalAttrs.version}-all.jar";
-    hash = "sha256-sKbwO5Lk/DeRQhO3c2zHuHe/CPdb4wRLzG55tP7DVVE=";
+    hash = "sha256-N7oGxGQHGwy6iflj6uiiJGCc5KpCZgIO7+QACiR2Fuc=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/re/reposilite/plugins.json b/pkgs/by-name/re/reposilite/plugins.json
index cdff843cbcd2..d70cba3ecc64 100644
--- a/pkgs/by-name/re/reposilite/plugins.json
+++ b/pkgs/by-name/re/reposilite/plugins.json
@@ -1,7 +1,7 @@
 {
-  "checksum": "sha256-z5/Er3e/0cxs6gic44ncVXxpfbyXqadSSc16D67DwHY=",
-  "groovy": "sha256-R6htqL1vx6C8bagCBDbLZJ8tldXRWzOQ6mrowRmdIKU=",
-  "migration": "sha256-Sl5vlkmxkCGkWQmfkn+QdX3tJ/S9WL/DpQUYB3Y4Yrs=",
-  "prometheus": "sha256-8sCoot7tc74Xnwsz/In68XWMeqcnocfbiKWDl/BSqlI=",
-  "swagger": "sha256-WHFUg/T9fFKrioLNeKQtJvYlhAI68HXcFEMCtpB70Vk="
+  "checksum": "sha256-vRRHaA05BHKs4fP+ono9UNSMi6O9WOO/pY/Rmh08+8A=",
+  "groovy": "sha256-lytD+79N/WswnLLpfRElTktDQ5P24voQgthdBX7aagw=",
+  "migration": "sha256-taai2JRCyC6oJM6u25mEKLUtGs/5RAx7GXIM8lWk3b4=",
+  "prometheus": "sha256-CcurL21i8cHXj6tYIbU84/wBMSJuLSnHXLRCTY5H1OU=",
+  "swagger": "sha256-ULk0HpKTZyq1DOb3XAG3OiDbmQS6YA3pV9X0jdzoD8Q="
 }

From 465af2bb3cbd2210c9b319b635eca7d5d1d2dd37 Mon Sep 17 00:00:00 2001
From: Ross Carter <rcarter@anduril.com>
Date: Thu, 20 Aug 2026 20:31:04 -0400
Subject: [PATCH 350/551] openblas: Fix aarch64 cross compilation

---
 .../development/libraries/science/math/openblas/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index b1a0175dfde1..89ad14774c9f 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -44,6 +44,7 @@
   R,
   openmp ? null,
   testers,
+  pkgsCross,
 }:
 
 let
@@ -81,7 +82,9 @@ let
     aarch64-linux = {
       BINARY = 64;
       TARGET = setTarget "ARMV8";
-      DYNAMIC_ARCH = setDynamicArch true;
+      # DYNAMIC_ARCH includes ARMV9SME which references sgemm_kernel_sve_v2x4.S,
+      # a file missing when cross-compiling.
+      DYNAMIC_ARCH = setDynamicArch (stdenv.buildPlatform.canExecute stdenv.hostPlatform);
       USE_OPENMP = true;
     };
 
@@ -332,6 +335,7 @@ stdenv.mkDerivation (finalAttrs: {
       package = finalAttrs.finalPackage;
       moduleNames = [ "OpenBLAS" ];
     };
+    aarch64-multiplatform = pkgsCross.aarch64-multiplatform.openblas;
   };
 
   meta = {

From 0c156980219f63c623417685228cd3e4fb95b15e Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 06:50:40 +0000
Subject: [PATCH 351/551] tree-sitter-grammars.tree-sitter-basic: init at
 0-unstable-2025-11-11

basic: fixup
---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index f364cc5bcfe3..d7b2e44e5b52 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -98,6 +98,15 @@
     };
   };
 
+  basic = {
+    version = "0-unstable-2025-11-11";
+    url = "github:Ra77a3l3-jar/tree-sitter-basic";
+    rev = "a98449c11d6c688b54c1ca132148a62d7e586a2a";
+    hash = "sha256-4wJLK+yZjBELTzTnB/9Xb70uGodetEyjVDtFshviQyA=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   bass = {
     version = "0-unstable-2024-05-03";
     url = "github:vito/tree-sitter-bass";

From adc06bc9efa0e1f272906859363b148565b554e1 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 06:51:06 +0000
Subject: [PATCH 352/551] tree-sitter-grammars.tree-sitter-c3: init at 0.11.0

c3: fixup
---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index d7b2e44e5b52..1bac41d52f29 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -212,6 +212,14 @@
     };
   };
 
+  c3 = {
+    version = "0.11.0";
+    url = "github:c3lang/tree-sitter-c3";
+    hash = "sha256-EADHh63Sf4VlffQX3gH/9kodiws4lQsG+cyMwg1dFp8=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   caddyfile = {
     version = "0-unstable-2026-04-06";
     url = "github:caddyserver/tree-sitter-caddyfile";

From eee35083a46f473b172d6a92e370703471f6cbb3 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 06:51:46 +0000
Subject: [PATCH 353/551] tree-sitter-grammars.tree-sitter-chuck: init at
 0-unstable-2026-03-27

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 1bac41d52f29..2f8bafc80d38 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -272,6 +272,14 @@
     };
   };
 
+  chuck = {
+    version = "0-unstable-2026-03-27";
+    url = "github:tymbalodeon/tree-sitter-chuck";
+    rev = "68fb7bdba480915d87177feaa5593a666c0bb602";
+    hash = "sha256-yd+RWeY+gHtTkRaxYxXSv27yWupjZtnIDxbsUAMa9eg=";
+    meta.license = lib.licenses.mit;
+  };
+
   circom = {
     version = "0-unstable-2024-09-09";
     url = "github:Decurity/tree-sitter-circom";

From 8c829f571f14bebd36aab01919e4b7743da5255b Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 06:53:34 +0000
Subject: [PATCH 354/551] tree-sitter-grammars.tree-sitter-concerto: init at
 0-unstable-2026-03-19

concerto: fixup
---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 2f8bafc80d38..0513c2efe6dd 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -343,6 +343,15 @@
     };
   };
 
+  concerto = {
+    version = "0-unstable-2026-03-19";
+    url = "github:accordproject/concerto-tree-sitter";
+    rev = "920ba23ea93af56b19dfc38fcddf80b3ddc62685";
+    hash = "sha256-WD+YEdwZJg4F4wNvUGDIMsL68QUt5AMypfC22lmLB+8=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.asl20;
+  };
+
   cpon = {
     version = "0-unstable-2023-06-06";
     url = "github:fvacek/tree-sitter-cpon";

From 56a368ac69b1d73a616cd46a7850f58a82815790 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 06:54:26 +0000
Subject: [PATCH 355/551] tree-sitter-grammars.tree-sitter-cython: init at
 0-unstable-2024-12-21

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 0513c2efe6dd..751555928b39 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -436,6 +436,14 @@
     };
   };
 
+  cython = {
+    version = "0-unstable-2024-12-21";
+    url = "github:b0o/tree-sitter-cython";
+    rev = "62f44f5e7e41dde03c5f0a05f035e293bcf2bcf8";
+    hash = "sha256-TFMVjzKWZBN1JISq5RTbXDTkqnttLKxckvwhf3WBQX0=";
+    meta.license = lib.licenses.mit;
+  };
+
   d = {
     version = "0.8.2-unstable-2025-06-29";
     url = "github:gdamore/tree-sitter-d";

From 71f3f529aded9a31c9c4c5f0668c146657e592af Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 06:55:21 +0000
Subject: [PATCH 356/551] tree-sitter-grammars.tree-sitter-doxyfile: init at
 0-unstable-2025-08-14

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 751555928b39..30f20ff3c7bf 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -558,6 +558,14 @@
     };
   };
 
+  doxyfile = {
+    version = "0-unstable-2025-08-14";
+    url = "github:tingerrr/tree-sitter-doxyfile";
+    rev = "18e44c6da639632a4e42264c7193df34be915f34";
+    hash = "sha256-/u1BHMJkj3FkTUwNiB6d8aQIBnnENsBzagXnQa9Dcls=";
+    meta.license = lib.licenses.mit;
+  };
+
   dtd = {
     version = "0.7.0-unstable-2026-01-21";
     url = "github:tree-sitter-grammars/tree-sitter-xml";

From 2ee34a4632229fae465abdaff469e04bd899785d Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 06:56:03 +0000
Subject: [PATCH 357/551] tree-sitter-grammars.tree-sitter-drools: init at
 0.1.0

drools: fixup
---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 30f20ff3c7bf..7961bea1c874 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -566,6 +566,14 @@
     meta.license = lib.licenses.mit;
   };
 
+  drools = {
+    version = "0.1.0";
+    url = "github:iByteABit256/tree-sitter-drools";
+    hash = "sha256-TuIJbr5URQJOChsb0OuiLO3A0mUyoZ0zMU4dzquhL58=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.agpl3Only;
+  };
+
   dtd = {
     version = "0.7.0-unstable-2026-01-21";
     url = "github:tree-sitter-grammars/tree-sitter-xml";

From f7b83113fa73bde547dfc58301acce4ed8b2513a Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 06:57:17 +0000
Subject: [PATCH 358/551] tree-sitter-grammars.tree-sitter-ebnf: init at
 0-unstable-2023-02-06

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 7961bea1c874..0f7d70549071 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -623,6 +623,15 @@
     };
   };
 
+  ebnf = {
+    version = "0-unstable-2023-02-06";
+    url = "github:RubixDev/ebnf";
+    rev = "8e635b0b723c620774dfb8abf382a7f531894b40";
+    hash = "sha256-Cch6WCYq9bsWGypzDGapxBLJ0ZB432uAl6YjEjBJ5yg=";
+    location = "crates/tree-sitter-ebnf";
+    meta.license = lib.licenses.mit;
+  };
+
   edoc = {
     version = "0-unstable-2022-11-23";
     url = "github:the-mikedavis/tree-sitter-edoc";

From 9a7eb003efc2d8a419e513077bd57e12ececa687 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 06:57:49 +0000
Subject: [PATCH 359/551] tree-sitter-grammars.tree-sitter-eiffel: init at
 1.0.0

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 0f7d70549071..fcf6a5d6433c 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -654,6 +654,13 @@
     };
   };
 
+  eiffel = {
+    version = "1.0.0";
+    url = "github:imustafin/tree-sitter-eiffel";
+    hash = "sha256-DeZZT+xlb+oWdTKXvf4W/siL8q/ESDVtpCOXUO/yeao=";
+    meta.license = lib.licenses.mit;
+  };
+
   elisp = rec {
     version = "1.6.1";
     url = "github:wilfred/tree-sitter-elisp?ref=${version}";

From a6d61b8651686f56d6cbcfa1e0f8727c5f7edea4 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 06:59:26 +0000
Subject: [PATCH 360/551] tree-sitter-grammars.tree-sitter-embedded-perl: init
 at 0-unstable-2026-03-18

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index fcf6a5d6433c..9c7d84a6160d 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -701,6 +701,14 @@
     };
   };
 
+  embedded-perl = {
+    version = "0-unstable-2026-03-18";
+    url = "github:jobindex-open/tree-sitter-embedded-perl";
+    rev = "5557a53f1f59a67cbd54c25bacd0c56d43158818";
+    hash = "sha256-4I14D3FY/GTOyESIywrRz298G1+I6DxwdSz84cI7Bqc=";
+    meta.license = lib.licenses.mit;
+  };
+
   embedded-template = {
     version = "0.25.0";
     url = "github:tree-sitter/tree-sitter-embedded-template";

From 2257dba529e1ac230d591aabdb25d00cd859147c Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:00:47 +0000
Subject: [PATCH 361/551] tree-sitter-grammars.tree-sitter-flatbuffers: init at
 0-unstable-2024-10-23

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 9c7d84a6160d..5fb4dca6eb5c 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -795,6 +795,14 @@
     };
   };
 
+  flatbuffers = {
+    version = "0-unstable-2024-10-23";
+    url = "github:yuanchenxi95/tree-sitter-flatbuffers";
+    rev = "95e6f9ef101ea97e870bf6eebc0bd1fdfbaf5490";
+    hash = "sha256-rxCgEpZ9NXjhq7ByJLtl/3Oy73dPv1EGG95k3eGOUVE=";
+    meta.license = lib.licenses.mit;
+  };
+
   forth = {
     version = "0-unstable-2025-12-01";
     url = "github:alexanderbrevig/tree-sitter-forth";

From 955e2da166ca0f43380b41db1c7b1581f368d8f0 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:02:10 +0000
Subject: [PATCH 362/551] tree-sitter-grammars.tree-sitter-freebasic: init at
 0-unstable-2025-11-11

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 5fb4dca6eb5c..d755c853ae45 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -825,6 +825,14 @@
     };
   };
 
+  freebasic = {
+    version = "0-unstable-2025-11-11";
+    url = "github:Ra77a3l3-jar/tree-sitter-freebasic";
+    rev = "dbf696adb4c0b9c020074e75043c90592981ee7f";
+    hash = "sha256-9JDf9Tj6K55JRTNfw9U7wR3/idQ8eBoQRCOQnLm3hbs=";
+    meta.license = lib.licenses.mit;
+  };
+
   fsharp = {
     version = "0.3.0-unstable-2026-04-16";
     url = "github:ionide/tree-sitter-fsharp";

From 4445d1c03e545c8cc2d87f20091c0c5673d0eaf9 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:04:27 +0000
Subject: [PATCH 363/551] tree-sitter-grammars.tree-sitter-glimmer-javascript:
 init at 0-unstable-2026-05-14

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index d755c853ae45..fc06d4c01e9b 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1007,6 +1007,14 @@
     excludeBrokenTreeSitterJson = true;
   };
 
+  glimmer-javascript = {
+    version = "0-unstable-2026-05-14";
+    url = "github:ember-tooling/tree-sitter-glimmer-javascript";
+    rev = "d9cf7a2f1dad3c6b660148eaf77e955d418fdb8b";
+    hash = "sha256-gvs85PiyNov10Ar0JytOzjmJQVOeVx74ZQSbV+XUKa4=";
+    meta.license = lib.licenses.mit;
+  };
+
   glsl = {
     version = "0.2.0";
     url = "github:tree-sitter-grammars/tree-sitter-glsl";

From a106ffce0e1211696a8416cb5c7202a4c6dbf09e Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:05:55 +0000
Subject: [PATCH 364/551] tree-sitter-grammars.tree-sitter-glimmer-typescript:
 init at 0-unstable-2025-04-01

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index fc06d4c01e9b..33d289150be9 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1015,6 +1015,14 @@
     meta.license = lib.licenses.mit;
   };
 
+  glimmer-typescript = {
+    version = "0-unstable-2025-04-01";
+    url = "github:ember-tooling/tree-sitter-glimmer-typescript";
+    rev = "12d98944c1d5077b957cbdb90d663a7c4d50118c";
+    hash = "sha256-3cJI6vcbU62kUIhphprNeAl9RyY9TThrzVeArdLfxnI=";
+    meta.license = lib.licenses.mit;
+  };
+
   glsl = {
     version = "0.2.0";
     url = "github:tree-sitter-grammars/tree-sitter-glsl";

From a09cf29dc66387fa142cb6293b0334b421fd2cf6 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:07:56 +0000
Subject: [PATCH 365/551] tree-sitter-grammars.tree-sitter-gnuplot: init at
 0-unstable-2026-01-29

gnuplot: fixup
---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 33d289150be9..eb30a38a3dc2 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1045,6 +1045,15 @@
     };
   };
 
+  gnuplot = {
+    version = "0-unstable-2026-01-29";
+    url = "codeberg:maribu/tree-sitter-gnuplot";
+    rev = "21a3a3929facb964b3592daeb69119294ff84cf2";
+    hash = "sha256-2Z0CDtLOZ7LWffFboxO+tE0VWEkzNNodFMXr5PHQkoo=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.bsd0;
+  };
+
   go = {
     version = "0.25.0";
     url = "github:tree-sitter/tree-sitter-go";

From 2d8d120688ceb069b17a0eaeac5d8900de77477b Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:08:56 +0000
Subject: [PATCH 366/551] tree-sitter-grammars.tree-sitter-go-format-string:
 init at 1.1.0

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index eb30a38a3dc2..34527b1a349b 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1063,6 +1063,13 @@
     };
   };
 
+  go-format-string = {
+    version = "1.1.0";
+    url = "codeberg:kpbaks/tree-sitter-go-format-string";
+    hash = "sha256-Em9uodgqj1TXyZieLuwrYouth5r4UvZoBFSSbzAqJE0=";
+    meta.license = lib.licenses.mit;
+  };
+
   go-template = {
     version = "0-unstable-2026-03-21";
     url = "github:ngalaiko/tree-sitter-go-template";

From 5012248ebf44ddb140202673fd9b3adf90c55540 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:09:44 +0000
Subject: [PATCH 367/551] tree-sitter-grammars.tree-sitter-haskell-literate:
 init at 0-unstable-2025-10-30

haskell-literate: fixup
---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 34527b1a349b..9d9089b58e71 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1212,6 +1212,15 @@
     };
   };
 
+  haskell-literate = {
+    version = "0-unstable-2025-10-30";
+    url = "github:LaurentRDC/tree-sitter-haskell-literate";
+    rev = "8ad7bd1b1595f4cc1a4ccc775d4a3c460f43a596";
+    hash = "sha256-P9FTcMwPU1AvH55ly0XydCSVOP0Mfi6jQ0Yg6Muraqk=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   haskell-persistent = {
     version = "0-unstable-2023-09-19";
     url = "github:MercuryTechnologies/tree-sitter-haskell-persistent";

From fd38e4ab3af4f7061754d5f18c6abcacef30f2e0 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:13:00 +0000
Subject: [PATCH 368/551] tree-sitter-grammars.tree-sitter-haxe: init at 0.13.0

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 9d9089b58e71..5a08b82b21ab 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1234,6 +1234,13 @@
     };
   };
 
+  haxe = {
+    version = "0.13.0";
+    url = "github:vantreeseba/tree-sitter-haxe";
+    hash = "sha256-MHZemYMpfbo1AdVUQv3j6eVWntZKi6K7UtRCPGk2kvE=";
+    meta.license = lib.licenses.mit;
+  };
+
   hcl = {
     version = "1.2.0";
     url = "github:tree-sitter-grammars/tree-sitter-hcl";

From a2a3eb80d197d9c51b8c8e1fc01e5fd51fca5b34 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:14:22 +0000
Subject: [PATCH 369/551] tree-sitter-grammars.tree-sitter-hdl: init at
 0-unstable-2025-09-09

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 5a08b82b21ab..ffb27f62978d 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1250,6 +1250,14 @@
     };
   };
 
+  hdl = {
+    version = "0-unstable-2025-09-09";
+    url = "github:quantonganh/tree-sitter-hdl";
+    rev = "2199fdf1d302100a53002ea2cf540999119836a0";
+    hash = "sha256-aurnBP9R03QN1cDTKpZbp1VX3HCYjleRkSQs6m1aCxA=";
+    meta.license = lib.licenses.mit;
+  };
+
   heex = {
     version = "0.9.0";
     url = "github:phoenixframework/tree-sitter-heex";

From c80c99a3af19053b4e3b7c2db915125d070810f8 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:15:51 +0000
Subject: [PATCH 370/551] tree-sitter-grammars.tree-sitter-jjrevset: init at
 0-unstable-2025-07-09

jjrevset: fixup
---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index ffb27f62978d..0786798a0094 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1475,6 +1475,15 @@
     };
   };
 
+  jjrevset = {
+    version = "0-unstable-2025-07-09";
+    url = "github:bryceberger/tree-sitter-jjrevset";
+    rev = "d9af23944b884ec528b505f41d81923bb3136a51";
+    hash = "sha256-815IDF/V+blItEjW1ljUeV/it/8w532tm4k295z+ago=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   jq = {
     version = "0-unstable-2025-05-10";
     url = "github:flurie/tree-sitter-jq";

From 82405c365e7d497deb6eb632b84095b06436a6f5 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:16:32 +0000
Subject: [PATCH 371/551] tree-sitter-grammars.tree-sitter-jjtemplate: init at
 0-unstable-2025-07-09

jjtemplate: fixup
---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 0786798a0094..6968b273c8fc 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1484,6 +1484,15 @@
     meta.license = lib.licenses.mit;
   };
 
+  jjtemplate = {
+    version = "0-unstable-2025-07-09";
+    url = "github:bryceberger/tree-sitter-jjtemplate";
+    rev = "4313eda8ac31c60e550e3ad5841b100a0a686715";
+    hash = "sha256-8rEatsR1vKBOlYYnGW88uwV0xLXGa+/rMAwiUeAuofk=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   jq = {
     version = "0-unstable-2025-05-10";
     url = "github:flurie/tree-sitter-jq";

From 9844179ee5560bdb755f4064ab63208167431855 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:18:54 +0000
Subject: [PATCH 372/551] tree-sitter-grammars.tree-sitter-kcl: init at 0.0.2

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 6968b273c8fc..7a315a19d2c4 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1565,6 +1565,13 @@
     };
   };
 
+  kcl = {
+    version = "0.0.2";
+    url = "github:KittyCAD/tree-sitter-kcl";
+    hash = "sha256-oxyC6YPSf14YmZ7t/htMPU8BqUagylMCKCmJ5ky5ZII=";
+    meta.license = lib.licenses.mit;
+  };
+
   kdl = {
     version = "1.1.0";
     url = "github:tree-sitter-grammars/tree-sitter-kdl";

From 196d297cfcb1aa8c0fb95cab47d2a19022baeffb Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:29:47 +0000
Subject: [PATCH 373/551] tree-sitter-grammars.tree-sitter-kconfig: init at
 1.3.0

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 7a315a19d2c4..71f84cebaafb 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1572,6 +1572,13 @@
     meta.license = lib.licenses.mit;
   };
 
+  kconfig = {
+    version = "1.3.0";
+    url = "github:tree-sitter-grammars/tree-sitter-kconfig";
+    hash = "sha256-ypjfe1IM3vxfoLWtsDUf+2WzjHkUjy8pc4xxKP4tUL4=";
+    meta.license = lib.licenses.mit;
+  };
+
   kdl = {
     version = "1.1.0";
     url = "github:tree-sitter-grammars/tree-sitter-kdl";

From 5f654a9037ae84c44d612f66d3c36cfdceb81f54 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:30:35 +0000
Subject: [PATCH 374/551] tree-sitter-grammars.tree-sitter-klog: init at
 0-unstable-2026-01-10

klog: fixup
---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 71f84cebaafb..33a2287d2f41 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1588,6 +1588,15 @@
     };
   };
 
+  klog = {
+    version = "0-unstable-2026-01-10";
+    url = "github:Ansimorph/tree-sitter-klog";
+    rev = "0b215fe75bdeb8368546e3cee36aca8c19212d06";
+    hash = "sha256-L0FJpQsiMvPxZOGvp5kfStTPRc5Zgr8xMUj06Yp6VGU=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   koka = {
     version = "0-unstable-2025-07-26";
     url = "github:mtoohey31/tree-sitter-koka";

From 0003f37cbcad07b50debf6d99502c02da401381d Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:51:52 +0000
Subject: [PATCH 375/551] tree-sitter-grammars.tree-sitter-less: init at
 1.0.0-d

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 33a2287d2f41..3b0c06b3aae3 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1688,6 +1688,13 @@
     };
   };
 
+  less = {
+    version = "1.0.0-d";
+    url = "github:jimliang/tree-sitter-less";
+    hash = "sha256-v2pE5CM6XxqQUooLR5r3qaPbDo/3tqQVMx2jWGGxfGo=";
+    meta.license = lib.licenses.mit;
+  };
+
   linkerscript = {
     version = "1.0.0";
     url = "github:tree-sitter-grammars/tree-sitter-linkerscript";

From 14f59df62a3d8a1e837d50b8d1444e4a1a39bb03 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:52:43 +0000
Subject: [PATCH 376/551] tree-sitter-grammars.tree-sitter-lua-format-string:
 init at 0.1.0

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 3b0c06b3aae3..497732e1d92f 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1766,6 +1766,13 @@
     };
   };
 
+  lua-format-string = {
+    version = "0.1.0";
+    url = "codeberg:kpbaks/tree-sitter-lua-format-string";
+    hash = "sha256-fP1c2F/nn4BsmO1u0JAGbECQfv0J9TCZWqiwu6W+JvM=";
+    meta.license = lib.licenses.mit;
+  };
+
   luau = {
     version = "0-unstable-2025-12-08";
     url = "github:polychromatist/tree-sitter-luau";

From b47613f47f100209d43014df0610b104a765c7d3 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:55:28 +0000
Subject: [PATCH 377/551] tree-sitter-grammars.tree-sitter-luap: init at 1.0.1

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 497732e1d92f..a194305c4740 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1773,6 +1773,13 @@
     meta.license = lib.licenses.mit;
   };
 
+  luap = {
+    version = "1.0.1";
+    url = "github:tree-sitter-grammars/tree-sitter-luap";
+    hash = "sha256-SW2ubK5317GUc1dQLkhoaisMgctLOwr6TPVYSQh02vE=";
+    meta.license = lib.licenses.mit;
+  };
+
   luau = {
     version = "0-unstable-2025-12-08";
     url = "github:polychromatist/tree-sitter-luau";

From 6e637500b30f2ec67babaf54f85d350ba0893a5e Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:56:00 +0000
Subject: [PATCH 378/551] tree-sitter-grammars.tree-sitter-nearly: init at
 0-unstable-2025-09-24

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index a194305c4740..5fe63bef67de 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1927,6 +1927,14 @@
     };
   };
 
+  nearley = {
+    version = "0-unstable-2025-09-24";
+    url = "github:mi2ebi/tree-sitter-nearley";
+    rev = "12d01113e194c8e83f6341aab8c2a5f21db9cac9";
+    hash = "sha256-Uhr1DbUK7svhJX1JCtBvKhwO4jgxQLvFPL3mc/zWAy8=";
+    meta.license = lib.licenses.mit;
+  };
+
   netlinx = {
     version = "1.0.4";
     url = "github:norgate-av/tree-sitter-netlinx";

From a4cc6979c55b5652d4946bd785858b35c7f768ba Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 07:57:22 +0000
Subject: [PATCH 379/551] tree-sitter-grammars.tree-sitter-penrose: init at
 0-unstable-2026-01-25

penrose: fixup
---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 5fe63bef67de..d7092993b920 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2185,6 +2185,15 @@
     };
   };
 
+  penrose = {
+    version = "0-unstable-2026-01-25";
+    url = "github:klukaszek/tree-sitter-penrose";
+    rev = "d9368ff7f743b2ac2145a3342db13b1ad950cba5";
+    hash = "sha256-E/tpautC1I3w2+p2xrnd2CjdHVvNooX7yW84gUXlyrg=";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.mit;
+  };
+
   perl = {
     version = "1.1.1";
     url = "github:ganezdragon/tree-sitter-perl";

From cb33c95d885acf8c3de7910b61b4cdaf32b2bdf8 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:00:07 +0000
Subject: [PATCH 380/551] tree-sitter-grammars.tree-sitter-picat: init at 0.1.0

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index d7092993b920..6cea9610e0c5 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2258,6 +2258,13 @@
     };
   };
 
+  picat = {
+    version = "0.1.0";
+    url = "github:dlr-ft/tree-sitter-picat";
+    hash = "sha256-xMiQQHC2GsH9MQJDQkSeAaFr5g7tix0CVn3JvgwxauQ=";
+    meta.license = lib.licenses.mit;
+  };
+
   pioasm = {
     version = "0-unstable-2024-10-12";
     url = "github:leo60228/tree-sitter-pioasm";

From 4344f6f01e35f9adf9529a28aa84e7d5e73b4320 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:01:05 +0000
Subject: [PATCH 381/551] tree-sitter-grammars.tree-sitter-proverif: init at
 0-unstable-2026-02-28

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 6cea9610e0c5..b2f04dc80fbe 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2397,6 +2397,14 @@
     };
   };
 
+  proverif = {
+    version = "0-unstable-2026-02-28";
+    url = "codeberg:maribu/tree-sitter-proverif";
+    rev = "7741807092c4009c1fe4c3648da60ca72b1b80f1";
+    hash = "sha256-fMtGQsEbZHNIamrz3hoGvCJn5Dtu0oHhuLmMxOjFhGU=";
+    meta.license = lib.licenses.bsd0;
+  };
+
   prql = {
     version = "0-unstable-2023-07-28";
     url = "github:PRQL/tree-sitter-prql";

From 1aedbdb522f2196f73449d938a66366d50114a45 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:01:55 +0000
Subject: [PATCH 382/551] tree-sitter-grammars.tree-sitter-ptx: init at
 0-unstable-2026-01-02

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index b2f04dc80fbe..c7904d77b843 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2418,6 +2418,14 @@
     };
   };
 
+  ptx = {
+    version = "0-unstable-2026-01-02";
+    url = "codeberg:jer-gremlin/tree-sitter-ptx";
+    rev = "3dfa6758d4c15832d051f933101992b9e01d6611";
+    hash = "sha256-h2a+ievbZGAYFVl3aZxM4/zTn92/fnfxelHWKfnXoP8=";
+    meta.license = lib.licenses.mit;
+  };
+
   pug = {
     version = "0-unstable-2024-11-17";
     url = "github:zealot128/tree-sitter-pug";

From 1b44406ec63fa2777d8b0f198a8fbe583dc4d5b3 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:02:40 +0000
Subject: [PATCH 383/551] tree-sitter-grammars.tree-sitter-requirements: init
 at 0.6.1

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index c7904d77b843..5f1d2a0e9ea8 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2561,6 +2561,13 @@
     };
   };
 
+  requirements = {
+    version = "0.6.1";
+    url = "github:tree-sitter-grammars/tree-sitter-requirements";
+    hash = "sha256-jLG+DcdVfC2Rj8SYL3WTBWreOLJWwtxpPxzyvJl77d4=";
+    meta.license = lib.licenses.mit;
+  };
+
   rescript = {
     version = "6.0.0-unstable-2026-07-13";
     url = "github:rescript-lang/tree-sitter-rescript";

From 8d808e799156e6c7e2fb11859923887962eeab61 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:04:17 +0000
Subject: [PATCH 384/551] tree-sitter-grammars.tree-sitter-ripple: init at
 0-unstable-2025-11-15

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 5f1d2a0e9ea8..5d3bda080c3d 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2581,6 +2581,15 @@
     };
   };
 
+  ripple = {
+    version = "0-unstable-2025-11-15";
+    url = "github:Ripple-TS/ripple";
+    rev = "49762f0a63de0d1845fcd2e6632639c095995336";
+    hash = "sha256-ohUhJXdo9UPKhSCxuFXGJE1vl8/QNApQkIrbiszVCbM=";
+    location = "packages/tree-sitter";
+    meta.license = lib.licenses.mit;
+  };
+
   river = {
     version = "0-unstable-2023-11-22";
     url = "github:grafana/tree-sitter-river";

From 93c12e8db706bea2441ef82a41d6f448c5a41aa3 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:04:59 +0000
Subject: [PATCH 385/551] tree-sitter-grammars.tree-sitter-robots-txt: init at
 1.0.1

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 5d3bda080c3d..d85e90cf1e10 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2612,6 +2612,13 @@
     };
   };
 
+  robots-txt = {
+    version = "1.0.1";
+    url = "github:opa-oz/tree-sitter-robots-txt";
+    hash = "sha256-fQq5agJ/xHsWxEJAydGxED4Z0bmREfXJ1t/EspBkYC8=";
+    meta.license = lib.licenses.mit;
+  };
+
   ron = {
     version = "0.2.0-unstable-2024-05-05";
     url = "github:tree-sitter-grammars/tree-sitter-ron";

From c745301ff72577ddf69164f08024e525c6320576 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:06:11 +0000
Subject: [PATCH 386/551] tree-sitter-grammars.tree-sitter-rpmspec: init at
 0-unstable-2025-08-11

fixup: rpmspec
---
 pkgs/by-name/tr/tree-sitter/grammars/default.nix |  9 ++++++++-
 .../tr/tree-sitter/grammars/grammar-sources.nix  | 16 ++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/default.nix b/pkgs/by-name/tr/tree-sitter/grammars/default.nix
index 237e0fd99c6a..a9a3dffcc78f 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/default.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/default.nix
@@ -13,7 +13,14 @@ let
   /**
     Set of grammar sources. See ./grammar-sources.nix to define a new grammar.
   */
-  grammar-sources = import ./grammar-sources.nix { inherit lib fetchpatch stdenv; };
+  grammar-sources = import ./grammar-sources.nix {
+    inherit
+      lib
+      fetchpatch
+      fetchFromGitLab
+      stdenv
+      ;
+  };
 
   /**
     Parse a flakeref style string to { type, owner, repo, ref }
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index d85e90cf1e10..dfffcb550f7d 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -1,5 +1,6 @@
 {
   fetchpatch,
+  fetchFromGitLab,
   lib,
   stdenv,
 }:
@@ -2632,6 +2633,21 @@
     };
   };
 
+  rpmspec = {
+    version = "0-unstable-2025-08-11";
+    src = fetchFromGitLab {
+      owner = "cryptomilk";
+      repo = "tree-sitter-rpmspec";
+      rev = "d0275cd1316d9b7a2e0fae028ce95a5a18741e1d";
+      hash = "sha256-YBC0thdMf4UYdZr8+vm1SQjBBh1CZD/VpuzndxsglOU=";
+      postFetch = ''
+        # ensure that case-insensitive folders are not merged on Darwin
+        rm -rf $out/bindings/swift
+      '';
+    };
+    meta.license = lib.licenses.mit;
+  };
+
   rst = {
     version = "0.2.0";
     url = "github:stsewd/tree-sitter-rst";

From 3b75170259ca0706206333a56f7bfbe9705bd6ad Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:08:23 +0000
Subject: [PATCH 387/551] tree-sitter-grammars.tree-sitter-rshtml: init at
 0.1.6

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index dfffcb550f7d..ac17ccfa2584 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2648,6 +2648,13 @@
     meta.license = lib.licenses.mit;
   };
 
+  rshtml = {
+    version = "0.1.6";
+    url = "github:rshtml/tree-sitter-rshtml";
+    hash = "sha256-7RzjvJEMhtWDRnaoLki7FjTK9Y7+ZECE5gIqGUlx6DE=";
+    meta.license = lib.licenses.mit;
+  };
+
   rst = {
     version = "0.2.0";
     url = "github:stsewd/tree-sitter-rst";

From b9e1985a632ab7162c9600b6d358d590c7a4db8a Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:09:31 +0000
Subject: [PATCH 388/551] tree-sitter-grammars.tree-sitter-scfg: init at
 0-unstable-2025-10-29

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index ac17ccfa2584..2d4ce3d0b0c2 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2704,6 +2704,14 @@
     };
   };
 
+  scfg = {
+    version = "0-unstable-2025-10-29";
+    url = "github:rockorager/tree-sitter-scfg";
+    rev = "d850fd470445d73de318a21d734d1e09e29b773c";
+    hash = "sha256-AnyOcQFA3N6AFZiG7eLS1xCm1qX6hko9lFV4oV9p/E8=";
+    meta.license = lib.licenses.mit;
+  };
+
   scheme = {
     version = "0.24.7-1-unstable-2026-03-17";
     url = "github:6cdh/tree-sitter-scheme";

From 7629ddb8eb3cb698f5b97ee0a175d56bb126d5c6 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:11:17 +0000
Subject: [PATCH 389/551] tree-sitter-grammars.tree-sitter-shellcheckrc: init
 at 0.1.0

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 2d4ce3d0b0c2..27a28c24e973 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2731,6 +2731,13 @@
     };
   };
 
+  shellcheckrc = {
+    version = "0.1.0";
+    url = "codeberg:kpbaks/tree-sitter-shellcheckrc";
+    hash = "sha256-f7hko5qYClgft2vvw95w/yU21r/pN5LkqaGJ/aAq8bM=";
+    meta.license = lib.licenses.mit;
+  };
+
   slang = {
     version = "0.3.1-unstable-2025-09-01";
     url = "github:tree-sitter-grammars/tree-sitter-slang";

From 24e70b10aaa04e6cb565253f92dbc8834addaf46 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:12:47 +0000
Subject: [PATCH 390/551] tree-sitter-grammars.tree-sitter-slisp: init at
 0-unstable-2025-09-15

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 27a28c24e973..b208a78c6037 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2761,6 +2761,14 @@
     };
   };
 
+  slisp = {
+    version = "0-unstable-2025-09-15";
+    url = "github:xenogenics/tree-sitter-slisp";
+    rev = "29f9c6707ce9dfc2fc915d175ec720b207f179f3";
+    hash = "sha256-ciolUtCf2e7VXmSIR8Zk4fQAGCeHoIQekYi2LVq7Hpg=";
+    meta.license = lib.licenses.bsd2;
+  };
+
   smali = {
     version = "1.0.0-unstable-2024-05-05";
     url = "github:amaanq/tree-sitter-smali";

From f5109cbfdea39d30f18cc23a61babd2894f7fc1a Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:13:37 +0000
Subject: [PATCH 391/551] tree-sitter-grammars.tree-sitter-ssh-client-config:
 init at 2026.7.9

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index b208a78c6037..446064e6cd33 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2892,6 +2892,13 @@
     };
   };
 
+  ssh-client-config = rec {
+    version = "2026.7.9";
+    url = "github:metio/tree-sitter-ssh-client-config?ref=${version}";
+    hash = "sha256-La1h6uJC5gUA84OAr3zBbQiR+AnrhcUhNf6r4HUpwhg=";
+    meta.license = lib.licenses.cc0;
+  };
+
   strace = {
     version = "0-unstable-2025-12-21";
     url = "github:sigmaSd/tree-sitter-strace";

From d040a5c088dbc166ba0fd02dd2ae030d71015a6b Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:15:12 +0000
Subject: [PATCH 392/551] tree-sitter-grammars.tree-sitter-strictdoc: init at
 0.2.0

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 446064e6cd33..d6653146e376 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2914,6 +2914,13 @@
     excludeBrokenTreeSitterJson = true;
   };
 
+  strictdoc = {
+    version = "0.2.0";
+    url = "github:manueldiagostino/tree-sitter-strictdoc";
+    hash = "sha256-sIbh8mYWrGhaXtRxe/FYIT1aD8WAKfQYJJbhWhz9jEs=";
+    meta.license = lib.licenses.mit;
+  };
+
   supercollider = {
     version = "0.3.2";
     url = "github:madskjeldgaard/tree-sitter-supercollider";

From be18307d427f8c969a2e23e3c42fa96a32f47900 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:19:55 +0000
Subject: [PATCH 393/551] tree-sitter-grammars.tree-sitter-styx: init at
 5.0.0-rc.0

styx: fixup
---
 .../tr/tree-sitter/grammars/grammar-sources.nix   | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index d6653146e376..6a8f6ceba1b5 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2921,6 +2921,21 @@
     meta.license = lib.licenses.mit;
   };
 
+  styx = rec {
+    version = "5.0.0-rc.0";
+    url = "github:bearcove/styx?ref=tree-sitter-styx-v${version}";
+    hash = "sha256-ogxqiKXdVuWZuMrVObGOLfV0t7snhRXtQhiGggvyvWY=";
+    location = "crates/tree-sitter-styx";
+    excludeBrokenTreeSitterJson = true;
+    meta.license = lib.licenses.OR (
+      with lib.licenses;
+      [
+        mit
+        asl20
+      ]
+    );
+  };
+
   supercollider = {
     version = "0.3.2";
     url = "github:madskjeldgaard/tree-sitter-supercollider";

From 54f6e6f7c18e4b64c327a387ca25acbf425db004 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:22:08 +0000
Subject: [PATCH 394/551] tree-sitter-grammars.tree-sitter-systemverilog: init
 at 0.3.1

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 6a8f6ceba1b5..d1f7e114242c 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2988,6 +2988,13 @@
     };
   };
 
+  systemverilog = {
+    version = "0.3.1";
+    url = "github:gmlarumbe/tree-sitter-systemverilog";
+    hash = "sha256-wzsjHDn6ZdGfOlufARurxCTwT8HqMvyfsnIIpXzRUYs=";
+    meta.license = lib.licenses.mit;
+  };
+
   t32 = {
     version = "9.0.1";
     url = "github:xasc/tree-sitter-t32";

From 9ca543792b37a49b39e05a763d8a5c2a44245904 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:24:00 +0000
Subject: [PATCH 395/551] tree-sitter-grammars.tree-sitter-tolk: init at
 0-unstable-2025-07-14

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index d1f7e114242c..e94cf27de844 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -3163,6 +3163,15 @@
     };
   };
 
+  tolk = {
+    version = "0-unstable-2025-07-14";
+    url = "github:ton-blockchain/ton-language-server";
+    rev = "e90dbb89f8ec8fbf8a16b61a31d6cc19a840de4f";
+    hash = "sha256-EeCp7i8ao+KCm8OAx4ALCDg7Nj0GAZbcC1ecyw76qZQ=";
+    location = "server/src/languages/tolk/tree-sitter-tolk";
+    meta.license = lib.licenses.mit;
+  };
+
   toml = {
     version = "0.7.0-unstable-2024-12-03";
     url = "github:tree-sitter-grammars/tree-sitter-toml";

From 99068ec1ded28a1ad43256c590fd4362aeb4ec78 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:27:35 +0000
Subject: [PATCH 396/551] tree-sitter-grammars.tree-sitter-tql: init at 1.1.0

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index e94cf27de844..47c345b7d66d 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -3182,6 +3182,13 @@
     };
   };
 
+  tql = {
+    version = "1.1.0";
+    url = "github:tenzir/tree-sitter-tql";
+    hash = "sha256-2XbSwUKSNcODT2GIQ/k4w+4DSbV8dH689DrYBnWhPfU=";
+    meta.license = lib.licenses.mit;
+  };
+
   tsq = {
     version = "0.19.0-unstable-2024-02-24";
     url = "github:tree-sitter/tree-sitter-tsq";

From f4a773785c83d253533c40b41b08ed3d52ae5e49 Mon Sep 17 00:00:00 2001
From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:29:47 +0000
Subject: [PATCH 397/551] tree-sitter-grammars.tree-sitter-wikitext: init at
 0.1.3

---
 pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 47c345b7d66d..44c726f836e8 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -3488,6 +3488,13 @@
     };
   };
 
+  wikitext = {
+    version = "0.1.3";
+    url = "github:wikimedia/tree-sitter-wikitext";
+    hash = "sha256-jqM+SQzQZNjUyHc4wv9c80lPkH62xWrxAU1uvGEmQho=";
+    meta.license = lib.licenses.mit;
+  };
+
   wing = {
     version = "0.83.11";
     url = "github:winglang/tree-sitter-wing";

From 8c010e667219bb373a397301fde0aa093ddb0d50 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 21 Aug 2026 09:05:15 +0300
Subject: [PATCH 398/551] python3Packages.posthog: 7.11.0 -> 7.39.2

---
 .../python-modules/posthog/default.nix        | 35 +++++++++----------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index e94bf194bd76..55c5e4187e43 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -4,13 +4,19 @@
   backoff,
   buildPythonPackage,
   distro,
+  django,
   fetchFromGitHub,
   freezegun,
+  google-genai,
+  mcp,
   mock,
   monotonic,
   openai,
+  opentelemetry-exporter-otlp,
+  opentelemetry-sdk,
   parameterized,
   pytest-asyncio,
+  pytest-bdd,
   pytestCheckHook,
   python-dateutil,
   pythonAtLeast,
@@ -18,18 +24,19 @@
   setuptools,
   six,
   typing-extensions,
+  zstandard,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "posthog";
-  version = "7.11.0";
+  version = "7.39.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-GmwFI23HUp9/p6o+UFCES7WwvnexrBrVTDhLd/YYWOs=";
+    tag = "posthog-v${finalAttrs.version}";
+    hash = "sha256-HmINi03pq2dkTaCLjdkzMqK7jWOyu5BRCIT5wz3m22g=";
   };
 
   build-system = [ setuptools ];
@@ -46,36 +53,28 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     anthropic
+    django
     freezegun
+    google-genai
+    mcp
     mock
     openai
+    opentelemetry-exporter-otlp
+    opentelemetry-sdk
     parameterized
     pytest-asyncio
+    pytest-bdd
     pytestCheckHook
+    zstandard
   ];
 
   pythonImportsCheck = [ "posthog" ];
 
   disabledTests = [
-    "test_load_feature_flags_wrong_key"
     # Tests require network access
     "test_excepthook"
     "test_request"
-    "test_trying_to_use_django_integration"
     "test_upload"
-    # AssertionError: 2 != 3
-    "test_flush_interval"
-    # len(client.distinct_ids_feature_flags_reported) = 101 != i % 100 + 1
-    "test_capture_multiple_users_doesnt_out_of_memory"
-  ]
-  ++ lib.optionals (pythonAtLeast "3.14") [
-    # Pydantic V1 functionality isn't compatible with Python 3.14
-    "test_clean_pydantic"
-  ];
-
-  disabledTestPaths = [
-    # Missing parts
-    "posthog/test/integrations/test_middleware.py"
   ];
 
   meta = {

From 30a29edb9f2991ed1a26d88e8262fac0adb58fe6 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 21 Aug 2026 11:26:00 +0200
Subject: [PATCH 399/551] =?UTF-8?q?ocamlPackages.bitstring:=204.1.1=20?=
 =?UTF-8?q?=E2=86=92=205.0.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../ocaml-modules/bitstring/default.nix            | 14 +++++++++-----
 pkgs/development/ocaml-modules/bitstring/ppx.nix   | 10 +---------
 2 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/ocaml-modules/bitstring/default.nix b/pkgs/development/ocaml-modules/bitstring/default.nix
index 4c612b177a7c..791620a77c08 100644
--- a/pkgs/development/ocaml-modules/bitstring/default.nix
+++ b/pkgs/development/ocaml-modules/bitstring/default.nix
@@ -1,21 +1,25 @@
 {
   lib,
   fetchFromGitHub,
+  ocaml,
   buildDunePackage,
   stdlib-shims,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "bitstring";
-  version = "4.1.1";
-
-  duneVersion = "3";
+  version = if lib.versionAtLeast ocaml.version "5.3" then "5.0.2" else "4.1.1";
 
   src = fetchFromGitHub {
     owner = "xguerin";
     repo = "bitstring";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-eO7/S9PoMybZPnQQ+q9qbqKpYO4Foc9OjW4uiwwNds8=";
+    tag = "v${finalAttrs.version}";
+    hash =
+      {
+        "5.0.2" = "sha256-MN16b37EM5NIZcvd59Y9Bd+YgcM62RdhrgCskd21tSg=";
+        "4.1.1" = "sha256-eO7/S9PoMybZPnQQ+q9qbqKpYO4Foc9OjW4uiwwNds8=";
+      }
+      ."${finalAttrs.version}";
   };
 
   propagatedBuildInputs = [ stdlib-shims ];
diff --git a/pkgs/development/ocaml-modules/bitstring/ppx.nix b/pkgs/development/ocaml-modules/bitstring/ppx.nix
index 9215c8293d28..826e01501fb2 100644
--- a/pkgs/development/ocaml-modules/bitstring/ppx.nix
+++ b/pkgs/development/ocaml-modules/bitstring/ppx.nix
@@ -1,8 +1,6 @@
 {
   lib,
   buildDunePackage,
-  fetchpatch,
-  ocaml,
   bitstring,
   ppxlib,
   ounit,
@@ -12,21 +10,15 @@ buildDunePackage {
   pname = "ppx_bitstring";
   inherit (bitstring) version src;
 
-  patches = lib.optional (lib.versionAtLeast ppxlib.version "0.36") (fetchpatch {
-    url = "https://github.com/xguerin/bitstring/commit/b42d4924cbb5ec5fd5309e6807852b63f456f35d.patch";
-    hash = "sha256-wtpSnGOzIUTmB3LhyHGopecy7F/5SYFOwaR6eReV+6g=";
-  });
-
   buildInputs = [
     bitstring
     ppxlib
   ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
   checkInputs = [ ounit ];
 
   meta = bitstring.meta // {
     description = "Bitstrings and bitstring matching for OCaml - PPX extension";
-    broken = lib.versionOlder ppxlib.version "0.18.0";
   };
 }

From f9b959289f365dc6fdbd650a0ce33528fce873e3 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Fri, 21 Aug 2026 10:55:46 +0100
Subject: [PATCH 400/551] extism-js-core: move nodejs and npmConfigHook to
 depsBuildBuild

Fixes build after #552708

See https://github.com/NixOS/nixpkgs/pull/552708#issuecomment-5368040167
---
 pkgs/by-name/ex/extism-js-core/package.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/extism-js-core/package.nix b/pkgs/by-name/ex/extism-js-core/package.nix
index 1a1e72fd1011..c54fef1d5441 100644
--- a/pkgs/by-name/ex/extism-js-core/package.nix
+++ b/pkgs/by-name/ex/extism-js-core/package.nix
@@ -49,11 +49,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     wasm-opt --enable-reference-types --enable-bulk-memory --strip -O3 $out/bin/js_pdk_core.wasm -o $out/bin/js_pdk_core.wasm
   '';
 
+  depsBuildBuild = [
+    nodejs
+    npmHooks.npmConfigHook
+  ];
+
   nativeBuildInputs = [
     binaryen
     lld
-    nodejs
-    npmHooks.npmConfigHook
     rustPlatform.bindgenHook
   ];
 

From 88ca9d71ab82664033e50f7503735bf25788ce52 Mon Sep 17 00:00:00 2001
From: Ryan Housand <rhousand@tryondirect.com>
Date: Wed, 12 Aug 2026 16:09:26 -0400
Subject: [PATCH 401/551] nixos/prometheus-exporters/snowflake: init

Assisted-by: Claude Code (Claude Opus 4.8)
---
 .../manual/release-notes/rl-2611.section.md   |  2 +
 .../monitoring/prometheus/exporters.nix       |  1 +
 .../prometheus/exporters/snowflake.nix        | 91 +++++++++++++++++++
 nixos/tests/prometheus-exporters.nix          | 28 ++++++
 4 files changed, 122 insertions(+)
 create mode 100644 nixos/modules/services/monitoring/prometheus/exporters/snowflake.nix

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index b6d5a3f69434..6faa3cfd60b4 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -46,6 +46,8 @@
 
 - [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
 
+- [snowflake-prometheus-exporter](https://github.com/grafana/snowflake-prometheus-exporter), a Prometheus exporter for Snowflake metrics. Available as [services.prometheus.exporters.snowflake](#opt-services.prometheus.exporters.snowflake.enable).
+
 - [feishin](https://github.com/jeffvli/feishin), a modern self-hosted music player. Available as [services.feishin](#opt-services.feishin.enable).
 
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index b1d7f62b582e..d39f66a9dc93 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -120,6 +120,7 @@ let
         "smartctl"
         "smokeping"
         "snmp"
+        "snowflake"
         "speedtest"
         "sql"
         "statsd"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/snowflake.nix b/nixos/modules/services/monitoring/prometheus/exporters/snowflake.nix
new file mode 100644
index 000000000000..c1589147b3bd
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/snowflake.nix
@@ -0,0 +1,91 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.snowflake;
+  inherit (lib)
+    mkIf
+    mkOption
+    types
+    optional
+    escapeShellArg
+    concatStringsSep
+    getExe
+    ;
+
+  # The private key is passed to systemd via LoadCredential, which exposes it in
+  # the per-service credentials directory (`%d`) readable by the service even
+  # under DynamicUser.
+  args = [
+    "--web.listen-address ${cfg.listenAddress}:${toString cfg.port}"
+    "--account ${escapeShellArg cfg.account}"
+    "--username ${escapeShellArg cfg.username}"
+    "--warehouse ${escapeShellArg cfg.warehouse}"
+    "--role ${escapeShellArg cfg.role}"
+  ]
+  ++ optional (cfg.privateKeyFile != null) "--private-key-path=%d/snowflake-private-key"
+  ++ cfg.extraFlags;
+in
+{
+  port = 9975;
+  extraOpts = {
+    account = mkOption {
+      type = types.str;
+      example = "xy12345.us-east-1";
+      description = "Snowflake account to collect metrics for (`--account`).";
+    };
+    username = mkOption {
+      type = types.str;
+      description = "Username used when querying metrics (`--username`).";
+    };
+    warehouse = mkOption {
+      type = types.str;
+      description = "Warehouse used when querying metrics (`--warehouse`).";
+    };
+    role = mkOption {
+      type = types.str;
+      default = "ACCOUNTADMIN";
+      description = "Role used when querying metrics (`--role`).";
+    };
+    privateKeyFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/snowflake-exporter.p8";
+      description = ''
+        Path to the user's RSA private key for key-pair authentication. The file
+        is passed to the service via {manpage}`systemd.exec(5)` credentials, so
+        it is read only by the exporter and never copied into the world-readable
+        Nix store. If the key is encrypted, supply its password via
+        {option}`environmentFile` (`SNOWFLAKE_EXPORTER_PRIVATE_KEY_PASSWORD`).
+
+        Mutually exclusive with password authentication; when set, do not also
+        provide `SNOWFLAKE_EXPORTER_PASSWORD`.
+      '';
+    };
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/snowflake-exporter.env";
+      description = ''
+        Path to an environment file, as defined in {manpage}`systemd.exec(5)`,
+        used to pass secrets without exposing them in the world-readable Nix
+        store or the process's command line. For password authentication set
+        `SNOWFLAKE_EXPORTER_PASSWORD`; for an encrypted key (see
+        {option}`privateKeyFile`) set `SNOWFLAKE_EXPORTER_PRIVATE_KEY_PASSWORD`.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+      LoadCredential = mkIf (cfg.privateKeyFile != null) [
+        "snowflake-private-key:${cfg.privateKeyFile}"
+      ];
+      ExecStart = "${getExe pkgs.prometheus-snowflake-exporter} ${concatStringsSep " " args}";
+    };
+  };
+}
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 3c1c5dc1d756..344f151945a0 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1787,6 +1787,34 @@ let
         '';
       };
 
+    snowflake =
+      { pkgs, ... }:
+      {
+        exporterConfig = {
+          enable = true;
+          account = "dummy";
+          username = "dummy";
+          warehouse = "dummy";
+          # key-pair auth: exercises the LoadCredential + `%d` wiring. The key is
+          # never parsed until a scrape, so a dummy file is enough to boot.
+          privateKeyFile = pkgs.writeText "snowflake-key.p8" "dummy";
+          environmentFile = pkgs.writeText "snowflake-exporter.env" ''
+            SNOWFLAKE_EXPORTER_PRIVATE_KEY_PASSWORD=dummy
+          '';
+        };
+        # Only the landing page is checked. Scraping `/metrics` would run the
+        # collector, which synchronously queries Snowflake and blocks until the
+        # driver's login timeout (~45s) with no reachable server. Booting with
+        # key-pair auth already exercises config validation and the
+        # LoadCredential/environmentFile wiring; the landing page confirms the
+        # exporter booted and is serving.
+        exporterTest = ''
+          wait_for_unit("prometheus-snowflake-exporter.service")
+          wait_for_open_port(9975)
+          succeed("curl -sSf http://localhost:9975/ | grep -i 'Snowflake exporter'")
+        '';
+      };
+
     sql =
       { ... }:
       {

From 25e5f05a16f301f29f3b720bcbf3ee74fa20ec67 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 22 Aug 2026 07:26:10 +0000
Subject: [PATCH 402/551] python3Packages.hyprland-schema: 0.7.0 -> 0.7.1

---
 pkgs/development/python-modules/hyprland-schema/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hyprland-schema/default.nix b/pkgs/development/python-modules/hyprland-schema/default.nix
index 10d618b86c0a..07fd86860de0 100644
--- a/pkgs/development/python-modules/hyprland-schema/default.nix
+++ b/pkgs/development/python-modules/hyprland-schema/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hyprland-schema";
-  version = "0.7.0";
+  version = "0.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "BlueManCZ";
     repo = "hyprland-schema";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5wm21kpn7Car4hntm+ZYG0xdRBpfbwI57yCBmoHmooQ=";
+    hash = "sha256-36nSnuiWtJeCGcxJB2hNlbWEd0t2Ke5hhsUJddoap+w=";
   };
 
   build-system = [ hatchling ];

From 3e9a120324332a9e6fbd65c8caee95c5298718d7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 22 Aug 2026 07:37:30 +0000
Subject: [PATCH 403/551] python3Packages.hyprland-monitors: 0.8.0 -> 0.9.0

---
 pkgs/development/python-modules/hyprland-monitors/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hyprland-monitors/default.nix b/pkgs/development/python-modules/hyprland-monitors/default.nix
index 67052ce556eb..c32040664027 100644
--- a/pkgs/development/python-modules/hyprland-monitors/default.nix
+++ b/pkgs/development/python-modules/hyprland-monitors/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hyprland-monitors";
-  version = "0.8.0";
+  version = "0.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "BlueManCZ";
     repo = "hyprland-monitors";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a7fEDPPN9XYsrpE99C9c9MZGpqg24ZlY6vvHzgvNtzc=";
+    hash = "sha256-7nrLBsU7QacSf5l0Y/LgegfHtx2qHBNCJUBz0cc3dLE=";
   };
 
   build-system = [ hatchling ];

From 188a6d87daf9838b0a656d24a6bf1b13ebd50fb1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 22 Aug 2026 08:48:18 +0000
Subject: [PATCH 404/551] fluxcd-operator: 0.57.0 -> 0.58.1

---
 pkgs/by-name/fl/fluxcd-operator/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator/package.nix b/pkgs/by-name/fl/fluxcd-operator/package.nix
index fcdafe3e6f35..3b1de7601c8e 100644
--- a/pkgs/by-name/fl/fluxcd-operator/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator";
-  version = "0.57.0";
+  version = "0.58.1";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "flux-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qY+uxYGkeiffU5UTsh7oVL1Cp8uKMj4/F6+Y62BSUPY=";
+    hash = "sha256-XGjRP9JvEpuVNKcErTKmKi4TGBADpbI1DDXYDd0Bbb4=";
   };
 
-  vendorHash = "sha256-uTj6P6UZtfFf7jBrRZMWJ3HObiSR/tPlFICk6Cw12WQ=";
+  vendorHash = "sha256-9iDxoWnizmTQ4FqxjlGPQO8Au2FxIdcgggtP+3dTOaU=";
 
   ldflags = [
     "-s"

From 9a32567cd78f99f44764768364af4976013e9ebc Mon Sep 17 00:00:00 2001
From: HHR2020 <76608828+HHR2020@users.noreply.github.com>
Date: Sat, 22 Aug 2026 14:54:22 +0800
Subject: [PATCH 405/551] cloudflare-warp: 2026.3.846.0 -> 2026.7.1343.0

---
 pkgs/by-name/cl/cloudflare-warp/package.nix | 47 +++++++++------------
 1 file changed, 20 insertions(+), 27 deletions(-)

diff --git a/pkgs/by-name/cl/cloudflare-warp/package.nix b/pkgs/by-name/cl/cloudflare-warp/package.nix
index 809f6f028740..f4028750a539 100644
--- a/pkgs/by-name/cl/cloudflare-warp/package.nix
+++ b/pkgs/by-name/cl/cloudflare-warp/package.nix
@@ -3,18 +3,19 @@
   lib,
   autoPatchelfHook,
   versionCheckHook,
-  copyDesktopItems,
   desktop-file-utils,
   dbus,
   dpkg,
   fetchurl,
   gtk3,
+  libayatana-appindicator,
   libpcap,
-  makeDesktopItem,
   makeWrapper,
   nftables,
   nss,
   openssl,
+  tpm2-tss,
+  webkitgtk_4_1,
   writeShellApplication,
   curl,
   jq,
@@ -26,19 +27,21 @@
 }:
 
 let
-  version = "2026.3.846.0";
+  version = "2026.7.1343.0";
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${version}_amd64.deb";
-      hash = "sha256-1SKTK0QW+3CcqBLqHbIsPny/6ekyjZe9qRcjYOMnR58=";
+      name = "cloudflare-warp_${version}_amd64.deb";
+      url = "https://downloads.cloudflareclient.com/v1/download/noble-intel/version/${version}";
+      hash = "sha256-C0u01lhECaHPBDHPIc+yOlDYyHepwCBzJxEaHAV7EF4=";
     };
     aarch64-linux = fetchurl {
-      url = "https://pkg.cloudflareclient.com/pool/noble/main/c/cloudflare-warp/cloudflare-warp_${version}_arm64.deb";
-      hash = "sha256-0zYsyZbX8qq/P+GHW4UHSTy2OsDa4fJAVjHcRbpHtSc=";
+      name = "cloudflare-warp_${version}_arm64.deb";
+      url = "https://downloads.cloudflareclient.com/v1/download/noble-arm/version/${version}";
+      hash = "sha256-NT9VUPzTn7dTKyCn+0v81ekN9EKhzeojR2P096amQTQ=";
     };
     aarch64-darwin = fetchurl {
       url = "https://downloads.cloudflareclient.com/v1/download/macos/version/${version}";
-      hash = "sha256-cDmoM0nIYYQyurJeeiVSX0IWJdIY0pVLmjIae5mEXI4=";
+      hash = "sha256-tmUwWC8ejsE2bNhFkMBr5SzCnXLOux+wh3nZ9BBDKd4=";
     };
   };
 in
@@ -64,7 +67,6 @@ stdenv.mkDerivation (finalAttrs: {
     versionCheckHook
   ]
   ++ lib.optionals (!headless && stdenv.hostPlatform.isLinux) [
-    copyDesktopItems
     desktop-file-utils
   ];
 
@@ -74,31 +76,18 @@ stdenv.mkDerivation (finalAttrs: {
       libpcap
       openssl
       nss
+      tpm2-tss
       (lib.getLib stdenv.cc.cc)
     ]
     ++ lib.optionals (!headless) [
       gtk3
+      libayatana-appindicator
+      webkitgtk_4_1
     ]
   );
 
-  desktopItems = lib.optionals (!headless) [
-    (makeDesktopItem {
-      name = "com.cloudflare.WarpCli";
-      desktopName = "Cloudflare Zero Trust Team Enrollment";
-      categories = [
-        "Utility"
-        "Security"
-        "ConsoleOnly"
-      ];
-      noDisplay = true;
-      mimeTypes = [ "x-scheme-handler/com.cloudflare.warp" ];
-      exec = "warp-cli --accept-tos registration token %u";
-      startupNotify = false;
-      terminal = true;
-    })
-  ];
-
   autoPatchelfIgnoreMissingDeps = [
+    "libjvm.so"
     "libpcap.so.0.8"
   ];
 
@@ -137,6 +126,9 @@ stdenv.mkDerivation (finalAttrs: {
         mv lib/systemd/system $out/lib/systemd/
         substituteInPlace $out/lib/systemd/system/warp-svc.service \
           --replace-fail "ExecStart=" "ExecStart=$out"
+        substituteInPlace $out/share/applications/com.cloudflare.WarpTaskbar.desktop \
+                          $out/share/applications/com.cloudflare.warp.desktop \
+          --replace-fail "Exec=" "Exec=$out"
         ${lib.optionalString (!headless) ''
           substituteInPlace $out/lib/systemd/user/warp-taskbar.service \
             --replace-fail "ExecStart=" "ExecStart=$out" \
@@ -155,7 +147,7 @@ stdenv.mkDerivation (finalAttrs: {
           rm -r $out/etc
           rm -r $out/share/applications
           rm -r $out/share/icons
-          rm -r $out/share/warp
+          rm -r $out/lib/warp
         ''}
 
         runHook postInstall
@@ -165,6 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
     wrapProgram $out/bin/warp-svc --prefix PATH : ${lib.makeBinPath [ nftables ]}
     ${lib.optionalString (!headless) ''
       wrapProgram $out/bin/warp-cli --prefix PATH : ${lib.makeBinPath [ desktop-file-utils ]}
+      wrapProgram $out/bin/warp-taskbar --prefix LD_LIBRARY_PATH : $out/lib/warp/lib
     ''}
   '';
 

From 89f5cbb27f144deff6d6fe0e6f17a97c1cee221f Mon Sep 17 00:00:00 2001
From: HHR2020 <76608828+HHR2020@users.noreply.github.com>
Date: Sat, 22 Aug 2026 16:35:51 +0800
Subject: [PATCH 406/551] nixos/cloudflare-warp: add BindReadOnlyPaths for
 nftables executable

---
 nixos/modules/services/networking/cloudflare-warp.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/services/networking/cloudflare-warp.nix b/nixos/modules/services/networking/cloudflare-warp.nix
index 9cd946903adc..0d7a1a987b51 100644
--- a/nixos/modules/services/networking/cloudflare-warp.nix
+++ b/nixos/modules/services/networking/cloudflare-warp.nix
@@ -73,6 +73,8 @@ in
             "${cfg.rootDir}"
             "/etc/resolv.conf"
           ];
+          # warp-svc uses this absolute FHS path instead of looking up nft in PATH.
+          BindReadOnlyPaths = [ "${lib.getExe pkgs.nftables}:/usr/sbin/nft" ];
           CapabilityBoundingSet = caps;
           AmbientCapabilities = caps;
           Restart = "always";

From 21ff12ee0782d7f548439f08a3905d7727d714b0 Mon Sep 17 00:00:00 2001
From: Mohamed Gaber <me@donn.website>
Date: Fri, 24 Jul 2026 09:08:49 +0300
Subject: [PATCH 407/551] judy: replace struct hack with flexible array +
 enable tests

With _FORTIFY_SOURCE, codebases using JudySL see any access
to struct hack element scl_Index with an offset >= WORDSIZE as an
out-of-bounds access, causing the program to crash and exit. This
was encountered with GTKWave.

