From 659fb24b00f542d9d26312fa4f78eb139149208d Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 2 Jul 2026 05:24:03 +0200
Subject: [PATCH 01/27] =?UTF-8?q?ocamlPackages.js=5Fof=5Focaml:=206.4.0=20?=
 =?UTF-8?q?=E2=86=92=206.4.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
index 5f81d23a42c4..49db27365957 100644
--- a/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
+++ b/pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix
@@ -12,7 +12,7 @@
   sedlex,
   version ?
     if lib.versionAtLeast ocaml.version "4.13" then
-      "6.4.0"
+      "6.4.1"
     else if lib.versionAtLeast ocaml.version "4.11" then
       "6.0.1"
     else
@@ -27,7 +27,7 @@ buildDunePackage {
     url = "https://github.com/ocsigen/js_of_ocaml/releases/download/${version}/js_of_ocaml-${version}.tbz";
     hash =
       {
-        "6.4.0" = "sha256-euIqflpsaqFKjiaV+mLGbzLLINsX8bRdwh6XAJNCFR8=";
+        "6.4.1" = "sha256-5Zu//K76ujGRYgVWUUt/U7sySeP4gaBw1yckI03/2Bk=";
         "6.3.2" = "sha256-qTr8llTsNGRwH7zg3M86i+uVCKyxLGBFd2vyzxBsq8A=";
         "6.2.0" = "sha256-fMZBd40bFyo1KogzPuDoxiE2WgrPzZuH44v9243Spdo=";
         "6.1.1" = "sha256-0x2kGq5hwCqqi01QTk6TcFIz0wPNgaB7tKxe7bA9YBQ=";

From 1057aaa96a3925f34a1d0550422f31205be43d15 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 6 Jul 2026 04:53:39 +0000
Subject: [PATCH 02/27] crc: 2.61.0 -> 2.62.0

---
 pkgs/by-name/cr/crc/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/cr/crc/package.nix b/pkgs/by-name/cr/crc/package.nix
index dc35dffb6f76..3afe6f1bd619 100644
--- a/pkgs/by-name/cr/crc/package.nix
+++ b/pkgs/by-name/cr/crc/package.nix
@@ -8,16 +8,16 @@
 }:
 
 let
-  openShiftVersion = "4.21.14";
+  openShiftVersion = "4.22.1";
   okdVersion = "4.21.0-okd-scos.8";
-  microshiftVersion = "4.21.7";
+  microshiftVersion = "4.22.0";
   writeKey = "$(MODULEPATH)/pkg/crc/segment.WriteKey=cvpHsNcmGCJqVzf6YxrSnVlwFSAZaYtp";
-  gitCommit = "6eb443d169c5a6dd461db1181f95506aa429f34b";
-  gitHash = "sha256-sVByFqYvPLrpG90GYigLEDemaJVF2fj+tSgERmmRzsM=";
+  gitCommit = "70f0c9879a8812cdd6ae19c059ca5816d8de7900";
+  gitHash = "sha256-TRqKCsHHc2+dpsLJ7t9apPvaR0jf/1xQrYV9swpk3RA=";
 in
 buildGoModule (finalAttrs: {
   pname = "crc";
-  version = "2.61.0";
+  version = "2.62.0";
 
   src = fetchFromGitHub {
     owner = "crc-org";

From 1966af4156b8cce630619f5b67366528095ec52e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Jul 2026 01:09:06 +0000
Subject: [PATCH 03/27] saga: 9.12.5 -> 9.12.6

---
 pkgs/by-name/sa/saga/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sa/saga/package.nix b/pkgs/by-name/sa/saga/package.nix
index 7c88882ad114..0d30f9e95401 100644
--- a/pkgs/by-name/sa/saga/package.nix
+++ b/pkgs/by-name/sa/saga/package.nix
@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "saga";
-  version = "9.12.5";
+  version = "9.12.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/saga-gis/saga-${finalAttrs.version}.tar.gz";
-    hash = "sha256-sqZYbdLOLtpTd168ZUZdK9zBBSixHiLuQcH9KDT2jP0=";
+    hash = "sha256-1A8Irbl135Uh+ywU4xQrmrp5Byr7UJRfBhvbcc70CIY=";
   };
 
   sourceRoot = "saga-${finalAttrs.version}/saga-gis";

From 9a8499293ba26948fdbecb006a18eed7e518d22e Mon Sep 17 00:00:00 2001
From: Perchun Pak <git@perchun.it>
Date: Tue, 7 Jul 2026 07:18:54 +0200
Subject: [PATCH 04/27] equibop: 3.2.0 -> 3.2.1

---
 pkgs/by-name/eq/equibop/node-modules.nix | 4 ++--
 pkgs/by-name/eq/equibop/package.nix      | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/eq/equibop/node-modules.nix b/pkgs/by-name/eq/equibop/node-modules.nix
index df0876ff55f8..b1168f7e2073 100644
--- a/pkgs/by-name/eq/equibop/node-modules.nix
+++ b/pkgs/by-name/eq/equibop/node-modules.nix
@@ -50,8 +50,8 @@ stdenvNoCC.mkDerivation {
 
   outputHash =
     {
-      x86_64-linux = "sha256-p8jx9HDYG2q2nhBiBK8XDTYm9O0ptTqv8L+PrQ8oiy8=";
-      aarch64-linux = "sha256-UsccQFaSSjhmv1+oF2FZcRG8xtWBCcPD+tizbdQ7SSI=";
+      x86_64-linux = "sha256-dLATw5Mb9grQnI/JTdlRdNP2JETELeqY8aXqb5dCXOA=";
+      aarch64-linux = "sha256-Zrk0aTHw7nrN6lKFa/ap7Hz1OJwnY4jtCLw2KWWqyJQ=";
     }
     .${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
diff --git a/pkgs/by-name/eq/equibop/package.nix b/pkgs/by-name/eq/equibop/package.nix
index cbe086a6b954..74a2ed33ed2d 100644
--- a/pkgs/by-name/eq/equibop/package.nix
+++ b/pkgs/by-name/eq/equibop/package.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "equibop";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "Equicord";
     repo = "Equibop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CPRn1F15N4Rjry91Gu+ZXWpKVTOEnHI3TmZn8502QB4=";
+    hash = "sha256-WqfxrVAJvD6Y6ZjkhbvibL6Bps7PL2lx3JBY94Yd6kk=";
   };
 
   postPatch = ''

