From ab2bc9944360bd1e202d8f70d4814bc579d3566f Mon Sep 17 00:00:00 2001
From: Samuel Holland <samuel@sholland.org>
Date: Tue, 30 Dec 2025 19:00:52 -0600
Subject: [PATCH 001/210] nixos/udev: Copy dmi_memory_id only if installed

This tool is only built on certain architectures that systemd
enumerates as supporting DMI[1]. Notably, this excludes POWER.

[1]: https://github.com/systemd/systemd/blob/v259/meson.build#L1529-L1530
---
 nixos/modules/services/hardware/udev.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index 6e779df94e77..b8e7549b1322 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -462,10 +462,17 @@ in
       "${config.boot.initrd.systemd.package}/lib/systemd/systemd-udevd"
       "${config.boot.initrd.systemd.package}/lib/udev/ata_id"
       "${config.boot.initrd.systemd.package}/lib/udev/cdrom_id"
-      "${config.boot.initrd.systemd.package}/lib/udev/dmi_memory_id"
       "${config.boot.initrd.systemd.package}/lib/udev/scsi_id"
       "${config.boot.initrd.systemd.package}/lib/udev/rules.d"
     ]
+    ++ lib.optional (
+      # https://github.com/systemd/systemd/blob/v259/meson.build#L1529-L1530
+      pkgs.stdenv.hostPlatform.isx86
+      || pkgs.stdenv.hostPlatform.isAarch
+      || pkgs.stdenv.hostPlatform.isLoongArch64
+      || pkgs.stdenv.hostPlatform.isMips
+      || pkgs.stdenv.hostPlatform.isRiscV64
+    ) "${config.boot.initrd.systemd.package}/lib/udev/dmi_memory_id"
     ++ map (x: "${x}/bin") config.boot.initrd.services.udev.binPackages;
 
     # Generate the udev rules for the initrd

From dacaaa8ef2a2c86135f63389aa2ffd4de155cb6d Mon Sep 17 00:00:00 2001
From: Uzlkav <177883133+Uzlkav@users.noreply.github.com>
Date: Tue, 24 Mar 2026 00:51:38 -0600
Subject: [PATCH 002/210] maintainers: add uzlkav

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 5a0c74731483..59cf08aab6af 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -27537,6 +27537,12 @@
     github = "uxodb";
     githubId = 20535246;
   };
+  uzlkav = {
+    name = "Uzlkav";
+    github = "Uzlkav";
+    githubId = 177883133;
+    matrix = "@capybara_squash:unredacted.org";
+  };
   V = {
     name = "V";
     email = "v@anomalous.eu";

From 40ff720834e45f57cda93252b4a2293cbbc0ca28 Mon Sep 17 00:00:00 2001
From: kilyanni <github@nkilian.org>
Date: Mon, 27 Apr 2026 18:02:29 +0200
Subject: [PATCH 003/210] intel-llvm: support rocm/cuda builds without explicit
 path parameters

Previously, building for ROCm/CUDA required manually passing flags like
--rocm-path for intel-llvm to discover driver libraries.
This commit automatically hooks up relevant paths.
---
 pkgs/by-name/in/intel-llvm/package.nix        | 15 ++++++++++++++-
 .../by-name/in/intel-llvm/unified-runtime.nix | 19 ++++++++++++++++++-
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/intel-llvm/package.nix b/pkgs/by-name/in/intel-llvm/package.nix
index d63b869d2038..a804b4f088a8 100644
--- a/pkgs/by-name/in/intel-llvm/package.nix
+++ b/pkgs/by-name/in/intel-llvm/package.nix
@@ -111,7 +111,20 @@ let
         mkdir "$rsrc"
         echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
         ln -s "${lib.getLib self.unwrapped}/lib/clang/${self.llvmMajorVersion}/include" "$rsrc"
-      '';
+      ''
+      + (lib.concatStrings (
+        lib.mapAttrsToList (k: v: ''
+          echo "export ${k}=${v}" >> $out/nix-support/setup-hook
+        '') self.unwrapped.unified-runtime.setupVars
+      ))
+
+      + (lib.optionalString (self.unwrapped.unified-runtime.setupVars ? CUDA_PATH) ''
+        # SYCL CUDA runtime libs (e.g. libonemath_blas_cublas.so) carry DT_NEEDED: libcuda.so.1.
+        # GNU ld resolves transitive DT_NEEDED via -rpath-link, not -L; point it at the stubs.
+        echo "-rpath-link,${self.unwrapped.unified-runtime.setupVars.CUDA_PATH}/lib/stubs" >> $out/nix-support/cc-ldflags
+        # The SYCL CUDA backend discovers libdevice by finding ptxas in PATH.
+        echo "export PATH=${self.unwrapped.unified-runtime.setupVars.CUDA_PATH}/bin''${PATH:+:$PATH}" >> $out/nix-support/setup-hook
+      '');
 
       extraPackages =
         # We need to explicitly link to the dev package to get headers like sycl.hpp
diff --git a/pkgs/by-name/in/intel-llvm/unified-runtime.nix b/pkgs/by-name/in/intel-llvm/unified-runtime.nix
index 78d673ca8094..1bd3cf296469 100644
--- a/pkgs/by-name/in/intel-llvm/unified-runtime.nix
+++ b/pkgs/by-name/in/intel-llvm/unified-runtime.nix
@@ -18,6 +18,7 @@
   pkg-config,
   lit,
   filecheck,
+  buildPackages,
   rocmPackages ? { },
   rocmGpuTargets ? lib.optionalString (rocmPackages ? clr.gpuTargets) (
     builtins.concatStringsSep ";" rocmPackages.clr.gpuTargets
@@ -41,10 +42,22 @@ let
     ];
   };
 
+  # Minimal rocm join required at runtime
+  # We pass this to clang in its wrapper later.
+  # This is a separate join from the above because we don't
+  # need to pull in hsakmt and comgr at runtime, only build time.
+  rocmPath = symlinkJoin {
+    name = "rocm-path";
+    paths = with rocmPackages; [
+      clr
+      rocm-device-libs
+    ];
+  };
+
   cudatoolkit_joined = symlinkJoin {
     name = "cuda-merged";
 
-    paths = with cudaPackages; [
+    paths = with buildPackages.cudaPackages; [
       cuda_cudart
       cuda_nvcc
       cuda_nvml_dev.include
@@ -158,6 +171,10 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "CUDA_cupti_LIBRARY" "${cudatoolkit_joined}/lib/libcupti.so")
   ];
 
+  passthru.setupVars =
+    lib.optionalAttrs rocmSupport { ROCM_PATH = rocmPath; }
+    // lib.optionalAttrs cudaSupport { CUDA_PATH = cudatoolkit_joined; };
+
   passthru.backends =
     lib.optionals levelZeroSupport [
       "level_zero"

From ad73c80d33f7a556e52106f2cfd61bf4c7873470 Mon Sep 17 00:00:00 2001
From: Rylan Polster <rylan.polster@shopify.com>
Date: Tue, 12 May 2026 18:00:44 -0400
Subject: [PATCH 004/210] openresty: fix lib.optional misuse in configureFlags

---
 pkgs/servers/http/openresty/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix
index f527e6a6adb3..8e60573f4a51 100644
--- a/pkgs/servers/http/openresty/default.nix
+++ b/pkgs/servers/http/openresty/default.nix
@@ -49,7 +49,7 @@ callPackage ../nginx/generic.nix args rec {
     patchShebangs configure bundle/
   '';
 
-  configureFlags = lib.optional withPostgres [ "--with-http_postgres_module" ];
+  configureFlags = lib.optionals withPostgres [ "--with-http_postgres_module" ];
 
   postInstall = ''
     ln -s $out/luajit/bin/luajit-2.1.ROLLING $out/bin/luajit-openresty

From cdb35b67b3d9828b0eae3769281ffa0f84592882 Mon Sep 17 00:00:00 2001
From: Jacek Galowicz <jacek@applicative.systems>
Date: Sat, 23 May 2026 13:02:53 +0200
Subject: [PATCH 005/210] nixos-test-driver: drop unneeded qemu dep

---
 nixos/lib/test-driver/default.nix | 3 ---
 nixos/lib/testing/driver.nix      | 1 -
 pkgs/top-level/all-packages.nix   | 1 -
 3 files changed, 5 deletions(-)

diff --git a/nixos/lib/test-driver/default.nix b/nixos/lib/test-driver/default.nix
index 77638397d11c..03cfcb6915b3 100644
--- a/nixos/lib/test-driver/default.nix
+++ b/nixos/lib/test-driver/default.nix
@@ -18,8 +18,6 @@
   netpbm,
   vhost-device-vsock,
   nixosTests,
-  qemu_pkg ? qemu_test,
-  qemu_test,
   setuptools,
   socat,
   systemd,
@@ -56,7 +54,6 @@ buildPythonApplication {
   propagatedBuildInputs = [
     coreutils
     netpbm
-    qemu_pkg
     socat
     util-linux
     vde2
diff --git a/nixos/lib/testing/driver.nix b/nixos/lib/testing/driver.nix
index 69392eb052af..02dd359b20c3 100644
--- a/nixos/lib/testing/driver.nix
+++ b/nixos/lib/testing/driver.nix
@@ -15,7 +15,6 @@ let
   # the respective qemu version and with or without ocr support
   testDriver = config.pythonTestDriverPackage.override {
     inherit (config) enableOCR extraPythonPackages;
-    qemu_pkg = config.qemu.package;
     enableNspawn = config.containers != { };
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 412eb9b256dd..b2e11801d838 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -196,7 +196,6 @@ with pkgs;
   inherit (nix-update) nix-update-script;
 
   nixos-test-driver = pkgs.python3Packages.callPackage ../../nixos/lib/test-driver {
-    qemu_pkg = pkgs.qemu;
     imagemagick_light = pkgs.imagemagick_light.override { inherit (pkgs) libtiff; };
     tesseract4 = pkgs.tesseract4.override { enableLanguages = [ "eng" ]; };
     # We want `pkgs.systemd`, *not* `python3Packages.system`.

From a3b079d14385f446643dfb43642dfd24cd2f1d4d Mon Sep 17 00:00:00 2001
From: Jacek Galowicz <jacek@applicative.systems>
Date: Sun, 24 May 2026 08:57:07 +0200
Subject: [PATCH 006/210] nixos-tests: fix qemu-img paths

---
 nixos/tests/boot.nix                  |   2 +-
 nixos/tests/common/ec2.nix            |   8 +-
 nixos/tests/ec2-image.nix             | 482 +++++++++++++-------------
 nixos/tests/systemd-initrd-simple.nix |  16 +-
 nixos/tests/systemd.nix               |  34 +-
 5 files changed, 275 insertions(+), 267 deletions(-)

diff --git a/nixos/tests/boot.nix b/nixos/tests/boot.nix
index d1ac1a8769fe..a59f94b94edf 100644
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -207,7 +207,7 @@ in
         import os
 
         # Create a mutable linked image backed by the read-only SD image
-        if os.system("qemu-img create -f qcow2 -F raw -b ${sdImage} ${mutableImage}") != 0:
+        if os.system("${pkgs.qemu}/bin/qemu-img create -f qcow2 -F raw -b ${sdImage} ${mutableImage}") != 0:
             raise RuntimeError("Could not create mutable linked image")
 
         machine = create_machine("${startCommand}")
diff --git a/nixos/tests/common/ec2.nix b/nixos/tests/common/ec2.nix
index 864afc63cb8b..f28e094d455b 100644
--- a/nixos/tests/common/ec2.nix
+++ b/nixos/tests/common/ec2.nix
@@ -51,9 +51,11 @@ in
         )
         os.makedirs(image_dir, mode=0o700, exist_ok=True)
         disk_image = os.path.join(image_dir, "machine.qcow2")
+        QEMU_BIN = "${pkgs.qemu}"
+        QEMU_IMG = f"{QEMU_BIN}/bin/qemu-img"
         subprocess.check_call(
             [
-                "qemu-img",
+                QEMU_IMG,
                 "create",
                 "-f",
                 "qcow2",
@@ -64,7 +66,7 @@ in
                 disk_image,
             ]
         )
-        subprocess.check_call(["qemu-img", "resize", disk_image, "10G"])
+        subprocess.check_call([QEMU_IMG, "resize", disk_image, "10G"])
 
         # Note: we use net=169.0.0.0/8 rather than
         # net=169.254.0.0/16 to prevent dhcpcd from getting horribly
@@ -74,7 +76,7 @@ in
         # turn off the DHCP server, but qemu does not have an option
         # to do that.
         start_command = (
-            "qemu-kvm -m 1024"
+            f"{QEMU_BIN}/bin/qemu-kvm -m 1024"
             + " -device virtio-net-pci,netdev=vlan0"
             + " -netdev 'user,id=vlan0,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${getExe imdsServer} ${metaData}'"
             + f" -drive file={disk_image},if=virtio,werror=report"
diff --git a/nixos/tests/ec2-image.nix b/nixos/tests/ec2-image.nix
index b54b153bd52e..df07d14b8ba7 100644
--- a/nixos/tests/ec2-image.nix
+++ b/nixos/tests/ec2-image.nix
@@ -88,294 +88,298 @@ in
       };
   };
 
-  testScript = ''
-    import os
-    import re
-    import subprocess
-    import tempfile
+  testScript =
+    { nodes, ... }:
+    ''
+      import os
+      import re
+      import subprocess
+      import tempfile
 
-    # Instance Metadata Service (IMDSv2 with 1.0 metadata version)
-    # TODO: Use 'latest' metadata version instead of '1.0'
-    # TODO: [Test matrix] also test providing the host key through IMDS
-    #       - i.e. a test module argument to select between writing or reading the host key
-    def create_ec2_metadata_dir(temp_dir, client_pubkey):
-        """Create fake EC2 metadata directory structure with mock data"""
-        metadata_dir = os.path.join(temp_dir.name, "ec2-metadata")
+      # Instance Metadata Service (IMDSv2 with 1.0 metadata version)
+      # TODO: Use 'latest' metadata version instead of '1.0'
+      # TODO: [Test matrix] also test providing the host key through IMDS
+      #       - i.e. a test module argument to select between writing or reading the host key
+      def create_ec2_metadata_dir(temp_dir, client_pubkey):
+          """Create fake EC2 metadata directory structure with mock data"""
+          metadata_dir = os.path.join(temp_dir.name, "ec2-metadata")
 
-        # Create directory structure
-        os.makedirs(os.path.join(metadata_dir, "1.0", "meta-data", "public-keys", "0"), exist_ok=True)
-        os.makedirs(os.path.join(metadata_dir, "latest", "api"), exist_ok=True)
+          # Create directory structure
+          os.makedirs(os.path.join(metadata_dir, "1.0", "meta-data", "public-keys", "0"), exist_ok=True)
+          os.makedirs(os.path.join(metadata_dir, "latest", "api"), exist_ok=True)
 
-        # Metadata version 1.0 endpoints (what fetch-ec2-metadata.sh actually fetches)
-        with open(os.path.join(metadata_dir, "1.0", "meta-data", "hostname"), "w") as f:
-            f.write("test-instance")
-        with open(os.path.join(metadata_dir, "1.0", "meta-data", "ami-manifest-path"), "w") as f:
-            f.write("(test)")
-        with open(os.path.join(metadata_dir, "1.0", "meta-data", "instance-id"), "w") as f:
-            f.write("i-1234567890abcdef0")
-        with open(os.path.join(metadata_dir, "1.0", "user-data"), "w") as f:
-            f.write("")
-        with open(os.path.join(metadata_dir, "1.0", "meta-data", "public-keys", "0", "openssh-key"), "w") as f:
-            f.write(client_pubkey)
+          # Metadata version 1.0 endpoints (what fetch-ec2-metadata.sh actually fetches)
+          with open(os.path.join(metadata_dir, "1.0", "meta-data", "hostname"), "w") as f:
+              f.write("test-instance")
+          with open(os.path.join(metadata_dir, "1.0", "meta-data", "ami-manifest-path"), "w") as f:
+              f.write("(test)")
+          with open(os.path.join(metadata_dir, "1.0", "meta-data", "instance-id"), "w") as f:
+              f.write("i-1234567890abcdef0")
+          with open(os.path.join(metadata_dir, "1.0", "user-data"), "w") as f:
+              f.write("")
+          with open(os.path.join(metadata_dir, "1.0", "meta-data", "public-keys", "0", "openssh-key"), "w") as f:
+              f.write(client_pubkey)
 
-        # IMDSv2 token endpoint - return a fake token
-        with open(os.path.join(metadata_dir, "latest", "api", "token"), "w") as f:
-            f.write("test-token-12345")
+          # IMDSv2 token endpoint - return a fake token
+          with open(os.path.join(metadata_dir, "latest", "api", "token"), "w") as f:
+              f.write("test-token-12345")
 
-        return metadata_dir
+          return metadata_dir
 
-    def generate_client_ssh_key():
-        """Generate SSH key pair on VM host for client authentication"""
-        # Use temporary directory for key generation
-        import tempfile
-        with tempfile.TemporaryDirectory() as key_dir:
-            private_key = os.path.join(key_dir, "id_ed25519")
-            public_key = os.path.join(key_dir, "id_ed25519.pub")
+      def generate_client_ssh_key():
+          """Generate SSH key pair on VM host for client authentication"""
+          # Use temporary directory for key generation
+          import tempfile
+          with tempfile.TemporaryDirectory() as key_dir:
+              private_key = os.path.join(key_dir, "id_ed25519")
+              public_key = os.path.join(key_dir, "id_ed25519.pub")
 
-            # Generate key pair using host SSH tools
-            ret = os.system(f"${hostPkgs.openssh}/bin/ssh-keygen -t ed25519 -f {private_key} -N \"\"")
-            if ret != 0:
-                raise Exception("Failed to generate SSH key pair")
+              # Generate key pair using host SSH tools
+              ret = os.system(f"${hostPkgs.openssh}/bin/ssh-keygen -t ed25519 -f {private_key} -N \"\"")
+              if ret != 0:
+                  raise Exception("Failed to generate SSH key pair")
 
-            # Read the generated public key
-            with open(public_key, "r") as f:
-                client_pubkey = f.read().strip()
+              # Read the generated public key
+              with open(public_key, "r") as f:
+                  client_pubkey = f.read().strip()
 
-            # Read the private key
-            with open(private_key, "r") as f:
-                client_private_key = f.read()
+              # Read the private key
+              with open(private_key, "r") as f:
+                  client_private_key = f.read()
 
-            return client_pubkey, client_private_key
+              return client_pubkey, client_private_key
 
-    def setup_client_ssh_key(client, client_private_key):
-        """Install the pre-generated SSH private key on client"""
-        client.succeed("mkdir -p /root/.ssh")
-        client.succeed(f"cat > /root/.ssh/id_ed25519 << 'EOF'\n{client_private_key}\nEOF")
-        client.succeed("chmod 600 /root/.ssh/id_ed25519")
+      def setup_client_ssh_key(client, client_private_key):
+          """Install the pre-generated SSH private key on client"""
+          client.succeed("mkdir -p /root/.ssh")
+          client.succeed(f"cat > /root/.ssh/id_ed25519 << 'EOF'\n{client_private_key}\nEOF")
+          client.succeed("chmod 600 /root/.ssh/id_ed25519")
 
-    def setup_machine(temp_dir, client_pubkey):
-        """Initialize EC2 machine with disk image, metadata server, and networking"""
-        # Set up disk image
-        image_dir = os.path.join(
-            os.environ.get("TMPDIR", tempfile.gettempdir()), "tmp", "vm-state-machine"
-        )
-        os.makedirs(image_dir, mode=0o700, exist_ok=True)
-        disk_image = os.path.join(image_dir, "machine.qcow2")
-        subprocess.check_call([
-            "qemu-img", "create", "-f", "qcow2", "-F", "qcow2",
-            "-o", "backing_file=${image}", disk_image
-        ])
-        subprocess.check_call(["qemu-img", "resize", disk_image, "10G"])
+      def setup_machine(temp_dir, client_pubkey):
+          """Initialize EC2 machine with disk image, metadata server, and networking"""
+          # Set up disk image
+          image_dir = os.path.join(
+              os.environ.get("TMPDIR", tempfile.gettempdir()), "tmp", "vm-state-machine"
+          )
+          os.makedirs(image_dir, mode=0o700, exist_ok=True)
+          disk_image = os.path.join(image_dir, "machine.qcow2")
+          QEMU = "${nodes.machine.virtualisation.qemu.package}"
+          QEMU_IMG = f"{QEMU}/bin/qemu-img"
+          subprocess.check_call([
+              QEMU_IMG, "create", "-f", "qcow2", "-F", "qcow2",
+              "-o", "backing_file=${image}", disk_image
+          ])
+          subprocess.check_call([QEMU_IMG, "resize", disk_image, "10G"])
 
-        # Create fake EC2 metadata in temporary directory with client's public key
-        metadata_dir = create_ec2_metadata_dir(temp_dir, client_pubkey)
+          # Create fake EC2 metadata in temporary directory with client's public key
+          metadata_dir = create_ec2_metadata_dir(temp_dir, client_pubkey)
 
-        # Add both VLAN networking (matching test framework) and EC2 metadata server
-        vlan_net = (
-            " -device virtio-net-pci,netdev=vlan1,mac=52:54:00:12:01:02"
-            + ' -netdev vde,id=vlan1,sock="$QEMU_VDE_SOCKET_1"'
-        )
-        metadata_net = (
-            " -device virtio-net-pci,netdev=ec2meta"
-            + f" -netdev 'user,id=ec2meta,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${lib.getExe imdsServer} {metadata_dir}'"
-        )
+          # Add both VLAN networking (matching test framework) and EC2 metadata server
+          vlan_net = (
+              " -device virtio-net-pci,netdev=vlan1,mac=52:54:00:12:01:02"
+              + ' -netdev vde,id=vlan1,sock="$QEMU_VDE_SOCKET_1"'
+          )
+          metadata_net = (
+              " -device virtio-net-pci,netdev=ec2meta"
+              + f" -netdev 'user,id=ec2meta,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${lib.getExe imdsServer} {metadata_dir}'"
+          )
 
-        start_command = (
-            "qemu-kvm -m 1024"
-            + f" -drive file={disk_image},if=virtio,werror=report"
-            + vlan_net
-            + metadata_net
-            + " $QEMU_OPTS"
-        )
+          start_command = (
+              f"{QEMU}/bin/qemu-kvm -m 1024"
+              + f" -drive file={disk_image},if=virtio,werror=report"
+              + vlan_net
+              + metadata_net
+              + " $QEMU_OPTS"
+          )
 
-        return create_machine(start_command), metadata_dir
+          return create_machine(start_command), metadata_dir
 
-    def test_userdata_decompression(machine, user_data_path, compressed_data, format_name):
-        """Test that compressed user-data is decompressed by fetch-ec2-metadata"""
-        test_marker = f"{format_name}-decompression-test"
-        with open(user_data_path, "wb") as f:
-            f.write(compressed_data)
-        machine.succeed("systemctl reset-failed fetch-ec2-metadata; systemctl restart fetch-ec2-metadata")
-        result = machine.succeed("cat /etc/ec2-metadata/user-data")
-        assert test_marker in result, f"Expected '{test_marker}' in decompressed {format_name} content, got: {result}"
-        journal = machine.succeed("journalctl -u fetch-ec2-metadata --no-pager -b")
-        assert "decompressing:" in journal, f"Expected decompression log in journal for {format_name}"
+      def test_userdata_decompression(machine, user_data_path, compressed_data, format_name):
+          """Test that compressed user-data is decompressed by fetch-ec2-metadata"""
+          test_marker = f"{format_name}-decompression-test"
+          with open(user_data_path, "wb") as f:
+              f.write(compressed_data)
+          machine.succeed("systemctl reset-failed fetch-ec2-metadata; systemctl restart fetch-ec2-metadata")
+          result = machine.succeed("cat /etc/ec2-metadata/user-data")
+          assert test_marker in result, f"Expected '{test_marker}' in decompressed {format_name} content, got: {result}"
+          journal = machine.succeed("journalctl -u fetch-ec2-metadata --no-pager -b")
+          assert "decompressing:" in journal, f"Expected decompression log in journal for {format_name}"
 
-    # Create temporary directory for metadata (scoped for cleanup)
-    temp_dir = tempfile.TemporaryDirectory()
+      # Create temporary directory for metadata (scoped for cleanup)
+      temp_dir = tempfile.TemporaryDirectory()
 
-    # Start client first (but don't wait for it to boot)
-    client.start()
+      # Start client first (but don't wait for it to boot)
+      client.start()
 
-    # Generate SSH key pair on VM host before starting machine
-    client_pubkey, client_private_key = generate_client_ssh_key()
+      # Generate SSH key pair on VM host before starting machine
+      client_pubkey, client_private_key = generate_client_ssh_key()
 
-    # Set up machine with client's public key in metadata service
-    machine, metadata_dir = setup_machine(temp_dir, client_pubkey)
-    user_data_path = os.path.join(metadata_dir, "1.0", "user-data")
+      # Set up machine with client's public key in metadata service
+      machine, metadata_dir = setup_machine(temp_dir, client_pubkey)
+      user_data_path = os.path.join(metadata_dir, "1.0", "user-data")
 
-    try:
-        machine.start()
+      try:
+          machine.start()
 
-        # Wait for services to be ready
-        machine.wait_for_unit("sshd.service")
-        machine.wait_for_unit("print-host-key.service")
-        machine.wait_for_unit("apply-ec2-data.service")
+          # Wait for services to be ready
+          machine.wait_for_unit("sshd.service")
+          machine.wait_for_unit("print-host-key.service")
+          machine.wait_for_unit("apply-ec2-data.service")
 
-        # Extract shared variables outside subtests
-        machine_ip = "${config.nodes.machine.networking.primaryIPAddress}"
+          # Extract shared variables outside subtests
+          machine_ip = "${config.nodes.machine.networking.primaryIPAddress}"
 
-        with subtest("EC2 metadata service connectivity"):
-            # Obtain an IMDSv2 token, then use it to fetch metadata
-            imds_token = machine.succeed(
-                "curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'"
-                " http://169.254.169.254/latest/api/token"
-            ).strip()
-            assert imds_token, "Failed to obtain IMDSv2 token"
-            hostname_response = machine.succeed(
-                f"curl -sf -H 'X-aws-ec2-metadata-token: {imds_token}'"
-                " http://169.254.169.254/1.0/meta-data/hostname"
-            )
-            assert "test-instance" in hostname_response, f"Expected 'test-instance', got: {hostname_response}"
+          with subtest("EC2 metadata service connectivity"):
+              # Obtain an IMDSv2 token, then use it to fetch metadata
+              imds_token = machine.succeed(
+                  "curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'"
+                  " http://169.254.169.254/latest/api/token"
+              ).strip()
+              assert imds_token, "Failed to obtain IMDSv2 token"
+              hostname_response = machine.succeed(
+                  f"curl -sf -H 'X-aws-ec2-metadata-token: {imds_token}'"
+                  " http://169.254.169.254/1.0/meta-data/hostname"
+              )
+              assert "test-instance" in hostname_response, f"Expected 'test-instance', got: {hostname_response}"
 
-        with subtest("SSH host key extraction from console"):
-            console_log = machine.get_console_log()
-            assert "-----BEGIN SSH HOST KEY FINGERPRINTS-----" in console_log
-            assert "-----END SSH HOST KEY FINGERPRINTS-----" in console_log
-            assert "-----BEGIN SSH HOST KEY KEYS-----" in console_log
-            assert "-----END SSH HOST KEY KEYS-----" in console_log
+          with subtest("SSH host key extraction from console"):
+              console_log = machine.get_console_log()
+              assert "-----BEGIN SSH HOST KEY FINGERPRINTS-----" in console_log
+              assert "-----END SSH HOST KEY FINGERPRINTS-----" in console_log
+              assert "-----BEGIN SSH HOST KEY KEYS-----" in console_log
+              assert "-----END SSH HOST KEY KEYS-----" in console_log
 
-            keys_pattern = r"-----BEGIN SSH HOST KEY KEYS-----(.*?)-----END SSH HOST KEY KEYS-----"
-            keys_match = re.search(keys_pattern, console_log, re.DOTALL)
-            assert keys_match, "Could not find SSH host keys section"
-            keys_content = keys_match.group(1).strip()
-            assert "ssh-" in keys_content, "SSH keys should contain ssh- prefix"
+              keys_pattern = r"-----BEGIN SSH HOST KEY KEYS-----(.*?)-----END SSH HOST KEY KEYS-----"
+              keys_match = re.search(keys_pattern, console_log, re.DOTALL)
+              assert keys_match, "Could not find SSH host keys section"
+              keys_content = keys_match.group(1).strip()
+              assert "ssh-" in keys_content, "SSH keys should contain ssh- prefix"
 
-        with subtest("Network connectivity"):
-            client.succeed(f"ping -c 1 {machine_ip}")
+          with subtest("Network connectivity"):
+              client.succeed(f"ping -c 1 {machine_ip}")
 
-        with subtest("SSH connectivity with strict host key checking"):
-            # Install the pre-generated private key on client
-            setup_client_ssh_key(client, client_private_key)
+          with subtest("SSH connectivity with strict host key checking"):
+              # Install the pre-generated private key on client
+              setup_client_ssh_key(client, client_private_key)
 
-            # Get console log and extract host keys
-            console_log = machine.get_console_log()
-            keys_pattern = r"-----BEGIN SSH HOST KEY KEYS-----(.*?)-----END SSH HOST KEY KEYS-----"
-            keys_match = re.search(keys_pattern, console_log, re.DOTALL)
-            assert keys_match, "Could not find SSH host keys section"
+              # Get console log and extract host keys
+              console_log = machine.get_console_log()
+              keys_pattern = r"-----BEGIN SSH HOST KEY KEYS-----(.*?)-----END SSH HOST KEY KEYS-----"
+              keys_match = re.search(keys_pattern, console_log, re.DOTALL)
+              assert keys_match, "Could not find SSH host keys section"
 
-            # Create known_hosts file from console-extracted host keys
-            keys_content = keys_match.group(1).strip()
-            known_hosts_entries = []
-            for line in keys_content.split('\n'):
-                if line.strip() and line.startswith('ssh-'):
-                    known_hosts_entries.append(f"{machine_ip} {line.strip()}")
+              # Create known_hosts file from console-extracted host keys
+              keys_content = keys_match.group(1).strip()
+              known_hosts_entries = []
+              for line in keys_content.split('\n'):
+                  if line.strip() and line.startswith('ssh-'):
+                      known_hosts_entries.append(f"{machine_ip} {line.strip()}")
 
-            assert known_hosts_entries, "No SSH host keys found for known_hosts generation"
+              assert known_hosts_entries, "No SSH host keys found for known_hosts generation"
 
-            known_hosts_content = '\n'.join(known_hosts_entries)
-            client.succeed(f"cat > /root/.ssh/known_hosts << 'EOF'\n{known_hosts_content}\nEOF")
+              known_hosts_content = '\n'.join(known_hosts_entries)
+              client.succeed(f"cat > /root/.ssh/known_hosts << 'EOF'\n{known_hosts_content}\nEOF")
 
-            # Test SSH connectivity with strict host key checking
-            ssh_result = client.succeed(f"ssh -o ConnectTimeout=60 -o BatchMode=yes -i /root/.ssh/id_ed25519 root@{machine_ip} 'echo Hello from $(hostname)'")
-            assert "Hello from test-instance" in ssh_result, f"Unexpected SSH result: {ssh_result}"
+              # Test SSH connectivity with strict host key checking
+              ssh_result = client.succeed(f"ssh -o ConnectTimeout=60 -o BatchMode=yes -i /root/.ssh/id_ed25519 root@{machine_ip} 'echo Hello from $(hostname)'")
+              assert "Hello from test-instance" in ssh_result, f"Unexpected SSH result: {ssh_result}"
 
-        with subtest("Basic EC2 functionality"):
-            machine.succeed("findmnt / -o SIZE -n | grep -E '[0-9]+G'")
+          with subtest("Basic EC2 functionality"):
+              machine.succeed("findmnt / -o SIZE -n | grep -E '[0-9]+G'")
 
-        with subtest("Decompression of gzip-compressed user-data"):
-            import gzip as gzip_mod
-            test_data = b"#!/bin/bash\necho gzip-decompression-test\n"
-            test_userdata_decompression(machine, user_data_path, gzip_mod.compress(test_data), "gzip")
+          with subtest("Decompression of gzip-compressed user-data"):
+              import gzip as gzip_mod
+              test_data = b"#!/bin/bash\necho gzip-decompression-test\n"
+              test_userdata_decompression(machine, user_data_path, gzip_mod.compress(test_data), "gzip")
 
-        with subtest("Decompression of bzip2-compressed user-data"):
-            import bz2
-            test_data = b"#!/bin/bash\necho bzip2-decompression-test\n"
-            test_userdata_decompression(machine, user_data_path, bz2.compress(test_data), "bzip2")
+          with subtest("Decompression of bzip2-compressed user-data"):
+              import bz2
+              test_data = b"#!/bin/bash\necho bzip2-decompression-test\n"
+              test_userdata_decompression(machine, user_data_path, bz2.compress(test_data), "bzip2")
 
-        with subtest("Decompression of xz-compressed user-data"):
-            import lzma
-            test_data = b"#!/bin/bash\necho xz-decompression-test\n"
-            test_userdata_decompression(machine, user_data_path, lzma.compress(test_data), "xz")
+          with subtest("Decompression of xz-compressed user-data"):
+              import lzma
+              test_data = b"#!/bin/bash\necho xz-decompression-test\n"
+              test_userdata_decompression(machine, user_data_path, lzma.compress(test_data), "xz")
 
-        with subtest("Decompression of zstd-compressed user-data"):
-            test_data = b"#!/bin/bash\necho zstd-decompression-test\n"
-            proc = subprocess.run(
-                ["${hostPkgs.zstd}/bin/zstd", "-c"],
-                input=test_data, capture_output=True, check=True,
-            )
-            test_userdata_decompression(machine, user_data_path, proc.stdout, "zstd")
+          with subtest("Decompression of zstd-compressed user-data"):
+              test_data = b"#!/bin/bash\necho zstd-decompression-test\n"
+              proc = subprocess.run(
+                  ["${hostPkgs.zstd}/bin/zstd", "-c"],
+                  input=test_data, capture_output=True, check=True,
+              )
+              test_userdata_decompression(machine, user_data_path, proc.stdout, "zstd")
 
