From 97bfb5a0621f7978e73cd68033fc3813cfaf45da Mon Sep 17 00:00:00 2001
From: Acid Bong <acidbong@tilde.club>
Date: Thu, 26 Mar 2026 22:02:19 +0200
Subject: [PATCH 01/58] greetd: purge greeter aliases

Follow-up to #427540
---
 pkgs/by-name/gr/greetd/package.nix | 28 +---------------------------
 1 file changed, 1 insertion(+), 27 deletions(-)

diff --git a/pkgs/by-name/gr/greetd/package.nix b/pkgs/by-name/gr/greetd/package.nix
index c6c65e452dec..0e13f6b07c9f 100644
--- a/pkgs/by-name/gr/greetd/package.nix
+++ b/pkgs/by-name/gr/greetd/package.nix
@@ -1,18 +1,11 @@
 {
   rustPlatform,
   lib,
-  config,
   fetchFromSourcehut,
   pam,
   scdoc,
   installShellFiles,
   nix-update-script,
-  # legacy passthrus
-  gtkgreet,
-  qtgreet,
-  regreet,
-  tuigreet,
-  wlgreet,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -45,26 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installManPage man/*
   '';
 
-  # Added 2025-07-23. To be deleted on 26.05
-  passthru =
-    let
-      warnPassthru = name: lib.warnOnInstantiate "`greetd.${name}` was renamed to `${name}`";
-    in
-    lib.mapAttrs warnPassthru (
-      lib.optionalAttrs config.allowAliases {
-        inherit
-          gtkgreet
-          qtgreet
-          regreet
-          tuigreet
-          wlgreet
-          ;
-        greetd = finalAttrs.finalPackage;
-      }
-    )
-    // {
-      updateScript = nix-update-script { };
-    };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Minimal and flexible login manager daemon";

From 29b576c757ba2a7f7591f6179b5c9c6ba0fa3f1c Mon Sep 17 00:00:00 2001
From: Acid Bong <acidbong@tilde.club>
Date: Thu, 26 Mar 2026 22:29:40 +0200
Subject: [PATCH 02/58] greetd: correct license

https://git.sr.ht/~kennylevinsen/greetd/tree/1bf47d7b2029233361be3c772a66384bb54a458d/item/greetd/Cargo.toml#L6
---
 pkgs/by-name/gr/greetd/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/gr/greetd/package.nix b/pkgs/by-name/gr/greetd/package.nix
index 0e13f6b07c9f..c2dfaf7ac8de 100644
--- a/pkgs/by-name/gr/greetd/package.nix
+++ b/pkgs/by-name/gr/greetd/package.nix
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
     homepage = "https://sr.ht/~kennylevinsen/greetd/";
     mainProgram = "greetd";
-    license = lib.licenses.gpl3Plus;
+    license = lib.licenses.gpl3Only;
     maintainers = [ ];
     platforms = lib.platforms.linux;
   };

From 20c0861f8fe518ffed2d4e539d16ecbfba5d1054 Mon Sep 17 00:00:00 2001
From: Acid Bong <acidbong@tilde.club>
Date: Thu, 26 Mar 2026 22:30:13 +0200
Subject: [PATCH 03/58] gtkgreet: correct license

https://git.sr.ht/~kennylevinsen/gtkgreet/tree/ac3f9ec05ee2fdd116081869b808a429538816a5/item/meson.build#L5
---
 pkgs/by-name/gt/gtkgreet/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/gt/gtkgreet/package.nix b/pkgs/by-name/gt/gtkgreet/package.nix
index 6156e3ee8f41..dad670c71fe9 100644
--- a/pkgs/by-name/gt/gtkgreet/package.nix
+++ b/pkgs/by-name/gt/gtkgreet/package.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "GTK based greeter for greetd, to be run under cage or similar";
     homepage = "https://git.sr.ht/~kennylevinsen/gtkgreet";
-    license = lib.licenses.gpl3Plus;
+    license = lib.licenses.gpl3Only;
     maintainers = [ ];
     platforms = lib.platforms.linux;
     mainProgram = "gtkgreet";

From 329f778bf64ddaaab17964c268bde5215812c1f3 Mon Sep 17 00:00:00 2001
From: Acid Bong <acidbong@tilde.club>
Date: Wed, 22 Apr 2026 20:04:24 +0300
Subject: [PATCH 04/58] wlgreet: correct license

---
 pkgs/by-name/wl/wlgreet/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/wl/wlgreet/package.nix b/pkgs/by-name/wl/wlgreet/package.nix
index d2cec5bca71b..71cca52b2877 100644
--- a/pkgs/by-name/wl/wlgreet/package.nix
+++ b/pkgs/by-name/wl/wlgreet/package.nix
@@ -37,7 +37,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Raw wayland greeter for greetd, to be run under sway or similar";
     mainProgram = "wlgreet";
     homepage = "https://git.sr.ht/~kennylevinsen/wlgreet";
-    license = lib.licenses.gpl3Plus;
+    license = lib.licenses.gpl3Only;
     maintainers = [ ];
     platforms = lib.platforms.linux;
   };

From b2f185c25bd77ede3be459e951cea98937c50b67 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Wed, 8 Apr 2026 18:01:14 +0200
Subject: [PATCH 05/58] nixos/etc: inline small regular files into the metadata
 erofs image

Regular (non-symlink) /etc entries with an explicit mode are currently
written to the metadata erofs image as stubs that redirect to a
separate basedir layer. Every open() of such a file makes overlayfs open
two real files (the metadata stub and the basedir target).

composefs-dump supports embedding file content directly via the CONTENT
field (raw size limit LCFS_INLINE_CONTENT_MAX = 5000 bytes). Use it for
files up to 4096 bytes so they are served straight from erofs with a
single underlying open. Files above the threshold keep the existing basedir
redirect.

Basedir entries that are provably inlineable are filtered at eval time
(text-backed entries) so changing a small /etc file no longer rebuilds
etc-lowerdir. Other entries are filtered at build time using the
same size check as the dump generator.

On a minimal config the basedir becomes empty and an open+read+close of
/etc/sudoers drops from ~46k to ~12k kernel instructions (-73%).
The metadata image size is unchanged (content fits in erofs block slack).
---
 .../system/etc/build-composefs-dump.py        | 85 +++++++++++++++++--
 nixos/modules/system/etc/etc.nix              | 30 ++++++-
 .../activation/etc-overlay-immutable.nix      | 34 ++++++++
 .../tests/activation/etc-overlay-mutable.nix  | 34 ++++++++
 4 files changed, 174 insertions(+), 9 deletions(-)

diff --git a/nixos/modules/system/etc/build-composefs-dump.py b/nixos/modules/system/etc/build-composefs-dump.py
index d8ede9aebf83..6b720f1c7631 100644
--- a/nixos/modules/system/etc/build-composefs-dump.py
+++ b/nixos/modules/system/etc/build-composefs-dump.py
@@ -20,6 +20,13 @@ from typing import Any
 
 Attrs = dict[str, Any]
 
+# mkcomposefs hard-limits inline content to LCFS_INLINE_CONTENT_MAX (5000 bytes).
+# We stay a bit below that. Files larger than this are served from the basedir
+# data-only lower layer via an overlay redirect; files at or below it are
+# embedded directly into the erofs metadata image, avoiding the redirect
+# indirection at read time and keeping the basedir empty in the common case.
+INLINE_CONTENT_MAX = 4096
+
 
 class FileType(Enum):
     """The filetype as defined by the `st_mode` stat field in octal
@@ -55,12 +62,14 @@ class ComposefsPath:
         mode: str,
         payload: str,
         path: str | None = None,
+        content: str = "-",
     ):
         if path is None:
             path = attrs["target"]
         self.path = path
         self.size = size
         self.filetype = filetype
+        self.content = content
 
         match len(mode):
             case 3 | 4:
@@ -95,6 +104,43 @@ def eprint(*args: Any, **kwargs: Any) -> None:
     print(*args, **kwargs, file=sys.stderr)
 
 
+# Bytes that may appear unescaped in a composefs-dump field. Everything else
+# is encoded as \xHH. See composefs-dump(5).
+_DUMP_SHORT_ESCAPES: dict[int, str] = {
+    ord("\\"): r"\\",
+    ord("\n"): r"\n",
+    ord("\r"): r"\r",
+    ord("\t"): r"\t",
+}
+
+
+def escape_dump_field(data: bytes) -> str:
+    """Escape raw bytes for use as a composefs-dump field.
+
+    The dump format separates fields by a single space and lines by a single
+    newline, uses '\\' as the escape character and reserves '-' for unset
+    optional fields, so all of these (plus non-printable bytes and '=') must
+    be escaped.
+    """
+    if data == b"":
+        # An empty CONTENT field would be indistinguishable from two spaces
+        # between PAYLOAD and DIGEST; callers must emit '-' for size-0 files
+        # instead of inlining them.
+        raise ValueError("cannot escape empty content; emit '-' instead")
+    if data == b"-":
+        # A bare '-' means "unset"; escape it so it round-trips as content.
+        return r"\x2d"
+    out: list[str] = []
+    for b in data:
+        if b in _DUMP_SHORT_ESCAPES:
+            out.append(_DUMP_SHORT_ESCAPES[b])
+        elif b in (ord(" "), ord("=")) or not (0x20 <= b <= 0x7E):
+            out.append(f"\\x{b:02x}")
+        else:
+            out.append(chr(b))
+    return "".join(out)
+
+
 def normalize_path(path: str) -> str:
     return str("/" + os.path.normpath(path).lstrip("/"))
 
@@ -201,14 +247,37 @@ def main() -> None:
                     payload=source,
                 )
             else:
-                composefs_path = ComposefsPath(
-                    attrs,
-                    size=os.stat(source).st_size,
-                    filetype=FileType.file,
-                    mode=mode,
-                    # payload needs to be relative path in this case
-                    payload=target.lstrip("/"),
-                )
+                size = os.stat(source).st_size
+                if size <= INLINE_CONTENT_MAX:
+                    # Inline small files directly into the erofs image so they
+                    # do not need to be served from the basedir data layer via
+                    # an overlay redirect. Empty files need neither payload nor
+                    # content; mkcomposefs treats size=0 as an empty inline
+                    # file.
+                    if size > 0:
+                        with open(source, "rb") as fh:
+                            raw = fh.read()
+                        content = escape_dump_field(raw)
+                        size = len(raw)
+                    else:
+                        content = "-"
+                    composefs_path = ComposefsPath(
+                        attrs,
+                        size=size,
+                        filetype=FileType.file,
+                        mode=mode,
+                        payload="-",
+                        content=content,
+                    )
+                else:
+                    composefs_path = ComposefsPath(
+                        attrs,
+                        size=size,
+                        filetype=FileType.file,
+                        mode=mode,
+                        # payload needs to be relative path in this case
+                        payload=target.lstrip("/"),
+                    )
             paths[target] = composefs_path
             add_leading_directories(target, attrs, paths)
 
diff --git a/nixos/modules/system/etc/etc.nix b/nixos/modules/system/etc/etc.nix
index 9ab019171b4c..46cf116eabbb 100644
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@@ -69,6 +69,22 @@ let
 
   etcHardlinks = lib.filter (f: f.mode != "symlink" && f.mode != "direct-symlink") etc';
 
+  # Regular files at or below this size are inlined into the erofs metadata
+  # image (see build-composefs-dump.py) and therefore do not need to be
+  # shipped in the basedir data-only lower layer. Keep this in sync with
+  # INLINE_CONTENT_MAX in build-composefs-dump.py.
+  etcInlineContentMax = 4096;
+
+  # Entries whose content we can prove at eval time will be served directly
+  # from the metadata image (inlined, or empty). Excluding them here keeps
+  # their source paths out of the basedir build script, so changing a small
+  # text-backed /etc file does not rebuild etc-lowerdir. Entries backed by
+  # `source` (size unknown at eval time) are kept and filtered at build time
+  # below.
+  isInlinedAtEvalTime = f: f.text != null && lib.stringLength f.text <= etcInlineContentMax;
+
+  etcBasedirEntries = lib.filter (f: !isInlinedAtEvalTime f) etcHardlinks;
+
 in
 
 {
@@ -371,6 +387,18 @@ in
         src="$1"
         target="$2"
 
+        if [[ -f "$src" ]]; then
+          # Small regular files are inlined into the erofs metadata image by
+          # build-composefs-dump.py and served directly from there, so we do
+          # not need a copy in the basedir data layer. Keep the size check in
+          # sync with INLINE_CONTENT_MAX in build-composefs-dump.py. Empty
+          # files need no backing copy either.
+          size=$(stat --dereference --format=%s "$src")
+          if (( size <= ${toString etcInlineContentMax} )); then
+            return
+          fi
+        fi
+
         mkdir -p "$out/$(dirname "$target")"
         cp "$src" "$out/$target"
       }
@@ -384,7 +412,7 @@ in
           "${etcEntry.source}"
           etcEntry.target
         ]
-      ) etcHardlinks}
+      ) etcBasedirEntries}
     '';
 
     system.build.etcMetadataImage =
diff --git a/nixos/tests/activation/etc-overlay-immutable.nix b/nixos/tests/activation/etc-overlay-immutable.nix
index a76c1ad297da..0f529161e58a 100644
--- a/nixos/tests/activation/etc-overlay-immutable.nix
+++ b/nixos/tests/activation/etc-overlay-immutable.nix
@@ -20,6 +20,23 @@
           text = "foo";
           mode = "0300";
         };
+        # Small regular file: inlined into the metadata erofs image.
+        inlinetest = {
+          text = "inline-content\n";
+          mode = "0640";
+        };
+        # Empty regular file: served directly from the metadata erofs image
+        # without payload or content.
+        emptytest = {
+          text = "";
+          mode = "0644";
+        };
+        # Large regular file (>4096 bytes): served from the basedir data layer
+        # via overlay redirect, not inlined.
+        bigfile = {
+          text = lib.strings.replicate 5000 "a";
+          mode = "0644";
+        };
       };
 
       # Prerequisites
@@ -63,6 +80,23 @@
         machine.succeed("stat --format '%F' /etc/modetest | tee /dev/stderr | grep -q 'regular file'")
         machine.succeed("stat --format '%F' /etc/modetest2 | tee /dev/stderr | grep -q 'regular file'")
 
+      with subtest("small regular files are inlined into the metadata image"):
+        assert machine.succeed("cat /etc/inlinetest") == "inline-content\n"
+        machine.succeed("stat --format '%a' /etc/inlinetest | tee /dev/stderr | grep -Eq '^640$'")
+        # Inlined files are stored in the metadata erofs image, not redirected
+        # to the basedir data layer, so they carry no overlay redirect xattr.
+        machine.fail("getfattr -h -n trusted.overlay.redirect /run/nixos-etc-metadata/inlinetest")
+
+      with subtest("empty regular files are served from the metadata image"):
+        assert machine.succeed("cat /etc/emptytest") == ""
+        machine.succeed("stat --format '%F %s %a' /etc/emptytest | tee /dev/stderr | grep -Eq '^regular empty file 0 644$'")
+        machine.fail("getfattr -h -n trusted.overlay.redirect /run/nixos-etc-metadata/emptytest")
+
+      with subtest("large regular files are served from the basedir"):
+        assert machine.succeed("wc -c < /etc/bigfile").strip() == "5000"
+        assert machine.succeed("head -c 10 /etc/bigfile") == "aaaaaaaaaa"
+        machine.succeed("getfattr -h -n trusted.overlay.redirect /run/nixos-etc-metadata/bigfile")
+
       with subtest("direct symlinks point to the target without indirection"):
         assert machine.succeed("readlink -n /etc/localtime") == "/etc/zoneinfo/Utc"
 
diff --git a/nixos/tests/activation/etc-overlay-mutable.nix b/nixos/tests/activation/etc-overlay-mutable.nix
index b30ca7b4fd89..3bfe85db8fdd 100644
--- a/nixos/tests/activation/etc-overlay-mutable.nix
+++ b/nixos/tests/activation/etc-overlay-mutable.nix
@@ -20,6 +20,23 @@
           text = "foo";
           mode = "0300";
         };
+        # Small regular file: inlined into the metadata erofs image.
+        inlinetest = {
+          text = "inline-content\n";
+          mode = "0640";
+        };
+        # Empty regular file: served directly from the metadata erofs image
+        # without payload or content.
+        emptytest = {
+          text = "";
+          mode = "0644";
+        };
+        # Large regular file (>4096 bytes): served from the basedir data layer
+        # via overlay redirect, not inlined.
+        bigfile = {
+          text = lib.strings.replicate 5000 "a";
+          mode = "0644";
+        };
       };
 