From 4f33a4cf63ef7e08f80824fb387d297f98679fc9 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 8 Jun 2026 17:11:22 +0800
Subject: [PATCH 05/27] alps: 2022-10-18 -> 1

---
 pkgs/by-name/al/alps/package.nix | 87 ++++++++++++++++++++------------
 1 file changed, 56 insertions(+), 31 deletions(-)

diff --git a/pkgs/by-name/al/alps/package.nix b/pkgs/by-name/al/alps/package.nix
index bdefa56e2e5b..5506537156bb 100644
--- a/pkgs/by-name/al/alps/package.nix
+++ b/pkgs/by-name/al/alps/package.nix
@@ -1,61 +1,86 @@
 {
   lib,
   buildGoModule,
-  fetchFromSourcehut,
-  fetchpatch,
+  buildNpmPackage,
+  fetchFromGitHub,
   nixosTests,
+  util-linux,
+  versionCheckHook,
 }:
-
-buildGoModule {
+buildGoModule (finalAttrs: {
   pname = "alps";
-  version = "2022-10-18";
+  version = "1";
+  __structuredAttrs = true;
 
-  src = fetchFromSourcehut {
-    owner = "~migadu";
+  src = fetchFromGitHub {
+    owner = "migadu";
     repo = "alps";
-    rev = "f01fbcbc48db5e65d69a0ebd9d7cb0deb378cf13";
-    hash = "sha256-RSug3YSiqYLGs05Bee4NoaoCyPvUZ7IqlKWI1hmxbiA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-uzr0N50qKpIoOr7YFfuhnJ/CTaMvcP7TZujM5YpklMs=";
   };
 
-  vendorHash = "sha256-QsGfINktk+rBj4b5h+NBVS6XV1SVz+9fDL1vtUqcKEU=";
+  postPatch = ''
+    substituteInPlace dist/alps.service \
+      --replace-fail /usr/local/bin "$out/bin" \
+      --replace-fail /bin/kill "${lib.getExe' util-linux "kill"}"
+
+    rm -r frontend/dist
+    cp -r ${finalAttrs.passthru.frontend} frontend/dist
+  '';
+
+  vendorHash = "sha256-Nm9TC0j/PSraO1AtxUJmFQWdhdLzeLP0CXY0FZZ6pV8=";
+
+  subPackages = [ "cmd/alps" ];
 
   ldflags = [
     "-s"
-    "-w"
-    "-X main.themesPath=${placeholder "out"}/share/alps/themes"
-    "-X git.sr.ht/~migadu/alps.PluginDir=${placeholder "out"}/share/alps/plugins"
+    "-X main.version=${finalAttrs.version}"
   ];
 
-  patches = [
-    (fetchpatch {
-      name = "Issue-160-Alps-theme-has-a-enormous-move-to-list-sel";
-      url = "https://lists.sr.ht/~migadu/alps-devel/patches/30096/mbox";
-      hash = "sha256-Sz/SCkrrXZWrmJzjfPXi+UfCcbwsy6QiA7m34iiEFX0=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace plugin.go --replace "const PluginDir" "var PluginDir"
-  '';
-
   postInstall = ''
-    mkdir -p "$out/share/alps"
-    cp -r themes plugins "$out/share/alps/"
+    install -Dm644 -t "$out/lib/systemd/system/" dist/alps.service
   '';
 
-  proxyVendor = true;
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-version";
 
-  passthru.tests = { inherit (nixosTests) alps; };
+  passthru = {
+    frontend = buildNpmPackage (finalAttrs': {
+      pname = "${finalAttrs.pname}-frontend";
+      inherit (finalAttrs) version src;
+      sourceRoot = "${finalAttrs'.src.name}/frontend";
+
+      npmDepsHash = "sha256-gR9leLQSPo/qBNf6Yy1b2klawwuhKIvofCSPYkHOJKk=";
+
+      postPatch = ''
+        rm -r dist
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        mkdir -p "$out"
+        cp -r dist/. "$out"
+
+        runHook postInstall
+      '';
+    });
+    tests = { inherit (nixosTests) alps; };
+  };
 
   meta = {
     description = "Simple and extensible webmail";
-    homepage = "https://git.sr.ht/~migadu/alps";
+    homepage = "https://github.com/migadu/alps";
+    downloadPage = "https://github.com/migadu/alps/releases";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       booklearner
       madonius
       hmenke
+      prince213
     ];
+    teams = with lib.teams; [ ngi ];
     mainProgram = "alps";
   };
-}
+})

From b0f64c4928795cdfd3184ba9f90c3d0e6f12c8b0 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 9 Jun 2026 17:53:12 +0800
Subject: [PATCH 06/27] nixos/alps: update

---
 nixos/modules/services/web-apps/alps.nix | 169 +++++++++--------------
 1 file changed, 63 insertions(+), 106 deletions(-)

diff --git a/nixos/modules/services/web-apps/alps.nix b/nixos/modules/services/web-apps/alps.nix
index 0a0925856e71..8359809fa010 100644
--- a/nixos/modules/services/web-apps/alps.nix
+++ b/nixos/modules/services/web-apps/alps.nix
@@ -1,151 +1,108 @@
 {
+  config,
   lib,
   pkgs,
-  config,
+  utils,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.alps;
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "alps" "port" ] ''
+      Use `services.alps.settings.server.addr` instead.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "alps" "bindIP" ] ''
+      Use `services.alps.settings.server.addr` instead.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "alps" "theme" ] ''
+      Themes are no longer customizable.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "alps" "imaps" "port" ] ''
+      Use `services.alps.settings.provider.imap.server` instead.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "alps" "imaps" "host" ] ''
+      Use `services.alps.settings.provider.imap.server` instead.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "alps" "smtps" "port" ] ''
+      Use `services.alps.settings.smtp.server` instead.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "alps" "smtps" "host" ] ''
+      Use `services.alps.settings.smtp.server` instead.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "alps" "args" ] ''
+      Use `services.alps.settings` instead.
+    '')
+  ];
+
   options.services.alps = {
-    enable = mkEnableOption "alps";
+    enable = lib.mkEnableOption "alps";
+    package = lib.mkPackageOption pkgs "alps" { };
 