-        with subtest("Decompression of lzip-compressed user-data"):
-            test_data = b"#!/bin/bash\necho lzip-decompression-test\n"
-            proc = subprocess.run(
-                ["${hostPkgs.lzip}/bin/lzip", "-c"],
-                input=test_data, capture_output=True, check=True,
-            )
-            test_userdata_decompression(machine, user_data_path, proc.stdout, "lzip")
+          with subtest("Decompression of lzip-compressed user-data"):
+              test_data = b"#!/bin/bash\necho lzip-decompression-test\n"
+              proc = subprocess.run(
+                  ["${hostPkgs.lzip}/bin/lzip", "-c"],
+                  input=test_data, capture_output=True, check=True,
+              )
+              test_userdata_decompression(machine, user_data_path, proc.stdout, "lzip")
 
-        with subtest("IPv6 IMDS fallback"):
-            # Save hostname fetched via IPv4 for later comparison
-            original_hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip()
+          with subtest("IPv6 IMDS fallback"):
+              # Save hostname fetched via IPv4 for later comparison
+              original_hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip()
 
-            # Assign the EC2 IPv6 IMDS address to loopback
-            machine.succeed("ip -6 addr add fd00:ec2::254/128 dev lo")
+              # Assign the EC2 IPv6 IMDS address to loopback
+              machine.succeed("ip -6 addr add fd00:ec2::254/128 dev lo")
 
-            # Create metadata directory structure for the IPv6 endpoint
-            machine.succeed(
-                "mkdir -p /tmp/ipv6-metadata/1.0/meta-data/public-keys/0"
-                " && mkdir -p /tmp/ipv6-metadata/latest/api"
-                " && cp /etc/ec2-metadata/hostname /tmp/ipv6-metadata/1.0/meta-data/hostname"
-                " && cp /etc/ec2-metadata/ami-manifest-path /tmp/ipv6-metadata/1.0/meta-data/ami-manifest-path"
-                " && echo i-1234567890abcdef0 > /tmp/ipv6-metadata/1.0/meta-data/instance-id"
-                " && echo ipv6-test-token > /tmp/ipv6-metadata/latest/api/token"
-                " && touch /tmp/ipv6-metadata/1.0/user-data"
-            )
-            machine.execute(
-                "test -f /etc/ec2-metadata/public-keys-0-openssh-key"
-                " && cp /etc/ec2-metadata/public-keys-0-openssh-key"
-                " /tmp/ipv6-metadata/1.0/meta-data/public-keys/0/openssh-key"
-            )
+              # Create metadata directory structure for the IPv6 endpoint
+              machine.succeed(
+                  "mkdir -p /tmp/ipv6-metadata/1.0/meta-data/public-keys/0"
+                  " && mkdir -p /tmp/ipv6-metadata/latest/api"
+                  " && cp /etc/ec2-metadata/hostname /tmp/ipv6-metadata/1.0/meta-data/hostname"
+                  " && cp /etc/ec2-metadata/ami-manifest-path /tmp/ipv6-metadata/1.0/meta-data/ami-manifest-path"
+                  " && echo i-1234567890abcdef0 > /tmp/ipv6-metadata/1.0/meta-data/instance-id"
+                  " && echo ipv6-test-token > /tmp/ipv6-metadata/latest/api/token"
+                  " && touch /tmp/ipv6-metadata/1.0/user-data"
+              )
+              machine.execute(
+                  "test -f /etc/ec2-metadata/public-keys-0-openssh-key"
+                  " && cp /etc/ec2-metadata/public-keys-0-openssh-key"
+                  " /tmp/ipv6-metadata/1.0/meta-data/public-keys/0/openssh-key"
+              )
 
-            # Serve metadata on the IPv6 IMDS address via socat + imds-server (inetd-style)
-            machine.succeed(
-                "systemd-run --unit=ipv6-imds --"
-                " socat TCP6-LISTEN:80,bind=[fd00:ec2::254],fork,reuseaddr"
-                " SYSTEM:'${lib.getExe imdsServer} /tmp/ipv6-metadata'"
-            )
+              # Serve metadata on the IPv6 IMDS address via socat + imds-server (inetd-style)
+              machine.succeed(
+                  "systemd-run --unit=ipv6-imds --"
+                  " socat TCP6-LISTEN:80,bind=[fd00:ec2::254],fork,reuseaddr"
+                  " SYSTEM:'${lib.getExe imdsServer} /tmp/ipv6-metadata'"
+              )
 
-            # Wait for IPv6 IMDS to become reachable (token endpoint doesn't require auth)
-            machine.wait_until_succeeds(
-                "curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'"
-                " http://[fd00:ec2::254]/latest/api/token"
-            )
+              # Wait for IPv6 IMDS to become reachable (token endpoint doesn't require auth)
+              machine.wait_until_succeeds(
+                  "curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'"
+                  " http://[fd00:ec2::254]/latest/api/token"
+              )
 
-            # Block IPv4 IMDS to force fallback to IPv6
-            machine.succeed(
-                "iptables -I OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT"
-            )
+              # Block IPv4 IMDS to force fallback to IPv6
+              machine.succeed(
+                  "iptables -I OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT"
+              )
 
-            # Verify IPv4 IMDS is now unreachable
-            machine.fail(
-                "curl -sf --connect-timeout 2 http://169.254.169.254/1.0/meta-data/hostname"
-            )
+              # Verify IPv4 IMDS is now unreachable
+              machine.fail(
+                  "curl -sf --connect-timeout 2 http://169.254.169.254/1.0/meta-data/hostname"
+              )
 
-            # Clear fetched metadata and re-run the fetcher
-            machine.succeed("rm -f /etc/ec2-metadata/*")
-            machine.succeed("systemctl restart fetch-ec2-metadata")
+              # Clear fetched metadata and re-run the fetcher
+              machine.succeed("rm -f /etc/ec2-metadata/*")
+              machine.succeed("systemctl restart fetch-ec2-metadata")
 
-            # Verify metadata was successfully re-fetched via IPv6
-            hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip()
-            assert hostname == original_hostname, f"Expected '{original_hostname}', got '{hostname}'"
+              # Verify metadata was successfully re-fetched via IPv6
+              hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip()
+              assert hostname == original_hostname, f"Expected '{original_hostname}', got '{hostname}'"
 
-            # Clean up: restore IPv4 IMDS access
-            machine.succeed(
-                "iptables -D OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT"
-            )
-            machine.succeed("systemctl stop ipv6-imds")
+              # Clean up: restore IPv4 IMDS access
+              machine.succeed(
+                  "iptables -D OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT"
+              )
+              machine.succeed("systemctl stop ipv6-imds")
 
-    finally:
-        machine.shutdown()
-        temp_dir.cleanup()
-  '';
+      finally:
+          machine.shutdown()
+          temp_dir.cleanup()
+    '';
 }
diff --git a/nixos/tests/systemd-initrd-simple.nix b/nixos/tests/systemd-initrd-simple.nix
index 191a23abb2e4..b02616e1b772 100644
--- a/nixos/tests/systemd-initrd-simple.nix
+++ b/nixos/tests/systemd-initrd-simple.nix
@@ -1,15 +1,15 @@
+{ pkgs, ... }:
 {
   name = "systemd-initrd-simple";
 
-  nodes.machine =
-    { pkgs, ... }:
-    {
-      testing.initrdBackdoor = true;
-      boot.initrd.systemd.enable = true;
-      virtualisation.fileSystems."/".autoResize = true;
-    };
+  nodes.machine = {
+    testing.initrdBackdoor = true;
+    boot.initrd.systemd.enable = true;
+    virtualisation.fileSystems."/".autoResize = true;
+  };
 
   testScript =
+    { nodes, ... }:
     # python
     ''
       import subprocess
@@ -43,7 +43,7 @@
           oldAvail = machine.succeed("df --output=avail / | sed 1d")
           machine.shutdown()
 
-          subprocess.check_call(["qemu-img", "resize", "vm-state-machine/machine.qcow2", "+1G"])
+          subprocess.check_call(["${nodes.machine.virtualisation.qemu.package}/bin/qemu-img", "resize", "vm-state-machine/machine.qcow2", "+1G"])
 
           machine.start()
           machine.switch_root()
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index d04b3a374570..3c467daf4ae7 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -38,21 +38,23 @@
       services.journald.extraConfig = "Storage=volatile";
       test-support.displayManager.auto.user = "alice";
 
-      systemd.shutdown.test = pkgs.writeScript "test.shutdown" ''
-        #!${pkgs.runtimeShell}
-        PATH=${
-          lib.makeBinPath (
-            with pkgs;
-            [
-              util-linux
-              coreutils
-            ]
-          )
-        }
-        mount -t 9p shared -o trans=virtio,version=9p2000.L /tmp/shared
-        touch /tmp/shared/shutdown-test
-        umount /tmp/shared
-      '';
+      systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/test".source =
+        pkgs.writeShellScript "test.shutdown" ''
+          PATH=${
+            lib.makeBinPath (
+              with pkgs;
+              [
+                util-linux
+                coreutils
+              ]
+            )
+          }
+          mkdir -p /tmp/shared
+          mount -t 9p shared -o trans=virtio,version=9p2000.L /tmp/shared
+          touch /tmp/shared/shutdown-test
+          umount /tmp/shared
+        '';
+      systemd.shutdownRamfs.storePaths = [ "${pkgs.util-linux}/bin" ];
 
       systemd.services.oncalendar-test = {
         description = "calendar test";
@@ -147,7 +149,7 @@
 
           subprocess.check_call(
               [
-                  "qemu-img",
+                  "${nodes.machine.virtualisation.qemu.package}/bin/qemu-img",
                   "convert",
                   "-O",
                   "raw",

From f173ec335533331f371e4bf83e06e393c013a5d8 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 31 May 2026 01:43:52 +0200
Subject: [PATCH 007/210] maintainers/README: fix wrong workflow reference

---
 maintainers/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/README.md b/maintainers/README.md
index 4c3e5cff9c2a..4959e6aa5892 100644
--- a/maintainers/README.md
+++ b/maintainers/README.md
@@ -160,7 +160,7 @@ Once approved, the team will have the right privileges to be pinged and requeste
 > [!TIP]
 > The team name should be as short as possible; because it is nested under the maintainers group, no -maintainers suffix is needed.
 
-After the first [weekly team sync](../.github/workflows/team-sync.yml) with the new team, it's then also possible to link it to the entry in `team-list.nix` by setting its `github` field to the GitHub team name.
+After the first [weekly team sync](../.github/workflows/teams.yml) with the new team, it's then also possible to link it to the entry in `team-list.nix` by setting its `github` field to the GitHub team name.
 
 # Maintainer scripts
 

From 279b129035e4e33765e84a1af44574c1a8e81eb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 12 Jun 2026 14:43:08 +0200
Subject: [PATCH 008/210] fetchPnpmDeps: remove redundant guard for
 pnpm-fixup-state-db override

---
 pkgs/build-support/node/fetch-pnpm-deps/default.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/build-support/node/fetch-pnpm-deps/default.nix b/pkgs/build-support/node/fetch-pnpm-deps/default.nix
index 4669d4909b7f..d83f06b5980e 100644
--- a/pkgs/build-support/node/fetch-pnpm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-pnpm-deps/default.nix
@@ -49,13 +49,9 @@ in
 
       filterFlags = lib.map (package: "--filter=${package}") pnpmWorkspaces;
 
-      pnpm-fixup-state-db' =
-        if pnpm.nodejs-slim or null != null then
-          pnpm-fixup-state-db.override {
-            inherit (pnpm) nodejs-slim;
-          }
-        else
-          pnpm-fixup-state-db;
+      pnpm-fixup-state-db' = pnpm-fixup-state-db.override {
+        inherit (pnpm) nodejs-slim;
+      };
     in
     assert
       fetcherVersion != null

From baf28478fc0be6d3f5b9f12a1d4eaa60786bd434 Mon Sep 17 00:00:00 2001
From: Jappie3 <jappie3+git@jappie.dev>
Date: Sat, 30 May 2026 20:14:57 +0200
Subject: [PATCH 009/210] nixos/dovecot: order non-attrs values first in
 rendered config

Co-authored-by: Katalin Rebhan <me@dblsaiko.net>
---
 nixos/modules/services/mail/dovecot.nix | 107 ++++++++++++++----------
 1 file changed, 61 insertions(+), 46 deletions(-)

diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index 2c00b3ee6529..48b0795c53c1 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -7,7 +7,6 @@
 
 let
   inherit (lib)
-    all
     attrsToList
     concatMapStringsSep
     concatStringsSep
@@ -19,7 +18,6 @@ let
     isBool
     isDerivation
     isInt
-    isList
     isPath
     isString
     listToAttrs
@@ -98,53 +96,67 @@ let
     i: n: v:
     "${i}${toString n} = ${v}";
 
-  formatKeyValue =
-    indent: n: v:
-    if (v == null) then
-      ""
-    else if isInt v then
-      toOption indent n (toString v)
+  isPrimitive = v: !isAttrs v || isDerivation v;
+
+  formatPrimitive =
+    v:
+    if isInt v then
+      toString v
     else if isBool v then
-      toOption indent n (yesOrNo v)
+      yesOrNo v
     else if isString v then
-      toOption indent n v
-    else if isList v then
-      if all isString v then
-        toOption indent n (concatStringsSep " " v)
-      else
-        map (formatKeyValue indent n) v
+      v
     else if isPath v || isDerivation v then
       # paths -> copy to store
       # derivations -> just use output path instead of looping over the attrs
-      toOption indent n "${v}"
-    else if isAttrs v && v ? _section then
-      let
-        sectionType = v._section.type;
-        sectionName = v._section.name;
-        sectionTitle = concatStringsSep " " (
-          filter (s: s != null) [
-            sectionType
-            sectionName
-          ]
-        );
-      in
-      concatStringsSep "\n" (
-        [
-          "${indent}${sectionTitle} {"
-        ]
-        ++ (mapAttrsToList (formatKeyValue "${indent}  ") (removeAttrs v [ "_section" ]))
-        ++ [ "${indent}}" ]
-      )
-    else if isAttrs v then
-      concatStringsSep "\n" (
-        [
-          "${indent}${n} {"
-        ]
-        ++ (mapAttrsToList (formatKeyValue "${indent}  ") v)
-        ++ [ "${indent}}" ]
-      )
+      "${v}"
     else
-      throw (traceSeq v "services.dovecot2.settings: unexpected type");
+      throw (traceSeq v "services.dovecot2.settings: unexpected primitive type");
+
+  formatSection =
+    indent: n: v:
+    let
+      sectionTitle =
+        if v ? _section then
+          concatStringsSep " " (
+            filter (s: s != null) [
+              v._section.type
+              v._section.name
+            ]
+          )
+        else
+          n;
+      inner = removeAttrs v [ "_section" ];
+    in
+    concatStringsSep "\n" (
+      [ "${indent}${sectionTitle} {" ]
+      ++ flatten (mapAttrsToList (primitiveLinesFor "${indent}  ") inner)
+      ++ flatten (mapAttrsToList (sectionLinesFor "${indent}  ") inner)
+      ++ [ "${indent}}" ]
+    );
+
+  # emit lines for a k=v pair only when the value is a primitive
+  primitiveLinesFor =
+    indent: n: v:
+    let
+      primitives = filter isPrimitive (flatten [ v ]);
+      hasOnlySections = primitives == [ ] && v != [ ];
+    in
+    # Only emit an empty list if the original entry was also an empty list.
+    # This is so that values like k = [{ ... }] will not produce an output
+    # here, but k = [] will, even though they result in the same
+    # primitives = [].
+    optional (!hasOnlySections && v != null) (
+      toOption indent n (concatMapStringsSep " " formatPrimitive primitives)
+    );
+
+  # emit lines for a k=v pair only when the value is *not* a primitive
+  sectionLinesFor =
+    indent: n: v:
+    let
+      sections = filter (e: !isPrimitive e) (flatten [ v ]);
+    in
+    map (e: formatSection indent n e) sections;
 
   doveConf =
     let
@@ -156,10 +168,13 @@ let
       ];
     in
     concatStringsSep "\n" (
-      optional (configVersion != null) (formatKeyValue "" "dovecot_config_version" configVersion)
-      ++ optional (storageVersion != null) (formatKeyValue "" "dovecot_storage_version" storageVersion)
+      optionals (configVersion != null) (primitiveLinesFor "" "dovecot_config_version" configVersion)
+      ++ optionals (storageVersion != null) (
+        primitiveLinesFor "" "dovecot_storage_version" storageVersion
+      )
       ++ optionals (cfg.includeFiles != [ ]) (map (f: "!include ${f}") cfg.includeFiles)
-      ++ flatten (mapAttrsToList (formatKeyValue "") remainingSettings)
+      ++ flatten (mapAttrsToList (primitiveLinesFor "") remainingSettings)
+      ++ flatten (mapAttrsToList (sectionLinesFor "") remainingSettings)
     );
 
   isPre24 = versionOlder cfg.package.version "2.4";

From fe14e362b27d99fade2c6b5db6f9fa81c3c1f2fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Fri, 12 Jun 2026 21:37:13 +0200
Subject: [PATCH 010/210] npm-groovy-lint: init at 17.0.5

---
 pkgs/by-name/np/npm-groovy-lint/package.nix | 46 +++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 pkgs/by-name/np/npm-groovy-lint/package.nix

diff --git a/pkgs/by-name/np/npm-groovy-lint/package.nix b/pkgs/by-name/np/npm-groovy-lint/package.nix
new file mode 100644
index 000000000000..62d3301f4f94
--- /dev/null
+++ b/pkgs/by-name/np/npm-groovy-lint/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  buildNpmPackage,
+  versionCheckHook,
+  jdk,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "npm-groovy-lint";
+  version = "17.0.5";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "nvuillam";
+    repo = "npm-groovy-lint";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Cq4SPOqR2mb2Foc1jlrA6B7qJBcmgLfcC84iTc4+tcw=";
+  };
+
+  npmDepsHash = "sha256-XGXiuqA0JmuFVretXDjWejV9HJAK6eWR9/LR3rUI99s=";
+
+  passthru.updateScript = nix-update-script { };
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [ jdk ])
+  ];
+
+  meta = {
+    description = "Lint, format and auto-fix your Groovy / Jenkinsfile / Gradle files using command line";
+    homepage = "https://github.com/nvuillam/npm-groovy-lint";
+    changelog = "https://github.com/nvuillam/npm-groovy-lint/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jlesquembre ];
+    mainProgram = "npm-groovy-lint";
+    platforms = lib.platforms.all;
+  };
+})

From 13934c6f63e2852e1be27684481ffc3011b278e0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 13 Jun 2026 18:47:09 +0000
Subject: [PATCH 011/210] starc: 0.8.0 -> 0.8.2

---
 pkgs/by-name/st/starc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/st/starc/package.nix b/pkgs/by-name/st/starc/package.nix
index 730a9fecc145..79f9fd30bf9e 100644
--- a/pkgs/by-name/st/starc/package.nix
+++ b/pkgs/by-name/st/starc/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "starc";
-  version = "0.8.0";
+  version = "0.8.2";
   src = fetchurl {
     url = "https://github.com/story-apps/starc/releases/download/v${version}/starc-setup.AppImage";
-    hash = "sha256-0lD2mpHslOGgvGG8edPqlhyNi9ewzSgN+Eaabbcs7CI=";
+    hash = "sha256-7uwc4gD+AlbYGMffaWj3v2Zt2x6P5edPXY3BsznBNdQ=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };

From f9050fe4485ccc81464dc476eb186c452c84bf94 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 14 Jun 2026 00:21:14 +0000
Subject: [PATCH 012/210] kube-state-metrics: 2.17.0 -> 2.19.1

---
 pkgs/by-name/ku/kube-state-metrics/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ku/kube-state-metrics/package.nix b/pkgs/by-name/ku/kube-state-metrics/package.nix
index bd470233ccab..49af926f291b 100644
--- a/pkgs/by-name/ku/kube-state-metrics/package.nix
+++ b/pkgs/by-name/ku/kube-state-metrics/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kube-state-metrics";
-  version = "2.17.0";
+  version = "2.19.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kube-state-metrics";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-w55FOWw9p7yV/bt4leZucOLqjVyHYFF+gVLWLGQKF9M=";
+    hash = "sha256-PZC3ZiVnChy7IdibZKB3IRv8+1AfmvAWY7RquwTcS1Y=";
   };
 
-  vendorHash = "sha256-pcoqeYyOehFNkwD4fWqrk9725BJkv+8sKy1NLv+HJPE=";
+  vendorHash = "sha256-vmmXEDzkv+ZQaKJ6++HpPHj2M9gaquonNjXG2DOlxwI=";
 
   excludedPackages = [
     "./tests/e2e"

From 9bee562b8c8a4dbd40bd4e063328db793a95a24f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 12:20:26 +0200
Subject: [PATCH 013/210] python3Packages.openinference-semantic-conventions:
 init at 0.1.30

OpenTelemetry Semantic Conventions for AI Observability

https://github.com/Arize-ai/openinference
---
 .../default.nix                               | 45 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 ++
 2 files changed, 49 insertions(+)
 create mode 100644 pkgs/development/python-modules/openinference-semantic-conventions/default.nix

diff --git a/pkgs/development/python-modules/openinference-semantic-conventions/default.nix b/pkgs/development/python-modules/openinference-semantic-conventions/default.nix
new file mode 100644
index 000000000000..a7a129cc1cc3
--- /dev/null
+++ b/pkgs/development/python-modules/openinference-semantic-conventions/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  nix-update-script,
+  pytest-asyncio,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "openinference-semantic-conventions";
+  version = "0.1.30";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Arize-ai";
+    repo = "openinference";
+    tag = "python-openinference-semantic-conventions-v${finalAttrs.version}";
+    hash = "sha256-MkgajZknHOw4/qra6uZ99rtpiylpHhOj8tDfLGUSU74=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/python/${finalAttrs.pname}";
+
+  build-system = [ hatchling ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "openinference.semconv" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "OpenTelemetry Semantic Conventions for AI Observability";
+    homepage = "https://github.com/Arize-ai/openinference";
+    changelog = "https://github.com/Arize-ai/openinference/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index cb255c8fb62c..d5037dbcb8db 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11834,6 +11834,10 @@ self: super: with self; {
     }
   );
 
+  openinference-semantic-conventions =
+    callPackage ../development/python-modules/openinference-semantic-conventions
+      { };
+
   openmm = toPythonModule (
     pkgs.openmm.override {
       python3Packages = self;

From e2a645256b873e9b302075e781e8a98e60f13eff Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 12:36:43 +0200
Subject: [PATCH 014/210] python3Packages.openinference-instrumentation: init
 at 0.1.53

OpenTelemetry Instrumentation for AI Observability

https://github.com/Arize-ai/openinference
---
 .../openinference-instrumentation/default.nix | 69 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 ++
 2 files changed, 73 insertions(+)
 create mode 100644 pkgs/development/python-modules/openinference-instrumentation/default.nix

diff --git a/pkgs/development/python-modules/openinference-instrumentation/default.nix b/pkgs/development/python-modules/openinference-instrumentation/default.nix
new file mode 100644
index 000000000000..6c2e2fbf3a3b
--- /dev/null
+++ b/pkgs/development/python-modules/openinference-instrumentation/default.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  jsonschema,
+  nix-update-script,
+  openai,
+  openinference-semantic-conventions,
+  opentelemetry-api,
+  opentelemetry-sdk,
+  pytest-asyncio,
+  pytest-vcr,
+  pytestCheckHook,
+  typing-extensions,
+  wrapt,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "openinference-instrumentation";
+  version = "0.1.53";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Arize-ai";
+    repo = "openinference";
+    tag = "python-openinference-instrumentation-v${finalAttrs.version}";
+    hash = "sha256-1FzAiO3Vxt2o9YCzwPfHOn4hwvOLDt9Luv3zQTJ6J2Q=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/python/${finalAttrs.pname}";
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    opentelemetry-api
+    opentelemetry-sdk
+    openinference-semantic-conventions
+    typing-extensions
+    wrapt
+  ];
+
+  nativeCheckInputs = [
+    jsonschema
+    openai
+    pytest-asyncio
+    pytest-vcr
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "openinference.instrumentation" ];
+
+  disabledTests = [
+    # Tests want to connect to OpenAI's API
+    "TestTracerLLMDecorator"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "OpenTelemetry Instrumentation for AI Observability";
+    homepage = "https://github.com/Arize-ai/openinference";
+    changelog = "https://github.com/Arize-ai/openinference/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d5037dbcb8db..4f2035834d92 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11834,6 +11834,10 @@ self: super: with self; {
     }
   );
 
+  openinference-instrumentation =
+    callPackage ../development/python-modules/openinference-instrumentation
+      { };
+
   openinference-semantic-conventions =
     callPackage ../development/python-modules/openinference-semantic-conventions
       { };

From 0598a8aa02bcb84789a18bdcbe842f47c6d66153 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 12:58:30 +0200
Subject: [PATCH 015/210] 
 python3Packages.openinference-instrumentation-claude-agent-sdk: init at 0.1.6

OpenInference Claude Agent SDK Instrumentation

https://github.com/Arize-ai/openinference
---
 .../default.nix                               | 74 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 +
 2 files changed, 78 insertions(+)
 create mode 100644 pkgs/development/python-modules/openinference-instrumentation-claude-agent-sdk/default.nix

diff --git a/pkgs/development/python-modules/openinference-instrumentation-claude-agent-sdk/default.nix b/pkgs/development/python-modules/openinference-instrumentation-claude-agent-sdk/default.nix
new file mode 100644
index 000000000000..e65aeb508cb3
--- /dev/null
+++ b/pkgs/development/python-modules/openinference-instrumentation-claude-agent-sdk/default.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  buildPythonPackage,
+  claude-agent-sdk,
+  fetchFromGitHub,
+  hatchling,
+  nix-update-script,
+  openinference-instrumentation,
+  openinference-semantic-conventions,
+  opentelemetry-api,
+  opentelemetry-instrumentation,
+  opentelemetry-semantic-conventions,
+  pytest-asyncio,
+  pytest-timeout,
+  pytestCheckHook,
+  pyyaml,
+  sniffio,
+  typing-extensions,
+  wrapt,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "openinference-instrumentation-claude-agent-sdk";
+  version = "0.1.6";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Arize-ai";
+    repo = "openinference";
+    tag = "python-openinference-instrumentation-claude-agent-sdk-v${finalAttrs.version}";
+    hash = "sha256-wmwqmN/rN521TaXVZfkaRzHPVhANSgKaBVc4rhXgIII=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/python/instrumentation/${finalAttrs.pname}";
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    opentelemetry-api
+    opentelemetry-instrumentation
+    opentelemetry-semantic-conventions
+    openinference-semantic-conventions
+    openinference-instrumentation
+    typing-extensions
+    wrapt
+  ];
+
+  optional-dependencies = {
+    instruments = [ claude-agent-sdk ];
+  };
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-timeout
+    pytestCheckHook
+    pyyaml
+    sniffio
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
+
+  pythonImportsCheck = [ "openinference.instrumentation.claude_agent_sdk" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "OpenInference Claude Agent SDK Instrumentation";
+    homepage = "https://github.com/Arize-ai/openinference";
+    changelog = "https://github.com/Arize-ai/openinference/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4f2035834d92..0e51df8e5721 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11838,6 +11838,10 @@ self: super: with self; {
     callPackage ../development/python-modules/openinference-instrumentation
       { };
 
+  openinference-instrumentation-claude-agent-sdk =
+    callPackage ../development/python-modules/openinference-instrumentation-claude-agent-sdk
+      { };
+
   openinference-semantic-conventions =
     callPackage ../development/python-modules/openinference-semantic-conventions
       { };

From 57d97b59acd9d63e44b2f9466fe2834b3ecc9738 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 13:11:51 +0200
Subject: [PATCH 016/210] python3Packages.openinference-instrumentation-openai:
 init at 0.1.52

OpenInference OpenAI SDK Instrumentation

https://github.com/Arize-ai/openinference
---
 .../default.nix                               | 84 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 +
 2 files changed, 88 insertions(+)
 create mode 100644 pkgs/development/python-modules/openinference-instrumentation-openai/default.nix

diff --git a/pkgs/development/python-modules/openinference-instrumentation-openai/default.nix b/pkgs/development/python-modules/openinference-instrumentation-openai/default.nix
new file mode 100644
index 000000000000..31a804841153
--- /dev/null
+++ b/pkgs/development/python-modules/openinference-instrumentation-openai/default.nix
@@ -0,0 +1,84 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  httpx,
+  nix-update-script,
+  openai,
+  openinference-instrumentation,
+  openinference-semantic-conventions,
+  opentelemetry-api,
+  opentelemetry-instrumentation-httpx,
+  opentelemetry-instrumentation,
+  opentelemetry-semantic-conventions,
+  pytest-asyncio,
+  pytest-vcr,
+  pytestCheckHook,
+  respx,
+  typing-extensions,
+  wrapt,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "openinference-instrumentation-openai";
+  version = "0.1.52";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Arize-ai";
+    repo = "openinference";
+    tag = "python-openinference-instrumentation-openai-v${finalAttrs.version}";
+    hash = "sha256-wmwqmN/rN521TaXVZfkaRzHPVhANSgKaBVc4rhXgIII=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/python/instrumentation/${finalAttrs.pname}";
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    opentelemetry-api
+    opentelemetry-instrumentation
+    opentelemetry-semantic-conventions
+    openinference-semantic-conventions
+    openinference-instrumentation
+    typing-extensions
+    wrapt
+  ];
+
+  optional-dependencies = {
+    instruments = [ openai ];
+  };
+
+  nativeCheckInputs = [
+    httpx
+    opentelemetry-instrumentation-httpx
+    pytest-asyncio
+    pytest-vcr
+    pytestCheckHook
+    respx
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
+
+  pythonImportsCheck = [ "openinference.instrumentation.openai" ];
+
+  disabledTests = [
+    # Tests want to connect to OpenAI's API
+    "test_cached_tokens"
+    "test_input_value"
+    "test_openai"
+    "test_tool_calls"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "OpenInference OpenAI SDK Instrumentation";
+    homepage = "https://github.com/Arize-ai/openinference";
+    changelog = "https://github.com/Arize-ai/openinference/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0e51df8e5721..eac8d943c031 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11842,6 +11842,10 @@ self: super: with self; {
     callPackage ../development/python-modules/openinference-instrumentation-claude-agent-sdk
       { };
 
+  openinference-instrumentation-openai =
+    callPackage ../development/python-modules/openinference-instrumentation-openai
+      { };
+
   openinference-semantic-conventions =
     callPackage ../development/python-modules/openinference-semantic-conventions
       { };

From 61e5bd15206c2e5d5d5b52d519fddf196d01d6c2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 17 Jun 2026 01:34:26 +0000
Subject: [PATCH 017/210] scotch: 7.0.11 -> 7.0.12

---
 pkgs/by-name/sc/scotch/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sc/scotch/package.nix b/pkgs/by-name/sc/scotch/package.nix
index 732e70d4dc78..f43b6e8319ba 100644
--- a/pkgs/by-name/sc/scotch/package.nix
+++ b/pkgs/by-name/sc/scotch/package.nix
@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "scotch";
-  version = "7.0.11";
+  version = "7.0.12";
 
   src = fetchFromGitLab {
     domain = "gitlab.inria.fr";
     owner = "scotch";
     repo = "scotch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ljz4Xu3ztxhx8c+gRYABG85T9SuauQc4UsVHPmREvkk=";
+    hash = "sha256-DE0VCGCSOOeSRIz/LQPCBNSBTNmXQtYAUKm3EeqnDBs=";
   };
 
   outputs = [

From e1fb35edd8467ff66083c9584bb9c69ec2c8380b Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Fri, 19 Jun 2026 21:39:25 +0200
Subject: [PATCH 018/210] maintainers: drop mikefaille

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 maintainers/maintainer-list.nix                      | 6 ------
 pkgs/by-name/kp/kpt/package.nix                      | 2 +-
 pkgs/by-name/ta/tanka/package.nix                    | 2 +-
 pkgs/development/python-modules/yamllint/default.nix | 2 +-
 4 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 387eb191a342..3a55893d1914 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -18066,12 +18066,6 @@
     githubId = 14096356;
     name = "Michael McLeod";
   };
-  mikefaille = {
-    email = "michael@faille.io";
-    github = "mikefaille";
-    githubId = 978196;
-    name = "Michaël Faille";
-  };
   mikehorn = {
     email = "mikehornproton@proton.me";
     github = "MikeHorn-git";
diff --git a/pkgs/by-name/kp/kpt/package.nix b/pkgs/by-name/kp/kpt/package.nix
index 810963745070..a4a30e4e3057 100644
--- a/pkgs/by-name/kp/kpt/package.nix
+++ b/pkgs/by-name/kp/kpt/package.nix
@@ -30,6 +30,6 @@ buildGoModule (finalAttrs: {
     mainProgram = "kpt";
     homepage = "https://github.com/kptdev/kpt";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ mikefaille ];
+    maintainers = [ ];
   };
 })
diff --git a/pkgs/by-name/ta/tanka/package.nix b/pkgs/by-name/ta/tanka/package.nix
index 80f503d30b5e..544dbe836804 100644
--- a/pkgs/by-name/ta/tanka/package.nix
+++ b/pkgs/by-name/ta/tanka/package.nix
@@ -65,7 +65,7 @@ buildGoModule (finalAttrs: {
     description = "Flexible, reusable and concise configuration for Kubernetes";
     homepage = "https://tanka.dev";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ mikefaille ];
+    maintainers = [ ];
     mainProgram = "tk";
   };
 })
diff --git a/pkgs/development/python-modules/yamllint/default.nix b/pkgs/development/python-modules/yamllint/default.nix
index 1f427196c9f8..89e05ca361b1 100644
--- a/pkgs/development/python-modules/yamllint/default.nix
+++ b/pkgs/development/python-modules/yamllint/default.nix
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/adrienverge/yamllint";
     changelog = "https://github.com/adrienverge/yamllint/blob/${src.tag}/CHANGELOG.rst";
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ mikefaille ];
+    maintainers = [ ];
     mainProgram = "yamllint";
   };
 }

From ae057ea14d2eb0bb54ddcb3d68cda0eb124aa4d5 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Sat, 20 Jun 2026 15:29:13 +0200
Subject: [PATCH 019/210] ayatana-indicator-power: Switch to lomiri-qt6 attrset