       # Prerequisites
@@ -66,6 +83,23 @@
         machine.succeed("test -d /.rw-etc/upper/nixos")
         print(machine.succeed("getfattr -h -d -m 'trusted.overlay' /.rw-etc/upper/nixos 2>&1 || true"))
 
+      with subtest("small regular files are inlined into the metadata image"):
+        assert machine.succeed("cat /etc/inlinetest") == "inline-content\n"
+        machine.succeed("stat --format '%a' /etc/inlinetest | tee /dev/stderr | grep -Eq '^640$'")
+        # Inlined files are stored in the metadata erofs image, not redirected
+        # to the basedir data layer, so they carry no overlay redirect xattr.
+        machine.fail("getfattr -h -n trusted.overlay.redirect /run/nixos-etc-metadata/inlinetest")
+
+      with subtest("empty regular files are served from the metadata image"):
+        assert machine.succeed("cat /etc/emptytest") == ""
+        machine.succeed("stat --format '%F %s %a' /etc/emptytest | tee /dev/stderr | grep -Eq '^regular empty file 0 644$'")
+        machine.fail("getfattr -h -n trusted.overlay.redirect /run/nixos-etc-metadata/emptytest")
+
+      with subtest("large regular files are served from the basedir"):
+        assert machine.succeed("wc -c < /etc/bigfile").strip() == "5000"
+        assert machine.succeed("head -c 10 /etc/bigfile") == "aaaaaaaaaa"
+        machine.succeed("getfattr -h -n trusted.overlay.redirect /run/nixos-etc-metadata/bigfile")
+
       with subtest("switching to the same generation"):
         machine.succeed("/run/current-system/bin/switch-to-configuration test")
 

From 0c3ac859aa0bba60d1c2deeb31eac6b62f67be11 Mon Sep 17 00:00:00 2001
From: Sapphire <imsapphire0@gmail.com>
Date: Thu, 18 Jun 2026 06:47:14 -0500
Subject: [PATCH 06/58] alcom: 1.1.5 -> 1.1.6

---
 .../al/alcom/disable-updater-artifacts.patch        | 13 -------------
 pkgs/by-name/al/alcom/package.nix                   | 13 +++++--------
 2 files changed, 5 insertions(+), 21 deletions(-)
 delete mode 100644 pkgs/by-name/al/alcom/disable-updater-artifacts.patch

diff --git a/pkgs/by-name/al/alcom/disable-updater-artifacts.patch b/pkgs/by-name/al/alcom/disable-updater-artifacts.patch
deleted file mode 100644
index 17e739d312c6..000000000000
--- a/pkgs/by-name/al/alcom/disable-updater-artifacts.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/vrc-get-gui/Tauri.toml b/vrc-get-gui/Tauri.toml
-index cd180da8..66a81aa9 100644
---- a/vrc-get-gui/Tauri.toml
-+++ b/vrc-get-gui/Tauri.toml
-@@ -34,8 +34,6 @@ icon = [
- resources = []
- publisher = "anatawa12"
- 
--createUpdaterArtifacts = "v1Compatible"  # remove if ci # we do not generate updater artifacts in CI
--
- [[bundle.fileAssociations]]
- # note: for macOS we directory use info.plist for registering file association.
- description = "ALCOM Project Template"
diff --git a/pkgs/by-name/al/alcom/package.nix b/pkgs/by-name/al/alcom/package.nix
index fb58e6d60d59..3a6fb61495a3 100644
--- a/pkgs/by-name/al/alcom/package.nix
+++ b/pkgs/by-name/al/alcom/package.nix
@@ -18,13 +18,13 @@
 }:
 let
   pname = "alcom";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchFromGitHub {
     owner = "vrc-get";
     repo = "vrc-get";
     tag = "gui-v${version}";
-    hash = "sha256-xucU8nXskniHOiuwrtVoZM2FIKNKU45i4DNo6iLjZvM=";
+    hash = "sha256-TpVHE3e3dMdBOtPVKomKvg5tQf42QWik18k5oVD2Hms=";
   };
 
   subdir = "vrc-get-gui";
@@ -32,10 +32,6 @@ in
 rustPlatform.buildRustPackage {
   inherit pname version src;
 
-  patches = [
-    ./disable-updater-artifacts.patch
-  ];
-
   nativeBuildInputs = [
     cargo-about
     cargo-tauri.hook
@@ -55,13 +51,14 @@ rustPlatform.buildRustPackage {
     webkitgtk_4_1
   ];
 
-  cargoHash = "sha256-MeCx3BoEXckMZfecyBcwwVE8+6V9Di6ULkIhUvUFZIA=";
+  cargoHash = "sha256-J8vCr+B4J3ZqxkkNk+x0jr52qNJJYfBJe2oyLf0GLsc=";
+  buildFeatures = [ "no-self-updater" ];
   buildAndTestSubdir = subdir;
 
   npmDeps = fetchNpmDeps {
     inherit src;
     sourceRoot = "${src.name}/${subdir}";
-    hash = "sha256-snXOfAtanLPhQNo0mg/r8UUXJua2X+52t7+7QS1vOkI=";
+    hash = "sha256-VyA2c2659Kg1DjLmmtvSAivltdraSBNArIu1XGENGmQ=";
   };
   npmRoot = subdir;
 

From b83f400a0fceccdf95877d109370b0dfe12e87d2 Mon Sep 17 00:00:00 2001
From: Sapphire <imsapphire0@gmail.com>
Date: Thu, 18 Jun 2026 06:52:28 -0500
Subject: [PATCH 07/58] alcom: migrate to finalAttrs

---
 pkgs/by-name/al/alcom/package.nix | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/al/alcom/package.nix b/pkgs/by-name/al/alcom/package.nix
index 3a6fb61495a3..30268c8c0e23 100644
--- a/pkgs/by-name/al/alcom/package.nix
+++ b/pkgs/by-name/al/alcom/package.nix
@@ -17,21 +17,18 @@
   webkitgtk_4_1,
 }:
 let
+  subdir = "vrc-get-gui";
+in
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alcom";
   version = "1.1.6";
-
   src = fetchFromGitHub {
     owner = "vrc-get";
     repo = "vrc-get";
-    tag = "gui-v${version}";
+    tag = "gui-v${finalAttrs.version}";
     hash = "sha256-TpVHE3e3dMdBOtPVKomKvg5tQf42QWik18k5oVD2Hms=";
   };
 
-  subdir = "vrc-get-gui";
-in
-rustPlatform.buildRustPackage {
-  inherit pname version src;
-
   nativeBuildInputs = [
     cargo-about
     cargo-tauri.hook
@@ -56,8 +53,8 @@ rustPlatform.buildRustPackage {
   buildAndTestSubdir = subdir;
 
   npmDeps = fetchNpmDeps {
-    inherit src;
-    sourceRoot = "${src.name}/${subdir}";
+    inherit (finalAttrs) src;
+    sourceRoot = "${finalAttrs.src.name}/${subdir}";
     hash = "sha256-VyA2c2659Kg1DjLmmtvSAivltdraSBNArIu1XGENGmQ=";
   };
   npmRoot = subdir;
@@ -70,4 +67,4 @@ rustPlatform.buildRustPackage {
     broken = stdenv.hostPlatform.isDarwin;
     mainProgram = "ALCOM";
   };
-}
+})

From 3d53a90818cae9413d94aebf5e5c007271a4e230 Mon Sep 17 00:00:00 2001
From: Sapphire <imsapphire0@gmail.com>
Date: Thu, 18 Jun 2026 06:59:35 -0500
Subject: [PATCH 08/58] alcom: add name to npmDeps derivation

---
 pkgs/by-name/al/alcom/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/al/alcom/package.nix b/pkgs/by-name/al/alcom/package.nix
index 30268c8c0e23..eca1d1b51a5c 100644
--- a/pkgs/by-name/al/alcom/package.nix
+++ b/pkgs/by-name/al/alcom/package.nix
@@ -53,6 +53,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildAndTestSubdir = subdir;
 
   npmDeps = fetchNpmDeps {
+    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/${subdir}";
     hash = "sha256-VyA2c2659Kg1DjLmmtvSAivltdraSBNArIu1XGENGmQ=";

From c8ebe4ff9aed9f5a3f07426b11f5e1d42bfa947f Mon Sep 17 00:00:00 2001
From: Sapphire <imsapphire0@gmail.com>
Date: Thu, 18 Jun 2026 06:59:55 -0500
Subject: [PATCH 09/58] alcom: add me as maintainer

---
 pkgs/by-name/al/alcom/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/al/alcom/package.nix b/pkgs/by-name/al/alcom/package.nix
index eca1d1b51a5c..eccbad84748d 100644
--- a/pkgs/by-name/al/alcom/package.nix
+++ b/pkgs/by-name/al/alcom/package.nix
@@ -64,7 +64,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Experimental GUI application to manage VRChat Unity Projects";
     homepage = "https://github.com/vrc-get/vrc-get";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ Scrumplex ];
+    maintainers = with lib.maintainers; [
+      Scrumplex
+      ImSapphire
+    ];
     broken = stdenv.hostPlatform.isDarwin;
     mainProgram = "ALCOM";
   };

From c09e87bad1652edc0b9d2674b9f35a100b5784da Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 20 Jun 2026 02:08:37 +0000
Subject: [PATCH 10/58] miller: 6.18.1 -> 6.19.0

---
 pkgs/by-name/mi/miller/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mi/miller/package.nix b/pkgs/by-name/mi/miller/package.nix
index 9a4633b889f9..08881804e38b 100644
--- a/pkgs/by-name/mi/miller/package.nix
+++ b/pkgs/by-name/mi/miller/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "miller";
-  version = "6.18.1";
+  version = "6.19.0";
 
   src = fetchFromGitHub {
     owner = "johnkerl";
     repo = "miller";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-pXxXUw956M5EUhL1TFtQp1JTXQwQK9qxp2vjBkozi/0=";
+    sha256 = "sha256-kIhJ9wysaWnZNvaWaNE32FQOHFDNBtUl41d1Z45VFac=";
   };
 
   outputs = [
@@ -20,7 +20,7 @@ buildGoModule (finalAttrs: {
     "man"
   ];
 
-  vendorHash = "sha256-ZnNEOVChF3kizfjti6Cgexvt/5UPIRQsyfUz8c03EKc=";
+  vendorHash = "sha256-PzklwkT2Chs3z1UzLX9g9hpDGTHmyxfiT0igSntXPqo=";
 
   postInstall = ''
     mkdir -p $man/share/man/man1

From 39e3856dd8b49a25d04f210c5cf69da89d0fdc79 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Sun, 21 Jun 2026 22:57:50 +0300
Subject: [PATCH 11/58] nixos/zigbee2mqtt: add RestartSec

After a cold reboot, zigbee2mqtt didn't properly come up.
The logs showed it crashed too often too quickly, and then systemd
stopped trying to restart it due to rate-limiting.

It might be due to the network not being up yet, or the Zigbee
coordinator still booting.

Either way, with a RestartSec=10, it did come up.
---
 nixos/modules/services/home-automation/zigbee2mqtt.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/home-automation/zigbee2mqtt.nix b/nixos/modules/services/home-automation/zigbee2mqtt.nix
index 5ec4d037073d..5fe8b3a68db7 100644
--- a/nixos/modules/services/home-automation/zigbee2mqtt.nix
+++ b/nixos/modules/services/home-automation/zigbee2mqtt.nix
@@ -84,6 +84,7 @@ in
         StateDirectory = "zigbee2mqtt";
         StateDirectoryMode = "0700";
         Restart = "on-failure";
+        RestartSec = 10;
 
         # Hardening
         CapabilityBoundingSet = "";

From f4847785d567d772553a29f216d1dfada5d8c792 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 22 Jun 2026 10:16:11 +0200
Subject: [PATCH 12/58] xmldiff: use toPythonApplication instead of redefining
 the whole package

---
 pkgs/by-name/xm/xmldiff/package.nix | 46 ++---------------------------
 1 file changed, 2 insertions(+), 44 deletions(-)

diff --git a/pkgs/by-name/xm/xmldiff/package.nix b/pkgs/by-name/xm/xmldiff/package.nix
index 4eccca0ffc50..df5fb289b148 100644
--- a/pkgs/by-name/xm/xmldiff/package.nix
+++ b/pkgs/by-name/xm/xmldiff/package.nix
@@ -1,45 +1,3 @@
-{
-  lib,
-  python3,
-  fetchFromGitHub,
-}:
+{ python3Packages }:
 
-let
-  version = "2.6.3";
-  src = fetchFromGitHub {
-    owner = "Shoobx";
-    repo = "xmldiff";
-    rev = version;
-    hash = "sha256-qn8gGultTSNKPUro6Ap4xJGcbpxV+lKgZFpKvyPdhtc=";
-  };
-in
-python3.pkgs.buildPythonApplication {
-  pname = "xmldiff";
-  inherit version src;
-  pyproject = true;
-
-  build-system = with python3.pkgs; [ setuptools ];
-
-  dependencies = with python3.pkgs; [
-    lxml
-    setuptools # pkg_resources is imported during runtime
-  ];
-
-  meta = {
-    homepage = "https://xmldiff.readthedocs.io/en/stable/";
-    description = "Library and command line utility for diffing xml";
-    longDescription = ''
-      xmldiff is a library and a command-line utility for making diffs out of
-      XML. This may seem like something that doesn't need a dedicated utility,
-      but change detection in hierarchical data is very different from change
-      detection in flat data. XML type formats are also not only used for
-      computer readable data, it is also often used as a format for hierarchical
-      data that can be rendered into human readable formats. A traditional diff
-      on such a format would tell you line by line the differences, but this
-      would not be readable by a human. xmldiff provides tools to make human
-      readable diffs in those situations.
-    '';
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ anpryl ];
-  };
-}
+python3Packages.toPythonApplication python3Packages.xmldiff

From 3e3cbaecb4e3bee803b1a7123000a43df316186c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 22 Jun 2026 12:15:56 -0700
Subject: [PATCH 13/58] parla: init at 0.5.6

---
 pkgs/by-name/pa/parla/package.nix | 59 +++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 pkgs/by-name/pa/parla/package.nix

diff --git a/pkgs/by-name/pa/parla/package.nix b/pkgs/by-name/pa/parla/package.nix
new file mode 100644
index 000000000000..e8c7fb906534
--- /dev/null
+++ b/pkgs/by-name/pa/parla/package.nix
@@ -0,0 +1,59 @@
+{
+  deltachat-rpc-server,
+  fetchFromGitHub,
+  glib,
+  gtk4,
+  json-glib,
+  lib,
+  libadwaita,
+  meson,
+  ninja,
+  nix-update-script,
+  pkg-config,
+  stdenv,
+  vala,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "parla";
+  version = "0.5.6";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "trufae";
+    repo = "parla";
+    tag = finalAttrs.version;
+    hash = "sha256-ZCIEjpsGh4WjzTRapoUoZTt5ld4K/SranfLIUWM0htk=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    vala
+  ];
+
+  mesonFlags = [
+    "-Drpc_server_path=${lib.getExe deltachat-rpc-server}"
+  ];
+
+  buildInputs = [
+    glib
+    gtk4
+    json-glib
+    libadwaita
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/trufae/parla/releases/tag/${finalAttrs.src.tag}";
+    description = "Native Gnome DeltaChat client";
+    homepage = "https://github.com/trufae/parla";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "parla";
+    maintainers = [ lib.maintainers.dotlambda ];
+    platforms = lib.platforms.linux;
+  };
+})

From 5598a671647ca185cc4b29971133475467890344 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 21:21:58 +0000
Subject: [PATCH 14/58] carapace: 1.6.3 -> 1.7.1

---
 pkgs/by-name/ca/carapace/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/carapace/package.nix b/pkgs/by-name/ca/carapace/package.nix
index 244dc57c2c56..d9f24a312b73 100644
--- a/pkgs/by-name/ca/carapace/package.nix
+++ b/pkgs/by-name/ca/carapace/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "carapace";
-  version = "1.6.3";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k6fWtwDTNc2qcr9ryL7wMVy744fiP8NrLqm4crVr+EI=";
+    hash = "sha256-wIRBz1WjN4Sy5hkRvAWHWRrtcTpVdY7BOLp1KF8UC5A=";
   };
 
-  vendorHash = "sha256-5AqoM16M5pPfRYxqa72LrHJRRatK2qnZK3pQIoFXG9g=";
+  vendorHash = "sha256-s6Wq7+2S7hxAhU2OJ8TCkSG5H9dJjwlDy5G02Uqnzm4=";
 
   proxyVendor = true;
 

From f22c621047ccd3195dfb310d8e82eb153981182d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 02:03:03 +0000
Subject: [PATCH 15/58] quarkus: 3.36.1 -> 3.36.3