-    port = mkOption {
-      type = types.port;
-      default = 1323;
+    settings = lib.mkOption {
       description = ''
-        TCP port the service should listen on.
+        The ALPS configuration, see <https://github.com/migadu/alps/blob/main/docs/CONFIGURATION.md> for documentation.
+
+        Options containing secret data should be set to an attribute set
+        containing the attribute `_secret` - a string pointing to a file
+        containing the value the option should be set to.
       '';
-    };
-
-    bindIP = mkOption {
-      default = "[::]";
-      type = types.str;
-      description = ''
-        The IP the service should listen on.
-      '';
-    };
-
-    theme = mkOption {
-      type = types.enum [
-        "alps"
-        "sourcehut"
-      ];
-      default = "sourcehut";
-      description = ''
-        The frontend's theme to use.
-      '';
-    };
-
-    imaps = {
-      port = mkOption {
-        type = types.port;
-        default = 993;
-        description = ''
-          The IMAPS server port.
-        '';
+      default = { };
+      type = lib.types.submodule {
+        freeformType = lib.types.toml;
+        options = { };
       };
-
-      host = mkOption {
-        type = types.str;
-        default = "[::1]";
-        example = "mail.example.org";
-        description = ''
-          The IMAPS server address.
-        '';
-      };
-    };
-
-    smtps = {
-      port = mkOption {
-        type = types.port;
-        default = 465;
-        description = ''
-          The SMTPS server port.
-        '';
-      };
-
-      host = mkOption {
-        type = types.str;
-        default = cfg.imaps.host;
-        defaultText = "services.alps.imaps.host";
-        example = "mail.example.org";
-        description = ''
-          The SMTPS server address.
-        '';
-      };
-    };
-
-    package = mkOption {
-      internal = true;
-      type = types.package;
-      default = pkgs.alps;
-    };
-
-    args = mkOption {
-      internal = true;
-      type = types.listOf types.str;
-      default = [
-        "-addr"
-        "${cfg.bindIP}:${toString cfg.port}"
-        "-theme"
-        "${cfg.theme}"
-        "imaps://${cfg.imaps.host}:${toString cfg.imaps.port}"
-        "smtps://${cfg.smtps.host}:${toString cfg.smtps.port}"
-      ];
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
+    systemd.packages = [ cfg.package ];
+
     systemd.services.alps = {
-      description = "alps is a simple and extensible webmail.";
-      documentation = [ "https://git.sr.ht/~migadu/alps" ];
       wantedBy = [ "multi-user.target" ];
-      wants = [ "network-online.target" ];
-      after = [
-        "network.target"
-        "network-online.target"
-      ];
 
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/alps ${escapeShellArgs cfg.args}";
-        AmbientCapabilities = "";
-        CapabilityBoundingSet = "";
         DynamicUser = true;
+        RuntimeDirectory = "alps";
+        ExecStartPre =
+          let
+            script = pkgs.writeShellScript "alps-pre-start" ''
+              ${utils.genJqSecretsReplacementSnippet cfg.settings "/run/alps/config.json"}
+              ${lib.getExe pkgs.remarshal} -f json -t toml /run/alps/config.json /run/alps/config.toml
+              chown --reference=/run/alps /run/alps/config.json /run/alps/config.toml
+            '';
+          in
+          "+${script}";
+        ExecStart = [
+          ""
+          "${lib.getExe cfg.package} -config \${RUNTIME_DIRECTORY}/config.toml"
+        ];
+
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateIPC = true;
-        PrivateTmp = true;
         PrivateUsers = true;
+        ProcSubset = "pid";
         ProtectClock = true;
         ProtectControlGroups = true;
-        ProtectHome = true;
         ProtectHostname = true;
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
-        ProtectSystem = "strict";
-        RemoveIPC = true;
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SocketBindAllow = cfg.port;
-        SocketBindDeny = "any";
-        SystemCallArchitectures = "native";
+        SystemCallArchitectures = [ "native" ];
         SystemCallFilter = [
           "@system-service"
-          "~@privileged @obsolete"
+          "~@privileged"
+          "~@resources"
         ];
       };
     };

From c6679e3b1085b0445a21ba796d3bbed55032e02b Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 9 Jun 2026 17:53:12 +0800
Subject: [PATCH 07/27] nixosTests.alps: update

---
 nixos/tests/alps.nix | 78 ++++++++++++++++++++++++++------------------
 1 file changed, 46 insertions(+), 32 deletions(-)

diff --git a/nixos/tests/alps.nix b/nixos/tests/alps.nix
index 3e5d516271bc..b33428378bc2 100644
--- a/nixos/tests/alps.nix
+++ b/nixos/tests/alps.nix
@@ -1,12 +1,16 @@
+{ lib, ... }:
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
   domain = certs.domain;
+  port = 1323;
 in
-{ pkgs, ... }:
 {
   name = "alps";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ hmenke ];
+  meta = {
+    maintainers = with lib.maintainers; [
+      hmenke
+      prince213
+    ];
   };
 
