Merge master into staging-next

2026-09-28 19:00:46 +00:00 · 2026-09-28 00:28:27 +00:00
parent bf5dbda6fd e9227ddbcc
commit 362969a3a4
120 changed files with 780 additions and 291 deletions
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -703,11 +703,6 @@ lib.mapAttrs mkLicense (
      url = "https://www.schristiancollins.com/generaluser.php"; # license included in sources
    };

-    gfl = {
-      fullName = "GUST Font License";
-      url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-LICENSE.txt";
-    };
-
    gfsl = {
      fullName = "GUST Font Source License";
      url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-SOURCE-LICENSE.txt";
--- a/nixos/modules/programs/wayland/noctalia.nix
+++ b/nixos/modules/programs/wayland/noctalia.nix
@@ -33,7 +33,13 @@ in
  config = lib.mkIf cfg.enable (
    lib.mkMerge [
      {
-        environment.systemPackages = [ cfg.package ];
+        environment.systemPackages = [
+          cfg.package
+        ];
+
+        # Needed to add the freedesktop sound theme
+        # It's only a runtime dependency for noctalia, so it's not made a package dependency.
+        xdg.sounds.enable = true;

        systemd.user.services.noctalia = lib.mkIf cfg.systemd.enable {
          description = "Noctalia Wayland desktop shell";
--- a/nixos/modules/services/networking/nebula.nix
+++ b/nixos/modules/services/networking/nebula.nix
@@ -292,7 +292,7 @@ in
    assertions = lib.mapAttrsToList (netName: netCfg: {
      # IFNAMSIZ caps network device names to 16 chars (including NULL terminator).
      # Without this check, users might end up with a truncated interface name.
-      assertion = !netCfg.tun.disable && builtins.stringLength netCfg.tun.device <= 15;
+      assertion = netCfg.tun.disable || builtins.stringLength netCfg.tun.device <= 15;
      message = ''
        Network device names can't be longer than 15 chars.
        `config.services.nebula.networks.${netName}.tun.device` is set to "${netCfg.tun.device}" which is above the limit.
--- a/nixos/tests/nebula/connectivity.nix
+++ b/nixos/tests/nebula/connectivity.nix
@@ -1,6 +1,9 @@
-{ pkgs, lib, ... }:
+{
+  pkgs,
+  lib,
+  ...
+}:
 let
-
  # We'll need to be able to trade cert files between nodes via scp.
  inherit (import ../ssh-keys.nix pkgs)
    snakeOilPrivateKey
@@ -44,13 +47,11 @@ let
      }
      extraConfig
    ];
-
 in
 {
  name = "nebula";

  nodes = {
-
    lighthouse =
      { ... }@args:
      makeNebulaNode args "lighthouse" {
@@ -97,6 +98,24 @@ in
            };
          };
        };
+
+        # A lighthouse can run without a tun interface, no device name = skip length check pr 565501
+        services.nebula.networks.tunless = {
+          ca = "/etc/nebula/ca.crt";
+          cert = "/etc/nebula/lighthouse.crt";
+          key = "/etc/nebula/lighthouse.key";
+          isLighthouse = true;
+          listen = {
+            host = "0.0.0.0";
+            port = 4243;
+          };
+          tun = {
+            disable = true;
+            device = "nebula.tunless-too-long";
+          };
+          user = "nebula-smoke";
+          group = "nebula-smoke";
+        };
      };

    allowAny =
@@ -265,12 +284,10 @@ in
          };
        };
      };
-
  };

  testScript =
    let
-
      setUpPrivateKey = name: ''
        ${name}.start()
        ${name}.succeed(
@@ -379,6 +396,11 @@ in
      lighthouse.wait_until_succeeds("ping -c1 -W1 10.0.100.1", timeout=10)
      lighthouse.wait_until_succeeds("ping -c1 -W1 2001:db8::1", timeout=10)

+      # The tunless network starts without a tun device despite its (deliberately over-long) configured device name. pr 565501
+      lighthouse.wait_for_unit("nebula@tunless.service")
+      lighthouse.wait_until_succeeds("ss -lun | grep -q ':4243'", timeout=10)
+      lighthouse.fail("ip link show nebula.tunless-too-long")
+
      # Start all the machines to be set up
      allowAny.start()
      allowFromLighthouse.start()
--- a/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix
+++ b/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix
@@ -1,21 +1,21 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
  pname = "brave-origin";
-  version = "1.95.104";
+  version = "1.96.59";
  flavor = "origin";

  archives = {
    aarch64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_arm64.deb";
-      sha256 = "3efe3d4325b241a19449348a3e32af574be9842b2b0fae1eb942a87bb50333a7";
+      sha256 = "b088a568b3d98893b737a2bfdd5a3769ebb67798100b413e6cce555d42d65f57";
    };
    x86_64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_amd64.deb";
-      sha256 = "fe6a88b3301eb8a08ed062d32bde01786d1b666e5ab842b5625c854eb11f2886";
+      sha256 = "447bc5ac4b2a2bfa71260cdf9d52d2fab694f59e15a4b9a907980f5b3ec45613";
    };
    aarch64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Origin-arm64.dmg";
-      sha256 = "2f59547e4b53ac300450cb4f56f292bcbf508b20fdfa06c6341e5fd976d66859";
+      sha256 = "71f88f231526d99c7eb18d809dfe56a04899a97a3713c0a4476df2fe4132cdbd";
    };
  };
 }
--- a/pkgs/applications/networking/browsers/brave/packages/brave.nix
+++ b/pkgs/applications/networking/browsers/brave/packages/brave.nix
@@ -1,20 +1,20 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
  pname = "brave";
-  version = "1.95.104";
+  version = "1.96.59";

  archives = {
    aarch64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      sha256 = "251ee83fa383db6106ae6140df0975689b226d15ceb96cdb4147cb90cd7c25ba";
+      sha256 = "b82a7a488c9bc0c7b18fea1a2da8acb49f42b4a856493d6a4ce75a0b9a49fee3";
    };
    x86_64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      sha256 = "e09e3c3e9fc84f75e65048a0be830c7c4907744a402b5790530d2206b276426e";
+      sha256 = "b05129c6907670b2029e2f01773d192c8b87c3075b25873ea3bc226bb0f15f1e";
    };
    aarch64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Browser-arm64.dmg";
-      sha256 = "f6823d53b3e9a287b8f8830b728ba9b34fe2d4a9f6ee4e05b3bcd4a21ee25eaf";
+      sha256 = "57690cf24e5ce5e15768b220d46621e575e0caabd3d651bdad5afc2b184f118a";
    };
  };
 }
--- a/pkgs/by-name/ba/badness/package.nix
+++ b/pkgs/by-name/ba/badness/package.nix
@@ -9,7 +9,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "badness";
-  version = "0.23.0";
+  version = "0.24.0";

  __structuredAttrs = true;

@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "jolars";
    repo = "badness";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rPIdpescZTHCDZffevgJbh83NjuDZjxzx3EXSa/I/6U=";
+    hash = "sha256-kc+gM3Vr2gyySwXLBunuL5uihlkYhPi6VW4IhpkigMs=";
  };

-  cargoHash = "sha256-Mi6/2ijc43wkzJzxTJafqh8+gygf3HJnyAq/uVcn3hY=";
+  cargoHash = "sha256-IeYGMF+iG/gSPs4HSaqm0ekZ1WMeKuf1qjNF6EMWvsI=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/ch/chromaprint/package.nix
+++ b/pkgs/by-name/ch/chromaprint/package.nix
@@ -10,7 +10,6 @@
  testers,
  validatePkgConfig,
  nix-update-script,
-  withExamples ? true,
  withTools ? true,
 }:

@@ -80,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://acoustid.org/chromaprint";
    description = "AcoustID audio fingerprinting library";
    license = lib.licenses.lgpl21Plus;
+    maintainers = [ lib.maintainers.quantenzitrone ];
    platforms = lib.platforms.unix;
    pkgConfigModules = [ "libchromaprint" ];
  }
--- a/pkgs/by-name/cl/clifm/package.nix
+++ b/pkgs/by-name/cl/clifm/package.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "clifm";
-  version = "1.28";
+  version = "1.29";

  src = fetchFromGitHub {
    owner = "leo-arch";
    repo = "clifm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w2hUwyQvGlYrSfpKNkUhs7WHsn+WgBk2t7t9dUOGST4=";
+    hash = "sha256-SOsyKaAYy32FIy4I63NRZJ1RawDAlAub/W9+7AZA1XA=";
  };