Doesn't use Qt, so would-be no-op (cmake-extras includes paths to Qt, so still a rebuild).
---
 pkgs/by-name/ay/ayatana-indicator-power/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ay/ayatana-indicator-power/package.nix b/pkgs/by-name/ay/ayatana-indicator-power/package.nix
index 23ba8bfe7669..b1aa6fed05fa 100644
--- a/pkgs/by-name/ay/ayatana-indicator-power/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-power/package.nix
@@ -13,7 +13,7 @@
   libayatana-common,
   libnotify,
   librda,
-  lomiri,
+  lomiri-qt6,
   pkg-config,
   python3,
   systemd,
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Path needed for build-time codegen
     substituteInPlace src/CMakeLists.txt \
-      --replace-fail '/usr/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml' '${lomiri.lomiri-schemas}/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml'
+      --replace-fail '/usr/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml' '${lomiri-qt6.lomiri-schemas}/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml'
   '';
 
   strictDeps = true;
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     librda
     systemd
   ]
-  ++ (with lomiri; [
+  ++ (with lomiri-qt6; [
     cmake-extras
     deviceinfo
     lomiri-schemas

From de520665f651a49ac6c56c831c1ba9fc6255aa63 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sat, 20 Jun 2026 22:00:47 +0200
Subject: [PATCH 020/210] maintainers: remove hypersw

---
 maintainers/maintainer-list.nix   | 6 ------
 pkgs/by-name/fa/far2l/package.nix | 5 +----
 2 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3b887d7d83a8..1c9153232716 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11245,12 +11245,6 @@
     github = "hxtmdev";
     githubId = 7771007;
   };
-  hypersw = {
-    email = "baltic@hypersw.net";
-    github = "hypersw";
-    githubId = 2332070;
-    name = "Serge Baltic";
-  };
   hythera = {
     name = "Hythera";
     github = "Hythera";
diff --git a/pkgs/by-name/fa/far2l/package.nix b/pkgs/by-name/fa/far2l/package.nix
index ab3e3d2f5c9d..46f795747645 100644
--- a/pkgs/by-name/fa/far2l/package.nix
+++ b/pkgs/by-name/fa/far2l/package.nix
@@ -130,10 +130,7 @@ stdenv.mkDerivation rec {
     description = "Linux port of FAR Manager v2, a program for managing files and archives in Windows operating systems";
     homepage = "https://github.com/elfmz/far2l";
     license = lib.licenses.gpl2Only;
-    maintainers = with lib.maintainers; [
-      hypersw
-      smakarov
-    ];
+    maintainers = with lib.maintainers; [ smakarov ];
     platforms = lib.platforms.unix;
   };
 }

From 3069c6b6bf13c6c6137ac9623b828f6c50bc9d15 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Sat, 20 Jun 2026 22:50:05 +0200
Subject: [PATCH 021/210] ayatana-indicator-session: Switch to lomiri-qt6
 attrset

Doesn't use Qt, so would-be no-op (cmake-extras includes paths to Qt, so still a rebuild).
---
 pkgs/by-name/ay/ayatana-indicator-session/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ay/ayatana-indicator-session/package.nix b/pkgs/by-name/ay/ayatana-indicator-session/package.nix
index f9e4f847e630..9b48ca33f5a9 100644
--- a/pkgs/by-name/ay/ayatana-indicator-session/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-session/package.nix
@@ -13,7 +13,7 @@
   intltool,
   libayatana-common,
   librda,
-  lomiri,
+  lomiri-qt6,
   mate-settings-daemon,
   pkg-config,
   systemd,
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    lomiri.cmake-extras
+    lomiri-qt6.cmake-extras
     glib
     gsettings-desktop-schemas
     libayatana-common

From 0d29f8773c9c9e6e64cd3aab6220d24671693ad2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 20 Jun 2026 22:24:56 +0000
Subject: [PATCH 022/210] freelens-bin: 1.9.0 -> 1.10.1

---
 pkgs/by-name/fr/freelens-bin/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/fr/freelens-bin/package.nix b/pkgs/by-name/fr/freelens-bin/package.nix
index e35f6a48994a..19f61da6d001 100644
--- a/pkgs/by-name/fr/freelens-bin/package.nix
+++ b/pkgs/by-name/fr/freelens-bin/package.nix
@@ -16,24 +16,24 @@
 let
 
   pname = "freelens-bin";
-  version = "1.9.0";
+  version = "1.10.1";
 
   sources = {
     x86_64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-amd64.AppImage";
-      hash = "sha256-aM3sS87kpb9UhVMdG7cPeCp4j9KBW71H+MJR+oN4908=";
+      hash = "sha256-Hbu28vbgaSEjJTAVSfHJ3cZGd2PRU0ex7dNv0wo1SrI=";
     };
     aarch64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-arm64.AppImage";
-      hash = "sha256-/DUMuGAhVV0Ro4UbAF6lwjgB4/Wi1AY2UKn9ZuN7fDc=";
+      hash = "sha256-JrApeOjMXNNi/wCq6vY6rYpPGgMWti0H+2i7QNEXaTc=";
     };
     x86_64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-amd64.dmg";
-      hash = "sha256-xKH/RBR2if37WiquCC+ZSxGyoFF32iIPvYdGNfDbDFw=";
+      hash = "sha256-BIBEaQFny/DvzrvsC38UPiIqBFaxUO/DOVQTIe2gL+Q=";
     };
     aarch64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-arm64.dmg";
-      hash = "sha256-dp/kD6NHmK/CNZEF2BKh6NAChBTMgjZLY7eIwhyWgWk=";
+      hash = "sha256-5duswriuDmL92tXqLckBhH2RMPFDqFRG/WW9oYMClGY=";
     };
   };
 

From de48634a6e7a6212ce13cd52c8429029b2f1ff07 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 21 Jun 2026 21:08:44 +0000
Subject: [PATCH 023/210] python3Packages.flash-linear-attention: 0.5.0 ->
 0.5.1

---
 .../python-modules/flash-linear-attention/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/flash-linear-attention/default.nix b/pkgs/development/python-modules/flash-linear-attention/default.nix
index 9cce12efe716..14fd32763b38 100644
--- a/pkgs/development/python-modules/flash-linear-attention/default.nix
+++ b/pkgs/development/python-modules/flash-linear-attention/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "flash-linear-attention";
-  version = "0.5.0";
+  version = "0.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
     owner = "fla-org";
     repo = "flash-linear-attention";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-g66yGHaBwEyjb+of76tKTtV/7as/2xQuqcjbGs4E3rU=";
+    hash = "sha256-vxNbZ+FkxJh2E0TF09Z7ghkm8eas7Q96heeSXwgV4uU=";
   };
 
   build-system = [ setuptools ];

From 863f7dcbf5bb42e29e2cad2872d36f837f2066e6 Mon Sep 17 00:00:00 2001
From: tgi74000 <tgi74@hotmail.fr>
Date: Mon, 22 Jun 2026 18:09:24 +0200
Subject: [PATCH 024/210] bellepoule: 5.5 -> 5.7

---
 pkgs/by-name/be/bellepoule/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/be/bellepoule/package.nix b/pkgs/by-name/be/bellepoule/package.nix
index 5b8384bce711..61158f446e37 100644
--- a/pkgs/by-name/be/bellepoule/package.nix
+++ b/pkgs/by-name/be/bellepoule/package.nix
@@ -19,13 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bellepoule";
-  version = "5.5";
+  version = "5.7";
 
   src =
     (fetchgit {
       url = "https://git.launchpad.net/bellepoule";
-      rev = finalAttrs.version;
-      hash = "sha256-SNL6yaaKk/GU8+EvHki4ysMuCHEQxFjPd3iwVIdJtCs=";
+      # No tag available on launchpad for this version
+      rev = "06516d698fde9662d95cf6a8758eb1fbcc89e983";
+      hash = "sha256-9bbFzi9JPryJK2zv4O1TUDaeoB9GVV7LRNn6Xl8lajg=";
     }).overrideAttrs
       (oldAttrs: {
         env = oldAttrs.env or { } // {

From 7182dffae30e1fc8f1e96c673da61a3451116eb5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 17:02:15 +0000
Subject: [PATCH 025/210] unityhub: 3.18.2 -> 3.18.3

---
 pkgs/by-name/un/unityhub/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unityhub/package.nix b/pkgs/by-name/un/unityhub/package.nix
index d183faafb7a6..ce2ce84f0844 100644
--- a/pkgs/by-name/un/unityhub/package.nix
+++ b/pkgs/by-name/un/unityhub/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.18.2";
+  version = "3.18.3";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb";
-    hash = "sha256-4sluuD2g70X98N6Pk9lpC//IFpePpHZf/mowDbh0S8g=";
+    hash = "sha256-6Gjik6zIQMYoAr8jmMp3X6+Xu5fdcbh2Exd8eToSbto=";
   };
 
   nativeBuildInputs = [

From 3025302a0067b78da605263f6dfe7d264e97d8cd Mon Sep 17 00:00:00 2001
From: Grayson Tinker <graysontinker@gmail.com>
Date: Mon, 22 Jun 2026 12:29:22 -0700
Subject: [PATCH 026/210] buildNimPackage: enable structuredAttrs by default

---
 pkgs/build-support/build-nim-package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/build-support/build-nim-package.nix b/pkgs/build-support/build-nim-package.nix
index 1e8489212cd6..ade88ea9d3db 100644
--- a/pkgs/build-support/build-nim-package.nix
+++ b/pkgs/build-support/build-nim-package.nix
@@ -15,6 +15,7 @@ let
   baseAttrs = {
     strictDeps = true;
     enableParallelBuilding = true;
+    __structuredAttrs = true;
     doCheck = true;
     configurePhase = ''
       runHook preConfigure

From 3fda0e37872c6ace46600373c94a774b51229ede Mon Sep 17 00:00:00 2001
From: Grayson Tinker <graysontinker@gmail.com>
Date: Mon, 22 Jun 2026 12:30:16 -0700
Subject: [PATCH 027/210] snekim: remove unnecessary strictDeps

This is automatically enabled by buildNimPackage
---
 pkgs/by-name/sn/snekim/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/sn/snekim/package.nix b/pkgs/by-name/sn/snekim/package.nix
index 8deefd7515d2..73a375ebc484 100644
--- a/pkgs/by-name/sn/snekim/package.nix
+++ b/pkgs/by-name/sn/snekim/package.nix
@@ -15,7 +15,6 @@ buildNimPackage (finalAttrs: {
     hash = "sha256-Qgvq4CkGvNppYFpITCCifOHtVQYRQJPEK3rTJXQkTvI=";
   };
 
-  strictDeps = true;
   lockFile = ./lock.json;
 
   nimFlags = [ "-d:nimraylib_now_shared" ];

From e229323c6dddd5c8d931574b8e950a87f27c0565 Mon Sep 17 00:00:00 2001
From: Grayson Tinker <graysontinker@gmail.com>
Date: Mon, 22 Jun 2026 13:29:12 -0700
Subject: [PATCH 028/210] auto-editor: fix tests with structuredAttrs

---
 pkgs/by-name/au/auto-editor/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/au/auto-editor/package.nix b/pkgs/by-name/au/auto-editor/package.nix
index 2d66a987d949..e260967f09ce 100644
--- a/pkgs/by-name/au/auto-editor/package.nix
+++ b/pkgs/by-name/au/auto-editor/package.nix
@@ -54,6 +54,8 @@ buildNimPackage rec {
     # buildNimPackage hack
     substituteInPlace ae.nimble \
       --replace-fail '"main=auto-editor"' '"main"'
+
+    mv tests/unit.nim tests/tunit.nim # buildNimPackage expects tests to start with t
   '';
 
   nativeCheckInputs = [
@@ -64,7 +66,7 @@ buildNimPackage rec {
   checkPhase = ''
     runHook preCheck
 
-    eval "nim r --nimcache:$NIX_BUILD_TOP/nimcache $nimFlags $src/tests/unit.nim"
+    nim_builder --phase:check
 
     substituteInPlace tests/test.py \
       --replace-fail '"./auto-editor"' "\"$out/bin/main\""

From e9e36f040322d2c081f79348885b383447809019 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 03:48:29 +0000
Subject: [PATCH 029/210] mongodb-ce: 8.2.7 -> 8.2.11

---
 pkgs/by-name/mo/mongodb-ce/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index 4fb2618f35b5..66b2d4306eaa 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mongodb-ce";
-  version = "8.2.7";
+  version = "8.2.11";
 
   src =
     finalAttrs.passthru.sources.${stdenv.hostPlatform.system}
@@ -53,19 +53,19 @@ stdenv.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2404-${finalAttrs.version}.tgz";
-        hash = "sha256-GYyWeVSoRXgrlQqx7R2chxH3+5S4ewbTefWJR9S2Frs=";
+        hash = "sha256-sqFkZ19eYZHQFwVX2zwaKaYXisvoqN25+8DFbyGU2H4=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://fastdl.mongodb.org/linux/mongodb-linux-aarch64-ubuntu2404-${finalAttrs.version}.tgz";
-        hash = "sha256-HTErVesWEWDjheedELdDOwlMrDvhV3JdVGtV3RuSeBI=";
+        hash = "sha256-5AX8pb1jInbQTuE0RqpqqcRXon6wKwdvoDCNDF70krE=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://fastdl.mongodb.org/osx/mongodb-macos-x86_64-${finalAttrs.version}.tgz";
-        hash = "sha256-DeD/v+NP2b8BTReV80+Lz0O9t6e3O9+52sJmTK5NtVY=";
+        hash = "sha256-BLIFrmToU8tFHdjAD+0q827cyeDHoYiXwtsds6e7NMA=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://fastdl.mongodb.org/osx/mongodb-macos-arm64-${finalAttrs.version}.tgz";
-        hash = "sha256-d8uulXczpq7ZEDmDsbb3o9kaZJ1IYzZ6MkgBLkNU4Mo=";
+        hash = "sha256-M3/x/d2rVKUmIZBQ9hVuT6W9ajZy/Ut5+8aDeXF+HwY=";
       };
     };
     updateScript =

From 83066c04f8f5928de8935151eec83670a9ef041d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 05:20:48 +0000
Subject: [PATCH 030/210] knossosnet: 1.3.7 -> 1.3.8

---
 pkgs/by-name/kn/knossosnet/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/kn/knossosnet/package.nix b/pkgs/by-name/kn/knossosnet/package.nix
index 96e16c05e9af..7e453fe191c9 100644
--- a/pkgs/by-name/kn/knossosnet/package.nix
+++ b/pkgs/by-name/kn/knossosnet/package.nix
@@ -11,13 +11,13 @@
 
 buildDotnetModule rec {
   pname = "knossosnet";
-  version = "1.3.7";
+  version = "1.3.8";
 
   src = fetchFromGitHub {
     owner = "KnossosNET";
     repo = "Knossos.NET";
     tag = "v${version}";
-    hash = "sha256-zUV+sQdQ71ORKOZzd4yxgRK1HjtZc9wgkmnzz6bG8FA=";
+    hash = "sha256-G/RSopDFn6ma5rXFkRth3NncbTVrVF6OqgqaJZl3EkE=";
   };
 
   patches = [ ./dotnet-8-upgrade.patch ];

From 47296edcc50d8d8bd1b7aca8eb5b8317f78272ff Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Tue, 23 Jun 2026 09:54:40 +0200
Subject: [PATCH 031/210] helm: fix i686-linux build

Replace a glibc-internal __sigemptyset call in the bundled FLAC code with the public sigemptyset function.

Closes #534469

Assisted-by: pi coding agent / Mika (OpenAI GPT-5.5)
---
 pkgs/by-name/he/helm/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/he/helm/package.nix b/pkgs/by-name/he/helm/package.nix
index 1d71ea4ee24a..ddc4d6eb4d59 100644
--- a/pkgs/by-name/he/helm/package.nix
+++ b/pkgs/by-name/he/helm/package.nix
@@ -70,6 +70,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     substituteInPlace src/common/load_save.cpp \
       --replace-fail "/usr/share/" "$out/share/"
+
+    substituteInPlace JUCE/modules/juce_audio_formats/codecs/flac/libFLAC/cpu.c \
+      --replace-fail "__sigemptyset(&sigill_sse.sa_mask);" "sigemptyset(&sigill_sse.sa_mask);"
   '';
 
   meta = {

From e74437b00ed74893c81835ec4358793b3f205c73 Mon Sep 17 00:00:00 2001
From: Luminar Leaf <80571430+LuminarLeaf@users.noreply.github.com>
Date: Tue, 23 Jun 2026 17:19:01 +0530
Subject: [PATCH 032/210] allmytoes: wrap for mime database

Signed-off-by: Luminar Leaf <80571430+LuminarLeaf@users.noreply.github.com>
---
 pkgs/by-name/al/allmytoes/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/al/allmytoes/package.nix b/pkgs/by-name/al/allmytoes/package.nix
index afe3ce8bfc12..6db99b1f0baf 100644
--- a/pkgs/by-name/al/allmytoes/package.nix
+++ b/pkgs/by-name/al/allmytoes/package.nix
@@ -2,6 +2,8 @@
   lib,
   nix-update-script,
   rustPlatform,
+  makeWrapper,
+  shared-mime-info,
   fetchFromGitLab,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -15,8 +17,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-BYKcDJN/uKESj0pnb2xvrx1lO6rOGdi+PVT6ywZqjbQ=";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
   cargoHash = "sha256-Pzbruv1E4mMohw//lf1JBoK+4BHDJVr4/9xXE4FrWbA==";
 
+  postInstall = ''
+    wrapProgram "$out/bin/allmytoes" --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
+  '';
+
   passthru.updateScript = nix-update-script { };
 
   __structuredAttrs = true;

From 3452a6a0a6067150c83bf7a87c3463f38bb9f6d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Mon, 22 Jun 2026 16:11:33 +0200
Subject: [PATCH 033/210] aws-ofi-nccl: init at 1.19.2

---
 pkgs/by-name/aw/aws-ofi-nccl/package.nix | 71 ++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 pkgs/by-name/aw/aws-ofi-nccl/package.nix

diff --git a/pkgs/by-name/aw/aws-ofi-nccl/package.nix b/pkgs/by-name/aw/aws-ofi-nccl/package.nix
new file mode 100644
index 000000000000..0c8f076882df
--- /dev/null
+++ b/pkgs/by-name/aw/aws-ofi-nccl/package.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  autoAddDriverRunpath,
+  autoreconfHook,
+  numactl,
+  libuuid,
+  rdma-core,
+  libfabric,
+  hwloc,
+  cudaPackages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "aws-ofi-nccl";
+  version = "1.19.2";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "aws-ofi-nccl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1gPIuZzS53cMRckiBkRRzMw3RzoAvu3v0xzt0rwyysk=";
+  };
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    numactl
+    libuuid
+    rdma-core
+    libfabric
+    hwloc
+  ]
+  ++ (with cudaPackages; [
+    cuda_cudart
+    nccl
+  ]);
+
+  postPatch = ''
+    patchShebangs m4
+    echo "$version" > .release_version
+  '';
+
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
+  configureFlags = [
+    "--enable-platform-aws"
+    "--with-cuda=${cudaPackages.cuda_nvcc}"
+    "--with-libfabric=${libfabric}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "This is a plugin which lets EC2 developers use libfabric as network provider while running NCCL applications";
+    homepage = "https://github.com/aws/aws-ofi-nccl";
+    changelog = "https://github.com/aws/aws-ofi-nccl/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jlesquembre ];
+    platforms = lib.platforms.all;
+  };
+})

From 89f91dbb1bbdc6f9c7c4c256b05c1c7797ebc6a8 Mon Sep 17 00:00:00 2001
From: DarkOnion0 <darkonion0@clapot.org>
Date: Tue, 23 Jun 2026 18:08:42 +0200
Subject: [PATCH 034/210] drawio: 30.0.4 -> 30.2.4

https://github.com/jgraph/drawio-desktop/releases/tag/v30.2.4
---
 pkgs/by-name/dr/drawio/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/dr/drawio/package.nix b/pkgs/by-name/dr/drawio/package.nix
index a494d80edfeb..268bff9dd8e7 100644
--- a/pkgs/by-name/dr/drawio/package.nix
+++ b/pkgs/by-name/dr/drawio/package.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "drawio";
-  version = "30.0.4";
+  version = "30.2.4";
 
   src = fetchFromGitHub {
     owner = "jgraph";
     repo = "drawio-desktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-kkKiGRxztEVFo/wlcdBYcDlxadNarcTyL1MqwonfVY4=";
+    hash = "sha256-+Lmv9I+9dShnvdR5v8O8enj8G2iXBzWTd5ImkNkDioI=";
   };
 
   # `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = fetchNpmDeps {
     src = finalAttrs.src;
-    hash = "sha256-hv1LQwsSOsBR5l/joUmXq6foQsVilH+jw3Wje24ISCg=";
+    hash = "sha256-87Z+abu9tH/BUT9Rey5Je1YeSGdWaD0TXP7ZJGIv6hI=";
   };
 
   nativeBuildInputs = [

From 6d26f1c9f3939faab05ce14be32e3aa027acec53 Mon Sep 17 00:00:00 2001
From: proitheus <me@mail.proitheus.top>
Date: Wed, 24 Jun 2026 04:14:39 +0800
Subject: [PATCH 035/210] shiru: add darwin support

---
 pkgs/by-name/sh/shiru/package.nix | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sh/shiru/package.nix b/pkgs/by-name/sh/shiru/package.nix
index c14c5a89bcb4..74532831db34 100644
--- a/pkgs/by-name/sh/shiru/package.nix
+++ b/pkgs/by-name/sh/shiru/package.nix
@@ -65,7 +65,12 @@ stdenv.mkDerivation (finalAttrs: {
 
     ./node_modules/.bin/electron-builder --dir \
       --c.electronDist=electron-dist \
-      --c.electronVersion=${electron.version}
+      --c.electronVersion=${electron.version} \
+      ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+        --c.npmRebuild=false \
+        --c.mac.identity=null \
+        --c.mac.notarize=false \
+      ''}
 
     runHook postBuild
   '';
@@ -73,6 +78,8 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
+  ''
+  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     mkdir -p "$out/share/lib/shiru"
     cp -r dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/shiru"
 
@@ -82,7 +89,18 @@ stdenv.mkDerivation (finalAttrs: {
       --add-flags "$out/share/lib/shiru/resources/app.asar" \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}" \
       --inherit-argv0
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p "$out/Applications"
+    cp -r dist/mac*/Shiru.app "$out/Applications/"
 
+    mkdir -p "$out/bin"
+    makeWrapper \
+      "$out/Applications/Shiru.app/Contents/MacOS/Shiru" \
+      "$out/bin/shiru" \
+      --set-default ELECTRON_IS_DEV 0
+  ''
+  + ''
     runHook postInstall
   '';
 
@@ -116,7 +134,10 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       naomieow
     ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-darwin"
+    ];
     mainProgram = "shiru";
   };
 })

From 75e5bfc80916131e23901554a38518fd266ea2f1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 00:35:13 +0000
Subject: [PATCH 036/210] python3Packages.jupyterlite-core: 0.7.6 -> 0.8.0

---
 pkgs/development/python-modules/jupyterlite-core/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jupyterlite-core/default.nix b/pkgs/development/python-modules/jupyterlite-core/default.nix
index 496717592b40..42ef3224589b 100644
--- a/pkgs/development/python-modules/jupyterlite-core/default.nix
+++ b/pkgs/development/python-modules/jupyterlite-core/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jupyterlite-core";
-  version = "0.7.6";
+  version = "0.8.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     owner = "jupyterlite";
     repo = "jupyterlite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TSy0GUI/7NLsLOayBwZ/raTtOtFgs/t4v1ByytVG960=";
+    hash = "sha256-LERWOeOvGdefbgQxbA8GAFZq1OD/Hhl2Q9hNVCS3Et4=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/py/jupyterlite-core";

From 090dfb61a2403f78e97e8c4812067c6b64411d25 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 02:20:44 +0000
Subject: [PATCH 037/210] mgmt: 1.0.2 -> 1.1.0

---
 pkgs/by-name/mg/mgmt/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mg/mgmt/package.nix b/pkgs/by-name/mg/mgmt/package.nix
index 6a4611a5918e..3928b2ed0c49 100644
--- a/pkgs/by-name/mg/mgmt/package.nix
+++ b/pkgs/by-name/mg/mgmt/package.nix
@@ -12,16 +12,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mgmt";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "purpleidea";
     repo = "mgmt";
     tag = finalAttrs.version;
-    hash = "sha256-nLk497gGrZ664VG9/yV6tqTtwAsN8EmuAEh5Vmq95hQ=";
+    hash = "sha256-jVFIVlytDvfTrAzWkX+pedAq/AcLrCDFtLPx0Wc+XjM=";
   };
 
-  vendorHash = "sha256-w4j9cJwW2tnjXSnd3w3v81TwHI8tGYiImjG3LZ+Pjuc=";
+  vendorHash = "sha256-mMRAlqySy6dpRG86p0BHSpYn2gzE8N4sZ3qHiyuttBA=";
 
   proxyVendor = true;
 

From b8edfcbfc5bfb1155425d4c6d6f5b2344ae61a9e Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Wed, 24 Jun 2026 07:21:13 +0200
Subject: [PATCH 038/210] python3Packages.jupyterlite-sphinx: relax
 jupyterlite-core

---
 .../development/python-modules/jupyterlite-sphinx/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/jupyterlite-sphinx/default.nix b/pkgs/development/python-modules/jupyterlite-sphinx/default.nix
index a4a1c68fbe41..3e0951f57541 100644
--- a/pkgs/development/python-modules/jupyterlite-sphinx/default.nix
+++ b/pkgs/development/python-modules/jupyterlite-sphinx/default.nix
@@ -59,6 +59,10 @@ buildPythonPackage (finalAttrs: {
     ];
   };
 
+  pythonRelaxDeps = [
+    "jupyterlite-core"
+  ];
+
   # upstream has no tests
   doCheck = false;
 

From 24358264956a503935a70c3ba6d43dc272a5ea2e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 06:00:47 +0000
Subject: [PATCH 039/210] sif: 0-unstable-2026-06-11 -> 0-unstable-2026-06-23

---
 pkgs/by-name/si/sif/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/si/sif/package.nix b/pkgs/by-name/si/sif/package.nix
index 0b33852a7892..8808910e606a 100644
--- a/pkgs/by-name/si/sif/package.nix
+++ b/pkgs/by-name/si/sif/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sif";
-  version = "0-unstable-2026-06-11";
+  version = "0-unstable-2026-06-23";
 
   src = fetchFromGitHub {
     owner = "vmfunc";
     repo = "sif";
-    rev = "d62919523abfecd06e07ba6528b15e9861bd747c";
-    hash = "sha256-T/HIvcXG3OpSK7xhZpYnCWv4KsRn0bnLhyouPjgwUoE=";
+    rev = "39b333320eab64f22392b2494a7cd18462d42b29";
+    hash = "sha256-1WdjmCxhd37gkb/HbgUfFZkcFumCMDQKAyG5nvfGAMU=";
   };
 
-  vendorHash = "sha256-rOAubGbeDPl0LJovksKRfYJmUvU6hmx3Ht12M7eLiOA=";
+  vendorHash = "sha256-R47Qz5tty+qvJKcWYMGZKYyRvpxN+mOdudT+cpUCT4s=";
 
   subPackages = [ "cmd/sif" ];
 

From cc181ff3310e63d5f77b88e4df563b2b24b42bcc Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Wed, 24 Jun 2026 09:56:48 +0200
Subject: [PATCH 040/210] ruff: 0.15.18 -> 0.15.19

Changelog: https://github.com/astral-sh/ruff/releases/tag/0.15.19
Diff: https://github.com/astral-sh/ruff/compare/0.15.18...0.15.19
---
 pkgs/by-name/ru/ruff/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index ca5d02475508..86e800f61978 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.18";
+  version = "0.15.19";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-DH00tENXdCdNcGPXPGzZsU3RVYQ0VBe1QLvbgEg/G6k=";
+    hash = "sha256-L0QRzc9S7vHOkk3WsfT0kgjBKbApsCHTgqCv4ts1j9g=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-RmK14NMPbhoRVLwIF5GXdGQg2AnMH20JGx7XF4HO+wY=";
+  cargoHash = "sha256-DapI+Wv4KNlbGUCRIiAybyKNYipRIFd5O2fYy9Uatjg=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From dd37c8dc248ce38c30cfb9956c50933939aa1fdb Mon Sep 17 00:00:00 2001
From: Timon <me@timon.zip>
Date: Wed, 24 Jun 2026 11:52:34 +0000
Subject: [PATCH 041/210] graphite: remove unused wasm-pack input

---
 pkgs/by-name/gr/graphite/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/gr/graphite/package.nix b/pkgs/by-name/gr/graphite/package.nix
index 2cac2d0bb464..9eabf26017e0 100644
--- a/pkgs/by-name/gr/graphite/package.nix
+++ b/pkgs/by-name/gr/graphite/package.nix
@@ -12,7 +12,6 @@
   lld,
   pkg-config,
   binaryen,
-  wasm-pack,
   cargo-about,
   nodejs,
   wasm-bindgen-cli_0_2_121,
@@ -97,7 +96,6 @@ stdenv.mkDerivation (finalAttrs: {
     npmHooks.npmConfigHook
     binaryen
     wasm-bindgen-cli_0_2_121
-    wasm-pack
     nodejs
     cargo-about
     removeReferencesTo

From ae557015a9ccf0ceb4ae8b486490c3c850baa797 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Wed, 24 Jun 2026 16:04:07 +0200
Subject: [PATCH 042/210] ty: 0.0.52 -> 0.0.53

Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.53
Diff: https://github.com/astral-sh/ty/compare/0.0.52...0.0.53
---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 48a4dbae05f2..ca6f502ade0f 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.52";
+  version = "0.0.53";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-p9fTzQ4DYvnwrtLdpSTekBV4ZbR1KETR8dfsbp8CDpo=";
+    hash = "sha256-0msHGoPm2b7OX0Lax/yr2Uism1RxsH4DxhxlQP/aFpU=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-NUIdYOeyRsR/ZQueEXshYdWTnSeQiRjZRRi2ag8Dm48=";
+  cargoHash = "sha256-DapI+Wv4KNlbGUCRIiAybyKNYipRIFd5O2fYy9Uatjg=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

From 357f8ae389999a99e5ae66b89b515ccd6dc48bf9 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Wed, 24 Jun 2026 23:00:45 +0800
Subject: [PATCH 043/210] cbmc: 6.9.0 -> 6.10.0

---
 pkgs/by-name/cb/cbmc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cb/cbmc/package.nix b/pkgs/by-name/cb/cbmc/package.nix
index ee3d677c0063..192a42a18d6d 100644
--- a/pkgs/by-name/cb/cbmc/package.nix
+++ b/pkgs/by-name/cb/cbmc/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cbmc";
-  version = "6.9.0";
+  version = "6.10.0";
 
   src = fetchFromGitHub {
     owner = "diffblue";
     repo = "cbmc";
     tag = "cbmc-${finalAttrs.version}";
-    hash = "sha256-SMJBnzoyTwcwJa9L2X1iX2W4Z/Mwoirf8EXfoyG0dRI=";
+    hash = "sha256-GCagpb2TFhOEH+lzMth+PWiJxlEw0L+H1DYUEQoMF3g=";
   };
 
   srcglucose = fetchFromGitHub {

From 8651ab7d4d794604b937906cd65dc1344cd16233 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian@arianvp.me>
Date: Fri, 16 Jan 2026 21:43:11 +0100
Subject: [PATCH 044/210] nixos/systemd/tmpfiles: add credstore.conf

This creates the /{etc,run}/credstore{,.encrypted} directories
from which ImportCredential= picks up credentials
---
 nixos/modules/system/boot/systemd/tmpfiles.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/system/boot/systemd/tmpfiles.nix b/nixos/modules/system/boot/systemd/tmpfiles.nix
index c606ff1ac50b..631a02645d9b 100644
--- a/nixos/modules/system/boot/systemd/tmpfiles.nix
+++ b/nixos/modules/system/boot/systemd/tmpfiles.nix
@@ -317,6 +317,7 @@ in
         mkdir -p $out/lib/tmpfiles.d
         cd $out/lib/tmpfiles.d
 
+        ln -s "${systemd}/example/tmpfiles.d/credstore.conf"
         ln -s "${systemd}/example/tmpfiles.d/home.conf"
         ln -s "${systemd}/example/tmpfiles.d/journal-nocow.conf"
         ln -s "${systemd}/example/tmpfiles.d/portables.conf"

From abbbac8a62bb0d6f96e8ce4b7f1dc574335ff298 Mon Sep 17 00:00:00 2001
From: carschandler <92899389+carschandler@users.noreply.github.com>
Date: Wed, 24 Jun 2026 11:23:57 -0500
Subject: [PATCH 045/210] livekit-cli: 2.16.4 ->  2.16.6

---
 pkgs/by-name/li/livekit-cli/package.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/livekit-cli/package.nix b/pkgs/by-name/li/livekit-cli/package.nix
index 5534cb60fce5..64f2e84af127 100644
--- a/pkgs/by-name/li/livekit-cli/package.nix
+++ b/pkgs/by-name/li/livekit-cli/package.nix
@@ -4,20 +4,28 @@
   fetchFromGitHub,
   nix-update-script,
   testers,
+  pkg-config,
+  portaudio,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "livekit-cli";
-  version = "2.16.4";
+  version = "2.16.6";
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "livekit-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D3moluv7tWi9BIvhHq4NDgDmCBNtWPEJPIbvpaAHtao=";
+    hash = "sha256-lsvbnc2YGPX2OYmdH6ZW0a6eNF+o3S8Y0eLuYsb4dUs=";
   };
 
-  vendorHash = "sha256-/vhISkzvfsPswsM0g4/RuyTZxqEEtfbtyAQV8YDRmu8=";
+  vendorHash = "sha256-BzEv2wpcXX7at6jJdgy9DtErbIU8ZPL+ollK1rlUWSA=";
+
+  # Use nixpkgs portaudio package + pkg-config rather than relying on a vendored
+  # git submodule, similar to the homebrew solution
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ portaudio ];
+  tags = [ "portaudio_system" ];
 
   subPackages = [ "cmd/lk" ];
 

From d4d4a78d32591023662c8da385e38e0f360de4b7 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 24 Jun 2026 18:21:40 +0100
Subject: [PATCH 046/210] nano: 9.0 -> 9.1

Changes: https://www.nano-editor.org/news.php
---
 pkgs/by-name/na/nano/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/na/nano/package.nix b/pkgs/by-name/na/nano/package.nix
index e4a2d0b1ea96..2ab07429d9e6 100644
--- a/pkgs/by-name/na/nano/package.nix
+++ b/pkgs/by-name/na/nano/package.nix
@@ -31,11 +31,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "nano";
-  version = "9.0";
+  version = "9.1";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    hash = "sha256-nzhDdLSWEQoltzrVpf67OEeDxuMYizcGP2d6yQgBP94=";
+    hash = "sha256-X0d2QnTLdTI0nOCqIOwQ8ejoUabp+j62aBLEPRltsEI=";
   };
 
   nativeBuildInputs = [ texinfo ] ++ lib.optional enableNls gettext;

From 8eb0f08e713ab2475993b37c35a88de951bc321c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 17:41:30 +0000
Subject: [PATCH 047/210] arnis: 2.8.0 -> 2.9.0

---
 pkgs/by-name/ar/arnis/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ar/arnis/package.nix b/pkgs/by-name/ar/arnis/package.nix
index 71ce5b416a5e..4a7e7621ccd3 100644
--- a/pkgs/by-name/ar/arnis/package.nix
+++ b/pkgs/by-name/ar/arnis/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arnis";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "louis-e";
     repo = "arnis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hNVECK6+I3ML/knsBdvEx2Uz1w4jXHynanlQfgrM9oM=";
+    hash = "sha256-SJT1dSQ6P5UCglYP5Song/cvisYLVXepsHH6AC5kJK4=";
   };
 
-  cargoHash = "sha256-Kff+76lZ6hsSbssYhrupmE2xAt1gwia8sMZR15ReqgU=";
+  cargoHash = "sha256-h8DuDgRtI9ZUq3hPqso/DZQnGInnilFIuzTPf0qpsbo=";
 
   nativeBuildInputs = [
     cargo-tauri.hook

From abbfb09d2d7d90e3d3d720fabc7f401234905bf7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 23:26:38 +0000
Subject: [PATCH 048/210] defuddle: 0.18.1 -> 0.19.1

---
 pkgs/by-name/de/defuddle/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/de/defuddle/package.nix b/pkgs/by-name/de/defuddle/package.nix
index 16b78498174a..94131aac3c11 100644
--- a/pkgs/by-name/de/defuddle/package.nix
+++ b/pkgs/by-name/de/defuddle/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "defuddle";
-  version = "0.18.1";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "kepano";
     repo = "defuddle";
     tag = version;
-    hash = "sha256-e/+eigIzpP0g+ZqTeyZnF6mloaY6UeKcMWfqryCcLbM=";
+    hash = "sha256-Fn203XKjZ2qbM1o0zs6mgxCdjWLOwz9Na+s1WSQG9XM=";
   };
 
-  npmDepsHash = "sha256-1NFwhYEGTKpjzCdK/eHK0TWtOEpn67FA+B3QZ11w1Rs=";
+  npmDepsHash = "sha256-quqWhbcaSNj4Bk++4N4LYq3Y8U5nQqnwc+MqU0LLgso=";
 
   # jsdom is both a peerDependency and devDependency; pruning
   # devDependencies removes it, but the CLI needs it at runtime.