   nodes = {
@@ -53,9 +57,8 @@ in
           };
         };
       };
-
     client =
-      { nodes, config, ... }:
+      { nodes, pkgs, ... }:
       {
         security.pki.certificateFiles = [
           certs.ca.cert
@@ -65,31 +68,44 @@ in
         '';
         services.alps = {
           enable = true;
-          theme = "alps";
-          imaps = {
-            host = domain;
-            port = 993;
-          };
-          smtps = {
-            host = domain;
-            port = 465;
+          settings = {
+            server = {
+              addr = ":${toString port}";
+            };
+            provider = {
+              type = "imap";
+              imap = {
+                server = "imaps://${domain}:993";
+              };
+            };
+            smtp = {
+              server = "smtps://${domain}:465";
+            };
           };
         };
         environment.systemPackages = [
           (pkgs.writers.writePython3Bin "test-alps-login" { } ''
             from urllib.request import build_opener, HTTPCookieProcessor, Request
-            from urllib.parse import urlencode, urljoin
+            from urllib.parse import urljoin
             from http.cookiejar import CookieJar
+            import json
 
-            baseurl = "http://localhost:${toString config.services.alps.port}"
+            baseurl = "http://localhost:${toString port}"
             username = "alice"
             password = "${nodes.server.users.users.alice.password}"
             cookiejar = CookieJar()
             cookieprocessor = HTTPCookieProcessor(cookiejar)
             opener = build_opener(cookieprocessor)
 
-            data = urlencode({"username": username, "password": password}).encode()
-            req = Request(urljoin(baseurl, "login"), data=data, method="POST")
+            data = json.dumps(
+                {"username": username, "password": password, "remember-me": ""}
+            ).encode()
+            req = Request(
+                urljoin(baseurl, "session"),
+                data=data,
+                headers={"Content-Type": "application/json"},
+                method="POST",
+            )
             with opener.open(req) as ret:
                 # Check that the alps_session cookie is set
                 print(cookiejar)
@@ -102,9 +118,9 @@ in
                 assert any(cookie.name == "alps_session" for cookie in cookiejar)
                 # ...and that we have not been redirected back to the login page
                 print(ret.url)
-                assert ret.url == urljoin(baseurl, "mailbox/INBOX")
+                assert ret.url != urljoin(baseurl, "#/login")
 
-            req = Request(urljoin(baseurl, "logout"))
+            req = Request(urljoin(baseurl, "session"), method="DELETE")
             with opener.open(req) as ret:
                 # Check that the alps_session cookie is now gone
                 print(cookiejar)
@@ -114,18 +130,16 @@ in
       };
   };
 
-  testScript =
-    { nodes, ... }:
-    ''
-      server.start()
-      server.wait_for_unit("postfix.service")
-      server.wait_for_unit("dovecot.service")
-      server.wait_for_open_port(465)
-      server.wait_for_open_port(993)
+  testScript = ''
+    server.start()
+    server.wait_for_unit("postfix.service")
+    server.wait_for_unit("dovecot.service")
+    server.wait_for_open_port(465)
+    server.wait_for_open_port(993)
 
-      client.start()
-      client.wait_for_unit("alps.service")
-      client.wait_for_open_port(${toString nodes.client.services.alps.port})
-      client.succeed("test-alps-login")
-    '';
+    client.start()
+    client.wait_for_unit("alps.service")
+    client.wait_for_open_port(${toString port})
+    client.succeed("test-alps-login")
+  '';
 }

From f504346df947fa199c85ffb59d28b8f8165ca868 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 9 Jun 2026 20:31:09 +0800
Subject: [PATCH 08/27] doc/rl-2611: add alps

---
 doc/release-notes/rl-2611.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index f9489c546659..87e617b19dd4 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -25,6 +25,8 @@
 
 - `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
 
+- `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
+
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.

From fe63e15b384c76b140eff4ac2b97c30eab22694a Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 9 Jun 2026 20:33:59 +0800
Subject: [PATCH 09/27] nixos/doc/rl-2611: add alps

---
 nixos/doc/manual/release-notes/rl-2611.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 01507338ec5f..969b2d7fe6d9 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -47,6 +47,8 @@
   Deployments running the server and worker in the same network namespace must also set at least the worker
   `AUTHENTIK_LISTEN__HTTP` address so that the server and worker do not bind to the same address.
 
+- `services.alps` has been rewritten, see [upstream repository](https://github.com/migadu/alps) for configuration.
+
 - Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
 - Rustical migrates from `settings.http.host` and `settings.http.port` to `settings.http.bind` to support UNIX domain sockets as well as TCP sockets in one setting.

From 6fd2eb0c1df4d0e74233ab885fd6c491bce007b0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Jul 2026 23:37:08 +0000
Subject: [PATCH 10/27] herdr: 0.7.1 -> 0.7.3

---
 pkgs/by-name/he/herdr/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/he/herdr/package.nix b/pkgs/by-name/he/herdr/package.nix
index b8e51cce25a6..103b51823232 100644
--- a/pkgs/by-name/he/herdr/package.nix
+++ b/pkgs/by-name/he/herdr/package.nix
@@ -11,7 +11,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "herdr";
-  version = "0.7.1";
+  version = "0.7.3";
 
   __structuredAttrs = true;
 
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "ogulcancelik";
     repo = "herdr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/WnsUO1DuSmBfVo8LCFaDJEZvSrYnJZPyRNqASbPzV8=";
+    hash = "sha256-Q2yvMs/N6oAF8xnRIrMxEOOV6Aj8aAXQzuvcaux2enA=";
   };
 
-  cargoHash = "sha256-enVFwIGTM7oBg3teWC6MO/bdT/jDIKbaxKq4jE9E0aw=";
+  cargoHash = "sha256-DRjcIJXWGxiA9c7xIiQoWU9az2EFjXsnFKu5sC933eE=";
 
   zigDeps = zig_0_15.fetchDeps {
     inherit (finalAttrs) pname version;

From bbec5a4309c4e352bdb8ce0d2cfc5c4c6eb1b35d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 8 Jul 2026 01:41:22 +0200
Subject: [PATCH 11/27] python3Packages.tencentcloud-sdk-python: 3.1.128 ->
 3.1.129

Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/3.1.128...3.1.129

Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.1.129/CHANGELOG.md
---
 .../python-modules/tencentcloud-sdk-python/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index be98244e3d0f..9cbe0765db87 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.128";
+  version = "3.1.129";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-TYevKf5EzQGU/JYNyWFrKhWaqJy7YXt8M9Mm1Ai1gbA=";
+    hash = "sha256-XW4vhZuXZZeOBuryAHtjKNR2rjxRU0LSTBKn+1+ox9g=";
   };
 
   build-system = [ setuptools ];

From 3a760bc8ddf1a41aa0b21c095900c15a87dbb355 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Jul 2026 23:49:08 +0000
Subject: [PATCH 12/27] models-dev: 0-unstable-2026-06-29 ->
 sdk-v0.0.5-unstable-2026-07-07

---
 pkgs/by-name/mo/models-dev/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 969097925456..ab296248c8e1 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -8,12 +8,12 @@
 }:
 let
   pname = "models-dev";
-  version = "0-unstable-2026-06-29";
+  version = "sdk-v0.0.5-unstable-2026-07-07";
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "models.dev";
-    rev = "25e012fcdd12652969e37837863e3dba53bd5582";
-    hash = "sha256-QOGlYaE4c1UVStlKPqvinBbmO6lfTAj4X1Q1fCtixwo=";
+    rev = "f1a9be19f62c24474d27947d5236067504dd755a";
+    hash = "sha256-ty8l1jURV2uf245Xqm+I95qZ8gU9IjTGqR7+yLGxBUs=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -57,7 +57,7 @@ let
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-kn5Ung5DGDYMf5MHnZ+jsqXCg+MYahfkbiixcD9kh4Y=";
+    outputHash = "sha256-aL2kNCYF6Y4QnEvlpQ9U5Qe+K8a1J2X7BvJqE+BnRcY=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };

From e31461c02c110bea33623f80802ed2909af54d9c Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Mon, 6 Jul 2026 07:30:51 +0200
Subject: [PATCH 13/27] ocamlPackages.fuse3: init at 3.10.0

---
 .../ocaml-modules/fuse3/default.nix           | 40 +++++++++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  4 ++
 2 files changed, 44 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/fuse3/default.nix

diff --git a/pkgs/development/ocaml-modules/fuse3/default.nix b/pkgs/development/ocaml-modules/fuse3/default.nix
new file mode 100644
index 000000000000..836ccb01cc1b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/fuse3/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildDunePackage,
+  camlidl,
+  dune-configurator,
+  pkg-config,
+  fuse3,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "fuse3";
+  version = "3.10.0";
+
+  src = fetchFromGitHub {
+    owner = "astrada";
+    repo = "ocamlfuse";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xy3Jf4GTQP3vM6vRxBAeOIASWRuoNdlbt91eCco2zMg=";
+  };
+
+  nativeBuildInputs = [
+    camlidl
+    pkg-config
+  ];
+
+  buildInputs = [ dune-configurator ];
+
+  propagatedBuildInputs = [
+    camlidl
+    fuse3
+  ];
+
+  meta = {
+    description = "OCaml bindings for libfuse 3";
+    homepage = "https://github.com/astrada/ocamlfuse/";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+  };
+})
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 974759c5491b..8b143f80b45c 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -710,6 +710,10 @@ let
 
         functory = callPackage ../development/ocaml-modules/functory { };
 
+        fuse3 = callPackage ../development/ocaml-modules/fuse3 {
+          inherit (pkgs) fuse3;
+        };
+
         ### G ###
 
         gapi-ocaml = callPackage ../development/ocaml-modules/gapi-ocaml { };

From 64f4a892cf01d1f967c1ddc6e0f09e69a16ac55e Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Mon, 6 Jul 2026 07:38:33 +0200
Subject: [PATCH 14/27] =?UTF-8?q?ocamlPackages.gapi-ocaml:=200.4.8=20?=
 =?UTF-8?q?=E2=86=92=200.4.9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/ocaml-modules/gapi-ocaml/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/gapi-ocaml/default.nix b/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
index a6bec8a069cb..accd07f110af 100644
--- a/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
+++ b/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
@@ -12,7 +12,7 @@
 
 buildDunePackage (finalAttrs: {
   pname = "gapi-ocaml";
-  version = if lib.versionAtLeast cryptokit.version "1.21" then "0.4.8" else "0.4.7";
+  version = if lib.versionAtLeast cryptokit.version "1.21" then "0.4.9" else "0.4.7";
 
   src = fetchFromGitHub {
     owner = "astrada";
@@ -21,7 +21,7 @@ buildDunePackage (finalAttrs: {
     hash =
       {
         "0.4.7" = "sha256-uQJfrgF0oafURlamHslt9hX9MP4vFeVqDhuX7T/kjiY=";
-        "0.4.8" = "sha256-RvHcse3ech8BwnR0Kd1oE5ycAdSBpeQ0IGAp9egFbBY=";
+        "0.4.9" = "sha256-UWoWWpCAKCNEwEFO4UBXrTO49QyxLXrulDHX6dGr0z4=";
       }
       ."${finalAttrs.version}";
   };
@@ -42,6 +42,7 @@ buildDunePackage (finalAttrs: {
     description = "OCaml client for google services";
     homepage = "https://github.com/astrada/gapi-ocaml";
     license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ bennofs ];
   };
 })