  buildInputs = [
--- a/pkgs/by-name/co/codex-security/package.nix
+++ b/pkgs/by-name/co/codex-security/package.nix
@@ -0,0 +1,151 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchurl,
+  fetchPnpmDeps,
+  pnpm_11,
+  nodejs,
+  pnpmConfigHook,
+  makeWrapper,
+  autoPatchelfHook,
+  git,
+  ncurses,
+  python3,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+  nix-update-script,
+}:
+
+let
+  nativePluginTarget =
+    {
+      aarch64-darwin = "darwin-arm64";
+      aarch64-linux = "linux-arm64-gnu";
+      x86_64-darwin = "darwin-x64";
+      x86_64-linux = "linux-x64-gnu";
+    }
+    .${stdenv.hostPlatform.system};
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "codex-security";
+  version = "0.1.31";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "openai";
+    repo = "codex-security";
+    tag = "npm-v${finalAttrs.version}";
+    hash = "sha256-TA0dxV9VYvvmPU2ZqI5i0XGHaIzNYhqlkLPztZMbtCQ=";
+  };
+
+  npmPackage = fetchurl {
+    url = "https://registry.npmjs.org/@openai/codex-security/-/codex-security-${finalAttrs.version}.tgz";
+    hash = "sha512-XdxIQ+JQH3iysFPW2VdFcKAJJo+M+G4hR9x/KlVimMcbmocDVtQT+trjjfNPqZUdb2ZHrW7HHGepeRhMbMvCHQ==";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/sdk/typescript";
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      sourceRoot
+      ;
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-7gu3a76l+5XgIbpjr2NFt5Wcp/+LRjUNAaxZ0cW8T8c=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm_11
+    pnpmConfigHook
+    makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    stdenv.cc.cc.lib
+    ncurses
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Reinstall with only the production dependencies to keep the closure small.
+    rm -rf node_modules
+    pnpm install --force --offline --prod --ignore-scripts --frozen-lockfile
+
+    mkdir -p "$out/lib/codex-security"
+    cp -r bin dist node_modules package.json LICENSE README.md \
+      "$out/lib/codex-security/"
+
+    # The plugin bundle is generated during npm prepack and is not in the source tag.
+    tar --extract --gzip --file=${finalAttrs.npmPackage} \
+      --directory="$out/lib/codex-security" --strip-components=1 \
+      package/_bundled_plugin
+
+    find "$out/lib/codex-security/_bundled_plugin/mcp/native" \
+      -mindepth 1 -maxdepth 1 -type d \
+      ! -name licenses ! -name ${lib.escapeShellArg nativePluginTarget} \
+      -exec rm --recursive --force {} +
+
+    find "$out/lib/codex-security/node_modules" -name "*.android*" -delete
+
+    makeWrapper "${lib.getExe nodejs}" "$out/bin/codex-security" \
+      --add-flags "$out/lib/codex-security/bin/codex-security.mjs" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          git
+          python3
+        ]
+      }"
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "npm-v(.*)"
+    ];
+  };
+
+  meta = {
+    description = "CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code";
+    homepage = "https://github.com/openai/codex-security";
+    changelog = "https://github.com/openai/codex-security/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sheeeng ];
+    mainProgram = "codex-security";
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryNativeCode
+    ];
+  };
+})
--- a/pkgs/by-name/da/dae/package.nix
+++ b/pkgs/by-name/da/dae/package.nix
@@ -10,17 +10,17 @@

 buildGoModule (finalAttrs: {
  pname = "dae";
-  version = "2.0.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "daeuniverse";
    repo = "dae";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hzX3b86BHvxXQZotSteiHoyBMF/P4WubeuJ6xpxa8ac=";
+    hash = "sha256-+Gls/lFhOjzfPisgWS96mEevI0mMtQ139Zf4NIik2X8=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-S2dNFvMeZqGhzu+sIBGeaET4bQXfeucao6XR4QSTpog=";
+  vendorHash = "sha256-N2noQXRV9Vewie4PiWkjDeX6U2+kF1kQ9L10kZ5X/LI=";

  proxyVendor = true;

--- a/pkgs/by-name/ea/easyrsa/package.nix
+++ b/pkgs/by-name/ea/easyrsa/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "easyrsa";
-  version = "3.2.6";
+  version = "3.2.7";

  src = fetchFromGitHub {
    owner = "OpenVPN";
    repo = "easy-rsa";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-xzCaUR97kS5pbUCTyV9i4lF59nudPJqnI7T2VkReJko=";
+    hash = "sha256-3uGAFb5nrW+35hdwMoESi3Xu8SIuwZ22B9ZAfyd9MSY=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/es/essh/package.nix
+++ b/pkgs/by-name/es/essh/package.nix
@@ -10,18 +10,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "essh";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "matthart1983";
    repo = "essh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+NBKATXTaKaXjkVIrXJvYibI/Xbcuh048kuMZShVjo8=";
+    hash = "sha256-amv4//HWf928oKHiZEdhJo4EzeFDCDXSz2fy7PT0CIs=";
  };

  __structuredAttrs = true;

-  cargoHash = "sha256-IU9TNPJPGT+KgrCTt6tcgLHudNpJeAtus4NAcjaQYAE=";
+  cargoHash = "sha256-DWWzQ4T2FiOy8JzepAgsV0fr73RMSaNuoCDp55vaaJo=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,13 +17,13 @@
 }:

 let
-  version = "0.316.0";
+  version = "0.316.1";

  src = fetchFromGitHub {
    owner = "evcc-io";
    repo = "evcc";
    tag = version;
-    hash = "sha256-oIdZ+BInnC9sIEPNNMmxJNvomcNq16CakvoZu3WMa1Q=";
+    hash = "sha256-WGg2XaaPS0zuRp/6hhLytKDZEfcMVmPF2Z0xDiGq8Ks=";
  };

  vendorHash = "sha256-X5MnC0lsJkgxa60IzGA2xZ+x81XqFRDmQvKqG+DnWYk=";
--- a/pkgs/by-name/fr/framework-tool-tui/package.nix
+++ b/pkgs/by-name/fr/framework-tool-tui/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "framework-tool-tui";
-  version = "0.8.5";
+  version = "0.8.6";

  src = fetchFromGitHub {
    owner = "grouzen";
    repo = "framework-tool-tui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AvxLx3BoAcbL7iekRZwlSA04VdBN3EVZYOCsPfZ9ZFc=";
+    hash = "sha256-8fnpgO6iOkOldh1LWrk7lgLR51lk5vKC1k9/qbrhuC8=";
  };

-  cargoHash = "sha256-y+QJ4gKZ17oYxDLnt3UrGRmdEF1OJqzxvsJTKsYNOFw=";
+  cargoHash = "sha256-+Baf6BFb8DtRoVBM/P2pVidiq+BA+tWt0XqKYwsSh7o=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ udev ];
--- a/pkgs/by-name/fr/fromager/package.nix
+++ b/pkgs/by-name/fr/fromager/package.nix
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "fromager";
-  version = "0.95.0";
+  version = "0.97.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "python-wheel-build";
    repo = "fromager";
    tag = finalAttrs.version;
-    hash = "sha256-9+JYWEVfqG8e0OYE0AxTTtGESLTR/xcZhQMsDEuAM34=";
+    hash = "sha256-u+avrDFOWhpPMXjY5ZlAprjinkUxY1nUqbGtndrbMkY=";
  };

  build-system = with python3Packages; [
@@ -55,6 +55,15 @@ python3Packages.buildPythonApplication (finalAttrs: {
    writableTmpDirAsHomeHook
  ];

+  # Some tests launch ignored background requests to placeholder URLs. Avoid
+  # backoff retries: https://github.com/python-wheel-build/fromager/pull/1348
+  env.FROMAGER_HTTP_RETRIES = 0;
+
+  # Tests share repository directories and race during setup:
+  # https://github.com/python-wheel-build/fromager/pull/1349
+  dontUsePytestXdist = true;
+  pytestFlags = [ "--numprocesses=0" ];
+
  pythonImportsCheck = [
    "fromager"
  ];
--- a/pkgs/by-name/gl/glpi-agent/package.nix
+++ b/pkgs/by-name/gl/glpi-agent/package.nix
@@ -16,13 +16,13 @@

 perlPackages.buildPerlPackage rec {
  pname = "glpi-agent";
-  version = "1.19";
+  version = "1.20";

  src = fetchFromGitHub {
    owner = "glpi-project";
    repo = "glpi-agent";
    tag = version;
-    hash = "sha256-KAvGfuHk/B4uDYuZqG9NMCrqWfW04nkTmN4NF5Wr1mw=";
+    hash = "sha256-2q1Isx7wFfAcyhhg4lMLV6cOXpfH+zHI9/E5rba/mSA=";
  };

  postPatch = ''
--- a/pkgs/by-name/go/gogup/package.nix
+++ b/pkgs/by-name/go/gogup/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "gogup";
-  version = "1.9.3";
+  version = "1.10.2";

  src = fetchFromGitHub {
    owner = "nao1215";
    repo = "gup";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Y2DjbngL0Xp8oleTfRK7SwcPkE6QmpdzZdwI//IL0Qg=";
+    hash = "sha256-rPIO4MqqVDbf8dtKEvC5fhWnrdeI/QdHq3nQZayGEO0=";
  };

-  vendorHash = "sha256-u5fP8nBwtoSAVNI6NBlPpMjCc27oZ9/By6wMxHudgR4=";
+  vendorHash = "sha256-8Y/XBNfo/XgKXrBmOK1+yydTMbdbtUzD1toubS9xC6Q=";
  doCheck = false;

  ldflags = [
--- a/pkgs/by-name/gv/gvm-libs/package.nix
+++ b/pkgs/by-name/gv/gvm-libs/package.nix
@@ -26,13 +26,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gvm-libs";
-  version = "23.10.1";
+  version = "23.11.0";

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = "gvm-libs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-f5pqUrpBEErBOLo0yO0CDNkJunSoF5Fvs0e8cDllBMI=";
+    hash = "sha256-GsZMk5Z0epLtRFfR2duzXgkparu5JMY3uUm8uNnyI9w=";
  };

  postPatch = ''
--- a/pkgs/by-name/ia/iaito/package.nix
+++ b/pkgs/by-name/ia/iaito/package.nix
@@ -8,7 +8,6 @@
  qt6Packages,
  radare2,
  xvfb-run,
-  breakpointHook,
  writableTmpDirAsHomeHook,
  stdenv,
 }:
@@ -50,7 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
    python3
    qt6Packages.qttools
    qt6Packages.wrapQtAppsHook
-    breakpointHook
  ];

  buildInputs = [
--- a/pkgs/by-name/in/intel-oneapi-toolkit/package.nix
+++ b/pkgs/by-name/in/intel-oneapi-toolkit/package.nix
@@ -329,6 +329,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [
      balsoft
      kilyanni
+      recutita
    ];
    platforms = [ "x86_64-linux" ];
  };
--- a/pkgs/by-name/is/isponsorblocktv/package.nix
+++ b/pkgs/by-name/is/isponsorblocktv/package.nix
@@ -1,5 +1,6 @@
 {
  fetchFromGitHub,
+  fetchpatch,
  lib,
  python3Packages,
 }:
@@ -16,6 +17,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
    hash = "sha256-VbhkSrF18JluKAKqUsFKkjC0jdYsvjFotYr0aJ4BTKs=";
  };