From b62b29596f86b062ef1495f35b2de5e51767db99 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 02:43:33 +0000
Subject: [PATCH 049/210] thunderbird-esr-bin-unwrapped: 140.11.1esr ->
 140.12.0esr

---
 .../thunderbird-bin/release_esr_sources.nix   | 794 +++++++++---------
 1 file changed, 397 insertions(+), 397 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix
index 473ba3792a08..bae1f9680f24 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix
@@ -1,1193 +1,1193 @@
 {
-  version = "140.11.1esr";
+  version = "140.12.0esr";
   sources = [
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/af/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/af/thunderbird-140.12.0esr.tar.xz";
       locale = "af";
       arch = "linux-x86_64";
-      sha256 = "cd44e22f8f2ec9a8691ff5b19479bb80b1251d8ec821876ef7b73cc4d6ad38b1";
+      sha256 = "050378311049a737822518c8b027796cdb39e9adc6dc0c0fd3928ff13e516ec6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/ar/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/ar/thunderbird-140.12.0esr.tar.xz";
       locale = "ar";
       arch = "linux-x86_64";
-      sha256 = "51855dbbd4c59d414c211c138aa46dd8b513825c02830bc68fa469248493a9f0";
+      sha256 = "c2db9059a6b4176a1f06d055b14dc1464f6c50c5c6ec27f7caf0b52e2edd51a5";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/ast/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/ast/thunderbird-140.12.0esr.tar.xz";
       locale = "ast";
       arch = "linux-x86_64";
-      sha256 = "81099d46f5776631e2ac59c269c36e80a0878812fd7422509cb940261bc702a9";
+      sha256 = "60a4c588e1d23b66c27824cee5621744d3bca001ace5bc5a8d0bcdf57fb26865";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/be/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/be/thunderbird-140.12.0esr.tar.xz";
       locale = "be";
       arch = "linux-x86_64";
-      sha256 = "9310cb6f6ba5371861f8f3d4695cb599839d726dc62cb280b03461e2bcbfd677";
+      sha256 = "9bb62803d7ce319c380981443f569400707f199e04908f519dbe9b402ff58ed0";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/bg/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/bg/thunderbird-140.12.0esr.tar.xz";
       locale = "bg";
       arch = "linux-x86_64";
-      sha256 = "88103bba753cf512319a05a6fc2fc1a4bf5ef51623a16e8ca06b6120eadd55e5";
+      sha256 = "bcecc7405a81da15cb9b3ac4fc8cb0ee2eda216c396f2b1cfc98a169733231a3";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/br/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/br/thunderbird-140.12.0esr.tar.xz";
       locale = "br";
       arch = "linux-x86_64";
-      sha256 = "b2507e3615fb3aa1f9b440304ecc14a5f3a82ea11cb1f26dfba049f247baba4c";
+      sha256 = "499a036fbf8f9155381f745094c8769ded4e6eda2a08f2157fdfe73b4ca5bf65";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/ca/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/ca/thunderbird-140.12.0esr.tar.xz";
       locale = "ca";
       arch = "linux-x86_64";
-      sha256 = "286528d64bb61a45fc75ed3eb9acdb51d86dccdf69f4921225b72f2f9705cab0";
+      sha256 = "986a178bb234d17112b0852284b0e075a78294d7bddad14df8df0fae1715b2c9";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/cak/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/cak/thunderbird-140.12.0esr.tar.xz";
       locale = "cak";
       arch = "linux-x86_64";
-      sha256 = "b055cda1a66326625cd9073e3ef59100011fb1fa94842bb1377982793e89fe13";
+      sha256 = "2cf04dc47f0491a5d6d7859502875c674a14dfc3ab8be159cf7695f8960f052b";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/cs/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/cs/thunderbird-140.12.0esr.tar.xz";
       locale = "cs";
       arch = "linux-x86_64";
-      sha256 = "c7c986a1b2928d50793be7a768f41792a11b10840c4b89e362fdd87dff8b859c";
+      sha256 = "373b52333287733e1d9db7692597cf8586a3c1c4b6e65f62f91f5cddd9ab2154";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/cy/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/cy/thunderbird-140.12.0esr.tar.xz";
       locale = "cy";
       arch = "linux-x86_64";
-      sha256 = "fec3476eb18c24fa23119f0ead79a14f50e243c60e18729a42d7390065a7752e";
+      sha256 = "5f52003da7979bdf7f67eb3b7b3cc56eed131ec3ae6ace959effc807e5de0572";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/da/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/da/thunderbird-140.12.0esr.tar.xz";
       locale = "da";
       arch = "linux-x86_64";
-      sha256 = "e879bbac85ed9aff18564afcd652d5ab7bb99eb9e36134bba36dda3c988dc754";
+      sha256 = "2d3ac1aca92ae22e8333e6fe9553756b11eee8206540c2734587210d49816a0c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/de/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/de/thunderbird-140.12.0esr.tar.xz";
       locale = "de";
       arch = "linux-x86_64";
-      sha256 = "72a5273c008060bc2a856eb33c49023ee1ed25f9826471cb2a04418b5d29ec6a";
+      sha256 = "da09fd775e48505951d8d043f1cd82fb30247b69b854e16f1aea6bde5d01f12c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/dsb/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/dsb/thunderbird-140.12.0esr.tar.xz";
       locale = "dsb";
       arch = "linux-x86_64";
-      sha256 = "ad5fdff483dfe20441a6b48d22dd3a82a2b7c20f7af06025744cc0a73f4e1504";
+      sha256 = "f05b4fa188a0a7fb9f9c7a064033c23c02f7e4d5707381e3e33d7c2c333e55e8";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/el/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/el/thunderbird-140.12.0esr.tar.xz";
       locale = "el";
       arch = "linux-x86_64";
-      sha256 = "0ecb235a03ceaf27e93f949d0a7f4534db48e2a1050ed10f644f70db794a78c5";
+      sha256 = "a0cd68365bcfadccddad5986681113516084d77caf2c8759bd3241efbc000040";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/en-CA/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/en-CA/thunderbird-140.12.0esr.tar.xz";
       locale = "en-CA";
       arch = "linux-x86_64";
-      sha256 = "5645c08f8630849b1efede22d46a8526ee157683458ce3929e1094a928be742e";
+      sha256 = "3a7cc40f7fe3ae92baa11a42921d4bcb1356b7c4f9265544a49b448d463fa0f8";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/en-GB/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/en-GB/thunderbird-140.12.0esr.tar.xz";
       locale = "en-GB";
       arch = "linux-x86_64";
-      sha256 = "5172cc07af724e427f593687f348cc501628786cc5d6c943d1d194e04075721f";
+      sha256 = "a46a9d7c2dd95e5beaa381ade1ff77eddfc5086859d4f63dc9603b6988d2f378";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/en-US/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/en-US/thunderbird-140.12.0esr.tar.xz";
       locale = "en-US";
       arch = "linux-x86_64";
-      sha256 = "9b453e56b395aa06237891644bc412609291522105bd87c4cb902caf82ccfbe5";
+      sha256 = "c5d06b256cab51dd885b566e41cd89092b235ad76c121aae31faea752203f862";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/es-AR/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/es-AR/thunderbird-140.12.0esr.tar.xz";
       locale = "es-AR";
       arch = "linux-x86_64";
-      sha256 = "d88f03eb618276e8be922fed996ae67f8d2cf9167c7c7c77302b67db9b5794a5";
+      sha256 = "f10b84ebde078189d78b3f09b16deb83bfa804c5260c5d0f39f320951df8b687";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/es-ES/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/es-ES/thunderbird-140.12.0esr.tar.xz";
       locale = "es-ES";
       arch = "linux-x86_64";
-      sha256 = "6ca15e9d2d58e1580ad08019c4272eec5e5f9be4b9f781628d0b0f42f7b572b9";
+      sha256 = "500dfbd3895d0f286bbfe9e0571364d720fe423963529ac3eddea3995a378b2a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/es-MX/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/es-MX/thunderbird-140.12.0esr.tar.xz";
       locale = "es-MX";
       arch = "linux-x86_64";
-      sha256 = "40196953a9f29207f64c535ea159673120eee51f03478518b8f86ff46a6d6d8a";
+      sha256 = "15b8284199e810afbe5fc8a7c0b0bf3bb1c398d825287247ab36e9f8c4d141ed";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/et/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/et/thunderbird-140.12.0esr.tar.xz";
       locale = "et";
       arch = "linux-x86_64";
-      sha256 = "78398e3d931c722bf35a30c3bc69218f2d396c6d4ff7cbb3130c01a20a23fa7c";
+      sha256 = "738eabe162536ef4cb9ce4410254d87570c54565d114c9b348c5c2951dfb7720";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/eu/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/eu/thunderbird-140.12.0esr.tar.xz";
       locale = "eu";
       arch = "linux-x86_64";
-      sha256 = "a5acae7a5b8d31dae0fc3fe7c3c41b582011af654bc0846921ae2661576a1a48";
+      sha256 = "0b80fcbe4ecdf5243880f9098562762dc7c24453d04bc574cff10948ad2b17a1";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/fi/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/fi/thunderbird-140.12.0esr.tar.xz";
       locale = "fi";
       arch = "linux-x86_64";
-      sha256 = "97d66dc25f0fde8a1f9559164bc1eb641f4e5f8aca34cf0b1f0bb10bd19636cd";
+      sha256 = "8d584823c27f78fbc0fcb4f17ff40bb44060a9883926efae679bd6348f014902";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/fr/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/fr/thunderbird-140.12.0esr.tar.xz";
       locale = "fr";
       arch = "linux-x86_64";
-      sha256 = "1497140b897323600202a1c982c80e1f69607351d4b243575f37e8b372d97681";
+      sha256 = "c553516dee6c8239104914c4e2cb2398c4481a20ce244a3cd62932eb1580f85f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/fy-NL/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/fy-NL/thunderbird-140.12.0esr.tar.xz";
       locale = "fy-NL";
       arch = "linux-x86_64";
-      sha256 = "e4126a7e2cc7ba4d0891896fb4a096971c2dbb2d932813d365dd90001e9b7c61";
+      sha256 = "0cb8d5f80f59f73e2e126b9095903b88db27955ac3e572eac8469d2033a8673a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/ga-IE/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/ga-IE/thunderbird-140.12.0esr.tar.xz";
       locale = "ga-IE";
       arch = "linux-x86_64";
-      sha256 = "03c1da05b74097d8103c4b98ac22077a01deef089d5509a2dcb89b235da91cc2";
+      sha256 = "708f6c7fb1aa1ae282ae78edd85b961c6806aa499c1323359dec030b2497a03f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/gd/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/gd/thunderbird-140.12.0esr.tar.xz";
       locale = "gd";
       arch = "linux-x86_64";
-      sha256 = "ec118262c5c8c4430f574b3a0613f4da1f6ff5e3e6a2b0bee0248021a98f5e54";
+      sha256 = "6fb584fc114014c87bbc7e7706edf2dfc61edf0dda460c2c065f688450319a7a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/gl/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/gl/thunderbird-140.12.0esr.tar.xz";
       locale = "gl";
       arch = "linux-x86_64";
-      sha256 = "c585f158acc1cd998edb46d8c5221e760f5e921f778b396ec89daa000ff426d8";
+      sha256 = "4450251a717c392df2a94d495450b9a52166fedd49a05145f1a1213736dcb97d";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/he/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/he/thunderbird-140.12.0esr.tar.xz";
       locale = "he";
       arch = "linux-x86_64";
-      sha256 = "81fae1be93af6bdc667f58cb6976376fdc334c4d5432c31d87fcf887dbe0f503";
+      sha256 = "3a167e20ab4ad7c12e239a7446e782dfe1bb9a966bfb2dd58d68f37f8a3b6f98";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/hr/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/hr/thunderbird-140.12.0esr.tar.xz";
       locale = "hr";
       arch = "linux-x86_64";
-      sha256 = "1d3c4e0fbd28b3931584454b3b7e392c793c5e75cdd21067be4faccc1e4ecfe7";
+      sha256 = "d01c579f7863bf3623afa4c4d115a262490f4b2a90eb120087e30a62b8b6c949";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/hsb/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/hsb/thunderbird-140.12.0esr.tar.xz";
       locale = "hsb";
       arch = "linux-x86_64";
-      sha256 = "064ce5e72d37607aa8103a046913efd93b659257463fa897a46f0ab5bf2971ae";
+      sha256 = "96f389ecc12af0113fda7fa177432bc7e79414af48df33f5742c822ba1bea59a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/hu/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/hu/thunderbird-140.12.0esr.tar.xz";
       locale = "hu";
       arch = "linux-x86_64";
-      sha256 = "2c366fce17fafd29c7f389a33674e117ac1d50074c3d3a35f7495bf868843b87";
+      sha256 = "4c614d831b74b7570024cdee4b981dfd0b00b24ebccaf1b7b59e0762cdd20754";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/hy-AM/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/hy-AM/thunderbird-140.12.0esr.tar.xz";
       locale = "hy-AM";
       arch = "linux-x86_64";
-      sha256 = "fd3aaace09db4cefa108c25eda88c9a3879c8ec227e572eaf2fd22729df7dc94";
+      sha256 = "375d7cc6f60a1c26a9674e6eeb3f78dfb02b2e1fda02b9bea08c6615bc0b8b50";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/id/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/id/thunderbird-140.12.0esr.tar.xz";
       locale = "id";
       arch = "linux-x86_64";
-      sha256 = "ff3eece338e9eb8fb6f09c8fcaa019254171fd5e6c4bd7af8f316d090367f00a";
+      sha256 = "3c9f80e7c7650e01ef750877eac782f1617fba7a39e6772d2a8a6d611c1bc687";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/is/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/is/thunderbird-140.12.0esr.tar.xz";
       locale = "is";
       arch = "linux-x86_64";
-      sha256 = "9a2ce7350e387bc697093f39fac52b1e4c80fa0a9c736900d63551a4a381c357";
+      sha256 = "75acc6a313daeaf329c2a575b6f88ae6564b1d7b7fff97e47419306f5d60f4bc";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/it/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/it/thunderbird-140.12.0esr.tar.xz";
       locale = "it";
       arch = "linux-x86_64";
-      sha256 = "3983915b58c46a64978a7b3332923077059fda6cabef4faa39ce1e9dabbb2667";
+      sha256 = "ef896c6db4b5ac846271350915ae4ff51b4d623265d3b6d781665f1be1f2ab20";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/ja/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/ja/thunderbird-140.12.0esr.tar.xz";
       locale = "ja";
       arch = "linux-x86_64";
-      sha256 = "0d7e7b11797826fed39ef5016301cddda761f39921b8d25288900358e3bf579a";
+      sha256 = "6c2049c0c117ecb204fb13062bab60a1e35a6523746b5975359caddde38e1dea";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/ka/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/ka/thunderbird-140.12.0esr.tar.xz";
       locale = "ka";
       arch = "linux-x86_64";
-      sha256 = "6952c4d12ac989b2073f112f02e14298756673945839ffcce2a887a562cdb9da";
+      sha256 = "06752896f2e67994628fcdac734b0139912af4831e7c67e25342b20bdb02d6a4";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/kab/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/kab/thunderbird-140.12.0esr.tar.xz";
       locale = "kab";
       arch = "linux-x86_64";
-      sha256 = "7245abb39634a26a2987f5a5ca2cdfed4a1957c0cb29900ea82146d63517210c";
+      sha256 = "4f60b77216c5e3d7ccb22457d42f741bfe5deb439e4325241bbd21be4b68fec3";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/kk/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/kk/thunderbird-140.12.0esr.tar.xz";
       locale = "kk";
       arch = "linux-x86_64";
-      sha256 = "208deec2213742c05d3ab742b7f7c86a007892ebc372f8810c09b783e4976200";
+      sha256 = "806749e4ed884f6cab1d598131e33960299e111e6d30f1889ae4fba37bdb7768";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/ko/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/ko/thunderbird-140.12.0esr.tar.xz";
       locale = "ko";
       arch = "linux-x86_64";
-      sha256 = "c8df67e9af8b1efc1e608f95b5075346db19283c285baabca27950545d6e3714";
+      sha256 = "dfada3e9e5e47a65305bebbbf119fd818318d2f29ae4311d85589b894102fd19";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/lt/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/lt/thunderbird-140.12.0esr.tar.xz";
       locale = "lt";
       arch = "linux-x86_64";
-      sha256 = "75f859da709c8698679eb49d5336220efdcda50acc0dc415be6c6f0be08780b4";
+      sha256 = "dbd680651d996ac06e2b6eeaa627b956c27a1f30da7e5e9f6a23f148d2d93abd";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/lv/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/lv/thunderbird-140.12.0esr.tar.xz";
       locale = "lv";
       arch = "linux-x86_64";
-      sha256 = "81cacd303205c11460037c372b25b0d79153c340e9be727f87f4950c924a1235";
+      sha256 = "7a3595b074dadd6f3fa05a9f923150b32ffc5c4df33ee012e3392ddc2383b81f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/ms/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/ms/thunderbird-140.12.0esr.tar.xz";
       locale = "ms";
       arch = "linux-x86_64";
-      sha256 = "36023a03fdc7e1fea7fc5beb8baf8eed8683efd68e9971cf8d907e1306368de9";
+      sha256 = "dbf7ff229cd76fbbdf8ad82e2ea10080e9ee7c9a89d87f48b81d8bbdac645e46";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/nb-NO/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/nb-NO/thunderbird-140.12.0esr.tar.xz";
       locale = "nb-NO";
       arch = "linux-x86_64";
-      sha256 = "499e5a4f08a0e82c38dbe5718878330f0ad35e9f6c0b93995d22661dfa8434e0";
+      sha256 = "787e6d7ab5be70c6cc3ea7ff5289c085a10e702e1bca050fd88df7da71a0b837";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/nl/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/nl/thunderbird-140.12.0esr.tar.xz";
       locale = "nl";
       arch = "linux-x86_64";
-      sha256 = "7f74580c216f949f68d29c3daba3094135b847b20a4796480526047c4a5ef938";
+      sha256 = "b8c8ea2e4b31cdbe3e6ee79f693a24a2e3231514e182591d50b98fba410d147f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/nn-NO/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/nn-NO/thunderbird-140.12.0esr.tar.xz";
       locale = "nn-NO";
       arch = "linux-x86_64";
-      sha256 = "df1e38486df5e06c8b2b8df51c5e34464fdd7ecf99ed7ce27b61c80496abf945";
+      sha256 = "02c3eb86d19c56bbc8f22a6975f9545bed929e1d76bd0e34815268c7d9cf9d9e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/pa-IN/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/pa-IN/thunderbird-140.12.0esr.tar.xz";
       locale = "pa-IN";
       arch = "linux-x86_64";
-      sha256 = "2f9e63be4fe48eae42f9b2142de21697fa2b5f6e454f13f0c595a223c8d72dff";
+      sha256 = "c5689b110edee033d0af26e49321f8bac2ddad122a34a65006e7e66758b3cc62";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/pl/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/pl/thunderbird-140.12.0esr.tar.xz";
       locale = "pl";
       arch = "linux-x86_64";
-      sha256 = "02af40342348ff187b402c96b5ca5cc5214932a6598e9499bba02ae6fcc168a6";
+      sha256 = "13ff125aff920248de22064a41653daa94ffd5b3be8603bb184a64d1bf6ae1b6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/pt-BR/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/pt-BR/thunderbird-140.12.0esr.tar.xz";
       locale = "pt-BR";
       arch = "linux-x86_64";
-      sha256 = "1364587ed5d821a999df87278905725c361c0dcf6aa1b60b90995ebf65a1d2d2";
+      sha256 = "36313bb55ad5a173c016baa48eaeb21e724f34245ee506335946be88341fcd19";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/pt-PT/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/pt-PT/thunderbird-140.12.0esr.tar.xz";
       locale = "pt-PT";
       arch = "linux-x86_64";
-      sha256 = "bde7be8accc37063c8817afe218c07445141c4964f077b47025819617e87d128";
+      sha256 = "639ebcf46b3e8758cc6d0913dfef1ab879e5bc1b88918378f04c88c82cf7319a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/rm/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/rm/thunderbird-140.12.0esr.tar.xz";
       locale = "rm";
       arch = "linux-x86_64";
-      sha256 = "62e733d827e128eeb60f094bad877a7a35c812c6969f920a8d333c68090c5f63";
+      sha256 = "5768f3989cd9760453f755f4079d943993b4a066ab7a67ed205ee01f98a00bef";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/ro/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/ro/thunderbird-140.12.0esr.tar.xz";
       locale = "ro";
       arch = "linux-x86_64";
-      sha256 = "bd15dc06055d993c1935574fdcbd15f5d00df6399a4e200292d1a47eb1a8e196";
+      sha256 = "6ec560d39690ade92c3240fbef80ca6e7dfd60d05318c4c5f380e83e82ab8d30";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/ru/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/ru/thunderbird-140.12.0esr.tar.xz";
       locale = "ru";
       arch = "linux-x86_64";
-      sha256 = "0fd47d7dd9dc7b12d331420074fa219d3f1eafbdbf2fa1bdf198c20c72ebc1aa";
+      sha256 = "57771e5eb3fe249beabc14406d5cfb4fa441e34e499ae33182bcd16329f7f006";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/sk/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/sk/thunderbird-140.12.0esr.tar.xz";
       locale = "sk";
       arch = "linux-x86_64";
-      sha256 = "979378ef6cb26761e0960948974a184eaf01cb8ca260e6adc51334ccbc47af0a";
+      sha256 = "26e886f4a2d592b63bdf2d7134732bf6dd723f96b35b3c7401557bad1f69ff7a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/sl/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/sl/thunderbird-140.12.0esr.tar.xz";
       locale = "sl";
       arch = "linux-x86_64";
-      sha256 = "ac1507b38c50a318b0e59687209979c9c4c0c389afa5583c8e610333e7495319";
+      sha256 = "ff6fc182474650b0a06df3eaa17fb8a25d1c6c6439593dad15dbb2dfec6054d0";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/sq/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/sq/thunderbird-140.12.0esr.tar.xz";
       locale = "sq";
       arch = "linux-x86_64";
-      sha256 = "eb6c22097d6aef20d121e35ffff4e0599929e167817dd0d22059f07742fafdfe";
+      sha256 = "397558e6d682b2ab113caa37b2f9d92a18060c4186765652ed2c5b25a099f522";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/sr/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/sr/thunderbird-140.12.0esr.tar.xz";
       locale = "sr";
       arch = "linux-x86_64";
-      sha256 = "31022daed19b0fc26d03aa5ba482e5f214e6d1a5579c16e6695fccf5fc0c9b76";
+      sha256 = "d8b38efc58ea52d26de81fa6d102111ba2fbd4223f0d249df50da454dd938a00";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/sv-SE/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/sv-SE/thunderbird-140.12.0esr.tar.xz";
       locale = "sv-SE";
       arch = "linux-x86_64";
-      sha256 = "e69480753cb4487fd7aeafca2042fe5661345066fa452be31e879dcc9c370504";
+      sha256 = "45e221d41072469de109f44e96f14e08805386c204916dafc5c4e0d3c19c8488";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/th/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/th/thunderbird-140.12.0esr.tar.xz";
       locale = "th";
       arch = "linux-x86_64";
-      sha256 = "d1e945026998163ca3c8ab37be348caed49c9f72864323e456ff9b8728c03c4f";
+      sha256 = "a1db6cf962d3a37d2d0377af2344e9096023f312411960423f194aaa4d463440";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/tr/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/tr/thunderbird-140.12.0esr.tar.xz";
       locale = "tr";
       arch = "linux-x86_64";
-      sha256 = "4bf8bce7b5e303d44e0c8a3a0e4f1002d637bc73f9c290ed42f97fc9a255fe4c";
+      sha256 = "942b512f3a97855af979f169aa13efc2c81e40a57cae9eef847a8002c32a2edc";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/uk/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/uk/thunderbird-140.12.0esr.tar.xz";
       locale = "uk";
       arch = "linux-x86_64";
-      sha256 = "e4110dfb97f35d1373640374a213163362877d212cc65cd64bd20742aa24dd63";
+      sha256 = "419954a7b515eda3cc4b05b0264794e5cdd30e7990ef22bda5853e2d2cfb66ed";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/uz/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/uz/thunderbird-140.12.0esr.tar.xz";
       locale = "uz";
       arch = "linux-x86_64";
-      sha256 = "1874900326621f5888fbe669a37b0a04228d30f70c3d23bd037f05edce286faa";
+      sha256 = "0fae72eaff57e94da55986fcb780c7f78a3d49d6e88579a8f27b0458c7e795a0";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/vi/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/vi/thunderbird-140.12.0esr.tar.xz";
       locale = "vi";
       arch = "linux-x86_64";
-      sha256 = "41494dc6f259067ee48ad713cc4fb84d8f25cee723ff1a8bbad98771a1822d21";
+      sha256 = "b2d34a336a99bb62653fb67cea88556e9e5257b3f274886bdb487b3d2cb8afe0";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/zh-CN/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/zh-CN/thunderbird-140.12.0esr.tar.xz";
       locale = "zh-CN";
       arch = "linux-x86_64";
-      sha256 = "2a1f12a9f87b72d45924f2d00037007a955dde55f82b1d5d6d520e15d90e5b8c";
+      sha256 = "f1fe732f4ea7b201aaa45f8465a355a427c6e8cd3735d6d0439d62bc70d2235f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-x86_64/zh-TW/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-x86_64/zh-TW/thunderbird-140.12.0esr.tar.xz";
       locale = "zh-TW";
       arch = "linux-x86_64";
-      sha256 = "cb358b240ff255b98d9d4061ea99524ee4774aedafbf962c284d1871ec11000e";
+      sha256 = "d110e9903ce4638f62640565b7891c1526489a0a3ad1056db62da30ea410ec18";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/af/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/af/thunderbird-140.12.0esr.tar.xz";
       locale = "af";
       arch = "linux-i686";
-      sha256 = "a451426fc9d84724255411a6464e05e7ac46f46912fc2c04182b349e3f02e44e";
+      sha256 = "322ae7ed2d53f00984c8bf0b18b2c716dfd35a2e7674b7841b9d3d2855fe2350";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/ar/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/ar/thunderbird-140.12.0esr.tar.xz";
       locale = "ar";
       arch = "linux-i686";
-      sha256 = "9f85ad16c9670be0f85d096a2db3713cb65c670c25977a92200687710fe6bfcb";
+      sha256 = "8aef945b037a93c5e3ac7b87dc249d61a4b2ef9dfada4cb9f5cac39fc7025d9d";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/ast/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/ast/thunderbird-140.12.0esr.tar.xz";
       locale = "ast";
       arch = "linux-i686";
-      sha256 = "790e24d94ddd53798a1e9ac76b7c096aa2c7428f62ccdd04756c8a4b46d20402";
+      sha256 = "ea429dc3e7ba910a88a9a49a83569379dc5cf17b9e85c212cb9ffd4cefbd8af8";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/be/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/be/thunderbird-140.12.0esr.tar.xz";
       locale = "be";
       arch = "linux-i686";
-      sha256 = "7dcbd7b4817cb491a0c171524aa212f5786b9a93a5834a1e7b01e03d02b8dc58";
+      sha256 = "c3baf19133f41517dc8d71c84028065e32b17d6dae6358868041030ca7352120";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/bg/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/bg/thunderbird-140.12.0esr.tar.xz";
       locale = "bg";
       arch = "linux-i686";
-      sha256 = "425bc5719ac01c3600523d7b0d26e38cfb86e5be2de15550b0781b15dca61310";
+      sha256 = "751b14bf9465813c0409a22a0cd8b04d959d0a01fbbde790dc15d3d5324352b1";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/br/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/br/thunderbird-140.12.0esr.tar.xz";
       locale = "br";
       arch = "linux-i686";
-      sha256 = "31a747ae4b6a429e3f630e4dbf19bae8cc1f97f1adf0b89d56162845d5e1ed7b";
+      sha256 = "05d8a35a456493e2e4d33bf137bec2c95118ef5022a3f96fede59522fa35d1d3";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/ca/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/ca/thunderbird-140.12.0esr.tar.xz";
       locale = "ca";
       arch = "linux-i686";
-      sha256 = "9caf9871fc73bfe2730ac231833cff6bbd60224c082ff26b1d8f2ffc407770ac";
+      sha256 = "8fff2a6eb652eb5be5d094d5df0b2519c9ed46f31f2518d6c253fb782348ba4b";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/cak/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/cak/thunderbird-140.12.0esr.tar.xz";
       locale = "cak";
       arch = "linux-i686";
-      sha256 = "ff8a4299610825a202b58ddea4e69eddbe8e1892319002eb8d031f513adf7709";
+      sha256 = "f06825ad3cfb733d28a19fce718b0dedbd902e3ed0477e3561c52e788863b9c2";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/cs/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/cs/thunderbird-140.12.0esr.tar.xz";
       locale = "cs";
       arch = "linux-i686";
-      sha256 = "64b86c5e360f93ad380d27c28bc126c8bc88c6028f9ba77fc799bdf75f5627cb";
+      sha256 = "0564af5f85093fbba2785a444dd6c1eb3c7f36e9743810ab2f15960a4f8e4dbf";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/cy/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/cy/thunderbird-140.12.0esr.tar.xz";
       locale = "cy";
       arch = "linux-i686";
-      sha256 = "522a5db1ff214dcfc892004723338cb2c02f7d529c43b892a1bc2fb378277462";
+      sha256 = "a9fdbbfe0c87235040f8e53a8b8a89e8a2d9e170a5915d0ff09b5bff3c8cbdf2";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/da/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/da/thunderbird-140.12.0esr.tar.xz";
       locale = "da";
       arch = "linux-i686";
-      sha256 = "e400141a23886b4a88262a67b9ae69f9d342061c770ea94ed9b9e792b40c5a4b";
+      sha256 = "8a83c0b74d92f8dc1c7364e86b5b57c99d7beae778000a18f6408aef1e027675";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/de/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/de/thunderbird-140.12.0esr.tar.xz";
       locale = "de";
       arch = "linux-i686";
-      sha256 = "bff772a4f3a9eca47900d65715640db7c7d0605570470eb35c1d96537b64192c";
+      sha256 = "4fff877677ea3473e5a2112577d5496778e49d2f1875dde617a4d5d2f9ce54b4";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/dsb/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/dsb/thunderbird-140.12.0esr.tar.xz";
       locale = "dsb";
       arch = "linux-i686";
-      sha256 = "61c388aab0f7edb6fbbee05b51f13efc50f154e33ae9d20bb2b61f3784e55821";
+      sha256 = "a95cb3ee5df7373048c671833923cf10eceb94518d7b134f0ae5ebb19fb5451e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/el/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/el/thunderbird-140.12.0esr.tar.xz";
       locale = "el";
       arch = "linux-i686";
-      sha256 = "22a7e3f9ca36d5c6eaeb64076223a884c18e34016d1df8328f380dc966c191eb";
+      sha256 = "926849efb07f19937e7b1bb88c97f963569e840bb580d405a62c91a941dbd84a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/en-CA/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/en-CA/thunderbird-140.12.0esr.tar.xz";
       locale = "en-CA";
       arch = "linux-i686";
-      sha256 = "c31862319d08a58c689aa25cc8fc619b64a63e8453817e0c2d312ecb0a9aa9ec";
+      sha256 = "402e06a6c83824fd0eb2c39289662d623a66d572172a90b599a4754756934036";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/en-GB/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/en-GB/thunderbird-140.12.0esr.tar.xz";
       locale = "en-GB";
       arch = "linux-i686";
-      sha256 = "eefc9967520048074756116537a8d83419cd3f2e6fb172dedda9c55914e927f2";
+      sha256 = "c5f0e1761fd16624d9d1830a980581d8069df4b7c86beb9c2c53b384224b8e38";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/en-US/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/en-US/thunderbird-140.12.0esr.tar.xz";
       locale = "en-US";
       arch = "linux-i686";
-      sha256 = "9ff43141905503ba3d8a0beb92dccf1f422c91b3d7c40c252b9d431093607f55";
+      sha256 = "c72fea4b5500105d1656600f2c06b42740d1189e08062099cdb69829d34768fd";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/es-AR/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/es-AR/thunderbird-140.12.0esr.tar.xz";
       locale = "es-AR";
       arch = "linux-i686";
-      sha256 = "75744354f8e6b8a6ac3b25c917aede6a1eca3e7d3861c1692cf4378b49e7cc84";
+      sha256 = "c8f5bf4dfe5defab943d7ae9c16f6c97ae029c182f177d04a5d3426c0f5f56cf";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/es-ES/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/es-ES/thunderbird-140.12.0esr.tar.xz";
       locale = "es-ES";
       arch = "linux-i686";
-      sha256 = "139f1be50f0658100828cd3a0608ee31ef1952aa80048eb9a254c097ba7e04c9";
+      sha256 = "1980b65149a256ec28b0d9e308d0bbaf24ea94810e1c64ef2139867b0e212458";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/es-MX/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/es-MX/thunderbird-140.12.0esr.tar.xz";
       locale = "es-MX";
       arch = "linux-i686";
-      sha256 = "206f3efbdd7566986824e62124f6855c3b88679d4c4e9eee2041b26d01501fe7";
+      sha256 = "5fcf85ed117a6707ad6bcf8a0f4c77466c99c532389849c985b58364180adc0e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/et/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/et/thunderbird-140.12.0esr.tar.xz";
       locale = "et";
       arch = "linux-i686";
-      sha256 = "6385a2b7201b295a9becb2e3326a87db7f26af19852141e82aaa1b9288e4cac1";
+      sha256 = "a0de80f954cc1840563dfa0e0ae217df920370107be9f79fe484c9a22bb1b261";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/eu/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/eu/thunderbird-140.12.0esr.tar.xz";
       locale = "eu";
       arch = "linux-i686";
-      sha256 = "1b115910849f6655d366f28949e998b1bc8b7b4c1b61d6af761fca6aba00a507";
+      sha256 = "e0722e189bde39ff9b06983ad6bda18e7b8be6b348027e0012e649f364b1fe4c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/fi/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/fi/thunderbird-140.12.0esr.tar.xz";
       locale = "fi";
       arch = "linux-i686";
-      sha256 = "7afb20de6e21db2fcbc7be7622bbf7ec84948eae6d1a9bc98c9b894d375e7667";
+      sha256 = "f0ce1ee9a0c6ddbd11b72834a6e9b15688847890d9cf852e035d4576f2800bd6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/fr/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/fr/thunderbird-140.12.0esr.tar.xz";
       locale = "fr";
       arch = "linux-i686";
-      sha256 = "b8637b6e2478d662f55c942d49810801bfb1ae085db4970d76843fb553971e03";
+      sha256 = "9342e4650e9fe94baa229fb008390a391e1530e75dc31ecfc2ba93230cac47d9";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/fy-NL/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/fy-NL/thunderbird-140.12.0esr.tar.xz";
       locale = "fy-NL";
       arch = "linux-i686";
-      sha256 = "dccb74f43b41a5c4c29a02e6ebeb947b8844f823c151be531548ef4b274accfb";
+      sha256 = "46018dbd147365a3b7df8e154aecdcfa4daca1c97f4b951cb7843bf3c8ad60ef";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/ga-IE/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/ga-IE/thunderbird-140.12.0esr.tar.xz";
       locale = "ga-IE";
       arch = "linux-i686";
-      sha256 = "2a6e2d3631ae61956936f839c5926b0447dd435b0f01e23e6f9d2ef1943c66d4";
+      sha256 = "42bd37c9a1fe3447c73d03f2f9de98c9436660ebb38e196d0116575f87c85e57";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/gd/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/gd/thunderbird-140.12.0esr.tar.xz";
       locale = "gd";
       arch = "linux-i686";
-      sha256 = "b206f80708e217b928dae816e34d9a2150bfe30825853779c0ff24308f0b788b";
+      sha256 = "240db796b1226de3b49e2b69b77c7c5c8eb06ad154f636c0e1b0df668a5b7bfc";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/gl/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/gl/thunderbird-140.12.0esr.tar.xz";
       locale = "gl";
       arch = "linux-i686";
-      sha256 = "e934577623dc7f1e086207389b46221c5f126bb0068ab75ed8f328e8b153682d";
+      sha256 = "7ce6f8b93e71d253986bfcb1689bc855e28b2e2760c619f0f281ff184a3feee5";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/he/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/he/thunderbird-140.12.0esr.tar.xz";
       locale = "he";
       arch = "linux-i686";
-      sha256 = "6625eb3e5714b4701c3f932837373fb125f1796939858396b186ea96dc7ea390";
+      sha256 = "36e7a54adc1d45ceda5031605c84c1e37df7a8c46af5a6875366af6a572b84d0";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/hr/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/hr/thunderbird-140.12.0esr.tar.xz";
       locale = "hr";
       arch = "linux-i686";
-      sha256 = "2c1009505352e4635d7f26ffd70d349eb3d42f8cbd82d3957007a6e78a0a301b";
+      sha256 = "19357676e620fbb28eda02aceaa05ae92ec1c664dc981c37ea22700d18d2afb6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/hsb/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/hsb/thunderbird-140.12.0esr.tar.xz";
       locale = "hsb";
       arch = "linux-i686";
-      sha256 = "959dc26e5dc95ad761b446d99968eba0a28d96df81e9bf1c5f7037f7d42c6f5c";
+      sha256 = "d1b0ecc410560a47a6065b8b398dbaabc158f816186d3f63e57232a7c4f9dcaf";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/hu/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/hu/thunderbird-140.12.0esr.tar.xz";
       locale = "hu";