The out-of-bound access check properly handles structs with C99
flexible arrays, however.

I have also turned on the included tests.

See https://github.com/NixOS/nixpkgs/issues/544994 for more background.
---
 pkgs/by-name/ju/judy/no-struct-hack.patch | 19 +++++++++++++++++++
 pkgs/by-name/ju/judy/package.nix          |  9 +++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 pkgs/by-name/ju/judy/no-struct-hack.patch

diff --git a/pkgs/by-name/ju/judy/no-struct-hack.patch b/pkgs/by-name/ju/judy/no-struct-hack.patch
new file mode 100644
index 000000000000..d11f931000fb
--- /dev/null
+++ b/pkgs/by-name/ju/judy/no-struct-hack.patch
@@ -0,0 +1,19 @@
+diff --git a/src/JudySL/JudySL.c b/src/JudySL/JudySL.c
+index d7314a7..6252bab 100644
+--- a/src/JudySL/JudySL.c
++++ b/src/JudySL/JudySL.c
+@@ -184,12 +184,12 @@
+ typedef struct SHORCUTLEAF
+ {
+     Pvoid_t   scl_Pvalue;               // callers value area.
+-    uint8_t   scl_Index[WORDSIZE];      // base Index string.
++    uint8_t   scl_Index[];              // base Index string.
+ } scl_t  , *Pscl_t;
+ 
+ // overhead of the scl_Pvalue only, the scl_Index is calculate elsewhere
+ 
+-#define STRUCTOVD       (sizeof(scl_t) - WORDSIZE)
++#define STRUCTOVD       (sizeof(scl_t))
+ 
+ // How big to malloc a shortcut leaf; stringlen should already include the
+ // trailing null char:
diff --git a/pkgs/by-name/ju/judy/package.nix b/pkgs/by-name/ju/judy/package.nix
index b1387dd6ccff..a90bca0aa47e 100644
--- a/pkgs/by-name/ju/judy/package.nix
+++ b/pkgs/by-name/ju/judy/package.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   depsBuildBuild = [ pkgsBuildBuild.stdenv.cc ];
   patches = [
     ./cross.patch
+    ./no-struct-hack.patch
     # Fix reproducible timestamps.
     ./fix-source-date.patch
   ];
@@ -29,6 +30,14 @@ stdenv.mkDerivation (finalAttrs: {
   # Let's wait for the upstream fix similar to https://sourceforge.net/p/judy/patches/4/
   enableParallelBuilding = false;
 
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+    make -C test check-TESTS
+    runHook postCheck
+  '';
+
   outputs = [
     "out"
     "man"

From 3bfcc7e5043b2772b7ba401dc2f212e24434a0f8 Mon Sep 17 00:00:00 2001
From: klea <klea@iwnp.org>
Date: Sat, 22 Aug 2026 10:01:04 +0000
Subject: [PATCH 408/551] frogatto: fix invalid unstable version scheme

As part of https://github.com/NixOS/nixpkgs/issues/541820

Both the game, and the engine seem to have a 4.0.0 version, but it was
made 2023-04-17, when the version we're using is older, so 0 it is.

Those releases are:
- https://github.com/frogatto/frogatto/releases/tag/4.0.0
- https://github.com/anura-engine/anura/releases/tag/v4.0.0

The game has a 1.3.1 version, here: https://github.com/frogatto/frogatto/releases/tag/1.3.1
---
 pkgs/by-name/fr/frogatto/data.nix   | 2 +-
 pkgs/by-name/fr/frogatto/engine.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/frogatto/data.nix b/pkgs/by-name/fr/frogatto/data.nix
index c1b43013d178..c163739b566b 100644
--- a/pkgs/by-name/fr/frogatto/data.nix
+++ b/pkgs/by-name/fr/frogatto/data.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation {
   pname = "frogatto-data";
-  version = "unstable-2023-02-27";
+  version = "1.3.1-unstable-2023-02-27";
 
   src = fetchFromGitHub {
     owner = "frogatto";
diff --git a/pkgs/by-name/fr/frogatto/engine.nix b/pkgs/by-name/fr/frogatto/engine.nix
index ba6ab8eef203..1e6e6d86e26f 100644
--- a/pkgs/by-name/fr/frogatto/engine.nix
+++ b/pkgs/by-name/fr/frogatto/engine.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation {
   pname = "anura-engine";
-  version = "unstable-2023-02-27";
+  version = "0-unstable-2023-02-27";
 
   src = fetchFromGitHub {
     owner = "anura-engine";

From ef0ae638ce0c0f2f5e0144f3150feb37bf282715 Mon Sep 17 00:00:00 2001
From: alden <84120+alden@users.noreply.github.com>
Date: Thu, 6 Aug 2026 11:59:52 -0400
Subject: [PATCH 409/551] fooyin: 0.11.1 -> 0.12.6

---
 pkgs/by-name/fo/fooyin/package.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fo/fooyin/package.nix b/pkgs/by-name/fo/fooyin/package.nix
index 32fae334adf9..784981c408ea 100644
--- a/pkgs/by-name/fo/fooyin/package.nix
+++ b/pkgs/by-name/fo/fooyin/package.nix
@@ -16,6 +16,8 @@
   libopenmpt,
   soundtouch,
   soxr,
+  libpulseaudio,
+  libprojectm,
   game-music-emu,
   SDL2,
   icu,
@@ -26,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fooyin";
-  version = "0.11.1";
+  version = "0.12.6";
 
   __structuredAttrs = true;
 
@@ -34,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fooyin";
     repo = "fooyin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-228hxjKkxE0ILzP8dnIS21R3AW9Y0+wutgcYlQdCgXc=";
+    hash = "sha256-rmejU5Q/qpxvIpl9HpXa0qdr/yQk6eKhbhEvNnvAYgw=";
   };
 
   buildInputs = [
@@ -59,6 +61,8 @@ stdenv.mkDerivation (finalAttrs: {
     game-music-emu
     soundtouch
     soxr
+    libpulseaudio
+    libprojectm
   ];
 
   nativeBuildInputs = [

From 918a660fb05da259faf842c67058e13bd834bca0 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sun, 23 Aug 2026 14:54:55 +0200
Subject: [PATCH 410/551] buf: fix riscv64-linux build

---
 pkgs/by-name/bu/buf/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/bu/buf/package.nix b/pkgs/by-name/bu/buf/package.nix
index 54f93cb93ed0..f90e1408fcf5 100644
--- a/pkgs/by-name/bu/buf/package.nix
+++ b/pkgs/by-name/bu/buf/package.nix
@@ -44,7 +44,7 @@ buildGoModule (finalAttrs: {
 
   preCheck = ''
     # Some tests take longer depending on builder load.
-    substituteInPlace private/bufpkg/bufcheck/lint_test.go \
+    substituteInPlace private/bufpkg/bufcheck/lint_test.go private/bufpkg/bufcheck/breaking_test.go \
       --replace-fail 'context.WithTimeout(t.Context(), 60*time.Second)' \
                      'context.WithTimeout(t.Context(), 600*time.Second)'
     # For WebAssembly runtime tests

From 3022dac42cd076bdec6a28f5a7cc816d8d316fd2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 23 Aug 2026 17:46:39 +0000
Subject: [PATCH 411/551] oscar64: 1.32.272 -> 1.32.273

---
 pkgs/by-name/os/oscar64/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/os/oscar64/package.nix b/pkgs/by-name/os/oscar64/package.nix
index 445b5ef07fde..8f6a7c66e355 100644
--- a/pkgs/by-name/os/oscar64/package.nix
+++ b/pkgs/by-name/os/oscar64/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "oscar64";
-  version = "1.32.272";
+  version = "1.32.273";
 
   src = fetchFromGitHub {
     owner = "drmortalwombat";
     repo = "oscar64";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u27aEnEKhzgVERqrnKrooqvSWdF1kS4GunEopUSv0NA=";
+    hash = "sha256-Z2QIj7KX4Wg0ed4D6AfZkl3cqrpLgRWRyswCGga7h1k=";
   };
 
   postPatch = ''

From 48d4cf12ba680b3f78af651abe7f039e9abe3931 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sun, 23 Aug 2026 15:25:22 -0400
Subject: [PATCH 412/551] tabby: mark broken

It's been broken for months for both platforms. Presumably a bump to
0.32 could fix it: https://github.com/NixOS/nixpkgs/pull/485360 but it's
also broken with our rust version and requires an upstream fix first.
---
 pkgs/by-name/ta/tabby/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ta/tabby/package.nix b/pkgs/by-name/ta/tabby/package.nix
index 328af70e0ec9..6ae1b447c375 100644
--- a/pkgs/by-name/ta/tabby/package.nix
+++ b/pkgs/by-name/ta/tabby/package.nix
@@ -188,6 +188,6 @@ rustPlatform.buildRustPackage {
     mainProgram = "tabby";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.ghthor ];
-    broken = stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isAarch64;
+    broken = true;
   };
 }

From 6de510a6bcbc9dd441a9bb061ecb8d450f1945fc Mon Sep 17 00:00:00 2001
From: darkyzhou <me@zqy.io>
Date: Sun, 4 Jan 2026 21:52:41 +0800
Subject: [PATCH 413/551] ghc: add LoongArch64 NCG support for 9.14+

---
 pkgs/development/compilers/ghc/common-have-ncg.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/compilers/ghc/common-have-ncg.nix b/pkgs/development/compilers/ghc/common-have-ncg.nix
index 1b92a0700ac2..ea2a8af23c09 100644
--- a/pkgs/development/compilers/ghc/common-have-ncg.nix
+++ b/pkgs/development/compilers/ghc/common-have-ncg.nix
@@ -12,3 +12,4 @@ stdenv.targetPlatform.isx86
 || (lib.versionAtLeast version "9.2" && stdenv.targetPlatform.isAarch64)
 || (lib.versionAtLeast version "9.6" && stdenv.targetPlatform.isGhcjs)
 || (lib.versionAtLeast version "9.12" && stdenv.targetPlatform.isRiscV64)
+|| (lib.versionAtLeast version "9.14" && stdenv.targetPlatform.isLoongArch64)

From 98a0e9fee108eb4f61c12fca04e2c9fb1d19d3c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 23 Aug 2026 20:24:10 +0200
Subject: [PATCH 414/551] intel-graphics-compiler: do not print every file in
 tree when creating the dummy git repo

---
 pkgs/by-name/in/intel-graphics-compiler/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/in/intel-graphics-compiler/package.nix b/pkgs/by-name/in/intel-graphics-compiler/package.nix
index 2443b412dd65..3fa764c458db 100644
--- a/pkgs/by-name/in/intel-graphics-compiler/package.nix
+++ b/pkgs/by-name/in/intel-graphics-compiler/package.nix
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
     # The build system only applies patches when the sources are in a Git repository.
     git -C llvm-project init
     git -C llvm-project add .
-    git -C llvm-project -c user.name=nixbld -c user.email= commit -m stub
+    git -C llvm-project -c user.name=nixbld -c user.email= commit -m stub >/dev/null
 
     substituteInPlace llvm-project/llvm/projects/opencl-clang/cmake/modules/CMakeFunctions.cmake \
       --replace-fail 'COMMAND ''${GIT_EXECUTABLE} am --3way --keep-non-patch --ignore-whitespace -C0 ' \

From 06adfcd61b7f3ada256befd457c932caa9904d47 Mon Sep 17 00:00:00 2001
From: 4evy <git@evy.pink>
Date: Mon, 24 Aug 2026 02:15:00 +0300
Subject: [PATCH 415/551] vencord: remove inactive maintainer

Last nixpkgs interaction for FlafyDev was on 2026-03-13:
https://github.com/NixOS/nixpkgs/pull/499368#issuecomment-4056323048
---
 pkgs/by-name/ve/vencord/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 1611168efcb4..c2ac71ef129f 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -110,7 +110,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       _4evy
-      FlafyDev
       Gliczy
       NotAShelf
       Scrumplex

From 07c6de7d6ece3293459b5c8411faa4a3596a299c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 23 Aug 2026 20:23:53 +0200
Subject: [PATCH 416/551] intel-graphics-compiler: fix patch applying for
 opencl-clang

---
 .../in/intel-graphics-compiler/package.nix    | 20 +++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/in/intel-graphics-compiler/package.nix b/pkgs/by-name/in/intel-graphics-compiler/package.nix
index 3fa764c458db..544fb1a1f2e5 100644
--- a/pkgs/by-name/in/intel-graphics-compiler/package.nix
+++ b/pkgs/by-name/in/intel-graphics-compiler/package.nix
@@ -92,14 +92,26 @@ stdenv.mkDerivation rec {
     chmod +x igc/IGC/Scripts/igc_create_linker_script.sh
     patchShebangs --build igc/IGC/Scripts/igc_create_linker_script.sh
 
-    # The build system only applies patches when the sources are in a Git repository.
-    git -C llvm-project init
-    git -C llvm-project add .
-    git -C llvm-project -c user.name=nixbld -c user.email= commit -m stub >/dev/null
+    # Their slapdash CMake code checks the exit code of "git rev-parse" whether patches must be applied.
+    # Since we do not have a full git repo and cannot clone one due to reproducibility issues,
+    # git exits with 128 which is in newer versions of opencl-clang logged as a STATUS, but does not abort either.
+    # We could hack around this, but since we are certain we want the patches (eg for CL3.1), we just shortcircuit the condition.
+    substituteInPlace llvm-project/llvm/projects/opencl-clang/cmake/modules/CMakeFunctions.cmake \
+      --replace-fail "if(patches_needed EQUAL 1)" "if(TRUE)"
 
+    # "git am" wants to check the git history if the commit is already applied, but we do not have that.
+    # "git apply" works very similar, but without a git history and supports the same options unlike patch.
     substituteInPlace llvm-project/llvm/projects/opencl-clang/cmake/modules/CMakeFunctions.cmake \
       --replace-fail 'COMMAND ''${GIT_EXECUTABLE} am --3way --keep-non-patch --ignore-whitespace -C0 ' \
                      'COMMAND ''${GIT_EXECUTABLE} apply --3way --ignore-whitespace -C0 '
+
+    # The build system only applies patches when the sources are in a Git repository.
+    export HOME=$(mktemp -d)
+    git config --global user.email ""
+    git config --global user.name nixbld
+    git -C llvm-project init
+    git -C llvm-project add .
+    git -C llvm-project commit -m stub >/dev/null
   '';
 
   nativeBuildInputs = [

From 41ce2f1fe5c30d0b8d779bb29bfde33e13245dbb Mon Sep 17 00:00:00 2001
From: pcboy <david.hagege@gmail.com>
Date: Mon, 24 Aug 2026 12:57:48 +0900
Subject: [PATCH 417/551] sqlit-tui: 1.6.0 -> 1.6.1

---
 pkgs/by-name/sq/sqlit-tui/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sq/sqlit-tui/package.nix b/pkgs/by-name/sq/sqlit-tui/package.nix
index 92d21228813a..3554d659235e 100644
--- a/pkgs/by-name/sq/sqlit-tui/package.nix
+++ b/pkgs/by-name/sq/sqlit-tui/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "sqlit-tui";
-  version = "1.6.0";
+  version = "1.6.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "Maxteabag";
     repo = "sqlit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LAWlUnRa+i+XQN8Sl7ri4i0UGjyqV7MTz1X+XgNDAcI=";
+    hash = "sha256-xKlL6Q32v7lD9RCwlkJidYmtwXqNiXLf9W57c7hxjFI=";
   };
 
   build-system = with python3Packages; [

From 63912e6c660bcb355f20b33f8a01cf7f04967849 Mon Sep 17 00:00:00 2001
From: pcboy <david.hagege@gmail.com>
Date: Mon, 24 Aug 2026 12:58:32 +0900
Subject: [PATCH 418/551] python3Packages.textual-fastdatatable: 0.17.1 ->
 0.19.0

---
 .../python-modules/textual-fastdatatable/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/textual-fastdatatable/default.nix b/pkgs/development/python-modules/textual-fastdatatable/default.nix
index d1df2b9395a3..616205aa401f 100644
--- a/pkgs/development/python-modules/textual-fastdatatable/default.nix
+++ b/pkgs/development/python-modules/textual-fastdatatable/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "textual-fastdatatable";
-  version = "0.17.1";
+  version = "0.19.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
     owner = "tconbeer";
     repo = "textual-fastdatatable";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-no2iLZmlQKSWLzHE9w5c6VRpHEQpPmVzrnBSvrwhgPI=";
+    hash = "sha256-o+lM682bLwhirNMOJ4AXzdgaA1ggysBkWFnDqTOj1s0=";
   };
 
   build-system = [ hatchling ];

From 44e5ec61dcafbf57450f51865cb9a641bcb29467 Mon Sep 17 00:00:00 2001
From: pcboy <david.hagege@gmail.com>
Date: Mon, 24 Aug 2026 12:59:47 +0900
Subject: [PATCH 419/551] harlequin: relax textual-fastdatatable

---
 pkgs/by-name/ha/harlequin/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/ha/harlequin/package.nix b/pkgs/by-name/ha/harlequin/package.nix
index 6e0ea05f5e84..8ec80a3924f1 100644
--- a/pkgs/by-name/ha/harlequin/package.nix
+++ b/pkgs/by-name/ha/harlequin/package.nix
@@ -32,6 +32,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "click"
     "questionary"
     "tomlkit"
+    "textual-fastdatatable"
   ];
   dependencies =
     with python3Packages;

From 54a904831f1ed4fcb682eba14cf97b379a054403 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Sun, 23 Aug 2026 23:37:44 -0700
Subject: [PATCH 420/551] =?UTF-8?q?nixtamal:=201.9.3=20=E2=86=92=201.10.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/ni/nixtamal/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixtamal/package.nix b/pkgs/by-name/ni/nixtamal/package.nix
index 294ab8df1c11..ddd949f00bd0 100644
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -21,7 +21,7 @@
 
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "nixtamal";
-  version = "1.9.3";
+  version = "1.10.0";
   release_year = 2026;
 
   minimalOCamlVersion = "5.3";
@@ -30,7 +30,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     url = "https://darcs.toastal.in.th/nixtamal/stable/";
     mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
     rev = finalAttrs.version;
-    hash = "sha256-NlCm9XQBK5ooX67ruOJr8TWlOAHGoCgNwIU0BKWol84=";
+    hash = "sha256-IiR8hihbhdGDIcKA4dwQPcieSxT6VOlB2TcuHB16PmQ=";
   };
 
   nativeBuildInputs = [

From a1c97969d9b236e4f847c4ce51fbbc8adfa31ac8 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Mon, 24 Aug 2026 09:41:44 +0200
Subject: [PATCH 421/551] rsync: skip sandbox-incompatible Darwin tests

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
---
 pkgs/by-name/rs/rsync/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix
index 4ca9e45f4258..9f94ca51fcc8 100644
--- a/pkgs/by-name/rs/rsync/package.nix
+++ b/pkgs/by-name/rs/rsync/package.nix
@@ -126,6 +126,12 @@ stdenv.mkDerivation (finalAttrs: {
           "variety-symlink-traversal"
           "variety"
         ]
+        # The Darwin sandbox drops set-id bits, and Python's os.getgroups()
+        # reports account groups that may not be usable by this process.
+        ++ lib.optionals stdenv.hostPlatform.isDarwin [
+          "chmod-setid"
+          "daemon-groupmap-wild"
+        ]
         # This test assumes that every Linux libc provides glibc malloc stats.
         ++ lib.optional stdenv.hostPlatform.isMusl "misc-coverage"
         # These require a native compiler and dynamic interposition.

From b519edd263d423f73301b21ba8e1c473a9f88be4 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Mon, 24 Aug 2026 03:02:38 -0500
Subject: [PATCH 422/551] =?UTF-8?q?yaziPlugins.mediainfo:=200-unstable-202?=
 =?UTF-8?q?6-07-13=20=E2=86=92=200-unstable-2026-08-23?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Compare: https://github.com/boydaihungst/mediainfo.yazi/compare/e079a001f4fefd69007e515bbede4e16b95a811e...73a36587bd896a20a0c84c0b79b341a0cb7e7b92
---
 pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix b/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
index 65e148c38625..b2600757e674 100644
--- a/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "mediainfo.yazi";
-  version = "0-unstable-2026-07-13";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "boydaihungst";
     repo = "mediainfo.yazi";
-    rev = "e079a001f4fefd69007e515bbede4e16b95a811e";
-    hash = "sha256-RIVcKJO89R4oaE6sJuFcV8pFK4nvWtq6ILAXehu4FIY=";
+    rev = "73a36587bd896a20a0c84c0b79b341a0cb7e7b92";
+    hash = "sha256-cdIVIqVxsr+V1I/pqAhr2dxfujTL/de7DFTAOd2jfUk=";
   };
 
   meta = {

From 6113e46486f9116b67e7c021f09819e3f9de3450 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Mon, 24 Aug 2026 03:02:58 -0500
Subject: [PATCH 423/551] =?UTF-8?q?yaziPlugins.ouch:=200.7.1=20=E2=86=92?=
 =?UTF-8?q?=200.7.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Compare: https://github.com/ndtoan96/ouch.yazi/compare/8e70ec74efbec63c7d7db3b1e567b56763affc09...cfe4f507ef7337c8ad4c90eef68ea91fc6694759
---
 pkgs/by-name/ya/yazi/plugins/ouch/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ya/yazi/plugins/ouch/default.nix b/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
index 5a88ae55cbb4..29cb7b09469e 100644
--- a/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/ouch/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "ouch.yazi";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "ndtoan96";
     repo = "ouch.yazi";
-    tag = "v0.7.1";
-    hash = "sha256-CSthsFIiIa81xHgs2Szoy9atRouRESHOPxUt/pOtvl0=";
+    tag = "v0.7.2";
+    hash = "sha256-t1kUo4+YODeTG9d5Yq/vxElcmRHIebC5TRv+uDGG88c=";
   };
 
   meta = {

From f9d62dd210617186f6d39f3920253bdb654b4463 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Mon, 24 Aug 2026 03:03:05 -0500
Subject: [PATCH 424/551] =?UTF-8?q?yaziPlugins.recycle-bin:=200-unstable-2?=
 =?UTF-8?q?026-01-17=20=E2=86=92=201.1.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Compare: https://github.com/uhs-robert/recycle-bin.yazi/compare/fa687116c46a784e664ef96619b32abf51f29b06...fe48a02778574b59ea15e289895f896a4e7e14eb
---
 pkgs/by-name/ya/yazi/plugins/recycle-bin/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ya/yazi/plugins/recycle-bin/default.nix b/pkgs/by-name/ya/yazi/plugins/recycle-bin/default.nix
index 261185b749b6..989625bc00db 100644
--- a/pkgs/by-name/ya/yazi/plugins/recycle-bin/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/recycle-bin/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "recycle-bin.yazi";
-  version = "0-unstable-2026-01-17";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "uhs-robert";
     repo = "recycle-bin.yazi";
-    rev = "fa687116c46a784e664ef96619b32abf51f29b06";
-    hash = "sha256-lpxTGWA15szM5VJ+qvV2+GTg7HXiZaZfyWyjeNMsTSM=";
+    tag = "v1.1.1";
+    hash = "sha256-ghmjM4jmXNC4+P2sl70UhI+8Vv5k3PZV7AwV7iBj1I4=";
   };
 
   meta = {

From b2f5b130bf16da2fdcc991fcdee257c4dfc6c5c4 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Mon, 24 Aug 2026 03:03:28 -0500
Subject: [PATCH 425/551] =?UTF-8?q?yaziPlugins.sudo:=200-unstable-2026-05-?=
 =?UTF-8?q?07=20=E2=86=92=200-unstable-2026-08-23?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Compare: https://github.com/TD-Sky/sudo.yazi/compare/afd61cedbcd13c549c552766755645069561d28c...be3670f3eae8c565e541d65e5f8f292f2e4f2398
---
 pkgs/by-name/ya/yazi/plugins/sudo/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ya/yazi/plugins/sudo/default.nix b/pkgs/by-name/ya/yazi/plugins/sudo/default.nix
index 29bb21a557b3..01480fd698c3 100644
--- a/pkgs/by-name/ya/yazi/plugins/sudo/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/sudo/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "sudo.yazi";
-  version = "0-unstable-2026-05-07";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "TD-Sky";
     repo = "sudo.yazi";
-    rev = "afd61cedbcd13c549c552766755645069561d28c";
-    hash = "sha256-5wa4fdYo7wOXOzdrigWMtADZIL/7alG8Jw7r8iWz9yA=";
+    rev = "be3670f3eae8c565e541d65e5f8f292f2e4f2398";
+    hash = "sha256-GNhoRnEKfA6otuXal87JWLW1bUW4Ago94BbQQ1ae3zA=";
   };
 
   meta = {

From e9a6ce2b83babaf5310270f1e78909516022c23a Mon Sep 17 00:00:00 2001
From: Alexandre Badez <alexandre@badez.eu>
Date: Mon, 24 Aug 2026 10:50:05 +0200
Subject: [PATCH 426/551] google-cloud-sdk: 579.0.0 -> 581.0.0

---
 .../go/google-cloud-sdk/components.json       | 280 +++++++++---------
 pkgs/by-name/go/google-cloud-sdk/data.nix     |  18 +-
 2 files changed, 149 insertions(+), 149 deletions(-)

diff --git a/pkgs/by-name/go/google-cloud-sdk/components.json b/pkgs/by-name/go/google-cloud-sdk/components.json
index 2770f12204c8..9ed0cffc42e6 100644
--- a/pkgs/by-name/go/google-cloud-sdk/components.json
+++ b/pkgs/by-name/go/google-cloud-sdk/components.json
@@ -5,7 +5,7 @@
         "checksum": "73eeb0b0222c8c72ce1cbba3c2ca787d7d89eabc5226463fd59a404f76280138",
         "contents_checksum": "a0096c5a5f0a315397d46a44d19b63f26bca1607a833260032e1efa03d44c9a7",
         "size": 761,
-        "source": "components/google-cloud-sdk-alpha-20260731054104.tar.gz",
+        "source": "components/google-cloud-sdk-alpha-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -23,8 +23,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "2026.07.31"
+        "build_number": 20260814074256,
+        "version_string": "2026.08.14"
       }
     },
     {
@@ -1138,7 +1138,7 @@
         "checksum": "0034138f7ee8d13690dae0a1443a09ecbdae1e45497360c14dabd2c57a79c8a2",
         "contents_checksum": "eee82cd34806ce26487960b9cf1705786ccf975d34390b179f7b89307dc51044",
         "size": 758,
-        "source": "components/google-cloud-sdk-beta-20260731054104.tar.gz",
+        "source": "components/google-cloud-sdk-beta-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1156,8 +1156,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "2026.07.31"
+        "build_number": 20260814074256,
+        "version_string": "2026.08.14"
       }
     },
     {
@@ -1481,10 +1481,10 @@
     },
     {
       "data": {
-        "checksum": "ea5d5573c5f273c69031b1f861ce3579434b7a4b37a53f81b558f1b0e6fea3d7",
-        "contents_checksum": "30706c8fc569a3578eefceb01b78b0b5a67fd72d1c016f269abc264834baa0e4",
-        "size": 1973753,
-        "source": "components/google-cloud-sdk-bq-20260724054717.tar.gz",
+        "checksum": "954a92fb0c34dfc607295a230ef126e84ebae0e0827a5ba2424d2622ce3535d6",
+        "contents_checksum": "16f1ebfc39679cfb5e3e3a7f24de0bf9da8f9ba21e86fb90de9244bdd905821b",
+        "size": 2286040,
+        "source": "components/google-cloud-sdk-bq-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1504,8 +1504,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260724054717,
-        "version_string": "2.1.36"
+        "build_number": 20260814074256,
+        "version_string": "2.1.37"
       }
     },
     {
@@ -1610,15 +1610,15 @@
       "platform_required": false,
       "version": {
         "build_number": 0,
-        "version_string": "1.25.3"
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "79590ed52dbd03a247b69e11dd40c625ce16354b2a5d88de100f14f364e57bdb",
-        "contents_checksum": "762286f63aafe7d3b43863f7d81743ba77110c74b9dad7419e85ed58a06f162a",
-        "size": 20845895,
-        "source": "components/google-cloud-sdk-cbt-darwin-arm-20260717053915.tar.gz",
+        "checksum": "d6b7eee546c9f44de0c02018144539ebb7b739934bd477efe4ce14061a6d1fb6",
+        "contents_checksum": "105a55d37d626676b5b1351d9432d41dbc2c13327b44a2e965d4dd9a093cd389",
+        "size": 22101844,
+        "source": "components/google-cloud-sdk-cbt-darwin-arm-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1643,8 +1643,8 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
@@ -1683,10 +1683,10 @@
     },
     {
       "data": {
-        "checksum": "af846f78a8906d2f63c4da1449dd147c7805820bb30b6f1bd0437c5cab048a1f",
-        "contents_checksum": "a2b6581c530da0dad6e3d330b24f7b0d703e99915a91d829dd2893f7d4974d86",
-        "size": 22038894,
-        "source": "components/google-cloud-sdk-cbt-darwin-x86_64-20260717053915.tar.gz",
+        "checksum": "23ae91edc498b4e407ab529e1efa942870f32dac3923c1f830a41005b4fabfa9",
+        "contents_checksum": "dac40b2a5f61ce95a93fddc7495a483731c82e8c3e015854440f16aafc41f182",
+        "size": 23354874,
+        "source": "components/google-cloud-sdk-cbt-darwin-x86_64-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1711,16 +1711,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "051264f5559ecb4b0135f95935b55a221978b24382febd1ec4e68512c0ffd442",
-        "contents_checksum": "2e8f90e00370f41597de5f6c5759a889866d112022b3e0d950a29b1ee6d63777",
-        "size": 19276042,
-        "source": "components/google-cloud-sdk-cbt-linux-arm-20260717053915.tar.gz",
+        "checksum": "e4ba5ebc32e9c3eff8de39374a7ed4f85138eca034a2fdc4ea662fc3383e32ec",
+        "contents_checksum": "db962cb6a3b04fe90c5552204c4db88f97c1ea13d8fd4bbbe610b453d8a32164",
+        "size": 20420640,
+        "source": "components/google-cloud-sdk-cbt-linux-arm-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1745,16 +1745,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "6145eabb4c63f4dacd65b93b44cc53890496ab4c9cb1e6b12c1a4539bc86a2eb",
-        "contents_checksum": "58b86989036f07e3716686667fed972dea38af44f8aa417adccbbb0c8feff8d5",
-        "size": 19901952,
-        "source": "components/google-cloud-sdk-cbt-linux-x86-20260717053915.tar.gz",
+        "checksum": "79d91403cb2018a35a017a9258faec0377336ce1248d04673b365f73ce8bcf47",
+        "contents_checksum": "bef43c1e95fb7b881037c853822efc198bccaee65bdbcaee9a27516b744c896c",
+        "size": 21141620,
+        "source": "components/google-cloud-sdk-cbt-linux-x86-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1779,16 +1779,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "482bee238a7aade205fd1a3f88ac8ca7e41df6b829c34f53bd265c3d24b309f9",
-        "contents_checksum": "c300acced8b8f1d22f649a86ea7179d15b6a4f6d508a96cf15be6cea60c7cc4f",
-        "size": 20909709,
-        "source": "components/google-cloud-sdk-cbt-linux-x86_64-20260717053915.tar.gz",
+        "checksum": "bf72f5f6f2c8649594e45ea3c0a8578934e1b937d36a8ff89c1677169b4b3f22",
+        "contents_checksum": "c616e30c3986cce5e434a317bef33f2d4acf83328e1b04663fa09562ec0fffea",
+        "size": 22132663,
+        "source": "components/google-cloud-sdk-cbt-linux-x86_64-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1813,16 +1813,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "83b3187fed8cc589426d96d007d85e4c77119600d29c6ac9ce2aa1f8d9a62a4d",
-        "contents_checksum": "06031024289140c23288dc37ebdc66e2b1929ca384bfd9a4fbdff447e01dec6d",
-        "size": 20363797,
-        "source": "components/google-cloud-sdk-cbt-windows-x86-20260717053915.tar.gz",
+        "checksum": "11f15c7b7f13b51cb1505451eae37215e40caad709c248f3eed7771d15b2b99a",
+        "contents_checksum": "839b6d9391827353c2469f0f12a38cc777bfd9a6c7661acfba1d1c66823e78c0",
+        "size": 21644226,
+        "source": "components/google-cloud-sdk-cbt-windows-x86-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1847,16 +1847,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
       "data": {
-        "checksum": "aed38eeebcb8eca2fea6200a434b1b555c175a81eac720da1da127c64eaf22d6",
-        "contents_checksum": "268ac7799d48ec6c2dc6c3034890a3b98f9ee3185764f371180272c4d8897852",
-        "size": 21160864,
-        "source": "components/google-cloud-sdk-cbt-windows-x86_64-20260717053915.tar.gz",
+        "checksum": "1e682e75f4f4fe9c3f7ca1831ed63b24db8f29db26cff0a987bbceea22e2d373",
+        "contents_checksum": "61c764c9feec805d679d1c8d56abc36b9bdd6c9b90ea958ef0d4a167e73a5c0f",
+        "size": 22388510,
+        "source": "components/google-cloud-sdk-cbt-windows-x86_64-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -1881,8 +1881,8 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260717053915,
-        "version_string": "1.25.3"
+        "build_number": 20260814074256,
+        "version_string": "1.25.4"
       }
     },
     {
@@ -2301,15 +2301,15 @@
       "platform_required": false,
       "version": {
         "build_number": 0,
-        "version_string": "1.5.55"
+        "version_string": "1.5.56"
       }
     },
     {
       "data": {
-        "checksum": "2b33301e10787e62c622435ef9de0ee0082d6c79955f845a755d80116291dd9b",
-        "contents_checksum": "a0a68fd62c1dcb243f16964a8cba368032252b6747a049b160663ca6a278c9e8",
-        "size": 51210457,
-        "source": "components/google-cloud-sdk-cloud-spanner-emulator-linux-x86_64-20260710150251.tar.gz",
+        "checksum": "2249fc658438d2434c1cf7f0e444107cfc24ce1b894bcdad3e8a7dc947fe62dd",
+        "contents_checksum": "517267de89b3f20d3fda91b1385f7b3b9a76d3920d9ad597edfb4d76749264ff",
+        "size": 52345394,
+        "source": "components/google-cloud-sdk-cloud-spanner-emulator-linux-x86_64-20260807154943.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -2335,8 +2335,8 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "1.5.55"
+        "build_number": 20260807154943,
+        "version_string": "1.5.56"
       }
     },
     {
@@ -3095,10 +3095,10 @@
     },
     {
       "data": {
-        "checksum": "ec505a00a8ccfba34e53d85f7302f9586a84eb17fe72525c60622606e1136aa4",
-        "contents_checksum": "726076916a36597072facad59103328324da73522ba20511cfeebea0f9ddc0ce",
-        "size": 27916650,
-        "source": "components/google-cloud-sdk-core-20260731054104.tar.gz",
+        "checksum": "645f514aede6e7c6d43d758c2464fc78b1d66d98d3dbbe63fa0e64d9370403a9",
+        "contents_checksum": "2b465549bd6ecb6dad4941fefd5e090d967b858daed22342955da03a7c9d9857",
+        "size": 28132031,
+        "source": "components/google-cloud-sdk-core-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -3119,8 +3119,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "2026.07.31"
+        "build_number": 20260814074256,
+        "version_string": "2026.08.14"
       }
     },
     {
@@ -3497,15 +3497,15 @@
       "platform_required": false,
       "version": {
         "build_number": 0,
-        "version_string": "0.3.19"
+        "version_string": "0.3.20"
       }
     },
     {
       "data": {
-        "checksum": "ed43d9c16d8763a42a980d8f62076c862463abdc7237492939bb569ef6fb92dd",
-        "contents_checksum": "043140a7d0fad390591d6e8a7768e910c447dbecf8b57c5b92abfa0fc5e030f9",
-        "size": 15336065,
-        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-darwin-arm-20260731054104.tar.gz",
+        "checksum": "2f9947d3be36a47d3f690140111ca79c15391dbc670b120715693e0d5bcea0ed",
+        "contents_checksum": "1e67b289d8f07d3ff5ff3c90babc5ef72e6b3ccf3a18fac4a2d48c485d8b9500",
+        "size": 15337430,
+        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-darwin-arm-20260807154943.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -3530,16 +3530,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "0.3.19"
+        "build_number": 20260807154943,
+        "version_string": "0.3.20"
       }
     },
     {
       "data": {
-        "checksum": "cd2c825b1615fc97ccd632478694c010db608dce2f63e3cada4e66d255c27103",
-        "contents_checksum": "74a89013ab0da2e08a8d9ab5871212689bddc7583a66c60c54c704d15867c75d",
-        "size": 16297514,
-        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-darwin-x86_64-20260731054104.tar.gz",
+        "checksum": "fa41da2478182e5b9f8f3b2679a3c65f8952eaaa8626b27d0727996b0f54dab0",
+        "contents_checksum": "f6d226c963d112a3e5a186d3fa2377cf9274c510cc1b9ec19393e841ea0fa13d",
+        "size": 16296666,
+        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-darwin-x86_64-20260807154943.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -3564,16 +3564,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "0.3.19"
+        "build_number": 20260807154943,
+        "version_string": "0.3.20"
       }
     },
     {
       "data": {
-        "checksum": "f8d7c5c09a436aff61918517824e5fcf1f10e82d46fe3898c8b915794f5bfa1d",
-        "contents_checksum": "e0a058d5ffd0ce65a6129bc37db8f1fec56e0f9e08e4b14c021a896bd0b84698",
-        "size": 18436186,
-        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-linux-x86_64-20260731054104.tar.gz",
+        "checksum": "e346f92235ea867e1e1a2f7ef8ef2b9907f0e7e2a35dbcfc87b7eba6c908c5b0",
+        "contents_checksum": "68e57165e4453f13810109a554115feee1ab925b4481ce383fd5f85dac31a9ce",
+        "size": 18436193,
+        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-linux-x86_64-20260807154943.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -3598,16 +3598,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "0.3.19"
+        "build_number": 20260807154943,
+        "version_string": "0.3.20"
       }
     },
     {
       "data": {
-        "checksum": "d731c7710da2820cffc2b4cb7314f5218b2f4ac7c30fb341980df44a3ef13f81",
-        "contents_checksum": "e54a67c367628edf8d3efcb8669c0d738718dfb0c20bb1df929123852f25675d",
-        "size": 13416873,
-        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-windows-x86_64-20260731054104.tar.gz",
+        "checksum": "b267dff0f17e28deffd96db80a6e844533c296f41092e45409e5192814ea000e",
+        "contents_checksum": "14bcdfa9a15b2fad5ee3d70439c5ff6b528f3f1fd5f1f2288f9373d3fc1103eb",
+        "size": 13416970,
+        "source": "components/google-cloud-sdk-enterprise-certificate-proxy-windows-x86_64-20260807154943.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -3632,8 +3632,8 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "0.3.19"
+        "build_number": 20260807154943,
+        "version_string": "0.3.20"
       }
     },
     {
@@ -4359,10 +4359,10 @@
     },
     {
       "data": {
-        "checksum": "2648f2f8064a17b0d97236aa67aad62a4e503cf87f0c6d1117a03a4e9065e9b1",
-        "contents_checksum": "36383a100c64ae6002aa3fdd37eb8b0941d35fda6c48d2634be7c1a3aa18a0df",
-        "size": 10483823,
-        "source": "components/google-cloud-sdk-gcloud-man-pages-nix-20260731054104.tar.gz",
+        "checksum": "2c7a22f1d75b6a85fc6e44e28cca3fa8f6aa8a8c81e14e1ec3b7abebbb5dc9af",
+        "contents_checksum": "cd4beff93d45489198de5857881aec8009e50e437aa87d7a6b5d10b58d2ec305",
+        "size": 10535456,
+        "source": "components/google-cloud-sdk-gcloud-man-pages-nix-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -4388,7 +4388,7 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
+        "build_number": 20260814074256,
         "version_string": ""
       }
     },
@@ -4827,15 +4827,15 @@
       "platform_required": false,
       "version": {
         "build_number": 0,
-        "version_string": "1.20.892"
+        "version_string": "1.20.8107"
       }
     },
     {
       "data": {
-        "checksum": "8b1d96997ba8a4e13043d362f6ff77c6515b9cf905237fcf6be363a950d219a4",
-        "contents_checksum": "3ebdd0a114596a3a470a48e6a6461db02099adeb53e79288c5d12748e6157a0a",
-        "size": 27723752,
-        "source": "components/google-cloud-sdk-istioctl-darwin-arm-20260710150251.tar.gz",
+        "checksum": "35825fe23b15d7604b617218fed998c96b87ca3c413b0cfe8717cc96966d5b8e",
+        "contents_checksum": "c000d3b1e6cbb45d3fc0cd236a3807b696e00b0c1c77a645ae928a4f834bd690",
+        "size": 27751763,
+        "source": "components/google-cloud-sdk-istioctl-darwin-arm-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -4860,16 +4860,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "1.20.892"
+        "build_number": 20260814074256,
+        "version_string": "1.20.8107"
       }
     },
     {
       "data": {
-        "checksum": "10a72bfbf62eace1c22d752ce77189b01769f472e29629c592f22b1eaf1d0468",
-        "contents_checksum": "943e43953d21092e26c42a8d2eb930e9716505ecc1bbc338b1e5ddd3e11e43fb",
-        "size": 29776478,
-        "source": "components/google-cloud-sdk-istioctl-darwin-x86_64-20260710150251.tar.gz",
+        "checksum": "96a17744595b780d72b3745aec5ff1f32fee3aab4d015306137ec7a4b080fa73",
+        "contents_checksum": "cf37e1eddb2000ce464ae7448703dff00a4ee14c9b9312cac4cea91c138d6490",
+        "size": 29803999,
+        "source": "components/google-cloud-sdk-istioctl-darwin-x86_64-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -4894,16 +4894,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "1.20.892"
+        "build_number": 20260814074256,
+        "version_string": "1.20.8107"
       }
     },
     {
       "data": {
-        "checksum": "b239adc3ce63ea6c4e3d016085f43774d85331d0bd891084984e19fe6a03df74",
-        "contents_checksum": "6ab5c4bcedb178abe3783876491d527e7c524ff258c4419a16f6a34f3a756035",
-        "size": 25874544,
-        "source": "components/google-cloud-sdk-istioctl-linux-arm-20260710150251.tar.gz",
+        "checksum": "991e4ea71e26eeeed8fc7a9b3d962d44f1a8b508a57282110d43264b89625cdb",
+        "contents_checksum": "c5fecdcd9b526b54f5b0f5cf88a874967a7819272f6e3153016b203ce4d65418",
+        "size": 25901981,
+        "source": "components/google-cloud-sdk-istioctl-linux-arm-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -4928,16 +4928,16 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "1.20.892"
+        "build_number": 20260814074256,
+        "version_string": "1.20.8107"
       }
     },
     {
       "data": {
-        "checksum": "173078820da7f599c95b681933da7a5358f5aa9ef97a372f2dd9403e6a3d1ddf",
-        "contents_checksum": "c7328be1e3b6780074d609bdc48cf98bf19df7be3d46d29c696aa65e5a3f87a7",
-        "size": 28710833,
-        "source": "components/google-cloud-sdk-istioctl-linux-x86_64-20260710150251.tar.gz",
+        "checksum": "65e9bdd42333dca6f6ff87fe456f5c7b4d6b07476278cdfbc76fc44d997dc248",
+        "contents_checksum": "f337697c75f563559dcbb8b9766cb82f8d94883a6159f8b8d490e96619abd8f2",
+        "size": 28742918,
+        "source": "components/google-cloud-sdk-istioctl-linux-x86_64-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -4962,8 +4962,8 @@
       },
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "1.20.892"
+        "build_number": 20260814074256,
+        "version_string": "1.20.8107"
       }
     },
     {
@@ -6720,7 +6720,7 @@
         "checksum": "f135e5f6dd331d28f3ebf299208dbe1993838ad4f2d9d87cbde365a6b760c66c",
         "contents_checksum": "c4caf1dd1ca46b5fb9d759606c18619ffaafff9315db4037ade8b3b628f6312b",
         "size": 782,
-        "source": "components/google-cloud-sdk-preview-20260731054104.tar.gz",
+        "source": "components/google-cloud-sdk-preview-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -6738,16 +6738,16 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "2026.07.31"
+        "build_number": 20260814074256,
+        "version_string": "2026.08.14"
       }
     },
     {
       "data": {
-        "checksum": "ce429db6453c95aee8d801cfa27486f9aca691be5b176f80223be0126280ba96",
-        "contents_checksum": "c54cc6153aa7694f9cb91c95961e9637a9c0f207f4671145cf718189af4f4abd",
-        "size": 53000366,
-        "source": "components/google-cloud-sdk-pubsub-emulator-20260710150251.tar.gz",
+        "checksum": "4d88c9a67c3f34f2669e9461db0ca067d406f6240881e04d00840f2da3e1fe4e",
+        "contents_checksum": "cfe5515690b9e0638c597a6f1476f6b27a8095c9f6f2c887384420dd9b16d116",
+        "size": 53008490,
+        "source": "components/google-cloud-sdk-pubsub-emulator-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -6765,8 +6765,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260710150251,
-        "version_string": "0.8.34"
+        "build_number": 20260814074256,
+        "version_string": "0.8.35"
       }
     },
     {
@@ -7985,10 +7985,10 @@
     },
     {
       "data": {
-        "checksum": "79a897b67c84d3e91b276075aa5231290dfd5c65017f5c01f83bc4d053ffa220",
-        "contents_checksum": "3545ecf221daa4ce972b11b88cb6ae55e8c0d92e43c01350bf45d48551a025dd",
-        "size": 64010748,
-        "source": "components/google-cloud-sdk-tests-20260731054104.tar.gz",
+        "checksum": "0db579165ba1ee59f46b7772298b070a47f775d57e45ec414260445a5d917426",
+        "contents_checksum": "f530583ef6822009960bdc9e0fa9973081838876815f3142faa9c8f5f7309cfa",
+        "size": 102176840,
+        "source": "components/google-cloud-sdk-tests-20260814074256.tar.gz",
         "type": "tar"
       },
       "dependencies": [
@@ -8006,8 +8006,8 @@
       "platform": {},
       "platform_required": false,
       "version": {
-        "build_number": 20260731054104,
-        "version_string": "2026.07.31"
+        "build_number": 20260814074256,
+        "version_string": "2026.08.14"
       }
     },
     {
@@ -8160,11 +8160,11 @@
   ],
   "post_processing_command": "components post-process",
   "release_notes_url": "RELEASE_NOTES",
-  "revision": 20260731054104,
+  "revision": 20260814074256,
   "schema_version": {
     "no_update": false,
     "url": "https://dl.google.com/dl/cloudsdk/channels/rapid/google-cloud-sdk.tar.gz",
     "version": 3
   },
-  "version": "579.0.0"
+  "version": "581.0.0"
 }
diff --git a/pkgs/by-name/go/google-cloud-sdk/data.nix b/pkgs/by-name/go/google-cloud-sdk/data.nix
index 01af9edd747d..a4a60bc2622e 100644
--- a/pkgs/by-name/go/google-cloud-sdk/data.nix
+++ b/pkgs/by-name/go/google-cloud-sdk/data.nix
@@ -1,23 +1,23 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "579.0.0";
+  version = "581.0.0";
   googleCloudSdkPkgs = {
     x86_64-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-579.0.0-linux-x86_64.tar.gz";
-      sha256 = "1mqns1dkngv41hk9cr41pjcy1315sz9bq79ghq4sqw7ybyaapa3b";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-581.0.0-linux-x86_64.tar.gz";
+      sha256 = "14gvc7c0cha7v7jv4bkisc0m3q018kr989agi7hma4xgqmdwzrij";
     };
     aarch64-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-579.0.0-linux-arm.tar.gz";
-      sha256 = "0nrp4nycn221a6nrjmkb2rbm1rfcyq9as3alx4qxlhacl9cv327p";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-581.0.0-linux-arm.tar.gz";
+      sha256 = "1l00qdriqnnzdbd134v565p3ii50fx133wca5am6qf04yqnwbpyd";
     };
     aarch64-darwin = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-579.0.0-darwin-arm.tar.gz";
-      sha256 = "1bbcl9f312bl2bng46vsnqg238prl1129wg7bij2rzmikvmmhdvq";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-581.0.0-darwin-arm.tar.gz";
+      sha256 = "1pabqk9nk2gfmzgp1kfw9qv3v2qk1asxsg5qzyyyn0n353y7jnsx";
     };
     i686-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-579.0.0-linux-x86.tar.gz";
-      sha256 = "1csy7l94f4xj5n3gpss1r6dfpr2cx3gvsfgfvhzrs2b48yjk39kc";
+      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-581.0.0-linux-x86.tar.gz";
+      sha256 = "06lihs49m98mznzr9j6v03pfcqnjf5qvwrqwdr3wzas9kch56qyf";
     };
   };
 }

From 7902174ee04800ad79e7fcd887e8b3835bc29c44 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 21 Aug 2026 00:15:13 +0200
Subject: [PATCH 427/551] angle: fix eval for exotic platforms

---
 pkgs/by-name/an/angle/package.nix | 52 +++++++++++++++----------------
 1 file changed, 25 insertions(+), 27 deletions(-)

diff --git a/pkgs/by-name/an/angle/package.nix b/pkgs/by-name/an/angle/package.nix
index 0d6a2329e6a9..4038c508da07 100644
--- a/pkgs/by-name/an/angle/package.nix
+++ b/pkgs/by-name/an/angle/package.nix
@@ -24,11 +24,7 @@ let
   llvmPackages = llvmPackages_21;
   llvmMajorVersion = lib.versions.major llvmPackages.llvm.version;
   arch = stdenv.hostPlatform.parsed.cpu.name;
-  triplet = lib.getAttr arch {
-    "x86_64" = "x86_64-unknown-linux-gnu";
-    "aarch64" = "aarch64-unknown-linux-gnu";
-    "riscv64" = "riscv64-unknown-linux-gnu";
-  };
+  triplet = stdenv.hostPlatform.config;
 
   clang = symlinkJoin {
     name = "angle-clang-llvm-join";
@@ -115,30 +111,32 @@ stdenv.mkDerivation (finalAttrs: {
     ./fix-uninitialized-const-pointer-error-001.patch
   ];
 
-  postPatch = ''
-    substituteInPlace build/config/clang/BUILD.gn \
-      --replace-fail \
-        "_dir = \"${triplet}\"" \
-        "_dir = \"${triplet}\"
-         _suffix = \"-${arch}\""
+  postPatch =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      substituteInPlace build/config/clang/BUILD.gn \
+        --replace-fail \
+          "_dir = \"${triplet}\"" \
+          "_dir = \"${triplet}\"
+           _suffix = \"-${arch}\""
+    ''
+    + ''
+      # Don't precompile Metal shaders, because the compiler is non-free.
+      substituteInPlace src/libANGLE/renderer/metal/metal_backend.gni \
+        --replace-fail \
+          "metal_internal_shader_compilation_supported =" \
+          "metal_internal_shader_compilation_supported = false &&"
 
-    # Don't precompile Metal shaders, because the compiler is non-free.
-    substituteInPlace src/libANGLE/renderer/metal/metal_backend.gni \
-      --replace-fail \
-        "metal_internal_shader_compilation_supported =" \
-        "metal_internal_shader_compilation_supported = false &&"
+      cat > build/config/gclient_args.gni <<EOF
+      # Generated from 'DEPS'
+      checkout_angle_internal = false
+      checkout_angle_mesa = false
+      checkout_angle_restricted_traces = false
+      generate_location_tags = false
+      EOF
 
-    cat > build/config/gclient_args.gni <<EOF
-    # Generated from 'DEPS'
-    checkout_angle_internal = false
-    checkout_angle_mesa = false
-    checkout_angle_restricted_traces = false
-    generate_location_tags = false
-    EOF
-
-    # For sandboxed build on darwin.
-    patchShebangs build/toolchain/apple
-  '';
+      # For sandboxed build on darwin.
+      patchShebangs build/toolchain/apple
+    '';
 
   installPhase = ''
     runHook preInstall

From c007473cc3645d9ef8338e343cfa1f12cf7157e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alice=20=E2=9C=A8=F0=9F=8C=99=20Luna?= <alice@liquidnya.dev>
Date: Sun, 29 Mar 2026 17:57:54 +0200
Subject: [PATCH 428/551] enpass: set mainProgram to `Enpass`