+  patches = [
+    # Fix iSponsorBlockTV with async-cache 2.x - https://github.com/dmunozv04/iSponsorBlockTV/pull/505
+    (fetchpatch {
+      url = "https://github.com/lukegb/iSponsorBlockTV/commit/110ce5de788ccb262a323f743543e37af914f7fa.patch";
+      hash = "sha256-AW9VwFBMDKo3pJCNc/r5b8vrqpcL1bV8jUl/z85x+jE=";
+    })
+  ];
+
  build-system = with python3Packages; [
    hatchling
    hatch-requirements-txt
--- a/pkgs/by-name/ku/kubernetes-polaris/package.nix
+++ b/pkgs/by-name/ku/kubernetes-polaris/package.nix
@@ -1,23 +1,23 @@
 {
  lib,
  stdenv,
-  buildGoModule,
+  buildGo127Module,
  fetchFromGitHub,
  installShellFiles,
 }:

-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
  pname = "kubernetes-polaris";
-  version = "10.1.7";
+  version = "10.2.5";

  src = fetchFromGitHub {
    owner = "FairwindsOps";
    repo = "polaris";
-    rev = finalAttrs.version;
-    sha256 = "sha256-0uz5Q7RvPTDIo6R6YIsK2jr1UIq1OJN0+IjyWciyA28=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SY7w7ltpoQNEA76ONqSSsDmkcK5s82NIpB/g3DQoCqs=";
  };

-  vendorHash = "sha256-M+/Jtw+SiLY+G3UKtRCFX1j6tH35FIQMX33YgacJAec=";
+  vendorHash = "sha256-MRNqMINPdc1ifhl6fiLb6sO34m50/QsBrCEjy8CiMdA=";

  nativeBuildInputs = [ installShellFiles ];

@@ -28,6 +28,11 @@ buildGoModule (finalAttrs: {
    "-X main.Commit=${finalAttrs.version}"
  ];

+  # These tests don't work in the build sandbox.
+  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "-skip=^TestConfig(FromURL|NoServerError)$"
+  ];
+
  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd polaris \
      --bash <($out/bin/polaris completion bash) \
--- a/pkgs/by-name/li/librice/package.nix
+++ b/pkgs/by-name/li/librice/package.nix
@@ -11,22 +11,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "librice";
-  # Cannot bump to 0.4.0 because it breaks webkitgtk_4_1's enableExperimental build.
-  # /build/webkitgtk-2.52.1/Source/WebCore/platform/rice/GRefPtrRice.h:34:47: error: use of undeclared identifier 'rice_turn_config_ref'; did you mean 'rice_turn_config_free'?
-  # 34 | WTF_DEFINE_GREF_TRAITS_INLINE(RiceTurnConfig, rice_turn_config_ref, rice_turn_config_unref)
-  #    |                                               ^~~~~~~~~~~~~~~~~~~~
-  #    |                                               rice_turn_config_free
-  # Unpin when https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-50/elements/sdk/librice.bst moves to newer version.
-  version = "0.3.0";
+  # Update when https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-50/elements/sdk/librice.bst moves to newer version.
+  version = "0.4.3";

  src = fetchFromGitHub {
    owner = "ystreet";
    repo = "librice";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CM+YoeVdWfnT/RjkHP0ILwMOkFEylFaN83B71r+S5Ik=";
+    hash = "sha256-VBbqRBzRifXtDUuvoOEwzvkyqgWSH+pw309uQiUzQsI=";
  };

-  cargoHash = "sha256-GNqzAFAnOYP5tCE4qb9F9XAlinX1xV4QyBWJjqXb5VE=";
+  cargoHash = "sha256-lrg21Bd+xK3xDGBjVUD+Q5m/EBIXe5po2TBsOenY8vE=";

  nativeBuildInputs = [
    cargo-c
--- a/pkgs/by-name/mi/microcode-intel/package.nix
+++ b/pkgs/by-name/mi/microcode-intel/package.nix
@@ -9,7 +9,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "microcode-intel";
-  version = "20260812";
+  version = "20260925";

  strictDeps = true;
  __structuredAttrs = true;
@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "intel";
    repo = "Intel-Linux-Processor-Microcode-Data-Files";
    tag = "microcode-${finalAttrs.version}";
-    hash = "sha256-Rw40SNaVSnGenRIkuspVzsFXt17GxPUTsRP86aMI4RM=";
+    hash = "sha256-FR3MB7lA6gaJD/cbTTOxqrQaksr9jXpowtmuFWaHoTs=";
  };

  nativeBuildInputs = [ libarchive ];
--- a/pkgs/by-name/mu/muso/package.nix
+++ b/pkgs/by-name/mu/muso/package.nix
@@ -9,7 +9,9 @@

 rustPlatform.buildRustPackage {
  pname = "muso";
-  version = "unstable-2021-09-02";
+  version = "2.0.0-unstable-2021-09-02";
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "quebin31";
--- a/pkgs/by-name/ne/nest-cli/package.nix
+++ b/pkgs/by-name/ne/nest-cli/package.nix
@@ -9,16 +9,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "nest-cli";
-  version = "12.0.3";
+  version = "12.0.7";

  src = fetchFromGitHub {
    owner = "nestjs";
    repo = "nest-cli";
    tag = finalAttrs.version;
-    hash = "sha256-cy1fXc0ZUtIRlFRJfsK2Sols9CPQIJ39Kf+1wgIJH+Q=";
+    hash = "sha256-bR4+0i3Cck29Y9i3l43i5oh76A2N0GbGg1xw8ZekVqk=";
  };

-  npmDepsHash = "sha256-gyRquPh4lOicS73J9WkWZ1NTbDndaU4yYDgpiDqkKug=";
+  npmDepsHash = "sha256-UY4hpx1BxqcNtwfNNPqV1r5+OE7JsL142eOMrxPnSQI=";
  npmFlags = [ "--legacy-peer-deps" ];

  env = {
--- a/pkgs/by-name/no/noctalia-greeter/package.nix
+++ b/pkgs/by-name/no/noctalia-greeter/package.nix
@@ -32,7 +32,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "noctalia-greeter";
-  version = "1.5.0";
+  version = "1.6.0";

  __structuredAttrs = true;
  strictDeps = true;
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "noctalia-dev";
    repo = "noctalia-greeter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JgPgbmlUOKlgCX/KDfRF+z9ID80+Q7CcdaJFh5eaFjU=";
+    hash = "sha256-agpHRmhsUL4ZNFseCNilGSiC/cc0S2tC1ZvC5rXmgtY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/no/noctalia/package.nix
+++ b/pkgs/by-name/no/noctalia/package.nix
@@ -56,13 +56,13 @@ stdenv.mkDerivation (finalAttrs: {
  __structuredAttrs = true;

  pname = "noctalia";
-  version = "5.1.0";
+  version = "5.2.0";

  src = fetchFromGitHub {
    owner = "noctalia-dev";
    repo = "noctalia";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-A7ehoEnAJw4k1Qwpr/WkOkLXWZAVU970uB+sm6nBxP0=";
+    hash = "sha256-RfRxWi9PfJVSyoLrLj5mQ5vo24FjkgfBIi+UmE96zZo=";
  };

  strictDeps = true;
--- a/pkgs/by-name/ol/olympus-unwrapped/package.nix
+++ b/pkgs/by-name/ol/olympus-unwrapped/package.nix
@@ -22,9 +22,9 @@ let

  phome = "$out/lib/olympus";
  # The following variables are to be updated by the update script.
-  version = "26.09.15.05";
-  buildId = "5878"; # IMPORTANT: This line is matched with regex in update.sh.
-  rev = "2472132ac23a30701c1eb928dbd95858113ded25";
+  version = "26.09.27.01";
+  buildId = "5915"; # IMPORTANT: This line is matched with regex in update.sh.
+  rev = "1c0163a5b03708cee1fc5d53d5e9869ad9e14f22";
 in
 buildDotnetModule {
  pname = "olympus-unwrapped";
@@ -37,7 +37,7 @@ buildDotnetModule {
    owner = "EverestAPI";
    repo = "Olympus";
    fetchSubmodules = true; # Required. See upstream's README.
-    hash = "sha256-pQjRiVVpF2J7qR6BfvdC/jkHGVcUJsXmq1tUTs7GmmY=";
+    hash = "sha256-fVyhX2A/aBDUq/jdkkocM5XkLBk12ZoBrMKDOOzL+/0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pd/pdfid/package.nix
+++ b/pkgs/by-name/pd/pdfid/package.nix
@@ -38,7 +38,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    homepage = "https://blog.didierstevens.com/programs/pdf-tools/";
    license = lib.licenses.free;
    mainProgram = "pdfid";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ eljamm ];
    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.29.3";

  passthru.updateScript = _experimental-update-script-combinators.sequence [
-    (nix-update-script { })
+    (nix-update-script { extraArgs = [ "--use-github-releases" ]; })
    (lib.getExe (writeShellApplication {
      name = "podman-desktop-dependencies-updater";
      runtimeInputs = [
--- a/pkgs/by-name/ra/radicle-explorer/package.nix
+++ b/pkgs/by-name/ra/radicle-explorer/package.nix
@@ -10,13 +10,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "radicle-explorer";
-  version = "0-unstable-2026-09-14";
+  version = "0-unstable-2026-09-25";

  src = fetchFromRadicle {
    seed = "seed.radicle.dev";
    repo = "z4V1sjrXqjvFdnCUbxPFqd5p4DtH5";
-    rev = "f1ee718886061b90fac69c53000613eeccbab09f";
-    hash = "sha256-BeZ5xtJVkoSXYggiT/tmJPUcPQoQMQg2FkCkuQvHZC0=";
+    rev = "00f079d0d9fb4828e570bc568ffde1dcd43ebb25";
+    hash = "sha256-+tODL7EpQ765GqlOYVFGx48+iclK/1rwUnXzfqTy7z8=";
  };

  npmDepsHash = "sha256-Bwlrh4DivqWhxuHcbJGJtatsGRI0V8BwTT3RtqoJ7lU=";
--- a/pkgs/by-name/ra/ramalama/package.nix
+++ b/pkgs/by-name/ra/ramalama/package.nix
@@ -17,14 +17,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "ramalama";
-  version = "0.22.0";
+  version = "0.25.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "containers";
    repo = "ramalama";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-k3VfZ9+ATu2Cwx531D0WVagjn1ZMIKR1i3yyq+3IGJ4=";
+    hash = "sha256-AwlB2JeOMFCXoIovqfr9nhy36QWC2m42kHFIGg4dJFo=";
  };

  build-system = with python3Packages; [
@@ -77,6 +77,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
    writableTmpDirAsHomeHook
  ];