       arch = "linux-i686";
-      sha256 = "67704499a7cbb17a403586f4b3f87da8029f347d01c0a815b88094afbf6d9a36";
+      sha256 = "07194833837fc6dfdfd039e99aebe73c134c10c0ea132b43ea0136682207545a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/hy-AM/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/hy-AM/thunderbird-140.12.0esr.tar.xz";
       locale = "hy-AM";
       arch = "linux-i686";
-      sha256 = "c25bde4dab387304e5e87ebf0874746600403a0077329dfe03324abe006fa5ff";
+      sha256 = "45fe4943bc42dfce2a43bb2e42d86d868f55c13ff65903333c921c16f053677c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/id/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/id/thunderbird-140.12.0esr.tar.xz";
       locale = "id";
       arch = "linux-i686";
-      sha256 = "67e1b9b33f16f19f90a6913d04db8d312378b73cac4da7e2146cde306e0b7143";
+      sha256 = "9f353589846f36e4e8e38730ddb794f5b2ccea43218f3b688ca15ba56bdd4384";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/is/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/is/thunderbird-140.12.0esr.tar.xz";
       locale = "is";
       arch = "linux-i686";
-      sha256 = "89498071c81e3d4117976c91f5863512d700c3a26b9ea843c5e96163537d65a9";
+      sha256 = "795bb109b2947922fa37fc4481f7ee7f8ac5e84214e1730935d0b5fa76eea513";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/it/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/it/thunderbird-140.12.0esr.tar.xz";
       locale = "it";
       arch = "linux-i686";
-      sha256 = "102f8e8510473e6a93dc91c1395232c24f0e54df1da4da63c08080b133c4b6c8";
+      sha256 = "002b3b4b26c48b4a20c126eb297362e60559e54b427c5dc986b95943701fb7cf";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/ja/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/ja/thunderbird-140.12.0esr.tar.xz";
       locale = "ja";
       arch = "linux-i686";
-      sha256 = "3aa0922fec0c4631f24623ed08c8c6912426caf2839ab4124c58417128b6dc11";
+      sha256 = "89fc3f44eae88fe84c6b05614c5bab705ee77e335989d1f06f5805c27165d7cb";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/ka/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/ka/thunderbird-140.12.0esr.tar.xz";
       locale = "ka";
       arch = "linux-i686";
-      sha256 = "f4239740b4e511088bde916f168dc9a05dc85984c3ff35e2d471ec2e8b606660";
+      sha256 = "90fc0418b806c7d7a9e486f314dc4d6c0cf27fb3e6a728bdc8a2157fa3f67229";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/kab/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/kab/thunderbird-140.12.0esr.tar.xz";
       locale = "kab";
       arch = "linux-i686";
-      sha256 = "006acc5b65e26864e06f3fc8edd4e462e540ca03ec6e6d72a0e1fc73b531cd9b";
+      sha256 = "a5deee3473991f6b1aed7eff55daedd636968a8823448540eb30194c359c5622";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/kk/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/kk/thunderbird-140.12.0esr.tar.xz";
       locale = "kk";
       arch = "linux-i686";
-      sha256 = "1fa3c1d87134b8e16d619ad6186eaf61827c50edde35e97e149d5d0fe9dd7ae0";
+      sha256 = "a3f66fc880a81d570c3ebc25a54a4dfcebe3ca135daae2f6afd0c27695ed8fd7";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/ko/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/ko/thunderbird-140.12.0esr.tar.xz";
       locale = "ko";
       arch = "linux-i686";
-      sha256 = "a79794232413e466978ee067190c47f668637477981e6938d82251c1b66fd185";
+      sha256 = "191349bd6b473e9dd9710b61d5677b81da41573037f8c7f73f600697e9175df7";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/lt/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/lt/thunderbird-140.12.0esr.tar.xz";
       locale = "lt";
       arch = "linux-i686";
-      sha256 = "a89485d85e2e637e81de889ae6d69dd0407ff34a683d35d3ceacdc6abc3002a6";
+      sha256 = "6c06b42407a868e29041ab2759c0a100d110fb035178dd06c6b899718c8ebaa9";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/lv/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/lv/thunderbird-140.12.0esr.tar.xz";
       locale = "lv";
       arch = "linux-i686";
-      sha256 = "90a05ad24b9de9adefc3ebe56999f63a44b809243593a32e53d7f9925188e850";
+      sha256 = "39bf7d6a2ff69515fcf30be853961a6e51e95f4982c20d7eaad3b732abfb53e0";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/ms/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/ms/thunderbird-140.12.0esr.tar.xz";
       locale = "ms";
       arch = "linux-i686";
-      sha256 = "b309a1c322c0342a9bcfe48dfbf8c0fc73dd77b1237390c4cbf0b72c413496ef";
+      sha256 = "2aa551301599b7432c46c3d30cfceb250b2a856a337f31280b0cb181df01ad9b";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/nb-NO/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/nb-NO/thunderbird-140.12.0esr.tar.xz";
       locale = "nb-NO";
       arch = "linux-i686";
-      sha256 = "525f8b1e56cc3ea5b1c16d190489758a0e7af3013ee6491fdd8d3b8620cd5c59";
+      sha256 = "6d8e7173170bbbd507b0c7f06398a4099af05901d3257581adf69932b6db341a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/nl/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/nl/thunderbird-140.12.0esr.tar.xz";
       locale = "nl";
       arch = "linux-i686";
-      sha256 = "f5509e36added3e130d014988abbf023c0f9a580ef24fbf695efa5261e68cb96";
+      sha256 = "db1bac4729c7bbdf937de9fdf844a273b538891a8731b8dec5219fcfa719018c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/nn-NO/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/nn-NO/thunderbird-140.12.0esr.tar.xz";
       locale = "nn-NO";
       arch = "linux-i686";
-      sha256 = "972cd6c2f95376ab8af6878790be288076c871a75056cc30597f9f0d872ef560";
+      sha256 = "55d0018db9450fd5ac2973eca00d142803b0ec2646b1922d1ac158ae1dafc0de";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/pa-IN/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/pa-IN/thunderbird-140.12.0esr.tar.xz";
       locale = "pa-IN";
       arch = "linux-i686";
-      sha256 = "75ea1cd47d13fa174cb6b9f0e5fadf98cbf946e1433bd8521e5fcd270a6915d2";
+      sha256 = "2948ec961b64c313d2c19f2f999e451f8581f7dc28577093060475180f69a201";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/pl/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/pl/thunderbird-140.12.0esr.tar.xz";
       locale = "pl";
       arch = "linux-i686";
-      sha256 = "a38797492d37e59ec4b43f0af22a89b84c5f5d75e4e0c4c8964e81a845b4d119";
+      sha256 = "84231f7da445e4ab8b830947e78f600a00575ef57a64f9c298801a074fdc990f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/pt-BR/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/pt-BR/thunderbird-140.12.0esr.tar.xz";
       locale = "pt-BR";
       arch = "linux-i686";
-      sha256 = "f8b008e467bc8d42a7a8bc94e62693b7cc922135ac1ff4371a5beeb090606f9a";
+      sha256 = "04716af585200d122e2986de4b7c807f306cff73ea4a84751ccfb9fc281a37a6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/pt-PT/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/pt-PT/thunderbird-140.12.0esr.tar.xz";
       locale = "pt-PT";
       arch = "linux-i686";
-      sha256 = "d78f6ece643f3245f6182d64fa5ae85559feda053920c9bdb3ab728a8eab83e5";
+      sha256 = "15e1beb30097d402370c175e877ee3592702f2d72f54a6972c94634824d348c1";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/rm/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/rm/thunderbird-140.12.0esr.tar.xz";
       locale = "rm";
       arch = "linux-i686";
-      sha256 = "b6238ca303658ffe91c69295efcb0e47b7887b53c914eec189ba105a5a5140b9";
+      sha256 = "a7b4b228ea205ca30d659cb55363b5d4f52a13110858a5e9eec8ad6b94a4a28c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/ro/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/ro/thunderbird-140.12.0esr.tar.xz";
       locale = "ro";
       arch = "linux-i686";
-      sha256 = "b21ba5df7ef7153d5e7e3fbbadffaec870a671293bf70056c867b69bf9130706";
+      sha256 = "d126beb669b499d379030b73e15f47c8a5efa6f5f5884db7a21eb3272127403b";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/ru/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/ru/thunderbird-140.12.0esr.tar.xz";
       locale = "ru";
       arch = "linux-i686";
-      sha256 = "5504c9c7922aef8ab2895dcca5e0a91777bdf9c23b04b51e91311ff1e6c19cfb";
+      sha256 = "0842b0fd1c55fd47ab364e1f73be15eba7dafd810d34a56d45f36fce5bd1ac4d";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/sk/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/sk/thunderbird-140.12.0esr.tar.xz";
       locale = "sk";
       arch = "linux-i686";
-      sha256 = "7c5f26aa5dcaae38fbc304f2ddb378c9aebac38b6162c89f75952b4cbc20a4a9";
+      sha256 = "1b980e36a94b36efa7c60257480af9610f0db13dbaaff5272f82b9d8eae6b5c3";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/sl/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/sl/thunderbird-140.12.0esr.tar.xz";
       locale = "sl";
       arch = "linux-i686";
-      sha256 = "a464a4c90cdbfa9e8e1b1911bc0fa1e6d14fa1ab79aeb9787c734823f52500db";
+      sha256 = "6b1e6d6ccf704ca02f65d30162bdbc527cb27b3097cec2cf5274291f9ae20411";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/sq/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/sq/thunderbird-140.12.0esr.tar.xz";
       locale = "sq";
       arch = "linux-i686";
-      sha256 = "983fd50f8065ff1128162c0bc02d3ce0831811e63ecf2232a60fb539463c700b";
+      sha256 = "d0aac1d9c39aeab1767e629e82104797421961070905eaa7f46e049201547fa6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/sr/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/sr/thunderbird-140.12.0esr.tar.xz";
       locale = "sr";
       arch = "linux-i686";
-      sha256 = "42287c4beab560a65eb160d2cb29ef76aea4ad617b04bfc2ca5e31ffa56c5526";
+      sha256 = "7ea70111184ca1a4e039221b33fc886fdef72115219b40f174e94b0cb23a215f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/sv-SE/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/sv-SE/thunderbird-140.12.0esr.tar.xz";
       locale = "sv-SE";
       arch = "linux-i686";
-      sha256 = "665f3b3a5ecb750a4c9ed28cde5ed75cf2363ca17aa2d35c0fdcc4345c54139a";
+      sha256 = "483e0aa0aff479a47f8d9f910c3f783c6503d3968197c95c483a21cb128b95ba";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/th/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/th/thunderbird-140.12.0esr.tar.xz";
       locale = "th";
       arch = "linux-i686";
-      sha256 = "e1ed90e486f2f5e0204bf42b281c92ebaf69512200d072d59bbb3e3dcc3976a9";
+      sha256 = "52325f7f5f2e1a8d21dcb4ab5f5bc48ebe86fd96bc2ef4234e695e1d3f36b7e1";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/tr/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/tr/thunderbird-140.12.0esr.tar.xz";
       locale = "tr";
       arch = "linux-i686";
-      sha256 = "e152cb6a608fd4e8fd39dbd64836d08fe764da453117c15ebb182d0e6d86a14d";
+      sha256 = "ed291cf3f52fc625995fca6a986e4a621440210ccbffce8401bbbb9166d538a0";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/uk/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/uk/thunderbird-140.12.0esr.tar.xz";
       locale = "uk";
       arch = "linux-i686";
-      sha256 = "951b52b9092be3fdb102439d91d1637112b765236255ec5332023109f0989585";
+      sha256 = "ebe8eb38bc75d62824bff5ac6f6915cbc29a6847514b18ea377051a8c63f71ef";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/uz/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/uz/thunderbird-140.12.0esr.tar.xz";
       locale = "uz";
       arch = "linux-i686";
-      sha256 = "f8fb96e26415860d54a66defce161f3d838429a9d8350ce71e88f6caa43ea565";
+      sha256 = "95d33ec046461a940c5edd4170edd5b00311c7591f24720209200df2c8092875";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/vi/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/vi/thunderbird-140.12.0esr.tar.xz";
       locale = "vi";
       arch = "linux-i686";
-      sha256 = "780b6fd4d2ba00b63a4c6e7627b67414cf9c3cd63104d6a66697886cea126b21";
+      sha256 = "b037ea5128e005efe164553db0156cf3d63255598b21a6701e05f6cf72b38827";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/zh-CN/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/zh-CN/thunderbird-140.12.0esr.tar.xz";
       locale = "zh-CN";
       arch = "linux-i686";
-      sha256 = "bfb2f2624f6acf646fe355e8b225f43aff91074fe7769ec38a598cc70744398d";
+      sha256 = "83093ace3f6fbb2bdbf93d35315fef2b78ddf79b1f0adbba78a0084d22c8a120";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/linux-i686/zh-TW/thunderbird-140.11.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/linux-i686/zh-TW/thunderbird-140.12.0esr.tar.xz";
       locale = "zh-TW";
       arch = "linux-i686";
-      sha256 = "ef6a6c877a3974f3f2c9ab43f019dd4aade5103cbb2ba231846f057f9d335240";
+      sha256 = "0ee17bc1a388c022de88307d86d06b8dae855317d754cd9c16d061879764ae24";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/af/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/af/Thunderbird%20140.12.0esr.dmg";
       locale = "af";
       arch = "mac";
-      sha256 = "71384c413ed31247caf5162b2cd7afe37df565febad3dbbec4260204f1aca5df";
+      sha256 = "2e0fdeefd7f7379cad024983d99f1a279e32734194f3abc1e9be07d76ffdb221";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/ar/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/ar/Thunderbird%20140.12.0esr.dmg";
       locale = "ar";
       arch = "mac";
-      sha256 = "c1f52fa77f922c748720965930e9896ecb8df86d9271632b64f732ac15f635e7";
+      sha256 = "919530d0d7949d2183b8de0ddfd1fcd901c4987a74a2632ea61ebc35cf7e15ca";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/ast/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/ast/Thunderbird%20140.12.0esr.dmg";
       locale = "ast";
       arch = "mac";
-      sha256 = "4494a9119296b62c834a256baed1f6cfcc887a775749c476540532f775757b63";
+      sha256 = "fdddc5614c36f543070271edc6f88a5ec06c99423549f3bc453117bfa59931a9";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/be/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/be/Thunderbird%20140.12.0esr.dmg";
       locale = "be";
       arch = "mac";
-      sha256 = "666959b19337a26ff81f0ae8b48ac43368ea8e91b7c497073da5fff5b2ff14f3";
+      sha256 = "a13cea6ea1147fc1899f08f69c1290efa5ba2c8a8432fa8b35de70c429f7602e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/bg/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/bg/Thunderbird%20140.12.0esr.dmg";
       locale = "bg";
       arch = "mac";
-      sha256 = "633900af011489b54a465caa2767f51081bbe66c6da0840a94c96e53ab1e5e25";
+      sha256 = "6d2a156b30b65525536ceb4170dd0e4ac711ec5fb487345a05454e3d7143eac1";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/br/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/br/Thunderbird%20140.12.0esr.dmg";
       locale = "br";
       arch = "mac";
-      sha256 = "9841cba701ef1207bcb1c8cc5ba741968c4785a7f03f6005baa3026cb5d6e830";
+      sha256 = "edae45cfb19a182656111b5ce01120624d21e47812fe919038cfdeaebb14a0a4";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/ca/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/ca/Thunderbird%20140.12.0esr.dmg";
       locale = "ca";
       arch = "mac";
-      sha256 = "f595c3892d7626ab90b96580933016533ffa30032c35d56afd6b11099d1788d1";
+      sha256 = "161ba0d71513b5ed6284ee33bd1925f4f95a917d17a1bc5c3d932852e92f0877";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/cak/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/cak/Thunderbird%20140.12.0esr.dmg";
       locale = "cak";
       arch = "mac";
-      sha256 = "7ee4bd5badecda67bc6c02ffaea353d8225b800a3e3dad631d1f78e28cce19d0";
+      sha256 = "11241d8886db8933ee37011947e39edc16b253cb860adcd428b00bf5836352af";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/cs/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/cs/Thunderbird%20140.12.0esr.dmg";
       locale = "cs";
       arch = "mac";
-      sha256 = "367a85f54fbecd8476f598c9d5cc3eaa59846d9103c80b621698043fd8d46d8b";
+      sha256 = "9251cbd0342609dac36b7b4af04adc39389c43355652eb66b4aabf390ef888b6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/cy/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/cy/Thunderbird%20140.12.0esr.dmg";
       locale = "cy";
       arch = "mac";
-      sha256 = "13ac90da12ed2dbeb3f3715212d3aeaaad9b7e591e18d1b7fa1a131fd0903d11";
+      sha256 = "d0d3846ebdfd104479ea919531c1f58e5b6d762b884f49a8016c398c88c93dcb";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/da/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/da/Thunderbird%20140.12.0esr.dmg";
       locale = "da";
       arch = "mac";
-      sha256 = "44e07909b0702b93a6a9ecc58db518cc53f37ad51892cadf3ae7fae71506ae1c";
+      sha256 = "02db45f5ebcf68dea3175ff963ba74ab0997f1413728a4d991a5fe04efd4512b";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/de/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/de/Thunderbird%20140.12.0esr.dmg";
       locale = "de";
       arch = "mac";
-      sha256 = "fa754adbc3f907347052751567ef6f3ee5d77e6077f7e0fde20c4e7ac1b15677";
+      sha256 = "33e4ce4054784fed1e51f6fb3303781ffa98da413394c5554573dbf71e3b63e2";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/dsb/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/dsb/Thunderbird%20140.12.0esr.dmg";
       locale = "dsb";
       arch = "mac";
-      sha256 = "87512955ada4e34c18e43652a3a98f66b289cda1d2eef6758b65d2417d073fba";
+      sha256 = "964c730b7beea89ba59a628eb1c16c9e8f12a2292e7834e049bc2eafc98df266";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/el/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/el/Thunderbird%20140.12.0esr.dmg";
       locale = "el";
       arch = "mac";
-      sha256 = "b440215c64da72c295aae50f268d56fd19213cbab62b52735daaa7f6bf2b3673";
+      sha256 = "c254141f904fb8be38903fe7ea02d7799580a485afa4906655752ea749ce4db2";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/en-CA/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/en-CA/Thunderbird%20140.12.0esr.dmg";
       locale = "en-CA";
       arch = "mac";
-      sha256 = "c06aeafe163740b4cd0c6a8794131a72567e1396a7bcb45a0bd719256bb97b65";
+      sha256 = "5c4cf089440e80cb3a6e2b2c3523dc158da83ab31becc885f079345b5aa29ca7";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/en-GB/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/en-GB/Thunderbird%20140.12.0esr.dmg";
       locale = "en-GB";
       arch = "mac";
-      sha256 = "08963c43d94b2b8d0e16b746252da8d48c3015d92f512c63a2868f06ae0667b4";
+      sha256 = "ebc9759d712f3474e9b4124d827837757a2f7e96e2bba33d032d42304bfb9bf8";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/en-US/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/en-US/Thunderbird%20140.12.0esr.dmg";
       locale = "en-US";
       arch = "mac";
-      sha256 = "2bc10b29aed42ce6b6148f351d02042ed81510938fdeaef291894f1f536ebddd";
+      sha256 = "4bec2d760c561c9f0c47e0449c79859577d99f814cdd2439dee8af4423b89cb7";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/es-AR/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/es-AR/Thunderbird%20140.12.0esr.dmg";
       locale = "es-AR";
       arch = "mac";
-      sha256 = "5a596c72011d7e04fafa9edd17c48c5d56b0fa4b25b9774829ef1171519cb9e3";
+      sha256 = "1292d70d777876d94e5444b9620e899f64a18f648d8000b67293b2bc5beef2e2";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/es-ES/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/es-ES/Thunderbird%20140.12.0esr.dmg";
       locale = "es-ES";
       arch = "mac";
-      sha256 = "1a33b872d51c231746998398584840fcec9dbbb2ae5c9aaf85471805003d462e";
+      sha256 = "857bc067881d719f49d2e9a22635dc5d1b2277de7ab15bee44d7b6eb4ac0d0a4";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/es-MX/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/es-MX/Thunderbird%20140.12.0esr.dmg";
       locale = "es-MX";
       arch = "mac";
-      sha256 = "564f1c44ee6b2acb27daa93046af0e8b4df6030404ac2c15e69192a2db7b02af";
+      sha256 = "83a493497bccf3ce8b11a0be250f1ed4721140200b8e787f7c4eae39fe5f669e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/et/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/et/Thunderbird%20140.12.0esr.dmg";
       locale = "et";
       arch = "mac";
-      sha256 = "7f91c172337ab957fa2a432d81929ec7505e510f84ce5c51db5be98679782aa0";
+      sha256 = "925c19faf90e80aae4768e1f42eacb4ddce6388200bea8faaee3d46f85df33c5";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/eu/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/eu/Thunderbird%20140.12.0esr.dmg";
       locale = "eu";
       arch = "mac";
-      sha256 = "44778d36575fa0925e959042097896024fda1818e3148092da80b40afc711d25";
+      sha256 = "3bbd84bf2f5ecad3d7f49671f2d056db2bfc129b6384054140eeb359575ada10";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/fi/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/fi/Thunderbird%20140.12.0esr.dmg";
       locale = "fi";
       arch = "mac";
-      sha256 = "0651b37a0e4783a082741e83393514cfb1c874fedba7d5383eca4015faf8111c";
+      sha256 = "38107d8059b94ae9b3693a849cc59ef80e64286069f02bd21e653c05004ed4c1";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/fr/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/fr/Thunderbird%20140.12.0esr.dmg";
       locale = "fr";
       arch = "mac";
-      sha256 = "dcd4962c03ad913772dea4b21994efa6f2b4a8d7a9aaa7f25f8256c2f219c01e";
+      sha256 = "7482b9769bc8bd8307372a44177287ffff08be4a1c26ccd0e40b8b77cadfa983";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/fy-NL/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/fy-NL/Thunderbird%20140.12.0esr.dmg";
       locale = "fy-NL";
       arch = "mac";
-      sha256 = "e273ad2248947a28482f3bbbc940bb82a50c1e7c9f2b138a9bd672db47394e2d";
+      sha256 = "6a50829984026c3f30a8d5da0533eab13e0dc015ea6e19a329e26723afe48e16";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/ga-IE/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/ga-IE/Thunderbird%20140.12.0esr.dmg";
       locale = "ga-IE";
       arch = "mac";
-      sha256 = "ef295ce6bb41f10ed2a9b46ad78b92693493886b4527e4b2f3b339cfcaed1006";
+      sha256 = "2ffa979b1d0fa1bb4ea0e025cdc6238d389d2c57f284c410763a9b74facbfc6e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/gd/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/gd/Thunderbird%20140.12.0esr.dmg";
       locale = "gd";
       arch = "mac";
-      sha256 = "c20587243b2c52155f36383c9d7807c77888db10828d9a452aeb2ad2818d9940";
+      sha256 = "b2ace43f1ba130cb04d68becdf8c0f2e8340d21e8050ac525b7b70dc68f4bd67";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/gl/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/gl/Thunderbird%20140.12.0esr.dmg";
       locale = "gl";
       arch = "mac";
-      sha256 = "5fb722d840f6ba1ad387618c4cc12948d0c3f29154eb27fbe80faa152a45fa72";
+      sha256 = "4a88092f150764d394551efef019cf175844e231c88ec2270ca7242e329f9366";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/he/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/he/Thunderbird%20140.12.0esr.dmg";
       locale = "he";
       arch = "mac";
-      sha256 = "7467a99abe96bc08ed288fe233f5f4200f29dec876715471df94b5715b5b52da";
+      sha256 = "6f49b7f4d4c21822d14ec73e4293f15e301725f43d6a815d80bf811fed7446ac";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/hr/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/hr/Thunderbird%20140.12.0esr.dmg";
       locale = "hr";
       arch = "mac";
-      sha256 = "3673ed4900ca38a8fc3ecf491c1106bfd8fd62f73b0f1b5d72c19f6a097e894f";
+      sha256 = "de1f296a66addcee616022c1dd552a4a040591dec9363730be2f79469dfa283f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/hsb/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/hsb/Thunderbird%20140.12.0esr.dmg";
       locale = "hsb";
       arch = "mac";
-      sha256 = "0f8cc936971b3aad9b4825f7b6a44f49b3d1cb131fec95b9e09a298b6dfa7c4d";
+      sha256 = "ce9dbd7b9c26e330639d2802a9e76ced183a1e0be11b7c99daf4a684d27ac137";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/hu/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/hu/Thunderbird%20140.12.0esr.dmg";
       locale = "hu";
       arch = "mac";
-      sha256 = "b3b526480a8580f534f56a15792b8c04d356b78b8055e88f34ea7589d5ec395c";
+      sha256 = "dba387610be4ff84367744705cf3311d31d417efb2fab4398c93d28c1e78e865";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/hy-AM/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/hy-AM/Thunderbird%20140.12.0esr.dmg";
       locale = "hy-AM";
       arch = "mac";
-      sha256 = "58ed43d6933d7b0d70935abcd816a035344b346bf5353b9c0b83b8e97e01be5c";
+      sha256 = "97ecff4bcf7cabb182bfe0575ef1f67d655307c2559296e3c4c75c58e59ae7e3";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/id/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/id/Thunderbird%20140.12.0esr.dmg";
       locale = "id";
       arch = "mac";
-      sha256 = "da3db2edf3773e80976c378c52b522d4019a69a1f14df0c08679587310561248";
+      sha256 = "aa2510109c6c5c8e14120aa9b3fbc98e352ba1de8355e86437d831023a59c4bb";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/is/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/is/Thunderbird%20140.12.0esr.dmg";
       locale = "is";
       arch = "mac";
-      sha256 = "db3966328ab4a5e9cf8783cccdca5955bfd7c049ca772d7f2e9955078d83989d";
+      sha256 = "3b92dbab9ae2f9bede01dc84fa744cc51b9185e0b5b3c62cc3e4334dcc8d2e40";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/it/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/it/Thunderbird%20140.12.0esr.dmg";
       locale = "it";
       arch = "mac";
-      sha256 = "7297c55daeeabcd2a60fb55699f1387609e7a3eb9bac3f81a86d1bdb31bd4299";
+      sha256 = "e5168dc2fe6762fdcf20dc1ccb7e863a0c555bad49faf87725bb71a77e7d2e41";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/ja-JP-mac/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/ja-JP-mac/Thunderbird%20140.12.0esr.dmg";
       locale = "ja-JP-mac";
       arch = "mac";
-      sha256 = "78b03aa4af0af37662aff128570964017a730727d9e8baaa6d58ddbb850c15cb";
+      sha256 = "a08cfce46e7f1fbb6b223acdb094325b6de30b1a162b696b183713810a8b2bfa";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/ka/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/ka/Thunderbird%20140.12.0esr.dmg";
       locale = "ka";
       arch = "mac";
-      sha256 = "48a6a8fa454da3f2aabe9734ed3271354f26146b6bb63fd0e84c9ca66e525242";
+      sha256 = "945029e3b61dca49426bcc839a9b03c5c20fcb837c0ba9c63672cb11b34ae266";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/kab/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/kab/Thunderbird%20140.12.0esr.dmg";
       locale = "kab";
       arch = "mac";
-      sha256 = "f93bbc335e9117b0bd8b4553a9f908d7088083251c59e8818cfd37f6f9ea000c";
+      sha256 = "a4077c9aad04635490e02dd48e332c222d06bc8a105230fdb366ecd8525b5c95";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/kk/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/kk/Thunderbird%20140.12.0esr.dmg";
       locale = "kk";
       arch = "mac";
-      sha256 = "4898a0e073caf10b3d886f902a99658073f79484ab23faf8ac2d44b4e1066a5c";
+      sha256 = "93d37e9d5d2d57389932b405cb26b45cced1cd8cdef3fe77001f103072d38230";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/ko/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/ko/Thunderbird%20140.12.0esr.dmg";
       locale = "ko";
       arch = "mac";
-      sha256 = "bed653c957c9cf392b2b33acac927c7c695b051daafc5c3e2e1df0606b39f602";
+      sha256 = "1ed911f9f676b795da6c3cd5ed9dd264c0f9e9bc29d88cf10bb8695c4a407eeb";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/lt/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/lt/Thunderbird%20140.12.0esr.dmg";
       locale = "lt";
       arch = "mac";
-      sha256 = "a46821ce5e80703f5b98590343491f25aad4d42f46606729612c200f7826a5b0";
+      sha256 = "8c274dbd53b8e55030a99a67ad2e632488377b640e2b998f5d49f01f65d3d441";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/lv/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/lv/Thunderbird%20140.12.0esr.dmg";
       locale = "lv";
       arch = "mac";
-      sha256 = "5745ed7e1e54f292e540124b027070fd132807955712722d7ec0b842655873ca";
+      sha256 = "8ee5f2bf9dd9fe4a1332f3ac5105e8adfa14150145342dc94d7092ad44568961";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/ms/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/ms/Thunderbird%20140.12.0esr.dmg";
       locale = "ms";
       arch = "mac";
-      sha256 = "c4f827aa57cde10bd59e24e34a285762d1f765027f6ad834735a2a4a97155b2c";
+      sha256 = "ba433bcf9440bda7713cbe75aa2488f5c998522e9797748c669024f5d3586a96";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/nb-NO/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/nb-NO/Thunderbird%20140.12.0esr.dmg";
       locale = "nb-NO";
       arch = "mac";
-      sha256 = "846c2a0f9b6d118911f2623e949192acc492b37b086e9356b52875357b623945";
+      sha256 = "6cf11acb2f0dbe170131c843890bbc4002876fb86564b893e938f190c9505d72";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/nl/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/nl/Thunderbird%20140.12.0esr.dmg";
       locale = "nl";
       arch = "mac";
-      sha256 = "48e6e7be5ea330b39653bdbfca4835db02c9545c51627f8411f8886b70838da9";
+      sha256 = "2c29c2ed59ff87b40e18f686529a569ff107002572e41ccaeb0fb5dcf77e8bc8";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/nn-NO/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/nn-NO/Thunderbird%20140.12.0esr.dmg";
       locale = "nn-NO";
       arch = "mac";
-      sha256 = "f1b28f4583fac39e57b173040df702d650011c1925082a91b3d630749a6db67f";
+      sha256 = "9adab55768e444a8de8d8cd0ef2551f0df218724781f1995c12f23ebde283f78";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/pa-IN/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/pa-IN/Thunderbird%20140.12.0esr.dmg";
       locale = "pa-IN";
       arch = "mac";
-      sha256 = "535cc3c913cb47b4d9dc540c17ba06d8a885904b2a44a0da4e039af010d70bb6";
+      sha256 = "c617dfc2d9c0df00e687492a8f21c4fe8643a82742bfb804f957b721a904f064";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/pl/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/pl/Thunderbird%20140.12.0esr.dmg";
       locale = "pl";
       arch = "mac";
-      sha256 = "4195b67da5ea25f656f44523a111fc0e5876b299b5293e015c651f9a12833062";
+      sha256 = "08accf38faf4c6d4b3d6197f038ce628cfab8506a9e3ccda3c4865b198f6b81f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/pt-BR/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/pt-BR/Thunderbird%20140.12.0esr.dmg";
       locale = "pt-BR";
       arch = "mac";
-      sha256 = "e0b1ee7eacc6252d6bfb7233504c17c8ed178048dfb34fb1294d2624203e2cca";
+      sha256 = "e3d2baab5763d393d70e0dfec48307894db8d14bd62954b912d5d659dfd93a62";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/pt-PT/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/pt-PT/Thunderbird%20140.12.0esr.dmg";
       locale = "pt-PT";
       arch = "mac";
-      sha256 = "2b9518c194259e570be52a866a13119f8a53effc8ccf47e602a0301bf51e5645";
+      sha256 = "0dd0e195fd9f445cc426120a001b0777441953af3ede4bdb2ab0a7665d0a416d";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/rm/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/rm/Thunderbird%20140.12.0esr.dmg";
       locale = "rm";
       arch = "mac";
-      sha256 = "3b184d62ac323cf4617693dbc3fded23edc0f6e24ae0184310e0b3114cce2442";
+      sha256 = "5d3e5500b1be9de217f38e0b16327ff9c98938f4b25371f724d84b949ae5e42e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/ro/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/ro/Thunderbird%20140.12.0esr.dmg";
       locale = "ro";
       arch = "mac";
-      sha256 = "361ff7aec05dde3c141193fa02c51ff5233ed5c6164ad2f592c5c019029f0935";
+      sha256 = "cdaee775ac4c6376ea9cbc4297be14f9dc470fcc46453bb54eee31e31896ff71";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/ru/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/ru/Thunderbird%20140.12.0esr.dmg";
       locale = "ru";
       arch = "mac";
-      sha256 = "0a4f588fbff81465284f80e46556577860cf4e39e091c9e35c3e5478a4a4f568";
+      sha256 = "faa160c7361c3429a046a85c69f5b14708f57599f6458b443aab32db0a333d14";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/sk/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/sk/Thunderbird%20140.12.0esr.dmg";
       locale = "sk";
       arch = "mac";
-      sha256 = "74104f7ff10755d3fffa97c9fc00c71011808a3247b9c895e72323ed393ba0c6";
+      sha256 = "d7c87822ee32fe5265114c38591234c78138a42bb521e8127a84d383f3ab1c2e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/sl/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/sl/Thunderbird%20140.12.0esr.dmg";
       locale = "sl";
       arch = "mac";
-      sha256 = "0a8aa57d7e45c3831a5a0ff67ca2a0617a9a580bd1bc543c6956d13d9fab5ebc";
+      sha256 = "bdcdab4d795dfaa82a9e95f85dc8556088fd75b5e617ca6b625f51b0d5bba121";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/sq/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/sq/Thunderbird%20140.12.0esr.dmg";
       locale = "sq";
       arch = "mac";
-      sha256 = "c1049a86ec71f56ca56fa9ce0af245fc84afc600274f572376c62dea9c06f1dc";
+      sha256 = "58ab147078ba465a1e140f200859b84d2db9ba64b41c4f5b267f9726e59e231e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/sr/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/sr/Thunderbird%20140.12.0esr.dmg";
       locale = "sr";
       arch = "mac";
-      sha256 = "ea00bccc0d461dd18f8bceb3d5291f0d8938ec33cfe4f3a62f340eba1d7e0d0c";
+      sha256 = "aa5d4ac91710f11dad6582ee15a0872c700f3d19a2d4d92bd02a8c7bb6d6e846";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/sv-SE/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/sv-SE/Thunderbird%20140.12.0esr.dmg";
       locale = "sv-SE";
       arch = "mac";
-      sha256 = "8cc6fed9ca0f5dd538b4b0f7847ed288d3dce1417e3711a8108d407506334116";
+      sha256 = "41a5eee8d58eeacc65304c4cee5a15c5f2323ea472cbc80b80a2593388f008ad";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/th/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/th/Thunderbird%20140.12.0esr.dmg";
       locale = "th";
       arch = "mac";
-      sha256 = "c9ea193f65ded29b4b7fe95b976e2b3986991fc27ce2c36644c3b19d670897a1";
+      sha256 = "e5b9ce0a7505b2020770526b8eca12c828cee60001133dfcb16aec8b69212c7c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/tr/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/tr/Thunderbird%20140.12.0esr.dmg";
       locale = "tr";
       arch = "mac";
-      sha256 = "599f39c1e9afc484e93a889d4c61b6951cc4ea6bc3cc97c3b89d233e053f07b6";
+      sha256 = "253af75f50478888326b9743700a9fa24490be489a5b2b578922d956db81f9b1";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/uk/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/uk/Thunderbird%20140.12.0esr.dmg";
       locale = "uk";
       arch = "mac";
-      sha256 = "fa31863b8cbd39628cfa8c6e1e6152ba44d12e1b2545f02ba12651c0ea236b5a";
+      sha256 = "bdce24c7597a7aca79d195a1ec3cae38ad8d659f3912733513422bc74414b8d5";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/uz/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/uz/Thunderbird%20140.12.0esr.dmg";
       locale = "uz";
       arch = "mac";
-      sha256 = "dc14d21c99880d48646d3207091d3ca6771da82384a8d89004964b6d013297ae";
+      sha256 = "f91de21e432f5102a2ad9c701056a7ee75af98abd390a3a5d9c7dd855dd46774";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/vi/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/vi/Thunderbird%20140.12.0esr.dmg";
       locale = "vi";
       arch = "mac";
-      sha256 = "6284f3cb464dfd22a4277bdcbf8a02cbd4a8a2b3906ef0a4c8afcb189c509a08";
+      sha256 = "43e0863fe63a6fa41a069179a66e83e9f354ea9791c74ed8562ae973b7b955e3";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/zh-CN/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/zh-CN/Thunderbird%20140.12.0esr.dmg";
       locale = "zh-CN";
       arch = "mac";
-      sha256 = "56813d07d216c08b101b9368913ecdd95ad01163dfb925acce3942056ef7be40";
+      sha256 = "16042334de8c07a138c726d6a6c3d6cfc6ce18d95cc24f3c8f50583ed4cbfb8c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.11.1esr/mac/zh-TW/Thunderbird%20140.11.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.0esr/mac/zh-TW/Thunderbird%20140.12.0esr.dmg";
       locale = "zh-TW";
       arch = "mac";
-      sha256 = "950f3f82e472db1aa408ec50817e40225c38b4511d66ba727240e1c42cc64e10";
+      sha256 = "c0accf5e3e3e6bc20d9f6a745f9812530d2d61e685c469bb24c01db277b03f3a";
     }
   ];
 }