---
 pkgs/by-name/en/enpass/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/en/enpass/package.nix b/pkgs/by-name/en/enpass/package.nix
index feee30969107..2043123a09a6 100644
--- a/pkgs/by-name/en/enpass/package.nix
+++ b/pkgs/by-name/en/enpass/package.nix
@@ -101,6 +101,7 @@ let
         "i686-linux"
       ];
       maintainers = with lib.maintainers; [ ewok ];
+      mainProgram = "Enpass";
     };
 
     nativeBuildInputs = [ makeWrapper ];

From 4c1e8ac4d5ee1a4a5893d27bed777a43c6e89d17 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 24 Aug 2026 14:16:57 +0300
Subject: [PATCH 429/551] lasuite-meet: 1.26.0 -> 1.28.0

Diff: https://github.com/suitenumerique/meet/compare/v1.26.0...v1.28.0

Changelog: https://github.com/suitenumerique/meet/blob/v1.28.0/CHANGELOG.md
---
 pkgs/by-name/la/lasuite-meet/frontend.nix | 2 +-
 pkgs/by-name/la/lasuite-meet/mail.nix     | 2 +-
 pkgs/by-name/la/lasuite-meet/package.nix  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/la/lasuite-meet/frontend.nix b/pkgs/by-name/la/lasuite-meet/frontend.nix
index 80a000547394..fb28b763ab9e 100644
--- a/pkgs/by-name/la/lasuite-meet/frontend.nix
+++ b/pkgs/by-name/la/lasuite-meet/frontend.nix
@@ -17,7 +17,7 @@ buildNpmPackage (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-ZvdfLM0GlIZPaKbpDK9ymSgARVMsJE+cop8lKq3R7fE=";
+    hash = "sha256-CRq4qpdUBOPBelmrbOgrBdQxD0tY84S3YSbCTQXBkvA=";
   };
   npmBuildScript = "build";
 
diff --git a/pkgs/by-name/la/lasuite-meet/mail.nix b/pkgs/by-name/la/lasuite-meet/mail.nix
index dc03dc73bbf5..9065263ad759 100644
--- a/pkgs/by-name/la/lasuite-meet/mail.nix
+++ b/pkgs/by-name/la/lasuite-meet/mail.nix
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
     pname = "${finalAttrs.pname}-npm-deps";
     inherit version src;
     inherit (finalAttrs) sourceRoot;
-    hash = "sha256-Ojk0giCc7tTFAGOIisirMywfe5j7JCKoTnWGk/hR+U8=";
+    hash = "sha256-EpUeQpEerHfZ5nZMCanZ+ayzqKHnCeRE4MqVa8TApKk=";
   };
   npmBuildScript = "build";
 
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index f27c946dd496..14efb85710c8 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -6,13 +6,13 @@
   python3,
 }:
 let
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-WiyVSqkyKDXYYPvzcA/fHcxQJrUThNGfNu+z/KcHK3g=";
+    hash = "sha256-BGYyAm4iX0/E1Fv9siRtOT9FXfpc3EAGhKwGRMTkoeQ=";
   };
 
   meta = {

From 562e93b336dcce01d136b03b8f2b2e41aadb62d5 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Mon, 24 Aug 2026 15:06:30 +0200
Subject: [PATCH 430/551] terraria-server: 1.4.5.7 -> 1.4.5.8

---
 pkgs/by-name/te/terraria-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/te/terraria-server/package.nix b/pkgs/by-name/te/terraria-server/package.nix
index 327d3617eb67..eab25c93b734 100644
--- a/pkgs/by-name/te/terraria-server/package.nix
+++ b/pkgs/by-name/te/terraria-server/package.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "terraria-server";
-  version = "1.4.5.7";
+  version = "1.4.5.8";
   urlVersion = lib.replaceStrings [ "." ] [ "" ] finalAttrs.version;
 
   src = fetchurl {
     url = "https://terraria.org/api/download/pc-dedicated-server/terraria-server-${finalAttrs.urlVersion}.zip";
-    hash = "sha256-xqZ7c1WmwqEGm6NlPtShe9gb48+5IKc0CKrePFpBpUY=";
+    hash = "sha256-9ROkrJeJ00r3Zika4hfJzX2UcuE3gqDisXUS9w16gzQ=";
   };
 
   nativeBuildInputs = [

From 28e195c0ce4d9367f404a7aad885a1e404ccac47 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 13:44:41 +0000
Subject: [PATCH 431/551] ghostfolio: 3.50.0 -> 3.59.1

---
 pkgs/by-name/gh/ghostfolio/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix
index 678516533ec3..87ef4c119c1b 100644
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@@ -12,13 +12,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "ghostfolio";
-  version = "3.50.0";
+  version = "3.59.1";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = finalAttrs.version;
-    hash = "sha256-jW/qcLIAVNcLlg9NqPcH2QeTouFZEzUHy4qqOzZ3h/8=";
+    hash = "sha256-Wf5uxU4lLB/Xw8SoZKFyyZulmpQCKKIIonDmyUlDyHs=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildNpmPackage (finalAttrs: {
     '';
   };
 
-  npmDepsHash = "sha256-wi8NfGBCiCbGUdVGWrX4XMRLUyLoBnur/v8og6RufKU=";
+  npmDepsHash = "sha256-pUE/zXM+q9RcV9pEMBMAhGUMB6Exn3ZWCbvFggzz0N8=";
 
   postPatch = ''
     substituteInPlace replace.build.mjs \

From bdc97573039b19746f642d4ff5a01b867a8df00f Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sun, 23 Aug 2026 15:01:37 +0200
Subject: [PATCH 432/551] dart: add riscv64-linux support

---
 pkgs/development/compilers/dart/default.nix | 3 +++
 pkgs/top-level/all-packages.nix             | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/dart/default.nix b/pkgs/development/compilers/dart/default.nix
index c3bc2b39fd9e..033da4699ddf 100644
--- a/pkgs/development/compilers/dart/default.nix
+++ b/pkgs/development/compilers/dart/default.nix
@@ -21,11 +21,13 @@ stdenv.mkDerivation (finalAttrs: {
       system = selectSystem {
         x86_64-linux = "linux-x64";
         aarch64-linux = "linux-arm64";
+        riscv64-linux = "linux-riscv64";
         aarch64-darwin = "macos-arm64";
       };
       hash = selectSystem {
         x86_64-linux = "sha256-h5Alc/rNisrKx+4f5z+o0GaOBgZQFgaOLtbFyZxrHuA=";
         aarch64-linux = "sha256-IBQaBlMyeTm7IMS4eyMSJr66ESjYqa7bswy1rxonkNQ=";
+        riscv64-linux = "sha256-VmvqaHCVsXv9W8+YdgnWAaW+THuDcc851O/6czx7WFE=";
         aarch64-darwin = "sha256-GBLWAq7Qqc9ygck/UUoeGuz2DcNFxDN9uk/yj6jTmMo=";
       };
     in
@@ -112,6 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
       "aarch64-linux"
       "aarch64-darwin"
+      "riscv64-linux"
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.bsd3;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 084ecb170066..95585cbafe3d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10765,7 +10765,7 @@ with pkgs;
     dart-source
     ;
 
-  dart = if stdenv.hostPlatform.isLinux then dart-source else dart-bin;
+  dart = if lib.meta.availableOn stdenv.hostPlatform dart-source then dart-source else dart-bin;
 
   pub2nix = recurseIntoAttrs (callPackage ../build-support/dart/pub2nix { });
 

From 9ad1af907307f832a516caf0574545d0d90e7172 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Mon, 24 Aug 2026 16:18:51 +0200
Subject: [PATCH 433/551] =?UTF-8?q?rocqPackages.mathcomp-word:=20enable=20?=
 =?UTF-8?q?for=20Rocq=20=E2=89=A5=209.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/rocq-modules/mathcomp-word/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/rocq-modules/mathcomp-word/default.nix b/pkgs/development/rocq-modules/mathcomp-word/default.nix
index 42c411a43d87..2cac066398bf 100644
--- a/pkgs/development/rocq-modules/mathcomp-word/default.nix
+++ b/pkgs/development/rocq-modules/mathcomp-word/default.nix
@@ -73,7 +73,7 @@ mkCoqDerivation {
     lib.switch
       [ coq.coq-version mathcomp.version ]
       [
-        (case (range "8.16" "9.1") (isGe "2.0") "3.5")
+        (case (range "8.16" "9.3") (isGe "2.0") "3.5")
         (case (range "8.12" "8.20") (range "1.12" "1.19") "2.4")
       ]
       null;

From 829bbb6005a033fe295dd679aaffba67bdfd575a Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Mon, 24 Aug 2026 16:38:56 +0200
Subject: [PATCH 434/551] rocqPackages.ITree: enable for Rocq 9.2

---
 pkgs/development/rocq-modules/ITree/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/rocq-modules/ITree/default.nix b/pkgs/development/rocq-modules/ITree/default.nix
index 610d33115a8e..8f830bba2c94 100644
--- a/pkgs/development/rocq-modules/ITree/default.nix
+++ b/pkgs/development/rocq-modules/ITree/default.nix
@@ -17,7 +17,7 @@ mkCoqDerivation {
     in
     with lib.versions;
     lib.switch coq.version [
-      (case (range "8.14" "9.1") "5.2.1")
+      (case (range "8.14" "9.2") "5.2.1")
       (case (isEq "8.13") "5.2.0+20241009")
       (case (range "8.10" "8.16") "4.0.0")
     ] null;

From a50b127af1f091c300b3e84739af56dbea385e92 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 14:41:26 +0000
Subject: [PATCH 435/551] opnborg: 0.1.132 -> 0.1.184

---
 pkgs/by-name/op/opnborg/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opnborg/package.nix b/pkgs/by-name/op/opnborg/package.nix
index 78ec4f52d932..158750745a18 100644
--- a/pkgs/by-name/op/opnborg/package.nix
+++ b/pkgs/by-name/op/opnborg/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "opnborg";
-  version = "0.1.132";
+  version = "0.1.184";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "opnborg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CfpmxYfC8VrfmO8H/mo7F6aeHVA/a2uJBA9CSYv9r/o=";
+    hash = "sha256-WjQy9LGJE+mcpuS+6h2ndsUqyyoroIPOLk/xwgzva0U=";
   };
 
-  vendorHash = "sha256-vNWtAtwWjjpZbWyduWWk/OF+iuvpGpbBUsy0cUZ5tYw=";
+  vendorHash = "sha256-obKLMRGwgsZMGOX+1AIODmzBJBJTlLcUJ9MvGnCT9WI=";
 
   ldflags = [
     "-s"

From eaac7e15048d5a6e19d3800a72e5bd5719a86c31 Mon Sep 17 00:00:00 2001
From: Peter Bynum <pkpbynum@gmail.com>
Date: Mon, 24 Aug 2026 12:00:08 -0400
Subject: [PATCH 436/551] nixos/test-driver: coerced testScript merging

---
 nixos/lib/testing/testScript.nix | 45 +++++++++++++-------------------
 1 file changed, 18 insertions(+), 27 deletions(-)

diff --git a/nixos/lib/testing/testScript.nix b/nixos/lib/testing/testScript.nix
index 2ba9b682d3cb..591330a40fd8 100644
--- a/nixos/lib/testing/testScript.nix
+++ b/nixos/lib/testing/testScript.nix
@@ -7,20 +7,15 @@ testModuleArgs@{
   ...
 }:
 let
-  inherit (lib) mkOption types;
-  inherit (types) either lines functionTo;
+  inherit (lib) mkOption types const;
+  inherit (types) coercedTo lines functionTo;
 in
 {
   options = {
     testScript = mkOption {
-      type = either lines (functionTo lines);
-      apply =
-        v:
-        if lib.isFunction v then
-          # Only pass args the testScript function expects.
-          args: v (builtins.intersectAttrs (lib.functionArgs v) args)
-        else
-          v;
+      type = coercedTo lines const (functionTo lines);
+      # Only pass args the testScript function expects.
+      apply = v: args: v (builtins.intersectAttrs (lib.functionArgs v) args);
       description = ''
         A series of python declarations and statements that you write to perform
         the test.
@@ -50,23 +45,19 @@ in
     withoutTestScriptReferences.includeTestScriptReferences = false;
     withoutTestScriptReferences.testScript = lib.mkForce "testscript omitted";
 
-    testScriptString =
-      if lib.isFunction config.testScript then
-        config.testScript {
-          nodes = lib.mapAttrs (
-            k: v:
-            if v.virtualisation.useNixStoreImage then
-              # prevent infinite recursion when testScript would
-              # reference v's toplevel
-              config.withoutTestScriptReferences.nodesCompat.${k}
-            else
-              # reuse memoized config
-              v
-          ) config.nodesCompat;
-          containers = config.containers;
-        }
-      else
-        config.testScript;
+    testScriptString = config.testScript {
+      nodes = lib.mapAttrs (
+        k: v:
+        if v.virtualisation.useNixStoreImage then
+          # prevent infinite recursion when testScript would
+          # reference v's toplevel
+          config.withoutTestScriptReferences.nodesCompat.${k}
+        else
+          # reuse memoized config
+          v
+      ) config.nodesCompat;
+      containers = config.containers;
+    };
 
     nodeDefaults =
       { config, name, ... }:

From 5d64f606a8207370dc680cb95c801d836dfc2e97 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 16:09:16 +0000
Subject: [PATCH 437/551] checkstyle: 13.10.0 -> 14.0.0

---
 pkgs/by-name/ch/checkstyle/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ch/checkstyle/package.nix b/pkgs/by-name/ch/checkstyle/package.nix
index 3290878f2fbd..b5d199cc3d05 100644
--- a/pkgs/by-name/ch/checkstyle/package.nix
+++ b/pkgs/by-name/ch/checkstyle/package.nix
@@ -8,14 +8,14 @@
 }:
 
 maven.buildMavenPackage (finalAttrs: {
-  version = "13.10.0";
+  version = "14.0.0";
   pname = "checkstyle";
 
   src = fetchFromGitHub {
     owner = "checkstyle";
     repo = "checkstyle";
     tag = "checkstyle-${finalAttrs.version}";
-    hash = "sha256-RJ0ALYE+X2wUdFB4WpGIKYYeRau7AHr5m2Qk3amiXX4=";
+    hash = "sha256-8XrYOILxxPMFkSjJyFULzFiqF1T63F/PIzPiRevUYws=";
   };
 
   patches = [
@@ -23,7 +23,7 @@ maven.buildMavenPackage (finalAttrs: {
     ./drop-nexus-codehaus-snapshot-plugin-repository.patch
   ];
 
-  mvnHash = "sha256-NWTabR7E3aXkLaERZmolOoWPzERnOT/1q7+DW815p9U=";
+  mvnHash = "sha256-8HMUvqhvI8dl2E4uPj3qmgwnyY5fAMtbTbXm67P1Wpo=";
 
   nativeBuildInputs = [
     maven

From e88b8d8b527401c33626597af7750a87935d6891 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 16:32:57 +0000
Subject: [PATCH 438/551] thunderbird-140-unwrapped: 140.13.0esr -> 140.14.0esr

---
 .../networking/mailreaders/thunderbird/packages.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 7f27c4383d44..5265b1225d80 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -112,8 +112,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.13.0esr";
-    sha512 = "778d2fc2837ba367e90c4336f3873da5a0823c182e2f50aa9373cd1ee9ee2b5310372ad9d33e1e11978791b67de4a6952d3036ff7d57b257a06f49c8cd4a830e";
+    version = "140.14.0esr";
+    sha512 = "4c95b1ca3fc7f6429b2360a7e732635bdfb60927622a7da4d8af9ca2abd550611b91763c587cddad5d51c0dd4e905ba8e106da3cd21591a1bec3dba1b9a2502d";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";

From ee78f1aaee7189fe1a65895fb6ee619dbd24ca75 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 17:39:56 +0000
Subject: [PATCH 439/551] mprisence: 1.8.2 -> 1.8.4

---
 pkgs/by-name/mp/mprisence/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mp/mprisence/package.nix b/pkgs/by-name/mp/mprisence/package.nix
index 908b6c5145a8..6f0864418195 100644
--- a/pkgs/by-name/mp/mprisence/package.nix
+++ b/pkgs/by-name/mp/mprisence/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mprisence";
-  version = "1.8.2";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "lazykern";
     repo = "mprisence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m3rmyE9sta8t2Xr3OQL85luPC2gnzCtA9hJ84dzqSVM=";
+    hash = "sha256-kPFTnwuyjad6qmJRg4ryFDL1slOt0JdOtzz3WTP0cKQ=";
   };
 
-  cargoHash = "sha256-BWsnQRKYjcJF3xojV73DCo2b99eLpuOuQHi4qZWmsnU=";
+  cargoHash = "sha256-tY6SBZ+vAGSTFRpOB4Y+ilZOx8EHOeLFsp3ZuQF0eQU=";
 
   nativeBuildInputs = [ pkg-config ];
 

From 88f711bb8663cd03c638081ff24cdff479bf42f2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 18:06:35 +0000
Subject: [PATCH 440/551] mdbook-linkcheck2: 0.12.2 -> 0.13.0

---
 pkgs/by-name/md/mdbook-linkcheck2/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/md/mdbook-linkcheck2/package.nix b/pkgs/by-name/md/mdbook-linkcheck2/package.nix
index 8a3acf3e211d..4c392e6d9204 100644
--- a/pkgs/by-name/md/mdbook-linkcheck2/package.nix
+++ b/pkgs/by-name/md/mdbook-linkcheck2/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdbook-linkcheck2";
-  version = "0.12.2";
+  version = "0.13.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "marxin";
     repo = "mdbook-linkcheck2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D0pteKtmBDkqcaonbNzL6tyo97x+qQhn6oY88+4VGFE=";
+    hash = "sha256-HLV3LqMUbaUL/AMlid0oamceeWiac6zydjQYuujCp3M=";
   };
 
-  cargoHash = "sha256-XY1epCro/BqHm95HVP1eK0oVLSPYjD2hU7IdiEkgNMM=";
+  cargoHash = "sha256-TcMiConcI8KMptOS67J+faPtCRnMCJxrWqFs3o19XMA=";
 
   propagatedNativeBuildInputs = [ cacert ];
 

From 2f8ee1507ce1b5c3772fb1cbfa55960f96d75293 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 18:36:58 +0000
Subject: [PATCH 441/551] phpantom-lsp: 0.9.0 -> 0.10.0

---
 pkgs/by-name/ph/phpantom-lsp/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ph/phpantom-lsp/package.nix b/pkgs/by-name/ph/phpantom-lsp/package.nix
index 06c365793f63..6e23b1b44151 100644
--- a/pkgs/by-name/ph/phpantom-lsp/package.nix
+++ b/pkgs/by-name/ph/phpantom-lsp/package.nix
@@ -10,13 +10,13 @@ let
   stubsSrc = fetchFromGitHub {
     owner = "JetBrains";
     repo = "phpstorm-stubs";
-    rev = "f6dd2dd35d99fb774251a83555fe07bf2109d57e";
-    hash = "sha256-H9Td/yi9Um0Z9ifxZdh74bvGCMVSC+MA1OHrtbGD8vE=";
+    rev = "5f68c1021badebe34119fb8fa10ba7cc25de6c0c";
+    hash = "sha256-GQW+N5FrWKf6PpLyhJ6Gywbe1lESwW/rxiv2ESNdH1s=";
   };
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "phpantom-lsp";
-  version = "0.9.0";
+  version = "0.10.0";
 
   __structuredAttrs = true;
 
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "PHPantom-dev";
     repo = "phpantom_lsp";
     tag = finalAttrs.version;
-    hash = "sha256-euWaFH40VHefZewUcKvsLwwHZP+GwfTN8kfuAkaABB8=";
+    hash = "sha256-P5adooUaNCidGTIh/PDKzwvtIXCQ0y8tUMbLUC4sk98=";
   };
 
   postPatch = ''
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       > stubs/jetbrains/phpstorm-stubs/.commit
   '';
 
-  cargoHash = "sha256-2MIJxVRqyCv5HzCwY1s+rCp1A4vFRsyAEEuyIEegZMA=";
+  cargoHash = "sha256-tZh1cn7Zu47FRVXozDjcoKW4MoxaaaxPmDX5OzlxnAs=";
 
   checkFlags = [
     "--test"

From b53649421fcedc89be78befa5b9f33ba0d3977bb Mon Sep 17 00:00:00 2001
From: lukas-sgx <lukas.soigneux@epitech.eu>
Date: Mon, 24 Aug 2026 18:48:57 +0000
Subject: [PATCH 442/551] rofi-games: 1.16.2 -> 1.18.0

---
 pkgs/by-name/ro/rofi-games/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ro/rofi-games/package.nix b/pkgs/by-name/ro/rofi-games/package.nix
index 50ffb68edf76..87ab2347004a 100644
--- a/pkgs/by-name/ro/rofi-games/package.nix
+++ b/pkgs/by-name/ro/rofi-games/package.nix
@@ -15,18 +15,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rofi-games";
-  version = "1.16.2";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "Rolv-Apneseth";
     repo = "rofi-games";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LwzlBjRh9YdUGBl9+L3Vdetmy7lUdAIvjKvp8hSebvY=";
+    hash = "sha256-6/UeQ+j38NeQFkeP0Pb2UKUbwruPgUos3e9TUQwv9WI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-opImhuLXj3/TtpmBjjMvrcdHalxYFyv5QZ0V8poYH7U=";
+    hash = "sha256-oWmfzlt/qqg1CYfk1pKWhaapiP3iqFU4Idn6pBivjko=";
   };
 
   patches = [

From 5e576a524d14605d4329afe3fd5e6dbb3adf6c87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Mon, 24 Aug 2026 11:49:21 -0700
Subject: [PATCH 443/551] nixtamal: add donationPage

---
 pkgs/by-name/ni/nixtamal/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/ni/nixtamal/package.nix b/pkgs/by-name/ni/nixtamal/package.nix
index ddd949f00bd0..679262844969 100644
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -170,5 +170,6 @@ ocamlPackages.buildDunePackage (finalAttrs: {
       • No experimental Nix features required
     '';
     maintainers = with lib.maintainers; [ toastal ];
+    donationPage = "https://nixtamal.toast.al/funding/";
   };
 })

From fa1e42c91801aefe931528bf55edf55c01fd16c3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 18:58:48 +0000
Subject: [PATCH 444/551] yara-x: 1.19.0 -> 1.20.0

---
 pkgs/by-name/ya/yara-x/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index 22807879f612..fd51b4b8fbfd 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CokjFTQoFT9k/2/MuQSbfzHonW4V0F8hskhqDvpCesM=";
+    hash = "sha256-TR9P4QYDxHSpAmPShiRNdNK1c4v3hGAx8mNOEhAo/HQ=";
   };
 
-  cargoHash = "sha256-wMh8F++16tQ0IUhacBPb4rDcydmDKZKzQf8EK/qDJXo=";
+  cargoHash = "sha256-/D4/H/+O1bCHecEO92aq05U3lPG2P/CFTWVlHekuH98=";
 
   env = {
     CARGO_PROFILE_RELEASE_LTO = "fat";

From 3e68f8b9f86ed52ed0ba3a18214c6f0474b2a308 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 19:33:52 +0000
Subject: [PATCH 445/551] jackett: 0.24.2406 -> 0.24.2457

---
 pkgs/by-name/ja/jackett/deps.json   | 163 ++++++++++++++++------------
 pkgs/by-name/ja/jackett/package.nix |   4 +-
 2 files changed, 96 insertions(+), 71 deletions(-)

diff --git a/pkgs/by-name/ja/jackett/deps.json b/pkgs/by-name/ja/jackett/deps.json
index d67bcbde106a..691a93559d21 100644
--- a/pkgs/by-name/ja/jackett/deps.json
+++ b/pkgs/by-name/ja/jackett/deps.json
@@ -11,8 +11,8 @@
   },
   {
     "pname": "AngleSharp.Xml",
-    "version": "1.1.0",
-    "hash": "sha256-EPKraxfylSFngnba58kosmo4AHEUwK1fv7qiIZAFi14="
+    "version": "1.2.0",
+    "hash": "sha256-o03pwOwChufKpUzy4vneETKc1UC/oBvW2FOeTxeH4e4="
   },
   {
     "pname": "Autofac",
@@ -51,8 +51,8 @@
   },
   {
     "pname": "FluentAssertions",
-    "version": "6.12.1",
-    "hash": "sha256-R/Fi9eee6T8t8JECxL9+HFd8jAxRMkCg18j+fAQLNqM="
+    "version": "7.2.2",
+    "hash": "sha256-FI9qH9n0Qu8XpevIQghgMOO82VZSz9FjgnMIvymJPAI="
   },
   {
     "pname": "Microsoft.ApplicationInsights",
@@ -61,54 +61,54 @@
   },
   {
     "pname": "Microsoft.AspNetCore.Cryptography.Internal",
-    "version": "9.0.18",
-    "hash": "sha256-2sigYMwiq5w/E2EFTXf1D0IjWW4/1HQMH4HOYfYTYtw="
+    "version": "9.0.19",
+    "hash": "sha256-XPsSeFa0wITp9+biWgvNcgr1BL1CbYcF/hTn+cTNOWs="
   },
   {
     "pname": "Microsoft.AspNetCore.DataProtection",
-    "version": "9.0.18",
-    "hash": "sha256-wLswQ5CrFv93sZ1ZKhxUW1FrWH2KBp96GTqZrozuBVI="
+    "version": "9.0.19",
+    "hash": "sha256-NA7D/y1ERjUsc4up1fm6Yo/3NIBOi1sRnpX95A7fpe0="
   },
   {
     "pname": "Microsoft.AspNetCore.DataProtection.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-Rpas+cH+OSP80wwQ448h0rFUbUG74XJHNtQLL9fUcR4="
+    "version": "9.0.19",
+    "hash": "sha256-fndKWkxrJkY+r7Lv8wINW4uKG5N7mg1O7AEO7qaXmjY="
   },
   {
     "pname": "Microsoft.AspNetCore.Http",
-    "version": "2.3.11",
-    "hash": "sha256-Wy+HphsrkH6r9ljPfQ+k1bgL/nsUKR5A9iCJ7DP33d4="
+    "version": "2.3.12",
+    "hash": "sha256-aXJG/CHxIdPr2Lhcr9iVrQLQLFGL74pQSoIpIdxSDsQ="
   },
   {
     "pname": "Microsoft.AspNetCore.Http.Abstractions",
-    "version": "2.3.10",
-    "hash": "sha256-TlgQug0JPR5vsFsxU0btpa4SbLSLLKZ2T8izyZpkZtM="
+    "version": "2.3.11",
+    "hash": "sha256-TZ29MQF9aJ+Iy3NSszVVDypEv7wXhWfLf5dp1uxxuCA="
   },
   {
     "pname": "Microsoft.AspNetCore.Http.Features",
-    "version": "2.3.9",
-    "hash": "sha256-9VJKZ5adBKRrVp+XRWEQiazv9Q6jj7noT/X693djVgQ="
+    "version": "2.3.10",
+    "hash": "sha256-XD/AU/0g+jriODowOVSPKGrjyQV1OlDrICmAq6xGJ9g="
   },
   {
     "pname": "Microsoft.AspNetCore.JsonPatch",
-    "version": "9.0.18",
-    "hash": "sha256-tKaK64BnFoj/J2DM4qSvO/zQ5alPLEasm6pr3+Tp3CM="
+    "version": "9.0.19",
+    "hash": "sha256-6kBV2zvRNS8SMsOdxW0lxjU7E0YvrD/4WP8bX2GXtag="
   },
   {
     "pname": "Microsoft.AspNetCore.Mvc.NewtonsoftJson",
-    "version": "9.0.18",
-    "hash": "sha256-jbOBm5T8ZlBhips96MI7u7JBLhNT/dX5eHjUQ6cw+dI="
-  },
-  {
-    "pname": "Microsoft.AspNetCore.WebUtilities",
-    "version": "2.3.10",
-    "hash": "sha256-XuHgYt83oinCBcCfY1FJa1PWj/t5kvg/YPse0DlYiUA="
+    "version": "9.0.19",
+    "hash": "sha256-j9Gc0hFdHhTQYXiUfZIJs1l8LOh5yfJ1Pge3qr1HlJg="
   },
   {
     "pname": "Microsoft.AspNetCore.WebUtilities",
     "version": "2.3.11",
     "hash": "sha256-HAGuLuTRLkTTcP9oqRpqPYQmIzQTecUWHI/UTAJ2iMY="
   },
+  {
+    "pname": "Microsoft.AspNetCore.WebUtilities",
+    "version": "2.3.12",
+    "hash": "sha256-js0KyvQlV2ZeQxuLHU8dNj6N1szO3xP3RPo0tpGjPFo="
+  },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
     "version": "6.0.0",
@@ -126,8 +126,8 @@
   },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
-    "version": "9.0.18",
-    "hash": "sha256-FscIiUzpg4lqoV4XU+qHKw1BipCPkC+twxRqcDDy4xo="
+    "version": "9.0.19",
+    "hash": "sha256-7K4FZvcCfZ1vkd5Q3B1Vbd6kURvqlwT960Y79YxAP5E="
   },
   {
     "pname": "Microsoft.Bcl.TimeProvider",
@@ -146,8 +146,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
-    "version": "9.0.18",
-    "hash": "sha256-Th2ejKhzEMKV1FUoj+74zhJIg3jaFhWmtci2utqfIn8="
+    "version": "9.0.19",
+    "hash": "sha256-/pAqE0AtGGYanAmk83vjrwNXIjwpHf5l1x3fJfTsnko="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
@@ -156,8 +156,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-e0ABlyKnPhqtd875N0d04E4bdYWe5MOHK7YZzFM9nnY="
+    "version": "9.0.19",
+    "hash": "sha256-C6zP/A5xBGd4tj+pV7XRL0IInYAB36OqMFP1/DD2dH4="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
@@ -171,23 +171,23 @@
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-xpAbVQ2HlbLiEETz+IHa0Sih68j0HARbUCk423SCdYg="
+    "version": "9.0.19",
+    "hash": "sha256-gUwYr6vb5Y+Nl2PtBgx4xrYgMz6/OgIZNz9hv3cm7aQ="
   },
   {
     "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-Or2ZUfYxYXZ7DrLYCPnkRhsKed4u0/ZElHrg65eovqY="
+    "version": "9.0.19",
+    "hash": "sha256-UfntG1BQUaDIzlJr4+QBDSiqgz90MTnXBQQoyoMtdLk="
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-SSERP6+GvZld+YjmGeAuwt6STik/aA8dR1v/7/kTiHo="
+    "version": "9.0.19",
+    "hash": "sha256-WryzNdWfXpJLY1PqDnO6K9/EXYVK/p0HnxJn7cdi/kI="
   },
   {
     "pname": "Microsoft.Extensions.Hosting.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-VLWUfFSry5RZz+oA6xqaF751QiOQmHKQftDoFbiMzCs="
+    "version": "9.0.19",
+    "hash": "sha256-Bk5FEVg4eotiX1jh62XrVnnXhw2tqpIhGuVJ7opfnMQ="
   },
   {
     "pname": "Microsoft.Extensions.Logging",
@@ -201,8 +201,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "9.0.18",
-    "hash": "sha256-wIfMBf7I1KuDIOyAuIML1Y9cZWkxYUdM3PercoEmSUM="
+    "version": "9.0.19",
+    "hash": "sha256-NUEhzO7a6dhWCLkGA+Op4+60S4jWSDZmh/WH0gr81Yk="
   },
   {
     "pname": "Microsoft.Extensions.ObjectPool",
@@ -221,8 +221,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Options",
-    "version": "9.0.18",
-    "hash": "sha256-AqEIL9qf6OJ4nzZZ/GT/53nz4TQofShVrDQhru/RgZs="
+    "version": "9.0.19",
+    "hash": "sha256-mUd8YqUvGJZSaV7vJ1RN7T/+fU81dwblBLATS8QmxxY="
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
@@ -231,13 +231,13 @@
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
-    "version": "9.0.18",
-    "hash": "sha256-4WejEhNikEJEmlYxjqM5DpAeGH5LiaK9TVtZIBU56ck="
+    "version": "9.0.19",
+    "hash": "sha256-/DpiE48An/Ir7IVQ6+U3FY/e7LcJE1ED4U8mdBu0F4Q="
   },
   {
     "pname": "Microsoft.Net.Http.Headers",
-    "version": "2.3.10",
-    "hash": "sha256-4LG06n+vo2bFpg9dQ9NSLvVf7rQfiD+k0FEq5S6tDsE="
+    "version": "2.3.11",
+    "hash": "sha256-/6ttqU89/nmwSk6KmlbpoKsWqRyS9f0NhvxpnLF0s7E="
   },
   {
     "pname": "Microsoft.NET.Test.Sdk",
@@ -299,6 +299,11 @@
     "version": "17.14.1",
     "hash": "sha256-1cxHWcvHRD7orQ3EEEPPxVGEkTpxom1/zoICC9SInJs="
   },
+  {
+    "pname": "Microsoft.Win32.SystemEvents",
+    "version": "6.0.0",
+    "hash": "sha256-N9EVZbl5w1VnMywGXyaVWzT9lh84iaJ3aD48hIBk1zA="
+  },
   {
     "pname": "MimeMapping",
     "version": "1.0.1.50",
@@ -441,8 +446,8 @@
   },
   {
     "pname": "System.Configuration.ConfigurationManager",
-    "version": "4.4.0",
-    "hash": "sha256-+8wGYllXnIxRzy9dLhZFB88GoPj8ivYXS0KUfcivT8I="
+    "version": "6.0.0",
+    "hash": "sha256-fPV668Cfi+8pNWrvGAarF4fewdPVEDwlJWvJk0y+Cms="
   },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
@@ -456,8 +461,13 @@
   },
   {
     "pname": "System.Diagnostics.EventLog",
-    "version": "9.0.18",
-    "hash": "sha256-pJBU/x5x1qwEjtSjkuTwVB6z04gAxMPPXOSdUIgYe1M="
+    "version": "9.0.19",
+    "hash": "sha256-0wH4FC8pNPr/ImPjID4Eo+MNagrqzQ58p7QLLFWek7g="
+  },
+  {
+    "pname": "System.Drawing.Common",
+    "version": "6.0.0",
+    "hash": "sha256-/9EaAbEeOjELRSMZaImS1O8FmUe8j4WuFUw1VOrPyAo="
   },
   {
     "pname": "System.IO.FileSystem.AccessControl",
@@ -476,8 +486,8 @@
   },
   {
     "pname": "System.IO.Pipelines",
-    "version": "9.0.18",
-    "hash": "sha256-JacrrdrxR6u7aVjeJiSDOptqAV/f3rcszgz/WdCMBkg="
+    "version": "9.0.19",
+    "hash": "sha256-Rh+QmhasR1YKSUlczvC7DyQF2NTSFo4+CL+CkflUcjc="
   },
   {
     "pname": "System.Memory",
@@ -524,25 +534,35 @@
     "version": "5.0.0",
     "hash": "sha256-ueSG+Yn82evxyGBnE49N4D+ngODDXgornlBtQ3Omw54="
   },
+  {
+    "pname": "System.Security.AccessControl",
+    "version": "6.0.0",
+    "hash": "sha256-qOyWEBbNr3EjyS+etFG8/zMbuPjA+O+di717JP9Cxyg="
+  },
   {
     "pname": "System.Security.Cryptography.Pkcs",
-    "version": "9.0.18",
-    "hash": "sha256-D16WfDikzmgkxmEspZqLa8m2UzyjgC3tivTAWCWZ87M="
+    "version": "9.0.19",
+    "hash": "sha256-NwRsuisjPKTvju0emRUkn2FTvgHMeqyr98SbToq9Y4U="
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "4.4.0",
-    "hash": "sha256-Ri53QmFX8I8UH0x4PikQ1ZA07ZSnBUXStd5rBfGWFOE="
+    "version": "6.0.0",
+    "hash": "sha256-Wi9I9NbZlpQDXgS7Kl06RIFxY/9674S7hKiYw5EabRY="
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "9.0.18",
-    "hash": "sha256-JfLdZjyzoRDHV2a6jGwq/xwuGy3T0XZNGB3zK9IAPBE="
+    "version": "9.0.19",
+    "hash": "sha256-f+9uhACebKboLUKT/W1XaRd73QyxA/EloGKx7JKn/8s="
   },
   {
     "pname": "System.Security.Cryptography.Xml",
-    "version": "9.0.18",
-    "hash": "sha256-OzwTTsPo8Gui1xs4+zlILwvZgbcxXJ97m3ejKqnebu4="
+    "version": "9.0.19",
+    "hash": "sha256-SXeOC+lW55jDpSSm+d1dbops2PH/UBiPp4FsJ/hJOvQ="
+  },
+  {
+    "pname": "System.Security.Permissions",
+    "version": "6.0.0",
+    "hash": "sha256-/MMvtFWGN/vOQfjXdOhet1gsnMgh6lh5DCHimVsnVEs="
   },
   {
     "pname": "System.Security.Principal.Windows",
@@ -551,13 +571,13 @@
   },
   {
     "pname": "System.ServiceProcess.ServiceController",
-    "version": "9.0.18",
-    "hash": "sha256-LGttR/XVbEu/ZKz9Np0hTjP0t1TP/3lkQfGxWrhhT10="
+    "version": "9.0.19",
+    "hash": "sha256-wbc8AJNktbSvBZOPFEgpUjt4SnTTG8Tyj3O5OLA4jq8="
   },
   {
     "pname": "System.Text.Encoding.CodePages",
-    "version": "9.0.18",
-    "hash": "sha256-g5Ps501kdW4XXvSQrwb8qJq71I+P48+2T41uBkx42VA="
+    "version": "9.0.19",
+    "hash": "sha256-M+NQmMFdvckrIeucrG7MGu5+OyQsOMrcvM6soY+GcJU="
   },
   {
     "pname": "System.Text.Encodings.Web",
@@ -566,13 +586,13 @@
   },
   {
     "pname": "System.Text.Encodings.Web",
-    "version": "9.0.18",
-    "hash": "sha256-DTjo1Iqkf8qIdwYPKKeddiiU78j/OCvrMITJ3vlPdhU="
+    "version": "9.0.19",
+    "hash": "sha256-VsJS/iiDZp41BY4fcqGZZAh0PYT+H5N13FMPfFeBDX8="
   },
   {
     "pname": "System.Text.Json",
-    "version": "9.0.18",
-    "hash": "sha256-tClFgkq64oP9F4UEZhi2SrvVCkgnOmjVn7p0sbpiwEw="
+    "version": "9.0.19",
+    "hash": "sha256-GbQS+KeI1Q5c9oNG3zERALc52l8RIlgYKmvXNbvbC7M="
   },
   {
     "pname": "System.Threading.Tasks.Extensions",
@@ -584,6 +604,11 @@
     "version": "4.5.4",
     "hash": "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="
   },
+  {
+    "pname": "System.Windows.Extensions",
+    "version": "6.0.0",
+    "hash": "sha256-N+qg1E6FDJ9A9L50wmVt3xPQV8ZxlG1xeXgFuxO+yfM="
+  },
   {
     "pname": "YamlDotNet",
     "version": "18.1.0",
diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix
index ef0c3f036e6e..f26ddba96e85 100644
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jackett";
-  version = "0.24.2406";
+  version = "0.24.2457";
 
   src = fetchFromGitHub {
     owner = "jackett";
     repo = "jackett";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IFz5U91ukmmx53Z7VOmvD+zuqzSf35k1SknjJOGDB6E=";
+    hash = "sha256-oLKej0+Loiwn2yEAOHMeCqv1fU4d0vd7nzX/uTl3dFU=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";

From 7d18398bcbb3eaf0e6325e51a4f19c6bf9e0e326 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 20:46:09 +0000
Subject: [PATCH 446/551] bsky-cli: 0.0.81 -> 0.0.82

---
 pkgs/by-name/bs/bsky-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bs/bsky-cli/package.nix b/pkgs/by-name/bs/bsky-cli/package.nix
index 154f6c686220..6674d6f33675 100644
--- a/pkgs/by-name/bs/bsky-cli/package.nix
+++ b/pkgs/by-name/bs/bsky-cli/package.nix
@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "bsky-cli";
-  version = "0.0.81";
+  version = "0.0.82";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "bsky";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Su2AhHaIozuqTzK1vyAjZR/a01j0dnlayV14Q7hTcCU=";
+    hash = "sha256-2Qtr9Q01ZbjfrZFw8315hDGiX2CmyQ0ru1MhqTvdjVw=";
   };
 
-  vendorHash = "sha256-jGeKaAR0rAqrhoUx/FqdDwdOxA/WioppFjGyi/PsIQs=";
+  vendorHash = "sha256-pICYDE5rpGdyII53Ucxx2u51MG604/yjz9W9xsO3ZLs=";
 
   buildInputs = [
     libpcap

From 53ba6000f4bd4dc88bfb5da511823d9a6fb4e471 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 21:41:12 +0000
Subject: [PATCH 447/551] rustical: 0.15.0 -> 0.16.0

---
 pkgs/by-name/ru/rustical/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rustical/package.nix b/pkgs/by-name/ru/rustical/package.nix
index 66dac4085c2d..64167da240eb 100644
--- a/pkgs/by-name/ru/rustical/package.nix
+++ b/pkgs/by-name/ru/rustical/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rustical";
-  version = "0.15.0";
+  version = "0.16.0";
   __darwinAllowLocalNetworking = true;
 
   src = fetchFromGitHub {
     owner = "lennart-k";
     repo = "rustical";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rQgxbj5etwWH7R1NULHTMrs+KdnP8SYraooYWQgedFI=";
+    hash = "sha256-0IW3sS0CFqcSgiP+3w+SVFerbHX10gIs/I+blKFW4cE=";
   };
 
-  cargoHash = "sha256-+etAoH3sXNhHcRoN74itU9tY3O1h68A6Jq3KbhMtfDQ=";
+  cargoHash = "sha256-zTFDM3nMy5C26Zaz/7eFEe4dSwVXQ7TqN4z+MNRp7XE=";
 
   nativeBuildInputs = [ pkg-config ];
 

From eccb4a4274407e83aa11937d29b911581ad66be7 Mon Sep 17 00:00:00 2001
From: lukas-sgx <lukas.soigneux@epitech.eu>
Date: Mon, 24 Aug 2026 21:42:07 +0000
Subject: [PATCH 448/551] cargo-sort: 2.1.3 -> 2.1.4

---
 pkgs/by-name/ca/cargo-sort/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-sort/package.nix b/pkgs/by-name/ca/cargo-sort/package.nix
index bf7268e72266..3c7b2226f105 100644
--- a/pkgs/by-name/ca/cargo-sort/package.nix
+++ b/pkgs/by-name/ca/cargo-sort/package.nix
@@ -6,13 +6,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-sort";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "devinr528";
     repo = "cargo-sort";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-PtBjs+mqrz9z6tkpajx/OYQATJP81vi4ColjFXr9Rv0=";
+    sha256 = "sha256-xT+fWwd92Ll9zcz7FKpQbHKjUGXNOSuCGpFuJ3DQTJY=";
   };
 
   cargoHash = "sha256-ygMtfhwoUEIZx+q6KB5yOr8/Fj5FRMIs7dXlYDUKb2U=";

From d827507b66b9414dcb4c86e16a80993d68c6d179 Mon Sep 17 00:00:00 2001
From: FelixLusseau <94113911+FelixLusseau@users.noreply.github.com>
Date: Mon, 24 Aug 2026 23:32:36 +0200
Subject: [PATCH 449/551] deezer-desktop: 7.1.300 -> 7.1.310

---
 pkgs/by-name/de/deezer-desktop/package.nix | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/de/deezer-desktop/package.nix b/pkgs/by-name/de/deezer-desktop/package.nix
index 748f1fc59a79..480c23654c53 100644
--- a/pkgs/by-name/de/deezer-desktop/package.nix
+++ b/pkgs/by-name/de/deezer-desktop/package.nix
@@ -8,15 +8,15 @@
 }:
 
 let
-  version = "7.1.300";
+  version = "7.1.310";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
-      hash = "sha256-6vS0jh8eaiZTMYbC/gvaTVGy/VuH1pfhRkbwzg/LJ2k=";
+      hash = "sha256-G1nrkyQR3pduZulFE30DTCTfVMmZe7X6nl6bcDfSf8E=";
     };
     aarch64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
-      hash = "sha256-KNs7rk1LCFhaKhgsw87WrKIMHTvP4mESZPuBgc002+Y=";
+      hash = "sha256-fMShKodtD8/icEcpRIVZZ9H3KlF/GEpMyuihcDkviWk=";
     };
   };
 
@@ -48,10 +48,9 @@ stdenv.mkDerivation (finalAttrs: {
     install -d $out/bin $out/share/deezer-desktop/resources $out/share/applications $out/share/icons/hicolor/scalable/apps
 
     substituteInPlace deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.desktop \
-      --replace-fail "run.sh" "deezer-desktop" \
-      --replace-fail "dev.aunetx.deezer" "deezer-desktop"
-    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.desktop $out/share/applications/deezer-desktop.desktop
-    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.svg $out/share/icons/hicolor/scalable/apps/deezer-desktop.svg
+      --replace-fail "run.sh" "deezer-desktop"
+    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.desktop $out/share/applications/
+    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.svg $out/share/icons/hicolor/scalable/apps/
     cp -r deezer-desktop-${version}-${archDir}/resources/{app.asar,linux} $out/share/deezer-desktop/resources/
 
     makeWrapper "${lib.getExe electron}" "$out/bin/deezer-desktop" \

From 5e86349b2754dc4ae9e83b78419c72639ea7e619 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Mon, 24 Aug 2026 23:52:12 +0200
Subject: [PATCH 450/551] rofi-games: add updateScript

---
 pkgs/by-name/ro/rofi-games/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/ro/rofi-games/package.nix b/pkgs/by-name/ro/rofi-games/package.nix
index 87ab2347004a..51efa1e744b0 100644
--- a/pkgs/by-name/ro/rofi-games/package.nix
+++ b/pkgs/by-name/ro/rofi-games/package.nix
@@ -3,14 +3,18 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
+
   cargo,
   just,
   rofi,
   pkg-config,
+
   glib,
   cairo,
   pango,
   sqlite,
+
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -53,6 +57,8 @@ stdenv.mkDerivation (finalAttrs: {
     sqlite
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     changelog = "https://github.com/Rolv-Apneseth/rofi-games/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     description = "Rofi plugin which adds a mode that will list available games for launch along with their box art";

From f050c03b63e488a341c943a875d5632eb4aa073d Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Mon, 24 Aug 2026 23:59:55 +0200
Subject: [PATCH 451/551] python3Packages.stemming: migrate to pyproject

---
 pkgs/development/python-modules/stemming/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/stemming/default.nix b/pkgs/development/python-modules/stemming/default.nix
index a5eaf6714d3b..59a82280ef96 100644
--- a/pkgs/development/python-modules/stemming/default.nix
+++ b/pkgs/development/python-modules/stemming/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
 }:
 let
   pname = "stemming";
@@ -9,7 +10,7 @@ let
 in
 buildPythonPackage {
   inherit version pname;
-  format = "setuptools";
+  pyproject = true;
 
   # Pypi source package doesn't contain tests
   src = fetchFromGitHub {
@@ -19,6 +20,8 @@ buildPythonPackage {
     hash = "sha256-wnmBCbxnCZ9mN1J7sLcN7OynMcvqgAnhEgpAwW2/xz4=";
   };
 
+  build-system = [ setuptools ];
+
   pythonImportsCheck = [ "stemming" ];
 
   meta = {

From d43eb56566686beca430a75542caf15c6e9d8242 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Tue, 25 Aug 2026 00:09:10 +0200
Subject: [PATCH 452/551] python3Packages.stemming: modernize

---
 pkgs/development/python-modules/stemming/default.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/stemming/default.nix b/pkgs/development/python-modules/stemming/default.nix
index 59a82280ef96..6f1dcac5822d 100644
--- a/pkgs/development/python-modules/stemming/default.nix
+++ b/pkgs/development/python-modules/stemming/default.nix
@@ -4,15 +4,11 @@
   fetchFromGitHub,
   setuptools,
 }:
-let
+buildPythonPackage {
   pname = "stemming";
   version = "1.0.1";
-in
-buildPythonPackage {
-  inherit version pname;
   pyproject = true;
 
-  # Pypi source package doesn't contain tests
   src = fetchFromGitHub {
     owner = "nmstoker";
     repo = "stemming";
@@ -24,6 +20,8 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "stemming" ];
 
+  doCheck = false; # source doesn't contain tests
+
   meta = {
     description = "Python implementations of various stemming algorithms";
     homepage = "https://github.com/nmstoker/stemming";

From 0d6e9157811ba06f5cd20db3998ee4418601e251 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 23:14:05 +0000
Subject: [PATCH 453/551] cri-o-unwrapped: 1.36.3 -> 1.36.4

---
 pkgs/by-name/cr/cri-o-unwrapped/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cr/cri-o-unwrapped/package.nix b/pkgs/by-name/cr/cri-o-unwrapped/package.nix
index ecdf29b84c39..8c2a434796fd 100644
--- a/pkgs/by-name/cr/cri-o-unwrapped/package.nix
+++ b/pkgs/by-name/cr/cri-o-unwrapped/package.nix
@@ -17,13 +17,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cri-o";
-  version = "1.36.3";
+  version = "1.36.4";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AhsSi79HUbNvPoa7duOl9290ZjKss2a6RLvRPHDh6Sg=";
+    hash = "sha256-GgjOY+TE9RcLjy9aSu8Um0Zdzd0juxbTaoT8ljThqws=";
   };
   vendorHash = null;
 

From f8de284d8befd32b351621990ad2e9c2ad89c3e5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 23:20:21 +0000
Subject: [PATCH 454/551] adhammer: 1.3.10 -> 1.4.2

---
 pkgs/by-name/ad/adhammer/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ad/adhammer/package.nix b/pkgs/by-name/ad/adhammer/package.nix
index a7d137916a74..5f6fb23db48e 100644
--- a/pkgs/by-name/ad/adhammer/package.nix
+++ b/pkgs/by-name/ad/adhammer/package.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "adhammer";
-  version = "1.3.10";
+  version = "1.4.2";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "icedracon";
     repo = "adhammer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QQjiyvj3e5unEsh17UyKck2rs8oKeLO5eodBG7cn1LQ=";
+    hash = "sha256-Jn3hmCSpc/9zxfIzebrCkDOgZ4HzfXdKOcJSXNvxZGM=";
   };
 
-  cargoHash = "sha256-Ebkvxl/JyiZ84ucv7FmOluHTqYd14I3B6z53QNmVQZw=";
+  cargoHash = "sha256-037x5bhTizcCqW/pszIadAVA9ElQzJOQ9W1dh5Kpg9Y=";
 
   nativeBuildInputs = [
     pkg-config

From bb92730f6e97ca1c19e285a872cdd62a1a25c467 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 23:59:55 +0000
Subject: [PATCH 455/551] openhack: 0.2.3 -> 0.2.4

---
 pkgs/by-name/op/openhack/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/openhack/package.nix b/pkgs/by-name/op/openhack/package.nix
index 172f9d46efd3..e6674e07d6b6 100644
--- a/pkgs/by-name/op/openhack/package.nix
+++ b/pkgs/by-name/op/openhack/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "openhack";
-  version = "0.2.3";
+  version = "0.2.4";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "openhackai";
     repo = "openhack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ptM4jL+Wjmz9n4HPa87s5kLHU1OhSyD2AEz0m/i6E3o=";
+    hash = "sha256-vdjOjCeYXlwia1NBKkD94fPHjb4Ho/69NrCOLoz51No=";
   };
 
   build-system = with python3Packages; [ hatchling ];

From 969d76611b81be00aed5d6d4ef9c382f54fc91d6 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Mon, 24 Aug 2026 19:52:12 -0400
Subject: [PATCH 456/551] cpp-netlib: drop

cpp-netlib is unmaintained in both nixpkgs and upstream (last commit
september 2023). it requires us to pin several old versions, such as
llvm/clang 18 and boost 1.86. most of the changes in nixpkgs in recent
years have been treewides and zhf-style changes. this is not likely to
be sustainable going forward, and since it's a leaf, let's simply drop
this and avoid the trouble.
---
 .../0001-Compatibility-with-boost-1.83.patch  | 33 ----------
 pkgs/by-name/cp/cpp-netlib/package.nix        | 62 -------------------
 pkgs/top-level/aliases.nix                    |  1 +
 3 files changed, 1 insertion(+), 95 deletions(-)
 delete mode 100644 pkgs/by-name/cp/cpp-netlib/0001-Compatibility-with-boost-1.83.patch
 delete mode 100644 pkgs/by-name/cp/cpp-netlib/package.nix

diff --git a/pkgs/by-name/cp/cpp-netlib/0001-Compatibility-with-boost-1.83.patch b/pkgs/by-name/cp/cpp-netlib/0001-Compatibility-with-boost-1.83.patch
deleted file mode 100644
index 2c860aaba4f7..000000000000
--- a/pkgs/by-name/cp/cpp-netlib/0001-Compatibility-with-boost-1.83.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 8be99f5972826c25378bccb9fbd7291623c7b2a7 Mon Sep 17 00:00:00 2001
-From: Moraxyc <i@qaq.li>
-Date: Fri, 9 May 2025 13:39:17 +0800
-Subject: [PATCH] Compatibility with boost 1.83
-
----
- boost/network/protocol/http/server/impl/parsers.ipp | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/boost/network/protocol/http/server/impl/parsers.ipp b/boost/network/protocol/http/server/impl/parsers.ipp
-index c31e60e..3272c2f 100755
---- a/boost/network/protocol/http/server/impl/parsers.ipp
-+++ b/boost/network/protocol/http/server/impl/parsers.ipp
-@@ -13,6 +13,7 @@
- #include <tuple>
- #include <boost/fusion/include/std_tuple.hpp>
- #include <boost/network/protocol/http/message/header.hpp>
-+#include <boost/regex/pending/unicode_iterator.hpp>
- 
- #ifdef BOOST_NETWORK_NO_LIB
- #ifndef BOOST_NETWORK_INLINE
-@@ -32,7 +33,7 @@ typedef std::basic_string<uint32_t> u32_string;
- template <>  // <typename Attrib, typename T, typename Enable>
- struct assign_to_container_from_value<std::string, u32_string, void> {
-   static void call(u32_string const& val, std::string& attr) {
--    u32_to_u8_iterator<u32_string::const_iterator> begin = val.begin(),
-+    boost::u32_to_u8_iterator<u32_string::const_iterator> begin = val.begin(),
-                                                    end = val.end();
-     for (; begin != end; ++begin) attr += *begin;
-   }
--- 
-2.48.1
-
diff --git a/pkgs/by-name/cp/cpp-netlib/package.nix b/pkgs/by-name/cp/cpp-netlib/package.nix
deleted file mode 100644
index 665f240c54cd..000000000000
--- a/pkgs/by-name/cp/cpp-netlib/package.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  boost186,
-  openssl,
-  llvmPackages_18,
-}:
-let
-  # std::char_traits has been removed
-  stdenvForCppNetlib = if stdenv.hostPlatform.isDarwin then llvmPackages_18.stdenv else stdenv;
-in
-stdenvForCppNetlib.mkDerivation rec {
-  pname = "cpp-netlib";
-  version = "0.13.0-final";
-
-  src = fetchFromGitHub {
-    owner = "cpp-netlib";
-    repo = "cpp-netlib";
-    tag = "cpp-netlib-${version}";
-    sha256 = "18782sz7aggsl66b4mmi1i0ijwa76iww337fi9sygnplz2hs03a3";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # 'u32_to_u8_iterator' was not declared
-    ./0001-Compatibility-with-boost-1.83.patch
-  ];
-
-  # CMake 2.8 is deprecated and is no longer supported by CMake > 4
-  # https://github.com/NixOS/nixpkgs/issues/445447
-  postPatch = ''
-    substituteInPlace CMakeLists.txt --replace-fail \
-      "cmake_minimum_required(VERSION 2.8)" \
-      "cmake_minimum_required(VERSION 3.10)"
-  '';
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [
-    # io_service.hpp has been removed in boost 1.87+
-    boost186
-    openssl
-  ];
-
-  cmakeFlags = [
-    "-DCPP-NETLIB_BUILD_SHARED_LIBS=ON"
-    # fatal error: 'boost/asio/stream_socket_service.hpp' file not found
-    "-DCPP-NETLIB_BUILD_EXAMPLES=OFF"
-    "-DCPP-NETLIB_BUILD_TESTS=OFF"
-  ];
-
-  # Most tests make network GET requests to various websites
-  doCheck = false;
-
-  meta = {
-    description = "Collection of open-source libraries for high level network programming";
-    homepage = "https://cpp-netlib.org";
-    license = lib.licenses.boost;
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d39835dec229..092e2f61a55e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -610,6 +610,7 @@ mapAliases {
   cotton = throw "'cotton' has been removed since it is vulnerable to CVE-2025-62518 and upstream is unmaintained"; # Added 2025-10-26
   cpp2a-kernel = cpp20-kernel; # Added 2026-06-30, xeus-cling removed in favour of xeus-cpp
   cpp-ipfs-api = throw "'cpp-ipfs-api' has been renamed to/replaced by 'cpp-ipfs-http-client'"; # Converted to throw 2025-10-27
+  cpp-netlib = throw "'cpp-netlib' has been removed as it was unmaintained uptream and relied on several outdated versions of dependencies."; # Added 2026-08-25
   cpr = warnAlias "'cpr' has been renamed to/replaced by 'libcpr'" libcpr; # Added 2025-11-17
   cqrlog = throw "'cqrlog' was removed due to lack of maintenance and relying on gtk2"; # Added 2025-12-02
   crabfit-api = throw "'crabfit-api' has been removed because it is unmaintained upstream and insecure."; # Added 2025-11-29

From e1ff785a43b2bada87f56ca4cad1410173729595 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 00:14:24 +0000
Subject: [PATCH 457/551] javaPackages.compiler.openjdk11: 11.0.32+9 ->
 11.0.32.1+1

---
 pkgs/development/compilers/openjdk/11/source.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/openjdk/11/source.json b/pkgs/development/compilers/openjdk/11/source.json
index e1ee5457ea14..bded9bb92a3f 100644
--- a/pkgs/development/compilers/openjdk/11/source.json
+++ b/pkgs/development/compilers/openjdk/11/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-2j3rFo7jRAQ/a+z2og0Nhrf1eyHarzb4vDTbrRtXwB4=",
+  "hash": "sha256-vXJaEXp8cum+sXm9dnmVeDsZBobeHh82Jd8jIND03Yk=",
   "owner": "openjdk",
   "repo": "jdk11u",
-  "rev": "refs/tags/jdk-11.0.32+9"
+  "rev": "refs/tags/jdk-11.0.32.1+1"
 }

From 43c5a160216d5a59b2c3ffa58ec287f48b1f88c9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 00:27:27 +0000
Subject: [PATCH 458/551] libretro.bluemsx: 0-unstable-2026-07-29 ->
 0-unstable-2026-08-23