From ddf679831790e97ce14e01496c4af5eef8203511 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Mon, 6 Jul 2026 07:44:37 +0200
Subject: [PATCH 15/27] =?UTF-8?q?google-drive-ocamlfuse:=200.7.32=20?=
 =?UTF-8?q?=E2=86=92=200.9.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../google-drive-ocamlfuse/default.nix        | 22 +++++++++++--------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/pkgs/applications/networking/google-drive-ocamlfuse/default.nix b/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
index 48d683e14f21..4260630190a4 100644
--- a/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
+++ b/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
@@ -4,41 +4,45 @@
   buildDunePackage,
   fetchFromGitHub,
   extlib,
-  ocamlfuse,
+  fuse3,
   gapi-ocaml,
   ocaml_sqlite3,
+  otoml,
   tiny_httpd,
   ounit2,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "google-drive-ocamlfuse";
-  version = "0.7.32";
+  version = "0.9.0";
+
+  minimalOCamlVersion = "4.13";
 
   src = fetchFromGitHub {
     owner = "astrada";
     repo = "google-drive-ocamlfuse";
-    rev = "v${version}";
-    hash = "sha256-AWr1tcium70rXFKMTv6xcWxndOJua3UXG8Q04TN1Siw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nTZdE9F6ufQ/O/Ck6fzoK65uZ0ylMR6HkwKsBNRDjMs=";
   };
 
-  doCheck = lib.versionAtLeast ocaml.version "5";
+  doCheck = lib.versionAtLeast ocaml.version "4.14";
   checkInputs = [ ounit2 ];
 
   buildInputs = [
     extlib
-    ocamlfuse
+    fuse3
     gapi-ocaml
     ocaml_sqlite3
+    otoml
     tiny_httpd
   ];
 
   meta = {
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/astrada/google-drive-ocamlfuse/";
     description = "FUSE-based file system backed by Google Drive, written in OCaml";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ obadz ];
     mainProgram = "google-drive-ocamlfuse";
   };
-}
+})

From 413da533bd7fdc389591f23bf738d6dfd2083658 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Jul 2026 00:57:59 +0000
Subject: [PATCH 16/27] astyle: 3.6.16 -> 3.6.17

---
 pkgs/by-name/as/astyle/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/as/astyle/package.nix b/pkgs/by-name/as/astyle/package.nix
index 3ed7b28e6e69..b66ae5e90a59 100644
--- a/pkgs/by-name/as/astyle/package.nix
+++ b/pkgs/by-name/as/astyle/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astyle";
-  version = "3.6.16";
+  version = "3.6.17";
 
   src = fetchurl {
     url = "mirror://sourceforge/astyle/astyle-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-QU6dpM/e6zXY98Fw4V70OvX6AGbJ9ZKnRvcHHzVuzac=";
+    hash = "sha256-7cg5uAB35g7VeGtjlNRCtOsQFWzL3VlEtLNg4SWvs+E=";
   };
 
   nativeBuildInputs = [ cmake ];

From 16ade640d04519e6ba0e665a178c74ed5225f242 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Jul 2026 01:12:21 +0000
Subject: [PATCH 17/27] pmtiles: 1.30.3 -> 1.31.0

---
 pkgs/by-name/pm/pmtiles/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pm/pmtiles/package.nix b/pkgs/by-name/pm/pmtiles/package.nix
index 24acb2ab2e04..1f0468702abb 100644
--- a/pkgs/by-name/pm/pmtiles/package.nix
+++ b/pkgs/by-name/pm/pmtiles/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "pmtiles";
-  version = "1.30.3";
+  version = "1.31.0";
 
   src = fetchFromGitHub {
     owner = "protomaps";
     repo = "go-pmtiles";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SFuW/TKKxBGOeyYdHLm7J2w3n8xPjLzSJTIi322WTk0=";
+    hash = "sha256-OWf66RsOvYoJEsDI4rVsimX60uxuZoqTgIwAI7kxvs0=";
   };
 
   vendorHash = "sha256-0u/04mpqhpRideIf8eOzgC7ZWNp4P2c2ssQvyWlcD4M=";

From 74aae8a95addd05b8b78e7302d17ea30695738e3 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 7 Jul 2026 22:02:27 -0400
Subject: [PATCH 18/27] xwayland: 24.1.12 -> 24.1.13

announcement: https://lists.x.org/archives/xorg-announce/2026-July/003717.html
advisory: https://lists.x.org/archives/xorg-announce/2026-July/003716.html

Fixes: CVE-2026-55999, CVE-2026-56000
---
 pkgs/by-name/xw/xwayland/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xw/xwayland/package.nix b/pkgs/by-name/xw/xwayland/package.nix
index 3cbc38b3f223..b608821cbfc5 100644
--- a/pkgs/by-name/xw/xwayland/package.nix
+++ b/pkgs/by-name/xw/xwayland/package.nix
@@ -56,11 +56,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xwayland";
-  version = "24.1.12";
+  version = "24.1.13";
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/xwayland-${finalAttrs.version}.tar.xz";
-    hash = "sha256-bfAsURuSwbmEhzTZ0bA6TCT4N1ujytpE6WhKIbX3jiE=";
+    hash = "sha256-FzrqPW95YJFkwEUo4cjkybYPzVk5HDydrUZnKX1yf7Y=";
   };
 
   postPatch = ''

From 4c4f2e325fd86a76888d8287691939dd3cc0379c Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 7 Jul 2026 22:10:03 -0400
Subject: [PATCH 19/27] xorg-server: 21.1.23 -> 21.1.24

announcement: https://lists.x.org/archives/xorg-announce/2026-July/003718.html
advisory: https://lists.x.org/archives/xorg-announce/2026-July/003716.html

Fixes: CVE-2026-55999, CVE-2026-56000
---
 pkgs/by-name/xo/xorg-server/package.nix | 4 ++--
 pkgs/by-name/xv/xvfb/package.nix        | 9 ++++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/xo/xorg-server/package.nix b/pkgs/by-name/xo/xorg-server/package.nix
index b9028ccbbe4c..63d1bd16f1bd 100644
--- a/pkgs/by-name/xo/xorg-server/package.nix
+++ b/pkgs/by-name/xo/xorg-server/package.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   # `xvfb` inherits `version` and `src` from here, leading to many rebuilds. If
   # necessary, these can be moved out of lockstep in order to merge updates
   # quickly.
-  version = "21.1.23";
+  version = "21.1.24";
 
   outputs = [
     "out"
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-45gy5WF9ra8HL9+fDhnl0uHCoTYHrCgLrBq6n4/hRjQ=";
+    hash = "sha256-Gk6zbKZcw7G5NlZtZ3qXhuE8Ec1YBulRrFXz9c45hK8=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/xv/xvfb/package.nix b/pkgs/by-name/xv/xvfb/package.nix
index 934fade5a795..17cc2e9418ca 100644
--- a/pkgs/by-name/xv/xvfb/package.nix
+++ b/pkgs/by-name/xv/xvfb/package.nix
@@ -38,7 +38,14 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "xvfb";
 