From d1d9fbc14a6facdd8de3ec7d4276b0e419c6631e Mon Sep 17 00:00:00 2001
From: Michael Wang <michael_wzq@icloud.com>
Date: Sat, 20 Jun 2026 11:21:49 +1000
Subject: [PATCH 050/210] maintainers: add zwang20

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 457bacdcdee1..979bfbe161df 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -31159,6 +31159,12 @@
     github = "zuzuleinen";
     githubId = 944919;
   };
+  zwang20 = {
+    name = "Michael Wang";
+    github = "zwang20";
+    githubId = 41721295;
+    matrix = "@michael_wzq:matrix.org";
+  };
   zx2c4 = {
     email = "Jason@zx2c4.com";
     github = "zx2c4";

From c3a1f8a838106b2e191350256c88861d2287b4e5 Mon Sep 17 00:00:00 2001
From: Michael Wang <michael_wzq@icloud.com>
Date: Thu, 25 Jun 2026 14:26:18 +1000
Subject: [PATCH 051/210] rpcbind: 1.2.6 -> 1.2.9
 https://sourceforge.net/projects/rpcbind/files/rpcbind/1.2.9/

---
 pkgs/by-name/rp/rpcbind/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/rp/rpcbind/package.nix b/pkgs/by-name/rp/rpcbind/package.nix
index 4ecf858d9e16..2dcdc8577d40 100644
--- a/pkgs/by-name/rp/rpcbind/package.nix
+++ b/pkgs/by-name/rp/rpcbind/package.nix
@@ -10,14 +10,14 @@
   systemd,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rpcbind";
-  version = "1.2.6";
+  version = "1.2.9";
 
   src = fetchgit {
     url = "git://git.linux-nfs.org/projects/steved/rpcbind.git";
-    rev = "c0c89b3bf2bdf304a5fe3cab626334e0cdaf1ef2";
-    hash = "sha256-aidETIZaQYzC3liDGM915wyBWpMrn4OudxEcFS/Iucw=";
+    rev = "refs/tags/rpcbind-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
+    hash = "sha256-uiUGSCUkFTFl+hqzXgJEjl4WZCcMi+QxuAGmY0g+fs4=";
   };
 
   patches = [
@@ -48,9 +48,9 @@ stdenv.mkDerivation {
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
     homepage = "https://linux-nfs.org/";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ zwang20 ];
     longDescription = ''
       Universal addresses to RPC program number mapper.
     '';
   };
-}
+})

From f371b4a14d6883c898c57a08104a4011e1380385 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 07:43:57 +0000
Subject: [PATCH 052/210] n8n: 2.25.7 -> 2.27.4

---
 pkgs/by-name/n8/n8n/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 0e91e2fd604c..11e0fa4396a9 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -26,20 +26,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.25.7";
+  version = "2.27.4";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-V8CqEzCw4DcLPCao4HRXrJXFeID2+Ef8fNW1xd1b8Vs=";
+    hash = "sha256-Z8oAetoSJLTCO7UO+DrlSDFAIjLSLND9bQzrcLz0hYg=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-JS4OY6CmihsbJRyPszSlNUEViFKfLm2vu+G2upIoLW8=";
+    hash = "sha256-xTZlv8YZC8u9pzD/WroduyO2MVtRvZ7ajKTphsHfObs=";
   };
 
   nativeBuildInputs = [

From 1fc433dc5174ec33192b1d59f6e65c9beed7e9ef Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 20 Jun 2026 21:35:49 +0200
Subject: [PATCH 053/210] nixos/systemd/repart: add Varlink socket

This enables the ability to use systemd-repart over Varlink at
/run/systemd/io.systemd.Repart.

Change-Id: Ia74fdf8c2cbc4ec52994ba8ceb5796acc731abd3
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/modules/system/boot/systemd.nix        | 5 +++++
 nixos/modules/system/boot/systemd/repart.nix | 6 ++++++
 pkgs/os-specific/linux/systemd/default.nix   | 1 +
 3 files changed, 12 insertions(+)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 75b4143d6810..f218863ecf05 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -209,6 +209,11 @@ let
     "dbus-org.freedesktop.portable1.service"
     "systemd-portabled.service"
   ]
+  ++ optionals cfg.package.withRepart [
+    # Varlink APIs
+    "systemd-repart@.service"
+    "systemd-repart.socket"
+  ]
   ++ [
     "systemd-exit.service"
     "systemd-update-done.service"
diff --git a/nixos/modules/system/boot/systemd/repart.nix b/nixos/modules/system/boot/systemd/repart.nix
index fce8e417991d..2126464c5250 100644
--- a/nixos/modules/system/boot/systemd/repart.nix
+++ b/nixos/modules/system/boot/systemd/repart.nix
@@ -157,6 +157,12 @@ in
     boot.initrd.systemd = lib.mkIf initrdCfg.enable {
       additionalUpstreamUnits = [
         "systemd-repart.service"
+        # Varlink APIs
+        # NOTE: compared to stage 2 where the IPC is enabled in the global location, initrd
+        # might be optimized to keep away the repart binary.
+        # As a result, we enable repart IPC in the initrd only if repart is enabled in the initrd.
+        "systemd-repart.socket"
+        "systemd-repart@.service"
       ];
 
       storePaths = [
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index f0fb666cd8de..47dc60f1d20b 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -703,6 +703,7 @@ stdenv.mkDerivation (finalAttrs: {
       withMachined
       withNetworkd
       withNspawn
+      withRepart
       withPortabled
       withSysupdate
       withTimedated

From 7dacd14febf4c7b8247ce2033e9bcf0faadae76a Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 20 Jun 2026 21:43:24 +0200
Subject: [PATCH 054/210] nixos/systemd/ask-password: add Varlink API

This adds io.systemd.AskPassword Varlink API by default.

Change-Id: I45b9a53d489ec3ea5561006c9c91ccb7016b3ee1
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/modules/system/boot/systemd.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index f218863ecf05..ee6a64189c46 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -157,6 +157,8 @@ let
     "systemd-ask-password-wall.service"
 
     # Varlink APIs
+    "systemd-ask-password@.service"
+    "systemd-ask-password.socket"
   ]
   ++ lib.optionals cfg.package.withBootloader [
     "systemd-bootctl@.service"

From 3003651b5ab140b6287de122cebdd7098890d60a Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 20 Jun 2026 21:43:55 +0200
Subject: [PATCH 055/210] nixos/systemd/importd: add Varlink API

This adds io.systemd.Import by default.

Change-Id: Idad216f83af2f3402b864a162373f04968725b7b
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/modules/system/boot/systemd.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index ee6a64189c46..81acb33df53b 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -180,6 +180,7 @@ let
   ]
   ++ optionals cfg.package.withImportd [
     "systemd-importd.service"
+    "systemd-importd.socket"
   ]
   ++ optionals cfg.package.withMachined [
     "machine.slice"

From ff55fdd00331493823ddd2fad7d898ed70d9ac13 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 20 Jun 2026 21:44:30 +0200
Subject: [PATCH 056/210] nixos/systemd/machined: add Varlink API

This adds io.systemd.Machine by default.

Change-Id: I05e595d22ad06504e2b3aacb48c74e7683057ce3
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/modules/system/boot/systemd.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 81acb33df53b..41ccdcd0e4bb 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -186,6 +186,7 @@ let
     "machine.slice"
     "machines.target"
     "systemd-machined.service"
+    "systemd-machined.socket"
   ]
   ++ optionals cfg.package.withNspawn [
     "systemd-nspawn@.service"

From 65cdcfc1331469f005923fd2dcbe305348f76631 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 20 Jun 2026 21:44:55 +0200
Subject: [PATCH 057/210] nixos/systemd/mute-console: add Varlink API

This adds io.systemd.MuteConsole by default.

Change-Id: I613d5f12e5b2742206c3023e4d57ccdfbaf0e704
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/modules/system/boot/systemd.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 41ccdcd0e4bb..71b166b998a9 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -195,6 +195,9 @@ let
     # Misc.
     "systemd-sysctl.service"
     "systemd-machine-id-commit.service"
+
+    "systemd-mute-console@.service"
+    "systemd-mute-console.socket"
   ]
   ++ optionals cfg.package.withTimedated [
     "dbus-org.freedesktop.timedate1.service"

From b8b65f1616d2b913f82324344315937650adae58 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 20 Jun 2026 21:45:16 +0200
Subject: [PATCH 058/210] nixos/systemd/factory-reset: add Varlink API

This adds io.systemd.FactoryReset by default.

Change-Id: I2ef8ae8812e76bc81a5f962e9bfeb99967f6df83
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/modules/system/boot/systemd.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 71b166b998a9..4149cda3e1e5 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -233,6 +233,8 @@ let
     "factory-reset.target"
     "systemd-factory-reset-request.service"
     "systemd-factory-reset-reboot.service"
+    "systemd-factory-reset@.service"
+    "systemd-factory-reset.socket"
   ]
   ++ cfg.additionalUpstreamSystemUnits;
 

From 04f7553ac2a5ecd6f01f3811eee6cabbbea8a8c7 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 20 Jun 2026 21:49:52 +0200
Subject: [PATCH 059/210] nixos/systemd/networkd: add Varlink APIs

This adds:

- /run/systemd/resolve.hook/io.systemd.Network (DNS hook)
- /run/systemd/report/io.systemd.Network (metrics)
- /run/systemd/netif/io.systemd.Network (management)

Change-Id: I3d63b0723ae5f8f9496418d8f5d857809302155e
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/modules/system/boot/networkd.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index 2b14caac86fa..4a22d6585eb9 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -4231,8 +4231,10 @@ let
           "systemd-networkd-wait-online@.service"
           "systemd-networkd.service"
           "systemd-networkd.socket"
-          "systemd-networkd-persistent-storage.service"
+          "systemd-networkd-resolve-hook.socket"
           "systemd-networkd-varlink-metrics.socket"
+          "systemd-networkd-varlink.socket"
+          "systemd-networkd-persistent-storage.service"
         ];
 
         systemd.sockets.systemd-networkd-varlink-metrics.wantedBy = [ "sockets.target" ];
@@ -4314,6 +4316,9 @@ let
         systemd.additionalUpstreamUnits = [
           "systemd-networkd-wait-online.service"
           "systemd-networkd.service"
+          "systemd-networkd-resolve-hook.socket"
+          "systemd-networkd-varlink-metrics.socket"
+          "systemd-networkd-varlink.socket"
           "systemd-networkd.socket"
           "systemd-network-generator.service"
           "network-online.target"

From 5c6a1e2b3d5a79cea0e4941ebaffef9226cccd28 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 20 Jun 2026 21:51:05 +0200
Subject: [PATCH 060/210] nixos/systemd/udevd: add Varlink API

This adds io.systemd.Udev by default.

Change-Id: I41fec3831049aec03041a9ac8a282088e1773b79
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/modules/system/boot/systemd.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 4149cda3e1e5..acfb213b98e0 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -65,6 +65,7 @@ let
     # Udev.
     "systemd-udevd-control.socket"
     "systemd-udevd-kernel.socket"
+    "systemd-udevd-varlink.socket"
     "systemd-udevd.service"
   ]
   ++ (optional (!config.boot.isContainer) "systemd-udev-trigger.service")

From 13684b8470a62303a3659b759a44fc2eb1112664 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 20 Jun 2026 21:52:02 +0200
Subject: [PATCH 061/210] nixos/systemd/resolved: add Varlink APIs

This adds:

- /run/systemd/resolve/io.systemd.Resolve (resolution)
- /run/systemd/resolve/io.systemd.Resolve.Monitor (monitoring)

Change-Id: I43f22be5c42757f3dad1e4a9d209b0a91f404a55
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/modules/system/boot/resolved.nix | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix
index da2b57285a76..6760dab044e9 100644
--- a/nixos/modules/system/boot/resolved.nix
+++ b/nixos/modules/system/boot/resolved.nix
@@ -185,7 +185,11 @@ in
       # added with order 501 to allow modules to go before with mkBefore
       system.nssDatabases.hosts = (mkOrder 501 [ "resolve [!UNAVAIL=return]" ]);
 
-      systemd.additionalUpstreamSystemUnits = [ "systemd-resolved.service" ];
+      systemd.additionalUpstreamSystemUnits = [
+        "systemd-resolved.service"
+        "systemd-resolved-monitor.socket"
+        "systemd-resolved-varlink.socket"
+      ];
 
       systemd.services.systemd-resolved = {
         wantedBy = [ "sysinit.target" ];
@@ -248,7 +252,12 @@ in
         tmpfiles.settings.systemd-resolved-stub."/etc/resolv.conf".L.argument =
           "/run/systemd/resolve/stub-resolv.conf";
 
-        additionalUpstreamUnits = [ "systemd-resolved.service" ];
+        additionalUpstreamUnits = [
+          "systemd-resolved.service"
+          "systemd-resolved-monitor.socket"
+          "systemd-resolved-varlink.socket"
+        ];
+
         users.systemd-resolve = { };
         groups.systemd-resolve = { };
         storePaths = [ "${config.boot.initrd.systemd.package}/lib/systemd/systemd-resolved" ];

From 588eb06fccd1087ecbcff36bfa9da229b1fbf9be Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 20 Jun 2026 21:53:21 +0200
Subject: [PATCH 062/210] nixos/systemd/tpm2/pcrextend: add Varlink API

This adds io.systemd.PCRExtend if the system has TPM2
enabled.

Additionally, this requires the system to fullfill
ConditionSecurity=measured-uki.

Change-Id: I3f1046cdc7463f3b6d3205030f7f12ac95e5cd9e
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/modules/system/boot/systemd/tpm2.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/system/boot/systemd/tpm2.nix b/nixos/modules/system/boot/systemd/tpm2.nix
index 2703d60428f1..de0f72e5a543 100644
--- a/nixos/modules/system/boot/systemd/tpm2.nix
+++ b/nixos/modules/system/boot/systemd/tpm2.nix
@@ -43,6 +43,8 @@
           "tpm2.target"
           "systemd-tpm2-setup-early.service"
           "systemd-tpm2-setup.service"
+          "systemd-pcrextend.socket"
+          "systemd-pcrextend@.service"
         ];
       }
     )
@@ -69,6 +71,8 @@
         boot.initrd.systemd.additionalUpstreamUnits = [
           "tpm2.target"
           "systemd-tpm2-setup-early.service"
+          "systemd-pcrextend.socket"
+          "systemd-pcrextend@.service"
         ];
 
         boot.initrd.availableKernelModules = [
@@ -81,6 +85,7 @@
           pkgs.tpm2-tss
           "${cfg.package}/lib/systemd/systemd-tpm2-setup"
           "${cfg.package}/lib/systemd/system-generators/systemd-tpm2-generator"
+          "${cfg.package}/lib/systemd/systemd-pcrextend"
         ];
       }
     )
@@ -89,7 +94,9 @@
         cfg = config.boot.initrd.systemd;
       in
       lib.mkIf (cfg.enable && cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) {
-        boot.initrd.systemd.additionalUpstreamUnits = [ "systemd-pcrphase-initrd.service" ];
+        boot.initrd.systemd.additionalUpstreamUnits = [
+          "systemd-pcrphase-initrd.service"
+        ];
         boot.initrd.systemd.services.systemd-pcrphase-initrd.wantedBy = [ "initrd.target" ];
         boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ];
       }

From 7a95244dd85e6d721ac568717bd8e792668b17f5 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 20 Jun 2026 22:41:38 +0200
Subject: [PATCH 063/210] nixos/tests/systemd-varlink: init

This maintains the fact that some IPCs are now observed and becomes
"public API" in NixOS as long as systemd makes them public APIs.

This can be generalized to a generic public-varlink-apis test once other
vendors obtains APIs which are defacto in the system, e.g. NixOS's IPCs.

Change-Id: I182965b0cd043b55bc7bbab572c9f0d50142eda9
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
---
 nixos/tests/all-tests.nix       |  1 +
 nixos/tests/systemd-varlink.nix | 46 +++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 nixos/tests/systemd-varlink.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 93ec2703c3e5..23d4b14284ba 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1676,6 +1676,7 @@ in
   systemd-user-settings = runTest ./systemd-user-settings.nix;
   systemd-user-tmpfiles-rules = runTest ./systemd-user-tmpfiles-rules.nix;
   systemd-userdbd = runTest ./systemd-userdbd.nix;
+  systemd-varlink = runTest ./systemd-varlink.nix;
   systemtap = handleTest ./systemtap.nix { };
   szurubooru = handleTest ./szurubooru.nix { };
   taler = handleTest ./taler { };
diff --git a/nixos/tests/systemd-varlink.nix b/nixos/tests/systemd-varlink.nix
new file mode 100644
index 000000000000..df5d7cbb73a3
--- /dev/null
+++ b/nixos/tests/systemd-varlink.nix
@@ -0,0 +1,46 @@
+{ lib, ... }:
+{
+  name = "systemd-varlink";
+  meta.maintainers = [ lib.maintainers.raitobezarius ];
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      networking.useNetworkd = true;
+      services.resolved.enable = true;
+      systemd.network.enable = true;
+    };
+  testScript = ''
+    def list_interfaces(intf_path: str) -> list[str]:
+      return machine.succeed(f"varlinkctl list-interfaces {intf_path}").split('\n')
+
+    expected_reg_sd_interfaces = [
+      ("BootControl", "bootctl"),
+      ("Credentials", "creds"),
+      ("Hostname", "hostnamed"),
+      ("JournalAccess", "journald"),
+      ("Import", "importd"),
+      ("Machine", "machined"),
+      ("Resolve", "resolved-varlink"),
+      ("Resolve.Monitor", "resolved-monitor"),
+      ("Udev", "udevd-varlink"),
+      ("MuteConsole", "mute-console"),
+      ("FactoryReset", "factory-reset"),
+      ("AskPassword", "ask-password"),
+      ("Network", "networkd-varlink"),
+      ("Repart", "repart"),
+    ]
+    expected_priv_sd_interfaces = [
+      ("Login", None), # systemd-logind-varlink.socket exist but is not necessary.
+    ]
+    expected_interfaces = [
+      (f"io.systemd.{intf}", f"systemd-{socket_name}", f"/run/varlink/registry/io.systemd.{intf}") for intf, socket_name in expected_reg_sd_interfaces
+    ] + [
+      (f"io.systemd.{intf}", f"systemd-{socket_name}" if socket_name is not None else None, f"/run/systemd/io.systemd.{intf}") for intf, socket_name in expected_priv_sd_interfaces
+    ]
+
+    for intf, socket_name, intf_path in expected_interfaces:
+      if socket_name is not None:
+        machine.wait_for_unit(f"{socket_name}.socket")
+      assert intf in list_interfaces(intf_path), f"Interface '{intf}' not found in the Varlink registry"
+  '';
+}

From d1700adc89d1ae68efe880a8a88f6735c3872680 Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Thu, 25 Jun 2026 10:33:33 +0200
Subject: [PATCH 064/210] nano: remove pname substitution anti-pattern

---
 pkgs/by-name/na/nano/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/na/nano/package.nix b/pkgs/by-name/na/nano/package.nix
index 2ab07429d9e6..2e68584027ee 100644
--- a/pkgs/by-name/na/nano/package.nix
+++ b/pkgs/by-name/na/nano/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   version = "9.1";
 
   src = fetchurl {
-    url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
+    url = "mirror://gnu/nano/nano-${version}.tar.xz";
     hash = "sha256-X0d2QnTLdTI0nOCqIOwQ8ejoUabp+j62aBLEPRltsEI=";
   };
 

From eb17b04a11149c25c2bff7b55d271f6bbc72c239 Mon Sep 17 00:00:00 2001
From: Andrea Ciceri <andrea.ciceri@autistici.org>
Date: Thu, 25 Jun 2026 10:36:46 +0200
Subject: [PATCH 065/210] amule: 3.0.0 -> 3.0.1

---
 pkgs/by-name/am/amule/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/am/amule/package.nix b/pkgs/by-name/am/amule/package.nix
index 1a50903cfa2f..d3003981d726 100644
--- a/pkgs/by-name/am/amule/package.nix
+++ b/pkgs/by-name/am/amule/package.nix
@@ -21,6 +21,7 @@
   gtk3,
   libayatana-appindicator,
   libsysprof-capture,
+  libmaxminddb,
   libpng,
   pkg-config,
   readline,
@@ -52,13 +53,13 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString enableDaemon "-daemon"
     + lib.optionalString client "-gui"
     + lib.optionalString textClient "-cmd";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "amule-org";
     repo = "amule";
     tag = finalAttrs.version;
-    hash = "sha256-2qQof2/JFTfOmqd25+YVWBpZgCDCOwf3NBo1aHcMPds=";
+    hash = "sha256-zLd8mt+dYEilGcFn3qspZv5EkZ4TmBbKgvgcuSvswFk=";
   };
 
   __structuredAttrs = true;
@@ -108,6 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
     libayatana-appindicator
   ]
   ++ lib.optional httpServer libpng
+  ++ lib.optional (monolithic || enableDaemon || client) libmaxminddb
   # gettext runtime for NLS; on glibc libintl is part of libc
   ++ lib.optional (!stdenv.hostPlatform.isGnu) libintl
   # line editing in the interactive consoles of amulecmd and amuleweb

From b4a5a3d28f06bb80b99ab5b54382a83d3232fe87 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian@arianvp.me>
Date: Thu, 25 Jun 2026 09:53:18 +0200
Subject: [PATCH 066/210] nixos/virtualisation/nspawn-container: add
 virtualisation.credentials support

Assisted-by: Claude <noreply@anthropic.com>
---
 .../virtualisation/credentials-options.nix    | 63 +++++++++++++
 .../nspawn-container/default.nix              |  7 +-
 nixos/modules/virtualisation/qemu-vm.nix      | 88 +++----------------
 3 files changed, 83 insertions(+), 75 deletions(-)
 create mode 100644 nixos/modules/virtualisation/credentials-options.nix

diff --git a/nixos/modules/virtualisation/credentials-options.nix b/nixos/modules/virtualisation/credentials-options.nix
new file mode 100644
index 000000000000..3345f6933784
--- /dev/null
+++ b/nixos/modules/virtualisation/credentials-options.nix
@@ -0,0 +1,63 @@
+{ lib, pkgs, ... }:
+{
+  options.virtualisation.credentials = lib.mkOption {
+    description = ''
+      Credentials to pass to the VM or container using systemd's credential system.
+
+      See {manpage}`systemd.exec(5)`, {manpage}`systemd-creds(1)` and https://systemd.io/CREDENTIALS/ for more
+      information about systemd credentials.
+    '';
+    default = { };
+    example = lib.literalExpression ''
+      {
+        database-password = {
+          text = "my-secret-password";
+        };
+        ssl-cert = {
+          source = "./cert.pem";
+        };
+        binary-key = {
+          source = "./private.der";
+        };
+      }
+    '';
+    type = lib.types.attrsOf (
+      lib.types.submodule (
+        {
+          name,
+          options,
+          config,
+          ...
+        }:
+        {
+          options = {
+            source = lib.mkOption {
+              type = lib.types.nullOr (lib.types.pathWith { });
+              default = null;
+              description = ''
+                Source file on the host containing the credential data.
+              '';
+            };
+            text = lib.mkOption {
+              default = null;
+              type = lib.types.nullOr lib.types.str;
+              description = ''
+                Text content of the credential.
+
+                For binary data or when the credential content should come from
+                an existing file, use `source` instead.
+
+                ::: {.warning}
+                The text here is stored in the host's nix store as a file.
+                :::
+              '';
+            };
+          };
+          config.source = lib.mkIf (config.text != null) (
+            lib.mkDerivedConfig options.text (pkgs.writeText name)
+          );
+        }
+      )
+    );
+  };
+}
diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix
index 9100b580768b..82a06929e925 100644
--- a/nixos/modules/virtualisation/nspawn-container/default.nix
+++ b/nixos/modules/virtualisation/nspawn-container/default.nix
@@ -21,6 +21,10 @@ let
   cfg = config.virtualisation;
 in
 {
+  imports = [
+    ../credentials-options.nix
+  ];
+
   options = {
 
     virtualisation.cmdline = lib.mkOption {
@@ -131,7 +135,8 @@ in
 
       # Send a READY=1 notification to a socket when the container is fully booted.
       "--notify-ready=yes"
-    ];
+    ]
+    ++ lib.mapAttrsToList (name: cred: "--load-credential=${name}:${cred.source}") cfg.credentials;
 
     system.build.nspawn =
       let
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 8d2817c23bf0..8230da280b50 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -399,6 +399,7 @@ in
   imports = [
     ../profiles/qemu-guest.nix
     ./disk-size-option.nix
+    ./credentials-options.nix
     (mkRenamedOptionModule
       [
         "virtualisation"
@@ -1126,81 +1127,20 @@ in
     };
 
     virtualisation.credentials = mkOption {
-      description = ''
-        Credentials to pass to the VM using systemd's credential system.
-
-        See {manpage}`systemd.exec(5)` , {manpage}`systemd-creds(1)` and https://systemd.io/CREDENTIALS/ for more
-        information about systemd credentials.
-      '';
-      default = { };
-      example = {
-        database-password = {
-          text = "my-secret-password";
-        };
-        ssl-cert = {
-          source = "./cert.pem";
-        };
-        binary-key = {
-          mechanism = "fw_cfg";
-          source = "./private.der";
-        };
-        config-file = {
-          mechanism = "smbios";
-          text = ''
-            [database]
-            host=localhost
-            port=5432
-          '';
-        };
-      };
       type = types.attrsOf (
-        lib.types.submodule (
-          {
-            name,
-            options,
-            config,
-            ...
-          }:
-          {
-            options = {
-              mechanism = lib.mkOption {
-                type = lib.types.enum [
-                  "fw_cfg"
-                  "smbios"
-                ];
-                default = if pkgs.stdenv.hostPlatform.isx86 then "smbios" else "fw_cfg";
-                defaultText = lib.literalExpression ''if pkgs.stdenv.hostPlatform.isx86 then "smbios" else "fw_cfg"'';
-                description = ''
-                  The mechanism used to pass the credential to the VM.
-                '';
-              };
-              source = lib.mkOption {
-                type = lib.types.nullOr (lib.types.pathWith { });
-                default = null;
-                description = ''
-                  Source file on the host containing the credential data.
-                '';
-              };
-              text = lib.mkOption {
-                default = null;
-                type = lib.types.nullOr lib.types.str;
-                description = ''
-                  Text content of the credential.
-
-                  For binary data or when the credential content should come from
-                  an existing file, use `source` instead.
-
-                  ::: {.warning}
-                  The text here is stored in the host's nix store as a file.
-                  :::
-                '';
-              };
-            };
-            config.source = lib.mkIf (config.text != null) (
-              lib.mkDerivedConfig options.text (pkgs.writeText name)
-            );
-          }
-        )
+        lib.types.submodule {
+          options.mechanism = lib.mkOption {
+            type = lib.types.enum [
+              "fw_cfg"
+              "smbios"
+            ];
+            default = if pkgs.stdenv.hostPlatform.isx86 then "smbios" else "fw_cfg";
+            defaultText = lib.literalExpression ''if pkgs.stdenv.hostPlatform.isx86 then "smbios" else "fw_cfg"'';
+            description = ''
+              The mechanism used to pass the credential to the VM.
+            '';
+          };
+        }
       );
     };
 