+  __darwinAllowLocalNetworking = true;
+
  preCheck = ''
    export PATH="$out/bin:$PATH"
  '';
--- a/pkgs/by-name/ra/ramalama/tests/podman-images.json
+++ b/pkgs/by-name/ra/ramalama/tests/podman-images.json
@@ -1,15 +1,15 @@
 {
  "imageName": "quay.io/ramalama/ramalama",
-  "imageTag": "0.22",
-  "imageDigest": "sha256:01f652adb2d7bed7c3eb960ee3fe1dc9b6addff003ed58932048cee01db78302",
+  "imageTag": "0.25",
+  "imageDigest": "sha256:d60dfda3113e127071d2b2679921c763d0eb7a0733596f68bf93a4ef1ca1216e",
  "images": {
    "x86_64-linux": {
      "arch": "amd64",
-      "hash": "sha256-Llykx761YUa50nsckZELxNSbjeDxBElWWshT7KQd5pE="
+      "hash": "sha256-CCEvlPHwq4R/gDDJGZS43rU1aEJojutatigGx1KMcSM="
    },
    "aarch64-linux": {
      "arch": "arm64",
-      "hash": "sha256-9It9EuYxmZ2UThQYr9FD63C/uBVS1ufP7bnZeA9psqI="
+      "hash": "sha256-lHe+3SDmAcdgZf42JIX+eTv3aJRcwepdz1qhKqr93Ng="
    }
  }
 }
--- a/pkgs/by-name/rn/rnm/package.nix
+++ b/pkgs/by-name/rn/rnm/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  meta = {
-    homepage = "https://neurobin.org/projects/softwares/unix/rnm/";
+    homepage = "https://github.com/neurobin/rnm";
    description = "Bulk rename utility";
    changelog = "https://github.com/neurobin/rnm/blob/${finalAttrs.version}/ChangeLog";
    platforms = lib.platforms.all;
--- a/pkgs/by-name/ru/ruri/package.nix
+++ b/pkgs/by-name/ru/ruri/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Self-contained Linux container implementation";
-    homepage = "https://wiki.crack.moe/ruri";
+    homepage = "https://ruri.zip";
    downloadPage = "https://github.com/RuriOSS/ruri";
    changelog = "https://github.com/RuriOSS/ruri/releases/tag/${finalAttrs.src.tag}";
    mainProgram = "ruri";
--- a/pkgs/by-name/sc/scipopt-gcg/package.nix
+++ b/pkgs/by-name/sc/scipopt-gcg/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
    changelog = "https://gcg.or.rwth-aachen.de/doc-3.5.0/RN${lib.versions.major version}${lib.versions.minor version}.html";
    description = "Branch-and-Price & Column Generation for Everyone";
    license = lib.licenses.lgpl3Plus;
-    homepage = "https://gcg.zib.de";
+    homepage = "https://gcg.or.rwth-aachen.de";
    mainProgram = "gcg";
  };
 }
--- a/pkgs/by-name/se/seamly2d/package.nix
+++ b/pkgs/by-name/se/seamly2d/package.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Open source patternmaking software";
-    homepage = "https://seamly.net/";
+    homepage = "https://seamly.io/";
    license = lib.licenses.gpl3;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ WhittlesJr ];
--- a/pkgs/by-name/se/selinux-python/package.nix
+++ b/pkgs/by-name/se/selinux-python/package.nix
@@ -105,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "SELinux policy core utilities written in Python";
    license = lib.licenses.gpl2Plus;
-    homepage = "https://selinuxproject.org";
+    homepage = "https://github.com/SELinuxProject/selinux";
    inherit (libsepol.meta) maintainers;
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/se/selinux-sandbox/package.nix
+++ b/pkgs/by-name/se/selinux-sandbox/package.nix
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
    mainProgram = "sandbox";
    description = "SELinux sandbox utility";
    license = lib.licenses.gpl2Only;
-    homepage = "https://selinuxproject.org";
+    homepage = "https://github.com/SELinuxProject/selinux";
    platforms = lib.platforms.linux;
    inherit (selinux-python.meta) maintainers;
  };
--- a/pkgs/by-name/se/sequelpro/package.nix
+++ b/pkgs/by-name/se/sequelpro/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {

  meta = {
    description = "MySQL database management for macOS";
-    homepage = "http://www.sequelpro.com/";
+    homepage = "https://github.com/sequelpro/sequelpro";
    license = lib.licenses.mit;
    platforms = lib.platforms.darwin;
  };
--- a/pkgs/by-name/sh/shc/package.nix
+++ b/pkgs/by-name/sh/shc/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
  };

  meta = {
-    homepage = "https://neurobin.org/projects/softwares/unix/shc/";
+    homepage = "https://github.com/neurobin/shc";
    description = "Shell Script Compiler";
    mainProgram = "shc";
    platforms = lib.platforms.all;
--- a/pkgs/by-name/si/sigal/package.nix
+++ b/pkgs/by-name/si/sigal/package.nix
@@ -54,7 +54,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
  meta = {
    description = "Yet another simple static gallery generator";
    mainProgram = "sigal";
-    homepage = "http://sigal.saimon.org/";
+    homepage = "https://sigal.readthedocs.io";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      matthiasbeyer
--- a/pkgs/by-name/si/signify/package.nix
+++ b/pkgs/by-name/si/signify/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
      OpenBSDs signing tool, which uses the Ed25519 public key signature system
      for fast signing and verification of messages using small public keys.
    '';
-    homepage = "https://www.tedunangst.com/flak/post/signify";
+    homepage = "https://codeberg.org/aperezdc/signify";
    license = lib.licenses.isc;
    maintainers = [ lib.maintainers.rlupton20 ];
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/sk/skills/package.nix
+++ b/pkgs/by-name/sk/skills/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "skills";
-  version = "1.6.0";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "vercel-labs";
    repo = "skills";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nbRboP1tM7Jf0XcBgusg+7oPe9IwWwjRdqVO+cPagxs=";
+    hash = "sha256-/B2el3+KYXohGCM4JaHl2EUx1c6mlYdUNrWiE0z/7lA=";
  };

  pnpmDeps = fetchPnpmDeps {
--- a/pkgs/by-name/so/soju/package.nix
+++ b/pkgs/by-name/so/soju/package.nix
@@ -12,13 +12,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "soju";
-  version = "0.11.0";
+  version = "0.11.1";

  src = fetchFromCodeberg {
    owner = "emersion";
    repo = "soju";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pen7Lb/aUWY67Y8KBCGfBkG1pX3sdQ8+D9L7xw8afaQ=";
+    hash = "sha256-OoFAdHnExm6Li5bTAmS/KdRkkpHPLP321GAYYqByrNI=";
  };

  vendorHash = "sha256-LiTr+ilKYRA3K93RjVGsmWm2jvImmt9YIYTZPtXv6cE=";
--- a/pkgs/by-name/so/soundfont-fluid/package.nix
+++ b/pkgs/by-name/so/soundfont-fluid/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation {

  meta = {
    description = "Frank Wen's pro-quality GM/GS soundfont";
-    homepage = "http://www.hammersound.net/";
+    homepage = "https://www.ibiblio.org/thammer/HammerSound/hs_frontpage.html";
    license = lib.licenses.mit;
    platforms = lib.platforms.all;
    maintainers = [ ];
--- a/pkgs/by-name/so/source-han-code-jp/package.nix
+++ b/pkgs/by-name/so/source-han-code-jp/package.nix
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
    description = "Monospaced Latin font suitable for coding";
    maintainers = with lib.maintainers; [ mt-caret ];
    platforms = with lib.platforms; all;
-    homepage = "https://blogs.adobe.com/CCJKType/2015/06/source-han-code-jp.html";
+    homepage = "https://ccjktype.fonts.adobe.com/2015/06/source-han-code-jp.html";
    license = lib.licenses.ofl;
  };
 }
--- a/pkgs/by-name/sp/spatial-shell/package.nix
+++ b/pkgs/by-name/sp/spatial-shell/package.nix
@@ -28,7 +28,7 @@ ocamlPackages.buildDunePackage rec {

  meta = {
    description = "Implementing a spatial model inspired by Material Shell, for i3 and sway";
-    homepage = "https://spatial-shell.app";
+    homepage = "https://github.com/lthms/spatial-shell";
    changelog = "https://github.com/lthms/spatial-shell/blob/${src.rev}/CHANGES.md";
    license = lib.licenses.mpl20;
    maintainers = with lib.maintainers; [ fgaz ];
--- a/pkgs/by-name/ss/ssdeep/package.nix
+++ b/pkgs/by-name/ss/ssdeep/package.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Program for calculating fuzzy hashes";
    mainProgram = "ssdeep";
-    homepage = "http://www.ssdeep.sf.net";
+    homepage = "https://ssdeep-project.github.io/ssdeep/index.html";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.unix;
    maintainers = [ lib.maintainers.thoughtpolice ];
--- a/pkgs/by-name/st/streamlink/package.nix
+++ b/pkgs/by-name/st/streamlink/package.nix
@@ -11,12 +11,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "streamlink";
-  version = "8.6.0";
+  version = "8.6.1";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-lNp9AXalVh5FUYN24LGQe1lfecfuifMb/fsp2squjoA=";
+    hash = "sha256-Kbp27W1pE8nmm8cw/FhLWBsoYAIq8YZhodCMja7gNkI=";
  };