---
 pkgs/by-name/qu/quarkus/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index d6e0b5362112..fd2b5d4818d2 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.36.1";
+  version = "3.36.3";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-fhGWH8ksB0JzhQL8EWkKCFA+8EpY7EMsgnTMHqGFbQ0=";
+    hash = "sha256-qb93KrBzoAe6Kt9GPH3jZ3jnBOnWxrY+d9FmYz5RM/c=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 19863f1d2a55140e833bef391e9380555cf06f45 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Wed, 24 Jun 2026 14:30:12 +0200
Subject: [PATCH 16/58] grafana: 13.0.2 -> 13.0.3

ChangeLog: https://github.com/grafana/grafana/releases/tag/v13.0.3
---
 pkgs/by-name/gr/grafana/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/gr/grafana/package.nix b/pkgs/by-name/gr/grafana/package.nix
index 19e9c093ff56..c7ad9b9f092a 100644
--- a/pkgs/by-name/gr/grafana/package.nix
+++ b/pkgs/by-name/gr/grafana/package.nix
@@ -21,7 +21,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "grafana";
-  version = "13.0.2";
+  version = "13.0.3";
 
   subPackages = [
     "pkg/cmd/grafana"
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
     owner = "grafana";
     repo = "grafana";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-knalINdJPFrvj6HNxWPV6wu6TSkrRvgkZjOnECOsWwU=";
+    hash = "sha256-HOTArHAoqhyKiqJf0Py2JMiMBloSgNDnVPDcKWlnY3I=";
   };
 
   patches = [
@@ -55,12 +55,12 @@ buildGoModule (finalAttrs: {
   # Since this is not a dependency attribute the buildPackages has to be specified.
   offlineCache = buildPackages.yarn-berry_4-fetcher.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes patches;
-    hash = "sha256-NXDXmed2TsMQS99breDt0Ky6X2ZyuWkJ5KyKz5Apkt8=";
+    hash = "sha256-pYuNW74ghHmBVzRcfXTXROjxo2FmsxmkTUbJpEFMkow=";
   };
 
   disallowedRequisites = [ finalAttrs.offlineCache ];
 
-  vendorHash = "sha256-rFGwtplr+n0qgIulycNQ5L/lh4ZFoHCrYeIfbb+e/h4=";
+  vendorHash = "sha256-dVu95a6xc7fEK3epeY0ZzF4IUT+WhozAmSDicYoIL4A=";
 
   # Grafana seems to just set it to the latest version available
   # nowadays.

From 3f6b9fde5ebe2235521ad56743674bb68d0880a8 Mon Sep 17 00:00:00 2001
From: provokateurin <kate@provokateurin.de>
Date: Wed, 24 Jun 2026 17:23:00 +0200
Subject: [PATCH 17/58] nextcloudPackages: update

---
 pkgs/servers/nextcloud/packages/32.json | 42 ++++++++++-----------
 pkgs/servers/nextcloud/packages/33.json | 50 ++++++++++++-------------
 2 files changed, 46 insertions(+), 46 deletions(-)

diff --git a/pkgs/servers/nextcloud/packages/32.json b/pkgs/servers/nextcloud/packages/32.json
index 359ec5d6ec96..2ac439f8d728 100644
--- a/pkgs/servers/nextcloud/packages/32.json
+++ b/pkgs/servers/nextcloud/packages/32.json
@@ -1,8 +1,8 @@
 {
   "bookmarks": {
-    "hash": "sha256-wf3t7qwxFAJBnPP3PYfa3Q/LrUaoONY47/So2w2fDww=",
-    "url": "https://github.com/nextcloud/bookmarks/releases/download/v16.2.1/bookmarks-16.2.1.tar.gz",
-    "version": "16.2.1",
+    "hash": "sha256-8F+sNG/+M8Ed/q5dcxW95KS5ZBNsEeZNR0P2OIe/HqQ=",
+    "url": "https://github.com/nextcloud/bookmarks/releases/download/v16.2.2/bookmarks-16.2.2.tar.gz",
+    "version": "16.2.2",
     "description": "- 📂 Sort bookmarks into folders\n- 🏷 Add tags and personal notes\n- ☠ Find broken links and duplicates\n- 📲 Synchronize with all your browsers and devices\n- 📔 Store archived versions of your links in case they are depublished\n- 🔍 Full-text search on site contents\n- 👪 Share bookmarks with other users, groups and teams or via public links\n- ⚛ Generate RSS feeds of your collections\n- 📈 Stats on how often you access which links\n- 🔒 Automatic backups of your bookmarks collection\n- 💼 Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n   - intl: *\n   - mbstring: *\n - when using MySQL, use at least v8.0",
     "homepage": "https://github.com/nextcloud/bookmarks",
     "licenses": [
@@ -30,9 +30,9 @@
     ]
   },
   "collectives": {
-    "hash": "sha256-ul8DRAOna5gCS9v0HhqFGdh/fFv6weG5x8ZMZjTLjhM=",
-    "url": "https://github.com/nextcloud/collectives/releases/download/v4.4.1/collectives-4.4.1.tar.gz",
-    "version": "4.4.1",
+    "hash": "sha256-/MGwV78AAzsoAvI11JeodQsbiMZs1J58NzsGrEIv5EA=",
+    "url": "https://github.com/nextcloud/collectives/releases/download/v4.4.2/collectives-4.4.2.tar.gz",
+    "version": "4.4.2",
     "description": "Your space to collaboratively write and organize. Collectives is designed for groups and communities\nto structure shared knowledge and cultivate trust.\n\n* **👥 Non-hierarchical at its core**: Each collective is backed by a\n  [Nextcloud Team](https://docs.nextcloud.com/server/latest/user_manual/en/groupware/contacts.html#teams) - its\n  content is owned by the group, not a single user.\n* **📝 Collaborative page editing** thanks to the [Text app](https://github.com/nextcloud/text).\n* **🔤 Well-known [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax** for page formatting.\n* **🔎 Full-text search** to find content straight away.",
     "homepage": "https://collectives.cloud/",
     "licenses": [
@@ -80,9 +80,9 @@
     ]
   },
   "deck": {
-    "hash": "sha256-t/9nWA3e2WBkMjevWMpzmhjBY8OaQS4nwryto4WJwtw=",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.16.6/deck-v1.16.6.tar.gz",
-    "version": "1.16.6",
+    "hash": "sha256-InDmm6aj8y8qfZ7i765XJIh4q0vsTlVtxA6n0E6rll0=",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.16.7/deck-v1.16.7.tar.gz",
+    "version": "1.16.7",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -140,9 +140,9 @@
     ]
   },
   "gpoddersync": {
-    "hash": "sha256-9BcXVauZWFlmlXtnwdSo5xISbhhssa7ao5ulKpziOnU=",
-    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.16.0/gpoddersync.tar.gz",
-    "version": "3.16.0",
+    "hash": "sha256-V4iJr1p5uqxdrvE50bjyNTiHdsZATewaBXKQ8Ma0dHg=",
+    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.17.0/gpoddersync.tar.gz",
+    "version": "3.17.0",
     "description": "Expose GPodder API to sync podcast consumer apps like AntennaPod",
     "homepage": "https://github.com/thrillfall/nextcloud-gpodder",
     "licenses": [
@@ -210,9 +210,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-K6sJ3XJOq9MoO0lGgqn3iBYuDqqhOMeHWD1DLVY5HaU=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.1/mail-v5.10.1.tar.gz",
-    "version": "5.10.1",
+    "hash": "sha256-GkLTk3Q1mSUGhU6lsNHmHGkwW6u4XoDCOj405vi8xuY=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.3/mail-v5.10.3.tar.gz",
+    "version": "5.10.3",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -290,9 +290,9 @@
     ]
   },
   "onlyoffice": {
-    "hash": "sha256-+phzZA410n9QQsba26OUf7XR+x24XMnmHamhqsqlcVo=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.14.0/onlyoffice.tar.gz",
-    "version": "9.14.0",
+    "hash": "sha256-sMgBVVAv6n6TlrvcndzRLc1xPJ6eA4hYBqDpiDabW1k=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.14.2/onlyoffice.tar.gz",
+    "version": "9.14.2",
     "description": "The ONLYOFFICE app for Nextcloud brings powerful document editing and collaboration tools directly to your Nextcloud environment. With this integration, you can seamlessly create, edit, and co-author text documents, spreadsheets, presentations, and PDFs, as well as build and fill out PDF forms.\n\nCollaborate with your team in real time, make use of Track Changes, version history, comments, integrated chat, and more. Work together on files with federated cloud sharing. Flexible access permissions allow you to control who can view, edit, or comment, ensuring secure role-based collaboration tailored to your needs. Documents can also be protected with watermarks, password settings, and encryption for added security.\n\nThe app offers support for over 50 file formats, including DOCX, XLSX, PPTX, PDF, RTF, TXT, CSV, ODT, ODS, ODP, EPUB, FB2, HTML, HWP, HWPX, Pages, Numbers, Keynote, etc. Seamless desktop and mobile app integration means you'll have access to your Nextcloud files wherever you go.\n\nFurthermore, you can seamlessly connect any AI assistant, including local ones, directly to the editors to work faster and more efficient. This allows you to leverage various AI models for tasks like chatbot interactions, translations, OCR, and more.\n\nWhether you’re working with internal teams or external collaborators, the ONLYOFFICE app for Nextcloud enhances productivity, simplifies workflows, and ensures your files remain secure.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
@@ -410,9 +410,9 @@
     ]
   },
   "tasks": {
-    "hash": "sha256-I5QdNavgv74FSuXwFWNz/++LOY9Z8kNZhEKf2k118L8=",
-    "url": "https://github.com/nextcloud/tasks/releases/download/v0.17.1/tasks.tar.gz",
-    "version": "0.17.1",
+    "hash": "sha256-nJFU65dthPRWd/SClKM/suZdYU3ic3QsIcXiPzUkQ6c=",
+    "url": "https://github.com/nextcloud/tasks/releases/download/v0.18.0/tasks.tar.gz",
+    "version": "0.18.0",
     "description": "Once enabled, a new Tasks menu will appear in your Nextcloud apps menu. From there you can add and delete tasks, edit their title, description, start and due dates and mark them as important. Tasks can be shared between users. Tasks can be synchronized using CalDav (each task list is linked to an Nextcloud calendar, to sync it to your local client: Thunderbird, Evolution, KDE Kontact, iCal … - just add the calendar as a remote calendar in your client). You can download your tasks as ICS files using the download button for each calendar.",
     "homepage": "https://github.com/nextcloud/tasks/",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/33.json b/pkgs/servers/nextcloud/packages/33.json
index 9e0de83486d2..f8118f92fa10 100644
--- a/pkgs/servers/nextcloud/packages/33.json
+++ b/pkgs/servers/nextcloud/packages/33.json
@@ -1,8 +1,8 @@
 {
   "bookmarks": {
-    "hash": "sha256-wf3t7qwxFAJBnPP3PYfa3Q/LrUaoONY47/So2w2fDww=",
-    "url": "https://github.com/nextcloud/bookmarks/releases/download/v16.2.1/bookmarks-16.2.1.tar.gz",
-    "version": "16.2.1",
+    "hash": "sha256-8F+sNG/+M8Ed/q5dcxW95KS5ZBNsEeZNR0P2OIe/HqQ=",
+    "url": "https://github.com/nextcloud/bookmarks/releases/download/v16.2.2/bookmarks-16.2.2.tar.gz",
+    "version": "16.2.2",
     "description": "- 📂 Sort bookmarks into folders\n- 🏷 Add tags and personal notes\n- ☠ Find broken links and duplicates\n- 📲 Synchronize with all your browsers and devices\n- 📔 Store archived versions of your links in case they are depublished\n- 🔍 Full-text search on site contents\n- 👪 Share bookmarks with other users, groups and teams or via public links\n- ⚛ Generate RSS feeds of your collections\n- 📈 Stats on how often you access which links\n- 🔒 Automatic backups of your bookmarks collection\n- 💼 Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n   - intl: *\n   - mbstring: *\n - when using MySQL, use at least v8.0",
     "homepage": "https://github.com/nextcloud/bookmarks",
     "licenses": [
@@ -30,9 +30,9 @@
     ]
   },
   "collectives": {
-    "hash": "sha256-ul8DRAOna5gCS9v0HhqFGdh/fFv6weG5x8ZMZjTLjhM=",
-    "url": "https://github.com/nextcloud/collectives/releases/download/v4.4.1/collectives-4.4.1.tar.gz",
-    "version": "4.4.1",
+    "hash": "sha256-/MGwV78AAzsoAvI11JeodQsbiMZs1J58NzsGrEIv5EA=",
+    "url": "https://github.com/nextcloud/collectives/releases/download/v4.4.2/collectives-4.4.2.tar.gz",
+    "version": "4.4.2",
     "description": "Your space to collaboratively write and organize. Collectives is designed for groups and communities\nto structure shared knowledge and cultivate trust.\n\n* **👥 Non-hierarchical at its core**: Each collective is backed by a\n  [Nextcloud Team](https://docs.nextcloud.com/server/latest/user_manual/en/groupware/contacts.html#teams) - its\n  content is owned by the group, not a single user.\n* **📝 Collaborative page editing** thanks to the [Text app](https://github.com/nextcloud/text).\n* **🔤 Well-known [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax** for page formatting.\n* **🔎 Full-text search** to find content straight away.",
     "homepage": "https://collectives.cloud/",
     "licenses": [
@@ -80,9 +80,9 @@
     ]
   },
   "deck": {
-    "hash": "sha256-n0q700fSmqZ9tvsfSquXwh4ujtiBsW3wUaLnohu1MFg=",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.17.3/deck-v1.17.3.tar.gz",
-    "version": "1.17.3",
+    "hash": "sha256-DVSFbea5d0CL3bdpO8iOBYXKHSbXCQ8oLHi5YkPbCI4=",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.17.4/deck-v1.17.4.tar.gz",
+    "version": "1.17.4",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -90,13 +90,13 @@
     ]
   },
   "end_to_end_encryption": {
-    "hash": "sha256-+krBgynHh8sz6HZrpHsrRQRc/NedD6fW5jEwPrz8Vas=",
-    "url": "https://github.com/nextcloud-releases/end_to_end_encryption/releases/download/v2.1.1/end_to_end_encryption-v2.1.1.tar.gz",
-    "version": "2.1.1",
+    "hash": "sha256-Z6MyXz//LNVy7Mt+yFbHIY5zGEMfsdwnAEDFsIcrs1M=",
+    "url": "https://github.com/nextcloud-releases/end_to_end_encryption/releases/download/v2.2.0/end_to_end_encryption-v2.2.0.tar.gz",
+    "version": "2.2.0",
     "description": "## **End-to-End Encryption**\n\n### For End Users\n\n**Protect your most sensitive files with strong encryption.**\n\nThe End-to-End Encryption app gives you complete control over your data privacy.\nWith this app, you can encrypt specific folders so that only you (and those you trust) can access their contents.\nYour files are encrypted on your device before they reach the server, ensuring that no one—not even the server administrator—can read them.\n\n**Benefits:**\n- 🔒 **True privacy**: Files are encrypted on your device and can only be decrypted by you\n- 📱 **Works across all platforms**: Fully supported on desktop, Android, iOS clients, and as you wish even in the browser\n- 🎯 **Selective encryption**: Choose which folders to encrypt\n- 🛡️ **Secure sharing**: Share encrypted files with other users or even secure public upload using the encrypted file drop\n\n---\n\n### For Administrators\n\n**Enterprise-ready end-to-end encryption infrastructure for your Nextcloud instance.**\n\nThis app provides all the necessary server-side APIs and infrastructure to enable End-to-End encryption (E2EE) for your users.\nIt ensures that encrypted data remains secure throughout its lifecycle on your server.\n\n**Technical highlights:**\n- 🔐 **Complete API suite**: Provides all client-side APIs needed for E2EE implementation\n- 🔒 **Secure FileDrop integration**: Enables secure file sharing with encryption\n- 🛡️ **Zero-knowledge architecture**: Server never has access to encryption keys\n- ⚙️ **Group restrictions**: Limit app usage to specific user groups if needed\n- 🔄 **Background job management**: Automatic rollback handling for failed operations\n\n### Setup\nThis application provides the server-side infrastructure for end-to-end encryption, but it requires client support to function.\nTo enable end-to-end encryption, users will need to install the corresponding client-side app on their devices (desktop, Android, iOS) or use the web client.\n\nUsing the web interface, after enabling it in the personal settings, allows you to encrypt files and folders directly in the browser,\nproviding a seamless experience without needing additional software. But also requires some kind of trust in the server as the code is delivered by the server and could be manipulated.\n\nOnce enable through clients or the web interface, you can create encrypted folders and upload or move files into them.\nThe clients and the web interface will handle the encryption and decryption processes automatically.\n\n⚠️ This comes with some limitations and caveats, as only normal file operations can be handled.\nMeaning that some apps in the web interface do not work with encrypted files.",
     "homepage": "https://github.com/nextcloud/end_to_end_encryption",
     "licenses": [
-      "agpl"
+      "AGPL-3.0-or-later"
     ]
   },
   "files_automatedtagging": {
@@ -140,9 +140,9 @@
     ]
   },
   "gpoddersync": {
-    "hash": "sha256-9BcXVauZWFlmlXtnwdSo5xISbhhssa7ao5ulKpziOnU=",
-    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.16.0/gpoddersync.tar.gz",
-    "version": "3.16.0",
+    "hash": "sha256-V4iJr1p5uqxdrvE50bjyNTiHdsZATewaBXKQ8Ma0dHg=",
+    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.17.0/gpoddersync.tar.gz",
+    "version": "3.17.0",
     "description": "Expose GPodder API to sync podcast consumer apps like AntennaPod",
     "homepage": "https://github.com/thrillfall/nextcloud-gpodder",
     "licenses": [
@@ -210,9 +210,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-K6sJ3XJOq9MoO0lGgqn3iBYuDqqhOMeHWD1DLVY5HaU=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.1/mail-v5.10.1.tar.gz",
-    "version": "5.10.1",
+    "hash": "sha256-GkLTk3Q1mSUGhU6lsNHmHGkwW6u4XoDCOj405vi8xuY=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.3/mail-v5.10.3.tar.gz",
+    "version": "5.10.3",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -290,9 +290,9 @@
     ]
   },
   "onlyoffice": {
-    "hash": "sha256-ktKopFpHmtRulOQN3XO5BW5QyhURhOv+G77dSn6Nv08=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v10.1.0/onlyoffice.tar.gz",
-    "version": "10.1.0",
+    "hash": "sha256-QaohaMbw7bncBqreb5W8XngzqqwqALnsGgT494xfr/E=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v10.1.2/onlyoffice.tar.gz",
+    "version": "10.1.2",
     "description": "The ONLYOFFICE app for Nextcloud brings powerful document editing and collaboration tools directly to your Nextcloud environment. With this integration, you can seamlessly create, edit, and co-author text documents, spreadsheets, presentations, and PDFs, as well as build and fill out PDF forms.\n\nCollaborate with your team in real time, make use of Track Changes, version history, comments, integrated chat, and more. Work together on files with federated cloud sharing. Flexible access permissions allow you to control who can view, edit, or comment, ensuring secure role-based collaboration tailored to your needs. Documents can also be protected with watermarks, password settings, and encryption for added security.\n\nThe app offers support for over 50 file formats, including DOCX, XLSX, PPTX, PDF, RTF, TXT, CSV, ODT, ODS, ODP, EPUB, FB2, HTML, HWP, HWPX, Pages, Numbers, Keynote, etc. Seamless desktop and mobile app integration means you'll have access to your Nextcloud files wherever you go.\n\nFurthermore, you can seamlessly connect any AI assistant, including local ones, directly to the editors to work faster and more efficient. This allows you to leverage various AI models for tasks like chatbot interactions, translations, OCR, and more.\n\nWhether you’re working with internal teams or external collaborators, the ONLYOFFICE app for Nextcloud enhances productivity, simplifies workflows, and ensures your files remain secure.",
     "homepage": "https://www.onlyoffice.com",
     "licenses": [
@@ -410,9 +410,9 @@
     ]
   },
   "tasks": {
-    "hash": "sha256-I5QdNavgv74FSuXwFWNz/++LOY9Z8kNZhEKf2k118L8=",
-    "url": "https://github.com/nextcloud/tasks/releases/download/v0.17.1/tasks.tar.gz",
-    "version": "0.17.1",
+    "hash": "sha256-nJFU65dthPRWd/SClKM/suZdYU3ic3QsIcXiPzUkQ6c=",
+    "url": "https://github.com/nextcloud/tasks/releases/download/v0.18.0/tasks.tar.gz",
+    "version": "0.18.0",
     "description": "Once enabled, a new Tasks menu will appear in your Nextcloud apps menu. From there you can add and delete tasks, edit their title, description, start and due dates and mark them as important. Tasks can be shared between users. Tasks can be synchronized using CalDav (each task list is linked to an Nextcloud calendar, to sync it to your local client: Thunderbird, Evolution, KDE Kontact, iCal … - just add the calendar as a remote calendar in your client). You can download your tasks as ICS files using the download button for each calendar.",
     "homepage": "https://github.com/nextcloud/tasks/",
     "licenses": [