From 612ff7f23c5bfffde6f1b6200941aafde22c9974 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian@arianvp.me>
Date: Thu, 25 Jun 2026 09:53:18 +0200
Subject: [PATCH 067/210] nixos/test-driver: support state_dir for container
 tests

Assisted-by: Claude <noreply@anthropic.com>
---
 nixos/lib/test-driver/src/test_driver/machine/__init__.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/lib/test-driver/src/test_driver/machine/__init__.py b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
index db96445af912..b4eceee8c6fc 100644
--- a/nixos/lib/test-driver/src/test_driver/machine/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
@@ -1684,6 +1684,7 @@ class NspawnMachine(BaseMachine):
 
         self.process = subprocess.Popen(
             [self.start_command],
+            cwd=self.state_dir,
             env={
                 "RUN_NSPAWN_ROOT_DIR": str(self.state_dir),
                 "RUN_NSPAWN_SHARED_DIR": str(self.shared_dir),

From 426413b862563b20afbc22ea9de00929942b77c0 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian@arianvp.me>
Date: Thu, 25 Jun 2026 09:53:18 +0200
Subject: [PATCH 068/210] nixos/tests/credentials: test both vm and container
 support

Assisted-by: Claude <noreply@anthropic.com>
---
 nixos/tests/all-tests.nix           |  16 ++---
 nixos/tests/credentials.nix         | 106 ++++++++++++++++++++++++++++
 nixos/tests/qemu-vm-credentials.nix |  83 ----------------------
 3 files changed, 114 insertions(+), 91 deletions(-)
 create mode 100644 nixos/tests/credentials.nix
 delete mode 100644 nixos/tests/qemu-vm-credentials.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 09b0a4632d28..0e386407529f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -446,6 +446,14 @@ in
   };
   coturn = runTest ./coturn.nix;
   couchdb = runTest ./couchdb.nix;
+  credentials-fwcfg = runTest {
+    imports = [ ./credentials.nix ];
+    _module.args.mechanism = "fw_cfg";
+  };
+  credentials-smbios = runTestOn [ "x86_64-linux" ] {
+    imports = [ ./credentials.nix ];
+    _module.args.mechanism = "smbios";
+  };
   cri-o = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./cri-o.nix;
   croc = runTest ./croc.nix;
   cross-seed = runTest ./cross-seed.nix;
@@ -1415,14 +1423,6 @@ in
   pykms = runTest ./pykms.nix;
   qbittorrent = runTest ./qbittorrent.nix;
   qboot = runTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix;
-  qemu-vm-credentials-fwcfg = runTest {
-    imports = [ ./qemu-vm-credentials.nix ];
-    _module.args.mechanism = "fw_cfg";
-  };
-  qemu-vm-credentials-smbios = runTestOn [ "x86_64-linux" ] {
-    imports = [ ./qemu-vm-credentials.nix ];
-    _module.args.mechanism = "smbios";
-  };
   qemu-vm-external-disk-image = runTest ./qemu-vm-external-disk-image.nix;
   qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix { };
   qemu-vm-store = runTest ./qemu-vm-store.nix;
diff --git a/nixos/tests/credentials.nix b/nixos/tests/credentials.nix
new file mode 100644
index 000000000000..7984ffd03593
--- /dev/null
+++ b/nixos/tests/credentials.nix
@@ -0,0 +1,106 @@
+{
+  lib,
+  pkgs,
+  mechanism,
+  ...
+}:
+
+let
+  secret = ''
+    foo
+    bar
+    baz
+  '';
+  secret-file = "bar";
+
+  common-credentials = {
+    secret-default-mechanism = {
+      text = "default-mechanism";
+    };
+    secret-file-nix-store = {
+      source = pkgs.writeText "secret-file-nix-store" secret-file;
+    };
+    secret-file-host = {
+      source = "./secret-file-host";
+    };
+    secret-file-host-binary = {
+      source = "./secret-file-host-binary";
+    };
+  };
+in
+
+{
+  name = "credentials-${mechanism}";
+
+  meta.maintainers = with lib.maintainers; [ arianvp ];
+
+  # No VM<->container traffic in this test; credentials are static.
+  requiredFeatures.devnet = lib.mkForce false;
+
+  nodes.vm = {
+    virtualisation.credentials = common-credentials // {
+      secret = {
+        inherit mechanism;
+        text = secret;
+      };
+    };
+  };
+
+  containers.container = {
+    virtualisation.credentials = common-credentials // {
+      secret = {
+        text = secret;
+      };
+    };
+  };
+
+  testScript = ''
+    import base64
+
+    secret_file_host = "baz"
+    # Binary data with null bytes, high bytes, and other problematic characters.
+    secret_file_host_binary = bytes([
+      0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+      0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+      0xDE, 0xAD, 0xBE, 0xEF,
+      0xFF, 0xFE, 0xFD, 0xFC,
+      0x00, 0x00, 0x00, 0x00,
+      0x80, 0x81, 0x82, 0x83,
+    ])
+
+    def assert_credentials(m):
+      with open(m.state_dir / "secret-file-host", "w") as f:
+        f.write(secret_file_host)
+      with open(m.state_dir / "secret-file-host-binary", "wb") as f2:
+        f2.write(secret_file_host_binary)
+
+      t.assertEqual(
+          m.succeed("systemd-creds --system cat secret").strip(),
+          "foo\nbar\nbaz",
+      )
+      t.assertEqual(
+          m.succeed("systemd-creds --system cat secret-default-mechanism").strip(),
+          "default-mechanism",
+      )
+      t.assertEqual(
+          m.succeed("systemd-creds --system cat secret-file-nix-store").strip(),
+          "${secret-file}",
+      )
+      t.assertEqual(
+          m.succeed("systemd-creds --system cat secret-file-host").strip(),
+          secret_file_host,
+      )
+      result = m.succeed(
+          "systemd-creds --system cat secret-file-host-binary --transcode=base64"
+      ).strip()
+      expected = base64.b64encode(secret_file_host_binary).decode("ascii")
+      t.assertEqual(
+          result,
+          expected,
+          f"Binary credential mismatch: got {result}, expected {expected}",
+      )
+
+    assert_credentials(vm)
+    assert_credentials(container)
+  '';
+}
diff --git a/nixos/tests/qemu-vm-credentials.nix b/nixos/tests/qemu-vm-credentials.nix
deleted file mode 100644
index 9ee2d270d8f0..000000000000
--- a/nixos/tests/qemu-vm-credentials.nix
+++ /dev/null
@@ -1,83 +0,0 @@
-{
-  lib,
-  pkgs,
-  mechanism,
-  ...
-}:
-
-let
-  secret = ''
-    foo
-    bar
-    baz
-  '';
-  secret-file = "bar";
-in
-
-{
-  name = "qemu-vm-credentials-${mechanism}";
-
-  meta.maintainers = with lib.maintainers; [ arianvp ];
-
-  nodes = {
-    machine = {
-      virtualisation.credentials = {
-        secret = {
-          inherit mechanism;
-          text = secret;
-        };
-        secret-default-mechanism = {
-          text = "default-mechanism";
-        };
-        secret-file-nix-store = {
-          inherit mechanism;
-          source = pkgs.writeText "secret-file-nix-store" secret-file;
-        };
-        secret-file-host = {
-          inherit mechanism;
-          source = "./secret-file-host";
-        };
-        secret-file-host-binary = {
-          inherit mechanism;
-          source = "./secret-file-host-binary";
-        };
-      };
-    };
-  };
-
-  testScript = ''
-    import base64
-    secret_file_host = "baz"
-    # Binary data with null bytes, high bytes, and all sorts of problematic characters
-    secret_file_host_binary = bytes([
-      0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,  # null and control chars
-      0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
-      0xDE, 0xAD, 0xBE, 0xEF,                          # classic binary pattern
-      0xFF, 0xFE, 0xFD, 0xFC,                          # high bytes
-      0x00, 0x00, 0x00, 0x00,                          # multiple nulls
-      0x80, 0x81, 0x82, 0x83,                          # more high bytes
-    ])
-
-    with open(machine.state_dir / "secret-file-host", "w") as f:
-      f.write(secret_file_host)
-    with open(machine.state_dir / "secret-file-host-binary", "wb") as f2:
-      f2.write(secret_file_host_binary)
-
-
-    # Test text credential
-    t.assertEqual(machine.succeed("systemd-creds --system cat secret").strip(), "foo\nbar\nbaz")
-
-    t.assertEqual(machine.succeed("systemd-creds --system cat secret-default-mechanism").strip(), "default-mechanism")
-
-    # Test credential from nix store
-    t.assertEqual(machine.succeed("systemd-creds --system cat secret-file-nix-store").strip(), "${secret-file}")
-
-    # Test credential from host file
-    t.assertEqual(machine.succeed("systemd-creds --system cat secret-file-host").strip(), secret_file_host)
-
-    # Test binary credential - verify exact binary content
-    result = machine.succeed("systemd-creds --system cat secret-file-host-binary --transcode=base64").strip()
-    expected = base64.b64encode(secret_file_host_binary).decode('ascii')
-    t.assertEqual(result, expected, f"Binary credential mismatch: got {result}, expected {expected}")
-  '';
-}

From a3bd3d8f18ed7fef77b43ec29b5eac24802021f1 Mon Sep 17 00:00:00 2001
From: Cassandra Comar <cass@ndra.io>
Date: Tue, 20 Jan 2026 21:06:04 -0500
Subject: [PATCH 069/210] nixos/ntpd-rs: set default log-level to warn

see [dev
recommendation](https://discourse.nixos.org/t/why-are-we-using-systemd-timesyncd-by-default/74052/32).

this should reduce the spamminess of the service in the system log while
leaving the option to turn up logging if needed for debugging.
---
 nixos/modules/services/networking/ntp/ntpd-rs.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/networking/ntp/ntpd-rs.nix b/nixos/modules/services/networking/ntp/ntpd-rs.nix
index 89735696616c..d68b7762805e 100644
--- a/nixos/modules/services/networking/ntp/ntpd-rs.nix
+++ b/nixos/modules/services/networking/ntp/ntpd-rs.nix
@@ -70,6 +70,7 @@ in
 
     services.ntpd-rs.settings = {
       observability = {
+        log-level = lib.mkDefault "warn";
         observation-path = lib.mkDefault "/var/run/ntpd-rs/observe";
       };
       source = lib.mkIf cfg.useNetworkingTimeServers (

From b450abc27a01b0485d8a7039463c473d15392c3c Mon Sep 17 00:00:00 2001
From: Adriel Velazquez <AdrielVelazquez@gmail.com>
Date: Thu, 25 Jun 2026 14:22:47 +0000
Subject: [PATCH 070/210] antigravity-cli: 1.0.8 -> 1.0.12

---
 pkgs/by-name/an/antigravity-cli/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/an/antigravity-cli/package.nix b/pkgs/by-name/an/antigravity-cli/package.nix
index d26b21016e85..21da4d2caa59 100644
--- a/pkgs/by-name/an/antigravity-cli/package.nix
+++ b/pkgs/by-name/an/antigravity-cli/package.nix
@@ -6,7 +6,7 @@
   versionCheckHook,
 }:
 let
-  wholeVersion = "1.0.8-6513509081677824"; # unfortunately this has dumb versioning
+  wholeVersion = "1.0.12-6156052174077952"; # unfortunately this has dumb versioning
   version = builtins.head (lib.splitString "-" wholeVersion);
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
@@ -14,19 +14,19 @@ let
   sourceData = {
     x86_64-linux = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-x64/cli_linux_x64.tar.gz";
-      hash = "sha256-/BxcglSN6NqZdEbq50MypFW4bv2bCN37L0PqcuYz+e4=";
+      hash = "sha256-fjB132jrrViqHPQiMenYuDvyiVtbBYqxc2sLY4PHUAg=";
     };
     aarch64-linux = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-arm/cli_linux_arm64.tar.gz";
-      hash = "sha256-QWQevvVezRdubRbG3V64C/XMHunfDsdA1OM8yhHoCHA=";
+      hash = "sha256-oDZ+WHWsG4imwLFjyG69XRPJvvkH9EaaZRb/aQIb8tQ=";
     };
     aarch64-darwin = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-arm/cli_mac_arm64.tar.gz";
-      hash = "sha256-j+/brIYCKjIOa0KSGZHt4Ic4tjTzOrfPtA4J8iY9tHE=";
+      hash = "sha256-U/cwihF/cP5+7KSmkAToI5yOoYydguR5ZrKQMytpuCk=";
     };
     x86_64-darwin = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-x64/cli_mac_x64.tar.gz";
-      hash = "sha256-0Cp76whEYtBdZS6GOnC+qqICGoqexX+v3KCFJmfaFAU=";
+      hash = "sha256-A8YjMmFUiHKxdlR+OpOPQGKC+68z/83vtjw1yiJGt6g=";
     };
   };
 in

From 35a7ab55b39b83fd52c471124fceab5108b44702 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 25 Jun 2026 07:30:31 +0000
Subject: [PATCH 071/210] python3Packages.keras: 3.14.1 -> 3.15.0

Diff: https://github.com/keras-team/keras/compare/v3.14.1...v3.15.0

Changelog: https://github.com/keras-team/keras/releases/tag/v3.15.0
---
 pkgs/development/python-modules/keras/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/keras/default.nix b/pkgs/development/python-modules/keras/default.nix
index 111d658ee05c..9de28fa56d6d 100644
--- a/pkgs/development/python-modules/keras/default.nix
+++ b/pkgs/development/python-modules/keras/default.nix
@@ -37,7 +37,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "keras";
-  version = "3.14.1";
+  version = "3.15.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -45,7 +45,7 @@ buildPythonPackage (finalAttrs: {
     owner = "keras-team";
     repo = "keras";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BaSD21mj7rPV53qFCOxGjGMm+rVzmfCooqcLcvQZa1U=";
+    hash = "sha256-EF61E7pwyuv9eKkTaPzJOWfbhK6rwkePIvmaVeriEDM=";
   };
 
   build-system = [
@@ -89,8 +89,8 @@ buildPythonPackage (finalAttrs: {
     # Require unpackaged `grain`
     "test_basics_grain"
     "test_fit_with_data_adapter_grain_dataloader"
-    "test_fit_with_data_adapter_grain_datast"
-    "test_fit_with_data_adapter_grain_datast_with_len"
+    "test_fit_with_data_adapter_grain_dataset"
+    "test_fit_with_data_adapter_grain_dataset_with_len"
     "test_image_dataset_from_directory_binary_grain"
     "test_image_dataset_from_directory_color_modes_grain"
     "test_image_dataset_from_directory_crop_to_aspect_ratio_grain"

From 4434b37238d02b208c6fd8636fd16470009d9611 Mon Sep 17 00:00:00 2001
From: Tom Oostveen <tomoostveen.06@gmail.com>
Date: Wed, 24 Jun 2026 11:41:19 +0200
Subject: [PATCH 072/210] github-desktop: 3.5.12 -> 3.6.1

---
 pkgs/by-name/gi/github-desktop/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index 64a94973745f..03239cf812e0 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -29,19 +29,19 @@
 
 let
   inherit (stdenv.hostPlatform.node) arch platform;
-  cacheRootHash = "sha256-OJDxq1Yep3swLU87YyJz7WfpPzpxo5ISukB4pIwxJBA=";
-  cacheAppHash = "sha256-DYUlLNxWn4sn7PBir/miJUoDVAQ2/nbOVGWSGN+IPxw=";
+  cacheRootHash = "sha256-/3niIma45fx3cmplxZsSxmnuS+vGtzjF2wqqZ5DcuJI=";
+  cacheAppHash = "sha256-/hmUmaPNGoIaIY9qdlP5CG/IKn2nnKCpOqf9Wvj1AwM=";
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-desktop";
-  version = "3.5.12";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "desktop";
     repo = "desktop";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-/ehwjv1ipvxhmZYye1avkpz8uyO8YEWl0iM8U8n6pwE=";
+    hash = "sha256-S4lWh+6tOP3hw5nAgg6i6//Sd+gaI2aQnoRDQzHsxUg=";
     fetchSubmodules = true;
     postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
   };

From 9f4a8949cc99584f1e62185d7c5fa39cded7bd78 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Fri, 26 Jun 2026 00:19:12 +0200
Subject: [PATCH 073/210] ruff: 0.15.19 -> 0.15.20

Changelog: https://github.com/astral-sh/ruff/releases/tag/0.15.20
Diff: https://github.com/astral-sh/ruff/compare/0.15.19...0.15.20
---
 pkgs/by-name/ru/ruff/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 86e800f61978..56982ab4db18 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.19";
+  version = "0.15.20";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-L0QRzc9S7vHOkk3WsfT0kgjBKbApsCHTgqCv4ts1j9g=";
+    hash = "sha256-8PFMGKG15kWBpG4YXg37940WtSe/e5pQDqIe3iJRh5A=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-DapI+Wv4KNlbGUCRIiAybyKNYipRIFd5O2fYy9Uatjg=";
+  cargoHash = "sha256-Bf6nsUnNMYapP0YN0SBkTPoP1czmj35tPwN1awyKhUw=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 89cfaf3eefe841d2f70161006613695e62a63b39 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Fri, 26 Jun 2026 00:36:58 +0200
Subject: [PATCH 074/210] ty: 0.0.53 -> 0.0.54

Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.54
Diff: https://github.com/astral-sh/ty/compare/0.0.53...0.0.54
---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index ca6f502ade0f..187daf164c61 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.53";
+  version = "0.0.54";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-0msHGoPm2b7OX0Lax/yr2Uism1RxsH4DxhxlQP/aFpU=";
+    hash = "sha256-hbVH0dCUHkWKD9IG/CYhYI4TfLgpk++tPOkCD36eVSg=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-DapI+Wv4KNlbGUCRIiAybyKNYipRIFd5O2fYy9Uatjg=";
+  cargoHash = "sha256-Bf6nsUnNMYapP0YN0SBkTPoP1czmj35tPwN1awyKhUw=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

From e59c83943ce02284910256b2c08b7bad9ad47811 Mon Sep 17 00:00:00 2001
From: RoGreat <roguegreat@gmail.com>
Date: Tue, 14 Apr 2026 20:26:22 -0500
Subject: [PATCH 075/210] protonup-qt: 2.14.0 -> 2.15.1

---
 pkgs/by-name/pr/protonup-qt/package.nix | 26 ++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/pr/protonup-qt/package.nix b/pkgs/by-name/pr/protonup-qt/package.nix
index a2387798bb07..ebed1818e564 100644
--- a/pkgs/by-name/pr/protonup-qt/package.nix
+++ b/pkgs/by-name/pr/protonup-qt/package.nix
@@ -3,25 +3,27 @@
   appimageTools,
   fetchurl,
   makeWrapper,
+  nix-update-script,
 }:
-
-appimageTools.wrapAppImage rec {
+let
   pname = "protonup-qt";
-  version = "2.14.0";
+  version = "2.15.1";
 
-  src = appimageTools.extractType2 {
-    inherit pname version;
-    src = fetchurl {
-      url = "https://github.com/DavidoTek/ProtonUp-Qt/releases/download/v${version}/ProtonUp-Qt-${version}-x86_64.AppImage";
-      hash = "sha256-OdogpqqNZiwKqj2ELfmAw/601iVHMsTqxl5CUjqRQBs=";
-    };
+  src = fetchurl {
+    url = "https://github.com/DavidoTek/ProtonUp-Qt/releases/download/v${version}/ProtonUp-Qt-${version}-x86_64.AppImage";
+    hash = "sha256-/Xjvsf+gkHpSV4RGJJS5tCk4+f18AZ8+rqO4+vg36ME=";
   };
 
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
   nativeBuildInputs = [ makeWrapper ];
 
   extraInstallCommands = ''
-    install -Dm644 ${src}/net.davidotek.pupgui2.desktop $out/share/applications/protonup-qt.desktop
-    install -Dm644 ${src}/net.davidotek.pupgui2.png $out/share/pixmaps/protonup-qt.png
+    install -Dm644 ${appimageContents}/net.davidotek.pupgui2.desktop $out/share/applications/protonup-qt.desktop
+    install -Dm644 ${appimageContents}/net.davidotek.pupgui2.png $out/share/pixmaps/protonup-qt.png
     substituteInPlace $out/share/applications/protonup-qt.desktop \
       --replace-fail "Exec=net.davidotek.pupgui2" "Exec=protonup-qt" \
       --replace-fail "Icon=net.davidotek.pupgui2" "Icon=protonup-qt"
@@ -32,6 +34,8 @@ appimageTools.wrapAppImage rec {
 
   extraPkgs = pkgs: with pkgs; [ zstd ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     homepage = "https://davidotek.github.io/protonup-qt/";
     description = "Install and manage Proton-GE and Luxtorpeda for Steam and Wine-GE for Lutris with this graphical user interface";

From 3affb524b14a8240effde96a0842bf5b2ab74e58 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 25 Jun 2026 23:29:25 +0000
Subject: [PATCH 076/210] joplin-desktop: 3.6.14 -> 3.6.15

---
 pkgs/by-name/jo/joplin-desktop/release-data.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/jo/joplin-desktop/release-data.json b/pkgs/by-name/jo/joplin-desktop/release-data.json
index 498b2075c049..5015e67861b0 100644
--- a/pkgs/by-name/jo/joplin-desktop/release-data.json
+++ b/pkgs/by-name/jo/joplin-desktop/release-data.json
@@ -1,6 +1,6 @@
 {
-  "version": "3.6.14",
-  "hash": "sha256-0mioVPCBhWmcXkVqCOku1KsPN29fGDp5jGhxnwD0MUk=",
+  "version": "3.6.15",
+  "hash": "sha256-uCF0nsHZowb9SuqBNni8/MWjGv9JyAUJs/gQprEoGjU=",
   "plugins": {
     "io.github.jackgruber.backup": {
       "name": "joplin-plugin-backup",

From a95c2c7b9803f8495b21e8a4d8de6e390de5f5a1 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Fri, 26 Jun 2026 01:54:54 +0200
Subject: [PATCH 077/210] dolphin-emu: 2603a -> 2606

---
 pkgs/by-name/do/dolphin-emu/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/do/dolphin-emu/package.nix b/pkgs/by-name/do/dolphin-emu/package.nix
index 8a7d9041abde..a1a4802de7b0 100644
--- a/pkgs/by-name/do/dolphin-emu/package.nix
+++ b/pkgs/by-name/do/dolphin-emu/package.nix
@@ -55,13 +55,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dolphin-emu";
-  version = "2603a";
+  version = "2606";
 
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
     tag = finalAttrs.version;
-    hash = "sha256-+3/JtjKFsTEkKQa0LjycqNmDz0M8o2FndWQtw5R5/jQ=";
+    hash = "sha256-Rs/b5Vnm1VAYpvC6YWj3bZqHBCw2SCHnzLro1UrvsdY=";
     fetchSubmodules = true;
     leaveDotGit = true;
     postFetch = ''

From 9f5adcafa9df04dd6a3f1c962a272a3dbaf7eebf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 00:46:02 +0000
Subject: [PATCH 078/210] haproxy: 3.4.0 -> 3.4.1

---
 pkgs/by-name/ha/haproxy/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ha/haproxy/package.nix b/pkgs/by-name/ha/haproxy/package.nix
index ccbdec377049..77945c05c7d6 100644
--- a/pkgs/by-name/ha/haproxy/package.nix
+++ b/pkgs/by-name/ha/haproxy/package.nix
@@ -33,11 +33,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "haproxy";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-kpj1ZcKpuopOf4nFS+LF0/2WC1swTrVRXhXSnSwV1Pc=";
+    hash = "sha256-LmLEzk/XfTvHzxflhkMWY0VEVqB4t8hGW48BJbW8Ivg=";
   };
 
   buildInputs = [

From 7cf8a95375a94ed9f1cc7ec7297bdc4da7dfeb76 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Thu, 25 Jun 2026 22:17:04 -0400
Subject: [PATCH 079/210] mpop: libidn -> libidn2

as per the changelog entry for version 1.4.0 at
https://git.marlam.de/gitweb/?p=mpop.git;a=blob;f=NEWS;h=8b8f2fd45a2109ba04c9720de7973a519bc4aeaf;hb=HEAD,
libidn2 is used instead of libidn where IDN support is needed, so we
migrate to that.
---
 pkgs/by-name/mp/mpop/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mp/mpop/package.nix b/pkgs/by-name/mp/mpop/package.nix
index 2109293a91ea..85b9b73efb6c 100644
--- a/pkgs/by-name/mp/mpop/package.nix
+++ b/pkgs/by-name/mp/mpop/package.nix
@@ -5,7 +5,7 @@
   gnutls,
   openssl,
   gsasl,
-  libidn,
+  libidn2,
   pkg-config,
   nlsSupport ? true,
   idnSupport ? true,
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs =
     lib.optional gsaslSupport gsasl
-    ++ lib.optional idnSupport libidn
+    ++ lib.optional idnSupport libidn2
     ++ lib.optional (sslLibrary == "gnutls") gnutls
     ++ lib.optional (sslLibrary == "openssl") openssl;
 

From 2faacc8a14553383e50c8b0067a654964f4d1331 Mon Sep 17 00:00:00 2001
From: chillcicada <2210227279@qq.com>
Date: Fri, 26 Jun 2026 11:58:52 +0800
Subject: [PATCH 080/210] ovito: 3.15.4 -> 3.15.5

---
 pkgs/by-name/ov/ovito/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ov/ovito/package.nix b/pkgs/by-name/ov/ovito/package.nix
index 4fbc6b64af3b..465250f171bd 100644
--- a/pkgs/by-name/ov/ovito/package.nix
+++ b/pkgs/by-name/ov/ovito/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ovito";
-  version = "3.15.4";
+  version = "3.15.5";
 
   src = fetchFromGitLab {
     owner = "stuko";
     repo = "ovito";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9/aps/phWkWflEdC46QWK/psA5DpdwxBK+2NSMaB4I0=";
+    hash = "sha256-ySU9AW4p7u1/yR9uOSmS82vIwx5fh4pWrFEqBZOoEHA=";
     fetchSubmodules = true;
   };
 

From b9e8d5cf65ec6fff82822e201de41115263bb3e9 Mon Sep 17 00:00:00 2001
From: Uzlkav <177883133+Uzlkav@users.noreply.github.com>
Date: Tue, 24 Mar 2026 00:52:35 -0600
Subject: [PATCH 081/210] swaytreesave: init at 0.4.0

https://github.com/fabienjuif/swaytreesave/releases/tag/v0.4.0
---
 pkgs/by-name/sw/swaytreesave/package.nix | 33 ++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 pkgs/by-name/sw/swaytreesave/package.nix

diff --git a/pkgs/by-name/sw/swaytreesave/package.nix b/pkgs/by-name/sw/swaytreesave/package.nix
new file mode 100644
index 000000000000..2ff1ad652253
--- /dev/null
+++ b/pkgs/by-name/sw/swaytreesave/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  versionCheckHook,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "swaytreesave";
+  version = "0.4.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "fabienjuif";
+    repo = "swaytreesave";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aAJBbauOiFERABF13hMhxyvRBzcx5c1F+vbm/U+JS8o=";
+  };
+
+  cargoHash = "sha256-5nI7YJyCu7kZTa+Gsp0LCQXNjwVhUqOAxLC7XGtfKVk=";
+
+  meta = {
+    description = "CLI to save and load your compositors tree/layout";
+    homepage = "https://github.com/fabienjuif/swaytreesave";
+    changelog = "https://github.com/fabienjuif/swaytreesave/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      uzlkav
+    ];
+    mainProgram = "swaytreesave";
+    platforms = lib.platforms.linux;
+  };
+})

From 9714a276ba2c27f3fbc53896b2317abd9accd469 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 04:43:03 +0000
Subject: [PATCH 082/210] context7-mcp: 3.2.1 -> 3.2.2

---
 pkgs/by-name/co/context7-mcp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/context7-mcp/package.nix b/pkgs/by-name/co/context7-mcp/package.nix
index d8b7f7dde62e..bc565e2e546b 100644
--- a/pkgs/by-name/co/context7-mcp/package.nix
+++ b/pkgs/by-name/co/context7-mcp/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "context7-mcp";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "upstash";
     repo = "context7";
     tag = "${tag-prefix}@${finalAttrs.version}";
-    hash = "sha256-Gf3GnVOceAMzsc1SYGQVriDzDD/dQYSoBSrCuQ5M4UI=";
+    hash = "sha256-v3zKMnZsc0gWVAdgZwFTskWcFVlOU6sG2i+qDwjx+dw=";
   };
 
   nativeBuildInputs = [

From 754778ec914830f9cddbde6d2e720273769766f9 Mon Sep 17 00:00:00 2001
From: Philip White <philip@0xfff.me>
Date: Tue, 23 Jun 2026 22:58:00 -0700
Subject: [PATCH 083/210] bisq1: init at 1.10.2