  patches = [
--- a/pkgs/by-name/sw/swh_lv2/package.nix
+++ b/pkgs/by-name/sw/swh_lv2/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = "make install-system";

  meta = {
-    homepage = "http://plugin.org.uk";
+    homepage = "https://github.com/swh/lv2";
    description = "LV2 version of Steve Harris' SWH plugins";
    longDescription = ''
      SWH plugins include:
--- a/pkgs/by-name/sw/swift-quit/package.nix
+++ b/pkgs/by-name/sw/swift-quit/package.nix
@@ -27,7 +27,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  meta = {
    description = "Automatic quitting of macOS apps when closing their windows";
-    homepage = "https://swiftquit.com/";
+    homepage = "https://github.com/onebadidea/swiftquit";
    license = lib.licenses.gpl3;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    maintainers = with lib.maintainers; [ Enzime ];
--- a/pkgs/by-name/sy/sympa/package.nix
+++ b/pkgs/by-name/sy/sympa/package.nix
@@ -122,7 +122,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Open source mailing list manager";
-    homepage = "https://www.sympa.org";
+    homepage = "https://www.sympa.community/sympa/";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [
      sorki
--- a/pkgs/by-name/t-/t-rex/package.nix
+++ b/pkgs/by-name/t-/t-rex/package.nix
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {

  meta = {
    description = "Vector tile server specialized on publishing MVT tiles";
-    homepage = "https://t-rex.tileserver.ch/";
+    homepage = "https://t-rex.bbox.earth/";
    changelog = "https://github.com/t-rex-tileserver/t-rex/blob/v${version}/CHANGELOG.md";
    license = lib.licenses.mit;
    teams = [ lib.teams.geospatial ];
--- a/pkgs/by-name/tb/tbox/package.nix
+++ b/pkgs/by-name/tb/tbox/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Glib-like multi-platform c library";
-    homepage = "https://docs.tboox.org";
+    homepage = "https://tboox.top";
    license = lib.licenses.asl20;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ wineee ];
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@@ -24,13 +24,13 @@ assert lib.elem lineEditingLibrary [
 ];
 stdenv.mkDerivation (finalAttrs: {
  pname = "trealla";
-  version = "3.10.3";
+  version = "3.11.4";

  src = fetchFromGitHub {
    owner = "trealla-prolog";
    repo = "trealla";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-QWjFbBnIHBTplx2nmD5mGL1bfhUy5o2T4izAPeiy2XE=";
+    hash = "sha256-67VZDwwRieFhxw0/9mkFkqWR79Nm70C0LJTvtLbGcik=";
  };

  postPatch = ''
--- a/pkgs/by-name/tr/trufflehog/package.nix
+++ b/pkgs/by-name/tr/trufflehog/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "trufflehog";
-  version = "3.97.5";
+  version = "3.97.9";

  src = fetchFromGitHub {
    owner = "trufflesecurity";
    repo = "trufflehog";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-zlB41Jv+Ypzl2Hm8jYn15KdC2ZzoWuspIodo2++nqag=";
+    hash = "sha256-SpKBUoaP7ZoNzybFL9EUcywV0bkx+bSFNyhyBCqwz5Y=";
  };

-  vendorHash = "sha256-5KvlWAa1ZYQ9R29ZsVLLWdTvlMC9rnOpMEKP9kXehLc=";
+  vendorHash = "sha256-JfymijrnTsoHqrltauqFU/ccPGjySEufkS9LoymCGuQ=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/um/umap/package.nix
+++ b/pkgs/by-name/um/umap/package.nix
@@ -19,7 +19,7 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
  pname = "umap";
-  version = "3.7.3";
+  version = "3.8.1";
  pyproject = true;

  __structuredAttrs = true;
@@ -28,7 +28,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
    owner = "umap-project";
    repo = "umap";
    tag = finalAttrs.version;
-    hash = "sha256-rM1o83/udkqiVD0nSiAjNVAzriJr2ztvSXh45wxmYzU=";
+    hash = "sha256-uhWa8CqNjqUAaPALWq6YiOFHahNmw4AVQWhAyfs18CU=";
  };

  build-system = [
@@ -43,6 +43,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
      django-environ
      django-probes
      django-storages
+      httpx
      pillow
      psycopg
      pydantic
@@ -95,6 +96,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
    with python.pkgs;
    [
      pytest
+      pytest-asyncio
      pytest-django
      pytest-playwright
      pytest-xdist
@@ -122,10 +124,22 @@ python.pkgs.buildPythonApplication (finalAttrs: {
  ];

  disabledTests = [
-    # The proxy_request tests require network
+    # Needs network: umap.utils.validate_url resolves the target hostname to
+    # reject private IPs, so every AjaxProxy test fails DNS in the sandbox.
    "proxy_request_with"
-    "test_good_request_passes"
    "test_valid_proxy_request"
+    "test_invalid_ttl_is_coerced_to_default"
+    "test_proxy_caches_response"
+    "test_proxy_clears_stale_semaphore"
+    "test_proxy_does_not_cache_upstream_error"
+    "test_proxy_falls_back_when_no_content_type"
+    "test_proxy_fast_path_ignores_held_semaphore"
+    "test_proxy_long_url_does_not_exceed_filename_limit"
+    "test_proxy_long_urls_with_common_prefix_do_not_collide"
+    "test_proxy_sets_nosniff"
+    "test_proxy_tolerates_raw_spaces_in_url"
+    # Needs network: fetches a real URL
+    "test_good_request_passes"
  ];

  meta = {
--- a/pkgs/by-name/us/user-scanner/package.nix
+++ b/pkgs/by-name/us/user-scanner/package.nix
@@ -8,7 +8,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "user-scanner";
-  version = "1.5.1";
+  version = "1.5.2";
  pyproject = true;

  __structuredAttrs = true;
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "kaifcodec";
    repo = "user-scanner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lBVKCIpvdYRz80BoaSbFcizs2tLEWankcLeOqu9u4iM=";
+    hash = "sha256-Jg40VMWEL7dW67M45S35phiVHygZUxcM9CmIT7WWdDY=";
  };

  build-system = with python3Packages; [ flit-core ];
--- a/pkgs/by-name/xp/xpra/package.nix
+++ b/pkgs/by-name/xp/xpra/package.nix
@@ -104,14 +104,14 @@ let
 in
 effectiveBuildPythonApplication rec {
  pname = "xpra";
-  version = "6.5.3";
+  version = "6.5.4";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "Xpra-org";
    repo = "xpra";
    tag = "v${version}";
-    hash = "sha256-UDKnkynWoS1feUBRRHXl7emksUmufBL16gmVFslMHpM=";
+    hash = "sha256-OXcZs2bt+ub59buDkw56A3gfOnDHSYP7RBAFOBvwrKY=";
  };

  patches = [
--- a/pkgs/development/interpreters/supercollider/default.nix
+++ b/pkgs/development/interpreters/supercollider/default.nix
@@ -21,7 +21,6 @@
  gitUpdater,
  supercollider-with-plugins,
  supercolliderPlugins,
-  writeText,
  runCommand,
 }:

@@ -87,25 +86,29 @@ stdenv.mkDerivation rec {
    };

    tests = {
-      # test to make sure sclang runs and included plugins are successfully found
+      # Check both language classes and server UGens, without an audio device.
      sclang-sc3-plugins =
        let
          supercollider-with-test-plugins = supercollider-with-plugins.override {
            plugins = with supercolliderPlugins; [ sc3-plugins ];
          };
-          testsc = writeText "test.sc" ''
-            var err = 0;
-            try {
-            MdaPiano.name.postln;
-            } {
-            err = 1;
-            };
-            err.exit;
-          '';
        in
-        runCommand "sclang-sc3-plugins-test" { } ''
-          timeout 60s env XDG_CONFIG_HOME="$(mktemp -d)" QT_QPA_PLATFORM=minimal ${supercollider-with-test-plugins}/bin/sclang ${testsc} >$out
-        '';
+        runCommand "sclang-sc3-plugins-test"
+          {
+            QT_QPA_PLATFORM = "offscreen";
+          }
+          ''
+            export XDG_CONFIG_HOME="$TMPDIR/config"
+            export XDG_DATA_HOME="$TMPDIR/data"
+            export XDG_CACHE_HOME="$TMPDIR/cache"
+            mkdir -p "$out"
+            timeout 60s ${supercollider-with-test-plugins}/bin/sclang \
+              ${./tests/sc3-plugins.scd} "$out" 2>&1 | tee "$out/log"
+            grep -Fq 'SC3 plugins rendered successfully' "$out/log"
+            if grep -E 'ERROR|FAILURE|duplicate' "$out/log"; then
+              exit 1
+            fi
+          '';
    };
  };