From f627991320bb62940b819aa9aba762b17cea90bf Mon Sep 17 00:00:00 2001
From: Acid Bong <acidbong@tilde.club>
Date: Thu, 4 Jun 2026 13:10:32 +0300
Subject: [PATCH 18/58] redo: 1.4 -> 1.5

---
 pkgs/by-name/re/redo/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/re/redo/package.nix b/pkgs/by-name/re/redo/package.nix
index 941f0fbd56aa..c47c0afb4500 100644
--- a/pkgs/by-name/re/redo/package.nix
+++ b/pkgs/by-name/re/redo/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation {
   pname = "redo";
-  version = "1.4";
+  version = "1.5";
 
   src = fetchFromGitHub {
     owner = "jdebp";
     repo = "redo";
-    rev = "91f5462339ef6373f9ac80902cfae2b614e2902b";
-    hash = "sha256-cA8UN4aQnJ8VyMW3mDOIPna4Ucw1kp8CirZTDhSoCpU=";
+    rev = "fb5088e1cc588134fd653809be038a4dbffe8f74";
+    hash = "sha256-QFdTpSF0IdqkBtL0SRmKS9OetEk2UNeJlotw8IwMx48=";
   };
 
   nativeBuildInputs = [

From ce4754c1e343504586afc43a859aedef1a32f43a Mon Sep 17 00:00:00 2001
From: Acid Bong <acidbong@tilde.club>
Date: Thu, 4 Jun 2026 13:11:36 +0300
Subject: [PATCH 19/58] redo: keep phases adjustable with hooks

---
 pkgs/by-name/re/redo/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/re/redo/package.nix b/pkgs/by-name/re/redo/package.nix
index c47c0afb4500..cd523ef086cf 100644
--- a/pkgs/by-name/re/redo/package.nix
+++ b/pkgs/by-name/re/redo/package.nix
@@ -21,11 +21,15 @@ stdenv.mkDerivation {
   ];
 
   buildPhase = ''
+    runHook preBuild
     package/compile
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
     package/export $out/
+    runHook postInstall
   '';
 
   meta = {

From 6dff14e979f7a09c035350c533e23579a7d3f53e Mon Sep 17 00:00:00 2001
From: Acid Bong <acidbong@tilde.club>
Date: Thu, 4 Jun 2026 13:12:28 +0300
Subject: [PATCH 20/58] redo: clarify licenses

The author accepts either BSD-2-Clause, MIT, or ISC
---
 pkgs/by-name/re/redo/package.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/re/redo/package.nix b/pkgs/by-name/re/redo/package.nix
index cd523ef086cf..2eeff75e1963 100644
--- a/pkgs/by-name/re/redo/package.nix
+++ b/pkgs/by-name/re/redo/package.nix
@@ -35,7 +35,14 @@ stdenv.mkDerivation {
   meta = {
     homepage = "https://github.com/jdebp/redo";
     description = "System for building target files from source files";
-    license = lib.licenses.bsd2;
+    # https://github.com/jdebp/redo/blob/trunk/source/COPYING
+    license =
+      with lib.licenses;
+      OR [
+        bsd2 # for some reason BSD-2-Clause and FreeBSD, despite being synonyms, are listed separately
+        isc
+        mit
+      ];
     maintainers = [ ];
     mainProgram = "redo";
     platforms = lib.platforms.unix;

From 60caeb8325a4c035747be333bc4ce23e056e399b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 17:00:17 +0000
Subject: [PATCH 21/58] docker: 29.5.3 -> 29.6.0

---
 pkgs/applications/virtualization/docker/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 9969a1705be5..54505dafcac0 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -420,16 +420,16 @@ in
 
   docker_29 =
     let
-      version = "29.5.3";
+      version = "29.6.0";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-ZYfBWNVp7w8ZKdRA6bmDVQV4UEp+t8lWehInvtfysxM=";
+      cliHash = "sha256-2JTiqvrIYhpwbEgU+5DnmlHpaf8Re1vYPkySs93sKZU=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-D+XjHsKUFgMBCQsFI825JIGHEQmDt3NQCwpTdu6XSc8=";
-      runcRev = "v1.3.5";
-      runcHash = "sha256-Swphxbu/OLkUrfRjLMZIVGwYb7AN0xHdyxm0ysAVam0=";
+      mobyHash = "sha256-xr3+RZANLP4IkLv26/7znXnTCOm/5Gm7k6WBaOlZfQk=";
+      runcRev = "v1.3.6";
+      runcHash = "sha256-cBMYZOElWHQ4OkF2NlYJSZrlW4833WD8CRJRkkXeKJc=";
       containerdRev = "v2.2.4";
       containerdHash = "sha256-F0lw7zh4V9JlFQGkE4RNT1VLX8WWLgZAAvbP12jnRMw=";
       tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";

From ae6601a6c33fa0e3e2d16c25f3a30e1a4e70a4da Mon Sep 17 00:00:00 2001
From: Josh Hoffer <jhoffer@sansorgan.es>
Date: Fri, 8 May 2026 22:43:07 -0700
Subject: [PATCH 22/58] chromium: avoid references to original version

When enableWideVine is true, then there is a second layer so
we need to avoid creating symlinks to the original derivation.
---
 pkgs/applications/networking/browsers/chromium/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index a4997eb3d576..3c058a84ed64 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -204,7 +204,7 @@ stdenv.mkDerivation {
       ln -s "$out/bin/chromium" "$out/bin/chromium-browser"
 
       mkdir -p "$out/share"
-      for f in '${chromium.browser}'/share/*; do
+      for f in '${chromiumWV}'/share/*; do
         ln -s -t "$out/share/" "$f"
       done
     '';

From 2b882109c2d968b963b4ad73a3fba3c49d5f050b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 19:58:42 +0000
Subject: [PATCH 23/58] clickhouse-lts: 26.3.13.31-lts -> 26.3.15.4-lts

---
 pkgs/by-name/cl/clickhouse/lts.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cl/clickhouse/lts.nix b/pkgs/by-name/cl/clickhouse/lts.nix
index d265a7c5abc6..b2f2710aec4b 100644
--- a/pkgs/by-name/cl/clickhouse/lts.nix
+++ b/pkgs/by-name/cl/clickhouse/lts.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.3.13.31-lts";
-  rev = "27ae4e9fe0e3f97f012b3be293caf42a60d08747";
-  hash = "sha256-NTts2SiaQ+B+iPCAPLF4fLQmZ9/0Gp2FFu/E0aXfCMc=";
+  version = "26.3.15.4-lts";
+  rev = "3c767441a1ed9b5828b94806d87a25501d1f7364";
+  hash = "sha256-7vhnUjmZtHm2v8a7w2gBxgFz153kbbUi94oy04vheLo=";
   lts = true;
 }

From a3e3d4e22b5c3cf5157aecee35b82617d8289d09 Mon Sep 17 00:00:00 2001
From: transcaffeine <transcaffeine@finally.coffee>
Date: Wed, 24 Jun 2026 22:20:08 +0200
Subject: [PATCH 24/58] element-{desktop,web}: 1.12.21 -> 1.12.22

Release notes: https://github.com/element-hq/element-web/releases/tag/v1.12.22
Full changelog: https://github.com/element-hq/element-web/compare/v1.12.21...v1.12.22
---
 pkgs/by-name/el/element-desktop/package.nix       | 6 +++---
 pkgs/by-name/el/element-web-unwrapped/package.nix | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/el/element-desktop/package.nix b/pkgs/by-name/el/element-desktop/package.nix
index 118a37a0023c..1ca0250cacc6 100644
--- a/pkgs/by-name/el/element-desktop/package.nix
+++ b/pkgs/by-name/el/element-desktop/package.nix
@@ -30,13 +30,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-desktop";
-  version = "1.12.21";
+  version = "1.12.22";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wtMmfNZptCMPp3j6dicEM/80otz20UBQw+HXb8EXJl0=";
+    hash = "sha256-TtC4KUnaKy/gmh5CbkPTWKCFjdeKvt8esFt3awdkA/g=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-OPpJ5XJ0YeidvlT88JwQIKXxbQ40l0xdVH/9uT3La2M=";
+    hash = "sha256-Cxc2/NpOpkXavDvBgaU6Douud7AO06jt1KjuaLnZh8M=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
diff --git a/pkgs/by-name/el/element-web-unwrapped/package.nix b/pkgs/by-name/el/element-web-unwrapped/package.nix
index ee61fce02654..3cb26541f8c4 100644
--- a/pkgs/by-name/el/element-web-unwrapped/package.nix
+++ b/pkgs/by-name/el/element-web-unwrapped/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-web";
-  version = "1.12.21";
+  version = "1.12.22";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wtMmfNZptCMPp3j6dicEM/80otz20UBQw+HXb8EXJl0=";
+    hash = "sha256-TtC4KUnaKy/gmh5CbkPTWKCFjdeKvt8esFt3awdkA/g=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-OPpJ5XJ0YeidvlT88JwQIKXxbQ40l0xdVH/9uT3La2M=";
+    hash = "sha256-Cxc2/NpOpkXavDvBgaU6Douud7AO06jt1KjuaLnZh8M=";
   };
 
   nativeBuildInputs = [

From 418a30d3e87d51384b84538953e3c18337225efc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 08:06:36 +0000
Subject: [PATCH 25/58] matterircd: 0.29.0 -> 0.30.0

---
 pkgs/by-name/ma/matterircd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/matterircd/package.nix b/pkgs/by-name/ma/matterircd/package.nix
index 644de7bca07d..8fec83348474 100644
--- a/pkgs/by-name/ma/matterircd/package.nix
+++ b/pkgs/by-name/ma/matterircd/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "matterircd";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "42wim";
     repo = "matterircd";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-7pOhUeUT95nk6kk03xAaIYHgXwr09m6LSbib2YSi1Ck=";
+    sha256 = "sha256-W00q5bRzCXl9R56xGol1bWYeW5w5MUpcoraKVaKimyk=";
   };
 
   vendorHash = null;

From 47cc1443c3f48206f7fbae8a4c5c334caf692ffb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 09:15:10 +0000
Subject: [PATCH 26/58] qlever: 0.5.47 -> 0.5.48

---
 pkgs/by-name/ql/qlever/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ql/qlever/package.nix b/pkgs/by-name/ql/qlever/package.nix
index 30b4eee93aab..1edf06eb784b 100644
--- a/pkgs/by-name/ql/qlever/package.nix
+++ b/pkgs/by-name/ql/qlever/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qlever";
-  version = "0.5.47";
+  version = "0.5.48";
 
   src = fetchFromGitHub {
     owner = "ad-freiburg";
     repo = "qlever";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sRV3OZTg9Q2Nvys0OgMbBGRqWPm+8P9zJD9rcaEEZ/Y=";
+    hash = "sha256-CqrwsUXjM5VwsNkLDkXgT6ZfqFZIuz2oPKVqO4z2t3A=";
     fetchSubmodules = true;
   };
 

From a49bf4a521dcd81c3c4437a4f20c31d180933b2b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Thu, 25 Jun 2026 16:17:15 +0700
Subject: [PATCH 27/58] =?UTF-8?q?h2o:=20makeWrapper=20=E2=86=92=20makeBina?=
 =?UTF-8?q?ryWrapper?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/h2/h2o/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index faa231744418..c87d218dfe08 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   pkg-config,
   cmake,
-  makeWrapper,
+  makeBinaryWrapper,
   ninja,
   perl,
   perlPackages,
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     pkg-config
     cmake
-    makeWrapper
+    makeBinaryWrapper
     ninja
     perlPackages.JSON
   ]

From 6d2f708632caf9ef7988931f3a2a435d670787ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Thu, 25 Jun 2026 16:02:01 +0700
Subject: [PATCH 28/58] =?UTF-8?q?h2o:=202.3.0-rolling-2026-06-24=20?=
 =?UTF-8?q?=E2=86=92=202.3.0-rolling-2026-06-25?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/h2/h2o/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index c87d218dfe08..72d314ae5c26 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "h2o";
-  version = "2.3.0-rolling-2026-06-24";
+  version = "2.3.0-rolling-2026-06-25";
 
   src = fetchFromGitHub {
     owner = "h2o";
     repo = "h2o";
-    rev = "66fcbfed806d7645577e4e78e4d536d38379764d";
-    hash = "sha256-RzQHDHihcD+ife1CBCGliytrkt8eYVdL8AHdaYp3CFQ=";
+    rev = "58a9a054300a09235df52954101a49573762e0fc";
+    hash = "sha256-TofY3JzWM4XNiMqna5KnmtBJETndJ/YY0sFY/0X99GA=";
   };
 
   outputs = [

From 39e152cdbf81fe552a1cc478fdc050ef39306eb1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Thu, 25 Jun 2026 16:29:33 +0700
Subject: [PATCH 29/58] h2o: make Brotli optional