---
 pkgs/applications/emulators/libretro/cores/bluemsx.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/bluemsx.nix b/pkgs/applications/emulators/libretro/cores/bluemsx.nix
index 9f94477e5346..5a33017f833e 100644
--- a/pkgs/applications/emulators/libretro/cores/bluemsx.nix
+++ b/pkgs/applications/emulators/libretro/cores/bluemsx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bluemsx";
-  version = "0-unstable-2026-07-29";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bluemsx-libretro";
-    rev = "0f32f52c48d3e772bfdf0379756f81f00b4e08bc";
-    hash = "sha256-4XjaPkv5Tm58nhU6JUdiZXbto/uePljwXpcePRCqVus=";
+    rev = "e3086eb5d36d77fa11704cf53dc176686e70127d";
+    hash = "sha256-cwyXtawCUyM/ISswY+O3bzGFX0wNayb/VAIv99E9esI=";
   };
 
   meta = {

From 56e01a438be1a2c1f3a742c231b212d69a5296cd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 01:09:46 +0000
Subject: [PATCH 459/551] xdg-desktop-portal-umbriel: 0-unstable-2026-08-23 ->
 0-unstable-2026-08-24

---
 pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix
index a4b1fe2404a5..a73e30f5ad60 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-umbriel/package.nix
@@ -21,7 +21,7 @@
 }:
 stdenv.mkDerivation {
   pname = "xdg-desktop-portal-umbriel";
-  version = "0-unstable-2026-08-23";
+  version = "0-unstable-2026-08-24";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -30,8 +30,8 @@ stdenv.mkDerivation {
     owner = "noctalia-dev";
     repo = "xdg-desktop-portal-umbriel";
     # No tagged releases yet
-    rev = "c8a9a223d48e6c62652f3f3cfaaa0f50aca39146";
-    hash = "sha256-jQFZRDnoaa0EvB9b55J1eYyfwCfD9LO2bwT1NVNbUME=";
+    rev = "515c9f70f13ba4b4b9e19930b3e899c4ac8a50a4";
+    hash = "sha256-fqU58lZeFchlY5aqyQgIfrN5ec/jqbhXNwNxyL2lp/g=";
   };
 
   nativeBuildInputs = [

From e7d5b03ae5d17afff0d02f17e9d38b732115e0f4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 01:12:20 +0000
Subject: [PATCH 460/551] umbriel: 0-unstable-2026-08-23 ->
 0-unstable-2026-08-25

---
 pkgs/by-name/um/umbriel/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/um/umbriel/package.nix b/pkgs/by-name/um/umbriel/package.nix
index a3ed1b57eb24..e813bdec3c13 100644
--- a/pkgs/by-name/um/umbriel/package.nix
+++ b/pkgs/by-name/um/umbriel/package.nix
@@ -30,7 +30,7 @@
 }:
 stdenv.mkDerivation {
   pname = "umbriel";
-  version = "0-unstable-2026-08-23";
+  version = "0-unstable-2026-08-25";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -39,9 +39,9 @@ stdenv.mkDerivation {
     owner = "noctalia-dev";
     repo = "umbriel";
     # No tagged releases yet
-    rev = "8650637f6fdb3cb78022a4560f5f34861439dbad";
+    rev = "af351dfa7564eaa0e73d215d057eb0b209cba057";
     fetchSubmodules = true;
-    hash = "sha256-WSTWPuF6KkSaO+zudERJCuga4BQzIH/RJdpvpkLVH4Q=";
+    hash = "sha256-y/ofPV9De3qxrLsmmAUs4fX/ZaNBquqvm6VvnnNXXhA=";
   };
 
   nativeBuildInputs = [

From 5d23d92c27e7a3cf92a9731f7ce17a30d0154c3b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 01:19:55 +0000
Subject: [PATCH 461/551] pyscan: 0.1.4 -> 2.1.3

---
 pkgs/by-name/py/pyscan/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/py/pyscan/package.nix b/pkgs/by-name/py/pyscan/package.nix
index 7482b3eb7691..1dde51029347 100644
--- a/pkgs/by-name/py/pyscan/package.nix
+++ b/pkgs/by-name/py/pyscan/package.nix
@@ -13,7 +13,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pyscan";
-  version = "0.1.4";
+  version = "2.1.3";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -22,12 +22,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "ohaswin";
     repo = "pyscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n1mwOYntWyW7lPKPLgG7PteTRh3mly5vqbKy2R/9xnw=";
+    hash = "sha256-I5Chs9N/ZH7NM1CsaIKjO0eS68/t+wZaHGEO59Ur/+8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-QzFUoHfvjd6ZMkKIsGXIVyks2LxdJblIiQccsOoYcJs=";
+    hash = "sha256-Y3fxKYpGJCX4VECe0mmP2lDZc4efd9tNXY8YLeQXXRk=";
   };
 
   build-system = [

From d5d8a177244b0dabb4eb7ccbd1e735ffea93e875 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Tue, 25 Aug 2026 01:16:23 +0000
Subject: [PATCH 462/551] alsa-utils: fix cross-compiled shebangs

before:
  ```
  $ head -n1 $(nix-build -A pkgsCross.aarch64-multiplatform.alsa-utils)/bin/.alsa-info-wrapped
  #!/bin/bash
  ```

and the resulting `alsa-info` would fail when invoked: "/bin/bash: bad interpreter: No such file or directory"

after:
  ```
  $ head -n1 $(nix-build -A pkgsCross.aarch64-multiplatform.alsa-utils)/bin/.alsa-info-wrapped
  #!/nix/store/p6mqrxz3wl8fvqcqqf498nyp88lv8687-bash-aarch64-unknown-linux-gnu-5.3p15/bin/bash
  ```
---
 pkgs/by-name/al/alsa-utils/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/al/alsa-utils/package.nix b/pkgs/by-name/al/alsa-utils/package.nix
index 91653a4848b6..4ad614132da5 100644
--- a/pkgs/by-name/al/alsa-utils/package.nix
+++ b/pkgs/by-name/al/alsa-utils/package.nix
@@ -5,6 +5,7 @@
   fetchurl,
   alsa-lib,
   alsa-plugins,
+  bashNonInteractive,
   gettext,
   makeWrapper,
   pkg-config,
@@ -45,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
   buildInputs = [
+    bashNonInteractive
     alsa-lib
     ncurses
     libsamplerate

From 44c26f59a7c3ed8729af1bc26ba49e9563164f92 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 01:33:21 +0000
Subject: [PATCH 463/551] vkd3d: 2.0 -> 2.1

---
 pkgs/by-name/vk/vkd3d/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vk/vkd3d/package.nix b/pkgs/by-name/vk/vkd3d/package.nix
index cc2d5ed3ec83..7312ac84837a 100644
--- a/pkgs/by-name/vk/vkd3d/package.nix
+++ b/pkgs/by-name/vk/vkd3d/package.nix
@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vkd3d";
-  version = "2.0";
+  version = "2.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.winehq.org";
     owner = "wine";
     repo = "vkd3d";
     tag = "vkd3d-${finalAttrs.version}";
-    hash = "sha256-S0sQaDt0aYYi2Rs/MNRIQ9oOuHm9/LsxaSL93M5jBRw=";
+    hash = "sha256-ruknQ1etTYFxKSu6GZvNz+YEtRNIdJrx+F4bX6CZiiU=";
   };
 
   outputs = [

From 1a09b1f8530dcabc979f78431541a8c93260177e Mon Sep 17 00:00:00 2001
From: dram <dramforever@live.com>
Date: Tue, 25 Aug 2026 09:36:16 +0800
Subject: [PATCH 464/551] Revert "scx.rustscheds: 1.1.2 -> 1.1.3"

---
 nixos/tests/scx/default.nix                   | 2 --
 pkgs/os-specific/linux/scx/scx_rustscheds.nix | 7 +++----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/nixos/tests/scx/default.nix b/nixos/tests/scx/default.nix
index 65cc84bc718f..41c7b84c90b7 100644
--- a/nixos/tests/scx/default.nix
+++ b/nixos/tests/scx/default.nix
@@ -20,7 +20,6 @@
       flow.configuration.services.scx.scheduler = "scx_flow";
       forge.configuration.services.scx.scheduler = "scx_forge";
       lavd.configuration.services.scx.scheduler = "scx_lavd";
-      mlfq.configuration.services.scx.scheduler = "scx_mlfq";
       p2dq.configuration.services.scx.scheduler = "scx_p2dq";
       pandemonium.configuration.services.scx.scheduler = "scx_pandemonium";
       rlfifo.configuration.services.scx.scheduler = "scx_rlfifo";
@@ -41,7 +40,6 @@
       "flow",
       "forge",
       "lavd",
-      "mlfq",
       "p2dq",
       "pandemonium",
       "rlfifo",
diff --git a/pkgs/os-specific/linux/scx/scx_rustscheds.nix b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
index 68b2774882d2..6d1b52807861 100644
--- a/pkgs/os-specific/linux/scx/scx_rustscheds.nix
+++ b/pkgs/os-specific/linux/scx/scx_rustscheds.nix
@@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "scx_rustscheds";
-  version = "1.1.3";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "sched-ext";
     repo = "scx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LK0go5blWgCtDpS5xm9BQc7C2NvbfrW+Jp66ImIThxA=";
+    hash = "sha256-igrmrfimVOEJnFxMr9ghN6lAHwEBSFLLVrB2MQ72PXI=";
   };
 
-  cargoHash = "sha256-vEsbpor52DEUpYO5OubFPMzRltO5kUXjqAoO/9hsKXc=";
+  cargoHash = "sha256-CTEVdvw6aG/fFas2Fk3x9o4Sp2k3lHO/OLwUM8t9UjE=";
 
   nativeBuildInputs = [
     pkg-config
@@ -95,7 +95,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "scx_lavd"
     "scx_layered"
     "scx_mitosis"
-    "scx_mlfq"
     "scx_p2dq"
     "scx_pandemonium"
     "scx_rlfifo"

From 465fe801bb09afb0bbb640090a785e4c79f6f3b4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 01:46:47 +0000
Subject: [PATCH 465/551] python3Packages.opower: 0.19.0 -> 0.20.0

---
 pkgs/development/python-modules/opower/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index a06c810156bf..af6c25828a76 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "opower";
-  version = "0.19.0";
+  version = "0.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tronikos";
     repo = "opower";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EMR04egHcv2Ln51g+t7uEAoC19JKa6lw7VhpaZJlrG0=";
+    hash = "sha256-ZNWZ46UWMcp0imJi9WFdfNnXrGx+5tHsf33F58Pn4XA=";
   };
 
   build-system = [ setuptools ];

From d9632cf486b265b34922874be68b19b898cf3111 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Mon, 24 Aug 2026 21:49:30 -0400
Subject: [PATCH 466/551] beamPackages: add extend throw to guide users

---
 pkgs/development/beam-modules/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/beam-modules/default.nix b/pkgs/development/beam-modules/default.nix
index 5e7622a3c11b..ac2536a46c92 100644
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@@ -91,6 +91,11 @@ makeScopeWithSplicing' {
 
     }
     // lib.optionalAttrs config.allowAliases {
+      extend = throw ''
+        'beamPackages.extend' has been replaced by 'beamPackages.overrideScope'
+
+        See examples at https://nixos.org/manual/nixpkgs/unstable/#sec-beam
+      ''; # added 2026-08-24
       webdriver = throw "'beamPackages.webdriver' has been removed."; # added 2026-07-29
     };
 

From 9aedad8eb453de126fc7f7a7029af2b5fef352fd Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Tue, 25 Aug 2026 12:16:19 +1000
Subject: [PATCH 467/551] prometheus-alertmanager: fix ui build

follow up from https://github.com/NixOS/nixpkgs/commit/bab9648f114253ff920e20ea82ebb822ad559229
---
 pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix b/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix
index 8beaa9c5f34e..7c0422035e05 100644
--- a/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix
+++ b/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix
@@ -13,6 +13,7 @@ buildNpmPackage (finalAttrs: {
   postPatch = ''
     # don't download elm from github
     sed -i '/"elm":/d' package.json
+    substituteInPlace elm.json --replace-fail "0.19.1" "${elmPackages.elm.version}"
   '';
 
   postConfigure = (

From 3532c0dda97f36bc0e5178be56733fb6dff31907 Mon Sep 17 00:00:00 2001
From: pancho horrillo <pancho@pancho.name>
Date: Tue, 25 Aug 2026 04:39:46 +0200
Subject: [PATCH 468/551] Revert "doc/rl-2611: add Emacs 31.1"

This reverts commit 47a4ab7a966902f2fde313cb7e77ce1b967a6173.

It was prematurely added, since the PR it belongs to only updates
emacs31 attrs, not top-level emacs attrs.

See https://github.com/NixOS/nixpkgs/pull/556042#discussion_r3847137386
for context.
---
 doc/release-notes/rl-2611.section.md | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 51c0a4e2ccb7..962a303c1a83 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -16,11 +16,6 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
-- Emacs has been updated to 31.1.
-  This introduces some backwards‐incompatible changes; see the NEWS for details.
-  NEWS can be viewed from Emacs by typing `C-h n`, or by clicking `Help->Emacs News` from the menu bar.
-  It can also be browsed [online](https://cgit.git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-31).
-
 - `sing-box` now supports NaïveProxy outbounds.
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}

From 244b9ae91311a95a09d78145349f94b88577fb1a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 02:43:55 +0000
Subject: [PATCH 469/551] curl-impersonate: 2.1.0 -> 2.1.1

---
 pkgs/by-name/cu/curl-impersonate/deps.nix    | 4 +++-
 pkgs/by-name/cu/curl-impersonate/package.nix | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cu/curl-impersonate/deps.nix b/pkgs/by-name/cu/curl-impersonate/deps.nix
index 0764c5832ad3..d49fdb94db3c 100644
--- a/pkgs/by-name/cu/curl-impersonate/deps.nix
+++ b/pkgs/by-name/cu/curl-impersonate/deps.nix
@@ -1,5 +1,7 @@
 # Generated by update.sh
-{ fetchurl }: {
+{ fetchurl }:
+
+{
   "curl-8_21_0.tar.gz" = fetchurl {
     url = "https://github.com/curl/curl/archive/curl-8_21_0.tar.gz";
     hash = "sha256-7HU6pvQIo8qfDW1fendBeuzRVE2xPAOuXUQ2Er82c2Q=";
diff --git a/pkgs/by-name/cu/curl-impersonate/package.nix b/pkgs/by-name/cu/curl-impersonate/package.nix
index c483306f8529..e2c3da0ccd50 100644
--- a/pkgs/by-name/cu/curl-impersonate/package.nix
+++ b/pkgs/by-name/cu/curl-impersonate/package.nix
@@ -17,7 +17,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "curl-impersonate";
-  version = "2.1.0";
+  version = "2.1.1";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     owner = "lexiforest";
     repo = "curl-impersonate";
     tag = "v${version}";
-    hash = "sha256-gN4TD+WxQM2eJofHsOHA/JpH6bQ8CI3VUTPL8NuySn4=";
+    hash = "sha256-AgC66L0z6cYVqePwc7yO1iO9F/6YD6dTqWKCcCrNLzc=";
   };
 
   separateDebugInfo = true;

From 443134fd41055b7251c9552977de26aa938827e0 Mon Sep 17 00:00:00 2001
From: Evan Porter <evanwporter@gmail.com>
Date: Mon, 24 Aug 2026 20:06:56 -0700
Subject: [PATCH 470/551] vimPlugins.profile-nvim: init at
 0-unstable-2025-03-05

---
 .../applications/editors/vim/plugins/generated.nix | 14 ++++++++++++++
 .../editors/vim/plugins/vim-plugin-names           |  1 +
 2 files changed, 15 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 64a70747c57e..ad8c769622ee 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -15316,6 +15316,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  profile-nvim = buildVimPlugin {
+    pname = "profile.nvim";
+    version = "0-unstable-2025-03-05";
+    src = fetchFromGitHub {
+      owner = "stevearc";
+      repo = "profile.nvim";
+      rev = "30433d7513f0d14665c1cfcea501c90f8a63e003";
+      hash = "sha256-2Mk6VbC+K/WhTWF+yHyDhQKJhTi2rpo8VJsnO7ofHXs=";
+    };
+    meta.homepage = "https://github.com/stevearc/profile.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
     version = "6.0.1-1";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 67032e537d05..f5129020cb46 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1092,6 +1092,7 @@ https://github.com/sotte/presenting.vim/,,
 https://github.com/ewilazarus/preto/,,
 https://github.com/anuvyklack/pretty-fold.nvim/,,
 https://github.com/vim-scripts/prev_indent/,,
+https://github.com/stevearc/profile.nvim/,,
 https://github.com/DrKJeff16/project.nvim/,,
 https://github.com/GnikDroy/projections.nvim/,,
 https://github.com/kevinhwang91/promise-async/,,

From c48df986d6a4533b197701a2f8d2d9e3a19bc570 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 04:07:03 +0000
Subject: [PATCH 471/551] liquibase: 5.0.3 -> 5.0.4

---
 pkgs/by-name/li/liquibase/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/liquibase/package.nix b/pkgs/by-name/li/liquibase/package.nix
index 4082e0009637..ecf6e2d6c29f 100644
--- a/pkgs/by-name/li/liquibase/package.nix
+++ b/pkgs/by-name/li/liquibase/package.nix
@@ -27,11 +27,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "liquibase";
-  version = "5.0.3";
+  version = "5.0.4";
 
   src = fetchurl {
     url = "https://github.com/liquibase/liquibase/releases/download/v${finalAttrs.version}/liquibase-${finalAttrs.version}.tar.gz";
-    hash = "sha256-hlqrORvpy+P+4iRhOS1dKap2ZSWWWYsUcAo/XwXJ4rc=";
+    hash = "sha256-uwhjjXDd3Wr4zKbgMxSFdvghS1mWgxsfiGTrNSj0z84=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 921f175c0ee0b07a873babcd7af9461039e465b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 25 Aug 2026 06:42:49 +0200
Subject: [PATCH 472/551] python3Packages.httpx2: disable a test on darwin

https://hydra.nixos.org/build/343024991/step/3/log/tail
I don't know why it fails, but it doesn't feel worth
blocking 2k jobs on darwin (and nixpkgs-unstable) on this.
---
 pkgs/development/python-modules/httpx2/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/httpx2/default.nix b/pkgs/development/python-modules/httpx2/default.nix
index a92c7ccb868d..a87bc2aacef3 100644
--- a/pkgs/development/python-modules/httpx2/default.nix
+++ b/pkgs/development/python-modules/httpx2/default.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   lib,
   buildPythonPackage,
   fetchFromGitHub,
@@ -114,6 +115,9 @@ buildPythonPackage (finalAttrs: {
     "test_client_decode_text_using_autodetect"
     "test_client_decode_text_using_explicit_encoding"
     "test_response_decode_text_using_autodetect"
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # TODO?
+    "test_keepalive_ping"
   ];
 
   passthru.tests = {

From 84ee00e637f5e0d858e6690f774c2d45fdfcf494 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 04:53:49 +0000
Subject: [PATCH 473/551] terraform-providers.oracle_oci: 8.27.0 -> 8.28.0

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 6e0825105bbd..b7a282305d39 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1058,11 +1058,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-YcKLw5PotrwRdGEmPzy1Ka/doJ9fDbKuP6Q9Dw24mG0=",
+    "hash": "sha256-3/apEon1W1iaB7UIkYgI4POV+f1uVDVXX4V6dyeqsLk=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.27.0",
+    "rev": "v8.28.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

From d588db72542151498c02d9ef960c4c9c697a066a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 05:13:08 +0000
Subject: [PATCH 474/551] zashboard: 3.19.0 -> 3.22.0

---
 pkgs/by-name/za/zashboard/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/za/zashboard/package.nix b/pkgs/by-name/za/zashboard/package.nix
index b1fd526438c0..53c9057c82aa 100644
--- a/pkgs/by-name/za/zashboard/package.nix
+++ b/pkgs/by-name/za/zashboard/package.nix
@@ -12,13 +12,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "zashboard";
-  version = "3.19.0";
+  version = "3.22.0";
 
   src = fetchFromGitHub {
     owner = "Zephyruso";
     repo = "zashboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lFuM6ovnFJysndARV00A659nXIlG+tMNuXv2Z7DlQZM=";
+    hash = "sha256-K7WZnFXgiSI/pxhDWfoWX9tHKJiNK1wbO6qowUu1hOo=";
   };
 
   npmDeps = null;
@@ -26,7 +26,7 @@ buildNpmPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-UjoY2/cLJ0chdZ2VUq/7KoJXRhLrJAADi8jEYjHKdmw=";
+    hash = "sha256-jbTAN9QbhXiGzD/McdoN62JIdRL8MA/v/kdLawWbokU=";
   };
 
   nativeBuildInputs = [ pnpm ];

From b1bfb851f28bda004e8bceeb073d4e6126adfcdd Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 25 Aug 2026 08:36:00 +0300
Subject: [PATCH 475/551] kdePackages.kwin: backport crash fix

---
 pkgs/kde/plasma/kwin/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/kde/plasma/kwin/default.nix b/pkgs/kde/plasma/kwin/default.nix
index 55538a99fba5..2d4a2861240a 100644
--- a/pkgs/kde/plasma/kwin/default.nix
+++ b/pkgs/kde/plasma/kwin/default.nix
@@ -17,6 +17,7 @@
   lcms2,
   pipewire,
   python3,
+  fetchpatch,
 }:
 mkKdeDerivation {
   pname = "kwin";
@@ -24,6 +25,13 @@ mkKdeDerivation {
   patches = [
     ./0003-plugins-qpa-allow-using-nixos-wrapper.patch
     ./0001-NixOS-Unwrap-executable-name-for-.desktop-search.patch
+
+    # backport crash fix with latest Mesa
+    # FIXME: remove in next update
+    (fetchpatch {
+      url = "https://invent.kde.org/plasma/kwin/-/commit/2d0613acd044544e79b034b1cbc248664edf2884.diff";
+      hash = "sha256-dpflStJ01aChNYDO+dfI67LhLWoC3sovaAza1AIck1E=";
+    })
   ];
 
   postPatch = ''

From 41f94445074c9059d46b9485999f9ced3faf2b14 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 25 Aug 2026 08:52:51 +0300
Subject: [PATCH 476/551] python3Packages.httpx2: nixfmt

---
 pkgs/development/python-modules/httpx2/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/httpx2/default.nix b/pkgs/development/python-modules/httpx2/default.nix
index a87bc2aacef3..962f8760414e 100644
--- a/pkgs/development/python-modules/httpx2/default.nix
+++ b/pkgs/development/python-modules/httpx2/default.nix
@@ -115,7 +115,8 @@ buildPythonPackage (finalAttrs: {
     "test_client_decode_text_using_autodetect"
     "test_client_decode_text_using_explicit_encoding"
     "test_response_decode_text_using_autodetect"
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # TODO?
     "test_keepalive_ping"
   ];

From b0de0d81af996901aecbc6a6d3492d32ab4243c5 Mon Sep 17 00:00:00 2001
From: kurogeek <kurogeek@lmvhaus.com>
Date: Tue, 25 Aug 2026 12:41:37 +0700
Subject: [PATCH 477/551] python3Packages.python-youtube: skip failing tests

---
 pkgs/development/python-modules/python-youtube/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/python-youtube/default.nix b/pkgs/development/python-modules/python-youtube/default.nix
index 2f5c72a2185b..5bab4a15a1a0 100644
--- a/pkgs/development/python-modules/python-youtube/default.nix
+++ b/pkgs/development/python-modules/python-youtube/default.nix
@@ -45,6 +45,11 @@ buildPythonPackage rec {
     pytest-cov-stub
   ];
 
+  disabledTests = [
+    # This test try to make request to the internet
+    "test_parse_response"
+  ];
+
   meta = {
     description = "Simple Python wrapper around for YouTube Data API";
     homepage = "https://github.com/sns-sdks/python-youtube";

From 543a603ccbd8ee5fd26c0ae24a3a7e9e9802bd37 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 25 Aug 2026 08:42:37 +0300
Subject: [PATCH 478/551] qt6.qtbase: backport icon theme fix

---
 pkgs/development/libraries/qt-6/modules/qtbase/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index 7686093f4d75..3704ac8354ed 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -251,6 +251,12 @@ stdenv.mkDerivation {
       url = "https://github.com/qt/qtbase/commit/515cbbacfba9f4259c9c3b0714a31222c2b4c879.diff";
       hash = "sha256-93tzp4O7dZxRZv7ilN/gbQSVmaeOGmxpYgM7aomN0n8=";
     })
+
+    # icon loading fix
+    (fetchpatch {
+      url = "https://github.com/qt/qtbase/commit/85420d5d4f78a6ba4cf70ed8ee092e0ef4fb9a54.diff";
+      hash = "sha256-BFL1mtwzEH0uUYbeUZDC2Fcp9pjBhtSYOaSxxVILe30=";
+    })
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''

From cf408531517803e8c141a04deb8b5d155f552ddf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 06:30:12 +0000
Subject: [PATCH 479/551] clboss: 0.16.2 -> 0.16.3

---
 pkgs/by-name/cl/clboss/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cl/clboss/package.nix b/pkgs/by-name/cl/clboss/package.nix
index 690ddb811cee..42174eee0d5b 100644
--- a/pkgs/by-name/cl/clboss/package.nix
+++ b/pkgs/by-name/cl/clboss/package.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clboss";
-  version = "0.16.2";
+  version = "0.16.3";
 
   # The release tarball includes the pre-generated file `commit_hash.h` that is required for building
   src = fetchzip {
     url = "https://github.com/ZmnSCPxj/clboss/releases/download/v${finalAttrs.version}/clboss-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-I83OH+31oqx2FSjzEIsz7uOko3/MbUqjrZ+xZTXxtto=";
+    hash = "sha256-lniKkyynkyzFBJBRTaPiGTVG9semZDhjpCxjyRDzt/g=";
   };
 
   nativeBuildInputs = [

From 5ef63701a8e71d1251a6477e08e9a4f818164581 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 25 Aug 2026 06:48:08 +0000
Subject: [PATCH 480/551] csharp-ls: remove aarch64-darwin from
 meta.badPlatforms

---
 pkgs/by-name/cs/csharp-ls/package.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/by-name/cs/csharp-ls/package.nix b/pkgs/by-name/cs/csharp-ls/package.nix
index 7335c3cd4f80..b4d236c836be 100644
--- a/pkgs/by-name/cs/csharp-ls/package.nix
+++ b/pkgs/by-name/cs/csharp-ls/package.nix
@@ -33,11 +33,5 @@ buildDotnetGlobalTool (finalAttrs: {
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ GaetanLepage ];
-    badPlatforms = [
-      # Crashes immediately at runtime
-      # terminated by signal SIGKILL (Forced quit)
-      # https://github.com/razzmatazz/csharp-language-server/issues/211
-      "aarch64-darwin"
-    ];
   };
 })

From 2d323b480c806b16dc66f2a7c8999be715a61064 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 25 Aug 2026 08:51:28 +0200
Subject: [PATCH 481/551] python3Packages.mypy-boto3-batch: 1.43.76 -> 1.43.79

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index ec4b3f0f6999..68d1d933db6f 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -163,8 +163,8 @@ in
       "sha256-EMl1KCe3/wEmsfTPgMbzDWo1V+NakqzhZJRPYNadeZQ=";
 
   mypy-boto3-batch =
-    buildMypyBoto3Package "batch" "1.43.76"
-      "sha256-LYp5PZ8yfozAhn9yF1a2FboHX3xqGoUytKCh9U9AC4U=";
+    buildMypyBoto3Package "batch" "1.43.79"
+      "sha256-3D1VN30a3RNbVUIeu2T2IBH18327SHca+LzmqbUec8c=";
 
   mypy-boto3-billingconductor =
     buildMypyBoto3Package "billingconductor" "1.43.7"

From 42caea5f4625f2d0f146a08578ef7fda62178a85 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 25 Aug 2026 08:51:40 +0200
Subject: [PATCH 482/551] python3Packages.mypy-boto3-connect: 1.43.73 ->
 1.43.79

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 68d1d933db6f..fb1f82908b46 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -335,8 +335,8 @@ in
       "sha256-3JYcWKFk0dKJg/qn+EBvxeAO5xh5PXCU3dTEWDr1oXI=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.43.73"
-      "sha256-2QzVxRO0JU0CWqv6RKGXMOkDloYoIHCqt98qcozFmQc=";
+    buildMypyBoto3Package "connect" "1.43.79"
+      "sha256-nup6lqkxN1g/df7cw2mCLKMGHuCm52BeoHhAgSIZzn8=";
 
   mypy-boto3-connect-contact-lens =
     buildMypyBoto3Package "connect-contact-lens" "1.43.0"

From 945007a9ea6c873ed8c21c6be2515e7fecf20e68 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 25 Aug 2026 08:51:41 +0200
Subject: [PATCH 483/551] python3Packages.mypy-boto3-connect-contact-lens:
 1.43.0 -> 1.43.79

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index fb1f82908b46..35363bc12b00 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -339,8 +339,8 @@ in
       "sha256-nup6lqkxN1g/df7cw2mCLKMGHuCm52BeoHhAgSIZzn8=";
 
   mypy-boto3-connect-contact-lens =
-    buildMypyBoto3Package "connect-contact-lens" "1.43.0"
-      "sha256-7rXsHj0fTM5UPbdvtGH0AimOjKbrrSZwW7pueKjF/uA=";
+    buildMypyBoto3Package "connect-contact-lens" "1.43.79"
+      "sha256-pfKiLx6qZJxvFGY7Jm+355d1fT4knIoZYD52VtWn+ck=";
 
   mypy-boto3-connectcampaigns =
     buildMypyBoto3Package "connectcampaigns" "1.43.0"

From b4f8c8c7a8eb4cd4b680399252922b3a8922b0cc Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 25 Aug 2026 08:52:05 +0200
Subject: [PATCH 484/551] python3Packages.mypy-boto3-kafka: 1.43.66 -> 1.43.79

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 35363bc12b00..fccd35731e77 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -706,8 +706,8 @@ in
       "sha256-9XMdnVsYUmz8Uf9kAgVMbG960vy0TOJturoD9/ZoM98=";
 
   mypy-boto3-kafka =
-    buildMypyBoto3Package "kafka" "1.43.66"
-      "sha256-reGKCXTFRIebc26zStSUrcX8TxFF+3FJ+t4cSaSpnW0=";
+    buildMypyBoto3Package "kafka" "1.43.79"
+      "sha256-kgfPSlNO0uj6Az83Bc/p3uyjqI3VMgwK+5/6tRoY4ok=";
 
   mypy-boto3-kafkaconnect =
     buildMypyBoto3Package "kafkaconnect" "1.43.0"

From c354b6a85c610a2c3a632371d5e8af59acfee5e1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 25 Aug 2026 08:52:53 +0200
Subject: [PATCH 485/551] python3Packages.boto3-stubs: 1.43.78 -> 1.43.79

---
 pkgs/development/python-modules/boto3-stubs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 35c75197bacf..f4383510640c 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.78";
+  version = "1.43.79";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-TosHjxSZH4l0/IOrjZb8cuaRP8iiRy1x3qD+ItaHZQ8=";
+    hash = "sha256-bfdQ6vu9WakrZ4v7ci0FLJ2b6FtACw5KI2e/LgJZ4k4=";
   };
 
   build-system = [ setuptools ];

From 9900169099030451287f41f9e77d7c393d0ecd85 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 25 Aug 2026 08:53:17 +0200
Subject: [PATCH 486/551] python3Packages.iamdata: 0.1.202608241 ->
 0.1.202608251

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202608241...v0.1.202608251

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202608251
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 251a4a99f7c1..5b9241fb3ef8 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202608241";
+  version = "0.1.202608251";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IBVOk3VLGpn4xKbmbDPj70qM3H/KuKT9X52e4HVsNtQ=";
+    hash = "sha256-BiObFh1DdHQTadEHjkg5yh2DH/gK1rDAEDD1iI41iG4=";
   };
 
   __darwinAllowLocalNetworking = true;

From 658fd7a6d1846d68f98a17f5158e02dccc4f96df Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 06:57:30 +0000
Subject: [PATCH 487/551] positron-bin: 2026.08.1-2 -> 2026.08.2-4

---
 pkgs/by-name/po/positron-bin/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/po/positron-bin/package.nix b/pkgs/by-name/po/positron-bin/package.nix
index a61b4b15df7d..1de17268cfc3 100644
--- a/pkgs/by-name/po/positron-bin/package.nix
+++ b/pkgs/by-name/po/positron-bin/package.nix
@@ -31,7 +31,7 @@
 }:
 let
   pname = "positron-bin";
-  version = "2026.08.1-2";
+  version = "2026.08.2-4";
 in
 stdenv.mkDerivation {
   dontFixup = stdenv.hostPlatform.isDarwin;
@@ -41,17 +41,17 @@ stdenv.mkDerivation {
     if stdenv.hostPlatform.isDarwin then
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/mac/arm64/Positron-${version}-arm64.dmg";
-        hash = "sha256-U4uO1T0SsFq/gzE5SdvAMj6tt+Bi1KiMImT+JcSBBwA=";
+        hash = "sha256-ocDWNEWiIfgLcFOTD6KqaqswRpQqf4dVqJe28lDYs9k=";
       }
     else if stdenv.hostPlatform.system == "aarch64-linux" then
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/deb/arm64/Positron-${version}-arm64.deb";
-        hash = "sha256-eMy5uPJfagyZ/SMzZ/ZnXCQAG/VDR9WtaUQjAgl218o=";
+        hash = "sha256-EHZZYLGquikmhWYPjv7+I4f1ZkSvyI9Q6nRJXvgGBk0=";
       }
     else
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/deb/x86_64/Positron-${version}-x64.deb";
-        hash = "sha256-4wfTcQsFTeQja2JZFwJBmIfXO9tl6CU/J5/HZj087Yk=";
+        hash = "sha256-DmlFAr24drfuqWK22uPXfHvPIuvQrtq3Yl5hUgcY3Oo=";
       };
 
   buildInputs = [

From 5b1b6b62a393b4d3ffba01ee7cc9d32794095f78 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Fri, 21 Aug 2026 22:38:16 +1000
Subject: [PATCH 488/551] corteza: 2024.9.2 -> 2024.9.9

https://docs.cortezaproject.org/corteza-docs/2024.9/changelog/index.html#_2024_9_9
Fixes: CVE-2026-6093
Fixes: #519391
Fixes: https://github.com/ngi-nix/projects/issues/2233
---
 pkgs/by-name/co/corteza/package.nix | 42 ++++++++++++++++++-----------
 1 file changed, 27 insertions(+), 15 deletions(-)

diff --git a/pkgs/by-name/co/corteza/package.nix b/pkgs/by-name/co/corteza/package.nix
index 072f8d9b14fb..a133042dc4be 100644
--- a/pkgs/by-name/co/corteza/package.nix
+++ b/pkgs/by-name/co/corteza/package.nix
@@ -4,18 +4,29 @@
   buildGoModule,
   callPackage,
   fetchFromGitHub,
+  fetchpatch,
+  applyPatches,
   lib,
   nixosTests,
   stdenvNoCC,
 }:
 
 let
-  version = "2024.9.2";
-  src = fetchFromGitHub {
-    owner = "cortezaproject";
-    repo = "corteza";
-    tag = version;
-    hash = "sha256-1mekSiRfFSNa/6MSzwRrI3rb9GHABkn3i1b6tX+73fI=";
+  version = "2024.9.9";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "cortezaproject";
+      repo = "corteza";
+      tag = version;
+      hash = "sha256-r6/z5yplkT2d1iEhA4S29C1LcbdEJQiOWr0JRP5Pvb0=";
+    };
+    patches = [
+      # CVE-2026-6093
+      (fetchpatch {
+        url = "https://github.com/cortezaproject/corteza/commit/64b58b9d7324e77248bacd183fb994ff338091ec.patch";
+        hash = "sha256-0Ume1zkksS3kwf6QS6T5lDXklAboZVlTt5ZJReqwu3w=";
+      })
+    ];
   };
   meta = {
     description = "Low-code platform";
@@ -47,13 +58,13 @@ let
     };
 
   webApps = lib.mapAttrs mkWebApp {
-    admin = "sha256-34lfnK2mecvu1Lgg9IM61+fbnqRgZC/Agi7iyugn0fM=";
-    compose = "sha256-1/Fyl6Z27TtZzNBeerKYNs4VhLWEW3wJyr0SCapzc9E=";
-    discovery = "sha256-mL+ibAgVFCRV5AvN0VZc4LCCY8hyaIC8gOlgEdXayuU=";
-    one = "sha256-SuGf72y4PXatZJQgbW5X4mPjtJmQlpwbjfFYCEZElBU=";
-    privacy = "sha256-yHi6pq0OKCh+2reygNL7TvwULCHwxeD8BXVVMjlnpLc=";
-    reporter = "sha256-AWKSzULOTdUZ5wdlTo8dJwVGc7RlYbimR4YF4ZAN1pQ=";
-    workflow = "sha256-cxD2mG4uuO8KT1r2Y4opPlY84Hvqu7cbWh2BSo8CcEc=";
+    admin = "sha256-fen4KxPbYpH0ikWco1w3Zr+4WeghFITdmsOqHMGa3gA=";
+    compose = "sha256-UHhyzCeSWTROgzULYkDKN/2hgZ25aDZ7roHTLkt466o=";
+    discovery = "sha256-GHmALrqLTBie0VTDmZz4zJ9Ls2JYsfV0A3VkRwCKSuQ=";
+    one = "sha256-GHCtouGYrFgghWlBVbF5rD9cXrAfleVVxVqZtuLOSr0=";
+    privacy = "sha256-PlmeAJZY/S+osdM650tpJI3XSOanc80WYuMQ6jsiJwQ=";
+    reporter = "sha256-4O6FEF7Ol4V0FxznKGISaIA0w68XL0E3HvQ8bbt2klE=";
+    workflow = "sha256-2vyx3lCxICtVlRFLPkpy0fzXZ9W4li9ESm9sJzInc8g=";
   };
 
   server-webconsole = callPackage ./buildYarnDistOnly.nix {
@@ -67,8 +78,8 @@ let
   corteza-locale = fetchFromGitHub {
     owner = "cortezaproject";
     repo = "corteza-locale";
-    rev = "64b6d5d562dce642652db55949231abf8b9af4ef";
-    sha256 = "sha256-OKr/M91sEDlTwYBiDXwWkShlfazJBm21G0uU429fjW0=";
+    rev = "57b1f2403207c44055ebce19d95cedd5573f39df";
+    sha256 = "sha256-j+mfWG6tED8AACkUcRWpol2G05qknTxp8b+kwu7c2NA=";
   };
 
   corteza-webapp = stdenvNoCC.mkDerivation (finalAttrs: {
@@ -116,6 +127,7 @@ let
       cp -r ${server-webconsole}/* webconsole/dist/
     ''
     + lib.optionalString withLocales ''
+      chmod -R u+w pkg/locale/src
       cp -r ${corteza-locale}/src/* pkg/locale/src/
     '';
 

From 2c0325420a6fe368a8fcce9c5ab4dc008a4a2844 Mon Sep 17 00:00:00 2001
From: Markus Hauck <markus1189@gmail.com>
Date: Tue, 25 Aug 2026 09:05:52 +0200
Subject: [PATCH 489/551] claude-code: 2.1.238 -> 2.1.245

Changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

Assisted-by: Claude Code (Claude Opus 5)
Claude-Session: https://claude.ai/code/session_01D6AxqtrCgxuArRBNjiNGPy
---
 pkgs/by-name/cl/claude-code/manifest.json | 46 +++++++++++------------
 1 file changed, 21 insertions(+), 25 deletions(-)

diff --git a/pkgs/by-name/cl/claude-code/manifest.json b/pkgs/by-name/cl/claude-code/manifest.json
index d2348c148aff..1a4dca608de1 100644
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,57 +1,51 @@
 {
-  "version": "2.1.238",
-  "commit": "46283063a4c23f7afadb8440f549264ad93b7c06",
-  "buildDate": "2026-08-20T15:26:31Z",
+  "version": "2.1.245",
+  "commit": "28b7e8c41235a9e2fcb24248e60c4cc2d29c853a",
+  "buildDate": "2026-08-25T04:08:50Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "1c196c456373b57818ae87df84aecee96cb659448c0d6a6bbb401ac5758431b2",
-      "size": 321263536
+      "checksum": "9f7c2260251765a18d0b35198669dacc1912f6e8129a3b01f6b58d93365ff1f1",
+      "size": 376109392
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "d10bc7bb1720435f8830aa3ee74085f09348d2b1a2a152bdee251b770d76cc73",
-      "size": 329970544
+      "checksum": "de044bb543e826352f31587a74356e1b2dae94dc1b9c960a362d9f07df96c2a7",
+      "size": 385137136
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "28d736120a6b14c5eae1ad1470e73371818c9c2fa41e0b3c7040207aa2d4edee",
-      "size": 335993064
+      "checksum": "d0da299303d710a7cc5cdece9629958f5128ce1a727e15463c651ed5cf385c7f",
+      "size": 389077224
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "0933b286cf94e1b2504b35ac165ab76b8f822735d53371c56393988c23040d58",
-      "size": 338860336
+      "checksum": "16ad2b94deaf7b29abed966d981c9991a47af0420f5be8ed4a3f83bea9f678bc",
+      "size": 391948592
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "a47d45149ea7c74e4474bce3c7628c4643b0541801b42053d6e26fd5e3203fdd",
-      "size": 329137944
+      "checksum": "8707fbe629fdd9876d9c356baa833a697dac76cd9a7157088f667199b8492851",
+      "size": 382222104
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "33546c2f7947bbfdb46a969123c5329e607c414045cd3645a29aa3cfe023c6ab",
-      "size": 332988384
+      "checksum": "d25564bc5d84ec988a762cfe25fe51cb706b96eaec614f704ddbf653ab08ba00",
+      "size": 386060256
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "223bc058b5aef48138876e28de5d00387e4fd7362a18e733143bf00819c01aab",
-      "size": 334150816
+      "checksum": "d1649bf5261792fee7e1a1b63fdd2197082adec36ce9701aa0c1723bdcd2348a",
+      "size": 384213664
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "645800d24201c93e5fd6f4308e0292bba9a75900693667401cdffb4361f8e616",
-      "size": 322051744
+      "checksum": "9cff8169be24a8b3e59e89e58d9e3d37f3c17ca1b3a149e60666fe53c789d80a",
+      "size": 372111520
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.201",
-      "0.3.202",
-      "0.3.204",
-      "0.3.205",
-      "0.3.206",
-      "0.3.207",
       "0.3.208",
       "0.3.209",
       "0.3.210",
@@ -67,6 +61,8 @@
       "0.3.221",
       "0.3.222",
       "0.3.223",
+      "0.3.224",
+      "0.3.225",
       "0.3.226",
       "0.3.227"
     ],

From 4e729057f0b96daf640f26cb4ce1b9deba446187 Mon Sep 17 00:00:00 2001
From: Markus Hauck <markus1189@gmail.com>
Date: Tue, 25 Aug 2026 09:05:52 +0200
Subject: [PATCH 490/551] vscode-extensions.anthropic.claude-code: 2.1.238 ->
 2.1.245

Changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

Assisted-by: Claude Code (Claude Opus 5)
Claude-Session: https://claude.ai/code/session_01D6AxqtrCgxuArRBNjiNGPy
---
 .../vscode/extensions/anthropic.claude-code/default.nix   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 15e589b83c77..24ec6ed0786f 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-oOytttotGI7f4RlnNBRM6TvXaXUht6v99Kzxc9GP404=";
+          hash = "sha256-Yabd8DFEh1wq0K4IQPFUBNFDkyHhXl695wSfKa5RX7k=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-9Ne1PGz0k1E1wY/HhoR5mqB3SFQiFkHt236+L5jXE60=";
+          hash = "sha256-gzMUtolNlNxFUofsL9JgOnaxfUGeSxFQY7C4smJ8fr8=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-2nwDsS4tVRikMZWZW4TKshQE7HVeQ/yY7CxpGg0os7w=";
+          hash = "sha256-U8S7U5sYj9LukYfmC2yyUjeenAYYHsMrx8snhXqATck=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.238";
+      version = "2.1.245";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

From 80d4e20d7569c7d25fdd4be0f3db8f8d914ddcae Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 07:21:20 +0000
Subject: [PATCH 491/551] nerd-font-patcher: 3.5.0 -> 3.5.1

---
 pkgs/by-name/ne/nerd-font-patcher/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ne/nerd-font-patcher/package.nix b/pkgs/by-name/ne/nerd-font-patcher/package.nix
index 0fc27b25f6c1..4085ad081432 100644
--- a/pkgs/by-name/ne/nerd-font-patcher/package.nix
+++ b/pkgs/by-name/ne/nerd-font-patcher/package.nix
@@ -6,11 +6,11 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nerd-font-patcher";
-  version = "3.5.0";
+  version = "3.5.1";
 
   src = fetchzip {
     url = "https://github.com/ryanoasis/nerd-fonts/releases/download/v${finalAttrs.version}/FontPatcher.zip";
-    hash = "sha256-Z3KpaSoJpZx3D07K5EtHBXDl4pyHxnTIg/AuXrzTWWA=";
+    hash = "sha256-gZ41oZPnsVLcchA58eJ1Vl28ccqePpOZd/ZCEKYywX4=";
     stripRoot = false;
   };
 

From e73d7c0243730a11d25fcf33703895dcc0fe4014 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 08:01:53 +0000
Subject: [PATCH 492/551] libretro.beetle-psx: 0-unstable-2026-08-07 ->
 0-unstable-2026-08-23

---
 pkgs/applications/emulators/libretro/cores/beetle-psx.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
index 4ee33cbfae79..843f7867bcb2 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-08-07";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "ed640fac8986d7813e4db6604544a6aafddd3018";
-    hash = "sha256-dwat09yGQ0OnF8GaglqCVlgcoyAfqhleqD/mMlgHh1w=";
+    rev = "ef51860dbd71ad6b7ce67115d4780c2ee321d968";
+    hash = "sha256-Yzzh/1+ZcySuFwXCEravLjLRJHbIMpf3rr7Mj0p9JM0=";
   };
 
   extraBuildInputs = lib.optionals withHw [

From 6f5d6b9208a31e602f23122f7db0679167f8c213 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 08:12:12 +0000
Subject: [PATCH 493/551] python3Packages.pydocket: 0.23.1 -> 0.24.1

---
 pkgs/development/python-modules/pydocket/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pydocket/default.nix b/pkgs/development/python-modules/pydocket/default.nix
index 25014d5d8c62..1e78537cdfbe 100644
--- a/pkgs/development/python-modules/pydocket/default.nix
+++ b/pkgs/development/python-modules/pydocket/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydocket";
-  version = "0.23.1";
+  version = "0.24.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
     owner = "chrisguidry";
     repo = "docket";
     tag = finalAttrs.version;
-    hash = "sha256-52UHiQUh4Aa5skYCWow+vKjtzPmcRQ9/wEW3UvLbHX4=";
+    hash = "sha256-Z/cmxHLOjZmgugSNo/XzBa/62wmAVpYQYs0Xwtly+OI=";
   };
 
   build-system = [

From 6a74792710ac50b7294a5fd68b44c504b54bea10 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 08:46:13 +0000
Subject: [PATCH 494/551] weaviate: 1.39.0 -> 1.39.1

---
 pkgs/by-name/we/weaviate/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/we/weaviate/package.nix b/pkgs/by-name/we/weaviate/package.nix
index 6ce624a7f957..5aa980356b68 100644
--- a/pkgs/by-name/we/weaviate/package.nix
+++ b/pkgs/by-name/we/weaviate/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "weaviate";
-  version = "1.39.0";
+  version = "1.39.1";
 
   src = fetchFromGitHub {
     owner = "weaviate";
     repo = "weaviate";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Nc6QAMjZF24KiYcS9W1AMgusUXHn96KqNV/RC2N4Glc=";
+    hash = "sha256-fD8Zju/WR+vxY/Ocopy0YosF0FZrVNbCZB6jd9JWBqM=";
   };
 
   vendorHash = "sha256-31yzL0fx2dhYiSdcKvHBe8UeFENSzFxsB/RQAMM/1e4=";

From 5d8205d03d803134a4a91384bfc48d7ab0cfae10 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 09:08:02 +0000
Subject: [PATCH 495/551] wasmtime_36: 36.0.13 -> 36.0.14

---
 pkgs/by-name/wa/wasmtime/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/wa/wasmtime/package.nix b/pkgs/by-name/wa/wasmtime/package.nix
index fa8e93bba3c3..b6a58c3bc924 100644
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@@ -15,9 +15,9 @@
 let
   sources = {
     lts-36 = {
-      version = "36.0.13";
-      hash = "sha256-KVNnxmEVDgH+EzItFdpRIpLm6DbmrN2JIKjctx6IyBE=";
-      cargoHash = "sha256-q1l2zmfdCI7Yg41/8jDTjf5akeHiQcC/60iIzMnh6B0=";
+      version = "36.0.14";
+      hash = "sha256-OI8wixfzV4U2brmW7uqhk55eLhj+Fdp+J5Pzz1iBO6U=";
+      cargoHash = "sha256-2Nwcw3Z4/cbkRcG2hJ2/1PcXZf3vYB9NGUlr7pxdqzU=";
     };
     main = {
       version = "48.0.0";

From 32c5967e2c31e48b2e1cede8dbf4e352c5db2f9b Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Mon, 3 Aug 2026 13:32:13 +0200
Subject: [PATCH 496/551] nixos/quake3-server: add settings option

---
 .../manual/release-notes/rl-2611.section.md   |  2 +
 .../modules/services/games/quake3-server.nix  | 82 +++++++++++++++----
 2 files changed, 68 insertions(+), 16 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index d921a1ec1cb2..26306ef76d45 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -199,6 +199,8 @@
 
 - `services.pfix-srsd` and the supporting `pfixtools` package have been removed, as the project is dormant and does not support pcre2.  `services.postsrsd` is the recommended replacement for Sender Rewriting Scheme support with Postfix.
 
+- `services.quake3-server.port` has been removed in favor of the structured [](#opt-services.quake3-server.settings.net_port) option. Use `services.quake3-server.settings.net_port` to set any custom UDP port directly.
+
 - Package `overseerr` has been removed as the `overseerr` and `jellyseerr` projects were merged under `seerr`.
 