--- a/pkgs/development/interpreters/supercollider/tests/sc3-plugins.scd
+++ b/pkgs/development/interpreters/supercollider/tests/sc3-plugins.scd
@@ -0,0 +1,58 @@
+var output = thisProcess.argv[0];
+var definition, score;
+
+try {
+    // Resolve symbols at runtime: an undefined class literal prevents the entire
+    // script (including its error handler and exit) from being compiled.
+    [\MembraneHexagon, \MdaPiano].do { |name|
+        if(name.asClass.isNil) {
+            Error("Missing SC3 class: " ++ name).throw;
+        };
+    };
+
+    definition = SynthDef(\sc3PluginsTest, {
+        // Give each UGen its own output channel so neither can mask a failure.
+        Out.ar(0, \MembraneHexagon.asClass.ar(Impulse.ar(0)));
+        Out.ar(1, \MdaPiano.asClass.ar.sum);
+    });
+    score = Score([
+        [0, [\d_recv, definition.asBytes]],
+        [0, [\s_new, definition.name, 1000, 0, 0]],
+        [1, [\n_free, 1000]]
+    ]);
+
+    score.recordNRT(
+        oscFilePath: output +/+ "score.osc",
+        outputFilePath: output +/+ "sc3.wav",
+        headerFormat: "WAV",
+        sampleFormat: "float",
+        options: ServerOptions.new.numInputBusChannels_(0).numOutputBusChannels_(2),
+        action: { |exitCode|
+            var file, samples;
+            try {
+                if(exitCode != 0) { Error("scsynth exited with " ++ exitCode).throw };
+                file = SoundFile.openRead(output +/+ "sc3.wav");
+                if(file.isNil) { Error("No rendered audio").throw };
+                if(file.numChannels != 2) { Error("Expected two audio channels").throw };
+                if(file.numFrames < 44100) { Error("Incomplete rendered audio").throw };
+                samples = FloatArray.newClear(file.numFrames * file.numChannels);
+                file.readData(samples);
+                file.close;
+                samples.clump(2).flop.do { |channel|
+                    if(channel.any { |sample| sample.isNaN or: { sample.abs == inf } }) {
+                        Error("Invalid SC3 UGen output").throw;
+                    };
+                    if(channel.abs.maxItem <= 0.00001) { Error("Silent SC3 UGen output").throw };
+                };
+                "SC3 plugins rendered successfully".postln;
+                0.exit;
+            } { |error|
+                error.reportError;
+                1.exit;
+            };
+        }
+    );
+} { |error|
+    error.reportError;
+    1.exit;
+};
--- a/pkgs/development/interpreters/supercollider/wrapper.nix
+++ b/pkgs/development/interpreters/supercollider/wrapper.nix
@@ -1,4 +1,5 @@
 {
+  lib,
  symlinkJoin,
  makeWrapper,
  supercollider,
@@ -12,10 +13,19 @@ symlinkJoin {
  nativeBuildInputs = [ makeWrapper ];

  postBuild = ''
+    # --include-path adds to the paths from the user's language configuration,
+    # including an explicit -l configuration (as used by tidal-cycles-full).
+    if [ -d "$out/share/SuperCollider/Extensions" ]; then
+      wrapProgram "$out/bin/sclang" \
+        --add-flags "--include-path $out/share/SuperCollider/Extensions"
+    fi
+
    for exe in $out/bin/*; do
-      wrapProgram $exe \
-        --set SC_PLUGIN_DIR "$out/lib/SuperCollider/plugins" \
-        --set SC_DATA_DIR   "$out/share/SuperCollider"
+      # scide launches sclang, and sclang launches scsynth, through PATH.
+      # The server already loads its core UGens from its compiled-in path.
+      wrapProgram "$exe" \
+        --prefix PATH : "$out/bin" \
+        --prefix SC_PLUGIN_PATH : "${lib.makeSearchPath "lib/SuperCollider/plugins" plugins}"
    done
  '';

--- a/pkgs/development/interpreters/tcl/generic.nix
+++ b/pkgs/development/interpreters/tcl/generic.nix
@@ -193,7 +193,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Tcl scripting language";
-    homepage = "https://www.tcl.tk/";
+    homepage = "https://www.tcl-lang.org/";
    license = lib.licenses.tcltk;
    platforms = lib.platforms.all;
    mainProgram = "tclsh";
--- a/pkgs/development/libraries/tk/generic.nix
+++ b/pkgs/development/libraries/tk/generic.nix
@@ -97,7 +97,7 @@ tcl.mkTclDerivation {

  meta = {
    description = "Widget toolkit that provides a library of basic elements for building a GUI in many different programming languages";
-    homepage = "https://www.tcl.tk/";
+    homepage = "https://www.tcl-lang.org/";
    license = lib.licenses.tcltk;
    platforms = lib.platforms.all;
    mainProgram = "wish";
--- a/pkgs/development/ocaml-modules/apron/default.nix
+++ b/pkgs/development/ocaml-modules/apron/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    license = lib.licenses.lgpl21;
-    homepage = "http://apron.cri.ensmp.fr/library/";
+    homepage = "https://github.com/antoinemine/apron";
    maintainers = [ lib.maintainers.vbgl ];
    description = "Numerical abstract domain library";
    inherit (ocaml.meta) platforms;
--- a/pkgs/development/ocaml-modules/ocurl/default.nix
+++ b/pkgs/development/ocaml-modules/ocurl/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "OCaml bindings to libcurl (deprecated)";
    license = lib.licenses.mit;
-    homepage = "http://ygrek.org.ua/p/ocurl/";
+    homepage = "https://ygrek.org/p/ocurl/";
    maintainers = with lib.maintainers; [
      dandellion
      bennofs
--- a/pkgs/development/ocaml-modules/piqi-ocaml/default.nix
+++ b/pkgs/development/ocaml-modules/piqi-ocaml/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Universal schema language and a collection of tools built around it. These are the ocaml bindings";
-    homepage = "https://piqi.org";
+    homepage = "https://github.com/alavrik/piqi";
    license = lib.licenses.asl20;
    maintainers = [ lib.maintainers.maurer ];
    mainProgram = "piqic-ocaml";
--- a/pkgs/development/ocaml-modules/piqi/default.nix
+++ b/pkgs/development/ocaml-modules/piqi/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
  ];

  meta = {
-    homepage = "https://piqi.org";
+    homepage = "https://github.com/alavrik/piqi";
    description = "Universal schema language and a collection of tools built around it";
    license = lib.licenses.asl20;
    maintainers = [ lib.maintainers.maurer ];
--- a/pkgs/development/ocaml-modules/sawja/default.nix
+++ b/pkgs/development/ocaml-modules/sawja/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation {

  meta = {
    description = "Library written in OCaml, relying on Javalib to provide a high level representation of Java bytecode programs";
-    homepage = "http://sawja.inria.fr/";
+    homepage = "https://github.com/javalib-team/sawja";
    license = lib.licenses.gpl3Plus;
    maintainers = [ lib.maintainers.vbgl ];
    inherit (ocaml.meta) platforms;
--- a/pkgs/development/ocaml-modules/sosa/default.nix
+++ b/pkgs/development/ocaml-modules/sosa/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
  doCheck = true;

  meta = {
-    homepage = "http://www.hammerlab.org/docs/sosa/master/index.html";
+    homepage = "https://github.com/hammerlab/sosa";
    description = "Sane OCaml String API";
    license = lib.licenses.isc;
    maintainers = [ ];
--- a/pkgs/development/ocaml-modules/ssl/default.nix
+++ b/pkgs/development/ocaml-modules/ssl/default.nix
@@ -35,7 +35,7 @@ buildDunePackage rec {
  '';

  meta = {
-    homepage = "http://savonet.rastageeks.org/";
+    homepage = "https://www.liquidsoap.info/ocaml-ssl/ssl/index.html";
    description = "OCaml bindings for libssl";
    license = with lib.licenses; [
      lgpl21Plus
--- a/pkgs/development/ocaml-modules/xml-light/default.nix
+++ b/pkgs/development/ocaml-modules/xml-light/default.nix
@@ -25,7 +25,7 @@ buildDunePackage rec {
      entirely written in OCaml, hence it does not require additional C
      library.
    '';
-    homepage = "http://tech.motion-twin.com/xmllight.html";
+    homepage = "https://github.com/ncannasse/xml-light";
    license = lib.licenses.lgpl21;
    maintainers = [ lib.maintainers.romildo ];
  };
--- a/pkgs/development/ocaml-modules/zmq/default.nix
+++ b/pkgs/development/ocaml-modules/zmq/default.nix
@@ -23,6 +23,6 @@ buildDunePackage rec {
    description = "ZeroMQ bindings for OCaml";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ akavel ];
-    homepage = "https://engineering.issuu.com/ocaml-zmq/";
+    homepage = "https://github.com/issuu/ocaml-zmq";
  };
 }
--- a/pkgs/development/python-modules/aqualogic/default.nix
+++ b/pkgs/development/python-modules/aqualogic/default.nix
@@ -11,14 +11,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "aqualogic";
-  version = "3.10";
+  version = "3.11";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "swilson";
    repo = "aqualogic";
    tag = finalAttrs.version;
-    hash = "sha256-M/08Wu9ANFQlev2nOzlG9R40Nuw5hy5T288dWaqV98g=";
+    hash = "sha256-9+auDJaXCEpANYm2FzsDCvr8jXmIMZFIQs1Za2BIriY=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/asyncmy/default.nix
+++ b/pkgs/development/python-modules/asyncmy/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "asyncmy";
-  version = "0.2.14";
+  version = "0.2.15";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "long2ice";
    repo = "asyncmy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bUpuFHfHW5mDtcbLk7Ro2gGq48sw3v3adY8tQ23e460=";
+    hash = "sha256-wAhw2V/7N7UzxSAXzggZekP6BWW3WPGTcs3LDUi9TgA=";
  };

  build-system = [
--- a/pkgs/development/python-modules/genai-prices/default.nix
+++ b/pkgs/development/python-modules/genai-prices/default.nix
@@ -4,7 +4,8 @@
  fetchFromGitHub,