2026-06-25 updates made Brotli optional
---
 pkgs/by-name/h2/h2o/package.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index 72d314ae5c26..595bb7bef992 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -8,12 +8,13 @@
   ninja,
   perl,
   perlPackages,
-  brotli,
   openssl,
   libcap,
   libuv,
   wslay,
   zlib,
+  withBrotli ? true,
+  brotli,
   withMruby ? true,
   bison,
   ruby,
@@ -47,6 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     perlPackages.JSON
   ]
+  ++ lib.optional withBrotli brotli
   ++ lib.optionals withMruby [
     bison
     ruby
@@ -61,9 +63,11 @@ stdenv.mkDerivation (finalAttrs: {
     perl
     zlib
     wslay
-  ];
+  ]
+  ++ lib.optional withBrotli brotli;
 
   cmakeFlags = [
+    "-DWITH_BROTLI=${if withBrotli then "ON" else "OFF"}"
     "-DWITH_MRUBY=${if withMruby then "ON" else "OFF"}"
   ];
 

From ba44c4a4befd37f244ba28c341d4c20678779a49 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Thu, 25 Jun 2026 11:59:08 +0200
Subject: [PATCH 30/58] licenses: add `Reticulum License`

---
 lib/licenses/licenses.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/licenses/licenses.nix b/lib/licenses/licenses.nix
index 282b41b6f3b4..74180367b95a 100644
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -1323,6 +1323,17 @@ lib.mapAttrs mkLicense (
       fullName = "Qwt exception 1.0";
     };
 
+    reticulum = {
+      # The Reticulum License restricts certain fields of use, notably systems
+      # intended to harm human beings and AI/ML training datasets. Such usage
+      # restrictions are incompatible with the Open Source Definition
+      # (https://opensource.org/osd), in particular "No Discrimination Against
+      # Fields of Endeavor".
+      free = false;
+      fullName = "Reticulum License";
+      url = "https://reticulum.network/license";
+    };
+
     ruby = {
       spdxId = "Ruby";
       fullName = "Ruby License";

From 8e99b441b3ea8c181479461a1182df5ed698c0b8 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Thu, 25 Jun 2026 11:59:24 +0200
Subject: [PATCH 31/58] python3Packages.rns: use `reticulum` license

---
 pkgs/development/python-modules/rns/default.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index d2254cd71709..49174a8f8eab 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -49,9 +49,7 @@ buildPythonPackage (finalAttrs: {
     description = "Cryptography-based networking stack for wide-area networks";
     homepage = "https://reticulum.network";
     changelog = "https://github.com/markqvist/Reticulum/blob/${finalAttrs.version}/Changelog.md";
-    # Reticulum License
-    # https://github.com/markqvist/Reticulum/blob/master/LICENSE
-    license = lib.licenses.unfree;
+    license = lib.licenses.reticulum;
     maintainers = with lib.maintainers; [
       drupol
       fab

From 75c8a921827666d9b6e3e18b830a4143d577fb36 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Thu, 25 Jun 2026 11:59:45 +0200
Subject: [PATCH 32/58] python3Packages.lxmf: use `reticulum` license

---
 pkgs/development/python-modules/lxmf/default.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index 250aa3174f69..6cd879024eef 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -46,9 +46,7 @@ buildPythonPackage (finalAttrs: {
     description = "Lightweight Extensible Message Format for Reticulum";
     homepage = "https://github.com/markqvist/lxmf";
     changelog = "https://github.com/markqvist/LXMF/releases/tag/${finalAttrs.src.tag}";
-    # Reticulum License
-    # https://github.com/markqvist/LXMF/blob/master/LICENSE
-    license = lib.licenses.unfree;
+    license = lib.licenses.reticulum;
     maintainers = with lib.maintainers; [
       drupol
       fab

From af27e3c59b0e1e8a132fa3303734de32038d9d3f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 13 Jun 2026 14:06:18 +0200
Subject: [PATCH 33/58] python3Packages.nats-py: 2.12.0 -> 2.15.0

Changelog: https://github.com/nats-io/nats.py/releases/tag/v2.15.0
---
 .../python-modules/nats-py/default.nix        | 24 ++++++++++++-------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/nats-py/default.nix b/pkgs/development/python-modules/nats-py/default.nix
index ca1a9e55fcfa..5e5840a067a8 100644
--- a/pkgs/development/python-modules/nats-py/default.nix
+++ b/pkgs/development/python-modules/nats-py/default.nix
@@ -3,30 +3,38 @@
   stdenv,
   aiohttp,
   buildPythonPackage,
-  ed25519,
   fetchFromGitHub,
   nats-server,
   nkeys,
+  pynacl,
+  pytest-asyncio,
   pytestCheckHook,
-  setuptools,
+  uv-build,
   uvloop,
 }:
 
 buildPythonPackage rec {
   pname = "nats-py";
-  version = "2.12.0";
+  version = "2.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats.py";
     tag = "v${version}";
-    hash = "sha256-HQtoFyw3Gi/lIQFVrFvRtWWzHTY+TchZYKqTiHfUWFk=";
+    hash = "sha256-rs+C++g21dKZ6c7L5dJYqWSiv4J8qMGobW7R8icUfVw=";
   };
 
-  build-system = [ setuptools ];
+  sourceRoot = "${src.name}/nats";
 
-  dependencies = [ ed25519 ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.9.28,<0.10.0" "uv_build"
+  '';
+
+  build-system = [ uv-build ];
+
+  dependencies = [ pynacl ];
 
   optional-dependencies = {
     aiohttp = [ aiohttp ];
@@ -36,6 +44,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     nats-server
+    pytest-asyncio
     pytestCheckHook
     uvloop
   ];
@@ -53,9 +62,6 @@ buildPythonPackage rec {
     "test_subscribe_iterate_next_msg"
     "test_ordered_consumer_larger_streams"
     "test_object_file_basics"
-    # Should be safe to remove on next version upgrade (from 2.11.0)
-    # https://github.com/nats-io/nats.py/pull/728
-    "test_object_list"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "test_subscribe_iterate_next_msg"

From f1aaf7083327a9ec9fe0d2cacd4f8bd66e2a3c12 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 13 Jun 2026 14:07:39 +0200
Subject: [PATCH 34/58] python3Packages.nats-py: migrate to finalAttrs

---
 pkgs/development/python-modules/nats-py/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/nats-py/default.nix b/pkgs/development/python-modules/nats-py/default.nix
index 5e5840a067a8..6e4ac3afa1d9 100644
--- a/pkgs/development/python-modules/nats-py/default.nix
+++ b/pkgs/development/python-modules/nats-py/default.nix
@@ -13,7 +13,7 @@
   uvloop,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "nats-py";
   version = "2.15.0";
   pyproject = true;
@@ -21,11 +21,11 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats.py";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-rs+C++g21dKZ6c7L5dJYqWSiv4J8qMGobW7R8icUfVw=";
   };
 
-  sourceRoot = "${src.name}/nats";
+  sourceRoot = "${finalAttrs.src.name}/nats";
 
   postPatch = ''
     substituteInPlace pyproject.toml \
@@ -73,8 +73,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python client for NATS.io";
     homepage = "https://github.com/nats-io/nats.py";
-    changelog = "https://github.com/nats-io/nats.py/releases/tag/${src.tag}";
+    changelog = "https://github.com/nats-io/nats.py/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From 0a149b71d6c9df341de767008671db7e81ad3922 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 13:05:28 +0000
Subject: [PATCH 35/58] atlauncher: 3.4.40.4 -> 3.4.41.0

---
 pkgs/by-name/at/atlauncher/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/at/atlauncher/package.nix b/pkgs/by-name/at/atlauncher/package.nix
index 523c3b8bd504..b8915753b597 100644
--- a/pkgs/by-name/at/atlauncher/package.nix
+++ b/pkgs/by-name/at/atlauncher/package.nix
@@ -27,13 +27,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "atlauncher";
-  version = "3.4.40.4";
+  version = "3.4.41.0";
 
   src = fetchFromGitHub {
     owner = "ATLauncher";
     repo = "ATLauncher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-pRYXzFUbVXYwD7edhBoVcVo/QDo6QSJJQd58Hf3rBGo=";
+    hash = "sha256-mowPK9wsX87LHLt17Wmn97H2TRICXuwGKC2p2MBXr4Y=";
   };
 
   patches = [

From 59a92f1a19522afa0086ddeb74f883bde4e74b6f Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 18:12:54 +0300
Subject: [PATCH 36/58] python3Packages.beets: 2.11.0 -> 2.12.0

Diff: https://github.com/beetbox/beets/compare/v2.11.0...v2.12.0
---
 pkgs/development/python-modules/beets/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/beets/default.nix b/pkgs/development/python-modules/beets/default.nix
index e0eb7ef3f293..6507544714d6 100644
--- a/pkgs/development/python-modules/beets/default.nix
+++ b/pkgs/development/python-modules/beets/default.nix
@@ -113,12 +113,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "beets";
-  version = "2.11.0";
+  version = "2.12.0";
   src = fetchFromGitHub {
     owner = "beetbox";
     repo = "beets";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fi6D0P2GtEO41VL6UKAArRedZVxw97yqDUAoilktUho=";
+    hash = "sha256-u2qoZ0/qWq9YUcwbOpsqtIjX5BZ2z2wj00X59Pf+/fk=";
   };
   pyproject = true;
 

From bc081a146c5e78a621812fd60fbb8562b797abf4 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 18:45:03 +0300
Subject: [PATCH 37/58] python3Packages.beets-filetote: remove unused pytest
 argument

---
 pkgs/development/python-modules/beets-filetote/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/python-modules/beets-filetote/default.nix b/pkgs/development/python-modules/beets-filetote/default.nix
index e64240fd22c1..b9a70cfb93b7 100644
--- a/pkgs/development/python-modules/beets-filetote/default.nix
+++ b/pkgs/development/python-modules/beets-filetote/default.nix
@@ -14,7 +14,6 @@
   pytestCheckHook,
   beets-audible,
   mediafile,
-  pytest,
   reflink,
   toml,
   typeguard,

From b8e9c738605a5c248ddeeeab7d7bab45fe2f0e79 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 25 Jun 2026 15:42:32 +0200
Subject: [PATCH 38/58] python3Packages.nats-py: disable failing test

---
 pkgs/development/python-modules/nats-py/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/nats-py/default.nix b/pkgs/development/python-modules/nats-py/default.nix
index 6e4ac3afa1d9..ac89b87e5fa9 100644
--- a/pkgs/development/python-modules/nats-py/default.nix
+++ b/pkgs/development/python-modules/nats-py/default.nix
@@ -58,6 +58,7 @@ buildPythonPackage (finalAttrs: {
     "test_pull_subscribe_limits"
     "test_stream_management"
     "test_subscribe_no_echo"
+    "test_rtt"
     # Tests fail on hydra, often Time-out
     "test_subscribe_iterate_next_msg"
     "test_ordered_consumer_larger_streams"

From 5f925d54e34935056037595ce8abbd7c0f90a7d7 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 18:29:04 +0300
Subject: [PATCH 39/58] python3Packages.beets-filetote: 1.3.5 -> 1.3.6

Diff: https://github.com/gtronset/beets-filetote/compare/v1.3.5...v1.3.6

Changelog: https://github.com/gtronset/beets-filetote/blob/v1.3.6/CHANGELOG.md
---
 .../python-modules/beets-filetote/default.nix | 34 +++++++------------
 1 file changed, 12 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/python-modules/beets-filetote/default.nix b/pkgs/development/python-modules/beets-filetote/default.nix
index b9a70cfb93b7..7f9883e664ac 100644
--- a/pkgs/development/python-modules/beets-filetote/default.nix
+++ b/pkgs/development/python-modules/beets-filetote/default.nix
@@ -1,11 +1,10 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   buildPythonPackage,
 
   # build-system
-  poetry-core,
+  uv-build,
 
   # nativeBuildInputs
   beets-minimal,
@@ -22,31 +21,23 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "beets-filetote";
-  version = "1.3.5";
+  version = "1.3.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gtronset";
     repo = "beets-filetote";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qMHjcBrXkVG7U5a1E0yRwNgmg7XinRnK3gnV7jAZLTk=";
+    hash = "sha256-ZrF9Z3Eaem8ZzNJgQoW45MvsNOCoLsd7l/yLQ2pldR0=";
   };
-  # needed to keep beetsplug a namespace package, othwise other plugins will not be found
-  # can be removed with next version
-  patches = [
-    (fetchpatch2 {
-      url = "https://github.com/gtronset/beets-filetote/commit/762cf0c4b60b8f6b38cf39b027de4241f12cef37.patch?full_index=1";
-      hash = "sha256-c7qIECcqwoV4ZOaA/8JYsM6Aym34peWPh7ZLWUxIYSI=";
-      excludes = [ "CHANGELOG.md" ];
-    })
-  ];
 
+  # https://github.com/gtronset/beets-filetote/issues/328
   postPatch = ''
-    substituteInPlace pyproject.toml --replace-fail "poetry-core<2.0.0" "poetry-core"
+    substituteInPlace pyproject.toml --replace-fail "uv_build>=0.11.21,<0.12" "uv-build"
   '';
 
   build-system = [
-    poetry-core
+    uv-build
   ];
 
   nativeBuildInputs = [
@@ -55,9 +46,6 @@ buildPythonPackage (finalAttrs: {
 
   dependencies = [
     mediafile
-    reflink
-    toml
-    typeguard
   ];
 
   nativeCheckInputs = [
@@ -70,10 +58,12 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  pytestFlags = [
-    # This is the same as:
-    #   -r fEs
-    "-rfEs"
+  disabledTestPaths = [
+    # Tests fail for Beets 2.12.x, see:
+    # https://github.com/gtronset/beets-filetote/issues/328
+    "tests/test_exclude.py::TestExclude::test_exclude_strseq_of_filenames_by_string"
+    "tests/test_exclude.py::TestExclude::test_exclude_strseq_of_filenames_by_list"
+    "tests/test_printignored.py::TestPrintIgnored::test_print_ignored"
   ];
 
   meta = {

From 9247d13ebfb15eed582dc49a7ae168aedb66fb06 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 18:49:43 +0300
Subject: [PATCH 40/58] python3Packages.beets-alternatives: fix tests with
 upstream patch

---
 .../python-modules/beets-alternatives/default.nix            | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/beets-alternatives/default.nix b/pkgs/development/python-modules/beets-alternatives/default.nix
index 5144eb45c80c..897481ce5bbd 100644
--- a/pkgs/development/python-modules/beets-alternatives/default.nix
+++ b/pkgs/development/python-modules/beets-alternatives/default.nix
@@ -38,6 +38,11 @@ buildPythonPackage rec {
       url = "https://github.com/geigerzaehler/beets-alternatives/commit/84fdb0fa15225cce1e881b07bddcb52715677915.patch";
       hash = "sha256-rURvP7aNJ+I9bPjk43t8rYujOK1iUS1J4RFMAHfa5AU=";
     })
+    # Fix for Beets 2.12; see https://github.com/geigerzaehler/beets-alternatives/pull/234
+    (fetchpatch {
+      url = "https://github.com/geigerzaehler/beets-alternatives/commit/e27772bb627d1b0763685d7add209d40987f2b95.patch";
+      hash = "sha256-47HhaYWzHQakGlbUWdfG5qkfvbadbow1i+O74JnKPwM=";
+    })
   ];
 
   build-system = [

From 921383b2ceaea9d9f4909e95b84f28ecd7f9071b Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian@arianvp.me>
Date: Thu, 25 Jun 2026 11:07:12 +0200
Subject: [PATCH 41/58] nixos/journald-{gateway,remote}: remove TLS support

We aren't linking systemd to gnutls anymore so these options
were all silently ignored. Which is pretty bad!