 - The papra NixOS module is now hardening the systemd unit by default. If this breaks any of the configured directories, please reconfigure them through `services.papra.environment` to enable sandbox passthrough.
diff --git a/nixos/modules/services/games/quake3-server.nix b/nixos/modules/services/games/quake3-server.nix
index 43aad73a4b04..a57535c88a3a 100644
--- a/nixos/modules/services/games/quake3-server.nix
+++ b/nixos/modules/services/games/quake3-server.nix
@@ -15,9 +15,16 @@ let
     ;
   cfg = config.services.quake3-server;
 
-  configFile = pkgs.writeText "q3ds-extra.cfg" ''
-    set net_port ${toString cfg.port}
+  toQuake3Value = value: if lib.isBool value then (if value then "1" else "0") else toString value;
 
+  toQuake3Config =
+    settings:
+    lib.concatStrings (
+      lib.mapAttrsToList (name: value: ''seta ${name} "${toQuake3Value value}"'' + "\n") settings
+    );
+
+  configFile = pkgs.writeText "q3ds-extra.cfg" ''
+    ${toQuake3Config cfg.settings}
     ${cfg.extraConfig}
   '';
 
@@ -50,19 +57,19 @@ let
   '';
 in
 {
+
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "quake3-server" "port" ]
+      [ "services" "quake3-server" "settings" "net_port" ]
+    )
+  ];
+
   options = {
     services.quake3-server = {
       enable = mkEnableOption "Quake 3 dedicated server";
       package = lib.mkPackageOption pkgs "ioquake3" { };
 
-      port = mkOption {
-        type = types.port;
-        default = 27960;
-        description = ''
-          UDP Port the server should listen on.
-        '';
-      };
-
       openFirewall = mkOption {
         type = types.bool;
         default = false;
@@ -71,16 +78,59 @@ in
         '';
       };
 
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = types.attrsOf (
+            types.nullOr (
+              types.oneOf [
+                types.str
+                types.bool
+                types.int
+                types.float
+                types.port
+              ]
+            )
+          );
+          options = {
+            net_port = lib.mkOption {
+              type = lib.types.port;
+              default = 27960;
+              description = "UDP port for the dedicated server to bind to.";
+            };
+          };
+        };
+        default = { };
+        example = {
+          sv_hostname = "My Quake 3 server";
+          g_gametype = 0;
+          sv_pure = true;
+        };
+        description = ''
+          Quake 3 cvars set via `seta` on server start (i.e. persisted,
+          archive-flagged cvars – the vast majority of server settings).
+          Note that options changed via RCON will not be persisted. To list
+          all possible options, use "cvarlist 1" via RCON.
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";
         example = ''
-          seta rconPassword "superSecret"      // sets RCON password for remote console
-          seta sv_hostname "My Quake 3 server"      // name that appears in server list
+          // map rotation and other things that don't map onto plain cvars
+          set d1 "map q3dm1 ; set nextmap vstr d2"
+          set d2 "map q3dm7 ; set nextmap vstr d1"
+          vstr d1
+
+          // rarely needed: cvars with a non-seta flag
+          sets sv_privatePassword "hidden"
         '';
         description = ''
-          Extra configuration options. Note that options changed via RCON will not be persisted. To list all possible
-          options, use "cvarlist 1" via RCON.
+          Extra configuration lines appended after `settings`, for anything
+          that isn't a plain persisted cvar: map-rotation scripts, `exec`,
+          `vstr`, aliases, or cvars that need `set`/`sets`/`sett`/`setu`
+          instead of `seta`. Note that options changed via RCON will not be
+          persisted. To list all possible options, use "cvarlist 1" via RCON.
         '';
       };
 
@@ -103,7 +153,7 @@ in
       baseq3InStore = builtins.typeOf cfg.baseq3 == "set";
     in
     mkIf cfg.enable {
-      networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.port ];
+      networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.settings.net_port ];
 
       systemd.services.q3ds = {
         description = "Quake 3 dedicated server";
@@ -115,7 +165,7 @@ in
         serviceConfig = with lib; {
           Restart = "always";
           DynamicUser = true;
-          WorkingDirectory = home;
+          WorkingDirectory = if baseq3InStore then home else cfg.baseq3;
 
           # It is possible to alter configuration files via RCON. To ensure reproducibility we have to prevent this
           ReadOnlyPaths = if baseq3InStore then home else cfg.baseq3;

From b48fdf1aadf111b03ba424cd1de895dc5c16f24a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 09:49:41 +0000
Subject: [PATCH 497/551] rush-lyrics: 6.5.3 -> 6.6.0

---
 pkgs/by-name/ru/rush-lyrics/deps.json   | 38 ++++++++++++-------------
 pkgs/by-name/ru/rush-lyrics/package.nix |  4 +--
 2 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/ru/rush-lyrics/deps.json b/pkgs/by-name/ru/rush-lyrics/deps.json
index a7767e5bbe68..0917c16aeb5e 100644
--- a/pkgs/by-name/ru/rush-lyrics/deps.json
+++ b/pkgs/by-name/ru/rush-lyrics/deps.json
@@ -1106,8 +1106,8 @@
   }
  },
  "https://plugins.gradle.org/m2": {
-  "com/diffplug/spotless#com.diffplug.spotless.gradle.plugin/8.9.0": {
-   "pom": "sha256-KiSidLMlcjuB1QGv6fjuNTNJK+WK2VIVukcEh39e4Y0="
+  "com/diffplug/spotless#com.diffplug.spotless.gradle.plugin/8.10.0": {
+   "pom": "sha256-ra/Nlpf+Kp8Avuz6+J2kSLeB9jalyt6qysEtRyplPuE="
   },
   "io/github/kdroidfilter#plugin/1.15.7": {
    "jar": "sha256-IvPp5/y8+e0Bcyi0Eb7VhDJhnawfX4TcLnDDH8EzPS4=",
@@ -1242,20 +1242,20 @@
    "module": "sha256-IFNqlfL+sr9DBRKMaq7Lb9idxFeYqchfJgK4qAnXUNs=",
    "pom": "sha256-Q1z/VXiZht7arXF/aPuo1UgklHhWLc2EsirU1lZvRAs="
   },
-  "com/diffplug/spotless#spotless-lib-extra/4.9.0": {
-   "jar": "sha256-HyB4zQvxKfI/aIGO8OrU6ZzrqKsAjmOKwDEbUHsBKZw=",
-   "module": "sha256-I50MaVyJBIeDyCJl4zMasKuy2R2M3KlK6mTFAn0trCs=",
-   "pom": "sha256-4wnu/KcMgWId/dV/l3tpBl8bLn/F1e5Ter3IWJqR7Js="
+  "com/diffplug/spotless#spotless-lib-extra/4.10.0": {
+   "jar": "sha256-qA1noQ+cq1Y/9COWXC6dEN7wcCiHHxzBn+H5jrY/rMQ=",
+   "module": "sha256-T4TFhZ9MzF7yp0I6/7fwHHedZeXUBp1ZsvLiU6y/Ycc=",
+   "pom": "sha256-ioWK1HalFxfvqjbUM4Ohc5jWHz4iChTTTPw2Y/2Q2cU="
   },
-  "com/diffplug/spotless#spotless-lib/4.9.0": {
-   "jar": "sha256-kJBhy1A+7QEskhkMHZAXa7on65jVopAG6tFoGlkG8m8=",
-   "module": "sha256-5ev03bdRVVuCANvKHdvU32eoI7dR1b71/s+m2wiZoyw=",
-   "pom": "sha256-ieleUBzLXDxf9VR8iyR3/Clbl34Nj34OULWTrue9sL4="
+  "com/diffplug/spotless#spotless-lib/4.10.0": {
+   "jar": "sha256-vzNRv+tuE9okAroygAd7Jo+1abvv9p7y4KqC8kGnH+M=",
+   "module": "sha256-jFGrf+KRC0NLXgzovbGy5BaOb1KpjJNX+WbgYLcCfQg=",
+   "pom": "sha256-wVQykHOJ3haa9MGXBgqliTz0q5W17B/bQMojbPHXhNM="
   },
-  "com/diffplug/spotless#spotless-plugin-gradle/8.9.0": {
-   "jar": "sha256-quTS9fpQJs0gJ0xXYP0Be0mSMAMv6E39jkgquZYNN2Y=",
-   "module": "sha256-Rdxah2UCG19mXf3ilysGO5Zgt0tySYdVqUVDQ0PYAOc=",
-   "pom": "sha256-PNYQSZvqWU/zcOUC/g/oAAWXUNpyrGTsPlBnkM0hE0s="
+  "com/diffplug/spotless#spotless-plugin-gradle/8.10.0": {
+   "jar": "sha256-oqP11YHf1YSstguJ891uR7Ek2dD3qUjc1nGb28u70W0=",
+   "module": "sha256-DuukKQzRN9+KmKyKzBHYTvG5zCFEhxtRaiCBSiAm2CM=",
+   "pom": "sha256-mxJJFkhEsRuoHuVUCxUdNiVULdfqqGUVguHzY1w/S3M="
   },
   "com/fleeksoft/charset#charset-iosarm64/0.0.8": {
    "module": "sha256-V8Uy9SUZRBEusEMLoGUv6CXHix6R9/eIWjeePvAhVpg=",
@@ -3736,12 +3736,12 @@
   "org/eclipse/ee4j#project/1.0.5": {
    "pom": "sha256-kWtHlNjYIgpZo/32pk2+eUrrIzleiIuBrjaptaLFkaY="
   },
-  "org/eclipse/jgit#org.eclipse.jgit-parent/7.7.0.202606012155-r": {
-   "pom": "sha256-S4qHPLaFhEH/MSUDTbVU0leSL7cIIEeVtyAZDW+05iE="
+  "org/eclipse/jgit#org.eclipse.jgit-parent/7.7.1.202607240634-r": {
+   "pom": "sha256-O/RKKe9ukBmDx7MfGQkaaEumdP6n1a3V3zF9DvoJxoc="
   },
-  "org/eclipse/jgit#org.eclipse.jgit/7.7.0.202606012155-r": {
-   "jar": "sha256-onxHjV94vD2VRh8VOmDv3xYjknUCxopFetmplaNcWnw=",
-   "pom": "sha256-owH00aR2nxrSVstU54V6Uq8n59A+UMo8UPTLZDw98SY="
+  "org/eclipse/jgit#org.eclipse.jgit/7.7.1.202607240634-r": {
+   "jar": "sha256-WRq8yElVpq0zY+yQS9p5zxRCdwbvtOBv/re8NgFQOYA=",
+   "pom": "sha256-4c9HhuyN3iB/5lh/QQ8lwsaHe+Oh3TCZ02dC3qgQUWs="
   },
   "org/eclipse/platform#org.eclipse.osgi/3.24.200": {
    "jar": "sha256-v+g/zR+gNOuamGs8tuXisY27rLZ+q9qtLaMoBOzYxlo=",
diff --git a/pkgs/by-name/ru/rush-lyrics/package.nix b/pkgs/by-name/ru/rush-lyrics/package.nix
index 9c6b55302f47..32722a7e210e 100644
--- a/pkgs/by-name/ru/rush-lyrics/package.nix
+++ b/pkgs/by-name/ru/rush-lyrics/package.nix
@@ -34,13 +34,13 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   pname = "rush-lyrics";
-  version = "6.5.3";
+  version = "6.6.0";
 
   src = fetchFromGitHub {
     owner = "shub39";
     repo = "Rush";
     tag = finalAttrs.version;
-    hash = "sha256-LuI3i87ufGAm1hxrC8UdH7xfnubSRUIOoO9CVq5c6T4=";
+    hash = "sha256-8BdlNUQvPm8bk9X0JG00NYy/EANSHvh9TfqMIK1jJhk=";
   };
 
   patches = [

From 37d98e4526e886aa39febfadb5bba1d09386d9e7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 09:51:59 +0000
Subject: [PATCH 498/551] moor: 2.16.3 -> 2.17.0

---
 pkgs/by-name/mo/moor/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mo/moor/package.nix b/pkgs/by-name/mo/moor/package.nix
index 90d6fe895994..ada1bcf76912 100644
--- a/pkgs/by-name/mo/moor/package.nix
+++ b/pkgs/by-name/mo/moor/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "moor";
-  version = "2.16.3";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z1fGeeCkcPmvQEK+WK/W0kj/w57YqT06yEbQf5gEgGY=";
+    hash = "sha256-xxfuDZsVu6/1v/vBvWcCR7ZB/4SXgYnNSscXRjK73dE=";
   };
 
   vendorHash = "sha256-01FIkLojyCvjMjW4qe6mPP63hz5rYeVATyL0dW+F/Ek=";

From 4f0c9aea6bcf96d2ba4e440856ee239951705eb7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 10:05:56 +0000
Subject: [PATCH 499/551] stalwart_0_16: 0.16.17 -> 0.16.19

---
 pkgs/by-name/st/stalwart_0_16/package.nix | 6 +++---
 pkgs/by-name/st/stalwart_0_16/webui.nix   | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/st/stalwart_0_16/package.nix b/pkgs/by-name/st/stalwart_0_16/package.nix
index 9689e99cc051..ffa904adb6b6 100644
--- a/pkgs/by-name/st/stalwart_0_16/package.nix
+++ b/pkgs/by-name/st/stalwart_0_16/package.nix
@@ -51,7 +51,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stalwart" + (lib.optionalString stalwartEnterprise "-enterprise");
-  version = "0.16.17";
+  version = "0.16.19";
 
   __structuredAttrs = true;
 
@@ -59,10 +59,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "stalwartlabs";
     repo = "stalwart";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tQY5L8tTyVbhIX0VrWbaKfR+Q97coTVoMRRDSHv5Lms=";
+    hash = "sha256-M6mO9z58WnvqmRcIxX9Hj2ZtY06mwlRtTXfdbXt6L00=";
   };
 
-  cargoHash = "sha256-EUx/ELV85pdPKzv49SEQ1Q8e/4ism2x3ZrKPqL6uvoE=";
+  cargoHash = "sha256-LsdGxAgBWTU7bMUrvypIVkiMDGG77qEXuD7i756YYCw=";
 
   env = {
     # https://docs.rs/openssl/latest/openssl/#manual
diff --git a/pkgs/by-name/st/stalwart_0_16/webui.nix b/pkgs/by-name/st/stalwart_0_16/webui.nix
index 124c546390c9..8ab6d0a74d74 100644
--- a/pkgs/by-name/st/stalwart_0_16/webui.nix
+++ b/pkgs/by-name/st/stalwart_0_16/webui.nix
@@ -8,13 +8,13 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "webui";
-  version = "1.0.8";
+  version = "1.0.9";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "webui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q6AR6/8eCzi9ED2PfL7wwNqFVWfkVIN93f8xEzOsAHo=";
+    hash = "sha256-EFENMnBuHU7ugciB/ib4iKGctZLMLl6rOZVQiakPgaU=";
   };
 
   npmDepsHash = "sha256-qe9cSrvs6kWwgbOO0xL7MBaJvICOvyuLFVi9R0dgnXQ=";

From 4142566b03bc9d2700fb5463b6a0bdf1c82603b7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 10:08:20 +0000
Subject: [PATCH 500/551] xenia-canary: 0-unstable-2026-08-13 ->
 0-unstable-2026-08-24

---
 pkgs/by-name/xe/xenia-canary/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/xe/xenia-canary/package.nix b/pkgs/by-name/xe/xenia-canary/package.nix
index 7ed8c138ba22..8552bdde949b 100644
--- a/pkgs/by-name/xe/xenia-canary/package.nix
+++ b/pkgs/by-name/xe/xenia-canary/package.nix
@@ -33,14 +33,14 @@ let
 in
 llvmPackages_20.stdenv.mkDerivation {
   pname = "xenia-canary";
-  version = "0-unstable-2026-08-13";
+  version = "0-unstable-2026-08-24";
 
   src = fetchFromGitHub {
     owner = "xenia-canary";
     repo = "xenia-canary";
     fetchSubmodules = true;
-    rev = "907d92bf8cfad334cb1b83755f48b6bfea391806";
-    hash = "sha256-5ATxs7iD5QS7VKAevRNOfCAAjMRDLuk5djAQrhBMnfQ=";
+    rev = "1e834f8a8c4033e9848f1a65c57edb8703990e09";
+    hash = "sha256-mfVRWZeLSCbjC2uJqztcvQeOfmscCzMZXR117tHXwA4=";
   };
 
   dontConfigure = true;

From aee6376f86c5cc662d1711405d6dfe537f47ea0a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 10:21:50 +0000
Subject: [PATCH 501/551] oci-cli: 3.90.2 -> 3.91.0

---
 pkgs/by-name/oc/oci-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/oc/oci-cli/package.nix b/pkgs/by-name/oc/oci-cli/package.nix
index 349eef72ddd9..2fe978a4d9cb 100644
--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@@ -31,14 +31,14 @@ in
 
 py.pkgs.buildPythonApplication (finalAttrs: {
   pname = "oci-cli";
-  version = "3.90.2";
+  version = "3.91.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "oci-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FpLbJQGuajT72XSRpBYRpwqggqebuiRXID9x7ucZrng=";
+    hash = "sha256-vCTgug7wGohw7o2zj+rSsG2xR58s+/107g5z3ttCf+E=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

From 05a12d8fb16152cb8c4bb97fcf176ebbd7dfc320 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 10:45:21 +0000
Subject: [PATCH 502/551] python3Packages.gflanguages: 0.7.9 -> 0.7.10

---
 pkgs/development/python-modules/gflanguages/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gflanguages/default.nix b/pkgs/development/python-modules/gflanguages/default.nix
index 0072dc6945f3..a9ab94c90ecc 100644
--- a/pkgs/development/python-modules/gflanguages/default.nix
+++ b/pkgs/development/python-modules/gflanguages/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "gflanguages";
-  version = "0.7.9";
+  version = "0.7.10";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-57a0dvGuwGux9fuOnBEoZCnbJ0RQ+T0+5SCUrSro5BE=";
+    hash = "sha256-d5tSIlJhwlJ/8lwYlfLoPglV57+bNehlnghDwk4nNU0=";
   };
 
   # Relax the dependency on protobuf 3. Other packages in the Google Fonts

From 709d3386bc81af60a7a77fbd9968158a8829e536 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Mon, 24 Aug 2026 20:50:10 +0300
Subject: [PATCH 503/551] python3Packages.shiboken6: don't propagate
 shiboken6-generator

Measured on a PySide6 application, dropping the propagation removes 17 paths
and 1.72 GiB, 813 MiB of which is clang-21.1.8-lib alone.

The generator is now depended on directly by the packages that run it to
generate bindings: pyside6 and the KDE python bindings. pyside6-qtads already
did this.

Assisted-by: claude-code with claude-opus-5[1m]-high
---
 pkgs/by-name/cu/cutter/package.nix                    | 1 +
 pkgs/development/python-modules/pyside6/default.nix   | 2 ++
 pkgs/development/python-modules/shiboken6/default.nix | 5 +----
 pkgs/kde/lib/mk-kde-derivation.nix                    | 1 +
 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/cu/cutter/package.nix b/pkgs/by-name/cu/cutter/package.nix
index 4872bb232346..db945a8ba885 100644
--- a/pkgs/by-name/cu/cutter/package.nix
+++ b/pkgs/by-name/cu/cutter/package.nix
@@ -32,6 +32,7 @@ let
       cmake
       pkg-config
       python3
+      python3.pkgs.shiboken6-generator
       qt6.wrapQtAppsHook
     ];
 
diff --git a/pkgs/development/python-modules/pyside6/default.nix b/pkgs/development/python-modules/pyside6/default.nix
index 402400afaca0..e1ad0f958fc8 100644
--- a/pkgs/development/python-modules/pyside6/default.nix
+++ b/pkgs/development/python-modules/pyside6/default.nix
@@ -8,6 +8,7 @@
   pythonImportsCheckHook,
   moveBuildTree,
   shiboken6,
+  shiboken6-generator,
   llvmPackages,
   symlinkJoin,
 }:
@@ -91,6 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     python
     pythonImportsCheckHook
+    shiboken6-generator
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ moveBuildTree ];
 
diff --git a/pkgs/development/python-modules/shiboken6/default.nix b/pkgs/development/python-modules/shiboken6/default.nix
index 7492add38e8e..b5b9a8e98ac1 100644
--- a/pkgs/development/python-modules/shiboken6/default.nix
+++ b/pkgs/development/python-modules/shiboken6/default.nix
@@ -21,16 +21,13 @@ stdenv'.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     python.pkgs.ninja
+    shiboken6-generator
     (python.pythonOnBuildForHost.withPackages (ps: [
       ps.packaging
       ps.setuptools
     ]))
   ];
 
-  propagatedNativeBuildInputs = [
-    shiboken6-generator
-  ];
-
   buildInputs = [
     python.pkgs.qt6.qtbase
   ]
diff --git a/pkgs/kde/lib/mk-kde-derivation.nix b/pkgs/kde/lib/mk-kde-derivation.nix
index 389d8d46031b..35ce81fe0b6e 100644
--- a/pkgs/kde/lib/mk-kde-derivation.nix
+++ b/pkgs/kde/lib/mk-kde-derivation.nix
@@ -116,6 +116,7 @@ let
     ]
     ++ lib.optionals hasPythonBindings [
       python3Packages.shiboken6
+      python3Packages.shiboken6-generator
       (python3.withPackages (ps: [
         ps.build
         ps.setuptools

From 8946fba5b7498ce874aaa40287c6cac5afb7fb4c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 11:17:14 +0000
Subject: [PATCH 504/551] rumdl: 0.2.55 -> 0.2.60

---
 pkgs/by-name/ru/rumdl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rumdl/package.nix b/pkgs/by-name/ru/rumdl/package.nix
index 36022fe17ab6..5f42fc8243d3 100644
--- a/pkgs/by-name/ru/rumdl/package.nix
+++ b/pkgs/by-name/ru/rumdl/package.nix
@@ -11,7 +11,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rumdl";
-  version = "0.2.55";
+  version = "0.2.60";
 
   __structuredAttrs = true;
 
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "rvben";
     repo = "rumdl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EZNHzJPnCkOaVxwz1lUQyNlk0mDAgK/ubTYu0ZMsttc=";
+    hash = "sha256-YKQFH0F/fZr6zeVDPAkF1nDXyg3Xk7Oi4vyJ2Jz+CM0=";
   };
 
-  cargoHash = "sha256-ooLf+EpWDRfDQBQTI3xRGR9qm5kFptTB4eRIu09Jyvs=";
+  cargoHash = "sha256-far2A4aCTlGmvsaAf9/i0osmAYECkdTvgVorf1umxKo=";
 
   cargoBuildFlags = [
     "--bin=rumdl"

From a18cfef23273f253415f1f994bd73a8d9a5c885a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 25 Aug 2026 13:25:03 +0200
Subject: [PATCH 505/551] firefox-unwrapped: 154.0 -> 154.0.1

https://www.firefox.com/en-US/firefox/154.0.1/releasenotes/
---
 .../networking/browsers/firefox/packages/firefox.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
index ffc02056a326..70bff435efee 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "154.0";
+  version = "154.0.1";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "a77cd664982add628681167ef5939bd6bf0c894aa380cca66f9b5fb265947874d1e819d42264f1dd07c843f8a6dc020da268cca9ff1e064fca019de91af9b996";
+    sha512 = "9141e34978c2ecbe1b267b3cc63136142625734618e67cbbbf6536e1427af66d01f19851200eba0db7c715991f39e7d5d0200abb9e2cd7c15d58a8a411b1b412";
   };
 
   meta = {

From f31b8a2e047ee341e0c52dc88c8b7d737e8aa5c6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 25 Aug 2026 13:25:54 +0200
Subject: [PATCH 506/551] firefox-bin-unwrapped: 154.0 -> 154.0.1