  # build-system
-  uv-build,
+  hatchling,
+  uv-dynamic-versioning,

  # dependencies
  httpx2,
@@ -13,20 +14,21 @@

 buildPythonPackage (finalAttrs: {
  pname = "genai-prices";
-  version = "0.1.3";
+  version = "0.1.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "genai-prices";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9fXJ+ZcQ7v2EjRx5LQVNsOSK32T4h0cAp4dKTTDRlpo=";
+    hash = "sha256-DNNFYB2+Rvq/QTjBSf0bGrTpIm8VmmjIuojvNg+Hbxk=";
  };

  sourceRoot = "${finalAttrs.src.name}/packages/python";

  build-system = [
-    uv-build
+    hatchling
+    uv-dynamic-versioning
  ];

  dependencies = [
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202609261";
+  version = "0.1.202609271";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JRCoF2h1gas4i/7BoN+No6wz+SzbProPo38id9Q+3ok=";
+    hash = "sha256-P3aUN/WHgN9zAql0lhWPohHGkJ9LA2EZWOg3QgvQQsA=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/imgw-pib/default.nix
+++ b/pkgs/development/python-modules/imgw-pib/default.nix
@@ -12,19 +12,19 @@
  pytest-asyncio,
  pytestCheckHook,
  setuptools,
-  syrupy,
+  syrupy_6,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "imgw-pib";
-  version = "2.5.1";
+  version = "2.5.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bieniu";
    repo = "imgw-pib";
    tag = finalAttrs.version;
-    hash = "sha256-nxQeYLDf7TEbbvbEygssH0X/sXLnoXoB1teZM8w70jQ=";
+    hash = "sha256-pvPPdtTO4Eq2fge8gjXMPrFTtw+qnUvVN+FqimFLQqg=";
  };

  build-system = [ setuptools ];
@@ -51,7 +51,7 @@ buildPythonPackage (finalAttrs: {
    freezegun
    pytest-asyncio
    pytestCheckHook
-    syrupy
+    syrupy_6
  ];

  meta = {
--- a/pkgs/development/python-modules/mplhep-data/default.nix
+++ b/pkgs/development/python-modules/mplhep-data/default.nix
@@ -29,7 +29,7 @@ buildPythonPackage rec {
    homepage = "https://github.com/scikit-hep/mplhep_data";
    license = with lib.licenses; [
      mit
-      gfl
+      lppl13c
      ofl
    ];
    maintainers = with lib.maintainers; [ veprbl ];
--- a/pkgs/development/python-modules/odl-renderer/default.nix
+++ b/pkgs/development/python-modules/odl-renderer/default.nix
@@ -0,0 +1,96 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  aiohttp,
+  pillow,
+  qrcode,
+  resize-image,
+
+  # optional-dependencies
+  hypothesis,
+  imagehash,
+  syrupy,
+
+  # tests
+  pytest-asyncio,
+  pytestCheckHook,
+  pytest-cov-stub,
+  pytest-xdist,
+  time-machine,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "odl-renderer";
+  version = "0.5.12";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "OpenDisplay";
+    repo = "odl-renderer";
+    tag = "odl-renderer-v${finalAttrs.version}";
+    hash = "sha256-3XTP5ymW6kbNnBQV9UysCG2O4gqQ6+4TmrIpTiu7JJ0=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    aiohttp
+    pillow
+    qrcode
+    resize-image
+  ];
+
+  optional-dependencies = {
+    property = [
+      hypothesis
+    ];
+    visual = [
+      imagehash
+      syrupy
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+    pytest-cov-stub
+    pytest-xdist
+    time-machine
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
+
+  disabledTestPaths = [
+    # likely pillow mismatch, they test exact raw image output match
+    "tests/visual/test_color_rendering.py::TestGrayColorVisualRegression::test_gray_text_inline_markup"
+    "tests/visual/test_layouts.py::TestLayoutVisualRegression::test_dashboard_layout"
+    "tests/visual/test_plot_rendering.py::TestPlotVisualRegression::test_plot_right_legend"
+    "tests/visual/test_plot_rendering.py::TestPlotVisualRegression::test_plot_with_axes_and_legend"
+    "tests/visual/test_text_rendering.py::TestTextVisualRegression::test_basic_text"
+    "tests/visual/test_text_rendering.py::TestTextVisualRegression::test_text_colors"
+    "tests/visual/test_text_rendering.py::TestTextVisualRegression::test_text_size"
+    "tests/visual/test_text_rendering.py::TestTextVisualRegression::test_text_sizes"
+    "tests/visual/test_transform_rendering.py::TestTransformVisualRegression::test_rotated_text"
+  ];
+
+  pythonImportsCheck = [
+    "odl_renderer"
+  ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "";
+    homepage = "https://github.com/OpenDisplay/odl-renderer";
+    changelog = "https://github.com/OpenDisplay/odl-renderer/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -10,9 +10,10 @@
  uv-dynamic-versioning,

  # dependencies
+  anyio,
  genai-prices,
  griffelib,
-  httpx,
+  httpx2,
  opentelemetry-api,
  pydantic-graph,
  pydantic,
@@ -22,14 +23,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydantic-ai-slim";
-  version = "2.31.1";
+  version = "2.51.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "pydantic-ai";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9kAUDDstOJP+s/eRZ6DtS7tZ16zIz7yxDpNJtAYiEmw=";
+    hash = "sha256-vrbBnSFnmIzqFJUVd2dZ8tDaO4/XXsVZvUUH+idttw8=";
  };

  sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
@@ -40,9 +41,10 @@ buildPythonPackage (finalAttrs: {
  ];

  dependencies = [
+    anyio
    genai-prices
    griffelib
-    httpx
+    httpx2
    opentelemetry-api
    pydantic-graph
    pydantic
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -8,7 +8,7 @@
  uv-dynamic-versioning,

  # dependencies
-  httpx,
+  anyio,
  logfire-api,
  pydantic,
  typing-inspection,
@@ -19,14 +19,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydantic-graph";
-  version = "2.31.1";
+  version = "2.51.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "pydantic-ai";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9kAUDDstOJP+s/eRZ6DtS7tZ16zIz7yxDpNJtAYiEmw=";
+    hash = "sha256-vrbBnSFnmIzqFJUVd2dZ8tDaO4/XXsVZvUUH+idttw8=";
  };

  sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
@@ -37,7 +37,7 @@ buildPythonPackage (finalAttrs: {
  ];

  dependencies = [
-    httpx
+    anyio
    logfire-api
    pydantic
    typing-inspection
--- a/pkgs/development/python-modules/pydrawise/default.nix
+++ b/pkgs/development/python-modules/pydrawise/default.nix
@@ -17,14 +17,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydrawise";
-  version = "2026.9.0";
+  version = "2026.9.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "dknowles2";
    repo = "pydrawise";
    tag = finalAttrs.version;
-    hash = "sha256-5p93vbrpOLCm2Kir2fTv4kx4UcgobVuU4FTkWxmG6T0=";
+    hash = "sha256-KlQ1SGqCx2PD+x0OfHYCgOemRZJovsXHg6UbAIf1QSs=";
  };

  build-system = [
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@@ -22,14 +22,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyenphase";
-  version = "4.0.5";
+  version = "4.0.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pyenphase";
    repo = "pyenphase";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JsKB6sSfUhhMeF6j0MP+sbPmKeCz6c3wlm7TIL5Ls2I=";
+    hash = "sha256-N9jNlLJDRThCshbbe/9eP77L3+KoJUIFxfgoQHd0ock=";
  };

  pythonRelaxDeps = [ "tenacity" ];
--- a/pkgs/development/python-modules/resize-image/default.nix
+++ b/pkgs/development/python-modules/resize-image/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  pillow,
+  python-resize-image,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "resize-image";
+  version = "0.4.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-nlJvyKSUKUNLcleBfrNH3wKh0Q97+d8laIa5POm7IeM=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    pillow
+    python-resize-image
+  ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [
+    "resize"
+  ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Commandline utility to resize an image";
+    homepage = "https://github.com/jaymu53/resize-image";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
--- a/pkgs/development/python-modules/smartthings-local/default.nix
+++ b/pkgs/development/python-modules/smartthings-local/default.nix
@@ -13,7 +13,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "smartthings-local";
-  version = "0.1.16";
+  version = "0.1.20";
  pyproject = true;
  __structuredAttrs = true;

@@ -21,7 +21,7 @@ buildPythonPackage (finalAttrs: {
    owner = "QuiteYellow";
    repo = "SmartThings-Local";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-o6e/+mj0o3wSpHtONBoUu+aEQKQ8SRLikx5LpHAhaiM=";
+    hash = "sha256-l1zCNdshRxUrUp5kYcgZBRO8ZWlz1rWRnxAtmVM2LpY=";
  };

  build-system = [
@@ -42,6 +42,11 @@ buildPythonPackage (finalAttrs: {
  disabledTests = [
    # import can't find pyopenssl for some reason
    "test_smartthings_local_imports_without_mqtt_demo_present"
+    # timezone handling issues
+    # assert 'GMT' in "clock sync (periodic) skipped: host clock reads 2000-01-01T00:00:00 Europe, outside the plausible window -- writing it could break the appliance's certificate verification"
+    "test_a_skipped_write_names_the_zone_too"
+    # AssertionError: assert '14:30:05 BST ->' in 'clock sync (periodic) /configuration/vs/0 = 2026-09-08T14:30:05 Europe -> 2.04'
+    "test_the_log_line_names_the_zone_the_stamp_came_from"
  ];

  pythonImportsCheck = [
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
    "testing": {
-        "version": "7.3-rc4",
-        "hash": "sha256:0bsd7w8xsd06g1kf5ildf6jnsryk5s2w5838ihp3237fh2sz8agr",
+        "version": "7.3-rc5",
+        "hash": "sha256:1slzmxyadz75p6lbk373x1waapyr6ggm6mz999sy5xkmidzg5d1n",
        "lts": false
    },
    "6.1": {
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2026.9.3";
+  version = "2026.9.4";
  components = {
    "3_day_blinds" =
      ps: with ps; [
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
@@ -14,13 +14,13 @@
 buildHomeAssistantComponent rec {
  owner = "luuquangvu";
  domain = "blueprints_updater";
-  version = "2.14.6";
+  version = "2.15.0";

  src = fetchFromGitHub {
    inherit owner;
    repo = "blueprints-updater";
    tag = version;
-    hash = "sha256-udj68ZlkSR2oldFfCEJh5A1gHF8GWb/iNluDrZ8L6us=";
+    hash = "sha256-ZfPfMrnUSaIEstkoocweit+wpk+/r+/L04uVGwZmKYc=";
  };

  patches = [
@@ -46,6 +46,11 @@ buildHomeAssistantComponent rec {
    pytestCheckHook
  ];