-  inherit (xorg-server) src version;
+  # TODO: commented out for rebuild avoidance after xorg-server update. revert
+  # on staging.
+  # inherit (xorg-server) src version;
+  version = "21.1.23";
+  src = fetchurl {
+    url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
+    hash = "sha256-45gy5WF9ra8HL9+fDhnl0uHCoTYHrCgLrBq6n4/hRjQ=";
+  };
 
   strictDeps = true;
 

From de643f257ba6e37fd9b58e742c4f7155a0a8a446 Mon Sep 17 00:00:00 2001
From: atagen <boss@atagen.co>
Date: Sun, 21 Jun 2026 14:03:31 +1000
Subject: [PATCH 20/27] tack: init at 1.0.0

---
 pkgs/by-name/ta/tack/package.nix | 43 ++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 pkgs/by-name/ta/tack/package.nix

diff --git a/pkgs/by-name/ta/tack/package.nix b/pkgs/by-name/ta/tack/package.nix
new file mode 100644
index 000000000000..6b4d448cb70b
--- /dev/null
+++ b/pkgs/by-name/ta/tack/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "tack";
+  version = "1.0.0";
+  src = fetchFromGitHub {
+    owner = "manic-systems";
+    repo = "tack";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-KhJb0NWLhj8AkD8uWEbXt179YlFLemk0OgOltw4jEk8=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  cargoHash = "sha256-3vDMM5uTsmRso6McH/b3+RpjeKjhgQm9V1piBrnSRjk=";
+
+  prePatch = ''
+    rm .cargo/config.toml
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/manic-systems/tack";
+    description = "flake-like toml nix pins, lazily fetched and transformed";
+    mainProgram = "tack";
+    license = [ lib.licenses.eupl12 ];
+    maintainers = with lib.maintainers; [
+      amaanq
+      atagen
+      faukah
+      max
+      NotAShelf
+    ];
+  };
+})

From 74b9979f50c299d1ebe22fbc40bef117c301502a Mon Sep 17 00:00:00 2001
From: atagen <boss@atagen.co>
Date: Sun, 21 Jun 2026 14:13:51 +1000
Subject: [PATCH 21/27] nixos/tack: init

---
 nixos/modules/module-list.nix   |  1 +
 nixos/modules/programs/tack.nix | 26 ++++++++++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 nixos/modules/programs/tack.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0fd01c232583..036365f72b6c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -328,6 +328,7 @@
   ./programs/sysdig.nix
   ./programs/system-config-printer.nix
   ./programs/systemtap.nix
+  ./programs/tack.nix
   ./programs/tcpdump.nix
   ./programs/television.nix
   ./programs/throne.nix
diff --git a/nixos/modules/programs/tack.nix b/nixos/modules/programs/tack.nix
new file mode 100644
index 000000000000..6b39c72bda4e
--- /dev/null
+++ b/nixos/modules/programs/tack.nix
@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.tack;
+in
+{
+  options.programs.tack = {
+    enable = lib.mkEnableOption "tack, flake-like toml nix pins";
+
+    package = lib.mkPackageOption pkgs "tack" { };
+
+    nixConfTokens = lib.mkEnableOption "tack reading access tokens from nix.conf (significantly improves comparison speed)";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    environment.sessionVariables = lib.mkIf cfg.nixConfTokens {
+      TACK_NIX_CONF_TOKENS = "1";
+    };
+  };
+}

From 0736a8093455cb77eb66987875b4a3291eb14f2e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Jul 2026 06:41:20 +0000
Subject: [PATCH 22/27] python3Packages.frigidaire: 0.18.47 -> 0.18.49

---
 pkgs/development/python-modules/frigidaire/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/frigidaire/default.nix b/pkgs/development/python-modules/frigidaire/default.nix
index bddc9bbcf35c..2df2d92984ed 100644
--- a/pkgs/development/python-modules/frigidaire/default.nix
+++ b/pkgs/development/python-modules/frigidaire/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "frigidaire";
-  version = "0.18.47";
+  version = "0.18.49";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bm1549";
     repo = "frigidaire";
     tag = finalAttrs.version;
-    hash = "sha256-KiWMzx22YNJNkhkfSFVdCC6amTGjtwpd/a040vQh8c4=";
+    hash = "sha256-wEiIkeF5ybb6wVVEhoIo/L4GjtTy2UAR6tSaoH+qp7Y=";
   };
 
   postPatch = ''

From 2fa9e71421e260946a8d02ba8ffd15db4a1531d0 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sun, 5 Jul 2026 09:13:25 +0200
Subject: [PATCH 23/27] python314Packages.vtherm-api: init at 0.3.0

https://github.com/jmcollin78/vtherm_api/releases/tag/0.3.0

Assisted-by: pi coding agent / Mika (OpenAI GPT-5.5)
---
 .../python-modules/vtherm-api/default.nix     | 44 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/development/python-modules/vtherm-api/default.nix

diff --git a/pkgs/development/python-modules/vtherm-api/default.nix b/pkgs/development/python-modules/vtherm-api/default.nix
new file mode 100644
index 000000000000..37abc93a5435
--- /dev/null
+++ b/pkgs/development/python-modules/vtherm-api/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  home-assistant,
+  pythonOlder,
+  pytest-asyncio,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "vtherm-api";
+  version = "0.3.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.14";
+
+  src = fetchFromGitHub {
+    owner = "jmcollin78";
+    repo = "vtherm_api";
+    tag = finalAttrs.version;
+    hash = "sha256-8YE9+Y+R6TvBKssRPvDLSdVzonDawWgg01Ngk94eMzM=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ home-assistant ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "vtherm_api" ];
+
+  meta = {
+    changelog = "https://github.com/jmcollin78/vtherm_api/releases/tag/${finalAttrs.version}";
+    description = "API for Versatile Thermostat Home Assistant integrations";
+    homepage = "https://github.com/jmcollin78/vtherm_api";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ geri1701 ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9d26ad71ac9f..0e99aa82d882 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -21558,6 +21558,8 @@ self: super: with self; {
 
   vt-py = callPackage ../development/python-modules/vt-py { };
 