https://www.firefox.com/en-US/firefox/154.0.1/releasenotes/
---
 .../browsers/firefox-bin/release_sources.nix  | 1238 ++++++++---------
 1 file changed, 619 insertions(+), 619 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
index d70264c4a71a..b465f1e82054 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
@@ -1,1859 +1,1859 @@
 {
-  version = "154.0";
+  version = "154.0.1";
   sources = [
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ach/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ach/firefox-154.0.1.tar.xz";
       locale = "ach";
       arch = "linux-x86_64";
-      sha256 = "8e64b67fb71a02aaa7c1621bd9e81f0052bd212aa4f7a55f337f2070a1d9bcf7";
+      sha256 = "02e9a328757c3d8792e8ee91e5fa580758e2e3336d983c030cc64af869633030";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/af/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/af/firefox-154.0.1.tar.xz";
       locale = "af";
       arch = "linux-x86_64";
-      sha256 = "d36ffb9caefabd66996a022207af98a370246cc875845440acf09b42717f87b8";
+      sha256 = "112ac2a20fd9d3fcff2f81e4a9958bc2685201fdc6e2d541067b05c8a22e6e9c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/an/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/an/firefox-154.0.1.tar.xz";
       locale = "an";
       arch = "linux-x86_64";
-      sha256 = "92b6238a6c1fc63837f41d1bd0d66be7b07c7d8f29053d0d41463c2e9d2f79d3";
+      sha256 = "674eb910e4ce6e9bbdbd144cd1d7709c5d24a9c5e5337b4eefc8a6d67494cd04";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ar/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ar/firefox-154.0.1.tar.xz";
       locale = "ar";
       arch = "linux-x86_64";
-      sha256 = "36b557499fe0cb76ce72341d0bda69b20c3a7d861b2bc29cfe1b8f10d7c4de9a";
+      sha256 = "3f95cd034dccfa50d84c137933b379d9a8e3b26a86ff76e9af251180312dc414";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ast/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ast/firefox-154.0.1.tar.xz";
       locale = "ast";
       arch = "linux-x86_64";
-      sha256 = "dc3653aefedac2e532b9c37969a009467ddf9bd39860db6d333b6911bd753c0e";
+      sha256 = "c5802acff008cd5cf2a90bb1ce3deeb5285a36d37f53d29d1f35d38e7723c23e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/az/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/az/firefox-154.0.1.tar.xz";
       locale = "az";
       arch = "linux-x86_64";
-      sha256 = "f31a48cfe6a283017e10cecd3ac9619ef8f9d2a901dc6bcee2fbf580779c3802";
+      sha256 = "1b1c6b84295e8eea6ec05c8d33c5c9c74a2fb980804d2417e9a3bb3523865974";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/be/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/be/firefox-154.0.1.tar.xz";
       locale = "be";
       arch = "linux-x86_64";
-      sha256 = "efcad27a81e59ea710f6e613f73f11b6da38850d2b4a9e437f11b6daab4315a6";
+      sha256 = "2fde4673340258a961e1fd6a5f56d73731ab37ffc6dadb7780f9c09ec50d524a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/bg/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/bg/firefox-154.0.1.tar.xz";
       locale = "bg";
       arch = "linux-x86_64";
-      sha256 = "5b576c865ec5544605034335d6fa374629a4e1c95820d089d09cb8640b792738";
+      sha256 = "e95a47b8f27508d614c6ca29af60ed34d85d97c0455eacc326483596ea5e62be";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/bn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/bn/firefox-154.0.1.tar.xz";
       locale = "bn";
       arch = "linux-x86_64";
-      sha256 = "e9634aabbbd53e2a4cda9ceada3c7b21279801a475a5d97f8911ff85da5ad2c3";
+      sha256 = "a7aa36921590c0b6c1cb042304debcce92202d63d610ef6ca1678a8be229fb87";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/br/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/br/firefox-154.0.1.tar.xz";
       locale = "br";
       arch = "linux-x86_64";
-      sha256 = "7f5dcba915a984f450d884f6ddeca4453c40242c4f54398fdfec21722dae049b";
+      sha256 = "1ca7b66dd12b4d9745554d2387090dfebed40c0b9e631280d66ab8994a1c8103";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/bs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/bs/firefox-154.0.1.tar.xz";
       locale = "bs";
       arch = "linux-x86_64";
-      sha256 = "e0f512679d92a78374beed288f39bab0f12c07b3c4af334f0fa19e0818a5c68d";
+      sha256 = "99e89c7aadd91021338a6f9152121e17d26cd8caba134371761028e2f09005af";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ca-valencia/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ca-valencia/firefox-154.0.1.tar.xz";
       locale = "ca-valencia";
       arch = "linux-x86_64";
-      sha256 = "4300deb71493044a23599c6a75f1a043694c4f7713a8ee8982f98a69471ef8f6";
+      sha256 = "f9263218a7c2fe9bced0e28333f7da50bbb44e42fb3502b978c00506452bd7af";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ca/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ca/firefox-154.0.1.tar.xz";
       locale = "ca";
       arch = "linux-x86_64";
-      sha256 = "074d6e8be0027767ff94e1ace400851c0d2ee2173da4cf23b066c6508dbb2e4c";
+      sha256 = "ce6e02e9f72353d79d7845eabe857ad4dffda223979c6cca9c1f5af18c0b64d3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/cak/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/cak/firefox-154.0.1.tar.xz";
       locale = "cak";
       arch = "linux-x86_64";
-      sha256 = "542c65943eb86d881199282129d9f2d4eede0c82e2dcf6717a0a8a9467f26bb7";
+      sha256 = "e364bc3f8a20c6507be0507dcbe19a0c3756d302756f01b9d6bdb140890eb291";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/cs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/cs/firefox-154.0.1.tar.xz";
       locale = "cs";
       arch = "linux-x86_64";
-      sha256 = "937a98ee792817d7cd1b15aacf5408c5bbbcd63c096795116d480238539cd515";
+      sha256 = "7b2b09db775df4d0ccfd27c341b507b299e0c7297adbb00de012fdffd84a6925";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/cy/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/cy/firefox-154.0.1.tar.xz";
       locale = "cy";
       arch = "linux-x86_64";
-      sha256 = "d70a6572d52be34a6bcd54458ffcd9180b25321513af27f13145a2e4700fb243";
+      sha256 = "03b84754c03fd4a3693df10f6d42dcf5648f58da9ac00666b717880e29410ed4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/da/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/da/firefox-154.0.1.tar.xz";
       locale = "da";
       arch = "linux-x86_64";
-      sha256 = "f7645df5a844c0f3087b2d6d9ba9b2c3147122c5e7492c217f6a09904ab8fa3c";
+      sha256 = "ae6ea05c2581a8f726e2963b31460dc811b4b46d747a381a23461631a3649cfd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/de/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/de/firefox-154.0.1.tar.xz";
       locale = "de";
       arch = "linux-x86_64";
-      sha256 = "99d2e9ff23cfbd991f21580c9340a599ab5413867293a7a06c841b8b616f6ed5";
+      sha256 = "fb27c3a7097530d9fc448210f446a37d6dbfe575146683bee3a8e856723e531f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/dsb/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/dsb/firefox-154.0.1.tar.xz";
       locale = "dsb";
       arch = "linux-x86_64";
-      sha256 = "87a812842cd339f8ab591b23bffb0d604e3256d00d604540eeffc8f4f2bbe7df";
+      sha256 = "02cf5d58e154f7b1a33b304cd0f18a8c4dfcff98e7d8dea20c8cfeaa4b841366";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/el/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/el/firefox-154.0.1.tar.xz";
       locale = "el";
       arch = "linux-x86_64";
-      sha256 = "9f77aa924d35f7fba16364a7df613179578ea45e976ee7c75c0fc5e2ada49aaf";
+      sha256 = "dfce5b777425b6f649dda87664d4b428745d0add8672363dcac8c43b30e400a1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/en-CA/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/en-CA/firefox-154.0.1.tar.xz";
       locale = "en-CA";
       arch = "linux-x86_64";
-      sha256 = "cf243c1c0950b7a8fe867c540bec8e25447c8949a329ef01c672b3f372dea674";
+      sha256 = "278fdaa59b1f872684b095656dcf29c7977db1d5bb4ee2f65f9c10c0569737b3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/en-GB/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/en-GB/firefox-154.0.1.tar.xz";
       locale = "en-GB";
       arch = "linux-x86_64";
-      sha256 = "d755d09114736b6e6ecd2de70b75923ff0f024517d4f75f80374f8428a3b8905";
+      sha256 = "c59e4a7e5148b333b52f13be253c011a37cc2af487c7f8fa55bd6237889f373a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/en-US/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/en-US/firefox-154.0.1.tar.xz";
       locale = "en-US";
       arch = "linux-x86_64";
-      sha256 = "7665cd49ab13417270748325838e565136adbc76d41bbd76fb24d15a0cc7792b";
+      sha256 = "ca29d2d001e0e54e3d83716d1104adb1ed281200d5fea6fdf8fac21b3ce3e526";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/eo/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/eo/firefox-154.0.1.tar.xz";
       locale = "eo";
       arch = "linux-x86_64";
-      sha256 = "aacb6ef648c4b560fafa713bb4af29246092404c51df57fe7a5898c4445f67a4";
+      sha256 = "782bc69caaad87e67452f8b6806bf34106338a263b98ed319033f3d6ea27a6ad";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/es-AR/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/es-AR/firefox-154.0.1.tar.xz";
       locale = "es-AR";
       arch = "linux-x86_64";
-      sha256 = "972d61a25fd0d42211421618d7e6ee57e9256f9484beaca6cf8eb17e3f4a2f07";
+      sha256 = "ffd7921c11ff9f99d0b79dc133a362f38e7c1d9e4ad9c7e748ef1b1cc5417d40";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/es-CL/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/es-CL/firefox-154.0.1.tar.xz";
       locale = "es-CL";
       arch = "linux-x86_64";
-      sha256 = "a205dd03b6cb89a2a63a0c3f5150f9aad8eba4a938e2019304607af61ce73e60";
+      sha256 = "e732f252350256fd624b24e4a031d8ad5cb3e4ccd5250ae80e2f50348f7ee9e0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/es-ES/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/es-ES/firefox-154.0.1.tar.xz";
       locale = "es-ES";
       arch = "linux-x86_64";
-      sha256 = "fc9b00edeae2d7a587b42890477f6a9272f7cf0e97bae35adfb51179c4ba191d";
+      sha256 = "b30c9955eb4d6659d3ad9c8d6c4edc069928ce52203314b8fe0d4f8bb93d4bed";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/es-MX/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/es-MX/firefox-154.0.1.tar.xz";
       locale = "es-MX";
       arch = "linux-x86_64";
-      sha256 = "13bd360a772e253c97e477feadbca805f53c0f3701fb41cf077a135a3c46d9b3";
+      sha256 = "5ad9b7a3421cab4a42ab74f1d24f0a27da0c072067d3b814a428635c8addf263";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/et/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/et/firefox-154.0.1.tar.xz";
       locale = "et";
       arch = "linux-x86_64";
-      sha256 = "7748e34035a930b22bfc5630ee3b9bacf32ac1f09826162732496260046519d8";
+      sha256 = "cc4c59af649aae22b5d1a4c6a6f287ca6217aa28fbb143e1d285a97d66b1268e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/eu/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/eu/firefox-154.0.1.tar.xz";
       locale = "eu";
       arch = "linux-x86_64";
-      sha256 = "72b98a3d77332804565283f78d5c0ec7b4ed113c2880ceadca60bc9ce0f04fde";
+      sha256 = "6a00933fc3b94158683dc8b41940809bacddeb1b966f18cd53446b1f44b07239";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/fa/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/fa/firefox-154.0.1.tar.xz";
       locale = "fa";
       arch = "linux-x86_64";
-      sha256 = "10665eb863a0695be079ffef2ad4139c28af8b7877e8c03e144bf3ce2399df30";
+      sha256 = "4431cf57c93bf8f7df24d7ef15e177630f2dad6a378c2f4688d42105948ca817";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ff/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ff/firefox-154.0.1.tar.xz";
       locale = "ff";
       arch = "linux-x86_64";
-      sha256 = "7a3d577d913dbb823395b500b5be1f9c37feb5478db4048975ff743da0d4e0d3";
+      sha256 = "f45f9ad507def4b43a7e8df3a022c7c59c0a58006f576793efe76e5caac32572";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/fi/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/fi/firefox-154.0.1.tar.xz";
       locale = "fi";
       arch = "linux-x86_64";
-      sha256 = "9ce7ec8f2f6c9ec88aceefa2460a94c4343e4836341d9e28116da79012cfaca4";
+      sha256 = "70c9f0890e0065648812172e608452e7b91e38a3db181c5f90d35edeffb0cacd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/fr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/fr/firefox-154.0.1.tar.xz";
       locale = "fr";
       arch = "linux-x86_64";
-      sha256 = "e2790d0b6920128870a04d6e194dbc9bdb588a4df153a780f61a8d325deb8291";
+      sha256 = "da042ea18f86235f7f416542b1d63ed42af0e3cd3f89f182fcc69d4a30a701ee";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/fur/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/fur/firefox-154.0.1.tar.xz";
       locale = "fur";
       arch = "linux-x86_64";
-      sha256 = "c4d39384fac503316744e125f5c2fea87f5a156f299d8499821f6781a7674d1b";
+      sha256 = "634bb4c52009e48d944ce4eb0e61d9f81edabf3fe961b5aaa5d4001d9e015490";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/fy-NL/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/fy-NL/firefox-154.0.1.tar.xz";
       locale = "fy-NL";
       arch = "linux-x86_64";
-      sha256 = "1a79ce60d3a3ca17b6be991781bf89d7b7425040fc44b1e19d0ed6bcb55d4e37";
+      sha256 = "6a91016eb211a9d4246ebb72c4e9505c8303c47f186b53c02949a16eff5dd7e1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ga-IE/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ga-IE/firefox-154.0.1.tar.xz";
       locale = "ga-IE";
       arch = "linux-x86_64";
-      sha256 = "a549e3953831708f83a1bec3a61ea78d145e87b9dcb96b038be3e6d3bcd19e17";
+      sha256 = "6c82bbd0a52d018d2e7f2137511c6d8bc1ad5b3492d86efc89bd0775decf5d7f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/gd/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/gd/firefox-154.0.1.tar.xz";
       locale = "gd";
       arch = "linux-x86_64";
-      sha256 = "aa1ac0b52f9821b87941fbfbd493aab9574881a99dbedf4e3537ec3df7cf6eaf";
+      sha256 = "1747245bcbf68c6b2516836ea2387dacd3478ba2f5886dee39c7e81c718d2e1e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/gl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/gl/firefox-154.0.1.tar.xz";
       locale = "gl";
       arch = "linux-x86_64";
-      sha256 = "5b4916ae0ed2ff973ef09bf87435d11327eea9fbe1e0ecfe2b0cd15396f155bb";
+      sha256 = "903b078a42131372fab0b588afa2fd1bbd1fd930929f80c9334439aeb472dc34";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/gn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/gn/firefox-154.0.1.tar.xz";
       locale = "gn";
       arch = "linux-x86_64";
-      sha256 = "1e54e0fb0322a8b0c129c490ddc699ea9f35e21fd827a8939ef9d43e3d2924b0";
+      sha256 = "6dce25645f21403be1677e34c004739d5fb9424c0a80fe85d1023975ec19a478";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/gu-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/gu-IN/firefox-154.0.1.tar.xz";
       locale = "gu-IN";
       arch = "linux-x86_64";
-      sha256 = "66e9fe2b288969efe1f1b37694fc208009594d6f5f4794fde91afa4631eb84eb";
+      sha256 = "2355365ddfc8faceb911267aa4840e0d480d90a1e64cbf55610291eee519965c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/he/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/he/firefox-154.0.1.tar.xz";
       locale = "he";
       arch = "linux-x86_64";
-      sha256 = "2762f25afe7639ed290888a46e6f669b214052e3dedd8198f819e2719bf5b9a8";
+      sha256 = "48bb1917449e21d99f86b4336471900f2f18513d0284b97a493ad7fc03e70ed4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/hi-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/hi-IN/firefox-154.0.1.tar.xz";
       locale = "hi-IN";
       arch = "linux-x86_64";
-      sha256 = "22a4164fe8629436e36de2be7c9184d8849dbbdf6640c87bcee30e01cb3bde96";
+      sha256 = "ae374bd02f3719f0792c6bf38301b3fd74d3faa2c86220711500044acb98326a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/hr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/hr/firefox-154.0.1.tar.xz";
       locale = "hr";
       arch = "linux-x86_64";
-      sha256 = "0a000a4d1754fa98439fb2f7343a9525b365619fe9b0ccf7a6955d94c4351610";
+      sha256 = "1574fbaa6bc5fe15c6fc789df2f215263e89f6e6cb54d677d3d30d9b34421297";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/hsb/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/hsb/firefox-154.0.1.tar.xz";
       locale = "hsb";
       arch = "linux-x86_64";
-      sha256 = "2fcc7887e1e2ae378393881f0e179de86389128db992e8dd0c9b8a58eb329e41";
+      sha256 = "614fdbfbfd613c5f98a72b7cd15004a85e21c6300ee6b6a97cb806654a93843e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/hu/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/hu/firefox-154.0.1.tar.xz";
       locale = "hu";
       arch = "linux-x86_64";
-      sha256 = "13424d9c83596de2980c2a114aa658417da162122a07ad0dfdb487bae514e6b8";
+      sha256 = "3a1d6c2b8e085a0118649d11b615fd93b3b136c7e131dbc3d682cae673bf080f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/hy-AM/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/hy-AM/firefox-154.0.1.tar.xz";
       locale = "hy-AM";
       arch = "linux-x86_64";
-      sha256 = "c3b83ba41440602d5c07ac374504cf0ce78d4b6018b449565d4f1cdbe3ce4a1d";
+      sha256 = "ecdd017ac6dd6a16086f71f653ef8675e660abad8236053cb808993d873acf6e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ia/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ia/firefox-154.0.1.tar.xz";
       locale = "ia";
       arch = "linux-x86_64";
-      sha256 = "8b493ac5d67fb579414253aca8e4b4e005102dd40e792ec4ea36eccd2bd9e5ce";
+      sha256 = "8909b8af617f19b22dac401b2589b831ce945211d427fd813c1e6e4eafbe89e2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/id/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/id/firefox-154.0.1.tar.xz";
       locale = "id";
       arch = "linux-x86_64";
-      sha256 = "1a7074f2b07ba6aefda11503fc8625c62a0a53fc7c233b60ee763f7695e94a4c";
+      sha256 = "b4a8b82209eb1f1173e6b93e88dc0360faf222f63347f6c6ca7c33838d0e73bd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/is/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/is/firefox-154.0.1.tar.xz";
       locale = "is";
       arch = "linux-x86_64";
-      sha256 = "46493b41bf022d2b1e30180520646164520c8061ec81a4a6108a8a1dec676370";
+      sha256 = "91180bd1108a67f5f7145dc69ce794160050695692b750eebcaa7d554d4463f2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/it/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/it/firefox-154.0.1.tar.xz";
       locale = "it";
       arch = "linux-x86_64";
-      sha256 = "e059c8bbadedd1d2fe50906d7b666aa752c30f0d9e0080acacc5802eaf17193d";
+      sha256 = "93dfa1fa06ce7e609bae1575f47bd35a4a6b047cd1c2d00c72303b90643d2f93";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ja/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ja/firefox-154.0.1.tar.xz";
       locale = "ja";
       arch = "linux-x86_64";
-      sha256 = "8757c7160d252057de0f6675e46a53c5180a22bed20f9330e1dbb2cd29af0a6f";
+      sha256 = "1db11b88cfd4cb951468b2edec404da81a17cb8eec633ea4e4a1b842c5241abe";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ka/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ka/firefox-154.0.1.tar.xz";
       locale = "ka";
       arch = "linux-x86_64";
-      sha256 = "6ad93f7b0dc202725b63866830ae2367fd715130169e7f2e63666c810ef72657";
+      sha256 = "dc31aecb2bc2aa7d2923253b9e30f7e71b11d75175be4b7a373530a091e54868";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/kab/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/kab/firefox-154.0.1.tar.xz";
       locale = "kab";
       arch = "linux-x86_64";
-      sha256 = "6f3a99af95b7534a6499fd2259f9878a81aa5e2d329526c5a01e8d89f1a67078";
+      sha256 = "c76efeea3a08e9d032c36c1f9718c8fad5ec959fcf944e2e1fcc070a56982726";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/kk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/kk/firefox-154.0.1.tar.xz";
       locale = "kk";
       arch = "linux-x86_64";
-      sha256 = "2ba664cf967898bf9b7e2f4c3240c4f0c21141e0a35b4fb67df14854b2a48f3e";
+      sha256 = "e4e513ccc00b46e20c25ce5b5e649ad6de601e1303d82c9b45c2eb09b8a4383b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/km/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/km/firefox-154.0.1.tar.xz";
       locale = "km";
       arch = "linux-x86_64";
-      sha256 = "8fa00ce60ba8d9b0231c94ddd1b5ec5b3828ae38f17e0b1b77c8f5e0305a4eb7";
+      sha256 = "a10c32cbffcf6b312abbd7978b72b341c32e25423f7f895a8fdb1ec7c1f47f90";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/kn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/kn/firefox-154.0.1.tar.xz";
       locale = "kn";
       arch = "linux-x86_64";
-      sha256 = "40f10c1de26d649a7cb5d13503d8b50947b5cc0828ea39fa84a676f0efb3b96f";
+      sha256 = "42b3251058353b496f5045d36a80e150628dabcde86838eb7f346b4a912e9a69";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ko/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ko/firefox-154.0.1.tar.xz";
       locale = "ko";
       arch = "linux-x86_64";
-      sha256 = "b0193f9392332ded70bf9ead68a531b4ac39d317d7a21b6c0c8e7098f517c28f";
+      sha256 = "d69a34723bbf216954e207b6a469c7acfc735acae8c1d386141e555e6da27f1d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/lij/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/lij/firefox-154.0.1.tar.xz";
       locale = "lij";
       arch = "linux-x86_64";
-      sha256 = "3a34574a70e1a2c53d51cdb12286ca37c5334e02586101cc0210309a8139763e";
+      sha256 = "c1860bc83cbcdf65c08a605c1d65da93effb743439dda210ffc6bf59c6dee6d2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/lt/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/lt/firefox-154.0.1.tar.xz";
       locale = "lt";
       arch = "linux-x86_64";
-      sha256 = "f998e908c6cec6900d156f76f593cabc7680c16d158c2e07029e51abb9f8ca17";
+      sha256 = "f43d7c7ba3d45e360c380a3733c2d0703f23565a16b706b3b3e5edb2b1d0a100";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/lv/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/lv/firefox-154.0.1.tar.xz";
       locale = "lv";
       arch = "linux-x86_64";
-      sha256 = "6a8952fece3cd31a7601d83bf77f568ed76c6f153bf2a58805ce0f5e03fffb59";
+      sha256 = "08cb5663ad55bd9135bfd873da0d099dd7d7428576136df001151621015c9d7b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/mk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/mk/firefox-154.0.1.tar.xz";
       locale = "mk";
       arch = "linux-x86_64";
-      sha256 = "b1774475981556175bbbdd77b8f68f7fa281cd2d1f19aec875374cbe7bb51fc4";
+      sha256 = "c9fa475e2d78d98a0357c3aebc051cc980d4d22bb74086be0b5970dc116de877";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/mr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/mr/firefox-154.0.1.tar.xz";
       locale = "mr";
       arch = "linux-x86_64";
-      sha256 = "ad81f7413a9fe604b7343cffcb387719bd0dcae004d050fe887c8ae825f2ed5d";
+      sha256 = "8b67a3e6df16af41651a27f9d7b6615f3062222205dfb4c0049aaa7503fe897b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ms/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ms/firefox-154.0.1.tar.xz";
       locale = "ms";
       arch = "linux-x86_64";
-      sha256 = "97bfaa34bbe6bda39f67d8d3911b2212410ed35ea7236a74b8043fa07587bf45";
+      sha256 = "0e1612d59335ae0ab06c9ffbf338ee837873f436212c4aab1b56c4b04f815ce3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/my/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/my/firefox-154.0.1.tar.xz";
       locale = "my";
       arch = "linux-x86_64";
-      sha256 = "8627166ff58524a4ac9f06840ede7e13988d1930ccb82201e0a53ede1a853b5e";
+      sha256 = "a92a26336da53b45e4c8e2179552f613179bbb0648f5d1c741c45ccdb08c510d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/nb-NO/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/nb-NO/firefox-154.0.1.tar.xz";
       locale = "nb-NO";
       arch = "linux-x86_64";
-      sha256 = "faefb5a2916b6afc5e999914cc7cc22afd59fed0d6cac90520f69fc39f37021b";
+      sha256 = "df6dbecf6aba8d30fa9d5c077740d59b6e3d8e3c50bf33f36d7d0a73502dca81";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ne-NP/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ne-NP/firefox-154.0.1.tar.xz";
       locale = "ne-NP";
       arch = "linux-x86_64";
-      sha256 = "8cc12c2c78c4fc28061c2e0f7ece21027fc96bd6254e7f9bb66b2cbab5258b14";
+      sha256 = "03ec66f09f4331d4c212775cdfe8036fdb738017f18aa6f754b55cb47f3b3947";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/nl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/nl/firefox-154.0.1.tar.xz";
       locale = "nl";
       arch = "linux-x86_64";
-      sha256 = "4f54b3589443f9393f30a0dc2a7834190eac343ba4537862b237b2a45f2746ab";
+      sha256 = "2c478837a48229d435bd2f45e8c92ec6f392c8b5b1669548ef84da93b2d17565";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/nn-NO/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/nn-NO/firefox-154.0.1.tar.xz";
       locale = "nn-NO";
       arch = "linux-x86_64";
-      sha256 = "51493fc5a9dfb800e8d4a6371dc238a6c41141f14caab77e04df09a2bbab008d";
+      sha256 = "2f93fec64dbeff386075c7bf9bef4678158cb5b6cd4cec538f65b9a6059e623b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/oc/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/oc/firefox-154.0.1.tar.xz";
       locale = "oc";
       arch = "linux-x86_64";
-      sha256 = "a5d10589c6911ebe76824921674ef52d677597968ea5d5c630202c081eb5abc7";
+      sha256 = "eb36f5dc19cebb5cc15cb85aa0deaa928ea105cd1fd787852abe605355fd61bf";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/pa-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/pa-IN/firefox-154.0.1.tar.xz";
       locale = "pa-IN";
       arch = "linux-x86_64";
-      sha256 = "2770c85c3c2cddb7232d9735631975717a15804950200a66780fa6700a4e0c26";
+      sha256 = "6156448e2bac8c3590a168cd0353ad219cd0db025f3ecb89de67eabd306b282e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/pl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/pl/firefox-154.0.1.tar.xz";
       locale = "pl";
       arch = "linux-x86_64";
-      sha256 = "86d7ce296755f68af7e5566181e7ee8daa7874d527db1b7c55f85bf915cefb49";
+      sha256 = "326ce1d473c0bbf7765b5e19a55131f62848865c7f85dbe7ba77000853788b68";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/pt-BR/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/pt-BR/firefox-154.0.1.tar.xz";
       locale = "pt-BR";
       arch = "linux-x86_64";
-      sha256 = "253ddd4e9668111bd4e82b58d16bde27baa90f4aed753e0f65a5e1f2bde575e3";
+      sha256 = "ba454c759761e9e3148e84a19acb71fe5e0b9053cde5481520c1c433c0b4235a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/pt-PT/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/pt-PT/firefox-154.0.1.tar.xz";
       locale = "pt-PT";
       arch = "linux-x86_64";
-      sha256 = "369c5f444d4aa056f0fdc2807a5dd8aa5feab3e1f231f80e6ec2d8b85791b479";
+      sha256 = "ba14631bd16c296a08fb09436180be3f4e1446cb72d6ab5a7ea81f255af1dc37";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/rm/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/rm/firefox-154.0.1.tar.xz";
       locale = "rm";
       arch = "linux-x86_64";
-      sha256 = "e9d14e8709d5e5604b755c9cfb6b8c77c38933d3b5c5cfdbd28986ea53e1f045";
+      sha256 = "3c7c04950b0cd84803ea45b2912479dd27b395be020e9e1feca15360a0e75848";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ro/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ro/firefox-154.0.1.tar.xz";
       locale = "ro";
       arch = "linux-x86_64";
-      sha256 = "4097d72314b6c25f091cc2360f5184c29216b749e99637912844ba5dd6d3c8a4";
+      sha256 = "79ca3625a3fcd577d96495ea2a3355ee4fa8795f1443befb2843b356acf8de9b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ru/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ru/firefox-154.0.1.tar.xz";
       locale = "ru";
       arch = "linux-x86_64";
-      sha256 = "e672355787fed02f31292d60332008e7481f95e650e61c721edb7ce9108b6225";
+      sha256 = "19618072baa5af2173701231d7f56cb3706c860345a31d8034ae4c097ab75ea0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sat/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sat/firefox-154.0.1.tar.xz";
       locale = "sat";
       arch = "linux-x86_64";
-      sha256 = "87f0c29fa1e0d07fd514309ba811de2ee1d3b9a0e0df68bb756b986396900491";
+      sha256 = "bbb2647f223708b43b908267d346db9c7dd1a869ac2bc93394afb64aca8ae0d2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sc/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sc/firefox-154.0.1.tar.xz";
       locale = "sc";
       arch = "linux-x86_64";
-      sha256 = "a2156da19cc66d516771dbf011a9c016aeab1782a725729192e924eb696d70b6";
+      sha256 = "3ce3f1325c6a6ef1aaa51ef99414ae35b68b3f73a476b552d18e932d6abec0de";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sco/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sco/firefox-154.0.1.tar.xz";
       locale = "sco";
       arch = "linux-x86_64";
-      sha256 = "8548e1d01d1652416400cce196aeb9634743d99f9a5d07e43c89f35950d2dad9";
+      sha256 = "d23c40d515e95ca67daba8a5f7cf6d068c2af98f156e15ec747accac13aa1a2f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/si/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/si/firefox-154.0.1.tar.xz";
       locale = "si";
       arch = "linux-x86_64";
-      sha256 = "bac9e1bafe3c304f766875300fec556021e3c5e5f0b813a29a30ae8c8f27c720";
+      sha256 = "69f13947efa57799b4d91274396408f9b4bc44e119052e58c2f95232d62e043a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sk/firefox-154.0.1.tar.xz";
       locale = "sk";
       arch = "linux-x86_64";
-      sha256 = "2907a789a27a3e0a59caac5c442016a3f3ffa2fb4eb212906e25f3c8dd827d19";
+      sha256 = "945ff516e0e7dd11d4290ec723b26e140988f4259509ad7372aa1088b5dbe3c3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/skr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/skr/firefox-154.0.1.tar.xz";
       locale = "skr";
       arch = "linux-x86_64";
-      sha256 = "9f8019822927e906e33b8bb09e6aed6e7a1833f37b9b52ba8585b4b7dd2dcfe3";
+      sha256 = "1a47b63eb211d32b5a6e49a9988f1633f9a13614d79993822767b21b954c7340";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sl/firefox-154.0.1.tar.xz";
       locale = "sl";
       arch = "linux-x86_64";
-      sha256 = "26fe98252f450dc419afe043b1df5f85313289123108ece2c26810c7ccee29bc";
+      sha256 = "e69e091f336814c2fbdf688c846f35d670528f48f2e9b69a630778458c4e3b0e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/son/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/son/firefox-154.0.1.tar.xz";
       locale = "son";
       arch = "linux-x86_64";
-      sha256 = "5c0bd0211e337d218d14c93efcbacf34e40249255fa1d3dcb899a28b32e82f82";
+      sha256 = "2a5492236d0fc2f84dd605639b226a76a75330d1a49d8289ce72a5acbb7d88da";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sq/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sq/firefox-154.0.1.tar.xz";
       locale = "sq";
       arch = "linux-x86_64";
-      sha256 = "f6ed3639b9156d6792798ff76197a44e2a249993f134b3629a45c433d6530cd7";
+      sha256 = "fc436c92edd7dd885e10860ff3e463923b31cffd24b4eec0416a567d17dd3061";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sr/firefox-154.0.1.tar.xz";
       locale = "sr";
       arch = "linux-x86_64";
-      sha256 = "9237547072178d8710b94f2d6cacfb37a36f4c12ed6302e7218b146ecc8654fa";
+      sha256 = "ac29150bfddd856efe9a2e7a752823be6f21f79b36c9d7d9a68780b1cdd08890";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/sv-SE/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/sv-SE/firefox-154.0.1.tar.xz";
       locale = "sv-SE";
       arch = "linux-x86_64";
-      sha256 = "eeaf0d728f9748bb5dbd373268f8f3fbf3d19cc03fc62b56c534612e1ea289d8";
+      sha256 = "3e364801e01054c33b4775a7b6fcec809121d8e77ec261a15f9f63979254108f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/szl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/szl/firefox-154.0.1.tar.xz";
       locale = "szl";
       arch = "linux-x86_64";
-      sha256 = "4ce4555c9bc72cf8434500ed48b9fe2e2be8ade5bf3715adcf4518d549fcfd51";
+      sha256 = "1e0ad89580de9acc7605f7b64973efdb1d64838b17c4872e840552c8eacd8df0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ta/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ta/firefox-154.0.1.tar.xz";
       locale = "ta";
       arch = "linux-x86_64";
-      sha256 = "692571474555633197e10fa6553a28ebc8ef2b5ccb3c0fe39f6d9ad73808aad0";
+      sha256 = "7f569bef788182808d7e38a9bfba37a1ae139a62c0b76b97c20b17b8f12e28c4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/te/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/te/firefox-154.0.1.tar.xz";
       locale = "te";
       arch = "linux-x86_64";
-      sha256 = "3358251692e41bfa49a75b0d2405db7c05199ab33ba4addaa7d80485ab2f687d";
+      sha256 = "d10404e9e7140b369e56b55c2222d8bdd52fc3b9d387d4bd432d20f0aa98c306";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/tg/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/tg/firefox-154.0.1.tar.xz";
       locale = "tg";
       arch = "linux-x86_64";
-      sha256 = "c9556508d16767bc74122b53006508e3dc701f851216004aaa214454d89ccee9";
+      sha256 = "aa3e1a427c880e2dd9e5788ea48ee9b2e6070a19b9fb19ae71bd7365f18d027b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/th/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/th/firefox-154.0.1.tar.xz";
       locale = "th";
       arch = "linux-x86_64";
-      sha256 = "4f592eca5024079e8c2070220eb5d53f35c3dd6d207df0acd2bc28e5bb9b5aaf";
+      sha256 = "204fb315770071206008c3384a23862757b2b4926327c4e381a1f58b5805bb8f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/tl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/tl/firefox-154.0.1.tar.xz";
       locale = "tl";
       arch = "linux-x86_64";
-      sha256 = "b1188767da17e83b483146448088e00c8993f53da2c2fc15d54a27f73bd02fdc";
+      sha256 = "008248dee4d35236b5729cfb5524d530a6449232314de277a40be12d425186ca";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/tr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/tr/firefox-154.0.1.tar.xz";
       locale = "tr";
       arch = "linux-x86_64";
-      sha256 = "776fbdc97b5d89359f7a9b9abd622acdb03802b6f50ed71d4077ebd884a38477";
+      sha256 = "44af43d08230a3a114cd7df83d753e8b06b9718250a81f5ca9d33321d21aef85";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/trs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/trs/firefox-154.0.1.tar.xz";
       locale = "trs";
       arch = "linux-x86_64";
-      sha256 = "0083b4627b8dc92793a146c69bdfbf58c411f607db678b03f0268a825c64be50";
+      sha256 = "bc57b12d148dd0fe80dac2ec08bd8ecb41e028ae6f03a2b36f92bfe1822bc29a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/uk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/uk/firefox-154.0.1.tar.xz";
       locale = "uk";
       arch = "linux-x86_64";
-      sha256 = "9215dec3eddb8dffb695dd876c803134f296bac8505d9a728c1ad5477ef23d4d";
+      sha256 = "39f6b02423da6e2feefbee935cc2070a804e7cde0e1d8f1939d11decb9736806";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/ur/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/ur/firefox-154.0.1.tar.xz";
       locale = "ur";
       arch = "linux-x86_64";
-      sha256 = "c87334fa00b54f94c2a4d872026aab8cdf75b868fe9db98c998459671fddb639";
+      sha256 = "0489d77e61169b4eb1d85bd0f1047831a557f3979715ae361cfa8ffeb7375475";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/uz/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/uz/firefox-154.0.1.tar.xz";
       locale = "uz";
       arch = "linux-x86_64";
-      sha256 = "8e52e26e3d67029947766fbc91cb7577e8f8d86214a7722e189978ad35bf849f";
+      sha256 = "005fac89225a264a6d3052c2f4f0180e46d698ff335718d309179fa3316ea3ad";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/vi/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/vi/firefox-154.0.1.tar.xz";
       locale = "vi";
       arch = "linux-x86_64";
-      sha256 = "64b11775e250170da886d4b015d3e2786d2b391683fa6c3ca87357d417fa589c";
+      sha256 = "c0c3aa5c5ed7a902fc4e1c4096f8325cb15563e1c0e6871354bed1a77899d7ba";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/xh/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/xh/firefox-154.0.1.tar.xz";
       locale = "xh";
       arch = "linux-x86_64";
-      sha256 = "1ec5771032e55306736504d79195bdc5ddafb277c956a0dd51522b97b2857475";
+      sha256 = "72a0f8b1ab38d01e1e194e940ca1f06c98ecce56b405521f79c5b8af8764c766";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/zh-CN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/zh-CN/firefox-154.0.1.tar.xz";
       locale = "zh-CN";
       arch = "linux-x86_64";
-      sha256 = "bc937876ac7efca3023e67ab6c56c7a4f89f8b36b39ee807e76def2827cab99d";
+      sha256 = "4071c0eec7b599cbf3b34e029cdf98f4d2cf246428a5b8f8f05c6f998f67e594";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-x86_64/zh-TW/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-x86_64/zh-TW/firefox-154.0.1.tar.xz";
       locale = "zh-TW";
       arch = "linux-x86_64";
-      sha256 = "baf4983d943e91a04d304b91cbef9b18f6226fe42ef93800729a30555537743e";
+      sha256 = "c032cf8ccff68a7964805e4f7d968676e40eff677a0bc50c1a73d48e88444ff8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ach/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ach/firefox-154.0.1.tar.xz";
       locale = "ach";
       arch = "linux-aarch64";
-      sha256 = "993961b495372ba52f155e20ceadacf82de9d2ae740db3bd0936e81d38d732a0";
+      sha256 = "93b7080e857204edb395033062097881f54a7fd944cb1885b0b4a2d6aa5f4261";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/af/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/af/firefox-154.0.1.tar.xz";
       locale = "af";
       arch = "linux-aarch64";
-      sha256 = "abeb50f23674224473e89898ca25f2318a067826e33bb8a2510db2a4fcc63172";
+      sha256 = "84425be21cd30c31f1b71b59a2187e578a3fb12bee480f08995a65dd2b03ce2f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/an/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/an/firefox-154.0.1.tar.xz";
       locale = "an";
       arch = "linux-aarch64";
-      sha256 = "5b86495656dc45fe2208c300debb35342fa0579401c17ddab10a65d5ffb03bdd";
+      sha256 = "ea861a7dbac2fc571240952934f3e2d6b817a550004aa044313d156e06a3db23";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ar/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ar/firefox-154.0.1.tar.xz";
       locale = "ar";
       arch = "linux-aarch64";
-      sha256 = "5bf11831e43cc1e2a7a6c5d0d504a41649d3d8b2f70dc58b971f191c2baaecf4";
+      sha256 = "561236bc96d1770611e4f74a3034bdb91c58e8ef2f1ac62f3a9326838f4cd339";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ast/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ast/firefox-154.0.1.tar.xz";
       locale = "ast";
       arch = "linux-aarch64";
-      sha256 = "3dfa4798a8b8ee6b72192e695f8cb5a5c2138c3402ef60ad1171cb8c6fc9d96f";
+      sha256 = "e398bc29f85e6d6e6e31947b0fa22a267d4270aa0af34a96379dd30b385694b5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/az/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/az/firefox-154.0.1.tar.xz";
       locale = "az";
       arch = "linux-aarch64";
-      sha256 = "f76cb5a973c11429fbac628f64b7ac7a31d4ccc1045f1088d83ffce07f4e21cc";
+      sha256 = "f1b5123be32b7ce7f75e0f6d05e5ff55aeb4185d63635530fc16a3be9bc2fec2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/be/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/be/firefox-154.0.1.tar.xz";
       locale = "be";
       arch = "linux-aarch64";
-      sha256 = "b25d0726f681f5f1b5151209de44becab0d7fb7027c11c68208febec7566425e";
+      sha256 = "ea296ce40c47f1d6e2b69df5d63ecc9046f5cd11366c02852714334153f2f186";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/bg/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/bg/firefox-154.0.1.tar.xz";
       locale = "bg";
       arch = "linux-aarch64";
-      sha256 = "4b86edcfd41f5982ae0e80985655fb9d3e04e411c138c62f98806004e52b9aaf";
+      sha256 = "c45d9f23f163a301a78198a22367d5ab1203d58508386f71cae53d1b1285daba";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/bn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/bn/firefox-154.0.1.tar.xz";
       locale = "bn";
       arch = "linux-aarch64";
-      sha256 = "a07471908be2fc3b7ceadb67872a83de1f71392aef279c8d2d864399fda77db2";
+      sha256 = "d7c3154b40c7d4dfab1e73a4bf439ca36b60b9fbc7c48c7487a5e19152c8723b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/br/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/br/firefox-154.0.1.tar.xz";
       locale = "br";
       arch = "linux-aarch64";
-      sha256 = "216a30c68bacb211b367e298ee206be57da00b4564a22c24ff7c226c90bafb6d";
+      sha256 = "115156d892d441ea04eac869bc5a1f5dafbbd51c4454bee803db8f52c4a99947";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/bs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/bs/firefox-154.0.1.tar.xz";
       locale = "bs";
       arch = "linux-aarch64";
-      sha256 = "58d9f171a9169d7de5e6964477f1d3c1320b06955ebfde7ef2b4fa68c3d02a15";
+      sha256 = "f0dc20d0a6eebacc86f1a5755b67cc8d245a5d73630545ef59b9940ceb2e2349";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ca-valencia/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ca-valencia/firefox-154.0.1.tar.xz";
       locale = "ca-valencia";
       arch = "linux-aarch64";
-      sha256 = "6e94c7778468a1ae580800d9d5e5c8ea184dadce0f198c762e79ce27c50ea985";
+      sha256 = "c117fde5a66f7a075ed719183f71ed71b6f067f0f2a107c4b683d7cc4c31047d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ca/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ca/firefox-154.0.1.tar.xz";
       locale = "ca";
       arch = "linux-aarch64";
-      sha256 = "d7fe85c500757bade5455d831ee8ead7c9e3d1403eb08e1846c7e383172026f4";
+      sha256 = "5112f24ae36283a4072d1a30d6ac0f44b3224120b218966e61f3a9665acb746c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/cak/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/cak/firefox-154.0.1.tar.xz";
       locale = "cak";
       arch = "linux-aarch64";
-      sha256 = "58093f7d87a0b8adb06963692ab5de570cd815952e109bbcaefc5ddea6dc5438";
+      sha256 = "a01e33b13dc771ddfe021752f60d26c247c9d3a2fb920086d26ecb2e1e801d1f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/cs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/cs/firefox-154.0.1.tar.xz";
       locale = "cs";
       arch = "linux-aarch64";
-      sha256 = "c647d857f6cdc7ed6617dceb59e4bf3616e290a240d601bcb8b46df5024f7965";
+      sha256 = "c1f256dbebd99ee8abc20ec75fae754fa18d6029e48a732f1cb0342597d800dd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/cy/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/cy/firefox-154.0.1.tar.xz";
       locale = "cy";
       arch = "linux-aarch64";
-      sha256 = "509d2ac819ee4b36f996da09eef528e9beb63824698073a4e487dbde1e1cf92e";
+      sha256 = "db83d1bc35a395afa1f20808f101e124ef444ede83333d0c4bf4bfbafe8d79e1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/da/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/da/firefox-154.0.1.tar.xz";
       locale = "da";
       arch = "linux-aarch64";
-      sha256 = "501e2f570e12eecc2ec17db85826f0261913801cd9d0bce751af52d4f1d464a5";
+      sha256 = "f960826ee03cb56c15284498f23239f4e2c80b30a1ab2aa3ae3d3d3cc5853862";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/de/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/de/firefox-154.0.1.tar.xz";
       locale = "de";
       arch = "linux-aarch64";
-      sha256 = "fce9229893a33fefc4322517295be1a5aa0839c12c4c2b49c558479336659c92";
+      sha256 = "33b020e23017b9d2b0253f044b7576cc7da54cbb1136ee8e86dffb9fd0da258c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/dsb/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/dsb/firefox-154.0.1.tar.xz";
       locale = "dsb";
       arch = "linux-aarch64";
-      sha256 = "44b66d7f93153640034a31ef198f6c3a4b4e924f1d8d76c87d6359718a2a5cf2";
+      sha256 = "6afb164374501c1edd988c611401024b443cb8ef09be542ecbc1ebdf6a022800";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/el/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/el/firefox-154.0.1.tar.xz";
       locale = "el";
       arch = "linux-aarch64";
-      sha256 = "3f0cbf20a640b4ea48ce32911dfb01f9029a9bdfe18da509ff505a6f5a066b8f";
+      sha256 = "44ffff4c1a90e4ff8155a840a54206c0d533220965c834ebd52c8b168058bfc8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/en-CA/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/en-CA/firefox-154.0.1.tar.xz";
       locale = "en-CA";
       arch = "linux-aarch64";
-      sha256 = "314b696bf7250af83b8474a97875db0be3850056ae73b25e184e1bf985880da5";
+      sha256 = "7f2d1fad991770d363beb5ad0efbe6fdd306c009a476255ca97e5b82ca92d906";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/en-GB/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/en-GB/firefox-154.0.1.tar.xz";
       locale = "en-GB";
       arch = "linux-aarch64";
-      sha256 = "761f83b7c2bf2293a005258bcebac457b6b52c43c9aa6609f6fc5b1adce81fd7";
+      sha256 = "91a9dcd496b2f29dba97651bbd76d97b8f042d1a8e39b54478d07066a91e4773";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/en-US/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/en-US/firefox-154.0.1.tar.xz";
       locale = "en-US";
       arch = "linux-aarch64";
-      sha256 = "0391a8d072431286fbed8f9ff497a126ff0c9e81c455d4ef04f9fb878fd4bf1f";
+      sha256 = "0f6a24aace4bedc5e7a58a1905e4ad74e765934c73f3c2cef95347e72d2ea9ca";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/eo/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/eo/firefox-154.0.1.tar.xz";
       locale = "eo";
       arch = "linux-aarch64";
-      sha256 = "85c12827965cd7e3f665458efe42a63ad2b27806628a0c5f8e3dd5cd08cbf547";
+      sha256 = "a9a0f558c85ee3f6e932cdf6e959a457f78adbe0f60a53f2eb4b811270799654";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/es-AR/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/es-AR/firefox-154.0.1.tar.xz";
       locale = "es-AR";
       arch = "linux-aarch64";
-      sha256 = "3dfbe6cf34cdbdb1eb1a523e9c76950335aa7e42853b5e0c4c9480abc49f046a";
+      sha256 = "110b832b09a10f98315b2d32cdf47c245e09f4728fca136fbcdbb86cb63bb8a7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/es-CL/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/es-CL/firefox-154.0.1.tar.xz";
       locale = "es-CL";
       arch = "linux-aarch64";
-      sha256 = "b613b262c2cfe017c68b9c7c0ab3b47d55b0a3be68559b7e74f8367d495ecc36";
+      sha256 = "45333c19935b95480af43768669c039c3455875f06ebf029282f86af109baf97";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/es-ES/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/es-ES/firefox-154.0.1.tar.xz";
       locale = "es-ES";
       arch = "linux-aarch64";
-      sha256 = "b7f2286e7a5532af53742d5a1abf6b3f805507a1e1479ae867c01585fbb18801";
+      sha256 = "129464a646aa24851f92b4d30917ed8c285baab08159e793286242f89a0eb9ed";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/es-MX/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/es-MX/firefox-154.0.1.tar.xz";
       locale = "es-MX";
       arch = "linux-aarch64";
-      sha256 = "9866abeb8e5e2f6509ee73fd9a8205a88762887efdab4d96c6c430846c1a1962";
+      sha256 = "6d9c35cc2d1f76350dac405c353ffcbc9f68489b7059da25880ad78fe4ad8c78";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/et/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/et/firefox-154.0.1.tar.xz";
       locale = "et";
       arch = "linux-aarch64";
-      sha256 = "e9a712cfefdedd7e3173cd40ec58b50bed43c8e9cdbf703b7e3a0e14f6b63c1e";
+      sha256 = "529f9f3a5426b55a85d587b8d73ad13cd62a84fa95d109d080e0ac83824fdd66";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/eu/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/eu/firefox-154.0.1.tar.xz";
       locale = "eu";
       arch = "linux-aarch64";
-      sha256 = "dcde31969468f454f355fe2361417f226ee0ce72a6d53b675114bb6e5121d07a";
+      sha256 = "77ee57ca411b857338430029a21698ab280ba49886e16fb83fabe2bf39262985";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/fa/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/fa/firefox-154.0.1.tar.xz";
       locale = "fa";
       arch = "linux-aarch64";
-      sha256 = "7af1063f815fd66f5857ce6651a2390491f7fdf5d83f58130041b85b65485f96";
+      sha256 = "c42acd97ef78e40d6004f6b215b113005423c08b2e33a1d582fe3eabf3825ab9";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ff/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ff/firefox-154.0.1.tar.xz";
       locale = "ff";
       arch = "linux-aarch64";
-      sha256 = "8a88862c22f617b645e1320ddd9181fadb51ec2fbb18fe894c4f8311ac129d4f";
+      sha256 = "91548420f91b841b144c752d767744cc138ee70dbdf1314ef0442e4c85ef8228";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/fi/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/fi/firefox-154.0.1.tar.xz";
       locale = "fi";
       arch = "linux-aarch64";
-      sha256 = "415124f0a0375e918109814e5c6859755d93322186e69a3d1b969cce879db2a1";
+      sha256 = "61fb2aa2c98dadbe69250274509818c6e20c29dbe39f77878926ec10b4893e80";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/fr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/fr/firefox-154.0.1.tar.xz";
       locale = "fr";
       arch = "linux-aarch64";
-      sha256 = "1efb5eb745691452234b34b031ac5dd116ed1230937cac0bce698a604c88a39c";
+      sha256 = "cf894bb83f82d820ee4ad135e8a119e0ad21b8161f9b6c04c3377675f71f10aa";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/fur/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/fur/firefox-154.0.1.tar.xz";
       locale = "fur";
       arch = "linux-aarch64";
-      sha256 = "5c6cbaa218b51ed8040ec5cabda3acc574b4a9b239a4a275a2dc0ed70019020b";
+      sha256 = "6b07e8116563eac3e28f97e6068ebd818fe0a3dbf7e89924e424604b366b5efd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/fy-NL/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/fy-NL/firefox-154.0.1.tar.xz";
       locale = "fy-NL";
       arch = "linux-aarch64";
-      sha256 = "11371644b1aa7b00e49929c29edae40f1bc09234a0999e8ca4397acb186f6253";
+      sha256 = "9b00960959db137409bef9c95f7f36f65a0e332a4930e4faf08f8f3356c78072";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ga-IE/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ga-IE/firefox-154.0.1.tar.xz";
       locale = "ga-IE";
       arch = "linux-aarch64";
-      sha256 = "11247ceea036964563d1040806629db1536100bebded42dd3fffc87d5d94c3a0";
+      sha256 = "1ba9a4fd37d40b0f23ecf51f5403c5a4ba18453b9a80edcf63b19259febb8438";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/gd/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/gd/firefox-154.0.1.tar.xz";
       locale = "gd";
       arch = "linux-aarch64";
-      sha256 = "f3b2e76f2f2a1ab195d5fde901c4d660fcc2a8cdfe1456de04e507ec4cf98bef";
+      sha256 = "7d18f738ad82c025ef2ad0a821c76275756fd610fccd433faf0b9ae7d9abc69c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/gl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/gl/firefox-154.0.1.tar.xz";
       locale = "gl";
       arch = "linux-aarch64";
-      sha256 = "ba6a657c02118bd7363b6b805752dca8b15f260435913037ddc86243b1ff2459";
+      sha256 = "1379b0387810b9669c88aaff3d49b73635d45f1c4373f0eee24855ad309d79f2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/gn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/gn/firefox-154.0.1.tar.xz";
       locale = "gn";
       arch = "linux-aarch64";
-      sha256 = "46ff0d447f03e5feb1bea7061ba1d5a22f3951451cf97fea195ca5b512e62945";
+      sha256 = "20e7d85ae108e4b7624454e6034a99753d8d8c7cf32ef0baa6bc7f2ae73e01c1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/gu-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/gu-IN/firefox-154.0.1.tar.xz";
       locale = "gu-IN";
       arch = "linux-aarch64";
-      sha256 = "bd1de01be8ed3feae19222a221dcd8b32305b756a2d17a958282c924a64a1f56";
+      sha256 = "ffc964c4fd72db27691206ac7256f57109b27ef0b58ac1bddb1e859a72c06ccf";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/he/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/he/firefox-154.0.1.tar.xz";
       locale = "he";
       arch = "linux-aarch64";
-      sha256 = "f2e7e5356c2d34fff5ff52789d7f248f3e785d9c674952cc5ff607cb5a94a127";
+      sha256 = "cd58a5928a4d0922b88e1eb1129e3464a7917719ef749b8c4e7ea8461959919a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/hi-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/hi-IN/firefox-154.0.1.tar.xz";
       locale = "hi-IN";
       arch = "linux-aarch64";
-      sha256 = "f1a20082186b4398ebd5c8b8fd4456d58fcfd3fb9f8a0ba820c41c312e9e3a68";
+      sha256 = "c77d165e4fd7eab45ad908c177e7523abf2e102a00911d7c1558a31048bfb77f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/hr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/hr/firefox-154.0.1.tar.xz";
       locale = "hr";
       arch = "linux-aarch64";
-      sha256 = "8e2092bb9cb1bce6b84b4d44403482c862e69afada3bb32a495cc5ae54c905bc";
+      sha256 = "ebf613731d891652cfa093769c271185ce9eebdd38fba595cd14a2674ac0b1a6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/hsb/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/hsb/firefox-154.0.1.tar.xz";
       locale = "hsb";
       arch = "linux-aarch64";
-      sha256 = "19f439c7bf6a039b123fc5008066a9ffcd4f9ece65580d6ddcc491330ccb71ef";
+      sha256 = "bc65e0ad3b6be37cb8e2e1400c5c05366b16b57c8e1af40be70cdd1ed8641ae8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/hu/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/hu/firefox-154.0.1.tar.xz";
       locale = "hu";
       arch = "linux-aarch64";
-      sha256 = "ce488ba221e5ed64fd89149316eb3c2040c85d128d4811f8d2282c26207333d3";
+      sha256 = "b7ac2a8ac43120afae289eb8df4fac70dc551d2b38bea1785e8810e3cdfa3d5f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/hy-AM/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/hy-AM/firefox-154.0.1.tar.xz";
       locale = "hy-AM";
       arch = "linux-aarch64";
-      sha256 = "2cdf5955ce74fa0552e6318cc668fdd1541e2049d4aaa02c3918eb21d3d0f9bc";
+      sha256 = "a71ec9c2f60a4d28e8f5a398549120a3e175c2a4e6d8851faea17d4c8de4b5d8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ia/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ia/firefox-154.0.1.tar.xz";
       locale = "ia";
       arch = "linux-aarch64";
-      sha256 = "7965454ef1ee4e86953a85855c212a110c075a9dc89a8cb756866115809d744e";
+      sha256 = "c5d832bbd5b5b85f53c3b30a4cfe283b9811049f639ffcddf12e82e82c1b623d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/id/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/id/firefox-154.0.1.tar.xz";
       locale = "id";
       arch = "linux-aarch64";
-      sha256 = "569dacdaef5f2957e879167190e7bb587d64559bed0d4b13fcaba68b7385f609";
+      sha256 = "6a770e99ae1b36a9a632ac192cef8379382e95b092b7b040f684e4bbe98e3841";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/is/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/is/firefox-154.0.1.tar.xz";
       locale = "is";
       arch = "linux-aarch64";
-      sha256 = "b7fee38b005fd401e7fed14509641251a0c3aee661ab5e3d25358d2035568e3b";
+      sha256 = "644d5e39b1a076d0b17ef548151c5ceff57261272c4276396afd6bd8b93e941b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/it/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/it/firefox-154.0.1.tar.xz";
       locale = "it";
       arch = "linux-aarch64";
-      sha256 = "7af77f44fded94ce1035b18c6921e7c4494d1045a2a19494df97a75533769ea5";
+      sha256 = "44523327fdd2e884fac64828f48c506cb2f83c45a60bd4a74968958a149a6724";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ja/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ja/firefox-154.0.1.tar.xz";
       locale = "ja";
       arch = "linux-aarch64";
-      sha256 = "aba04778a75e549e420acc9637ab0af79769f4cae43be0b24f8fa1778750f7ef";
+      sha256 = "a16f8f08c00aa38e1235ad80de8cf92680f3636b31ee5e9232e4b452c099a199";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ka/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ka/firefox-154.0.1.tar.xz";
       locale = "ka";
       arch = "linux-aarch64";
-      sha256 = "575a3abb02174a678bebac0f56ab57912ef269d045a4aedd66062f05b271f524";
+      sha256 = "938ed5d45680b92cca414ef9e3b8cfe3bb2f3fa58a2f0b321ceed61cf886503e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/kab/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/kab/firefox-154.0.1.tar.xz";
       locale = "kab";
       arch = "linux-aarch64";
-      sha256 = "80cc42d2d2ad981a724e51630190f5ae1c3ad26f9fdf1d38c1df6c23ca568067";
+      sha256 = "a2f14addc58207f32b8fb8ecf551ca3a9e6f53b47a3827ce58723458fb12be77";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/kk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/kk/firefox-154.0.1.tar.xz";
       locale = "kk";
       arch = "linux-aarch64";
-      sha256 = "3dafc9b33c7fd41028cfa1ec1c4cb3d04847cea03899d3233b3d5387c4ab0f82";
+      sha256 = "9831def5f74e22429f5b031d103479686e9ab5d5e12fce3505284a43ec2f0387";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/km/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/km/firefox-154.0.1.tar.xz";
       locale = "km";
       arch = "linux-aarch64";
-      sha256 = "ea5b69feef4944a91954b0bfcb8d8cd9337005dbcfdd7379cf496952d54200c0";
+      sha256 = "85379b0d26d5f61567748cd8f600ebbda7191588d8169fbb07ab025264130023";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/kn/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/kn/firefox-154.0.1.tar.xz";
       locale = "kn";
       arch = "linux-aarch64";
-      sha256 = "20387db292d63c498334ca4b376f798987debe1359fbedd683a4a39d2beff74e";
+      sha256 = "efee3d83190aa40986eb70ad474823dafa5593fff9e7a57497c167821acfd9f3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ko/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ko/firefox-154.0.1.tar.xz";
       locale = "ko";
       arch = "linux-aarch64";
-      sha256 = "4e778413f904a2c47a2d3fbbc215a32919a789a9e454131b9d6401bbc5ffa3d8";
+      sha256 = "9338d6be0199eb3d58482ff4f9874db746efa52f33e1e371122445461783668f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/lij/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/lij/firefox-154.0.1.tar.xz";
       locale = "lij";
       arch = "linux-aarch64";
-      sha256 = "9aacf7ce0c090f80f17b8e97975cd2c68f9e0ebd1070b9ad3ec9d15df6acc72f";
+      sha256 = "61dddc4c5895709368f2004ff7edcd15dade237d63bb30036b9683c210ba0336";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/lt/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/lt/firefox-154.0.1.tar.xz";
       locale = "lt";
       arch = "linux-aarch64";
-      sha256 = "96234c0f73eb5e8cae00182804b3628ab80e5953ae48a3e624ab5d1185f3014a";
+      sha256 = "50503372f5c9dd47c22990a65434d5416922d2d52cc3bc8a9a7559188b9ee8ac";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/lv/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/lv/firefox-154.0.1.tar.xz";
       locale = "lv";
       arch = "linux-aarch64";
-      sha256 = "d63a1821dd3ec332a0002435dc9763b9db246ded70a61de61088603e01be7af7";
+      sha256 = "35c5d7b6d9006a2a5268844354a605db1e27548e009a5fc34df4c8feff524519";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/mk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/mk/firefox-154.0.1.tar.xz";
       locale = "mk";
       arch = "linux-aarch64";
-      sha256 = "3abd72612e58ecb5dfc810ba857792173d40bc8fff8a80f4fa7629886d5ff917";
+      sha256 = "3bc568b473179443bc0df45913ee256c24fd00670f37d7804fda0190f3446f6c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/mr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/mr/firefox-154.0.1.tar.xz";
       locale = "mr";
       arch = "linux-aarch64";
-      sha256 = "b3f8e8838c5bfb707ca46b02f1d8e4815ddfb93688fc41f5e326c6318c60d3ec";
+      sha256 = "16469180d177862bae490cd6c172b955d951703c6bf265084c5ed2dc8d665ace";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ms/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ms/firefox-154.0.1.tar.xz";
       locale = "ms";
       arch = "linux-aarch64";
-      sha256 = "648973d95243a7be29983ec656ceb125279ebac643393d2755151f0888e04669";
+      sha256 = "aefb7b3a02b4975795202f5fbd75a7ecad2fe4b638a8161ddaa744e038976bbf";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/my/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/my/firefox-154.0.1.tar.xz";
       locale = "my";
       arch = "linux-aarch64";
-      sha256 = "f8172867d11119abf3d91c835650c2bdc7ba59687faf9a1d00befad3caa76111";
+      sha256 = "acf89b9116b29fd37882a3ac35446434a9bda058bae9b907fe2a8476d0f9d630";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/nb-NO/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/nb-NO/firefox-154.0.1.tar.xz";
       locale = "nb-NO";
       arch = "linux-aarch64";
-      sha256 = "e7fcaf18437119bb4e6c3d1588059b6596296315024ebaa2286bc26e5f57bcc2";
+      sha256 = "7c0b7ec35bf1189cbef9e462996f8db38fb684d15de3124c278edef62900ce47";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ne-NP/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ne-NP/firefox-154.0.1.tar.xz";
       locale = "ne-NP";
       arch = "linux-aarch64";
-      sha256 = "3f136b43e9203af8c2bd9aec9a73835e88aafdaf5432c3b8a79c48d4eca474b0";
+      sha256 = "76bd7dcc19d0e3d48946834ff753eec20ce2ddfbf07dcddd001731ed5c3a8bdd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/nl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/nl/firefox-154.0.1.tar.xz";
       locale = "nl";
       arch = "linux-aarch64";
-      sha256 = "12b04da36550c9ee3bdf4d32c13daffbdaa335801d11124bf692d9a10bd3c048";
+      sha256 = "3a7800211c77033d61062d109d5c16080cd7d6876ba383cfd4169fdaeed30d55";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/nn-NO/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/nn-NO/firefox-154.0.1.tar.xz";
       locale = "nn-NO";
       arch = "linux-aarch64";
-      sha256 = "79ff432c9b4485f6e8d8c44723f2f303a0e7f64df8dfdbb4c9663466d34e86cb";
+      sha256 = "38c114d851b51b94dd3d0f24304efee38b0f6ef2f29cb542f769e107ae9f9ba0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/oc/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/oc/firefox-154.0.1.tar.xz";
       locale = "oc";
       arch = "linux-aarch64";
-      sha256 = "c4b6f1cc0ba30c39fda8a2946159dd5185689f4940a3aad568d755f4d40c8ccd";
+      sha256 = "cd902822fa6e9e849548420d865aa666889054bb9e4a38893c713ac45da2357f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/pa-IN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/pa-IN/firefox-154.0.1.tar.xz";
       locale = "pa-IN";
       arch = "linux-aarch64";
-      sha256 = "4f52ceebd244879151713155da4ee5d7725d10bceeca352cf3f43523ed968a22";
+      sha256 = "ac37379e121054e7f79b46bad135ac29f17281eb09318331f1589e9d083b7017";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/pl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/pl/firefox-154.0.1.tar.xz";
       locale = "pl";
       arch = "linux-aarch64";
-      sha256 = "033151c22086c240907db71e9046163652fae862f4f9f091196abc60bab37aa1";
+      sha256 = "183ec3b3ef5de9784fb94ed8563ee9fa3b03599bb43f19331802d2aa6899219c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/pt-BR/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/pt-BR/firefox-154.0.1.tar.xz";
       locale = "pt-BR";
       arch = "linux-aarch64";
-      sha256 = "145f87e70e6690c21b2d60fbb27d1e48e194151bfe3b25661024ab6c995329d1";
+      sha256 = "f29fabd6dd1d66deb9c2f290d57bef0a864c8a2c5b723ea54b40b3f6952bb21c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/pt-PT/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/pt-PT/firefox-154.0.1.tar.xz";
       locale = "pt-PT";
       arch = "linux-aarch64";
-      sha256 = "fe68890ffaffcb0209aa825b9cd8b3d17c0111d1d5889f1c31cdcc9dd8c1d080";
+      sha256 = "828dc41763e63143d6ecbe79a1c45aff13f0e5098bb865b8489ee13fa7062f0a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/rm/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/rm/firefox-154.0.1.tar.xz";
       locale = "rm";
       arch = "linux-aarch64";
-      sha256 = "94971d8a41b0ef30081c64ae4557e16049f84ee9a782df7890414d1760f882ec";
+      sha256 = "c042be8c2b3bb3943db5756c7ba1bff58be8512fd6bd409392fd79748662d857";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ro/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ro/firefox-154.0.1.tar.xz";
       locale = "ro";
       arch = "linux-aarch64";
-      sha256 = "bb6dc3d17a16675e04411bb8dbc28b18bf4ff90b86d67e9f3afad3f57d87d2a4";
+      sha256 = "0f9f65365eccbfd93adae3673fb95a4816974d79307766285322fae8233910f1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ru/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ru/firefox-154.0.1.tar.xz";
       locale = "ru";
       arch = "linux-aarch64";
-      sha256 = "5f941d0a980bd71962df7eddd8f44d3801306503fa50c3c00e745c866e1a3417";
+      sha256 = "bccdfe811e259fac65e1ebb14cd8e841a406ca47cf62a43cd3826b6b77ac4361";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sat/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sat/firefox-154.0.1.tar.xz";
       locale = "sat";
       arch = "linux-aarch64";
-      sha256 = "16a7f9f1c742000b43883a900e4b61863639e21ebebe167a3cb09a1a65bf5e72";
+      sha256 = "e648cc7d406abe5da07a5215975d8791ff4f1f3ea071b95b952ecc407dfe98d4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sc/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sc/firefox-154.0.1.tar.xz";
       locale = "sc";
       arch = "linux-aarch64";
-      sha256 = "3bfcddef3d55d9ad4d5283251ecb92b9e25ff46c41605ca277bb2b5b4098448f";
+      sha256 = "c3336c48e8e67f31e53eae11b9a6706d8b5d44491655b2919dacb67fe88ea5f5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sco/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sco/firefox-154.0.1.tar.xz";
       locale = "sco";
       arch = "linux-aarch64";
-      sha256 = "59c639be7c1d86004d6d4d7c4762dd35f08b8cde87268c641dacd6fc875875f3";
+      sha256 = "b1982fa46ca0796b2e7e4b017f86a119f89ea506bfd918838e851a2d12c12f4c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/si/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/si/firefox-154.0.1.tar.xz";
       locale = "si";
       arch = "linux-aarch64";
-      sha256 = "ad655fc0a0d82be50ce331b88d514de0673eb1793bd5a1973b34ce29f9ef4384";
+      sha256 = "d8f81f8d34d46b91b116ae5bfbdbbadd20e1c885c4f449ac8700391f7952e94b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sk/firefox-154.0.1.tar.xz";
       locale = "sk";
       arch = "linux-aarch64";
-      sha256 = "df4c97cb7c1b76048da242397ceeb762ee52c92b68c25efe221b3b8e48a71272";
+      sha256 = "3659a304e33a906a4debbb82ea43c2594d9d0345e60617782de9a3564c888f3e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/skr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/skr/firefox-154.0.1.tar.xz";
       locale = "skr";
       arch = "linux-aarch64";
-      sha256 = "c47c6287ead0ed741cf58aa401ed7ce205817c293ba60fe6e236652edb3e6fc7";
+      sha256 = "3a9ffb62de94f0d3669908a607e259520e53a66def692d90778bda57609f8887";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sl/firefox-154.0.1.tar.xz";
       locale = "sl";
       arch = "linux-aarch64";
-      sha256 = "86d389df8132fd4a12eda1a721c05e0f86f8c8de1452bc7b05231cb5984a51dc";
+      sha256 = "31063908a97870189debd0602585bc249cba464e5f093e9824af143aa1494e67";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/son/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/son/firefox-154.0.1.tar.xz";
       locale = "son";
       arch = "linux-aarch64";
-      sha256 = "c9a51e0b07c397bdf64d911aa84b6f4e830ab84c5f3ed856c7c444dba3925d9f";
+      sha256 = "ebea857ba0d70219dc851065a94ec7b2374b592463a0fa694e27ced95da2fc6a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sq/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sq/firefox-154.0.1.tar.xz";
       locale = "sq";
       arch = "linux-aarch64";
-      sha256 = "ce76c0a5e25250403552d1c1247078808f129e7f41a3768d334376751871b2ee";
+      sha256 = "e49cb38c51d2f0f668d9cd0c71b32978b8661abc32517ba0bdd7e4641d9d9ce8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sr/firefox-154.0.1.tar.xz";
       locale = "sr";
       arch = "linux-aarch64";
-      sha256 = "3b6a5d7e82b98561fa1f701483950395ecb97a8d3a0d036316151a5867f6f790";
+      sha256 = "8f165b8e241c420ce2661357e62b7b3439e0f3d12930e4fb80418fcf4dfe97ab";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/sv-SE/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/sv-SE/firefox-154.0.1.tar.xz";
       locale = "sv-SE";
       arch = "linux-aarch64";
-      sha256 = "1ef95439d1a6f70905ef7ae87be7f377557bf8b15dc3d8427f393b5016251f0b";
+      sha256 = "4919f8d90a021fe66e895e969ae4bc810d3e5fcf43a2b385b69e905a76331e14";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/szl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/szl/firefox-154.0.1.tar.xz";
       locale = "szl";
       arch = "linux-aarch64";
-      sha256 = "e68bec80d20046c3122246160a1af69d5bba0142f178b472cafb8a4996215184";
+      sha256 = "c1f30e58fb6e8c0437284760895a3fc16d631a9f4a99c64d9bed1df2fdb38e56";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ta/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ta/firefox-154.0.1.tar.xz";
       locale = "ta";
       arch = "linux-aarch64";
-      sha256 = "fa1b7bcd5ddea43751cb5bdca3d789a3d31479864a2fdac126e6838d32845f10";
+      sha256 = "52f58dc0c5faed694eae2c59ed6075ef8c9daf8df16590b84cb9c6e83f807545";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/te/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/te/firefox-154.0.1.tar.xz";
       locale = "te";
       arch = "linux-aarch64";
-      sha256 = "042c8c402606188aa55101d6e3c403a83e7bd0e50e7d8d81f99be101b313986d";
+      sha256 = "b48d1e2f30c0e640d3b84644bb496734f1fa12bf4a18f6ab7c0dd1dfc7984402";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/tg/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/tg/firefox-154.0.1.tar.xz";
       locale = "tg";
       arch = "linux-aarch64";
-      sha256 = "98d154f0a8682f07fbf568f0a78c7fda5c8a3c2ba45013602185110b542d126f";
+      sha256 = "d7c8c30f5827cf4f042ed6e14bdc022b62e00b97fe43ad43bf9b0d74b97cb105";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/th/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/th/firefox-154.0.1.tar.xz";
       locale = "th";
       arch = "linux-aarch64";
-      sha256 = "e7495eb4b531852ef28aa7ee894392099e1ff436b098645d88dd426bac4ee7e9";
+      sha256 = "6266a72a039ed32102e86793cc02926d03b9e0ae53bfdfc54084a6a51237bcc4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/tl/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/tl/firefox-154.0.1.tar.xz";
       locale = "tl";
       arch = "linux-aarch64";
-      sha256 = "5d60dd0804cf274bdd814e706e727bc78ac31acd1a9c899682448ae7fcc71467";
+      sha256 = "6f51464b42ad1df318dfa1e7f6350d0dcceb5962a2f30c55cf27ec8fd0fb62b5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/tr/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/tr/firefox-154.0.1.tar.xz";
       locale = "tr";
       arch = "linux-aarch64";
-      sha256 = "017c50f493a595c448bbbe80dad0958332dce570e66aae47a2eafca3aaa2cf17";
+      sha256 = "159321b1c8925aa17d7d44cb646925a64754fc3ebba992fe5bc95594bb4a3cf1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/trs/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/trs/firefox-154.0.1.tar.xz";
       locale = "trs";
       arch = "linux-aarch64";
-      sha256 = "d43924f222323f47b90ae57edc3ab66c074930829ddc373256e4d98b750f774a";
+      sha256 = "28c20f09e707eda2db956f52eb9b56e57618215c0f8c60e2173044724d878aa0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/uk/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/uk/firefox-154.0.1.tar.xz";
       locale = "uk";
       arch = "linux-aarch64";
-      sha256 = "13832393c90e2f2ba679bf06c51b985f8c22bd0694cdd63161946c02eeeae0e8";
+      sha256 = "42c72c97c8450a141be191a078e88a73eeffd760ef56a37910b5ccf1e64f133e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/ur/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/ur/firefox-154.0.1.tar.xz";
       locale = "ur";
       arch = "linux-aarch64";
-      sha256 = "97c9b136e4f1e6742ec9bbc92d17f39bb002b4ae6b900e911a51feebbab55005";
+      sha256 = "3c2c40d826aeaa25f3301da828d2ebd94e643ec7fc0dc893623211d748e53321";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/uz/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/uz/firefox-154.0.1.tar.xz";
       locale = "uz";
       arch = "linux-aarch64";
-      sha256 = "45a8f3a6795f4c5619ddc349e2e705c6037cff4800704ff6e6cca6ea5a0d7bc3";
+      sha256 = "8c63234e1705447d626a761caf269404bf55e4d23aafd9a5999dea248ddb48ff";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/vi/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/vi/firefox-154.0.1.tar.xz";
       locale = "vi";
       arch = "linux-aarch64";
-      sha256 = "1201600730d7473f672431d574bb773d3da00f89d6e4f6df00bd4345979d0832";
+      sha256 = "fc9e410de7e78f90f5e22aa8ed446a1918559fb5492af7b40ca22c8b5cd9755f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/xh/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/xh/firefox-154.0.1.tar.xz";
       locale = "xh";
       arch = "linux-aarch64";
-      sha256 = "d158a9ac754d11f1d5cc7c8cbbc79d0c29bd9e54f800223adbdf2bc916e66602";
+      sha256 = "7d6d094177969b5305ef032b66c12da96be36f77ea3f1cba47e535f6ada5e387";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/zh-CN/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/zh-CN/firefox-154.0.1.tar.xz";
       locale = "zh-CN";
       arch = "linux-aarch64";
-      sha256 = "ffbc0243de33d1efa36f670688655be8e43d93f8e884fa8dee87a58416c02451";
+      sha256 = "cf72b35fba58c10232884982f26f6439a73d84d362ad2e58883a0c55107115ea";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/linux-aarch64/zh-TW/firefox-154.0.tar.xz";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/linux-aarch64/zh-TW/firefox-154.0.1.tar.xz";
       locale = "zh-TW";
       arch = "linux-aarch64";
-      sha256 = "0961c1663f8c29e209fafdef1cd82512b5a9d293d62d13be32713e465b979f74";
+      sha256 = "a8e04d55c8ba8001636fbfa50e20d30b683f5eec543731fb14dbb529c78b016c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ach/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ach/Firefox%20154.0.1.dmg";
       locale = "ach";
       arch = "mac";
-      sha256 = "acec4d73f5157270fb509ea9c3c4e605f0edc86ed3016102bcfc1d50072b4177";
+      sha256 = "f06ac38d1584185849663c01d37be843a392e354ae049bfd4787649972adb9a1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/af/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/af/Firefox%20154.0.1.dmg";
       locale = "af";
       arch = "mac";
-      sha256 = "71024d7feb97cab927d717164d4ae1942fbe0aff38cdff32b9456e6822f4e147";
+      sha256 = "84b0372daed5effe23816235e5d84a11f7523698b4f6cbed04bc04b5b41c4d10";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/an/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/an/Firefox%20154.0.1.dmg";
       locale = "an";
       arch = "mac";
-      sha256 = "67795753d14ad02b0880e213f1760cf9524ff09ef6306f91fa8783983fecd54b";
+      sha256 = "29c81ff08773147ef3569c8c5ce9a01bee4b9bda734e70699d4bd274be182210";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ar/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ar/Firefox%20154.0.1.dmg";
       locale = "ar";
       arch = "mac";
-      sha256 = "5b7f62cb0f63c2876ca7e8487b33f64cbdf43419e67f2b67e3a5d953cda1d034";
+      sha256 = "b5e2d5fd5d6b12d69caef76cb82c4b3b5f84c4b47642de71ff29b1b73c6ccdf3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ast/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ast/Firefox%20154.0.1.dmg";
       locale = "ast";
       arch = "mac";
-      sha256 = "c7a1dbf4e0a3863522315c456a1fb821fe35e4c9722413c0ba2eb359a8c31638";
+      sha256 = "33def2a0e11260558030cf69ff7874d01a288038e810369728330ffc3396af80";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/az/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/az/Firefox%20154.0.1.dmg";
       locale = "az";
       arch = "mac";
-      sha256 = "999a2b112bf621554bb1ddef11c30750d2d7509fc62ce5be541168f5ff656e3b";
+      sha256 = "873e97da13a1a835a58b292a73a6422efbb0d55a3ea4d96837d8c6474c783e07";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/be/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/be/Firefox%20154.0.1.dmg";
       locale = "be";
       arch = "mac";
-      sha256 = "f8b012052b062b1e584e62f7ab855138fbd3dc4374253d3938ee410356e416a0";
+      sha256 = "263b6aee735a66df62504f458bd527455b6bd558a6aff66c52a974c7fe9d883b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/bg/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/bg/Firefox%20154.0.1.dmg";
       locale = "bg";
       arch = "mac";
-      sha256 = "7993423d29c8d088737d4f7e9df69d6a46c44d461c1f9b2aa932a90dbb5ee66a";
+      sha256 = "a063beb1ebdf54de64a9e5e1f4a32000a59e3d2d28904daa5942b5236ceed6b8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/bn/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/bn/Firefox%20154.0.1.dmg";
       locale = "bn";
       arch = "mac";
-      sha256 = "31bf918c828b4c1a42bae2892cb03aab2bc8e784d4681f6013eb03ebf0905fef";
+      sha256 = "91e7e6c1ec44c46c2c9c888782fab2858a6ed58473b8cf467f212f88dac2a9ed";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/br/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/br/Firefox%20154.0.1.dmg";
       locale = "br";
       arch = "mac";
-      sha256 = "2dc69b9369d16a5b3e6a38ff0ad2e2b9b52a97879b4e6eb92d8912304bb9485a";
+      sha256 = "7aef117ffd6ae93a56b617088a8d65d4a70c80ec16d46f9d141be6782de26aa3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/bs/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/bs/Firefox%20154.0.1.dmg";
       locale = "bs";
       arch = "mac";
-      sha256 = "6dc939f5bf12e605115efe8c0f44b814ec190a59883bb2c09439db894d1e7a7e";
+      sha256 = "6d91cd9337b73667f0578d866ff889f44a65fcf12fd2aeeace3f8910b0d96056";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ca-valencia/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ca-valencia/Firefox%20154.0.1.dmg";
       locale = "ca-valencia";
       arch = "mac";
-      sha256 = "c8ce1598ac1963428cb0d141f09582dac880f25cb95c804b52621768adeea0a8";
+      sha256 = "75d2e1cfb821b8f28c0323d447bb07315e35c7d33e9440e408bde30ea918abb1";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ca/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ca/Firefox%20154.0.1.dmg";
       locale = "ca";
       arch = "mac";
-      sha256 = "b3a6e29c3a051d266853d4159e2ea2ab98d3037bcd305b5a7c39608e8332f305";
+      sha256 = "1cce50c6370dd6d3fa873d1a818721d3aaa9078df8151639801962486f955d52";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/cak/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/cak/Firefox%20154.0.1.dmg";
       locale = "cak";
       arch = "mac";
-      sha256 = "0c8a70aa1a7fb6d332815847bd723a46db4c8d4b307d36dddaaa7d236ac5478f";
+      sha256 = "a6a461e6810019125ce21d258fa185fdddf9068ef5d10d74820d8c7fa26771c5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/cs/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/cs/Firefox%20154.0.1.dmg";
       locale = "cs";
       arch = "mac";
-      sha256 = "43e990ca06646e6b6b0f7d39d51f036bba2a053ec3c84ec2fa0943ff377d6604";
+      sha256 = "bcca96bdd59baeeb6f74a057fbee9aa5c88b44347cd1c2a4c5d71ab404dee53e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/cy/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/cy/Firefox%20154.0.1.dmg";
       locale = "cy";
       arch = "mac";
-      sha256 = "613e850023999735743d4fe7356c52767be86b1a3bd0abcb91ce9351f320db3c";
+      sha256 = "19f6e2e6464b0cc9563b4457d41c714b5e134ad7e1e27461191c54a4dff97890";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/da/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/da/Firefox%20154.0.1.dmg";
       locale = "da";
       arch = "mac";
-      sha256 = "7b57b1432d5249350338effc0a35b9dc5f817eec42d1cf7957d08f7ef7d43e07";
+      sha256 = "e7df58b688bd03da0d5f77d45b214055a555cd5199483c443527510155f9b117";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/de/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/de/Firefox%20154.0.1.dmg";
       locale = "de";
       arch = "mac";
-      sha256 = "6b5604036e7ca343fa3077a407a850ec2b5533e0c33ff1d1e302e22a8fc61374";
+      sha256 = "70cfbd49a1cdbf75dd7f8657dd1713df5ff06b4911f9904e945210c4e76492de";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/dsb/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/dsb/Firefox%20154.0.1.dmg";
       locale = "dsb";
       arch = "mac";
-      sha256 = "302f401f9b665df6009200b76ed84193a5c8bc92aa0d0056bbc82d70533dcba8";
+      sha256 = "6d0bacdeaa340a31f9e284db84eaffb18f7167da39050c2a712f857fe772e347";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/el/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/el/Firefox%20154.0.1.dmg";
       locale = "el";
       arch = "mac";
-      sha256 = "e7af11122aef81640f52083c04cf1e3e56a88bc6fece031e292bc996ead6dd94";
+      sha256 = "c5d174aa403fb6a3dc86ac4427a0ce75de46b07cdbd06ac3ed5001329d0b2f15";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/en-CA/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/en-CA/Firefox%20154.0.1.dmg";
       locale = "en-CA";
       arch = "mac";
-      sha256 = "89289a3567c1392a369a5630b9e7faed76d4f954f5f2073cb672d724023add63";
+      sha256 = "ebf35f442797b25cebd060037bb6903883cd3349e2672948d5605757a830e108";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/en-GB/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/en-GB/Firefox%20154.0.1.dmg";
       locale = "en-GB";
       arch = "mac";
-      sha256 = "2906cebb19ac09585b230da127e152b49ff079c03c809de70570aa72d3a45321";
+      sha256 = "cd70e5dcf678ba8f9abc65f2546d94a4962a499ef2fba37a19d51d979f6573d7";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/en-US/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/en-US/Firefox%20154.0.1.dmg";
       locale = "en-US";
       arch = "mac";
-      sha256 = "b0295d3b77ec632a60282cf2b9770e1dada085879d00e43d8d23fddf5015e06a";
+      sha256 = "01d95a6652018bb3d1e0bfad13ed6775864a1f3390d224e713f7d6f8b98fd679";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/eo/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/eo/Firefox%20154.0.1.dmg";
       locale = "eo";
       arch = "mac";
-      sha256 = "d404034431d0afae6ad401364e54b6672c731ffdf08a716f2376885b2a75faf0";
+      sha256 = "35341e852cd99da146330fea079cedafdd1a794bb0c6fa7f04740b8798994981";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/es-AR/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/es-AR/Firefox%20154.0.1.dmg";
       locale = "es-AR";
       arch = "mac";
-      sha256 = "1b745c276fa6e03eb40dff057d527cd4ad574a6941897811142db531e133eb13";
+      sha256 = "20368ed5632c0b7d4dc037c36ae941f028e574cf93f6aece76e70848212c3d0c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/es-CL/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/es-CL/Firefox%20154.0.1.dmg";
       locale = "es-CL";
       arch = "mac";
-      sha256 = "8c80d681da61eedd2b7422f6956cd21e855fe97318641f96967c6f65bb7e7bc9";
+      sha256 = "e53dddc643e3da0d2e159b340541591cf24412b5025fdc184bc80a45409b0989";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/es-ES/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/es-ES/Firefox%20154.0.1.dmg";
       locale = "es-ES";
       arch = "mac";
-      sha256 = "98b9e5a870058f0ecd13287367f061cfa95513b68a3f623505ae240d23b6447e";
+      sha256 = "5a7c2536c8c52c9c2ac283fb02ef53ab9d7603ccb4339e8bfdec9d06b224516d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/es-MX/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/es-MX/Firefox%20154.0.1.dmg";
       locale = "es-MX";
       arch = "mac";
-      sha256 = "105deefb281c02a4c73d13e26e0c21884e1b73b28b7fe2a9cc5e1ab550992e75";
+      sha256 = "db2940c7dbf4e2f0746578669c0635ac7bbde9490e9bde63560f3ff28af30cdd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/et/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/et/Firefox%20154.0.1.dmg";
       locale = "et";
       arch = "mac";
-      sha256 = "e906af6351ce057eff9512a98a1b72cb04d7da6e28753190b69abd59b7a6ed91";
+      sha256 = "d957c0a3a32be383b694c1c44a50469ae96dc52360a22e20341f5456f2e33a19";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/eu/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/eu/Firefox%20154.0.1.dmg";
       locale = "eu";
       arch = "mac";
-      sha256 = "bcddaf2a700b776c9d2f03944f8aff8651dc71b63e971f9364585f1a17c5b7d0";
+      sha256 = "74577ca222b501c33504a1f964ae6eb4d18a132bf1c16453f35540192d888d2d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/fa/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/fa/Firefox%20154.0.1.dmg";
       locale = "fa";
       arch = "mac";
-      sha256 = "bdc19a054928852c532e9b78d466699504b5fe874e9f0ee176f1e31ca340e2df";
+      sha256 = "208b45e98f71b82f60f6a2eaf2fe98337ad45175e1b47aa6eb8c3b7191325d8a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ff/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ff/Firefox%20154.0.1.dmg";
       locale = "ff";
       arch = "mac";
-      sha256 = "673ba559601a6e18f5ef5d0fccc5f79cfa2e1c0324ecef4fe807e0469ea68a9f";
+      sha256 = "e50a19f1733a26eeb0018ba5d46235ded266a1294afcd9726a4b175a43c3b927";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/fi/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/fi/Firefox%20154.0.1.dmg";
       locale = "fi";
       arch = "mac";
-      sha256 = "04f8d2c9ea4616e01bd0114e231701714a3114ef9ede808fb581109c9abb57d6";
+      sha256 = "5b283c0eda34b22a46c9b48c94df001f0de4f55c15efccb37f4524d401b1c765";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/fr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/fr/Firefox%20154.0.1.dmg";
       locale = "fr";
       arch = "mac";
-      sha256 = "703b66a199f5cd1fe465fb9c38ffa1ebe713bc61849a5f2d2edd8c34e9a94558";
+      sha256 = "20ea7d4d57ef9b9fc8deb1c6695d5dd4a06cab9ede6526885ee4a257443d3570";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/fur/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/fur/Firefox%20154.0.1.dmg";
       locale = "fur";
       arch = "mac";
-      sha256 = "f4b7a9e6186b11eb4d01f66ae66d2e7a6c05f5f352e7d1bde44c6e37978ab9be";
+      sha256 = "c332abb2cce600290e122c2f2b235c7581d4ec6d5299c80f48a4687ea455b357";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/fy-NL/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/fy-NL/Firefox%20154.0.1.dmg";
       locale = "fy-NL";
       arch = "mac";
-      sha256 = "6a97ab106a5defeb09c31761a0de056616c51d3de4aedaadc755bfb443340a9f";
+      sha256 = "7d5b902b2b97d24ae167332feaf84327a3ae3274b1a529e1d090bd0acda652ab";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ga-IE/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ga-IE/Firefox%20154.0.1.dmg";
       locale = "ga-IE";
       arch = "mac";
-      sha256 = "e62f8cfbffb7fda1dc460583d456ce8fbae5bf132268f3e13f1ad79a321b659d";
+      sha256 = "138ce35e60240c2fc36e9171e881f07f444f95003eb8d0192c5514171c654d94";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/gd/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/gd/Firefox%20154.0.1.dmg";
       locale = "gd";
       arch = "mac";
-      sha256 = "1d59cd8437aa0706b636ce62a592734796b004fa56169dd7c850c6ffca543829";
+      sha256 = "da8274e963516289239837ef2ed38a7d7f1f3a42cef18282e289f6328d839a05";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/gl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/gl/Firefox%20154.0.1.dmg";
       locale = "gl";
       arch = "mac";
-      sha256 = "ceba9c145611ea04a87730fde9c60535a62bbe7b913065b9621e2fd8f833d072";
+      sha256 = "f400382e2653f0e5a9a31f636432071bfe8ebfef01ea942c8c4a2be9f42262b8";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/gn/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/gn/Firefox%20154.0.1.dmg";
       locale = "gn";
       arch = "mac";
-      sha256 = "782b4dfcc1cd1c1a485858a906ae6f7c10624347fbbf521a45d34b8c29723b79";
+      sha256 = "1e5b123c249a3481aebb9bc06e09bea212bd25668cdb9b3c30fb00448dd2c935";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/gu-IN/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/gu-IN/Firefox%20154.0.1.dmg";
       locale = "gu-IN";
       arch = "mac";
-      sha256 = "98dad2fc3a85c609e62dc44b0f03d64ad9a207a869eea56644be80b2183071f1";
+      sha256 = "fa88a19d17cfe89cb5d9a1e070e53922f619b085869c469a63b2a016ca160171";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/he/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/he/Firefox%20154.0.1.dmg";
       locale = "he";
       arch = "mac";
-      sha256 = "1243457f155e4e42ff871fe9b4cfc8debbd387cab7032cba402925d25b41d650";
+      sha256 = "5e1f680a0b6ce42a165d9de00ce226415b246f6fda0f7f9dfeb4691c498704c2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/hi-IN/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/hi-IN/Firefox%20154.0.1.dmg";
       locale = "hi-IN";
       arch = "mac";
-      sha256 = "6ab4190ff05c61f9b6f717627ee286aecd47acb352dee0173835d08a8df5629b";
+      sha256 = "a628cee20142f9f3c5c74fc9ebdafe192bc8fb0823d778a27abff74685820e6e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/hr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/hr/Firefox%20154.0.1.dmg";
       locale = "hr";
       arch = "mac";
-      sha256 = "f295f0eddad40101c06045a2014030184b10122f8ed2f820763586a1d6ce2864";
+      sha256 = "39fe2e41d13d73bd20cd634cad40adfd523ab3471c75a31effe05c50a21cf565";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/hsb/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/hsb/Firefox%20154.0.1.dmg";
       locale = "hsb";
       arch = "mac";
-      sha256 = "158f2548e2c862135b650d193b87c06e56f0eada77aeed662021da4f42eac0c5";
+      sha256 = "0a3bcaac2fd166923bc96d17145fa8399dd8b8f7bc009c52f1df09e05fd684db";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/hu/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/hu/Firefox%20154.0.1.dmg";
       locale = "hu";
       arch = "mac";
-      sha256 = "99e4a5710dabb3fff6a91947c382b972055dfcedc8c84c9bfbf621c170069b59";
+      sha256 = "a897bea193e98ed07411236d533a6bb377d60575992980a53ac6cfa60c40fba6";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/hy-AM/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/hy-AM/Firefox%20154.0.1.dmg";
       locale = "hy-AM";
       arch = "mac";
-      sha256 = "4cc2d77540604dc2c3c02f589e91ccdd238269f392bb900d400aa73cc72f9217";
+      sha256 = "60a1978945016af85d5fa5705fd69da098e80627176ba7fd02cc0de43f2713f0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ia/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ia/Firefox%20154.0.1.dmg";
       locale = "ia";
       arch = "mac";
-      sha256 = "e512681a38c635df0b1814f7d075ffc5afb1f9dafa4e8b2aa943e027613e3456";
+      sha256 = "c2e2161178596b4b056781d5cb077d494882c15106a85e4bd39bbc4e3352a031";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/id/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/id/Firefox%20154.0.1.dmg";
       locale = "id";
       arch = "mac";
-      sha256 = "d160404a204da163499d28aa3efcece84e55949886fd48db5a4ccef0c9149afc";
+      sha256 = "d1bddab3a82366687ff3bde873a60c41bf5d8a737ecb527822be9d0dd0a044dc";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/is/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/is/Firefox%20154.0.1.dmg";
       locale = "is";
       arch = "mac";
-      sha256 = "307b3a346cd9ac7424d2eac06ce1d20087db98d7b320a41d620f191c919a4f27";
+      sha256 = "835466ffbc88946bc7e540661725a19ed54afc4e978dcff2f9539601e764d681";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/it/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/it/Firefox%20154.0.1.dmg";
       locale = "it";
       arch = "mac";
-      sha256 = "f0a579ca2cc457391685446e684a850b5735a908b812a8f020c372cce8d29ab0";
+      sha256 = "8131abe54d2240670878a5c67bd4b5516738ee5e2df40523342f40e4374c6fff";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ja-JP-mac/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ja-JP-mac/Firefox%20154.0.1.dmg";
       locale = "ja-JP-mac";
       arch = "mac";
-      sha256 = "61015363122ea16df9d7ce2a53141ddad20fbb1b36fda27c14a2bbe0303d7256";
+      sha256 = "c75bc467cc66b036d29afbdac5667f31f4c889645e3f85f7293fac84a74f7011";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ka/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ka/Firefox%20154.0.1.dmg";
       locale = "ka";
       arch = "mac";
-      sha256 = "e4f43c099ffec021e01f74a2219e64df27b289ec52ae1c0d4552c58f7611f41c";
+      sha256 = "26a85a09892662633d107f1bdbbf3603c3e46306ab00b9f8632ba6a815a23aa0";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/kab/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/kab/Firefox%20154.0.1.dmg";
       locale = "kab";
       arch = "mac";
-      sha256 = "106d52e78e5b86dae85a043fb60806ae59501c099ddbac2c266860908c0cd8cf";
+      sha256 = "6c0150541668424e53485fd360d2e71aa2a5b206bf3bb4665c9c35ba5471328e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/kk/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/kk/Firefox%20154.0.1.dmg";
       locale = "kk";
       arch = "mac";
-      sha256 = "55fd92b30a51d5aa9b571d1c8177b897cef13f7975258251b4a6d6c41f2fefd8";
+      sha256 = "e8f3a404d07cd3f692315a1fcea0730af94d03347e2c495bdbea7071e2bea001";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/km/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/km/Firefox%20154.0.1.dmg";
       locale = "km";
       arch = "mac";
-      sha256 = "0d229d4613bc509de83ace539e11e86539b741dfdf4de92172df26f9d1f8d919";
+      sha256 = "9c30207a448ab083d590f25630289e26ea19e1235b3201e61ec1545ebb8cac1f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/kn/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/kn/Firefox%20154.0.1.dmg";
       locale = "kn";
       arch = "mac";
-      sha256 = "bec06ed3b0f0eb2f2db405d9284b781d5d0e88d126b23ecfaa211777b68ab1e5";
+      sha256 = "2701fa15c878006090f11315357fbca94d7fc382613842d498585028dee8937b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ko/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ko/Firefox%20154.0.1.dmg";
       locale = "ko";
       arch = "mac";
-      sha256 = "288d2bf51c4a6f7c2c32a286d41fb7fc07191b3f9949dbba7043e850596e2357";
+      sha256 = "306327b13160acbe5dd034dc75aac62ed65415dd3e82f1f06dd1c37d714515a3";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/lij/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/lij/Firefox%20154.0.1.dmg";
       locale = "lij";
       arch = "mac";
-      sha256 = "7b48fec1aa78acc600f5f61bcf0b97d11851f8583827db65275ac64b6f683a4a";
+      sha256 = "0c8a38c3aa6b54694d5034595fdefeb86ec0c82cafa1e3878a29081c0fdd8a2c";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/lt/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/lt/Firefox%20154.0.1.dmg";
       locale = "lt";
       arch = "mac";
-      sha256 = "ebf14db25268685ce43f430fd3d417aa9cb42f976440d914c7ecf24ac15c15c3";
+      sha256 = "6be388cf36c26e770ff718fbe92ccb7f489c906ef7e3e793d9ba4a80edea9e7d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/lv/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/lv/Firefox%20154.0.1.dmg";
       locale = "lv";
       arch = "mac";
-      sha256 = "d2e58e6788d8d4d69694b348be0c4fc70420d57cc83d9a6f5c862045af82e17a";
+      sha256 = "e794427502e5747eeb25edbcebe78d53296b0d4aac4f082dc2436c69c8b74309";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/mk/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/mk/Firefox%20154.0.1.dmg";
       locale = "mk";
       arch = "mac";
-      sha256 = "0eebe41306962074c778655e1a82ef249e12130f0ea7be100ec70b9760415f55";
+      sha256 = "32b85a92071a3aed56e6caf17cc5f2eb64573ecdeef4da848eacfaa5f4ab4c97";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/mr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/mr/Firefox%20154.0.1.dmg";
       locale = "mr";
       arch = "mac";
-      sha256 = "f1482cf455719ec7021e504f498795c746b48d55f5cdf4b5347769a886ffdee6";
+      sha256 = "040b0145395d0924b6ba300eacc414183bd1311756bee23e200180e4883ea05a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ms/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ms/Firefox%20154.0.1.dmg";
       locale = "ms";
       arch = "mac";
-      sha256 = "9d4ab0059554815f46310b0076b95e5c5819c652b8901a44381b9a37ad8a57a4";
+      sha256 = "df525f6142be37da81fe588b98cfc6fc70f2f6865a5ae6a6203b19094464c8fa";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/my/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/my/Firefox%20154.0.1.dmg";
       locale = "my";
       arch = "mac";
-      sha256 = "e03f45a748fd7aadb73db4d731ce2728d730e6bfe29b4ca32b2fb086e04cd8e8";
+      sha256 = "895ed8618e7c67ea87789db809a0c7712d0e661632b1429f6a2dc4c169770a6f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/nb-NO/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/nb-NO/Firefox%20154.0.1.dmg";
       locale = "nb-NO";
       arch = "mac";
-      sha256 = "9b58bd2583246afee6d664db813212a025d5fd11db1cd4501578a080c56a3316";
+      sha256 = "679d52a171460c6f3fa2f6650d771d76f32560ee9415d53e6e82e81657fb9cba";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ne-NP/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ne-NP/Firefox%20154.0.1.dmg";
       locale = "ne-NP";
       arch = "mac";
-      sha256 = "b0b24a0833dd77c923e945fb159a4e2d93c25e8e95cea6985c21c5d76c4439cd";
+      sha256 = "cfcbc0e797651aa63ff60c3dbd931c706deea78f97e4942f1d7d360239e5d7f5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/nl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/nl/Firefox%20154.0.1.dmg";
       locale = "nl";
       arch = "mac";
-      sha256 = "270e8b9a7209e401db9e5c6a31aeecfb7d780751dd51141eae0da1bd6a4f27c3";
+      sha256 = "40610084048d88af57975b97eb29eb709d700495690947f41119307b436dd84d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/nn-NO/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/nn-NO/Firefox%20154.0.1.dmg";
       locale = "nn-NO";
       arch = "mac";
-      sha256 = "217b548e3b3c21143036b1079b2ca4c2eab99764f85bdb0c9f85cc9d4fd35e70";
+      sha256 = "724d5c8a88280ec1bc2a444d4937fc999c90eeff14e58fa901eb3bbc0dee315b";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/oc/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/oc/Firefox%20154.0.1.dmg";
       locale = "oc";
       arch = "mac";
-      sha256 = "f442102201c2e78bb6ce675b89d8a009c2cc34f0a6094c81b17b20e6ffa094aa";
+      sha256 = "272cba1dff412f20e8771549ab3a889a0aef8aa069f474f27451fa19d8477c4d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/pa-IN/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/pa-IN/Firefox%20154.0.1.dmg";
       locale = "pa-IN";
       arch = "mac";
-      sha256 = "3a0b9231d3f9c4903fd44b00967c471f16783e4a2ece1bba1e657d253bacfdf7";
+      sha256 = "4e7ee45a7b753485a1cbbeaffaa12149e5eed0ee6bbfe714292205d900419edd";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/pl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/pl/Firefox%20154.0.1.dmg";
       locale = "pl";
       arch = "mac";
-      sha256 = "0ff7e06d57404483b30e12d634fe660e976293d709acc68621fc93c92d2ebe0d";
+      sha256 = "eb4606fe5472aa0ac452f52e0cad1dec65958d6b0e9e11e9ba983be8679886b5";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/pt-BR/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/pt-BR/Firefox%20154.0.1.dmg";
       locale = "pt-BR";
       arch = "mac";
-      sha256 = "fa635a610a2865d9b980c9eb17c1bf658c7bab8b2592c36da3f49f71d3a992a9";
+      sha256 = "7bdd8a74843d5034be226a9f0e2f7f4550c19a6a2120f156c77de6d7dfc7e346";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/pt-PT/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/pt-PT/Firefox%20154.0.1.dmg";
       locale = "pt-PT";
       arch = "mac";
-      sha256 = "e8da7857141089e7bd081a4f8de5f8b4e30207a56795115e392070a6532ca5dd";
+      sha256 = "223e628e3fc76da188b6c324a8e270fe90e39c8664c55083e52591607b78539f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/rm/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/rm/Firefox%20154.0.1.dmg";
       locale = "rm";
       arch = "mac";
-      sha256 = "346998cffc880bd7306f1218f9de90bdb4090a8875fec4b75f3b74d12821a0b3";
+      sha256 = "04377e24880319527413d81734ca17f8f65615a6dbb27e5702f2e1db084dd107";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ro/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ro/Firefox%20154.0.1.dmg";
       locale = "ro";
       arch = "mac";
-      sha256 = "f4e4282decf485251be9182541c6499f0bc9f5c7a869b61b75f5be4fd284aa46";
+      sha256 = "122d6f521dcd3002d6217d930ba994a545cd872c12ce057e22654d00b22b727f";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ru/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ru/Firefox%20154.0.1.dmg";
       locale = "ru";
       arch = "mac";
-      sha256 = "0c4cd169fa81f611f49b3887b567549be6c52abfa420625a3c3ed17734911799";
+      sha256 = "599d1f8decec332a3b2605521970e9ea1ef27b4de82c32760a06463dab8d2115";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sat/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sat/Firefox%20154.0.1.dmg";
       locale = "sat";
       arch = "mac";
-      sha256 = "8787802a89daa0db5a3723abad077651e603d9bd0541c52bf646599ee04bc72c";
+      sha256 = "c1096508426c6d3a34b24978120268b595ca5e70a22cdcac1ba32abb8714952e";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sc/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sc/Firefox%20154.0.1.dmg";
       locale = "sc";
       arch = "mac";
-      sha256 = "dd7fc4714c0890329e85b0a3e05b30dec01561f61b378ef13158562055ed03a1";
+      sha256 = "cdc862d707333f19c4834cb9a5ebde6d17c023a330790e875d3c97ddfe123bbe";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sco/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sco/Firefox%20154.0.1.dmg";
       locale = "sco";
       arch = "mac";
-      sha256 = "efac5870e5e9e8b4ce471364384445b612a141a143ffdb5890c57b4d5622aba9";
+      sha256 = "5b629086043ec6aa37d22e527ff034b535b1c390f4be549b5252945ce2674bd2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/si/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/si/Firefox%20154.0.1.dmg";
       locale = "si";
       arch = "mac";
-      sha256 = "a2c6973b2273b99ac8855fd06b5b498dce0befa0dcd55f6b80213567a7ca31e3";
+      sha256 = "25ae120fb39ea91f385eee75995de55879bc4d3ec3cc478fc3ec14aaec6a86fa";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sk/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sk/Firefox%20154.0.1.dmg";
       locale = "sk";
       arch = "mac";
-      sha256 = "5120a7d6ed22910d9a47fc4df7c3c3c9db58233e9bdbfda3ccb7e92e8e2ec21e";
+      sha256 = "833e8b129c4086abc9f0e844391a4d048ade4a1973eef7659e7b627b22aa6b4d";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/skr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/skr/Firefox%20154.0.1.dmg";
       locale = "skr";
       arch = "mac";
-      sha256 = "6b7c6d8bee92c448532cb63690b92747ecb86016410524f0fade47c7cdd78db4";
+      sha256 = "68c01848c3551eddef5765d32c8fc073a2624ee05db379bae20c95313557ec65";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sl/Firefox%20154.0.1.dmg";
       locale = "sl";
       arch = "mac";
-      sha256 = "2aadceea2181b67cb32212f018b9a2b71d8d6c00a413708d3a8e3fe2e70d4ea9";
+      sha256 = "68a5835bf9ec9946f7c755b47fe632591c8a39ee96cc1cb547f9f846414fc4c4";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/son/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/son/Firefox%20154.0.1.dmg";
       locale = "son";
       arch = "mac";
-      sha256 = "202935b82fcfad4bf3a3a576911c2e19704384a7885bcfa50fed708c9005279d";
+      sha256 = "0eda232501b16ed50e1042f81a130f41c78ecfe7f4f1e5ec10ce4701b083cb82";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sq/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sq/Firefox%20154.0.1.dmg";
       locale = "sq";
       arch = "mac";
-      sha256 = "f1047ee23eae8ae52f150123ff0113f49df8f45003c69f980d953790d6364f63";
+      sha256 = "dda4bf62d697a2d46c1b1e6c8e9bbd6a0d6be373a1a9deb7557dd66d663fc1a2";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sr/Firefox%20154.0.1.dmg";
       locale = "sr";
       arch = "mac";
-      sha256 = "42f149046451efe00b70c0b8f44838e5a362fd5cc711834a418d963472fc2361";
+      sha256 = "5a8c433ae15118c3876c0f4283ed6650d00a17c7143b5d6a730ed65abde73d69";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/sv-SE/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/sv-SE/Firefox%20154.0.1.dmg";
       locale = "sv-SE";
       arch = "mac";
-      sha256 = "974dd925a44442a4f3ce80faf744e2e49de81e706f7200929e17d02b285591b6";
+      sha256 = "3324c50077c4b356637bbf147d005d587016459668a551429c47b4a5a4f05b98";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/szl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/szl/Firefox%20154.0.1.dmg";
       locale = "szl";
       arch = "mac";
-      sha256 = "43f7b6db959f43ed334a70883871604c760bff77054583396c39fe3d62869a59";
+      sha256 = "fb88323ad28b777f4a50ea883f74ec6233585908e28b97f172f0f3c975370268";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ta/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ta/Firefox%20154.0.1.dmg";
       locale = "ta";
       arch = "mac";
-      sha256 = "c1c8c98ed3504f493fbe43d68dc2da13d45078804f9c4806c94bd782ee53d1e2";
+      sha256 = "22782a11c4c41c02fa26b1631b642c5c9dcdad5ebed32a3c82cd55903433239a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/te/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/te/Firefox%20154.0.1.dmg";
       locale = "te";
       arch = "mac";
-      sha256 = "f4ef40d51c55071c4307a40159cfac0ed407fe3ea510b81088f002dfb1677acb";
+      sha256 = "eb6d55a6531f3537215061bb714177084b90d7e73b40150649ef03166881fe04";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/tg/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/tg/Firefox%20154.0.1.dmg";
       locale = "tg";
       arch = "mac";
-      sha256 = "86513b7c21a9c4d80927b0da5ece77bc64556f21d6b911af6fc82e51a315856e";
+      sha256 = "1aa96e3c9051ebccecb71ab50b6e52274d4b848f4d8346c6f0949476b2537421";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/th/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/th/Firefox%20154.0.1.dmg";
       locale = "th";
       arch = "mac";
-      sha256 = "2c35394ca92b641c1792cd1436c6e4c8294f4013f3812406172c7218709b2806";
+      sha256 = "2aea80659fcf48e95a0b9d418ae05322c97aab792cda0c4931503d2a4e2ba421";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/tl/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/tl/Firefox%20154.0.1.dmg";
       locale = "tl";
       arch = "mac";
-      sha256 = "ec9e7d5f0abde902dc27f61a598184c573e40f93c09bf853ea5006d358eda91c";
+      sha256 = "5986856c931f9094edca1a835643be75409002edb74bfd3ababd5b98f6f60c49";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/tr/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/tr/Firefox%20154.0.1.dmg";
       locale = "tr";
       arch = "mac";
-      sha256 = "b29ef8c16f7ae03ec3bfdd98f818e3f99306087f458bb4f8b639b65c7c1f797d";
+      sha256 = "bd109949aea0eba6d23661559e311d58e9b3a921719363d93773b8ed0d85fc17";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/trs/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/trs/Firefox%20154.0.1.dmg";
       locale = "trs";
       arch = "mac";
-      sha256 = "7237eddde8f416fd12b65d0e89e589947c6c4a6b8e820892cd1907c4d02f5bd9";
+      sha256 = "9afc95428a7b11dd3afa169961f33d6f84f240772d3278f23ac957eee21e9f56";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/uk/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/uk/Firefox%20154.0.1.dmg";
       locale = "uk";
       arch = "mac";
-      sha256 = "962494f20f5be12a1849c29bb845739c77d81f556836dcbd25f7b5b93f52e3b5";
+      sha256 = "40ef11c4e840e176d4c79166238119fd49819ac044f8392f661fb45ce18c1e7a";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/ur/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/ur/Firefox%20154.0.1.dmg";
       locale = "ur";
       arch = "mac";
-      sha256 = "b797bf1f09ebe462a380198a693b13295529a50954697dec5a494a79853c1daf";
+      sha256 = "a14d5be4ca37884232ebddbbf0daa15efc6b24c5292bf2a3d69692e15ff1e029";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/uz/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/uz/Firefox%20154.0.1.dmg";
       locale = "uz";
       arch = "mac";
-      sha256 = "fdc19ff3422b5fa613f7167346751a1c25ce113c3c97fc25342d46c9440a595a";
+      sha256 = "ef1e18407a1a8171ba7696029dc3e89d9fdbfd3eb224bfee7e8aa5e421019900";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/vi/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/vi/Firefox%20154.0.1.dmg";
       locale = "vi";
       arch = "mac";
-      sha256 = "2ee4542168f06b2053a5dc0efea8881b336de735b49b81d284289d559231b2c7";
+      sha256 = "d1b7eb7ba0048d2d5f9b1f3ce4edf3d1a83893e699e61d419c899dbeb3e16396";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/xh/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/xh/Firefox%20154.0.1.dmg";
       locale = "xh";
       arch = "mac";
-      sha256 = "82bbc4cfcdc7beeb6698db288903982eb23a52622853eb8081ba158a7661a729";
+      sha256 = "92828aecb90f4ab1aa4ba479857a1b2227c362268b3c58b21712a130226e6b38";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/zh-CN/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/zh-CN/Firefox%20154.0.1.dmg";
       locale = "zh-CN";
       arch = "mac";
-      sha256 = "d51a4dd5583bf58a2e20ab6df46dbeb4aab7c046871a608157405627428b8622";
+      sha256 = "b003ef61cc82d152d52cc193e5bd56100ef0830cc965aecb785f11f85e39d061";
     }
     {
-      url = "https://archive.mozilla.org/pub/firefox/releases/154.0/mac/zh-TW/Firefox%20154.0.dmg";
+      url = "https://archive.mozilla.org/pub/firefox/releases/154.0.1/mac/zh-TW/Firefox%20154.0.1.dmg";
       locale = "zh-TW";
       arch = "mac";
-      sha256 = "2d6754c5a72238fcf18ef2ce2101b215e7427fa723abf03fb97a2a3610922ddf";
+      sha256 = "566b91ae10158cb8141be166da3deed608ed85d9f09b058388ed765c516e34a6";
     }
   ];
 }