Assisted-by: Claude <noreply@anthropic.com>
---
 .../system/boot/systemd/journald-gateway.nix  |  55 ++-------
 .../system/boot/systemd/journald-remote.nix   |  92 ++++++----------
 nixos/tests/systemd-journal-gateway.nix       |  58 +---------
 nixos/tests/systemd-journal-upload.nix        | 104 +++++++++++-------
 4 files changed, 111 insertions(+), 198 deletions(-)

diff --git a/nixos/modules/system/boot/systemd/journald-gateway.nix b/nixos/modules/system/boot/systemd/journald-gateway.nix
index 28c29df71c41..76a858e1b471 100644
--- a/nixos/modules/system/boot/systemd/journald-gateway.nix
+++ b/nixos/modules/system/boot/systemd/journald-gateway.nix
@@ -9,16 +9,19 @@ let
   cfg = config.services.journald.gateway;
 
   cliArgs = lib.cli.toCommandLineShellGNU { } {
-    # If either of these are null / false, they are not passed in the command-line
+    # If either of these are false, they are not passed in the command-line
     inherit (cfg)
-      cert
-      key
-      trust
       system
       user
       merge
       ;
   };
+
+  tlsOptionRemovedMessage = ''
+    systemd in Nixpkgs is built without GnuTLS, so systemd-journal-gatewayd
+    cannot serve HTTPS. Use a reverse proxy (such as nginx) to terminate TLS
+    in front of the gateway if you need encrypted access.
+  '';
 in
 {
   imports = [
@@ -26,6 +29,9 @@ in
       [ "services" "journald" "enableHttpGateway" ]
       [ "services" "journald" "gateway" "enable" ]
     )
+    (lib.mkRemovedOptionModule [ "services" "journald" "gateway" "cert" ] tlsOptionRemovedMessage)
+    (lib.mkRemovedOptionModule [ "services" "journald" "gateway" "key" ] tlsOptionRemovedMessage)
+    (lib.mkRemovedOptionModule [ "services" "journald" "gateway" "trust" ] tlsOptionRemovedMessage)
   ];
 
   meta.maintainers = [ ];
@@ -40,47 +46,6 @@ in
       '';
     };
 
-    cert = lib.mkOption {
-      default = null;
-      type = with lib.types; nullOr str;
-      description = ''
-        The path to a file or `AF_UNIX` stream socket to read the server
-        certificate from.
-
-        The certificate must be in PEM format. This option switches
-        `systemd-journal-gatewayd` into HTTPS mode and must be used together
-        with {option}`services.journald.gateway.key`.
-      '';
-    };
-
-    key = lib.mkOption {
-      default = null;
-      type = with lib.types; nullOr str;
-      description = ''
-        Specify the path to a file or `AF_UNIX` stream socket to read the
-        secret server key corresponding to the certificate specified with
-        {option}`services.journald.gateway.cert` from.
-
-        The key must be in PEM format.
-
-        This key should not be world-readable, and must be readably by the
-        `systemd-journal-gateway` user.
-      '';
-    };
-
-    trust = lib.mkOption {
-      default = null;
-      type = with lib.types; nullOr str;
-      description = ''
-        Specify the path to a file or `AF_UNIX` stream socket to read a CA
-        certificate from.
-
-        The certificate must be in PEM format.
-
-        Setting this option enforces client certificate checking.
-      '';
-    };
-
     system = lib.mkOption {
       default = false;
       type = lib.types.bool;
diff --git a/nixos/modules/system/boot/systemd/journald-remote.nix b/nixos/modules/system/boot/systemd/journald-remote.nix
index d08c83d303ba..fbb444b6400b 100644
--- a/nixos/modules/system/boot/systemd/journald-remote.nix
+++ b/nixos/modules/system/boot/systemd/journald-remote.nix
@@ -12,25 +12,30 @@ let
   cliArgs = lib.cli.toCommandLineShellGNU { } {
     inherit (cfg) output;
     # "-3" specifies the file descriptor from the .socket unit.
-    "listen-${cfg.listen}" = "-3";
+    "listen-http" = "-3";
   };
+
+  tlsOptionRemovedMessage = ''
+    systemd in Nixpkgs is built without GnuTLS, so systemd-journal-remote
+    cannot accept HTTPS connections or validate client certificates. Use a
+    reverse proxy (such as nginx) to terminate TLS in front of journal-remote
+    if you need encrypted ingestion.
+  '';
 in
 {
   meta.maintainers = [ ];
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "journald"
+      "remote"
+      "listen"
+    ] tlsOptionRemovedMessage)
+  ];
+
   options.services.journald.remote = {
     enable = lib.mkEnableOption "receiving systemd journals from the network";
 
-    listen = lib.mkOption {
-      default = "https";
-      type = lib.types.enum [
-        "https"
-        "http"
-      ];
-      description = ''
-        Which protocol to listen to.
-      '';
-    };
-
     output = lib.mkOption {
       default = "/var/log/journal/remote/";
       type = lib.types.str;
@@ -50,10 +55,6 @@ in
       type = lib.types.port;
       description = ''
         The port to listen to.
-
-        Note that this option is used only if
-        {option}`services.journald.upload.listen` is configured to be either
-        "https" or "http".
       '';
     };
 
@@ -92,55 +93,28 @@ in
               one output journal file is used.
             '';
           };
-
-          ServerKeyFile = lib.mkOption {
-            default = "/etc/ssl/private/journal-remote.pem";
-            type = lib.types.str;
-            description = ''
-              A path to a SSL secret key file in PEM format.
-
-              Note that due to security reasons, `systemd-journal-remote` will
-              refuse files from the world-readable `/nix/store`. This file
-              should be readable by the "" user.
-
-              This option can be used with `listen = "https"`. If the path
-              refers to an `AF_UNIX` stream socket in the file system a
-              connection is made to it and the key read from it.
-            '';
-          };
-
-          ServerCertificateFile = lib.mkOption {
-            default = "/etc/ssl/certs/journal-remote.pem";
-            type = lib.types.str;
-            description = ''
-              A path to a SSL certificate file in PEM format.
-
-              This option can be used with `listen = "https"`. If the path
-              refers to an `AF_UNIX` stream socket in the file system a
-              connection is made to it and the certificate read from it.
-            '';
-          };
-
-          TrustedCertificateFile = lib.mkOption {
-            default = "/etc/ssl/ca/trusted.pem";
-            type = lib.types.str;
-            description = ''
-              A path to a SSL CA certificate file in PEM format, or `all`.
-
-              If `all` is set, then client certificate checking will be
-              disabled.
-
-              This option can be used with `listen = "https"`. If the path
-              refers to an `AF_UNIX` stream socket in the file system a
-              connection is made to it and the certificate read from it.
-            '';
-          };
         };
       };
     };
   };
 
   config = lib.mkIf cfg.enable {
+    assertions =
+      map
+        (key: {
+          assertion = !(cfg.settings ? Remote.${key});
+          message = ''
+            The option definition `services.journald.remote.settings.Remote.${key}'
+            no longer has any effect; please remove it.
+            ${tlsOptionRemovedMessage}
+          '';
+        })
+        [
+          "ServerKeyFile"
+          "ServerCertificateFile"
+          "TrustedCertificateFile"
+        ];
+
     systemd.additionalUpstreamSystemUnits = [
       "systemd-journal-remote.service"
       "systemd-journal-remote.socket"
diff --git a/nixos/tests/systemd-journal-gateway.nix b/nixos/tests/systemd-journal-gateway.nix
index 85f007d7a94d..17b454d9595e 100644
--- a/nixos/tests/systemd-journal-gateway.nix
+++ b/nixos/tests/systemd-journal-gateway.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ pkgs, ... }:
 {
   name = "systemd-journal-gateway";
   meta = with pkgs.lib.maintainers; {
@@ -7,64 +7,21 @@
     ];
   };
 
-  # Named client for coherence with the systemd-journal-upload test, and for
-  # certificate validation
+  # Named client for coherence with the systemd-journal-upload test.
   nodes.client = {
-    services.journald.gateway = {
-      enable = true;
-      cert = "/run/secrets/client/cert.pem";
-      key = "/run/secrets/client/key.pem";
-      trust = "/run/secrets/ca.cert.pem";
-    };
+    services.journald.gateway.enable = true;
   };
 
   testScript = ''
     import json
-    import subprocess
-    import tempfile
-
-    tmpdir_o = tempfile.TemporaryDirectory()
-    tmpdir = tmpdir_o.name
-
-    def generate_pems(domain: str):
-      subprocess.run(
-        [
-          "${pkgs.minica}/bin/minica",
-          "--ca-key=ca.key.pem",
-          "--ca-cert=ca.cert.pem",
-          f"--domains={domain}",
-        ],
-        cwd=str(tmpdir),
-      )
-
-    with subtest("Creating keys and certificates"):
-      generate_pems("server")
-      generate_pems("client")
-
-    client.wait_for_unit("multi-user.target")
-
-    def copy_pem(file: str):
-      client.copy_from_host(source=f"{tmpdir}/{file}", target=f"/run/secrets/{file}")
-      client.succeed(f"chmod 600 /run/secrets/{file} && chown systemd-journal-gateway /run/secrets/{file}")
-
-    with subtest("Copying keys and certificates"):
-      client.succeed("mkdir -p /run/secrets/{client,server}")
-      copy_pem("server/cert.pem")
-      copy_pem("server/key.pem")
-      copy_pem("client/cert.pem")
-      copy_pem("client/key.pem")
-      copy_pem("ca.cert.pem")
 
     client.wait_for_unit("multi-user.target")
 
     curl = '${pkgs.curl}/bin/curl'
     accept_json = '--header "Accept: application/json"'
-    cacert = '--cacert /run/secrets/ca.cert.pem'
-    cert = '--cert /run/secrets/server/cert.pem'
-    key = '--key /run/secrets/server/key.pem'
-    base_url = 'https://client:19531'
+    base_url = 'http://client:19531'
 
-    curl_cli = f"{curl} {accept_json} {cacert} {cert} {key} --fail"
+    curl_cli = f"{curl} {accept_json} --fail"
 
     machine_info = client.succeed(f"{curl_cli} {base_url}/machine")
     assert json.loads(machine_info)["hostname"] == "client", "wrong machine name"
@@ -78,11 +35,8 @@
 
     client.succeed(f"systemd-cat --identifier={identifier} <<< '{message}'")
 
-    # max-time is a workaround against a bug in systemd-journal-gatewayd where
-    # if TLS is enabled, the connection is never closed. Since it will timeout,
-    # we ignore the return code.
     entries = client.succeed(
-        f"{curl_cli} --max-time 5 {base_url}/entries?SYSLOG_IDENTIFIER={identifier} || true"
+        f"{curl_cli} {base_url}/entries?SYSLOG_IDENTIFIER={identifier}"
     )
 
     # Number of entries should be only 1
diff --git a/nixos/tests/systemd-journal-upload.nix b/nixos/tests/systemd-journal-upload.nix
index 747e8c4ffe31..f01ed17019f8 100644
--- a/nixos/tests/systemd-journal-upload.nix
+++ b/nixos/tests/systemd-journal-upload.nix
@@ -7,48 +7,84 @@
     ];
   };
 
+  # systemd in Nixpkgs is built without GnuTLS, so systemd-journal-remote
+  # cannot terminate TLS itself. We put nginx in front of it with mutual TLS
+  # and have systemd-journal-upload (which uses curl+openssl) talk HTTPS to
+  # nginx. This exercises both the recommended migration path and verifies
+  # that journal-upload's TLS support still works.
   nodes.server =
-    { nodes, ... }:
+    { lib, nodes, ... }:
     {
+
       services.journald.remote = {
         enable = true;
-        listen = "http";
         settings.Remote = {
-          ServerCertificateFile = "/run/secrets/sever.cert.pem";
-          ServerKeyFile = "/run/secrets/sever.key.pem";
-          TrustedCertificateFile = "/run/secrets/ca.cert.pem";
           Seal = true;
         };
       };
 
-      networking.firewall.allowedTCPPorts = [ nodes.server.services.journald.remote.port ];
-    };
+      # Keep journal-remote loopback-only; only nginx is exposed to the network.
+      systemd.sockets.systemd-journal-remote.listenStreams = lib.mkForce [
+        ""
+        "127.0.0.1:${toString nodes.server.services.journald.remote.port}"
+      ];
 
-  nodes.client =
-    { lib, nodes, ... }:
-    {
-      services.journald.upload = {
+      virtualisation.credentials = {
+        "ca.cert.pem".source = "./ca.cert.pem";
+        "server.cert.pem".source = "./server.cert.pem";
+        "server.key.pem".source = "./server.key.pem";
+      };
+      systemd.services.nginx.serviceConfig.ImportCredential = [
+        "server.cert.pem"
+        "server.key.pem"
+        "ca.cert.pem"
+      ];
+      services.nginx = {
         enable = true;
-        settings.Upload = {
-          URL = "http://server:${toString nodes.server.services.journald.remote.port}";
-          ServerCertificateFile = "/run/secrets/client.cert.pem";
-          ServerKeyFile = "/run/secrets/client.key.pem";
-          TrustedCertificateFile = "/run/secrets/ca.cert.pem";
+        virtualHosts."server" = {
+          onlySSL = true;
+          http2 = false;
+          sslCertificate = "/run/credentials/nginx.service/server.cert.pem";
+          sslCertificateKey = "/run/credentials/nginx.service/server.key.pem";
+          extraConfig = ''
+            ssl_client_certificate /run/credentials/nginx.service/ca.cert.pem;
+            ssl_verify_client on;
+          '';
+          locations."/".proxyPass = "http://127.0.0.1:${toString nodes.server.services.journald.remote.port}";
         };
       };
 
-      # Wait for the PEMs to arrive
-      systemd.services.systemd-journal-upload.wantedBy = lib.mkForce [ ];
-      systemd.paths.systemd-journal-upload = {
-        wantedBy = [ "default.target" ];
-        # This file must be copied last
-        pathConfig.PathExists = [ "/run/secrets/ca.cert.pem" ];
+      networking.firewall.allowedTCPPorts = [ 443 ];
+    };
+
+  nodes.client =
+    { lib, ... }:
+    {
+      virtualisation.credentials = {
+        "ca.cert.pem".source = "./ca.cert.pem";
+        "client.cert.pem".source = "./client.cert.pem";
+        "client.key.pem".source = "./client.key.pem";
+      };
+      systemd.services.systemd-journal-upload.serviceConfig.ImportCredential = [
+        "client.cert.pem"
+        "client.key.pem"
+        "ca.cert.pem"
+      ];
+      services.journald.upload = {
+        enable = true;
+        settings.Upload = {
+          URL = "https://server:443";
+          ServerCertificateFile = "/run/credentials/systemd-journal-upload.service/client.cert.pem";
+          ServerKeyFile = "/run/credentials/systemd-journal-upload.service/client.key.pem";
+          TrustedCertificateFile = "/run/credentials/systemd-journal-upload.service/ca.cert.pem";
+        };
       };
     };
 
   testScript = ''
     import subprocess
     import tempfile
+    import shutil
 
     tmpdir_o = tempfile.TemporaryDirectory()
     tmpdir = tmpdir_o.name
@@ -68,33 +104,17 @@
       generate_pems("server")
       generate_pems("client")
 
-    server.wait_for_unit("multi-user.target")
-    client.wait_for_unit("multi-user.target")
-
     def copy_pems(machine: BaseMachine, domain: str):
-      machine.succeed("mkdir /run/secrets")
-      machine.copy_from_host(
-        source=f"{tmpdir}/{domain}/cert.pem",
-        target=f"/run/secrets/{domain}.cert.pem",
-      )
-      machine.copy_from_host(
-        source=f"{tmpdir}/{domain}/key.pem",
-        target=f"/run/secrets/{domain}.key.pem",
-      )
-      # Should be last
-      machine.copy_from_host(
-        source=f"{tmpdir}/ca.cert.pem",
-        target="/run/secrets/ca.cert.pem",
-      )
+      shutil.copy(f"{tmpdir}/{domain}/cert.pem", machine.state_dir / f"{domain}.cert.pem")
+      shutil.copy(f"{tmpdir}/{domain}/key.pem", machine.state_dir / f"{domain}.key.pem")
+      shutil.copy(f"{tmpdir}/ca.cert.pem", machine.state_dir / "ca.cert.pem")
 
     with subtest("Copying keys and certificates"):
       copy_pems(server, "server")
       copy_pems(client, "client")
 
+    server.wait_for_unit("nginx.service")
     client.wait_for_unit("systemd-journal-upload.service")
-    # The journal upload should have started the remote service, triggered by
-    # the .socket unit
-    server.wait_for_unit("systemd-journal-remote.service")
 
     identifier = "nixos-test"
     message = "Hello from NixOS test infrastructure"

From dd9d37cbdce538698a71411804ff439f0b999a7f Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 25 Jun 2026 15:59:38 +0200
Subject: [PATCH 42/58] nextcloud32: 32.0.11 -> 32.0.12

ChangeLog: https://github.com/nextcloud/server/releases/tag/v32.0.12
---
 pkgs/servers/nextcloud/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 34a708f9ef84..115a8b9ea266 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -53,8 +53,8 @@ let
 in
 {
   nextcloud32 = generic {
-    version = "32.0.11";
-    hash = "sha256-vvIY5Yeczhy/0Q0gfVG1iiYPGQ1U/VcZkx7coMWdRiQ=";
+    version = "32.0.12";
+    hash = "sha256-rxWPclccjhXim8E2wjqSEYjOHVZoVQAK2U+JuAqPGAw=";
     packages = nextcloud32Packages;
   };
 