+  vtherm-api = callPackage ../development/python-modules/vtherm-api { };
+
   vtjp = callPackage ../development/python-modules/vtjp { };
 
   vtk = toPythonModule (

From 0540a8eb7dff23592e38056c0a6760778ab82941 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sun, 5 Jul 2026 09:13:45 +0200
Subject: [PATCH 24/27] home-assistant-custom-components.versatile_thermostat:
 9.3.3 -> 10.0.2

https://github.com/jmcollin78/versatile_thermostat/releases/tag/10.0.2

Assisted-by: pi coding agent / Mika (OpenAI GPT-5.5)
---
 .../custom-components/versatile_thermostat/package.nix      | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix b/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
index 4daa7cee951f..028596f033f1 100644
--- a/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/versatile_thermostat/package.nix
@@ -4,24 +4,26 @@
   lib,
   numpy,
   scipy,
+  vtherm-api,
   gitUpdater,
 }:
 
 buildHomeAssistantComponent rec {
   owner = "jmcollin78";
   domain = "versatile_thermostat";
-  version = "9.3.3";
+  version = "10.0.2";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     tag = version;
-    hash = "sha256-TiaJFFx3nEUYHVB5Ka71MaP8pngcPSdHxt920NSCQ8c=";
+    hash = "sha256-WnhOsvBhIyumWkEiX2Id2fz4GQQTZxBOLPtR6zHqsXw=";
   };
 
   dependencies = [
     numpy
     scipy
+    vtherm-api
   ];
 
   passthru.updateScript = gitUpdater { ignoredVersions = "(Alpha|Beta|alpha|beta).*"; };

From d45ebfd1ac54d8bbe6508e7d1cf7aa9e1f3db27e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Jul 2026 06:52:52 +0000
Subject: [PATCH 25/27] python3Packages.std-uritemplate: 2.0.10 -> 2.0.11

---
 pkgs/development/python-modules/std-uritemplate/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/std-uritemplate/default.nix b/pkgs/development/python-modules/std-uritemplate/default.nix
index 6d537bbb6171..55d16347bf7f 100644
--- a/pkgs/development/python-modules/std-uritemplate/default.nix
+++ b/pkgs/development/python-modules/std-uritemplate/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "std-uritemplate";
-  version = "2.0.10";
+  version = "2.0.11";
   pyproject = true;
 
   src = fetchPypi {
     pname = "std_uritemplate";
     inherit version;
-    hash = "sha256-NQSKMiIXrtl2b9/+WmnwYy9zGVd6SiZSaHYc1P+jIF4=";
+    hash = "sha256-afqeUkc41RG7S5Sz4jk8oFJKrRGOVJJZxU2zZ+BdmFI=";
   };
 
   build-system = [ poetry-core ];

From c774789fb2b9c0cb4e408f796f136dc9ccd07da3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 8 Jul 2026 09:13:03 +0200
Subject: [PATCH 26/27] python3Packages.std-uritemplate: migrate to finalAttrs

---
 .../python-modules/std-uritemplate/default.nix            | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/std-uritemplate/default.nix b/pkgs/development/python-modules/std-uritemplate/default.nix
index 55d16347bf7f..0dea59c66c6b 100644
--- a/pkgs/development/python-modules/std-uritemplate/default.nix
+++ b/pkgs/development/python-modules/std-uritemplate/default.nix
@@ -5,14 +5,14 @@
   poetry-core,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "std-uritemplate";
   version = "2.0.11";
   pyproject = true;
 
   src = fetchPypi {
     pname = "std_uritemplate";
-    inherit version;
+    inherit (finalAttrs) version;
     hash = "sha256-afqeUkc41RG7S5Sz4jk8oFJKrRGOVJJZxU2zZ+BdmFI=";
   };
 
@@ -26,8 +26,8 @@ buildPythonPackage rec {
   meta = {
     description = "Std-uritemplate implementation for Python";
     homepage = "https://github.com/std-uritemplate/std-uritemplate";
-    changelog = "https://github.com/std-uritemplate/std-uritemplate/releases/tag/${version}";
+    changelog = "https://github.com/std-uritemplate/std-uritemplate/releases/tag/${finalAttrs.version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From 211b8f674c3acefe2f8af2493ca7b8c9a6c351ee Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Jul 2026 07:14:30 +0000
Subject: [PATCH 27/27] pvz-portable-unwrapped: 0.1.25 -> 0.1.26

---
 pkgs/by-name/pv/pvz-portable-unwrapped/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix b/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
index 3523439b45de..99ec68180031 100644
--- a/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
+++ b/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pvz-portable-unwrapped";
-  version = "0.1.25";
+  version = "0.1.26";
 
   src = fetchFromGitHub {
     owner = "wszqkzqk";
     repo = "PvZ-Portable";
     tag = finalAttrs.version;
-    hash = "sha256-ePPDzHlUu+b0bbRHSHtbgqOVrOdW3FR0WPXZM9iTKWM=";
+    hash = "sha256-IsU/l7k7F79nfM6TYdbcofOmJKm6v55HR7HHAZc7sH0=";
   };
 
   nativeBuildInputs = [