From 04b31903731854f05e4dc0f49746ff11b44e102f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 25 Aug 2026 13:35:26 +0200
Subject: [PATCH 507/551] python3Packages.caido-schema-proxy: 0.58.0 -> 0.58.2

---
 .../development/python-modules/caido-schema-proxy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/caido-schema-proxy/default.nix b/pkgs/development/python-modules/caido-schema-proxy/default.nix
index 6e45c9d226d6..b1054f0e8891 100644
--- a/pkgs/development/python-modules/caido-schema-proxy/default.nix
+++ b/pkgs/development/python-modules/caido-schema-proxy/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "caido-schema-proxy";
-  version = "0.58.0";
+  version = "0.58.2";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "caido_schema_proxy";
     inherit (finalAttrs) version;
-    hash = "sha256-1vGmDivVqx3XN1CUR/XwgYTG/mwI6Zny0Nv8AKUpOa4=";
+    hash = "sha256-AABaSkaSDs4meoDxG4sbOd/jxGTmo+dodDdqzE9UvWk=";
   };
 
   build-system = [ hatchling ];

From a0e5a77fb0cc74b31cd9a3abead4dfbb3a3c1292 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 25 Aug 2026 13:42:48 +0200
Subject: [PATCH 508/551] gitcomet: move env variable into env

---
 pkgs/by-name/gi/gitcomet/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/gi/gitcomet/package.nix b/pkgs/by-name/gi/gitcomet/package.nix
index 484e0efc656b..656d9c6053e3 100644
--- a/pkgs/by-name/gi/gitcomet/package.nix
+++ b/pkgs/by-name/gi/gitcomet/package.nix
@@ -77,7 +77,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  GIT_PAGER = "cat";
+  env.GIT_PAGER = "cat";
   dontUseCargoParallelTests = true;
 
   postInstall = ''

From 2dbc888dc1f1a2cbed900b427d570994595e08db Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Tue, 25 Aug 2026 12:03:07 +0300
Subject: [PATCH 509/551] python3Packages.crontab: drop duplicate package

---
 .../python-modules/crontab/default.nix        | 46 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 48 deletions(-)
 delete mode 100644 pkgs/development/python-modules/crontab/default.nix

diff --git a/pkgs/development/python-modules/crontab/default.nix b/pkgs/development/python-modules/crontab/default.nix
deleted file mode 100644
index b73902e45ecf..000000000000
--- a/pkgs/development/python-modules/crontab/default.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  nix-update-script,
-  pytestCheckHook,
-  python-dateutil,
-  pytz,
-  setuptools,
-}:
-
-buildPythonPackage (finalAttrs: {
-  pname = "crontab";
-  version = "1.0.5";
-  pyproject = true;
-
-  __structuredAttrs = true;
-
-  src = fetchFromGitHub {
-    owner = "josiahcarlson";
-    repo = "parse-crontab";
-    tag = finalAttrs.version;
-    hash = "sha256-iZS4vkfp93BK5wp1S3qCg0bC7NcT7o5/nNMRI+SXTws=";
-  };
-
-  build-system = [ setuptools ];
-
-  dependencies = [
-    python-dateutil
-    pytz
-  ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  pythonImportsCheck = [ "crontab" ];
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Parse and use crontab schedules in Python";
-    homepage = "https://github.com/josiahcarlson/parse-crontab";
-    changelog = "https://github.com/josiahcarlson/parse-crontab/blob/${finalAttrs.src.rev}/changelog.txt";
-    license = lib.licenses.lgpl21Only;
-    maintainers = with lib.maintainers; [ fab ];
-  };
-})
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index b25dd07de114..5c0aebbe0614 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -172,6 +172,7 @@ mapAliases {
   CommonMark = throw "'CommonMark' has been renamed to/replaced by 'commonmark'"; # Converted to throw 2025-10-29
   ConfigArgParse = throw "'ConfigArgParse' has been renamed to/replaced by 'configargparse'"; # Converted to throw 2025-10-29
   configshell = throw "'configshell' has been renamed to/replaced by 'configshell-fb'"; # Converted to throw 2025-10-29
+  crontab = throw "'crontab' has been removed, migrate to either 'python-crontab' or 'parse-crontab'"; # Added 2026-08-25
   cx_Freeze = throw "'cx_Freeze' has been renamed to/replaced by 'cx-freeze'"; # Converted to throw 2025-10-29
   cx_oracle = throw "'cx_oracle' has been renamed to/replaced by 'cx-oracle'"; # Converted to throw 2025-10-29
   dalle-mini = throw "'dalle-mini' has been removed due to lack of upstream maintenance"; # added 2026-02-26
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 2f1e98da4130..1b7806b29ca1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3765,8 +3765,6 @@ self: super: with self; {
 
   cronsim = callPackage ../development/python-modules/cronsim { };
 
-  crontab = callPackage ../development/python-modules/crontab { };
-
   cross-web = callPackage ../development/python-modules/cross-web { };
 
   crossandra = callPackage ../development/python-modules/crossandra { };

From 8cc9acbe68461799da0a119ad5e490c32fff8b02 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 12:01:39 +0000
Subject: [PATCH 510/551] ocamlPackages.yamlx: 0.3.0 -> 0.5.0

---
 pkgs/development/ocaml-modules/yamlx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/yamlx/default.nix b/pkgs/development/ocaml-modules/yamlx/default.nix
index 15eb9a8ef564..3c77231f349f 100644
--- a/pkgs/development/ocaml-modules/yamlx/default.nix
+++ b/pkgs/development/ocaml-modules/yamlx/default.nix
@@ -8,11 +8,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "yamlx";
-  version = "0.3.0";
+  version = "0.5.0";
 
   src = fetchurl {
     url = "https://github.com/mjambon/yamlx/releases/download/${finalAttrs.version}/yamlx-${finalAttrs.version}.tbz";
-    hash = "sha256-9pGp4XSCjMEwsUqHtwoyLBKTUdPjmYccqaU3dLkgVzg=";
+    hash = "sha256-ejpFZY4G6m4/EPApN6GDwEfFC9qS8azWeJQspOCRhkA=";
   };
 
   propagatedBuildInputs = [ ppx_deriving ];

From aa7085a9c99412a199a46698efd864540f4aafa8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 12:11:47 +0000
Subject: [PATCH 511/551] openscadPackages.bosl2: 2.0.750 -> 2.0.751

---
 pkgs/development/openscad-packages/bosl2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/openscad-packages/bosl2/default.nix b/pkgs/development/openscad-packages/bosl2/default.nix
index 7d4786930144..e7061d6b15cc 100644
--- a/pkgs/development/openscad-packages/bosl2/default.nix
+++ b/pkgs/development/openscad-packages/bosl2/default.nix
@@ -9,7 +9,7 @@
 
 buildOpenSCADPackage (finalAttrs: {
   pname = "bosl2";
-  version = "2.0.750";
+  version = "2.0.751";
   libName = "BOSL2";
 
   installTargets = [ "*.scad" ];
@@ -18,7 +18,7 @@ buildOpenSCADPackage (finalAttrs: {
     owner = "BelfrySCAD";
     repo = "BOSL2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ErSJxw1hLlnyUQCXBChwBrN9kS6+l4KXYvu9bBO1m6w=";
+    hash = "sha256-WyTUmyCYcK/e+adYJysn0A2yVdYbcyGzN6ODJnIutMQ=";
   };
 
   passthru = {

From e114a2cd609678ef9d37327c3eec64b2c132f807 Mon Sep 17 00:00:00 2001
From: jj <jsjeges@gmail.com>
Date: Tue, 25 Aug 2026 22:12:08 +1000
Subject: [PATCH 512/551] emscripten: fix -fwasm-exceptions link failure with
 release LLVM

Nixpkgs builds emscripten with the generic llvmPackages release LLVM,
not the llvm-project main-branch commit that emsdk pins. Release LLVM
(<= 22.x) generates calls to _Unwind_CallPersonality in catch handlers.
Emscripten's bundled libunwind no longer defines _Unwind_CallPersonality:
llvm-project PR #209282 moved the helper into libc++abi under the name
__gxx_wasm_personality_v0. Restore the old entry point as a forwarder to
__gxx_wasm_personality_v0, so that -fwasm-exceptions links.

Assisted-by: Claude Code (Claude Fable 5)
---
 ...nwind-restore-Unwind_CallPersonality.patch | 31 +++++++++++++++++++
 .../compilers/emscripten/default.nix          |  3 ++
 2 files changed, 34 insertions(+)
 create mode 100644 pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch

diff --git a/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch b/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch
new file mode 100644
index 000000000000..1f8b62a319ed
--- /dev/null
+++ b/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch
@@ -0,0 +1,31 @@
+libunwind: restore _Unwind_CallPersonality for release-LLVM pairing
+
+Nixpkgs pairs the emscripten runtime with the generic llvmPackages release
+LLVM instead of the trunk commit emsdk pins (default.nix already patches
+EXPECTED_LLVM_VERSION accordingly). Release LLVM (<= 22.x) WasmEHPrepare
+still emits calls to _Unwind_CallPersonality in landing pads; emscripten's
+system libs dropped that entry point when the personality wrapper moved
+into libc++abi as __gxx_wasm_personality_v0 (called directly by trunk
+LLVM's codegen). Restore the old entry point as a forwarder so that
+-fwasm-exceptions links. Drop this when llvmPackages reaches an LLVM that
+calls the personality directly.
+
+--- a/system/lib/libunwind/src/Unwind-wasm.c
++++ b/system/lib/libunwind/src/Unwind-wasm.c
+@@ -80,4 +80,16 @@
+   return 0;
+ }
+ 
++/// Restored from LLVM <= 22.x libunwind: release LLVM's WasmEHPrepare emits
++/// calls to _Unwind_CallPersonality in landing pads, while emscripten's pinned
++/// (trunk) LLVM calls the personality directly. The personality wrapper that
++/// used to live here moved into libc++abi as __gxx_wasm_personality_v0, so
++/// forward to it. Needed when pairing this runtime with a release LLVM.
++_Unwind_Reason_Code __gxx_wasm_personality_v0(void *exception_ptr);
++
++_LIBUNWIND_EXPORT _Unwind_Reason_Code
++_Unwind_CallPersonality(void *exception_ptr) {
++  return __gxx_wasm_personality_v0(exception_ptr);
++}
++
+ #endif // defined(__WASM_EXCEPTIONS__)
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index cf4576b9402f..f2868700a3cc 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -69,6 +69,9 @@ stdenv.mkDerivation rec {
     (replaceVars ./0001-emulate-clang-sysroot-include-logic.patch {
       resourceDir = "${llvmEnv}/lib/clang/${lib.versions.major llvmPackages.llvm.version}/";
     })
+    # Release LLVM still emits _Unwind_CallPersonality, which emscripten's
+    # system libs dropped; without this, -fwasm-exceptions fails to link.
+    ./0002-libunwind-restore-Unwind_CallPersonality.patch
   ];
 
   buildPhase = ''

From 0c38c2833a5d08347343122a855af3e3f3749d9d Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Tue, 25 Aug 2026 19:35:20 +0700
Subject: [PATCH 513/551] tcptrack: fix invalid unstable version scheme

As part of https://github.com/NixOS/nixpkgs/issues/541820
---
 pkgs/by-name/tc/tcptrack/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/tc/tcptrack/package.nix b/pkgs/by-name/tc/tcptrack/package.nix
index e50ff6c60c5f..c48e4c494b87 100644
--- a/pkgs/by-name/tc/tcptrack/package.nix
+++ b/pkgs/by-name/tc/tcptrack/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tcptrack";
-  version = "unstable-2017-04-29";
+  version = "1.4.3-unstable-2017-04-29";
 
   src = fetchFromGitHub {
     owner = "bchretien";

From e5992792a0c312f9d0ffa584dd795f976b946d40 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Tue, 25 Aug 2026 19:35:20 +0700
Subject: [PATCH 514/551] tamgamp-lv2: fix invalid unstable version scheme

As part of https://github.com/NixOS/nixpkgs/issues/541820
---
 pkgs/by-name/ta/tamgamp-lv2/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ta/tamgamp-lv2/package.nix b/pkgs/by-name/ta/tamgamp-lv2/package.nix
index 9afcf0dd810b..341507d50a51 100644
--- a/pkgs/by-name/ta/tamgamp-lv2/package.nix
+++ b/pkgs/by-name/ta/tamgamp-lv2/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation {
   pname = "tamgamp.lv2";
-  version = "unstable-2020-06-14";
+  version = "0-unstable-2020-06-14";
 
   src = fetchFromGitHub {
     owner = "sadko4u";

From 1853467aa861ae6d1bb948f0de5fb03851fcb3d0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 12:41:44 +0000
Subject: [PATCH 515/551] krep: 3.0.0 -> 3.0.1

---
 pkgs/by-name/kr/krep/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/kr/krep/package.nix b/pkgs/by-name/kr/krep/package.nix
index 502fc932bd7b..c65892a04640 100644
--- a/pkgs/by-name/kr/krep/package.nix
+++ b/pkgs/by-name/kr/krep/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "krep";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "davidesantangelo";
     repo = "krep";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lLlgsIFU37m+C1pqLYH+7n9Ye6jrpSdSJQYyTISId54=";
+    hash = "sha256-w37k/A6fBJUCqI9gg126NvWxur16Bs4roBe+cgTNy8M=";
   };
 
   makeFlags = [

From a6aec26355345f6a9fca624e2820937544234c16 Mon Sep 17 00:00:00 2001
From: jj <jsjeges@gmail.com>
Date: Tue, 25 Aug 2026 22:52:59 +1000
Subject: [PATCH 516/551] emscripten: trim the compat-patch comments to the
 essentials

Also regenerate the hunk against the 6.0.8 sources so it applies at the
recorded offsets.

Assisted-by: Claude Code (Claude Fable 5)
---
 .../0002-libunwind-restore-Unwind_CallPersonality.patch  | 9 +++------
 pkgs/development/compilers/emscripten/default.nix        | 3 +--
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch b/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch
index 1f8b62a319ed..567ba7fa445e 100644
--- a/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch
+++ b/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch
@@ -12,15 +12,12 @@ calls the personality directly.
 
 --- a/system/lib/libunwind/src/Unwind-wasm.c
 +++ b/system/lib/libunwind/src/Unwind-wasm.c
-@@ -80,4 +80,16 @@
+@@ -95,4 +95,13 @@
    return 0;
  }
  
-+/// Restored from LLVM <= 22.x libunwind: release LLVM's WasmEHPrepare emits
-+/// calls to _Unwind_CallPersonality in landing pads, while emscripten's pinned
-+/// (trunk) LLVM calls the personality directly. The personality wrapper that
-+/// used to live here moved into libc++abi as __gxx_wasm_personality_v0, so
-+/// forward to it. Needed when pairing this runtime with a release LLVM.
++/// Release LLVM (<= 22.x) still emits calls to this helper; its body moved
++/// into libc++abi as __gxx_wasm_personality_v0 (llvm-project #209282).
 +_Unwind_Reason_Code __gxx_wasm_personality_v0(void *exception_ptr);
 +
 +_LIBUNWIND_EXPORT _Unwind_Reason_Code
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index f2868700a3cc..43321a03ec66 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -69,8 +69,7 @@ stdenv.mkDerivation rec {
     (replaceVars ./0001-emulate-clang-sysroot-include-logic.patch {
       resourceDir = "${llvmEnv}/lib/clang/${lib.versions.major llvmPackages.llvm.version}/";
     })
-    # Release LLVM still emits _Unwind_CallPersonality, which emscripten's
-    # system libs dropped; without this, -fwasm-exceptions fails to link.
+    # Readd the entry point release LLVM emits; without it, -fwasm-exceptions fails to link.
     ./0002-libunwind-restore-Unwind_CallPersonality.patch
   ];
 

From e7a83d693e11a31e1daac06162e029694265a864 Mon Sep 17 00:00:00 2001
From: jj <jsjeges@gmail.com>
Date: Tue, 25 Aug 2026 22:57:32 +1000
Subject: [PATCH 517/551] emscripten: cut the patch comments to the header
 prose alone

Drop the default.nix comment and the C comment; shorten the patch
header.

Assisted-by: Claude Code (Claude Fable 5)
---
 ...nwind-restore-Unwind_CallPersonality.patch | 21 +++++++------------
 .../compilers/emscripten/default.nix          |  1 -
 2 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch b/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch
index 567ba7fa445e..407f9573f670 100644
--- a/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch
+++ b/pkgs/development/compilers/emscripten/0002-libunwind-restore-Unwind_CallPersonality.patch
@@ -1,23 +1,18 @@
-libunwind: restore _Unwind_CallPersonality for release-LLVM pairing
+libunwind: restore _Unwind_CallPersonality for release LLVM
 
-Nixpkgs pairs the emscripten runtime with the generic llvmPackages release
-LLVM instead of the trunk commit emsdk pins (default.nix already patches
-EXPECTED_LLVM_VERSION accordingly). Release LLVM (<= 22.x) WasmEHPrepare
-still emits calls to _Unwind_CallPersonality in landing pads; emscripten's
-system libs dropped that entry point when the personality wrapper moved
-into libc++abi as __gxx_wasm_personality_v0 (called directly by trunk
-LLVM's codegen). Restore the old entry point as a forwarder so that
--fwasm-exceptions links. Drop this when llvmPackages reaches an LLVM that
-calls the personality directly.
+Nixpkgs builds emscripten with the release LLVM, not the llvm-project
+main commit that emsdk pins. Release LLVM (<= 22.x) emits calls to
+_Unwind_CallPersonality. llvm-project PR #209282 moved that helper into
+libc++abi, renamed to __gxx_wasm_personality_v0. Add the old name back
+as a forwarder to the new name. Remove this patch when llvmPackages
+reaches LLVM 23.
 
 --- a/system/lib/libunwind/src/Unwind-wasm.c
 +++ b/system/lib/libunwind/src/Unwind-wasm.c
-@@ -95,4 +95,13 @@
+@@ -95,4 +95,11 @@
    return 0;
  }
  
-+/// Release LLVM (<= 22.x) still emits calls to this helper; its body moved
-+/// into libc++abi as __gxx_wasm_personality_v0 (llvm-project #209282).
 +_Unwind_Reason_Code __gxx_wasm_personality_v0(void *exception_ptr);
 +
 +_LIBUNWIND_EXPORT _Unwind_Reason_Code
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index 43321a03ec66..54636b0a0fbb 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -69,7 +69,6 @@ stdenv.mkDerivation rec {
     (replaceVars ./0001-emulate-clang-sysroot-include-logic.patch {
       resourceDir = "${llvmEnv}/lib/clang/${lib.versions.major llvmPackages.llvm.version}/";
     })
-    # Readd the entry point release LLVM emits; without it, -fwasm-exceptions fails to link.
     ./0002-libunwind-restore-Unwind_CallPersonality.patch
   ];
 

From 6c17a0593637c5147bfd278c4ce083b1c715b576 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 25 Aug 2026 14:56:24 +0200
Subject: [PATCH 518/551] python3Packages.pbr: 7.0.3 -> 7.1.2

---
 pkgs/development/python-modules/pbr/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index 48b2fad0aa8e..a31a700e5c5d 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -4,24 +4,24 @@
   callPackage,
   distutils,
   fetchPypi,
-  setuptools_80,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pbr";
-  version = "7.0.3";
+  version = "7.1.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-tGAE7DClMkZyaD7ISK7Z6PxQCw0mHUCjIpwtK7/O3Ck=";
+    hash = "sha256-Rjm4fMkdDVhHG3vaHyi30ISbpD15NcTEgvPHT+9xmAQ=";
   };
 
-  build-system = [ setuptools_80 ];
+  build-system = [ setuptools ];
 
   dependencies = [
     distutils # for distutils.command in pbr/packaging.py
-    setuptools_80 # for pkg_resources
+    setuptools
   ];
 
   # check in passthru.tests.pytest to escape infinite recursion with fixtures

From 2da6b0b786f347e8aadddb7477a5580748d9b8e5 Mon Sep 17 00:00:00 2001
From: Eric Berquist <eric.berquist@gmail.com>
Date: Tue, 25 Aug 2026 09:10:32 -0400
Subject: [PATCH 519/551] python3Packages.monty: remove ci-only optional
 dependencies

---
 pkgs/development/python-modules/monty/default.nix | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/pkgs/development/python-modules/monty/default.nix b/pkgs/development/python-modules/monty/default.nix
index 1fc1a269a5d8..f5a43c1e12a1 100644
--- a/pkgs/development/python-modules/monty/default.nix
+++ b/pkgs/development/python-modules/monty/default.nix
@@ -16,24 +16,19 @@
   invoke,
   ipython,
   msgpack,
-  mypy,
   myst-parser,
   orjson,
   pandas,
   pint,
   pydantic,
   pymongo,
-  pytest,
-  pytest-cov,
   requests,
   roman-numerals,
-  ruff,
   sphinx,
   sphinx-markdown-builder,
   sphinx-rtd-theme,
   torch,
   tqdm,
-  uv,
 
   # tests
   pytestCheckHook,
@@ -63,14 +58,6 @@ buildPythonPackage rec {
   ];
 
   optional-dependencies = rec {
-    ci = [
-      mypy
-      pytest
-      pytest-cov
-      ruff
-      uv
-    ]
-    ++ optional;
     dev = [ ipython ];
     docs = [
       sphinx

From 5966a2c06bc97ebedc9632f70c4e649f60010948 Mon Sep 17 00:00:00 2001
From: Eric Berquist <eric.berquist@gmail.com>
Date: Tue, 25 Aug 2026 09:13:44 -0400
Subject: [PATCH 520/551] python3Packages.monty: use __structuredAttrs

---
 pkgs/development/python-modules/monty/default.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/monty/default.nix b/pkgs/development/python-modules/monty/default.nix
index f5a43c1e12a1..542e15cbbf1c 100644
--- a/pkgs/development/python-modules/monty/default.nix
+++ b/pkgs/development/python-modules/monty/default.nix
@@ -35,15 +35,16 @@
   pytest-benchmark,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "monty";
   version = "2026.7.16";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "materialyzeai";
     repo = "monty";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-x5FNw7E3rtrgCWVhMsBpnO+uwu+mB3ELNFdd33+uFds=";
   };
 
@@ -85,7 +86,7 @@ buildPythonPackage rec {
     pytestCheckHook
     pytest-benchmark
   ]
-  ++ optional-dependencies.optional;
+  ++ finalAttrs.passthru.optional-dependencies.optional;
 
   pythonImportsCheck = [ "monty" ];
 
@@ -97,11 +98,11 @@ buildPythonPackage rec {
       patterns such as singleton and cached_class, and many more.
     ";
     homepage = "https://github.com/materialyzeai/monty";
-    changelog = "https://github.com/materialyzeai/monty/releases/tag/${src.tag}";
+    changelog = "https://github.com/materialyzeai/monty/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       psyanticy
       berquist
     ];
   };
-}
+})

From 9b8845711b67c9ea6674afcf853692a09c5dd120 Mon Sep 17 00:00:00 2001
From: Ilan Joselevich <personal@ilanjoselevich.com>
Date: Tue, 25 Aug 2026 16:14:08 +0200
Subject: [PATCH 521/551] nixos: pkgs.systemd -> config.systemd.package

Using the config-defined systemd package is preferred for when you
override the global systemd package across the entire config.
---
 nixos/modules/image/repart.nix                              | 4 ++--
 nixos/modules/services/backup/borgbackup.nix                | 2 +-
 nixos/modules/services/backup/restic.nix                    | 2 +-
 nixos/modules/services/display-managers/dms-greeter.nix     | 2 +-
 .../services/hardware/nvidia-container-toolkit/default.nix  | 2 +-
 nixos/modules/services/home-automation/homebridge.nix       | 6 +++---
 nixos/modules/services/misc/blenderfarm.nix                 | 2 +-
 nixos/modules/services/misc/cfdyndns.nix                    | 2 +-
 nixos/modules/services/misc/duckdns.nix                     | 2 +-
 nixos/modules/services/monitoring/ups.nix                   | 4 ++--
 nixos/modules/services/networking/autossh-ng.nix            | 2 +-
 nixos/modules/services/networking/clatd.nix                 | 2 +-
 nixos/modules/services/networking/dhcpcd.nix                | 2 +-
 nixos/modules/services/security/pocket-id.nix               | 3 ++-
 nixos/modules/services/web-apps/librechat.nix               | 3 ++-
 nixos/modules/system/boot/clevis-luks-askpass.nix           | 2 +-
 nixos/modules/system/boot/systemd/journald-gateway.nix      | 2 +-
 nixos/modules/system/boot/systemd/journald-remote.nix       | 2 +-
 nixos/tests/appliance-repart-image.nix                      | 2 +-
 19 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/nixos/modules/image/repart.nix b/nixos/modules/image/repart.nix
index cfa90fd5f512..97b096fe9230 100644
--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@@ -58,7 +58,7 @@ let
           example = lib.literalExpression ''
             {
               "/EFI/BOOT/BOOTX64.EFI".source =
-                "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi";
+                "''${config.systemd.package}/lib/systemd/boot/efi/systemd-bootx64.efi";
 
               "/loader/entries/nixos.conf".source = systemdBootEntry;
             }
@@ -227,7 +227,7 @@ in
           "10-esp" = {
             contents = {
               "/EFI/BOOT/BOOTX64.EFI".source =
-                "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi";
+                "''${config.systemd.package}/lib/systemd/boot/efi/systemd-bootx64.efi";
             };
             repartConfig = {
               Type = "esp";
diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index 59581daeb721..5fe2694c513e 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -154,7 +154,7 @@ let
       script =
         "exec "
         + lib.optionalString cfg.inhibitsSleep ''
-          ${pkgs.systemd}/bin/systemd-inhibit \
+          ${config.systemd.package}/bin/systemd-inhibit \
               --who="borgbackup" \
               --what="sleep" \
               --why="Scheduled backup" \
diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix
index b7d6424fe424..8344fc84246a 100644
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@@ -392,7 +392,7 @@ in
       let
         extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
         inhibitCmd = lib.concatStringsSep " " [
-          "${pkgs.systemd}/bin/systemd-inhibit"
+          "${config.systemd.package}/bin/systemd-inhibit"
           "--mode='block'"
           "--who='restic'"
           "--what='sleep'"
diff --git a/nixos/modules/services/display-managers/dms-greeter.nix b/nixos/modules/services/display-managers/dms-greeter.nix
index 9814e5cdc25a..cb6a4126ff9c 100644
--- a/nixos/modules/services/display-managers/dms-greeter.nix
+++ b/nixos/modules/services/display-managers/dms-greeter.nix
@@ -291,7 +291,7 @@ in
         };
         initial_session = mkIf (cfgAutoLogin.enable && (cfgAutoLogin.user != null)) {
           inherit (cfgAutoLogin) user;
-          command = ''${getExe pkgs.bash} -lc "${pkgs.systemd}/bin/systemd-cat $(<${autoLoginCommand})"'';
+          command = ''${getExe pkgs.bash} -lc "${config.systemd.package}/bin/systemd-cat $(<${autoLoginCommand})"'';
         };
       };
     };
diff --git a/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix b/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
index 1a1365c5d420..c6c744ca8311 100644
--- a/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
@@ -332,7 +332,7 @@
           # devices needed here become available. This is terribly broken and
           # essentially no better than a random sleep(). See PR #452645 for
           # an attempt to fix this issue.
-          ExecStartPre = "-${lib.getExe' pkgs.systemd "udevadm"} settle --timeout=180";
+          ExecStartPre = "-${lib.getExe' config.systemd.package "udevadm"} settle --timeout=180";
           ExecStart =
             let
               script = pkgs.callPackage ./cdi-generate.nix {
diff --git a/nixos/modules/services/home-automation/homebridge.nix b/nixos/modules/services/home-automation/homebridge.nix
index 9f0d379c6514..21c3ea048bb9 100644
--- a/nixos/modules/services/home-automation/homebridge.nix
+++ b/nixos/modules/services/home-automation/homebridge.nix
@@ -405,17 +405,17 @@ in
         commands = [
           {
             # Ability to restart homebridge service
-            command = "${pkgs.systemd}/bin/systemctl restart homebridge";
+            command = "${config.systemd.package}/bin/systemctl restart homebridge";
             options = [ "NOPASSWD" ];
           }
           {
             # Ability to shutdown server
-            command = "${pkgs.systemd}/bin/shutdown -h now";
+            command = "${config.systemd.package}/bin/shutdown -h now";
             options = [ "NOPASSWD" ];
           }
           {
             # Ability to restart server
-            command = "${pkgs.systemd}/bin/shutdown -r now";
+            command = "${config.systemd.package}/bin/shutdown -r now";
             options = [ "NOPASSWD" ];
           }
         ];
diff --git a/nixos/modules/services/misc/blenderfarm.nix b/nixos/modules/services/misc/blenderfarm.nix
index b66cfa2b5be4..fac671613684 100644
--- a/nixos/modules/services/misc/blenderfarm.nix
+++ b/nixos/modules/services/misc/blenderfarm.nix
@@ -96,7 +96,7 @@ in
         ln -s ${lib.getExe cfg.blenderPackage} BlenderData/nix-blender-linux64/blender
       ''
       + lib.optionalString (cfg.basicSecurityPasswordFile != null) ''
-        BLENDFARM_PASSWORD=$(${pkgs.systemd}/bin/systemd-creds cat BLENDFARM_PASS_FILE)
+        BLENDFARM_PASSWORD=$(${config.systemd.package}/bin/systemd-creds cat BLENDFARM_PASS_FILE)
         sed -i "s/null/\"$BLENDFARM_PASSWORD\"/g" ServerSettings
       '';
       serviceConfig = {
diff --git a/nixos/modules/services/misc/cfdyndns.nix b/nixos/modules/services/misc/cfdyndns.nix
index bd870c2acdda..4c37a7218f78 100644
--- a/nixos/modules/services/misc/cfdyndns.nix
+++ b/nixos/modules/services/misc/cfdyndns.nix
@@ -78,7 +78,7 @@ in
           export CLOUDFLARE_EMAIL="${cfg.email}"
         ''}
         ${lib.optionalString (cfg.apiTokenFile != null) ''
-          export CLOUDFLARE_APITOKEN=$(${pkgs.systemd}/bin/systemd-creds cat CLOUDFLARE_APITOKEN_FILE)
+          export CLOUDFLARE_APITOKEN=$(${config.systemd.package}/bin/systemd-creds cat CLOUDFLARE_APITOKEN_FILE)
         ''}
         ${pkgs.cfdyndns}/bin/cfdyndns
       '';
diff --git a/nixos/modules/services/misc/duckdns.nix b/nixos/modules/services/misc/duckdns.nix
index 3a9b6fa3bd42..bf746595a093 100644
--- a/nixos/modules/services/misc/duckdns.nix
+++ b/nixos/modules/services/misc/duckdns.nix
@@ -96,7 +96,7 @@ in
       startAt = "*:0/5";
       path = [
         pkgs.gnused
-        pkgs.systemd
+        config.systemd.package
         pkgs.curl
         pkgs.gawk
         duckdns
diff --git a/nixos/modules/services/monitoring/ups.nix b/nixos/modules/services/monitoring/ups.nix
index 24d013c642e2..f82806b014eb 100644
--- a/nixos/modules/services/monitoring/ups.nix
+++ b/nixos/modules/services/monitoring/ups.nix
@@ -361,7 +361,7 @@ let
             MONITOR = <generated from config.power.ups.upsmon.monitor>
             NOTIFYCMD = "''${cfg.package}/bin/upssched";
             POWERDOWNFLAG = "/run/killpower";
-            SHUTDOWNCMD = "''${pkgs.systemd}/bin/shutdown now";
+            SHUTDOWNCMD = "''${config.systemd.package}/bin/shutdown now";
           }
         '';
         description = "Additional settings to add to `upsmon.conf`.";
@@ -398,7 +398,7 @@ let
         );
         NOTIFYCMD = lib.mkDefault "${cfg.package}/bin/upssched";
         POWERDOWNFLAG = lib.mkDefault "/run/killpower";
-        SHUTDOWNCMD = lib.mkDefault "${pkgs.systemd}/bin/shutdown now";
+        SHUTDOWNCMD = lib.mkDefault "${config.systemd.package}/bin/shutdown now";
       };
     };
   };
diff --git a/nixos/modules/services/networking/autossh-ng.nix b/nixos/modules/services/networking/autossh-ng.nix
index c7f4f52ebaab..2a9217cc2956 100644
--- a/nixos/modules/services/networking/autossh-ng.nix
+++ b/nixos/modules/services/networking/autossh-ng.nix
@@ -120,7 +120,7 @@ in
                   else
                     "-o \"UserKnownHostsFile=/dev/null\" -o \"StrictHostKeyChecking=no\"";
                 ready = pkgs.writers.writeBash "systemd-signal-ready" ''
-                  ${pkgs.systemd}/bin/systemd-notify --ready
+                  ${config.systemd.package}/bin/systemd-notify --ready
                 '';
               in
               ''
diff --git a/nixos/modules/services/networking/clatd.nix b/nixos/modules/services/networking/clatd.nix
index 573d77e71d71..29d433652a51 100644
--- a/nixos/modules/services/networking/clatd.nix
+++ b/nixos/modules/services/networking/clatd.nix
@@ -97,7 +97,7 @@ in
         source = pkgs.writeShellScript "restart-clatd" ''
           [ "$DEVICE_IFACE" = "${cfg.settings.clat-dev or "clat"}" ] && exit 0
           [ "$2" != "up" ] && [ "$2" != "down" ] && exit 0
-          ${pkgs.systemd}/bin/systemctl restart clatd.service
+          ${config.systemd.package}/bin/systemctl restart clatd.service
         '';
       }
     ];
diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index d2705d4fa2d9..614ee08b0c31 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -302,7 +302,7 @@ in
         ]
         ++ lib.optional cfg.setHostname (
           pkgs.writeShellScriptBin "hostname" ''
-            ${lib.getExe' pkgs.systemd "hostnamectl"} set-hostname --transient $1
+            ${lib.getExe' config.systemd.package "hostnamectl"} set-hostname --transient $1
           ''
         );
 
diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix
index 547b3df6db54..b86e982e25c1 100644
--- a/nixos/modules/services/security/pocket-id.nix
+++ b/nixos/modules/services/security/pocket-id.nix
@@ -31,7 +31,8 @@ let
   format = pkgs.formats.keyValue { };
   settingsFile = format.generate "pocket-id-env-vars" cfg.settings;
 
-  exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
+  exportCredentials =
+    n: _: ''export ${n}="$(${config.systemd.package}/bin/systemd-creds cat ${n}_FILE)"'';
   exportAllCredentials = vars: lib.concatStringsSep "\n" (lib.mapAttrsToList exportCredentials vars);
   getLoadCredentialList = lib.mapAttrsToList (n: v: "${n}_FILE:${v}") cfg.credentials;
 in
diff --git a/nixos/modules/services/web-apps/librechat.nix b/nixos/modules/services/web-apps/librechat.nix
index 87dbb08823c9..2612a68cb0fa 100644
--- a/nixos/modules/services/web-apps/librechat.nix
+++ b/nixos/modules/services/web-apps/librechat.nix
@@ -9,7 +9,8 @@ let
   meiliCfg = config.services.meilisearch;
   format = pkgs.formats.yaml { };
   configFile = format.generate "librechat.yaml" cfg.settings;
-  exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
+  exportCredentials =
+    n: _: ''export ${n}="$(${config.systemd.package}/bin/systemd-creds cat ${n}_FILE)"'';
   exportAllCredentials = vars: lib.concatStringsSep "\n" (lib.mapAttrsToList exportCredentials vars);
   getLoadCredentialList = lib.mapAttrsToList (n: v: "${n}_FILE:${v}") cfg.credentials;
 in
diff --git a/nixos/modules/system/boot/clevis-luks-askpass.nix b/nixos/modules/system/boot/clevis-luks-askpass.nix
index 1d9685ff889c..417daaf4499c 100644
--- a/nixos/modules/system/boot/clevis-luks-askpass.nix
+++ b/nixos/modules/system/boot/clevis-luks-askpass.nix
@@ -55,7 +55,7 @@ in
 
       storePaths = [
         cfg.package
-        "${pkgs.systemd}/lib/systemd/systemd-reply-password"
+        "${config.systemd.package}/lib/systemd/systemd-reply-password"
         "${pkgs.jose}/bin/jose"
         "${pkgs.curl}/bin/curl"
         "${pkgs.cryptsetup}/bin/cryptsetup"
diff --git a/nixos/modules/system/boot/systemd/journald-gateway.nix b/nixos/modules/system/boot/systemd/journald-gateway.nix
index 76a858e1b471..804b09b074bd 100644
--- a/nixos/modules/system/boot/systemd/journald-gateway.nix
+++ b/nixos/modules/system/boot/systemd/journald-gateway.nix
@@ -92,7 +92,7 @@ in
     systemd.services.systemd-journal-gatewayd.serviceConfig.ExecStart = [
       # Clear the default command line
       ""
-      "${pkgs.systemd}/lib/systemd/systemd-journal-gatewayd ${cliArgs}"
+      "${config.systemd.package}/lib/systemd/systemd-journal-gatewayd ${cliArgs}"
     ];
 
     systemd.sockets.systemd-journal-gatewayd = {
diff --git a/nixos/modules/system/boot/systemd/journald-remote.nix b/nixos/modules/system/boot/systemd/journald-remote.nix
index fbb444b6400b..b8ca73e34908 100644
--- a/nixos/modules/system/boot/systemd/journald-remote.nix
+++ b/nixos/modules/system/boot/systemd/journald-remote.nix
@@ -123,7 +123,7 @@ in
     systemd.services.systemd-journal-remote.serviceConfig.ExecStart = [
       # Clear the default command line
       ""
-      "${pkgs.systemd}/lib/systemd/systemd-journal-remote ${cliArgs}"
+      "${config.systemd.package}/lib/systemd/systemd-journal-remote ${cliArgs}"
     ];
 
     systemd.sockets.systemd-journal-remote = {
diff --git a/nixos/tests/appliance-repart-image.nix b/nixos/tests/appliance-repart-image.nix
index bba163b463e4..7422233828a3 100644
--- a/nixos/tests/appliance-repart-image.nix
+++ b/nixos/tests/appliance-repart-image.nix
@@ -57,7 +57,7 @@ in
               in
               {
                 "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source =
-                  "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
+                  "${config.systemd.package}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
 
                 "/EFI/Linux/${config.system.boot.loader.ukiFile}".source =
                   "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";

From aace436fe92bf41cd6c3c7e9e3f442dffb26748d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 14:25:01 +0000
Subject: [PATCH 522/551] python3Packages.pyintesishome: 2.2.0 -> 2.5.0

---
 pkgs/development/python-modules/pyintesishome/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyintesishome/default.nix b/pkgs/development/python-modules/pyintesishome/default.nix
index 07a7487b60b1..eef6b9489544 100644
--- a/pkgs/development/python-modules/pyintesishome/default.nix
+++ b/pkgs/development/python-modules/pyintesishome/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyintesishome";
-  version = "2.2.0";
+  version = "2.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jnimmo";
     repo = "pyIntesisHome";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eTOamGfZEkQixJ9x/3R4ZGeHiHq7fFpTDgR7BWGUGfA=";
+    hash = "sha256-ICwwvg7zJVdXP42W4ZtWEnztW3HthHZ0z3OEUoSfjqM=";
   };
 
   build-system = [ setuptools ];

From 1311a5e1ba692cd38ecb80d710be359e94519ff9 Mon Sep 17 00:00:00 2001
From: David McFarland <corngood@gmail.com>
Date: Tue, 25 Aug 2026 11:26:52 -0300
Subject: [PATCH 523/551] dotnet-hook: fix substitution of null runtime

Some packages explitly use `dotnet-runtime = null` when outputting
self-contained executables.  This results in the hook script containing:

  dotnetRuntime=@dotnetRuntime@
---
 pkgs/build-support/dotnet/build-dotnet-module/hook/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/dotnet/build-dotnet-module/hook/default.nix b/pkgs/build-support/dotnet/build-dotnet-module/hook/default.nix
index e1f7cd816719..58a89b855e70 100644
--- a/pkgs/build-support/dotnet/build-dotnet-module/hook/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hook/default.nix
@@ -9,7 +9,7 @@
 makeSetupHook {
   name = "dotnet-hook";
   substitutions = {
-    dotnetRuntime = dotnet-runtime;
+    dotnetRuntime = lib.defaultTo "" dotnet-runtime;
     wrapperPath = lib.makeBinPath [
       which
       coreutils

From 4091423c039eae7885432b6ae648d4dda42385a1 Mon Sep 17 00:00:00 2001
From: winston <hey@winston.sh>
Date: Tue, 25 Aug 2026 16:43:55 +0200
Subject: [PATCH 524/551] python3Packages.wasmtime: 47.0.1 -> 48.0.0

---
 pkgs/development/python-modules/wasmtime/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/wasmtime/default.nix b/pkgs/development/python-modules/wasmtime/default.nix
index 3cc70aebe1b4..5ce35598793e 100644
--- a/pkgs/development/python-modules/wasmtime/default.nix
+++ b/pkgs/development/python-modules/wasmtime/default.nix
@@ -18,14 +18,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "wasmtime";
-  version = "47.0.1";
+  version = "48.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasmtime-py";
     tag = finalAttrs.version;
-    hash = "sha256-EtozWiHv354jDu0pHAI2vnx1c53Ldq4WBhTSFPZICSs=";
+    hash = "sha256-OpA/LCCYAYNULiIqcXY070wjO5vNQ/ek35wDwgjoKj0=";
   };
 
   postPatch = ''

From d518eb3805a8435d2a6a4135bcce8fb10f7006bb Mon Sep 17 00:00:00 2001
From: winston <hey@winston.sh>
Date: Tue, 25 Aug 2026 16:44:15 +0200
Subject: [PATCH 525/551] python3Packages.itkwasm: 1.0b200 -> 1.0b201

---
 pkgs/development/python-modules/itkwasm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/itkwasm/default.nix b/pkgs/development/python-modules/itkwasm/default.nix
index 0bbf4042c69b..9322dace1811 100644
--- a/pkgs/development/python-modules/itkwasm/default.nix
+++ b/pkgs/development/python-modules/itkwasm/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "itkwasm";
-  version = "1.0b200";
+  version = "1.0b201";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-vhN4Nm5tuGDRYYZKFyC+mH+LxW4UXmVxZDzsQI48U4s=";
+    hash = "sha256-f1DRcDlGW0y8VwfIrCEWaUIhN3zrgsbWsK/SJRbtbqM=";
   };
 
   build-system = [ hatchling ];

From 3df4c1bf2ace34249cd9d27333723832181ee773 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 14:49:28 +0000
Subject: [PATCH 526/551] docker-sbx: 0.38.0 -> 0.39.0

---
 pkgs/by-name/do/docker-sbx/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/do/docker-sbx/package.nix b/pkgs/by-name/do/docker-sbx/package.nix
index a33f4afc7540..e08fe53b538a 100644
--- a/pkgs/by-name/do/docker-sbx/package.nix
+++ b/pkgs/by-name/do/docker-sbx/package.nix
@@ -15,9 +15,9 @@
 }:
 let
   hashes = {
-    "x86_64-linux" = "sha256-nrzqgx1NJw4lrhd3vxXiR1ar+/h5GtJylHVGgoOO0As=";
-    "aarch64-linux" = "sha256-BR/fg0n4pm20epkOEaMM0dLgE6xsjkLkjAcr/OwGodU=";
-    "aarch64-darwin" = "sha256-Fg0eq0R8IA4vVKIqZIkByoDuhVVyTsALYMK9qsPE6hw=";
+    "x86_64-linux" = "sha256-LsRbx5OMIML0Bv6MxyKUrVqVS9wEdgFIS4m/GhCDEdQ=";
+    "aarch64-linux" = "sha256-OcRwpfXgmRscI1iVLiqzKnsDCb+lesYra7xktGbQLBc=";
+    "aarch64-darwin" = "sha256-0S+gau7OKY2W2uBYEB8lZTd3CgDvRuZYR2Lg8nsGpaM=";
   };
   platformName = {
     "x86_64-linux" = "linux-amd64";
@@ -27,7 +27,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "docker-sbx";
-  version = "0.38.0";
+  version = "0.39.0";
   src =
     let
       throwPlat = throw "Unsupported platform ${stdenvNoCC.hostPlatform.system}";

From af285482643e6f80aafbb52820dce8bd1bd65d9a Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 25 Aug 2026 17:06:00 +0200
Subject: [PATCH 527/551] =?UTF-8?q?rocqPackages.math-classes:=20init=20at?=
 =?UTF-8?q?=209.2.0=20for=20Coq=20=E2=89=A5=209.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../rocq-modules/math-classes/default.nix     | 27 ++++++++-----------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/rocq-modules/math-classes/default.nix b/pkgs/development/rocq-modules/math-classes/default.nix
index 1d5b42eb7ef2..0c156dce69f0 100644
--- a/pkgs/development/rocq-modules/math-classes/default.nix
+++ b/pkgs/development/rocq-modules/math-classes/default.nix
@@ -11,24 +11,17 @@ mkCoqDerivation {
   pname = "math-classes";
   inherit version;
   defaultVersion =
+    let
+      case = case: out: { inherit case out; };
+    in
     with lib.versions;
     lib.switch coq.coq-version [
-      {
-        case = range "8.17" "8.20";
-        out = "8.19.0";
-      }
-      {
-        case = range "8.12" "8.18";
-        out = "8.18.0";
-      }
-      {
-        case = range "8.12" "8.17";
-        out = "8.17.0";
-      }
-      {
-        case = range "8.6" "8.16";
-        out = "8.15.0";
-      }
+      (case (range "9.0" "9.3") "9.2.0")
+      (case (range "9.0" "9.1") "9.0.0")
+      (case (range "8.17" "8.20") "8.19.0")
+      (case (range "8.12" "8.18") "8.18.0")
+      (case (range "8.12" "8.17") "8.17.0")
+      (case (range "8.6" "8.16") "8.15.0")
     ] null;
   release."8.12.0".hash = "sha256:14nd6a08zncrl5yg2gzk0xf4iinwq4hxnsgm4fyv07ydbkxfb425";
   release."8.13.0".hash = "sha256:1ln7ziivfbxzbdvlhbvyg3v30jgblncmwcsam6gg3d1zz6r7cbby";
@@ -36,6 +29,8 @@ mkCoqDerivation {
   release."8.17.0".hash = "sha256-WklL8pgYTd0l4TGt7h7tWj1qcFcXvoPn25+XKF1pIKA=";
   release."8.18.0".hash = "sha256-0WwPss8+Vr37zX616xeuS4TvtImtSbToFQkQostIjO8=";
   release."8.19.0".hash = "sha256-rsV96W9MPFi/DKsepNPm1QnC2DMemio+uALIgzVYw0w=";
+  release."9.0.0".hash = "sha256-b8GPb1MRg5ZLieDTaoozy6ju10FhVdb6/XhKmyac1V4=";
+  release."9.2.0".hash = "sha256-NdmZcaNg0AmJXRsB3reyxrOYOnj/ZHgv3kF9Bxw+Q3I=";
 
   mlPlugin = true; # uses coq-bignums.plugin
 

From 2c1ed27d2c578c3ee8ce7bd09a50c6665bfdb6fa Mon Sep 17 00:00:00 2001
From: Ryan Housand <rhousand@tryondirect.com>
Date: Wed, 29 Jul 2026 19:44:11 -0400
Subject: [PATCH 528/551] nixos/prometheus-exporters/yace: init

Assisted-by: Claude Code (Claude Opus 4.8)
---
 .../manual/release-notes/rl-2611.section.md   |  2 +
 .../monitoring/prometheus/exporters.nix       |  1 +
 .../monitoring/prometheus/exporters/yace.nix  | 59 +++++++++++++++++++
 nixos/tests/prometheus-exporters.nix          | 24 ++++++++
 4 files changed, 86 insertions(+)
 create mode 100644 nixos/modules/services/monitoring/prometheus/exporters/yace.nix

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 26306ef76d45..0b440c340f6b 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -110,6 +110,8 @@
 
 - [Rundeck](https://www.rundeck.com), Self-Service Operations [services.rundeck](#opt-services.rundeck.enable).
 