From bfe759a7596b93a5fde94a197dcf190b08c49334 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 25 Jun 2026 16:00:04 +0200
Subject: [PATCH 43/58] nextcloud33: 33.0.5 -> 33.0.6

ChangeLog: https://github.com/nextcloud/server/releases/tag/v33.0.6
---
 pkgs/servers/nextcloud/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 115a8b9ea266..392485f78891 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -59,8 +59,8 @@ in
   };
 
   nextcloud33 = generic {
-    version = "33.0.5";
-    hash = "sha256-7Ua5HY2k4fAjTQGIslvulEj6LzAYh+WygBPmtUfW3Mo=";
+    version = "33.0.6";
+    hash = "sha256-eRghpVAplE3gQxnPyvysSujn71a0zR78JjG/MLedFt4=";
     packages = nextcloud33Packages;
   };
 

From 28027ad48ee07aab54a59d33d94479324af503e3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 14:13:52 +0000
Subject: [PATCH 44/58] kluctl: 2.27.0 -> 2.28.2

---
 pkgs/by-name/kl/kluctl/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/kl/kluctl/package.nix b/pkgs/by-name/kl/kluctl/package.nix
index c18d75d1619a..932608d5e782 100644
--- a/pkgs/by-name/kl/kluctl/package.nix
+++ b/pkgs/by-name/kl/kluctl/package.nix
@@ -12,18 +12,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "kluctl";
-  version = "2.27.0";
+  version = "2.28.2";
 
   src = fetchFromGitHub {
     owner = "kluctl";
     repo = "kluctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m/bfZb+sp0gqxfMdBr/gAOxfYHdrPwKRcJAqprkAkQE=";
+    hash = "sha256-Adh2n8aE+DEBY1MC4laVPDdr5dq6FKSMEFLjbs74D4c=";
   };
 
   subPackages = [ "cmd" ];
 
-  vendorHash = "sha256-TKMMMZ+8bv5kKgrHIp3CXmt4tpi5VejPpXv/oiX4M3c=";
+  vendorHash = "sha256-cQJRU3vL5wJ0dgYMtN4qFdvJyp367I4N7GM6PhRvW0I=";
 
   ldflags = [
     "-s"

From da9066d8004c18987294acb9193654e43f0ad147 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 14:19:42 +0000
Subject: [PATCH 45/58] python3Packages.wand: 0.7.1 -> 0.7.2

---
 pkgs/development/python-modules/wand/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/wand/default.nix b/pkgs/development/python-modules/wand/default.nix
index 7a3212a78742..47f6a52a0bcf 100644
--- a/pkgs/development/python-modules/wand/default.nix
+++ b/pkgs/development/python-modules/wand/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "wand";
-  version = "0.7.1";
+  version = "0.7.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "emcconville";
     repo = "wand";
     tag = version;
-    hash = "sha256-SigXdX4sfw0nKYvIu/Jsoj+RBmcoHAGCFRA8t7gc+3s=";
+    hash = "sha256-1ZkvJxlv47rQ2BOBnEWPczcjIM2muywemrxwY2ZN2UA=";
   };
 
   postPatch = ''

From bc0b3d21e1a4fb9aba3a6c6e5de109ceac30ef43 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 14:27:04 +0000
Subject: [PATCH 46/58] jfbview: 0.6.1 -> 0.7.0

---
 pkgs/by-name/jf/jfbview/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/jf/jfbview/package.nix b/pkgs/by-name/jf/jfbview/package.nix
index 5a28c3c8eea5..dfef739b1ac8 100644
--- a/pkgs/by-name/jf/jfbview/package.nix
+++ b/pkgs/by-name/jf/jfbview/package.nix
@@ -18,14 +18,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jfbview";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "jichu4n";
     repo = "jfbview";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-7iyDfMuGAXXLyDNz0d4jEQ+KfJ/LyUu4v1n0GcOKeEc=";
+    hash = "sha256-X52FBg4Jgb80OETu29p4lcWpT+OSRz1xfhw+IkFZr+I=";
   };
 
   __structuredAttrs = true;

From 613167a467a6bea2db99c732b4b9b5fc8ac1a432 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 14:55:28 +0000
Subject: [PATCH 47/58] go-hass-agent: 14.12.0 -> 14.14.1

---
 pkgs/by-name/go/go-hass-agent/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/go-hass-agent/package.nix b/pkgs/by-name/go/go-hass-agent/package.nix
index bb708356dbcd..e72c7b6b8270 100644
--- a/pkgs/by-name/go/go-hass-agent/package.nix
+++ b/pkgs/by-name/go/go-hass-agent/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "go-hass-agent";
-  version = "14.12.0";
+  version = "14.14.1";
 
   src = fetchFromGitHub {
     owner = "joshuar";
     repo = "go-hass-agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KQRM6b6BtCkY+raJoshOYOoKwOzRwzFTLFnHTY6hCSY=";
+    hash = "sha256-s5kzxzyfNGK57MtusjEjcm0Gn75Wu8vfwJEIaVz7m20=";
   };
 
-  vendorHash = "sha256-WsxxT1hCpGt7YAcbp2NDVLPl4lFLHlZraiKUePoQwNU=";
+  vendorHash = "sha256-ZiLYnEcugciobjAchzJZNQrE3G11ehf3vi6cIMxZiTQ=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;

From da97bf84234657e6fdde8fabd8720eceb685d4f4 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sat, 25 Apr 2026 02:23:25 +0300
Subject: [PATCH 48/58] ci/github-script/merge: skip auto-merge when CI has
 already failed

The merge bot falls back to GitHub Auto Merge whenever the merge queue
won't accept a PR yet. That is the right move while CI is still
running, but pointless once CI has already failed: Auto Merge can never
trigger, and fixing CI requires a new push, which invalidates the merge
command anyway (the bot only acts on comments after the latest push).

Fetch the `no PR failures` commit status and, when the merge-queue
enqueue fails, branch on it. If CI has already failed
(`error`/`failure`), skip Auto Merge and reply that a fresh
`@NixOS/nixpkgs-merge-bot merge` comment is needed once CI is green
again. Otherwise (pending or missing status) enable Auto Merge as
before.

`merge()` now returns `{ reaction, messages }` so the CI-failure path
can leave a thumbs-down reaction rather than the rocket used for an
actual merge.

Closes #512554.

Assisted-by: claude-code with claude-opus-4-8[1m]-high
---
 ci/README.md              |  9 +++++
 ci/github-script/merge.js | 69 ++++++++++++++++++++++++++++++---------
 2 files changed, 63 insertions(+), 15 deletions(-)

diff --git a/ci/README.md b/ci/README.md
index be0e8e4c4fca..814299ed8182 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -52,6 +52,14 @@ To ensure security and a focused utility, the bot adheres to specific limitation
 - The user attempting to merge is a member of [@NixOS/nixpkgs-maintainers].
 - The user attempting to merge is a maintainer of all packages touched by the PR.
 
+Once these constraints are met, the bot picks a merge strategy based on the `no PR failures` commit status:
+
+- CI passing: the PR is added to the merge queue.
+- CI unfinished (pending or missing status): the bot enables [Auto Merge], which queues the PR once required checks succeed.
+  Note that if CI later fails, nothing happens until it is fixed and passes.
+- CI already failing (`error`/`failure` status): the bot does not enable Auto Merge, because it would never trigger, and fixing CI requires a new push that invalidates the merge command.
+  A fresh `@NixOS/nixpkgs-merge-bot merge` comment is needed once CI is green again.
+
 ### Approving merge bot changes
 
 Changes to the bot can usually be approved by the [@NixOS/nixpkgs-ci] team, as with other CI changes.
@@ -104,3 +112,4 @@ This script can also be run locally to print basic test cases.
 [@NixOS/nixpkgs-ci]: https://github.com/orgs/NixOS/teams/nixpkgs-ci
 [@NixOS/nixpkgs-core]: https://github.com/orgs/NixOS/teams/nixpkgs-core
 [RFC 172]: https://github.com/NixOS/rfcs/pull/172
+[Auto Merge]: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request
diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index ee861e21187d..e7f0cac8cc83 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -57,6 +57,9 @@ function runChecklist({
         pull_request.user.login === 'r-ryantm',
     },
     'PR is not a draft': !pull_request.draft,
+    // CI state is intentionally *not* a checklist item: auto-merge exists precisely to
+    // cover unfinished CI, and an already-failed CI is reported via the merge message
+    // (see merge() below) rather than a blanket refusal.
   }
 
   if (user) {
@@ -148,6 +151,14 @@ async function handleMerge({
   // including an early exit when the first non-by-name file is found.
   if (files.length >= 100) return false
 
+  const noPrFailuresState = (
+    await github.rest.repos.listCommitStatusesForRef({
+      ...context.repo,
+      ref: pull_request.head.sha,
+      per_page: 100,
+    })
+  ).data.find(({ context }) => context === 'no PR failures')?.state
+
   // Only look through comments *after* the latest (force) push.
   const lastPush = events.findLastIndex(
     ({ event, sha, commit_id }) =>
@@ -173,10 +184,12 @@ async function handleMerge({
         )),
   )
 
+  // Returns `{ reaction, messages }`: the reaction to leave on the merge comment and the
+  // lines to append to the bot's reply. Throws only on an unexpected API error.
   async function merge() {
     if (dry) {
       core.info(`Merging #${pull_number}... (dry)`)
-      return ['Merge completed (dry)']
+      return { reaction: 'ROCKET', messages: ['Merge completed (dry)'] }
     }
 
     // Using GraphQL mutations instead of the REST /merge endpoint, because the latter
@@ -197,16 +210,37 @@ async function handleMerge({
         { node_id: pull_request.node_id, sha: pull_request.head.sha },
       )
       log('merge', 'Queued for merge')
-      return [
-        `:heavy_check_mark: [Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge (#306934)`,
-      ]
+      return {
+        reaction: 'ROCKET',
+        messages: [
+          `:heavy_check_mark: [Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge (#306934)`,
+        ],
+      }
     } catch (e) {
       log('Enqueuing failed', e.response.errors[0].message)
     }
 
-    // If required status checks are not satisfied, yet, the above will fail. In this case
-    // we can enable auto-merge. We could also only use auto-merge, but this often gets
-    // stuck for no apparent reason.
+    // Enqueuing fails when the required status checks are not satisfied, yet. If CI has
+    // already failed, enabling auto-merge would be pointless: it would never fire, and
+    // fixing CI requires a new push, which invalidates this merge command anyway (we only
+    // act on comments after the latest push). So we don't enable auto-merge and instead
+    // ask for a fresh command once CI is green again.
+    if (['error', 'failure'].includes(noPrFailuresState)) {
+      log('merge', 'CI has failed, not enabling auto-merge')
+      return {
+        reaction: 'THUMBS_DOWN',
+        messages: [
+          ':x: Pull Request could not be merged: CI has failed (#305350).',
+          '',
+          '> [!TIP]',
+          '> PRs cannot be merged while CI is failing.',
+          '> Once CI is passing, comment `@NixOS/nixpkgs-merge-bot merge` again.',
+        ],
+      }
+    }
+
+    // CI has not finished yet, so we enable auto-merge. We could also only use auto-merge,
+    // but this often gets stuck for no apparent reason.
     try {
       await github.graphql(
         `mutation($node_id: ID!, $sha: GitObjectID) {
@@ -219,12 +253,15 @@ async function handleMerge({
         { node_id: pull_request.node_id, sha: pull_request.head.sha },
       )
       log('merge', 'Auto-merge enabled')
-      return [
-        `:heavy_check_mark: Enabled Auto Merge (#306934)`,
-        '',
-        '> [!TIP]',
-        '> Sometimes GitHub gets stuck after enabling Auto Merge. In this case, leaving another approval should trigger the merge.',
-      ]
+      return {
+        reaction: 'ROCKET',
+        messages: [
+          `:heavy_check_mark: Enabled Auto Merge (#306934)`,
+          '',
+          '> [!TIP]',
+          '> Sometimes GitHub gets stuck after enabling Auto Merge. In this case, leaving another approval should trigger the merge.',
+        ],
+      }
     } catch (e) {
       log('Auto Merge failed', e.response.errors[0].message)
       throw new Error(e.response.errors[0].message)
@@ -308,10 +345,12 @@ async function handleMerge({
     }
 
     if (result) {
-      await react('ROCKET')
       try {
-        body.push(...(await merge()))
+        const { reaction, messages } = await merge()
+        await react(reaction)
+        body.push(...messages)
       } catch (e) {
+        await react('THUMBS_DOWN')
         // Remove the HTML comment with node_id reference to allow retrying this merge on the next run.
         body.shift()
         body.push(`:x: Merge failed with: ${e} (#371492)`)

From b94b44d3f9e0d7d021dc4d550d2dd0185da47489 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sat, 25 Apr 2026 03:12:03 +0300
Subject: [PATCH 49/58] ci/github-script/merge: refuse merge when a committer
 has requested changes

A "changes requested" review from a committer blocks both the merge
queue and auto-merge, but unlike approvals it isn't auto-dismissed
when new commits are pushed. Surface it as a checklist item so the
bot's reply explains the block instead of silently enabling
auto-merge that will never trigger.

Implementation pulls every review for the PR via `listReviews` and,
for each committer, takes the latest review whose state is
`APPROVED`/`CHANGES_REQUESTED`. The check fails if any committer's
latest stance is `CHANGES_REQUESTED`. Other review states fall out
naturally:

- A dismissed review surfaces as `DISMISSED`, so a committer
  dismissing their own changes-requested review unblocks the PR.
- A comment-only follow-up surfaces as `COMMENTED`, so it doesn't
  override an earlier actionable review - the prior stance still
  stands until the committer explicitly approves or requests changes
  again.

Assisted-by: claude-code with claude-opus-4-8[1m]-high
---
 ci/README.md              |  2 ++
 ci/github-script/merge.js | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/ci/README.md b/ci/README.md
index 814299ed8182..6fbdca39800c 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -51,6 +51,8 @@ To ensure security and a focused utility, the bot adheres to specific limitation
   - opened by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/).
 - The user attempting to merge is a member of [@NixOS/nixpkgs-maintainers].
 - The user attempting to merge is a maintainer of all packages touched by the PR.
+- No [committer][@NixOS/nixpkgs-committers] has an outstanding "changes requested" review.
+  These block both the merge queue and auto-merge, so the bot refuses to merge until the review is addressed or dismissed.
 
 Once these constraints are met, the bot picks a merge strategy based on the `no PR failures` commit status:
 
diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index e7f0cac8cc83..1d218b27b0ae 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -7,6 +7,7 @@ function runChecklist({
   pull_request,
   log,
   maintainers,
+  reviews,
   user,
   userIsMaintainer,
 }) {
@@ -41,6 +42,27 @@ function runChecklist({
       .filter(Boolean),
   )
 
+  // A "changes requested" review from a committer blocks both the merge queue and
+  // auto-merge, even if it was made on an older commit (unlike approvals, GitHub does
+  // not auto-dismiss changes-requested reviews on push). For each committer, take their
+  // latest actionable review; if it's CHANGES_REQUESTED, they're blocking the PR.
+  // Dismissed reviews surface as DISMISSED and comment-only follow-ups as COMMENTED, so
+  // both are skipped naturally — the prior actionable review still stands until the
+  // committer explicitly approves or requests changes again.
+  const committerReviewState = new Map()
+  for (const { user, state } of reviews) {
+    if (
+      user &&
+      committers.has(user.id) &&
+      ['APPROVED', 'CHANGES_REQUESTED'].includes(state)
+    ) {
+      committerReviewState.set(user.id, state)
+    }
+  }
+  const noBlockingReviews = !Array.from(committerReviewState.values()).includes(
+    'CHANGES_REQUESTED',
+  )
+
   const checklist = {
     'PR targets a [development branch](https://github.com/NixOS/nixpkgs/blob/-/ci/README.md#branch-classification).':
       classify(pull_request.base.ref).type.includes('development'),
@@ -60,6 +82,8 @@ function runChecklist({
     // CI state is intentionally *not* a checklist item: auto-merge exists precisely to
     // cover unfinished CI, and an already-failed CI is reported via the merge message
     // (see merge() below) rather than a blanket refusal.
+    'PR is not blocked by a "changes requested" review from a [committer](https://github.com/orgs/NixOS/teams/nixpkgs-committers).':
+      noBlockingReviews,
   }
 
   if (user) {
@@ -159,6 +183,15 @@ async function handleMerge({
     })
   ).data.find(({ context }) => context === 'no PR failures')?.state
 
+  // Reviews are returned in chronological order; the latest review per user wins below.
+  // Dismissed reviews surface with state DISMISSED and comment-only follow-ups as
+  // COMMENTED, so both naturally drop out of the committer-blocking check.
+  const reviews = await github.paginate(github.rest.pulls.listReviews, {
+    ...context.repo,
+    pull_number,
+    per_page: 100,
+  })
+
   // Only look through comments *after* the latest (force) push.
   const lastPush = events.findLastIndex(
     ({ event, sha, commit_id }) =>
@@ -309,6 +342,7 @@ async function handleMerge({
       pull_request,
       log,
       maintainers,
+      reviews,
       user: comment.user,
       userIsMaintainer: await isMaintainer(comment.user.login),
     })
@@ -380,6 +414,7 @@ async function handleMerge({
     pull_request,
     log,
     maintainers,
+    reviews,
   })
 
   // Returns a boolean, which indicates whether the PR is merge-bot eligible in principle.