+  disabledTests = [
+    # validate_compatibility.py: error: Invalid --verify-pair-python: Python executable not found at .venv/bin/python
+    "test_compatibility_main_configures_global_uv_before_verification"
+  ];
+
  meta = {
    description = "Automatically update Home Assistant blueprints via native update entities";
    homepage = "https://github.com/luuquangvu/blueprints-updater/";
--- a/pkgs/servers/home-assistant/custom-components/cover_time_based/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/cover_time_based/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
  owner = "Sese-Schneider";
  domain = "cover_time_based";
-  version = "4.11.0";
+  version = "4.13.0";

  src = fetchFromGitHub {
    inherit (finalAttrs) owner;
    repo = "ha-cover-time-based";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-x6+xQCR3UmoIDp9JCnl86g8HTJMlo9Jz+eXXpu/oMGU=";
+    hash = "sha256-J5yTdjJTIOzq5miC5GpLshMAkklEYnajEyPN4AyyHIU=";
  };

  nativeCheckInputs = [
--- a/pkgs/servers/home-assistant/custom-components/econet300/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/econet300/package.nix
@@ -5,7 +5,7 @@
 }:

 buildHomeAssistantComponent (finalAttrs: {
-  version = "1.3.2";
+  version = "1.3.3";
  domain = "econet300";
  owner = "jontofront";

@@ -13,7 +13,7 @@ buildHomeAssistantComponent (finalAttrs: {
    owner = "jontofront";
    repo = "ecoNET-300-Home-Assistant-Integration";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Kbtp5yTsi7QEVaHrK+g/JcS9B3xS1TsH3t54lTPNgAI=";
+    hash = "sha256-nJ0xoSGmvPNqGKl8nYoNGfL5phXRbDzFsG/0HihLRmk=";
  };

  meta = {
@@ -21,6 +21,6 @@ buildHomeAssistantComponent (finalAttrs: {
    description = "Home Assistant component for Plum ecoNET300 devices";
    homepage = "https://github.com/jontofront/ecoNET-300-Home-Assistant-Integration";
    maintainers = with lib.maintainers; [ implr ];
-    license = lib.licenses.unfree;
+    license = lib.licenses.mit;
  };
 })
--- a/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
@@ -11,6 +11,7 @@
  websockets,

  # tests
+  pytest-asyncio,
  pytestCheckHook,
  aiohttp,
  home-assistant,
@@ -19,13 +20,13 @@
 buildHomeAssistantComponent rec {
  owner = "danielcherubini";
  domain = "elegoo_printer";
-  version = "2.12.2";
+  version = "2.13.1";

  src = fetchFromGitHub {
    owner = "danielcherubini";
    repo = "elegoo-homeassistant";
    tag = "v${version}";
-    hash = "sha256-iso1y8fjX88esIJPtgKQIOLlNYnj6zf9W/WlftQzewU=";
+    hash = "sha256-L3oFUCqxkygiwTTeHR9MMneA5q4+YFHBoNAxqbqp/Sk=";
  };

  dependencies = [
@@ -37,11 +38,17 @@ buildHomeAssistantComponent rec {
  ];

  nativeCheckInputs = [
+    pytest-asyncio
    pytestCheckHook
    aiohttp
    home-assistant
  ];

+  disabledTestPaths = [
+    # https://github.com/danielcherubini/elegoo-homeassistant/issues/419
+    "custom_components/elegoo_printer/tests/test_coordinator.py"
+  ];
+
  meta = {
    changelog = "https://github.com/danielcherubini/elegoo-homeassistant/releases/tag/v${version}";
    description = "Home Assistant integration for Elegoo 3D printers using the SDCP protocol";
--- a/pkgs/servers/home-assistant/custom-components/localthings/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/localthings/package.nix
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent (finalAttrs: {
  owner = "mbillow";
  domain = "localthings";
-  version = "0.26.1";
+  version = "0.29.0";

  src = fetchFromGitHub {
    owner = "mbillow";
    repo = "localthings";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7hFLCqZWiE3lo08wehXsqNdiddE4lAp02nQhzsDO0hs=";
+    hash = "sha256-/WOVkF7/crcHuNAzK+zfNkOxmk6Q+S+gOhMlydRio/o=";
  };

  dependencies = [
--- a/pkgs/servers/home-assistant/custom-components/meshcore/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/meshcore/package.nix
@@ -8,19 +8,20 @@
  paho-mqtt,
  pynacl,
  pytest-asyncio,
+  pytest-homeassistant-custom-component,
  pytestCheckHook,
 }:

 buildHomeAssistantComponent (finalAttrs: {
  owner = "meshcore-dev";
  domain = "meshcore";
-  version = "2.8.0";
+  version = "2.10.0";

  src = fetchFromGitHub {
    owner = "meshcore-dev";
    repo = "meshcore-ha";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-K1DYBcuAilcKBzQVSUQvoA9OoxUbtfISYNY8IwgUdZk=";
+    hash = "sha256-I4AUa66/XmXSb40suDGab6om2m/qJiUysXQdniT42bw=";
  };

  dependencies = [
@@ -37,9 +38,22 @@ buildHomeAssistantComponent (finalAttrs: {

  nativeCheckInputs = [
    pytest-asyncio
+    pytest-homeassistant-custom-component
    pytestCheckHook
  ];

+  disabledTestPaths = [
+    # https://github.com/meshcore-dev/meshcore-ha/issues/363
+    "tests_integration/test_dedup_eviction.py"
+    "tests_integration/test_execute_command_authorization.py"
+    "tests_integration/test_repeater_firmware_button.py"
+    "tests_integration/test_multihub_messaging.py"
+    "tests_integration/test_create_contact_sensor.py"
+    "tests_integration/test_config_flow.py"
+    "tests/test_cli_command.py::test_command_ui_records_when_flag_set"
+    "tests/test_cli_command.py::test_command_ui_noop_on_empty_input"
+  ];
+
  meta = {
    changelog = "https://github.com/meshcore-dev/meshcore-ha/releases/tag/${finalAttrs.src.tag}";
    description = "Home Assistant integration for MeshCore";
--- a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
  owner = "BottlecapDave";
  domain = "octopus_energy";
-  version = "19.1.0";
+  version = "19.2.1";

  src = fetchFromGitHub {
    inherit owner;
    repo = "HomeAssistant-OctopusEnergy";
    tag = "v${version}";
-    hash = "sha256-mUQXW6oW7JBDgDV+Sw3EGwVvBhwukEdNJmsxs8TK03Q=";
+    hash = "sha256-KkQxLmp/5X/Z1WwklLzOCvL49Tn6ZinID2Rf2GZngXI=";
  };

  dependencies = [ pydantic ];
--- a/pkgs/servers/home-assistant/custom-components/openai-tts/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/openai-tts/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
  owner = "sfortis";
  domain = "openai_tts";
-  version = "3.9.1";
+  version = "3.9.2";

  src = fetchFromGitHub {
    inherit (finalAttrs) owner;
    repo = "openai_tts";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hpGKSUMJuW2XSAGuqmCIXTtN4Qh2nwOFJWAg5X9JljA=";
+    hash = "sha256-z7PB1/UFdj8GvRIaAgDOBDSXjxfMky63/FRbr4Euj4w=";
  };

  dependencies = [ sentence-stream ];
--- a/pkgs/servers/home-assistant/custom-components/opendisplay/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/opendisplay/package.nix
@@ -8,13 +8,19 @@
  bleak-retry-connector,
  python-resize-image,
  numpy,
+  odl-renderer,
  qrcode,
+  py-opendisplay,
  requests-toolbelt,
+  silabs-ble-ota,
  websocket-client,
  websockets,

  # tests
+  home-assistant,
  pytest-asyncio,
+  pytest-cov-stub,
+  pytest-freezegun,
  pytest-homeassistant-custom-component,
  pytestCheckHook,
 }:
@@ -22,22 +28,25 @@
 buildHomeAssistantComponent (finalAttrs: {
  owner = "OpenDisplay";
  domain = "opendisplay";
-  version = "2.0.2";
+  version = "3.0.2";

  src = fetchFromGitHub {
    inherit (finalAttrs) owner;
    repo = "Home_Assistant_Integration";
    tag = finalAttrs.version;
-    hash = "sha256-EmcDY31cTWK+JRErM6EWO0jrQvIaxKXgeI6i5qiwYGU=";
+    hash = "sha256-m76Ie6yBs5evTZ4Myp+YvFzbWnAOBUREoy2R0cKlwuw=";
  };

  dependencies = [
    bleak
    bleak-retry-connector
    numpy
+    odl-renderer
    python-resize-image
    qrcode
+    py-opendisplay
    requests-toolbelt
+    silabs-ble-ota
    websocket-client
    websockets
  ]
@@ -50,9 +59,12 @@ buildHomeAssistantComponent (finalAttrs: {

  nativeCheckInputs = [
    pytest-asyncio
+    pytest-cov-stub
+    pytest-freezegun
    pytest-homeassistant-custom-component
    pytestCheckHook
-  ];
+  ]
+  ++ (home-assistant.getPackages "usb" home-assistant.python3Packages);

  disabledTestPaths = [
    # Probably mismatch in fontconfig priorities
--- a/Show More
+++ b/Show More