+- [yet-another-cloudwatch-exporter](https://github.com/prometheus-community/yet-another-cloudwatch-exporter), a Prometheus exporter for AWS CloudWatch metrics. Available as [services.prometheus.exporters.yace](#opt-services.prometheus.exporters.yace.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 530315264562..56944f51a308 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -135,6 +135,7 @@ let
         "varnish"
         "wireguard"
         "xray"
+        "yace"
         "zfs-siebenmann"
         "zfs"
       ]
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/yace.nix b/nixos/modules/services/monitoring/prometheus/exporters/yace.nix
new file mode 100644
index 000000000000..f35020a30ec1
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/yace.nix
@@ -0,0 +1,59 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.yace;
+  inherit (lib)
+    mkIf
+    mkOption
+    types
+    escapeShellArg
+    concatStringsSep
+    getExe
+    ;
+in
+{
+  port = 5000;
+  extraOpts = {
+    configFile = mkOption {
+      type = types.path;
+      description = ''
+        Path to the YACE configuration file, defining which CloudWatch
+        metrics to scrape. See
+        <https://github.com/prometheus-community/yet-another-cloudwatch-exporter#configuration>
+        for the format. AWS credentials are supplied separately via the
+        environment (see {option}`environmentFile`, an IMDS instance role,
+        or the usual `AWS_*` variables).
+      '';
+    };
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/yace.env";
+      description = ''
+        Path to an environment file, as defined in {manpage}`systemd.exec(5)`,
+        used to pass AWS credentials (e.g. `AWS_ACCESS_KEY_ID`,
+        `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`) to the exporter without exposing
+        them in the world-readable Nix store. Not needed on EC2 with an IMDS
+        instance role.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+      ExecStart = concatStringsSep " " (
+        [
+          (getExe pkgs.yet-another-cloudwatch-exporter)
+          "--config.file ${escapeShellArg cfg.configFile}"
+          "--listen-address ${cfg.listenAddress}:${toString cfg.port}"
+        ]
+        ++ cfg.extraFlags
+      );
+    };
+  };
+}
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 7a246ba5eb35..4f0a6999e6bc 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -2141,6 +2141,30 @@ let
         '';
       };
 
+    yace =
+      { pkgs, ... }:
+      {
+        exporterConfig = {
+          enable = true;
+          configFile = pkgs.writeText "yace-config.yml" ''
+            apiVersion: v1alpha1
+            sts-region: us-east-1
+            discovery:
+              jobs:
+                - type: AWS/EC2
+                  regions: [us-east-1]
+                  metrics:
+                    - name: CPUUtilization
+                      statistics: [Average]
+          '';
+        };
+        exporterTest = ''
+          wait_for_unit("prometheus-yace-exporter.service")
+          wait_for_open_port(5000)
+          succeed("curl -sSf http://localhost:5000/metrics")
+        '';
+      };
+
     zfs =
       { ... }:
       {

From b6c384d1b6fe566b1f85961d90f02998b97c8459 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 13:40:22 +0000
Subject: [PATCH 529/551] rerun: 0.36.2 -> 0.36.3

---
 pkgs/by-name/re/rerun/package.nix                          | 6 +++---
 pkgs/development/python-modules/rerun-notebook/default.nix | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/re/rerun/package.nix b/pkgs/by-name/re/rerun/package.nix
index 2a4decf21273..29fc17a3d361 100644
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -40,7 +40,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rerun";
-  version = "0.36.2";
+  version = "0.36.3";
 
   __structuredAttrs = true;
 
@@ -53,7 +53,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "rerun-io";
     repo = "rerun";
     tag = finalAttrs.version;
-    hash = "sha256-vGbR3rjqlIoQaho5rTLgeZDO0ZKfzZwPdA1OHU3/C3E=";
+    hash = "sha256-oJduGAL+fqnQKEWIcpgH/X8F0+sW3BTF9x0nBco4Do4=";
   };
 
   # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@@ -62,7 +62,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '"rerun_sdk/rerun_cli/rerun"' '"rerun_sdk/rerun"'
   '';
 
-  cargoHash = "sha256-oqlGsNb8j0thRAh+/2E95nGfhggQss89rvWvuvjNWUY=";
+  cargoHash = "sha256-8rNIf6Rl7MYo+nk1qxOdmY8BmTKvjBb47Hk6xBeMIVE=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/development/python-modules/rerun-notebook/default.nix b/pkgs/development/python-modules/rerun-notebook/default.nix
index f232157fae37..83cbf23c84a5 100644
--- a/pkgs/development/python-modules/rerun-notebook/default.nix
+++ b/pkgs/development/python-modules/rerun-notebook/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     inherit (finalAttrs) version;
     format = "wheel";
     python = "py2.py3";
-    hash = "sha256-t23UmPiWUxt2jVhMuOd90Wq9tDriZNr2hMlEjWn6o5w=";
+    hash = "sha256-QYOfTf2PCEjLA0YI6G/HDtA3UlUkhV5t7fCdw9QU584=";
   };
 
   pythonRelaxDeps = [

From 314c5cee74bb651f99de072944dfa44595175cbb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 15:10:56 +0000
Subject: [PATCH 530/551] cnspec: 13.35.2 -> 13.36.0

---
 pkgs/by-name/cn/cnspec/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index ffa12d69be85..ff805d2f7d9d 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -9,18 +9,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "cnspec";
-  version = "13.35.2";
+  version = "13.36.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-V3fVmIrrbTQhbOMFKmsUHkRADlcPadCi5zwr2WXwzAM=";
+    hash = "sha256-KDubdJ+OgXRxe2DX/8lDGITdl57ViZ8FPgrNNefKI3I=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-WA4O3WITS4QW/yVQ8qcpgvSir77iWG7wRmS5JKML2zw=";
+  vendorHash = "sha256-2YccHGxnVz/4sHAjmOSSJ+W3tAKVQOPTl0NchKycHjI=";
 
   subPackages = [ "apps/cnspec" ];
 

From 9ee9a414e40b792bc35d3710e0066473ec26fca4 Mon Sep 17 00:00:00 2001
From: Rine Amakawa <Misaka13514@gmail.com>
Date: Wed, 26 Aug 2026 00:28:15 +0900
Subject: [PATCH 531/551] metasploit: 6.5.1 -> 6.5.2

---
 pkgs/by-name/me/metasploit/Gemfile      |  2 +-
 pkgs/by-name/me/metasploit/Gemfile.lock | 35 ++++++++-------
 pkgs/by-name/me/metasploit/gemset.nix   | 58 ++++++++++++-------------
 pkgs/by-name/me/metasploit/package.nix  |  4 +-
 4 files changed, 49 insertions(+), 50 deletions(-)

diff --git a/pkgs/by-name/me/metasploit/Gemfile b/pkgs/by-name/me/metasploit/Gemfile
index 5620433b9bdf..90f816ff8b1d 100644
--- a/pkgs/by-name/me/metasploit/Gemfile
+++ b/pkgs/by-name/me/metasploit/Gemfile
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.5.1"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.5.2"
 
 gem "getoptlong"
 gem "syslog", "~> 0.3.0"
diff --git a/pkgs/by-name/me/metasploit/Gemfile.lock b/pkgs/by-name/me/metasploit/Gemfile.lock
index 7ba41155f307..448ae6185c4a 100644
--- a/pkgs/by-name/me/metasploit/Gemfile.lock
+++ b/pkgs/by-name/me/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 77223f289965af330765014a89fa0ceee5318255
-  ref: refs/tags/6.5.1
+  revision: 75120f414c183dcb05c5d99d04f2d62bf538555a
+  ref: refs/tags/6.5.2
   specs:
-    metasploit-framework (6.5.1)
+    metasploit-framework (6.5.2)
       aarch64
       abbrev
       actionpack (~> 8.0.5)
@@ -173,7 +173,7 @@ GEM
     arel-helpers (2.17.0)
       activerecord (>= 3.1.0)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1279.0)
+    aws-partitions (1.1281.0)
     aws-sdk-core (3.254.1)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
@@ -182,13 +182,13 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-ec2 (1.636.0)
+    aws-sdk-ec2 (1.638.0)
       aws-sdk-core (~> 3, >= 3.254.0)
       aws-sigv4 (~> 1.5)
     aws-sdk-ec2instanceconnect (1.74.0)
       aws-sdk-core (~> 3, >= 3.254.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-iam (1.151.0)
+    aws-sdk-iam (1.152.0)
       aws-sdk-core (~> 3, >= 3.254.0)
       aws-sigv4 (~> 1.5)
     aws-sdk-kms (1.130.0)
@@ -228,8 +228,8 @@ GEM
     domain_name (0.6.20240107)
     drb (2.2.3)
     ed25519 (1.4.0)
-    elftools (1.3.1)
-      bindata (~> 2)
+    elftools (2.0.0)
+      bindata (>= 2, < 4)
     em-http-request (1.1.7)
       addressable (>= 2.3.4)
       cookiejar (!= 0.3.1)
@@ -278,7 +278,7 @@ GEM
       mutex_m
     i18n (1.15.2)
       concurrent-ruby (~> 1.0)
-    io-console (0.9.1)
+    io-console (0.9.2)
     ipaddr (1.2.9)
     irb (1.18.0)
       pp (>= 0.6.0)
@@ -402,11 +402,10 @@ GEM
     parallel (2.1.0)
     patch_finder (1.0.2)
     pcaprub (0.13.3)
-    pdf-reader (2.15.1)
+    pdf-reader (2.16.0)
       Ascii85 (>= 1.0, < 3.0, != 2.0.0)
       afm (>= 0.2.1, < 2)
       hashery (~> 2.0)
-      ruby-rc4
       ttfunk
     pg (1.6.3)
     pp (0.6.4)
@@ -417,7 +416,7 @@ GEM
     puma (8.0.2)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (3.2.6)
+    rack (3.2.7)
     rack-protection (4.2.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)
@@ -449,7 +448,7 @@ GEM
     rasn1 (0.14.0)
       strptime (~> 0.2.5)
     rb-readline (0.5.5)
-    rbs (4.1.2)
+    rbs (4.2.0)
       logger
       prism (>= 1.6.0)
       tsort
@@ -458,7 +457,7 @@ GEM
       prism (>= 1.6.0)
       rbs (>= 4.0.0)
       tsort
-    recog (3.1.33)
+    recog (3.1.35)
       nokogiri
     redcarpet (3.6.1)
     reline (0.7.0)
@@ -470,7 +469,7 @@ GEM
       netrc (~> 0.8)
     rex-arch (0.1.20)
       rex-text
-    rex-bin_tools (0.1.16)
+    rex-bin_tools (0.1.17)
       metasm
       rex-arch
       rex-core
@@ -540,7 +539,7 @@ GEM
       windows_error (>= 0.1.4)
     rubyntlm (0.6.5)
       base64
-    rubyzip (3.4.1)
+    rubyzip (3.5.0)
     sawyer (0.9.3)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
@@ -553,7 +552,7 @@ GEM
       rack-protection (= 4.2.1)
       rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    sqlite3 (2.9.5)
+    sqlite3 (2.9.6)
       mini_portile2 (~> 2.8.0)
     sshkey (3.0.0)
     stringio (3.1.1)
@@ -567,7 +566,7 @@ GEM
       logger
       rack (>= 1, < 4)
     thor (1.5.0)
-    tilt (2.8.0)
+    tilt (2.9.0)
     timeout (0.6.1)
     tsort (0.2.0)
     ttfunk (1.7.0)
diff --git a/pkgs/by-name/me/metasploit/gemset.nix b/pkgs/by-name/me/metasploit/gemset.nix
index 02d1cf0651ec..fa951b8f2180 100644
--- a/pkgs/by-name/me/metasploit/gemset.nix
+++ b/pkgs/by-name/me/metasploit/gemset.nix
@@ -124,10 +124,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0dg4k9l1kb9xvagzag1ddqgsmaj0wrd6a9yzskjfzrd3pislzalv";
+      sha256 = "1v424xj0szmlki0g2zzd9f5i1yq8giccdn7w3q57kav8l3bcgz4p";
       type = "gem";
     };
-    version = "1.1279.0";
+    version = "1.1281.0";
   };
   aws-sdk-core = {
     groups = [ "default" ];
@@ -144,10 +144,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a0z35sz9h6qy8wfv6wn8ycaryb3x55fgl7sxxbbxsyqm135nm57";
+      sha256 = "00383p597x4n3dl9knmvpjxldv226hzrv9qaj5ry3a3yby9zz67a";
       type = "gem";
     };
-    version = "1.636.0";
+    version = "1.638.0";
   };
   aws-sdk-ec2instanceconnect = {
     groups = [ "default" ];
@@ -164,10 +164,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1wivpvs3wc4w1wkgm991xjig4chnnxjgxs92b27klzwyzkbfsbx7";
+      sha256 = "0n5ac3zpy96vqkzaai5496g39k73fa8lvkz6k0brv0j5bxj84nq9";
       type = "gem";
     };
-    version = "1.151.0";
+    version = "1.152.0";
   };
   aws-sdk-kms = {
     groups = [ "default" ];
@@ -424,10 +424,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1y5ahqk24ngjiyfbj5xapxwfb34yslcpn4l0khdq4pkxkajgqilx";
+      sha256 = "08698s15r50hkbk31bmhlvy99mrn5cf8l304rfhashzky1ccvwba";
       type = "gem";
     };
-    version = "1.3.1";
+    version = "2.0.0";
   };
   em-http-request = {
     groups = [ "default" ];
@@ -684,10 +684,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rnnj8nbvqcn55diifkmz82alix5ws5dgh18kpbxjd6rdrdddd9l";
+      sha256 = "026v93kja19bfslnwi9xfq2dj4r89kkwdprim4whjg6h3n4lz9zg";
       type = "gem";
     };
-    version = "0.9.1";
+    version = "0.9.2";
   };
   ipaddr = {
     groups = [ "default" ];
@@ -844,12 +844,12 @@
     platforms = [ ];
     source = {
       fetchSubmodules = false;
-      rev = "77223f289965af330765014a89fa0ceee5318255";
-      sha256 = "16bi5rp6mrl9c5yr88k4p9nrafyn8zxpvlxk07mwqxvwnr830wmq";
+      rev = "75120f414c183dcb05c5d99d04f2d62bf538555a";
+      sha256 = "06z8jqr6k51gdzc9gvsfbn2zhgslxrvycwvv4xhv897g9bzql5yp";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.5.1";
+    version = "6.5.2";
   };
   metasploit-model = {
     groups = [ "default" ];
@@ -1230,10 +1230,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kk8f1f5kkdwsbskv0vikcwx5xaivv19y9zl97x1fcaam23akihq";
+      sha256 = "0cipbx3ssgfsww7hrlll2j27b2vpcwaczqxxg614s9l5q1j5a6xz";
       type = "gem";
     };
-    version = "2.15.1";
+    version = "2.16.0";
   };
   pg = {
     groups = [ "default" ];
@@ -1310,10 +1310,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1hhjy9gcp52dzij05gmidqac8g28ski5xm67prwmdqmjfcgqxmsy";
+      sha256 = "1dwgab330lsv4qppw3f52mc4ihr8lagxgll53mkmcdgr4hf3xqck";
       type = "gem";
     };
-    version = "3.2.6";
+    version = "3.2.7";
   };
   rack-protection = {
     groups = [ "default" ];
@@ -1420,10 +1420,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0j4g0wj90kiirgck0li9vxx2yc2jf0n0z74jxlxj7w88npcb23h5";
+      sha256 = "0x067q8cdam4kv5dc09iq2nzca8qm2kdl0dr22gc0ny0vj3bixsi";
       type = "gem";
     };
-    version = "4.1.2";
+    version = "4.2.0";
   };
   rdoc = {
     groups = [ "default" ];
@@ -1440,10 +1440,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mxj6s3si6xl29wh5km53x0dnwq3sy0dpz308mdgh7vvafcc2xqf";
+      sha256 = "0jwgzwr6j1bcjcmjdk14j50yf58dqja7z3msn1w3bi0kzsh2j9qk";
       type = "gem";
     };
-    version = "3.1.33";
+    version = "3.1.35";
   };
   redcarpet = {
     groups = [ "default" ];
@@ -1490,10 +1490,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0b755sz6h9hn3f7qbx033h4j7pwx1r2ykyzqil8alpp8983li0h0";
+      sha256 = "0gpdvf8qqh0mm1c90vip1mpjgqrlgvaydyg5wbi3bl8dm3m1qghi";
       type = "gem";
     };
-    version = "0.1.16";
+    version = "0.1.17";
   };
   rex-core = {
     groups = [ "default" ];
@@ -1740,10 +1740,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "00nafgqjhwa504xrjv32v0757a2xcvspsia8s7mp4n62nm2yfy8a";
+      sha256 = "0z4d1wgn8868ll0zkjgii21cskhvydry8kfayribcjd86zbljz7p";
       type = "gem";
     };
-    version = "3.4.1";
+    version = "3.5.0";
   };
   sawyer = {
     groups = [ "default" ];
@@ -1790,10 +1790,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01i6k25fv3w3f5ph5cix9ipg19ajsy6zrzxdm18ashzrldrjjmq4";
+      sha256 = "13nh4kd96d28dv3habjv2fiap30ccb73lz8mqx5d0834jl3fcvwm";
       type = "gem";
     };
-    version = "2.9.5";
+    version = "2.9.6";
   };
   sshkey = {
     groups = [ "default" ];
@@ -1870,10 +1870,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "089pvsdyf8krrhzavqm1lq4yqf79valiklnn290y1qbgf6r2wixs";
+      sha256 = "19d3k8ym9bj9j98zmc0pbjnwqdg4mqabnh8hm7lrdfhb5383amys";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.9.0";
   };
   timeout = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/me/metasploit/package.nix b/pkgs/by-name/me/metasploit/package.nix
index 083b89bafc09..5352dcf589a8 100644
--- a/pkgs/by-name/me/metasploit/package.nix
+++ b/pkgs/by-name/me/metasploit/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "metasploit-framework";
-  version = "6.5.1";
+  version = "6.5.2";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     tag = finalAttrs.version;
-    hash = "sha256-uHIwULZ8d8zrAbPTfftH1juVbbpkIpR9YYnmam4ucZk=";
+    hash = "sha256-1xeK/0rvJLRhJ3tz5nfuVD/4hV1O75fYby+UaTKW6Bs=";
   };
 
   __structuredAttrs = true;

From 39e7198cd94cd60e0db6d278ed306d34450d3e31 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 15:28:23 +0000
Subject: [PATCH 532/551] python3Packages.pyswitchbot: 2.4.1 -> 2.6.0

---
 pkgs/development/python-modules/pyswitchbot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyswitchbot/default.nix b/pkgs/development/python-modules/pyswitchbot/default.nix
index b52999a0a550..577bf5306d1f 100644
--- a/pkgs/development/python-modules/pyswitchbot/default.nix
+++ b/pkgs/development/python-modules/pyswitchbot/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyswitchbot";
-  version = "2.4.1";
+  version = "2.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     tag = finalAttrs.version;
-    hash = "sha256-is/eLRiVzekX+kLy/CHps6Gw7jujCJJ0A9AWMTNUObs=";
+    hash = "sha256-dyk3eAMwKkTLotv1yLBai9vvATTU2jeiwvPs0uurNz4=";
   };
 
   build-system = [ poetry-core ];

From 24e681b679f4a3114939485b79a4e478e2aa464e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 15:42:43 +0000
Subject: [PATCH 533/551] terraform-providers.equinix_equinix: 5.1.0 -> 5.2.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index b7a282305d39..bcfa3f4a0bcf 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -382,13 +382,13 @@
     "vendorHash": "sha256-y9GRTuoh1X6GfGkGZbPpO500y8DoJS1dnwZL3BCTUcY="
   },
   "equinix_equinix": {
-    "hash": "sha256-HwPjxVWIqWxpdIElMgDmOUx7KXr5VEwLVNbTLeEgRRo=",
+    "hash": "sha256-gPuRvWQiJZdyUGTNMCQSEFmbqC5ralxroBSbBprFe/8=",
     "homepage": "https://registry.terraform.io/providers/equinix/equinix",
     "owner": "equinix",
     "repo": "terraform-provider-equinix",
-    "rev": "v5.1.0",
+    "rev": "v5.2.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-8v7+xVF/X9q7VmjQD4azGIggWpgPGuoNSWetsbKN7LA="
+    "vendorHash": "sha256-JnbQPQi/dy3pEwurlzIcfBdbAfvYJVsoLYnvJPX3sjc="
   },
   "exoscale_exoscale": {
     "hash": "sha256-QIYIqJI/xznbkqR8E8R2LwF15M6ZdEntQ8JtdIwZypM=",

From 129278f3c6712f37f0d546b87cb511916fc418e3 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 25 Aug 2026 16:29:33 +0000
Subject: [PATCH 534/551] pocket-tts: 2.1.0 -> 3.0.2

Diff: https://github.com/kyutai-labs/pocket-tts/compare/v2.1.0...v3.0.2

Changelog: https://github.com/kyutai-labs/pocket-tts/releases/tag/v3.0.2
---
 pkgs/development/python-modules/pocket-tts/default.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/pocket-tts/default.nix b/pkgs/development/python-modules/pocket-tts/default.nix
index 3db78e3c6c37..eae65524de18 100644
--- a/pkgs/development/python-modules/pocket-tts/default.nix
+++ b/pkgs/development/python-modules/pocket-tts/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pocket-tts";
-  version = "2.1.0";
+  version = "3.0.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -38,17 +38,13 @@ buildPythonPackage (finalAttrs: {
     owner = "kyutai-labs";
     repo = "pocket-tts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TonwnbH1FQMoK7SyKiCyEVIn9TY8drUyN2ZOq8JpXj4=";
+    hash = "sha256-/8MLr8Z1UDqrS5DBVPdsKOKO2XCFjk8aK+CXY1lYjRQ=";
   };
 
   build-system = [
     hatchling
   ];
 
-  pythonRelaxDeps = [
-    "beartype"
-    "python-multipart"
-  ];
   dependencies = [
     beartype
     einops

From ba6224fc6f6f4880f620bca5ad1143b13ef7823e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 25 Aug 2026 18:52:33 +0200
Subject: [PATCH 535/551] Revert "top-level/release.nix: use named constituents
 in aggregates"

---
 pkgs/build-support/release/default.nix |   4 -
 pkgs/top-level/release-haskell.nix     |  86 ++++++++-----
 pkgs/top-level/release-python.nix      |  16 +--
 pkgs/top-level/release.nix             | 172 ++++++++++++-------------
 4 files changed, 145 insertions(+), 133 deletions(-)

diff --git a/pkgs/build-support/release/default.nix b/pkgs/build-support/release/default.nix
index 2ac928d77916..6ad860d4fac9 100644
--- a/pkgs/build-support/release/default.nix
+++ b/pkgs/build-support/release/default.nix
@@ -124,16 +124,12 @@ rec {
       name,
       constituents,
       meta ? { },
-      # Interpret string constituents as fnmatch patterns matched
-      # against all job names of the jobset.
-      globConstituents ? false,
     }:
     pkgs.runCommand name
       {
         inherit constituents meta;
         preferLocalBuild = true;
         _hydraAggregate = true;
-        _hydraGlobConstituents = globConstituents;
       }
       ''
         mkdir -p $out/nix-support
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index fe773844c1e8..686d09922259 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -26,6 +26,26 @@ let
     pkgs
     ;
 
+  # Helper function which traverses a (nested) set
+  # of derivations produced by mapTestOn and flattens
+  # it to a list of derivations suitable to be passed
+  # to `releaseTools.aggregate` as constituents.
+  # Removes all non derivations from the input jobList.
+  #
+  # accumulateDerivations :: [ Either Derivation AttrSet ] -> [ Derivation ]
+  #
+  # > accumulateDerivations [ drv1 "string" { foo = drv2; bar = { baz = drv3; }; } ]
+  # [ drv1 drv2 drv3 ]
+  accumulateDerivations =
+    jobList:
+    lib.concatMap (
+      attrs:
+      if lib.isDerivation attrs then
+        [ attrs ]
+      else
+        lib.optionals (lib.isAttrs attrs) (accumulateDerivations (lib.attrValues attrs))
+    ) jobList;
+
   # names of all subsets of `pkgs.haskell.packages`
   #
   # compilerNames looks like the following:
@@ -612,35 +632,34 @@ let
           '';
           teams = [ lib.teams.haskell ];
         };
-        globConstituents = true;
-        constituents = [
+        constituents = accumulateDerivations [
           # haskell specific tests
-          "tests.haskell.*"
+          jobs.tests.haskell
           # important top-level packages
-          "cabal-install.*"
-          "cabal2nix.*"
-          "cachix.*"
-          "darcs.*"
-          "haskell-language-server.*"
-          "hledger.*"
-          "hledger-ui.*"
-          "hpack.*"
-          "niv.*"
-          "pandoc.*"
-          "stack.*"
-          "stylish-haskell.*"
-          "shellcheck.*"
+          jobs.cabal-install
+          jobs.cabal2nix
+          jobs.cachix
+          jobs.darcs
+          jobs.haskell-language-server
+          jobs.hledger
+          jobs.hledger-ui
+          jobs.hpack
+          jobs.niv
+          jobs.pandoc
+          jobs.stack
+          jobs.stylish-haskell
+          jobs.shellcheck
           # important haskell (library) packages
-          "haskellPackages.cabal-plan.*"
-          "haskellPackages.distribution-nixpkgs.*"
-          "haskellPackages.hackage-db.*"
-          "haskellPackages.xmonad.*"
-          "haskellPackages.xmonad-contrib.*"
+          jobs.haskellPackages.cabal-plan
+          jobs.haskellPackages.distribution-nixpkgs
+          jobs.haskellPackages.hackage-db
+          jobs.haskellPackages.xmonad
+          jobs.haskellPackages.xmonad-contrib
           # haskell packages maintained by @peti
           # imported from the old hydra jobset
-          "haskellPackages.hopenssl.*"
-          "haskellPackages.hsemail.*"
-          "haskellPackages.hsyslog.*"
+          jobs.haskellPackages.hopenssl
+          jobs.haskellPackages.hsemail
+          jobs.haskellPackages.hsyslog
         ];
       };
       maintained = pkgs.releaseTools.aggregate {
@@ -649,8 +668,9 @@ let
           description = "Aggregate jobset of all haskell packages with a maintainer";
           teams = [ lib.teams.haskell ];
         };
-        globConstituents = true;
-        constituents = map (name: "haskellPackages.${name}.*") (maintainedPkgNames pkgs.haskellPackages);
+        constituents = accumulateDerivations (
+          map (name: jobs.haskellPackages."${name}") (maintainedPkgNames pkgs.haskellPackages)
+        );
       };
 
       muslGHCs = pkgs.releaseTools.aggregate {
@@ -661,10 +681,9 @@ let
             nh2
           ];
         };
-        globConstituents = true;
-        constituents = [
-          "pkgsMusl.haskell.compiler.ghcHEAD.*"
-          "pkgsMusl.haskell.compiler.native-bignum.ghcHEAD.*"
+        constituents = accumulateDerivations [
+          jobs.pkgsMusl.haskell.compiler.ghcHEAD
+          jobs.pkgsMusl.haskell.compiler.native-bignum.ghcHEAD
         ];
       };
 
@@ -677,10 +696,9 @@ let
             lib.maintainers.rnhmjoj
           ];
         };
-        globConstituents = true;
-        constituents = [
-          "pkgsStatic.haskell.packages.native-bignum.ghc948.*" # non-hadrian
-          "pkgsStatic.haskellPackages.*"
+        constituents = accumulateDerivations [
+          jobs.pkgsStatic.haskell.packages.native-bignum.ghc948 # non-hadrian
+          jobs.pkgsStatic.haskellPackages
         ];
       };
     }
diff --git a/pkgs/top-level/release-python.nix b/pkgs/top-level/release-python.nix
index 51faf69aec8b..51407db2654f 100644
--- a/pkgs/top-level/release-python.nix
+++ b/pkgs/top-level/release-python.nix
@@ -53,14 +53,14 @@ let
       name = "python-tested";
       meta.description = "Release-critical packages from the python package sets";
       constituents = [
-        "nixos-render-docs.x86_64-linux" # Used in nixos manual
-        "remarshal.x86_64-linux" # Used in pkgs.formats.yaml_1_1
-        "python313Packages.afdko.x86_64-linux" # Used in noto-fonts-color-emoji
-        "python313Packages.buildcatrust.x86_64-linux" # Used in pkgs.cacert
-        "python313Packages.colorama.x86_64-linux" # Used in nixos test-driver
-        "python313Packages.ptpython.x86_64-linux" # Used in nixos test-driver
-        "python313Packages.requests.x86_64-linux" # Almost ubiquous package
-        "python313Packages.sphinx.x86_64-linux" # Document creation for many packages
+        jobs.nixos-render-docs.x86_64-linux # Used in nixos manual
+        jobs.remarshal.x86_64-linux # Used in pkgs.formats.yaml_1_1
+        jobs.python313Packages.afdko.x86_64-linux # Used in noto-fonts-color-emoji
+        jobs.python313Packages.buildcatrust.x86_64-linux # Used in pkgs.cacert
+        jobs.python313Packages.colorama.x86_64-linux # Used in nixos test-driver
+        jobs.python313Packages.ptpython.x86_64-linux # Used in nixos test-driver
+        jobs.python313Packages.requests.x86_64-linux # Almost ubiquous package
+        jobs.python313Packages.sphinx.x86_64-linux # Document creation for many packages
       ];
     };
 
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index b277da8b043a..a6b22fba574e 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -77,12 +77,13 @@ let
   inherit (release-lib) mapTestOn pkgs;
 
   inherit (release-lib.lib)
-    concatMap
+    collect
     elem
     genAttrs
     hasInfix
     hasSuffix
     id
+    isDerivation
     optionals
     ;
 
@@ -112,49 +113,49 @@ let
           name = "nixpkgs-darwin-${jobs.tarball.version}";
           meta.description = "Release-critical builds for the Nixpkgs darwin channel";
           constituents = [
-            "tarball"
-            "release-checks"
+            jobs.tarball
+            jobs.release-checks
           ]
           ++ optionals supportDarwin [
-            "cabal2nix.aarch64-darwin"
-            "ghc.aarch64-darwin"
-            "git.aarch64-darwin"
-            "go.aarch64-darwin"
-            "mariadb.aarch64-darwin"
-            "nix.aarch64-darwin"
-            "nixpkgs-review.aarch64-darwin"
-            "nix-info.aarch64-darwin"
-            "nix-info-tested.aarch64-darwin"
-            "openssh.aarch64-darwin"
-            "openssl.aarch64-darwin"
-            "pandoc.aarch64-darwin"
-            "postgresql.aarch64-darwin"
-            "python3.aarch64-darwin"
-            "ruby.aarch64-darwin"
-            "rustc.aarch64-darwin"
+            jobs.cabal2nix.aarch64-darwin
+            jobs.ghc.aarch64-darwin
+            jobs.git.aarch64-darwin
+            jobs.go.aarch64-darwin
+            jobs.mariadb.aarch64-darwin
+            jobs.nix.aarch64-darwin
+            jobs.nixpkgs-review.aarch64-darwin
+            jobs.nix-info.aarch64-darwin
+            jobs.nix-info-tested.aarch64-darwin
+            jobs.openssh.aarch64-darwin
+            jobs.openssl.aarch64-darwin
+            jobs.pandoc.aarch64-darwin
+            jobs.postgresql.aarch64-darwin
+            jobs.python3.aarch64-darwin
+            jobs.ruby.aarch64-darwin
+            jobs.rustc.aarch64-darwin
             # blocking ofBorg CI 2020-02-28
-            # "stack.aarch64-darwin"
-            "stdenv.aarch64-darwin"
-            "vim.aarch64-darwin"
-            "cachix.aarch64-darwin"
-            "darwin.linux-builder.aarch64-darwin"
+            # jobs.stack.aarch64-darwin
+            jobs.stdenv.aarch64-darwin
+            jobs.vim.aarch64-darwin
+            jobs.cachix.aarch64-darwin
+            jobs.darwin.linux-builder.aarch64-darwin
 
             # UI apps
-            # "firefox-unwrapped.aarch64-darwin"
-            "qt5.qtmultimedia.aarch64-darwin"
-            "inkscape.aarch64-darwin"
-            "gimp2.aarch64-darwin" # FIXME replace with gimp once https://github.com/NixOS/nixpkgs/issues/411189 is resolved
-            "emacs.aarch64-darwin"
-            "wireshark.aarch64-darwin"
+            # jobs.firefox-unwrapped.aarch64-darwin
+            jobs.qt5.qtmultimedia.aarch64-darwin
+            jobs.inkscape.aarch64-darwin
+            jobs.gimp2.aarch64-darwin # FIXME replace with gimp once https://github.com/NixOS/nixpkgs/issues/411189 is resolved
+            jobs.emacs.aarch64-darwin
+            jobs.wireshark.aarch64-darwin
 
             # Tests
             /*
-              "tests.cc-wrapper.default.aarch64-darwin"
-              "tests.cc-wrapper.llvmPackages.clang.aarch64-darwin"
-              "tests.cc-wrapper.llvmPackages.libcxx.aarch64-darwin"
-              "tests.stdenv-inputs.aarch64-darwin"
-              "tests.macOSSierraShared.aarch64-darwin"
-              "tests.stdenv.hooks.patch-shebangs.aarch64-darwin"
+              jobs.tests.cc-wrapper.default.aarch64-darwin
+              jobs.tests.cc-wrapper.llvmPackages.clang.aarch64-darwin
+              jobs.tests.cc-wrapper.llvmPackages.libcxx.aarch64-darwin
+              jobs.tests.stdenv-inputs.aarch64-darwin
+              jobs.tests.macOSSierraShared.aarch64-darwin
+              jobs.tests.stdenv.hooks.patch-shebangs.aarch64-darwin
             */
           ];
         }
@@ -165,71 +166,68 @@ let
       name = "nixpkgs-${jobs.tarball.version}";
       meta.description = "Release-critical builds for the Nixpkgs unstable channel";
       constituents = [
-        "tarball"
-        "release-checks"
-        "metrics"
-        "manual"
-        "tests.lib-tests.x86_64-linux"
-        "tests.pkgs-lib.formats-tests.x86_64-linux"
-        "stdenv.x86_64-linux"
-        "cargo.x86_64-linux"
-        "go.x86_64-linux"
-        "linux.x86_64-linux"
-        "nix.x86_64-linux"
-        "pandoc.x86_64-linux"
-        "python3.x86_64-linux"
+        jobs.tarball
+        jobs.release-checks
+        jobs.metrics
+        jobs.manual
+        jobs.tests.lib-tests.x86_64-linux
+        jobs.tests.pkgs-lib.formats-tests.x86_64-linux
+        jobs.stdenv.x86_64-linux
+        jobs.cargo.x86_64-linux
+        jobs.go.x86_64-linux
+        jobs.linux.x86_64-linux
+        jobs.nix.x86_64-linux
+        jobs.pandoc.x86_64-linux
+        jobs.python3.x86_64-linux
         # Needed by contributors to test PRs (by inclusion of the PR template)
-        "nixpkgs-review.x86_64-linux"
+        jobs.nixpkgs-review.x86_64-linux
         # Needed for support
-        "nix-info.x86_64-linux"
-        "nix-info-tested.x86_64-linux"
+        jobs.nix-info.x86_64-linux
+        jobs.nix-info-tested.x86_64-linux
         # Ensure that X11/GTK are in order.
-        "firefox-unwrapped.x86_64-linux"
-        "cachix.x86_64-linux"
-        "devenv.x86_64-linux"
+        jobs.firefox-unwrapped.x86_64-linux
+        jobs.cachix.x86_64-linux
+        jobs.devenv.x86_64-linux
 
         /*
           TODO: re-add tests; context: https://github.com/NixOS/nixpkgs/commit/36587a587ab191eddd868179d63c82cdd5dee21b
 
-          "tests.cc-wrapper.default.x86_64-linux"
+          jobs.tests.cc-wrapper.default.x86_64-linux
 
           # broken see issue #40038
 
-          "tests.cc-wrapper.llvmPackages.clang.x86_64-linux"
-          "tests.cc-wrapper.llvmPackages.libcxx.x86_64-linux"
-          "tests.cc-multilib-gcc.x86_64-linux"
-          "tests.cc-multilib-clang.x86_64-linux"
-          "tests.stdenv-inputs.x86_64-linux"
-          "tests.stdenv.hooks.patch-shebangs.x86_64-linux"
+          jobs.tests.cc-wrapper.llvmPackages.clang.x86_64-linux
+          jobs.tests.cc-wrapper.llvmPackages.libcxx.x86_64-linux
+          jobs.tests.cc-multilib-gcc.x86_64-linux
+          jobs.tests.cc-multilib-clang.x86_64-linux
+          jobs.tests.stdenv-inputs.x86_64-linux
+          jobs.tests.stdenv.hooks.patch-shebangs.x86_64-linux
         */
       ]
-      ++ concatMap (config: [
-        "stdenvBootstrapTools.${config}.build"
-        "stdenvBootstrapTools.${config}.test"
-      ]) bootstrapConfigs
+      ++ collect isDerivation jobs.stdenvBootstrapTools
       ++ optionals supportDarwin [
-        "stdenv.aarch64-darwin"
-        "cargo.aarch64-darwin"
-        "cachix.aarch64-darwin"
-        "devenv.aarch64-darwin"
-        "go.aarch64-darwin"
-        "python3.aarch64-darwin"
-        "nixpkgs-review.aarch64-darwin"
-        "nix.aarch64-darwin"
-        "nix-info.aarch64-darwin"
-        "nix-info-tested.aarch64-darwin"
-        "git.aarch64-darwin"
-        "mariadb.aarch64-darwin"
-        "vim.aarch64-darwin"
-        "inkscape.aarch64-darwin"
-        "qt5.qtmultimedia.aarch64-darwin"
-        "darwin.linux-builder.aarch64-darwin"
+        jobs.stdenv.aarch64-darwin
+        jobs.cargo.aarch64-darwin
+        jobs.cachix.aarch64-darwin
+        jobs.devenv.aarch64-darwin
+        jobs.go.aarch64-darwin
+        jobs.python3.aarch64-darwin
+        jobs.nixpkgs-review.aarch64-darwin
+        jobs.nix.aarch64-darwin
+        jobs.nix-info.aarch64-darwin
+        jobs.nix-info-tested.aarch64-darwin
+        jobs.git.aarch64-darwin
+        jobs.mariadb.aarch64-darwin
+        jobs.vim.aarch64-darwin
+        jobs.inkscape.aarch64-darwin
+        jobs.qt5.qtmultimedia.aarch64-darwin
+        jobs.darwin.linux-builder.aarch64-darwin
         /*
-          "tests.cc-wrapper.default.aarch64-darwin"
-          "tests.cc-wrapper.llvmPackages.clang.aarch64-darwin"
-          "tests.cc-wrapper.llvmPackages.libcxx.aarch64-darwin"
-          "tests.stdenv-inputs.aarch64-darwin"
-          "tests.stdenv.hooks.patch-shebangs.aarch64-darwin"
+          jobs.tests.cc-wrapper.default.aarch64-darwin
+          jobs.tests.cc-wrapper.llvmPackages.clang.aarch64-darwin
+          jobs.tests.cc-wrapper.llvmPackages.libcxx.aarch64-darwin
+          jobs.tests.stdenv-inputs.aarch64-darwin
+          jobs.tests.stdenv.hooks.patch-shebangs.aarch64-darwin
         */
       ];
     };

From efbe62bbebb9808a9bc0898852657f603aa0c4c4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 16:59:45 +0000
Subject: [PATCH 536/551] openfreebuds: 0.17.3 -> 0.18.0

---
 pkgs/by-name/op/openfreebuds/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/openfreebuds/package.nix b/pkgs/by-name/op/openfreebuds/package.nix
index 29fd14b2a4e0..2d9daa41a5d2 100644
--- a/pkgs/by-name/op/openfreebuds/package.nix
+++ b/pkgs/by-name/op/openfreebuds/package.nix
@@ -8,13 +8,13 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "openfreebuds";
-  version = "0.17.3";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "melianmiko";
     repo = "OpenFreebuds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3DTSoVnHYB8GjKw0G8O3hlkOdQmDxe6B2O7h6LT1+jg=";
+    hash = "sha256-wl+peoklWEC/k99ZfPACvM0HvgTtvbHCXqdwKOAv7Bg=";
   };
 
   pyproject = true;

From 11fa47eab4b2b6f99b20bfde21f3890859fd3af3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 17:07:59 +0000
Subject: [PATCH 537/551] terraform-providers.hashicorp_google: 7.44.0 ->
 7.45.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index b7a282305d39..6efab2bc3a20 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -580,13 +580,13 @@
     "vendorHash": "sha256-gv54RqpkWri5yL40ajcLnqzF0XvMEzFoFEEV2/g1paE="
   },
   "hashicorp_google": {
-    "hash": "sha256-GWC0PIYMAhI9KO2j5yI7W7v0el8u9d1qqUyaWq/sodo=",
+    "hash": "sha256-Ed/D/c8Ut4gR+VAonZbqvgK/MKVLRryloO+7hvzn5G8=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v7.44.0",
+    "rev": "v7.45.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gy+Tn9L2NYRYnmYGcb2jqTTXJDzMqHtm2EgSQZunbjg="
+    "vendorHash": "sha256-d4nO4QTeHyVNdU1JFzQdU4UTisoY1tjv7GVCRNRtNC8="
   },
   "hashicorp_google-beta": {
     "hash": "sha256-WjgVh6LHcNmTT6Fg2FWmtMacCokaNuZTI9ZEcMoD7uo=",

From d6068e3e6b6bdc108928a188299e61c8e55f4b1c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 17:20:53 +0000
Subject: [PATCH 538/551] somo: 1.3.3 -> 1.3.4

---
 pkgs/by-name/so/somo/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/so/somo/package.nix b/pkgs/by-name/so/somo/package.nix
index 40d6971423b9..bf5da00b6476 100644
--- a/pkgs/by-name/so/somo/package.nix
+++ b/pkgs/by-name/so/somo/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "somo";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "theopfr";
     repo = "somo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+NXB+iOuimd3nz8EqMNL0j2N15fZtURH40dwicytd88=";
+    hash = "sha256-MSTXub5S3LQqflJ2j1Wxzw7lXZE9kwWrURAPROFa95s=";
   };
 
-  cargoHash = "sha256-TAIUgyq8NBx7gQdZeY0dTGEvkRveMdozBjINQeyJOss=";
+  cargoHash = "sha256-wm80KbxvsffPA9KqOfVJpokMZsMgm3w4LQjf+XLzSp4=";
 
   nativeBuildInputs = [
     installShellFiles

From beb4cbaec944d1dea3a39f3870b76ce963470af0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 10:28:35 +0000
Subject: [PATCH 539/551] python3Packages.jupyter-collaboration-ui: 3.0.0 ->
 3.0.2

---
 .../python-modules/jupyter-collaboration-ui/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix b/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
index d6417013ec21..b64484c40702 100644
--- a/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jupyter-collaboration-ui";
-  version = "3.0.0";
+  version = "3.0.2";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "jupyter_collaboration_ui";
     inherit (finalAttrs) version;
-    hash = "sha256-cPR+sCvX1RqLTLcPqQ6+TS8OrDUNkVxcOzAYySiqXx0=";
+    hash = "sha256-X2o6WEb5tAk6EYV212cx/fAa3SL7F5WmKyn9Pd/dExQ=";
   };
 
   build-system = [

From 0f2da1f1decb2ffec25780ef6ba4442cac983d5c Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 25 Aug 2026 17:24:08 +0000
Subject: [PATCH 540/551] python3Packages.jupyter-collaboration: skip failing
 test on python<3.14

---
 .../python-modules/jupyter-collaboration/default.nix         | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/jupyter-collaboration/default.nix b/pkgs/development/python-modules/jupyter-collaboration/default.nix
index ee01b55117ce..e5fb83d2864f 100644
--- a/pkgs/development/python-modules/jupyter-collaboration/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonOlder,
 
   # build-system
   hatchling,
@@ -68,6 +69,10 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # Failed: Timeout (>300.0s) from pytest-timeout
     "test_document_ttl_from_settings"
+  ]
+  ++ lib.optionals (pythonOlder "3.14") [
+    # pytest.PytestUnraisableExceptionWarning: Exception ignored in: None
+    "test_dirty"
   ];
 
   __darwinAllowLocalNetworking = true;

From 25894fcf30af383a26eb07934da2a9d4b14e67b3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 17:44:17 +0000
Subject: [PATCH 541/551] openlinkhub: 0.9.0 -> 0.9.1

---
 pkgs/by-name/op/openlinkhub/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/openlinkhub/package.nix b/pkgs/by-name/op/openlinkhub/package.nix
index 7330c386cb13..b87eaf9778a2 100644
--- a/pkgs/by-name/op/openlinkhub/package.nix
+++ b/pkgs/by-name/op/openlinkhub/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "openlinkhub";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "jurkovic-nikola";
     repo = "OpenLinkHub";
     tag = finalAttrs.version;
-    hash = "sha256-VGrLQmg+ze60LRVmzeN8y8W8ZQt1Zxk8iENOsxNaOZ4=";
+    hash = "sha256-MIr37WrS3DoBL1gdzUkXugX8KksUA3x5pTsh5+6VBXs=";
   };
 
   proxyVendor = true;

From b47c7f5ae6eba9d735cdd27225bef8aced2bf9ad Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 25 Aug 2026 17:42:02 +0000
Subject: [PATCH 542/551] harlequin: 2.9.0 -> 2.10.0

Diff: https://github.com/tconbeer/harlequin/compare/v2.9.0...v2.10.0

Changelog: https://github.com/tconbeer/harlequin/releases/tag/v2.10.0
---
 pkgs/by-name/ha/harlequin/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ha/harlequin/package.nix b/pkgs/by-name/ha/harlequin/package.nix
index 8ec80a3924f1..a5e71d3d81d0 100644
--- a/pkgs/by-name/ha/harlequin/package.nix
+++ b/pkgs/by-name/ha/harlequin/package.nix
@@ -13,7 +13,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "harlequin";
-  version = "2.9.0";
+  version = "2.10.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "tconbeer";
     repo = "harlequin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3GpchONAU+FAFh82E1vZ2tXqo536qpQaVbECyjnH6K4=";
+    hash = "sha256-TD6i+nlZncr8yNGYsEqIuRbYU/5DoHIoDaHih4S/7Vw=";
   };
 
   build-system = with python3Packages; [ hatchling ];
@@ -32,14 +32,13 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "click"
     "questionary"
     "tomlkit"
-    "textual-fastdatatable"
   ];
   dependencies =
     with python3Packages;
     [
       click
       duckdb
-      pandas
+      msgspec
       platformdirs
       pyarrow
       pyperclip
@@ -68,6 +67,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   nativeCheckInputs = with python3Packages; [
     flaky
+    jsonschema
     pytest-asyncio
     pytest-textual-snapshot
     pytest-xdist

From 7a32a72e145eaf7d2ff850b9687eb63b22c476ab Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 18:06:31 +0000
Subject: [PATCH 543/551] suitesparse-graphblas: 10.4.1 -> 10.5.0

---
 pkgs/by-name/su/suitesparse-graphblas/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/su/suitesparse-graphblas/package.nix b/pkgs/by-name/su/suitesparse-graphblas/package.nix
index 2d731685db41..a0926cc62813 100644
--- a/pkgs/by-name/su/suitesparse-graphblas/package.nix
+++ b/pkgs/by-name/su/suitesparse-graphblas/package.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "suitesparse-graphblas";
-  version = "10.4.1";
+  version = "10.5.0";
 
   outputs = [
     "out"
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "DrTimothyAldenDavis";
     repo = "GraphBLAS";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-cP5LktaO/vCPg6tRrK3uaCgOkOwS7X6mbb6VPTuYvl0=";
+    hash = "sha256-N+rpBYcpAjUPPeeqU6pMrPKR+b5rBP+z7Z9i2jS6kNE=";
   };
 
   nativeBuildInputs = [

From 83a9af8a5d530b10ef7fe3cb0b662a17ab2d9e7f Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 25 Aug 2026 18:07:17 +0000
Subject: [PATCH 544/551] tuicr: 0.23.1 -> 0.24.0

Diff: https://github.com/agavra/tuicr/compare/v0.23.1...v0.24.0

Changelog: https://github.com/agavra/tuicr/blob/v0.24.0/CHANGELOG.md
---
 pkgs/by-name/tu/tuicr/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tu/tuicr/package.nix b/pkgs/by-name/tu/tuicr/package.nix
index 4f7ab1acb862..e1d7ed299117 100644
--- a/pkgs/by-name/tu/tuicr/package.nix
+++ b/pkgs/by-name/tu/tuicr/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tuicr";
-  version = "0.23.1";
+  version = "0.24.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "agavra";
     repo = "tuicr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SvRvoQN9b4pXg4rPFnYI2Yeg3SAZKyjYknR2AzfoHnY=";
+    hash = "sha256-AnLLEOI3QaWZLMy339nJeyfCXt4NZpnzsYhZXTEagkU=";
   };
 
-  cargoHash = "sha256-1h8jDRssVA7gNfHB/9Uh1QWOsNF+aUBU698P/qLbyeY=";
+  cargoHash = "sha256-LyBCtZ93HZ5GvceqD27zhKzXbAgJ0aLOgGcFNoq/WdE=";
 
   strictDeps = true;
 

From 564ae713dcc35dee7d78bd4019cf06e278e08e71 Mon Sep 17 00:00:00 2001
From: Clover Ison <clover@isons.org>
Date: Tue, 25 Aug 2026 11:12:37 -0700
Subject: [PATCH 545/551] maintainers: rename pyrotelekinetic to tr3foil

Reflect my github username change by updating any references to
`lib.maintainers.pyrotelekinetic` tree-wide (there's only one).
---
 maintainers/maintainer-list.nix      | 12 ++++++------
 pkgs/by-name/mi/minefair/package.nix |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 28211810b4aa..f4923a3f794e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -23432,12 +23432,6 @@
     github = "pyle";
     githubId = 7279609;
   };
-  pyrotelekinetic = {
-    name = "Clover Ison";
-    email = "clover@isons.org";
-    github = "pyrotelekinetic";
-    githubId = 29682759;
-  };
   pyrox0 = {
     name = "Pyrox";
     email = "pyrox@pyrox.dev";
@@ -29386,6 +29380,12 @@
     github = "tpwrules";
     githubId = 208010;
   };
+  tr3foil = {
+    name = "Clover Ison";
+    email = "clover@isons.org";
+    github = "tr3foil";
+    githubId = 29682759;
+  };
   transcaffeine = {
     name = "transcaffeine";
     email = "transcaffeine@finally.coffee";
diff --git a/pkgs/by-name/mi/minefair/package.nix b/pkgs/by-name/mi/minefair/package.nix
index 2fc84795abb9..f7572e1331b1 100644
--- a/pkgs/by-name/mi/minefair/package.nix
+++ b/pkgs/by-name/mi/minefair/package.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Fair and infinite implementation of Minesweeper";
     homepage = "https://github.com/LyricLy/minefair";
     license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.pyrotelekinetic ];
+    maintainers = [ lib.maintainers.tr3foil ];
     mainProgram = "minefair";
   };
 })

From 17cc4687fbbb996c2133f042f086cdfa19af491b Mon Sep 17 00:00:00 2001
From: VuiMuich <vuimuich@quantentunnel.de>
Date: Mon, 24 Aug 2026 08:00:39 +0200
Subject: [PATCH 546/551] nushell: 0.115.0 -> 0.115.1

---
 pkgs/by-name/nu/nushell/package.nix                | 6 +++---
 pkgs/by-name/nu/nushell/plugins/polars/package.nix | 4 +---
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/nu/nushell/package.nix b/pkgs/by-name/nu/nushell/package.nix
index a798e0559e9a..d8fed2d39945 100644
--- a/pkgs/by-name/nu/nushell/package.nix
+++ b/pkgs/by-name/nu/nushell/package.nix
@@ -25,16 +25,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # NOTE: when updating this to a new non-patch version, please also try to
   # update the plugins. Plugins only work if they are compiled for the same
   # major/minor version.
-  version = "0.115.0";
+  version = "0.115.1";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nushell";
     tag = finalAttrs.version;
-    hash = "sha256-9QzdbNP8S9TmW8MRUVqvVRAi6dxTP3T2WY3+wuypsck=";
+    hash = "sha256-qndvtW1yD4n++LpGp+ucQVNqIm8jgcrM3M4O5q5WDgk=";
   };
 
-  cargoHash = "sha256-Vby1x3/W1IUs73bFz/+AZpn4IepWScqrGp0tXlF6an4=";
+  cargoHash = "sha256-73JFGry/aVBwIAs5DTqx7GbeCfwIopEIZ8pQp75TRq4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/nu/nushell/plugins/polars/package.nix b/pkgs/by-name/nu/nushell/plugins/polars/package.nix
index 18c23ca6939d..bfd1aeba1821 100644
--- a/pkgs/by-name/nu/nushell/plugins/polars/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/polars/package.nix
@@ -10,9 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu_plugin_polars";
-  inherit (nushell) version src;
-
-  cargoHash = "sha256-Vby1x3/W1IUs73bFz/+AZpn4IepWScqrGp0tXlF6an4=";
+  inherit (nushell) version src cargoHash;
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
   buildInputs = [ openssl ];

From ba89296176c6a0653c5f04f272b3b56093249160 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 23 Aug 2026 17:39:57 +0000
Subject: [PATCH 547/551] firefox-beta-unwrapped: 154.0b10 -> 155.0b4

---
 .../networking/browsers/firefox/packages/firefox-beta.nix     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index 8935ef5e314f..cbea4f9af1ed 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = "firefox-beta";
-  version = "154.0b10";
+  version = "155.0b4";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "ddbe3ff45217a16df9eecfac52fcb12425accae76457e7054b20bd085f5b22908940a20448f213c3dc62d1276bb1c81f38194432336ba97459b2c17393ebd3cd";
+    sha512 = "6c1536924b955f856bc629cdf563ab9d4a87058fac7acf8db008bfe5a1f19defd004116bb3673fd23b62e1e00ca21acbcc7153d85dfa522eb3def6c85065b01b";
   };
 
   meta = {

From 4bee12d42c841c917d608899ad0e9f27826a7a38 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Tue, 25 Aug 2026 19:56:20 +0000
Subject: [PATCH 548/551] firefox-devedition-unwrapped: 154.0b10 -> 155.0b4

---
 .../browsers/firefox/packages/firefox-devedition.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index d9918265f160..4b541f399eae 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = "firefox-devedition";
-  version = "154.0b10";
+  version = "155.0b4";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "e2275579e4769a0690010d8fbba528a0e347d86f0dc981d1702b3e627d9c73f3fd7399d3e618c514bf6a3c0059fa3aa5a29f9cdec802e52955a03b1122ca8d39";
+    sha512 = "d2b58b520393848c110714537aec2c71d1244d7439c8c62e85bf123a3f3ade3db8a31617c242d9803306f1655237666948aaa55b780f8743ab57fc406a6ea906";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but

From 1df3568a49cb22bc9d04a13880faa99cd288d4ab Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Tue, 25 Aug 2026 17:47:39 -0400
Subject: [PATCH 549/551] google-chrome: 151.0.7922.173 -> 152.0.7977.64

Release note: https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html
---
 pkgs/by-name/go/google-chrome/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 243668efa5d4..804edd559344 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -179,7 +179,7 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "151.0.7922.173";
+    version = "152.0.7977.64";
 
     src =
       let
@@ -194,8 +194,8 @@ let
         url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_${debArch}.deb";
         hash =
           {
-            amd64 = "sha256-h45atJW4ppSYD8phvAmzfmUcztziKRxzQ00W5IomRv0=";
-            arm64 = "sha256-rmIl2Yu9JT/wCqW3Mew8q1+t3utV905O1TDb4w88dx8=";
+            amd64 = "sha256-Tq4HNqgS2byFHNKTf3rwDkfbr4MFhF7tRScD/wCYc8c=";
+            arm64 = "sha256-bMq3mnr+HRdMieKM8NWiZebohV/ztFxqIVGmXX3a6eg=";
           }
           .${debArch};
       };
@@ -300,11 +300,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "151.0.7922.174";
+    version = "152.0.7977.65";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/kfi4kfphbh3b32pyrjxv55iqfi_151.0.7922.174/GoogleChrome-151.0.7922.174.dmg";
-      hash = "sha256-CcJ7VoCjUE8Zn5G2NMFJjKeDUBXVuF+2m/HglN8/R0Q=";
+      url = "http://dl.google.com/release2/chrome/hojsgpdatugdlbpbk6whstg6m4_152.0.7977.65/GoogleChrome-152.0.7977.65.dmg";
+      hash = "sha256-a3r/7DSXVfQJKNujF2xu5KPTLjJk3JLE+oFrAwktPAc=";
     };
 
     dontPatch = true;

From 761831b2ef0021abd56c99ce7cc2b7d2c5d2de2b Mon Sep 17 00:00:00 2001
From: jj <jsjeges@gmail.com>
Date: Wed, 26 Aug 2026 07:12:58 +1000
Subject: [PATCH 550/551] emscripten: check -fwasm-exceptions in
 installCheckPhase

Compile and link a throw/catch program with -fwasm-exceptions. The
catch handler makes the compiler emit its unwind-helper reference, so
the link fails when the LLVM/emscripten pairing regresses the
_Unwind_CallPersonality mismatch. The check gates every build of the
package, so CI catches the regression.

Assisted-by: Claude Code (Claude Fable 5)
---
 .../development/compilers/emscripten/default.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index 54636b0a0fbb..25dc6e1cc03b 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -69,6 +69,7 @@ stdenv.mkDerivation rec {
     (replaceVars ./0001-emulate-clang-sysroot-include-logic.patch {
       resourceDir = "${llvmEnv}/lib/clang/${lib.versions.major llvmPackages.llvm.version}/";
     })
+    # Remove this patch when llvmPackages reaches LLVM 23
     ./0002-libunwind-restore-Unwind_CallPersonality.patch
   ];
 
@@ -197,6 +198,21 @@ stdenv.mkDerivation rec {
         runHook postInstall
   '';
 
+  doInstallCheck = true;
+
+  # C++ exceptions with -fwasm-exceptions must compile and link
+  # see https://github.com/NixOS/nixpkgs/pull/556385
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    pushd $TMPDIR
+    echo 'int main() { try { throw 42; } catch (int) { return 0; } return 1; }' > throw.cpp
+    $out/bin/em++ -fwasm-exceptions throw.cpp -o throw.js
+    popd
+
+    runHook postInstallCheck
+  '';
+
   passthru = {
     # HACK: Make emscripten look more like a cc-wrapper to GHC
     # when building the javascript backend.

From d0876b61c25762417e8f02aacea2ba7b10eb1dab Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 21:57:23 +0000
Subject: [PATCH 551/551] libretro.flycast: 0-unstable-2026-08-07 ->
 0-unstable-2026-08-23

---
 pkgs/applications/emulators/libretro/cores/flycast.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index 46888f2e8f31..18fd9bf197bd 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-08-07";
+  version = "0-unstable-2026-08-23";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "a172e0001351dfbc49b86860a13d5390b1c493fe";
-    hash = "sha256-0vBKit2Ce5ihTtQjOrbwrFBEg1Qig/8+H86eJb7EjZs=";
+    rev = "c3763d8fc4208dd6f8f0bc456383543b8406a8a0";
+    hash = "sha256-/QfEDbodvtrfxe2qEqselWFyv6Lx77Z3fJOZhgwMAIk=";
     fetchSubmodules = true;
   };