From 2aed8750428c136f9bec9f899c94cb41cc9d3837 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 14:58:29 +0000
Subject: [PATCH 50/58] snx-rs: 6.1.1 -> 6.1.2

---
 pkgs/by-name/sn/snx-rs/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sn/snx-rs/package.nix b/pkgs/by-name/sn/snx-rs/package.nix
index d48a683fc66c..a2cc8276e9b8 100644
--- a/pkgs/by-name/sn/snx-rs/package.nix
+++ b/pkgs/by-name/sn/snx-rs/package.nix
@@ -15,13 +15,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "snx-rs";
-  version = "6.1.1";
+  version = "6.1.2";
 
   src = fetchFromGitHub {
     owner = "ancwrd1";
     repo = "snx-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-64xwXC8s7BY8fzwrmpoF2sNqkknUj2AHLZprnuM1Be8=";
+    hash = "sha256-JhknaTqvd7Dsox38FH6mphbi+DPzVoyLlyAX6ZsqPkI=";
   };
 
   passthru.updateScript = nix-update-script { };
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     versionCheckHook
   ];
 
-  cargoHash = "sha256-/SQBcItOANmqcCzZ5/uKcVYA9btDqzApHJRSNbDh/ws=";
+  cargoHash = "sha256-lclSkg+WDRl3LQuzF4Q1+5zRT7UcnrasVvbcgd7wbxQ=";
 
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/snx-rs";

From 6f9325fb5dbf965b2078cba8a5ca4ad285e8f0af Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sat, 9 May 2026 15:04:29 +0300
Subject: [PATCH 51/58] ci/github-script/merge: clarify Auto Merge follow-up
 tip

The previous tip ("Sometimes GitHub gets stuck after enabling Auto
Merge") didn't explain why nothing happens immediately after the bot's
"Enabled Auto Merge" reply, leaving maintainers unsure whether to wait
or intervene. Spell out that Auto Merge waits for required CI before
queueing, that a later CI failure leaves the PR un-queued until it is
fixed, and link to GitHub's documentation; keep the existing "leave
another approval" workaround for the rare cases where Auto Merge stalls
after CI completes.

Assisted-by: claude-code with claude-opus-4-8[1m]-high
---
 ci/github-script/merge.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 1d218b27b0ae..963d2c1e61bf 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -292,7 +292,9 @@ async function handleMerge({
           `:heavy_check_mark: Enabled Auto Merge (#306934)`,
           '',
           '> [!TIP]',
-          '> Sometimes GitHub gets stuck after enabling Auto Merge. In this case, leaving another approval should trigger the merge.',
+          '> [Auto Merge](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request) will queue this PR once required CI checks succeed.',
+          '> If CI fails instead, fixing it needs a new push, which disables Auto Merge and invalidates this command — comment `@NixOS/nixpkgs-merge-bot merge` again once CI is green.',
+          '> If GitHub gets stuck even though CI passed (it sometimes does), leaving another approval should kick off the merge.',
         ],
       }
     } catch (e) {

From 0c1c3d48139703764cb5415b585313ef8b15d0fe Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sat, 9 May 2026 15:15:27 +0300
Subject: [PATCH 52/58] ci/github-script/merge: share reviews fetch with
 bot.js, drop events

`bot.js` already pulls reviews via GraphQL for the approval-count
labels. Move that fetch above the `handleMerge` call, add `commit
{ oid }` to the query, and pass the result through. `handleMerge` no
longer issues its own `listReviews` REST call.

While here, the `approvals` set is now derived from the same reviews
data. Two upsides:

- A reviewer who approved and was later dismissed no longer counts
  towards the approval check; their review now surfaces with state
  DISMISSED instead of leaving a stale `reviewed` event behind.
- `events` is no longer needed by `runChecklist` (it was only feeding
  the approvals filter); the parameter is dropped from both call
  sites. `handleMerge` still uses `events` for tracking the latest
  push and merge-command comments.

Also drop the redundant `user` truthy checks (and the stale "some
users have been deleted" comment) in `runChecklist`. The GraphQL
query uses `author { ... on User { login id } }` and bot.js then
filters via `r.user?.login`, so by the time reviews reach
`runChecklist` every entry already has a populated `user`. Verified
by querying real PRs: bots surface as `{__typename: "Bot"}` (no
`login`/`id`, filtered out by bot.js), and deleted accounts surface
as the "ghost" user (login `"ghost"`, id `10137`), which passes the
filter but matches no committer - harmless for both checks.

Assisted-by: claude-code with claude-opus-4-8[1m]-high
---
 ci/github-script/bot.js   | 29 ++++++++++++++++-------------
 ci/github-script/merge.js | 27 ++++++---------------------
 2 files changed, 22 insertions(+), 34 deletions(-)

diff --git a/ci/github-script/bot.js b/ci/github-script/bot.js
index c952499cec54..8e0043d5505c 100644
--- a/ci/github-script/bot.js
+++ b/ci/github-script/bot.js
@@ -206,20 +206,8 @@ module.exports = async ({ github, context, core, dry }) => {
 
     const maintainers = await getMaintainerMap(pull_request.base.ref)
 
-    const merge_bot_eligible = await handleMerge({
-      github,
-      context,
-      core,
-      log,
-      dry,
-      pull_request,
-      events,
-      maintainers,
-      getTeamMembers,
-      getUser,
-    })
-
     // Check for any human reviews other than the PR author, GitHub actions and other GitHub apps.
+    // `commit { oid }` is needed by handleMerge to verify approvals are against the current head.
     const reviews = (
       await github.graphql(
         `query($owner: String!, $repo: String!, $pr: Int!) {
@@ -231,6 +219,7 @@ module.exports = async ({ github, context, core, dry }) => {
             reviews(first: 100) {
               nodes {
                 state
+                commit { oid }
                 user: author {
                   # Only get users, no bots
                   ... on User {
@@ -266,6 +255,20 @@ module.exports = async ({ github, context, core, dry }) => {
         r.user.id !== pull_request.user?.id,
     )
 
+    const merge_bot_eligible = await handleMerge({
+      github,
+      context,
+      core,
+      log,
+      dry,
+      pull_request,
+      events,
+      reviews,
+      maintainers,
+      getTeamMembers,
+      getUser,
+    })
+
     const approvals = new Set(
       reviews
         .filter((review) => review.state === 'APPROVED')
diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 963d2c1e61bf..180a12b0fe4a 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -2,7 +2,6 @@ const { classify } = require('../supportedBranches.js')
 
 function runChecklist({
   committers,
-  events,
   files,
   pull_request,
   log,
@@ -28,18 +27,15 @@ function runChecklist({
         .reduce((acc, cur) => acc?.intersection(cur) ?? cur)
 
   const approvals = new Set(
-    events
+    reviews
       .filter(
-        ({ event, state, commit_id }) =>
-          event === 'reviewed' &&
-          state === 'approved' &&
+        ({ state, commit }) =>
+          state === 'APPROVED' &&
           // Only approvals for the current head SHA count, otherwise authors could push
           // bad code between the approval and the merge.
-          commit_id === pull_request.head.sha,
+          commit?.oid === pull_request.head.sha,
       )
-      .map(({ user }) => user?.id)
-      // Some users have been deleted, so filter these out.
-      .filter(Boolean),
+      .map(({ user }) => user.id),
   )
 
   // A "changes requested" review from a committer blocks both the merge queue and
@@ -52,7 +48,6 @@ function runChecklist({
   const committerReviewState = new Map()
   for (const { user, state } of reviews) {
     if (
-      user &&
       committers.has(user.id) &&
       ['APPROVED', 'CHANGES_REQUESTED'].includes(state)
     ) {
@@ -150,6 +145,7 @@ async function handleMerge({
   dry,
   pull_request,
   events,
+  reviews,
   maintainers,
   getTeamMembers,
   getUser,
@@ -183,15 +179,6 @@ async function handleMerge({
     })
   ).data.find(({ context }) => context === 'no PR failures')?.state
 
-  // Reviews are returned in chronological order; the latest review per user wins below.
-  // Dismissed reviews surface with state DISMISSED and comment-only follow-ups as
-  // COMMENTED, so both naturally drop out of the committer-blocking check.
-  const reviews = await github.paginate(github.rest.pulls.listReviews, {
-    ...context.repo,
-    pull_number,
-    per_page: 100,
-  })
-
   // Only look through comments *after* the latest (force) push.
   const lastPush = events.findLastIndex(
     ({ event, sha, commit_id }) =>
@@ -339,7 +326,6 @@ async function handleMerge({
 
     const { result, eligible, checklist } = runChecklist({
       committers,
-      events,
       files,
       pull_request,
       log,
@@ -411,7 +397,6 @@ async function handleMerge({
 
   const { result } = runChecklist({
     committers,
-    events,
     files,
     pull_request,
     log,

From cf8b2c280a9e0afd3692fe514e672eaa7a1a3aaa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 15:09:49 +0000
Subject: [PATCH 53/58] geeqie: 2.7 -> 2.8

---
 pkgs/by-name/ge/geeqie/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ge/geeqie/package.nix b/pkgs/by-name/ge/geeqie/package.nix
index c48dfab6f595..b8cf75d9742b 100644
--- a/pkgs/by-name/ge/geeqie/package.nix
+++ b/pkgs/by-name/ge/geeqie/package.nix
@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geeqie";
-  version = "2.7";
+  version = "2.8";
 
   src = fetchFromGitHub {
     owner = "BestImageViewer";
     repo = "geeqie";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yCY9ltm21cD3NnC2hDZ3O+2UZYgop4TLHC0djPF3Lo0=";
+    hash = "sha256-90e+f95RIv2FZUFrfr6e7MhsQ8Xnve+Ie+uPyc87FRE=";
   };
 
   postPatch = ''

From d035268053ca9b7a37e48257cb138c5a82df613e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 15:12:51 +0000
Subject: [PATCH 54/58] libretro.swanstation: 0-unstable-2026-06-14 ->
 0-unstable-2026-06-25

---
 pkgs/applications/emulators/libretro/cores/swanstation.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/swanstation.nix b/pkgs/applications/emulators/libretro/cores/swanstation.nix
index 13be1cc06c10..00ec541ad351 100644
--- a/pkgs/applications/emulators/libretro/cores/swanstation.nix
+++ b/pkgs/applications/emulators/libretro/cores/swanstation.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "swanstation";
-  version = "0-unstable-2026-06-14";
+  version = "0-unstable-2026-06-25";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "swanstation";
-    rev = "93b213d805591c4f1488339c4a16f0b4cb68d44a";
-    hash = "sha256-l4HhejwOKE/bk9HFf2mDTDqc223m6UofTIF+BgMIDEw=";
+    rev = "32e5654cb4ff17db3e950250a677767906fa3cf8";
+    hash = "sha256-l4Vb1kSuoqMJC4gn+S61zuePZaYvJ/nmVyoFOlsCTBM=";
   };
 
   extraNativeBuildInputs = [ cmake ];

From 2b428514e551b09ba15f1dd9ea76c1b40ee801df Mon Sep 17 00:00:00 2001
From: Paul Grandperrin <paul.grandperrin@gmail.com>
Date: Thu, 25 Jun 2026 17:24:49 +0200
Subject: [PATCH 55/58] linux: forward features into passthru

build.nix accepted `features` as a parameter but discarded it, never
placing it into the derivation's passthru. The NixOS boot.kernelPackages
apply function calls kernel.override() on every evaluation, re-running
build.nix from scratch; any features added via overrideAttrs were
silently lost, causing assertions like hardware.graphics.enable32Bit
(which checks kernel.features.ia32Emulation) to always fail for
linuxManualConfig-based kernels.

Change `features ? null` to `features ? {}` and add it to passthru so
it survives override() call chains.
---
 pkgs/os-specific/linux/kernel/build.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index ac191a3ba149..91340c212afd 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -80,8 +80,7 @@ lib.makeOverridable (
 
     # Whether to utilize the controversial import-from-derivation feature to parse the config
     allowImportFromDerivation ? false,
-    # ignored
-    features ? null,
+    features ? { },
     lib ? lib_,
     stdenv ? stdenv_,
   }:
@@ -530,6 +529,9 @@ lib.makeOverridable (
       inherit
         isZen
         withRust
+        # Forwarded into passthru so features survive kernel.override() call chains
+        # used by the NixOS module system (see boot.kernelPackages apply in kernel.nix).
+        features
         ;
       baseVersion = lib.head (lib.splitString "-rc" version);
       kernelOlder = lib.versionOlder baseVersion;

From 63ab6eb164e21b21db245aace4bac2af4a128bf5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 15:55:52 +0000
Subject: [PATCH 56/58] libretro.gambatte: 0-unstable-2026-06-14 ->
 0-unstable-2026-06-19

---
 pkgs/applications/emulators/libretro/cores/gambatte.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/gambatte.nix b/pkgs/applications/emulators/libretro/cores/gambatte.nix
index a4b475e12d83..edab66c09021 100644
--- a/pkgs/applications/emulators/libretro/cores/gambatte.nix
+++ b/pkgs/applications/emulators/libretro/cores/gambatte.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gambatte";
-  version = "0-unstable-2026-06-14";
+  version = "0-unstable-2026-06-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gambatte-libretro";
-    rev = "e99e1bd9b91de67ac12c77c3679c85447c26e8c8";
-    hash = "sha256-i5Bx5MstvwwKfH/Lmlj3jheQsbHP2BU8Ecpp3m5D8HA=";
+    rev = "4832d33cc3427ee0a1c1b9065339dd18ff57370d";
+    hash = "sha256-qn3zYecSmQjQV1f0Aw6+zVEQttMSHsrNQuMFbsDyKC8=";
   };
 
   meta = {

From 96435d701a8a5bc689251a003dab4ec723225f62 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 16:34:19 +0000
Subject: [PATCH 57/58] claude-agent-acp: 0.45.1 -> 0.52.0

---
 pkgs/by-name/cl/claude-agent-acp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cl/claude-agent-acp/package.nix b/pkgs/by-name/cl/claude-agent-acp/package.nix
index 26dc14b0c45a..ec735a5d71a5 100644
--- a/pkgs/by-name/cl/claude-agent-acp/package.nix
+++ b/pkgs/by-name/cl/claude-agent-acp/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "claude-agent-acp";
-  version = "0.45.1";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "agentclientprotocol";
     repo = "claude-agent-acp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NiDsm0tcK80CQyG8zn974ErwDP0hXXOHbCLX9BpErKY=";
+    hash = "sha256-w8lrc/4cW7QZNDMvq663eas7Dl4tnya4JCM9xkLF8S8=";
   };
 
-  npmDepsHash = "sha256-WB+ZMtDmqZrEg8/k9peCm+EbKvZc8qfOV33STT1vj8k=";
+  npmDepsHash = "sha256-czNQInLxK/DMFViJWa15PGOU61qnqm0wNwFqjTH3Z+k=";
 
   nativeBuildInputs = [ makeWrapper ];
 

From f26c0932b3872f0a9879a20e236b21e654e321d5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 16:56:15 +0000
Subject: [PATCH 58/58] python3Packages.sabctools: 9.4.1 -> 9.5.0

---
 pkgs/development/python-modules/sabctools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sabctools/default.nix b/pkgs/development/python-modules/sabctools/default.nix
index fd6fd8d3bf85..dc69a97325d2 100644
--- a/pkgs/development/python-modules/sabctools/default.nix
+++ b/pkgs/development/python-modules/sabctools/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "sabctools";
-  version = "9.4.1";
+  version = "9.5.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MU2vgWX7ojy5OYllEJTHrz9z7mvrJq3mrfRUM2jQ9ws=";
+    hash = "sha256-x0+9GT/xs+EdX63qglTeuYE/z8cp/kOZmk6zd8MlAgQ=";
   };
 
   build-system = [ setuptools ];