Tested:
`nix-build -A bisq1` followed by `./result/bin/bisq` and `.../bisq-hidpi`.
---
 pkgs/by-name/bi/bisq1/package.nix | 258 ++++++++++++++++++++++++++++++
 1 file changed, 258 insertions(+)
 create mode 100644 pkgs/by-name/bi/bisq1/package.nix

diff --git a/pkgs/by-name/bi/bisq1/package.nix b/pkgs/by-name/bi/bisq1/package.nix
new file mode 100644
index 000000000000..8895ec305994
--- /dev/null
+++ b/pkgs/by-name/bi/bisq1/package.nix
@@ -0,0 +1,258 @@
+{
+  stdenv,
+  lib,
+  makeBinaryWrapper,
+  fetchurl,
+  writeShellScript,
+  makeDesktopItem,
+  copyDesktopItems,
+  imagemagick,
+  zulu21,
+  dpkg,
+  zip,
+  xz,
+  gnupg,
+  coreutils,
+  tor,
+
+  # Native libraries required by the JavaFX natives that Bisq extracts from its bundled
+  # javafx-graphics jar into ~/.openjfx/cache at runtime. Those .so files are
+  # bare (no rpath), so every direct needed library must be on LD_LIBRARY_PATH.
+  # The set below is exactly the verified closure (readelf NEEDED + ldd not_found=0).
+  gtk3,
+  glib,
+  cairo,
+  pango,
+  atk,
+  gdk-pixbuf,
+  harfbuzz,
+  freetype,
+  fontconfig,
+  libGL,
+  libglvnd,
+  libx11,
+  libxtst,
+  libxxf86vm,
+}:
+
+let
+  version = "1.10.2";
+
+  # JDK 21 is the toolchain required by docs/build.md. enableJavaFX is not
+  # strictly required (Bisq bundles its own JavaFX jars), but mirrors the
+  # sibling bisq2 package and gives a JDK that can host JavaFX.
+  jdk = zulu21.override {
+    enableJavaFX = true;
+  };
+
+  # JVM arguments sourced from bisq/desktop/build.gradle, applicationDefaultJvmArgs
+  bisqJvmArgs = lib.concatStringsSep " " [
+    "-XX:MaxRAM=8g"
+    "-Xss1280k"
+    "-XX:+UseG1GC"
+    "-XX:MaxHeapFreeRatio=10"
+    "-XX:MinHeapFreeRatio=5"
+    "-XX:+UseStringDeduplication"
+    "-Djava.net.preferIPv4Stack=true"
+    "--add-opens=javafx.controls/javafx.scene.control.skin=ALL-UNNAMED"
+  ];
+
+  # JVM arguments added for nixpkgs, not present in the bisq source tree.
+  nixpkgsJvmArgs = lib.concatStringsSep " " [
+    # solving this error at application startup:
+    # > class com.jfoenix.skins.JFXSpinnerSkin (in unnamed module @0x77ec78b9) cannot access class com.sun.javafx.scene.NodeHelper (in module javafx.graphics) because module javafx.graphics does not export com.sun.javafx.scene to unnamed module @0x77ec78b9
+    "--add-exports=javafx.graphics/com.sun.javafx.scene=ALL-UNNAMED"
+
+    # solving this error at application startup:
+    # > class com.jfoenix.skins.JFXTabPaneSkin$TabHeaderContainer (in unnamed module @0x77ec78b9) cannot access class com.sun.javafx.scene.control.LambdaMultiplePropertyChangeListenerHandler (in module javafx.controls) because module javafx.controls does not export com.sun.javafx.scene.control to unnamed module @0x77ec78b9
+    "--add-exports=javafx.controls/com.sun.javafx.scene.control=ALL-UNNAMED"
+
+    # solving this error at application startup:
+    # > class com.jfoenix.skins.JFXTabPaneSkin (in unnamed module @0x77ec78b9) cannot access class com.sun.javafx.scene.control.behavior.TabPaneBehavior (in module javafx.controls) because module javafx.controls does not export com.sun.javafx.scene.control.behavior to unnamed module @0x77ec78b9
+    "--add-exports=javafx.controls/com.sun.javafx.scene.control.behavior=ALL-UNNAMED"
+  ];
+
+  bisq-launcher =
+    args:
+    writeShellScript "bisq-launcher" ''
+      exec "${lib.getExe jdk}" \
+        ${bisqJvmArgs} \
+        ${nixpkgsJvmArgs} \
+        -classpath @out@/lib/app/desktop.jar:@out@/lib/app/* \
+        ${args} bisq.desktop.app.BisqAppMain "$@"
+    '';
+
+  # keys taken from bisq/docs/release-process.md
+  publicKey = {
+    "E222AA02" = fetchurl {
+      url = "https://github.com/bisq-network/bisq/releases/download/v${version}/E222AA02.asc";
+      hash = "sha256-Ue/UmS6F440/ybEEIAR+pdPEIksAt6QSMN6G5TZVWzc=";
+    };
+
+    "4A133008" = fetchurl {
+      url = "https://github.com/bisq-network/bisq/releases/download/v${version}/4A133008.asc";
+      hash = "sha256-UijG3DkJNNTakVJd2wl30mDepa27n6R/Xxfl4sjt0sk=";
+    };
+
+    "387C8307" = fetchurl {
+      url = "https://github.com/bisq-network/bisq/releases/download/v${version}/387C8307.asc";
+      hash = "sha256-PrRYZLT0xv82dUscOBgQGKNf6zwzWUDhriAffZbNpmI=";
+    };
+  };
+
+  binPath = lib.makeBinPath [
+    coreutils
+    tor
+  ];
+
+  libraryPath = lib.makeLibraryPath [
+    gtk3
+    glib
+    cairo
+    pango
+    atk
+    gdk-pixbuf
+    harfbuzz
+    freetype
+    fontconfig
+    libGL
+    libglvnd
+    libx11
+    libxtst
+    libxxf86vm
+    stdenv.cc.cc
+  ];
+in
+stdenv.mkDerivation (finalAttrs: {
+  inherit version;
+
+  pname = "bisq1";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchurl {
+    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
+    hash = "sha256-e7rPUhA6KF3Tz3zlYqEfM9G0owe9hAUFDifKseRvb6A=";
+
+    # Verify the upstream Debian package's detached PGP signature prior to use.
+    # This ensures that a successful build of this Nix package requires the
+    # signed Debian package to pass verification, preserving Bisq's trust model.
+    nativeBuildInputs = [ gnupg ];
+    downloadToTemp = true;
+
+    postFetch = ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=./gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      ln -s $downloadedFile ./Bisq-64bit-${version}.deb
+      ln -s ${finalAttrs.signature} ./signature.asc
+      gpg --import ${publicKey."E222AA02"}
+      gpg --import ${publicKey."4A133008"}
+      gpg --import ${publicKey."387C8307"}
+      gpg --batch --verify signature.asc Bisq-64bit-${version}.deb
+      popd
+      mv $downloadedFile $out
+    '';
+  };
+
+  signature = fetchurl {
+    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb.asc";
+    hash = "sha256-kBRaOXuP22DvXMkJ1XQatwvTmu/Ds8FvmUgYnRT7Vg0=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    dpkg
+    imagemagick
+    makeBinaryWrapper
+    zip
+    xz
+    gnupg
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "bisq";
+      exec = "bisq";
+      icon = "bisq";
+      desktopName = "Bisq";
+      genericName = "Decentralized bitcoin exchange";
+      categories = [
+        "Network"
+        "P2P"
+      ];
+    })
+
+    (makeDesktopItem {
+      name = "bisq-hidpi";
+      exec = "bisq-hidpi";
+      icon = "bisq";
+      desktopName = "Bisq (HiDPI)";
+      genericName = "Decentralized bitcoin exchange";
+      categories = [
+        "Network"
+        "P2P"
+      ];
+    })
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+    dpkg -x $src .
+    runHook postUnpack
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # Replace the Tor binary bundled in tor-binary-linux64-*.jar
+    # (native/linux/x64/tor.tar.xz) with the Tor binary from Nixpkgs. The
+    # bundled tor is a dynamically-linked ELF expecting the
+    # /lib64/ld-linux-x86-64.so.2 interpreter, which does not exist on NixOS.
+    makeWrapper ${lib.getExe' tor "tor"} ./tor
+    mkdir -p native/linux/x64
+    tar -cf - ./tor | xz > native/linux/x64/tor.tar.xz
+    zip opt/bisq/lib/app/tor-binary-linux64-*.jar native/linux/x64/tor.tar.xz >/dev/null
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib $out/bin
+    cp -r opt/bisq/lib/app $out/lib
+
+    install -D -m 777 ${bisq-launcher ""} $out/bin/bisq
+    substituteAllInPlace $out/bin/bisq
+    wrapProgram $out/bin/bisq --prefix PATH : ${binPath} --prefix LD_LIBRARY_PATH : ${libraryPath}
+
+    install -D -m 777 ${bisq-launcher "-Dglass.gtk.uiScale=2.0"} $out/bin/bisq-hidpi
+    substituteAllInPlace $out/bin/bisq-hidpi
+    wrapProgram $out/bin/bisq-hidpi --prefix PATH : ${binPath} --prefix LD_LIBRARY_PATH : ${libraryPath}
+
+    for n in 16 24 32 48 64 96 128 256; do
+      size=$n"x"$n
+      magick opt/bisq/lib/Bisq.png -resize $size bisq.png
+      install -Dm644 -t $out/share/icons/hicolor/$size/apps bisq.png
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Decentralized bitcoin exchange network (Bisq 1)";
+    homepage = "https://bisq.network";
+    mainProgram = "bisq";
+    sourceProvenance = with lib.sourceTypes; [
+      binaryBytecode
+      binaryNativeCode
+    ];
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ pmw ];
+    platforms = [
+      "x86_64-linux"
+    ];
+  };
+})

From 1e77780471d27d2dbb70481630d4204f869548c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 05:17:16 +0000
Subject: [PATCH 084/210] zwave-js-ui: 11.20.0 -> 11.21.1

---
 pkgs/by-name/zw/zwave-js-ui/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index 9eae37d2d4ef..5633f22e76f2 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "11.20.0";
+  version = "11.21.1";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-No9s6fZk8b2eE4LPYbX7juSBNDpG49kMTdEeAcC62Ms=";
+    hash = "sha256-TBSc1dMOjZhJFffVm0SHbwDzDQFhXVjpeQ6qkYV14ew=";
   };
-  npmDepsHash = "sha256-/mAUsCdOd9aDzUnJCEI9gr++55xdwDy6OXgUkF8EcM0=";
+  npmDepsHash = "sha256-AS4/eOZG2nXErCacXR4FerUkqpt4BNwUjohuLMsauks=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 

From d107b05be09495d7e4dea83fb7f24d0c20befccb Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Thu, 25 Jun 2026 23:03:47 -0700
Subject: [PATCH 085/210] =?UTF-8?q?zulip:=205.12.3=20=E2=86=92=205.12.4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #526892; refs #521305.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 pkgs/by-name/zu/zulip/package.nix | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/zu/zulip/package.nix b/pkgs/by-name/zu/zulip/package.nix
index 14cd14a49b54..9d1fca11cf12 100644
--- a/pkgs/by-name/zu/zulip/package.nix
+++ b/pkgs/by-name/zu/zulip/package.nix
@@ -4,39 +4,40 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   nodejs,
-  pnpm_10_29_2,
+  pnpm_11,
   pnpmConfigHook,
   python3,
-  electron_39,
+  electron_42,
   makeDesktopItem,
   makeBinaryWrapper,
   copyDesktopItems,
 }:
 
 let
-  electron = electron_39;
+  electron = electron_42;
+  pnpm = pnpm_11;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zulip";
-  version = "5.12.3";
+  version = "5.12.4";
 
   src = fetchFromGitHub {
     owner = "zulip";
     repo = "zulip-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jRco2eyQrWf5jGvdWYn4mt8FD/xu1+FftQoB3wuF2Lw=";
+    hash = "sha256-0TQKQfjfA1Nn/xvtHF0t6i+whLkyu1kVwuZ62Z0AZgk=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10_29_2;
-    fetcherVersion = 3;
-    hash = "sha256-s/KllzT46L2o4SWS3z3Z7FDQD6FEEEAnPdM6tsfGRUo=";
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-D9Ge0Ao1fnVA1hk+K1ScZ3iCnl1+iqUtZSG5ACO2H2M=";
   };
 
   nativeBuildInputs = [
     nodejs
-    pnpm_10_29_2
+    pnpm
     pnpmConfigHook
     makeBinaryWrapper
     copyDesktopItems
@@ -46,8 +47,9 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-    npm_config_nodedir=${electron.headers} \
-      node --run pack -- \
+    pnpm exec electron-vite build
+    npm_package_config_node_gyp_nodedir=${electron.headers} \
+      pnpm exec electron-builder --dir \
       -c.electronDist=${electron.dist} \
       -c.electronVersion=${electron.version}
 

From 03aae1016e762e4c25bb5b158d3bebbb90a56d7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Santos=20Reis?= <joao.reis@tweag.io>
Date: Tue, 23 Jun 2026 15:05:12 +0100
Subject: [PATCH 086/210] busybox: backport tar symlink bug fix

---
 pkgs/os-specific/linux/busybox/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index d155c1064676..bfb3f424aa45 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -99,6 +99,13 @@ stdenv.mkDerivation (finalAttrs: {
       excludes = [ "networking/httpd_ratelimit_cgi.c" ]; # New since release.
       hash = "sha256-Msm9sDZrVx7ofunnvnTS73SPKUUpR3Tv5xZ/wBd+rts=";
     })
+    # tar: only strip unsafe components from hardlinks, not symlinks
+    # fix issue introduced by the previous patch (CVE-2026-26157_CVE-2026-26158.patch)
+    (fetchpatch {
+      name = "CVE-2026-26157_CVE-2026-26158-2.patch";
+      url = "https://github.com/vda-linux/busybox_mirror/commit/599f5dd8fac390c18b79cba4c14c334957605dae.patch";
+      hash = "sha256-go/KHSsuMSm21nC0yvKEtAQs8Jnjjqdcs5i8RWBGwT4=";
+    })
     # syslogd: fix writing to local log file
     # https://lists.busybox.net/pipermail/busybox/2024-October/090969.html
     (fetchpatch {

From dccad3b9c424fe87bde2248fcc1cf2239eb7e7e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Santos=20Reis?= <joao.reis@tweag.io>
Date: Fri, 26 Jun 2026 10:40:11 +0100
Subject: [PATCH 087/210] busybox: re-enable tar tests

---
 pkgs/os-specific/linux/busybox/default.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index bfb3f424aa45..20a76523092a 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -270,12 +270,6 @@ stdenv.mkDerivation (finalAttrs: {
         # Relies on suid/guid bits
         skip-testcase cpio.tests "cpio restores suid/sgid bits"
 
-        # Weird failures, looks related to our sandbox
-        skip-testcase tar.tests "tar does not extract into symlinks"
-        skip-testcase tar.tests "tar -k does not extract into symlinks"
-        skip-testcase tar.tests "tar Symlink attack: create symlink and then write through it"
-        skip-testcase tar.tests "tar Symlinks and hardlinks coexist"
-
         popd
       '';
     });

From a4f31c71d7e0ee73d8235263f885303d7b52598c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 12:01:19 +0000
Subject: [PATCH 088/210] lunar-client: 3.7.6 -> 3.7.9

---
 pkgs/by-name/lu/lunar-client/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lu/lunar-client/package.nix b/pkgs/by-name/lu/lunar-client/package.nix
index ecf1bb7599e9..7714186e91c0 100644
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunarclient";
-  version = "3.7.6";
+  version = "3.7.9";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}-ow.AppImage";
-    hash = "sha512-+xC7hvpQfmXkZ+FndNAWIxgfWjodfdcCrHmPe5XqEC+3cBkT6KpOxvuw7o0qAebxo6VNN5tKuAPfibfZfeH+RQ==";
+    hash = "sha512-7rVPN/CmnaA91mnNQkuK4/pmPtHeLvsLeuzBlEBbRT2RrYtSxF3eEnHiFndlMzmRor8FWuFITz43QFPgFVMJpQ==";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 5773aa99c5a2e0cea5f375c2f59b46ab9168b1e8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 12:02:53 +0000
Subject: [PATCH 089/210] python3Packages.switchbot-api: 2.11.1 -> 2.12.0

---
 pkgs/development/python-modules/switchbot-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/switchbot-api/default.nix b/pkgs/development/python-modules/switchbot-api/default.nix
index 9839f490ee1c..deeab9eb65f6 100644
--- a/pkgs/development/python-modules/switchbot-api/default.nix
+++ b/pkgs/development/python-modules/switchbot-api/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "switchbot-api";
-  version = "2.11.1";
+  version = "2.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SeraphicCorp";
     repo = "py-switchbot-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xgfFpylMS8Xs3erM7vuJKun6fYOtJ6kfXgBVSkejbJI=";
+    hash = "sha256-mvGWuj+YpAqMg8dpICMwkY73vVwrvF6Klld2h2q1Mig=";
   };
 
   build-system = [ poetry-core ];

From 0688e5615d2de212ae34ec8e9e4503c63ab91652 Mon Sep 17 00:00:00 2001
From: Lyn <me@fugi.dev>
Date: Fri, 26 Jun 2026 14:09:29 +0200
Subject: [PATCH 090/210] joplin-desktop: pin nodejs_22 to fix build on
 aarch64-darwin

---
 pkgs/by-name/jo/joplin-desktop/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/jo/joplin-desktop/package.nix b/pkgs/by-name/jo/joplin-desktop/package.nix
index 444eecdda5cf..c1005e35295a 100644
--- a/pkgs/by-name/jo/joplin-desktop/package.nix
+++ b/pkgs/by-name/jo/joplin-desktop/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  nodejs,
+  nodejs_22,
   makeDesktopItem,
   copyDesktopItems,
   makeWrapper,
@@ -25,7 +25,9 @@
 }:
 
 let
-  yarn-berry = yarn-berry_4;
+  # nodejs pin should be obsolete once #522655 is in master
+  nodejs = nodejs_22;
+  yarn-berry = yarn-berry_4.override { inherit nodejs; };
 
   releaseData = lib.importJSON ./release-data.json;
 in

From 1f3eacd0c6acdc37a5fe8c1f739864979f5768c9 Mon Sep 17 00:00:00 2001
From: Sebastian Blunt <nix@sebastianblunt.com>
Date: Fri, 26 Jun 2026 05:11:07 -0700
Subject: [PATCH 091/210] cyberchef: 11.0.0 -> 11.2.0

They modified their release naming to include the hash of the git commit
that it's based on, so this adds a commit variable to support that.
---
 pkgs/by-name/cy/cyberchef/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cy/cyberchef/package.nix b/pkgs/by-name/cy/cyberchef/package.nix
index 515da83edae1..ecba96cf49f3 100644
--- a/pkgs/by-name/cy/cyberchef/package.nix
+++ b/pkgs/by-name/cy/cyberchef/package.nix
@@ -21,15 +21,16 @@ let
       categories = [ "Development" ];
     }
   );
-  version = "11.0.0";
+  version = "11.2.0";
+  commit = "d358d82cbcb269d764a2deb598a37043bd054f45";
 in
 stdenv.mkDerivation {
   pname = "cyberchef";
   inherit version;
 
   src = fetchzip {
-    url = "https://github.com/gchq/CyberChef/releases/download/v${version}/CyberChef_v${version}.zip";
-    hash = "sha256-Hom0YFel1GVdyx/1q7N93se6uLUVutp0Lu31WNhkPPA=";
+    url = "https://github.com/gchq/CyberChef/releases/download/v${version}/CyberChef_${commit}.zip";
+    hash = "sha256-3DXIrxCefiEYqZOPs8pO5jWdHFj7cPGgrwZcwE4ESPg=";
     stripRoot = false;
   };
 

From a49e5ce8f0568677026fcc3ec31705c942eb7863 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 12:22:09 +0000
Subject: [PATCH 092/210] workcraft: 3.5.4 -> 3.5.5

---
 pkgs/by-name/wo/workcraft/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wo/workcraft/package.nix b/pkgs/by-name/wo/workcraft/package.nix
index 6012fabf47eb..fea071c44337 100644
--- a/pkgs/by-name/wo/workcraft/package.nix
+++ b/pkgs/by-name/wo/workcraft/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "workcraft";
-  version = "3.5.4";
+  version = "3.5.5";
 
   src = fetchurl {
     url = "https://github.com/workcraft/workcraft/releases/download/v${finalAttrs.version}/workcraft-v${finalAttrs.version}-linux.tar.gz";
-    hash = "sha256-+G4Z9GfyfdBL3qb8RqtmRPq6wC6et4P3S6Owy/L5sSU=";
+    hash = "sha256-zpuwNwVu9iH7JSHsSyGt3gl6swOHa2b9uDC8Ck2Mtno=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 4c4503b1fda76574963c3c14a630d38eee54c0e1 Mon Sep 17 00:00:00 2001
From: Henrique Oliveira <github@m0streng0.eu>
Date: Fri, 26 Jun 2026 14:43:41 +0200
Subject: [PATCH 093/210] caido-cli: 0.56.2 -> 0.57.0

---
 pkgs/by-name/ca/caido-cli/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ca/caido-cli/package.nix b/pkgs/by-name/ca/caido-cli/package.nix
index f566af5e5cd4..4dd939bb2417 100644
--- a/pkgs/by-name/ca/caido-cli/package.nix
+++ b/pkgs/by-name/ca/caido-cli/package.nix
@@ -9,25 +9,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "caido-cli";
-  version = "0.56.2";
+  version = "0.57.0";
 
   src = fetchurl (
     {
       x86_64-linux = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-linux-x86_64.tar.gz";
-        hash = "sha256-SUkysiFdH4ilA6MKYMiSqC80NkYZ9YVO/7CT0hQY++Q=";
+        hash = "sha256-ujpGYERNceUPartkgx4o38xUfPwWvnmiEnjkvmEbybA=";
       };
       aarch64-linux = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-linux-aarch64.tar.gz";
-        hash = "sha256-rYRzo3iYjWAvRGm1+wBLGkr3eUoAGbi71+AX0qmoIXs=";
+        hash = "sha256-d1xzF0N6emShCQpotFiQEj1wV3hdt1DK7R+6Smlxrmg=";
       };
       x86_64-darwin = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-mac-x86_64.zip";
-        hash = "sha256-mMWivNwgAmMYitERwnP/lAzgzua/2UDDDffSbgZXlr4=";
+        hash = "sha256-xh6kaYPJ7dwDHM1CkDzxYBHM4cKUex+XPXceqvQgWX4=";
       };
       aarch64-darwin = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-mac-aarch64.zip";
-        hash = "sha256-19eEV79yk6PCHdl7oTw4Gqt10B7rYnZCJxBebDssFZc=";
+        hash = "sha256-FwbKLEwjiFzZWdBS6RgsDtc/EkI9AT2CBGwdmgEdDnw=";
       };
     }
     .${stdenv.hostPlatform.system}

From 47f1c61864568ef61f76c245d5003c0f08033f62 Mon Sep 17 00:00:00 2001
From: Henrique Oliveira <github@m0streng0.eu>
Date: Fri, 26 Jun 2026 14:43:53 +0200
Subject: [PATCH 094/210] caido-desktop: 0.56.2 -> 0.57.0

---
 pkgs/by-name/ca/caido-desktop/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ca/caido-desktop/package.nix b/pkgs/by-name/ca/caido-desktop/package.nix
index 2b7b546ba6e2..3f9c146862d0 100644
--- a/pkgs/by-name/ca/caido-desktop/package.nix
+++ b/pkgs/by-name/ca/caido-desktop/package.nix
@@ -9,24 +9,24 @@
 
 let
   pname = "caido-desktop";
-  version = "0.56.2";
+  version = "0.57.0";
 
   sources = {
     x86_64-linux = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-x86_64.AppImage";
-      hash = "sha256-GW8prdvR9+WNO7bdz9ok27Aqra9+jgpZyBnYIM+G5Ys=";
+      hash = "sha256-a+WHhJ+TvwhOqHOxU7Y5LXeXAJ6T8hk71meFuTR+ra8=";
     };
     aarch64-linux = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-aarch64.AppImage";
-      hash = "sha256-mN5wf9RUllfbR/CfLTE6Ywzoj8wKmEG1clVCKRqPUtU=";
+      hash = "sha256-B7dw9uoG++AqT264ZlyHxGpv68fH5SlYzDKUaIM8c14=";
     };
     x86_64-darwin = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-mac-x86_64.dmg";
-      hash = "sha256-4B3DQJL8M6otnLpFjr4haZA4EWHpgVADQW4DcwsDhIM=";
+      hash = "sha256-0VCLjl0Lpe+4Mgnrp6X8ApJWjAjuhkaZOxQ4P3C8MSM=";
     };
     aarch64-darwin = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-mac-aarch64.dmg";
-      hash = "sha256-kZdfcZueMmgEHpNTIPANsN7X4lnVOfZXbKHxComaalM=";
+      hash = "sha256-GmpMnaGR7gYz1RvSO5xj9AA3xU1mn2IBInakmVkuG7A=";
     };
   };
 

From 407aea00ffb74fe4e07eab4dd433c021a072ac3f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 26 Jun 2026 15:11:33 +0200
Subject: [PATCH 095/210] feishin: pnpm_10_29_2 -> pnpm_10

---
 pkgs/by-name/fe/feishin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index 4e2f82063d42..f8a1a7ee214c 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -8,7 +8,7 @@
   mpv-unwrapped,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10_29_2,
+  pnpm_10,
   darwin,
   actool,
   copyDesktopItems,
@@ -42,7 +42,7 @@ buildNpmPackage {
       version
       src
       ;
-    pnpm = pnpm_10_29_2;
+    pnpm = pnpm_10;
     fetcherVersion = 3;
     hash = "sha256-zNOGJ24G0xcgsGK4DmbBm7d1PHTp7IJS+RTALGRtfDg=";
   };
@@ -50,7 +50,7 @@ buildNpmPackage {
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   nativeBuildInputs = [
-    pnpm_10_29_2
+    pnpm_10
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [

From 03abf4ac09895d7bd854de76ca9e1c6343050926 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 13:21:14 +0000
Subject: [PATCH 096/210] python3Packages.alibabacloud-ram20150501: 1.2.0 ->
 1.2.1

---
 .../python-modules/alibabacloud-ram20150501/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/alibabacloud-ram20150501/default.nix b/pkgs/development/python-modules/alibabacloud-ram20150501/default.nix
index ffa802f1a398..16d4c217e2f8 100644
--- a/pkgs/development/python-modules/alibabacloud-ram20150501/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-ram20150501/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-ram20150501";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -19,7 +19,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "alibabacloud_ram20150501";
     inherit (finalAttrs) version;
-    hash = "sha256-YlNRPIiAdp9P1bNv7d2zYqnKYorZrpwFwO6s9fvJW0I=";
+    hash = "sha256-dzFVfjw5oPAVm59dEMksDeZZXCf0VT3EWeA8zZpMIqU=";
   };
 
   build-system = [ setuptools ];

From efe0cdf744d661fb2a80f91937eaf45ec3880e3e Mon Sep 17 00:00:00 2001
From: Holiu <165534185+Holiu618@users.noreply.github.com>
Date: Fri, 26 Jun 2026 21:26:50 +0800
Subject: [PATCH 097/210] syft: 1.45.1 -> 1.46.0

---
 pkgs/by-name/sy/syft/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sy/syft/package.nix b/pkgs/by-name/sy/syft/package.nix
index f666eaa9dee8..c90ae32ded47 100644
--- a/pkgs/by-name/sy/syft/package.nix
+++ b/pkgs/by-name/sy/syft/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "syft";
-  version = "1.45.1";
+  version = "1.46.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "syft";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JYMauarf2GB6ZJXB5pDZAcYZFJXWqEkULF3KIE8WvJQ=";
+    hash = "sha256-gjVfsJQoE//u0i6lVQCEF2dSUvoepIOaqqCazOUgSwI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
   # hash mismatch with darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-KjbxAhjIb8h4F6kXfa38qUwWloK/3Rh6YU8G7rMIOtw=";
+  vendorHash = "sha256-t4L+Q82ohwBEXVh1Yy7OOrNhinnAXzOHO7mmFJQUZYM=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From a33cbb4c35be14beb91ed9253141b321eadc5d29 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 14:17:00 +0000
Subject: [PATCH 098/210] repomix: 1.14.0 -> 1.15.0

---
 pkgs/by-name/re/repomix/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/re/repomix/package.nix b/pkgs/by-name/re/repomix/package.nix
index 19b16ae59f8b..89edde64d8b5 100644
--- a/pkgs/by-name/re/repomix/package.nix
+++ b/pkgs/by-name/re/repomix/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "repomix";
-  version = "1.14.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "yamadashy";
     repo = "repomix";
     tag = "v${version}";
-    hash = "sha256-xvRCblm7WRvxFBjsxe3AjvLt8AvL4Q9F6SQuOv39ADA=";
+    hash = "sha256-M96q1oJ2ipDMfeos5P0FBbngjStC86qBlQcRFXitkt4=";
   };
 
-  npmDepsHash = "sha256-Pw2/w0rn5UloUqPZrze2l1Qi7JEdAXxlpPm7dxEHzWU=";
+  npmDepsHash = "sha256-3AP+mMFipVUfO7vLY7ZjaJ8FG4uwpxC2+jYtaHz49YI=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

From dae05a7dd5aae8d50aceea41a6bbcf0000de62e8 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Fri, 26 Jun 2026 17:56:27 +0200
Subject: [PATCH 099/210] =?UTF-8?q?glab:=201.101.0=20=E2=86=92=201.105.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/gl/glab/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gl/glab/package.nix b/pkgs/by-name/gl/glab/package.nix
index 366d896bbacc..57f5b58c450f 100644
--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "glab";
-  version = "1.101.0";
+  version = "1.105.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K8QL9Ff5FHmiXyBEdsUE8kwhSF0camSFh08LbfJb3wo=";
+    hash = "sha256-MKb46PHgm+jfHGf2rEh0o7ghtb6JR4UE3Mam9z+2gw8=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-u1zvzMrQGyTVcl/lnIGK3dfisxGYRa2LGpDMBDq6rJk=";
+  vendorHash = "sha256-aFrTCqvxVaiEJFKa4zY0kFW1P6QDDD4UG5x+yHK6vZ8=";
 
   ldflags = [
     "-s"

From ac0755d316f30a64761c8877fd0cf93aa903766e Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Fri, 26 Jun 2026 19:38:03 +0300
Subject: [PATCH 100/210] sail-riscv: 0.8 -> 0.12; adopt

The patch was the best way I could figure out to nuke the weird
FetchContent that upstream does. I'll try to make this slightly less
annoying upstream.
---
 pkgs/by-name/sa/sail-riscv/package.nix        | 24 ++++++--
 .../by-name/sa/sail-riscv/unvendor-deps.patch | 57 +++++++++++++++++++
 2 files changed, 75 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/by-name/sa/sail-riscv/unvendor-deps.patch

diff --git a/pkgs/by-name/sa/sail-riscv/package.nix b/pkgs/by-name/sa/sail-riscv/package.nix
index a27b9c4e0ca5..55d94609af37 100644
--- a/pkgs/by-name/sa/sail-riscv/package.nix
+++ b/pkgs/by-name/sa/sail-riscv/package.nix
@@ -10,19 +10,25 @@
   ocamlPackages,
 
   gmp,
+  cli11,
+  jsoncons,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sail-riscv";
-  version = "0.8";
+  version = "0.12";
 
   src = fetchFromGitHub {
     owner = "riscv";
     repo = "sail-riscv";
-    rev = finalAttrs.version;
-    hash = "sha256-50ATe3DQcdyNOqP85mEMyEwxzpBOplzRN9ulaJNo9zo=";
+    tag = finalAttrs.version;
+    hash = "sha256-pi/XP6+NX/wNpBESmnEg2d5cppMpMwFripDPk9vTx9I=";
   };
 
+  patches = [
+    ./unvendor-deps.patch
+  ];
+
   nativeBuildInputs = [
     z3
     cmake
@@ -32,16 +38,22 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [
     gmp
+    # Header-only
+    jsoncons
+    cli11
   ];
   strictDeps = true;
 
-  # sail-riscv 0.8 fails to install without compressed_changelog
-  ninjaFlags = [ "compressed_changelog" ];
+  cmakeFlags = [
+    (lib.cmakeBool "ENABLE_LTO" true)
+  ];
 
   meta = {
     homepage = "https://github.com/riscv/sail-riscv";
     description = "Formal specification of the RISC-V architecture, written in Sail";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      xokdvium
+    ];
     license = lib.licenses.bsd2;
   };
 })
diff --git a/pkgs/by-name/sa/sail-riscv/unvendor-deps.patch b/pkgs/by-name/sa/sail-riscv/unvendor-deps.patch
new file mode 100644
index 000000000000..0b689e125f2e
--- /dev/null
+++ b/pkgs/by-name/sa/sail-riscv/unvendor-deps.patch
@@ -0,0 +1,57 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 2446abb8..8946820c 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -194,6 +194,8 @@ option(COVERAGE "Compile with Sail coverage collection enabled.")
+ include(GNUInstallDirs)
+ 
+ # Third party dependencies.
++find_package(CLI11 REQUIRED)
++find_package(jsoncons REQUIRED)
+ add_subdirectory("dependencies")
+ 
+ # Sail C runtime.
+diff --git a/c_emulator/CMakeLists.txt b/c_emulator/CMakeLists.txt
+index 349d2c68..3d121b75 100644
+--- a/c_emulator/CMakeLists.txt
++++ b/c_emulator/CMakeLists.txt
+@@ -60,7 +60,7 @@ target_include_directories(riscv_model
+ )
+ 
+ target_link_libraries(riscv_model
+-    PUBLIC elfio softfloat sail_runtime jsoncons default_config
++    PUBLIC elfio softfloat sail_runtime jsoncons::jsoncons default_config
+ )
+ 
+ add_dependencies(riscv_model generated_sail_riscv_model generated_config_schema)
+@@ -94,7 +94,7 @@ set_source_files_properties(
+ add_dependencies(sail_riscv_sim generated_sail_riscv_model)
+ 
+ target_link_libraries(sail_riscv_sim
+-    PRIVATE CLI11 riscv_model
++    PRIVATE CLI11::CLI11 riscv_model
+ )
+ 
+ # After the emulator is built, use it to validate the generated config files.
+diff --git a/c_emulator/riscv_sim.cpp b/c_emulator/riscv_sim.cpp
+index b50bb4cb..d8a59db1 100644
+--- a/c_emulator/riscv_sim.cpp
++++ b/c_emulator/riscv_sim.cpp
+@@ -18,7 +18,7 @@
+ #include <unistd.h>
+ #include <vector>
+ 
+-#include "CLI11.hpp"
++#include "CLI/CLI.hpp"
+ #include "elf_loader.h"
+ #include "jsoncons/config/version.hpp"
+ #include "jsoncons/json.hpp"
+diff --git a/dependencies/CMakeLists.txt b/dependencies/CMakeLists.txt
+index 95600694..66692022 100644
+--- a/dependencies/CMakeLists.txt
++++ b/dependencies/CMakeLists.txt
+@@ -1,4 +1,2 @@
+-add_subdirectory("CLI11")
+ add_subdirectory("elfio")
+ add_subdirectory("softfloat")
+-add_subdirectory("jsoncons")

From fdff66f505315add89b754d5e184e8af8c25b52b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 16:45:49 +0000
Subject: [PATCH 101/210] ddhx: 0.9.3 -> 0.10.0

---
 pkgs/by-name/dd/ddhx/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/dd/ddhx/package.nix b/pkgs/by-name/dd/ddhx/package.nix
index e69826b472ed..033080c49167 100644
--- a/pkgs/by-name/dd/ddhx/package.nix
+++ b/pkgs/by-name/dd/ddhx/package.nix
@@ -5,13 +5,13 @@
 }:
 buildDubPackage (finalAttrs: {
   pname = "ddhx";
-  version = "0.9.3";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "dd86k";
     repo = "ddhx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7sXXkn/B9iN8Iq4X/Rj7BufdHKDBS1aG3pXcInG+UaI=";
+    hash = "sha256-1dbY7xUOpwihrppuB+tyHuV2b12E4Yv2J69LXULxmg0=";
   };
 
   dubLock = ./dub-lock.json;

From 41af54d9b2140f9c460b0d0fc58e901e7b8ceca9 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Fri, 26 Jun 2026 12:56:23 -0700
Subject: [PATCH 102/210] buildVscode: enable strictDeps, __structuredAttrs

Encountered this while trying to repackage windsurf as devin-desktop.

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/applications/editors/vscode/generic.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index de93186c3db1..752ff76bf682 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -249,6 +249,9 @@ stdenv.mkDerivation (
       })
     ];
 
+    strictDeps = true;
+    __structuredAttrs = true;
+
     buildInputs = [
       libsecret
     ]

From f1e050e9d4cbcc1f93b4f5eae204be402e964a9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Sat, 27 Jun 2026 03:08:00 +0700
Subject: [PATCH 103/210] =?UTF-8?q?nixtamal:=201.8.0=20=E2=86=92=201.8.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/ni/nixtamal/package.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ni/nixtamal/package.nix b/pkgs/by-name/ni/nixtamal/package.nix
index adfbb59e507d..517a70f1e9a4 100644
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -21,7 +21,7 @@
 
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "nixtamal";
-  version = "1.8.0";
+  version = "1.8.2";
   release_year = 2026;
 
   minimalOCamlVersion = "5.3";
@@ -30,13 +30,15 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     url = "https://darcs.toastal.in.th/nixtamal/stable/";
     mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
     rev = finalAttrs.version;
-    hash = "sha256-75p+4hZtgsiUeOxRhLpg3l/0G/XS2uCCPF58KbGTqJ8=";
+    hash = "sha256-WS3Au0V2AFUxRoINZvBLDJWvsTn/SyiN6jSLOWb+PQY=";
   };
 
   nativeBuildInputs = [
     makeBinaryWrapper
     removeReferencesTo
     installShellFiles
+    # Compile-time preprocessing
+    ocamlPackages.ppx_deriving
     # Completions
     ocamlPackages.cmdliner
     # For manpages
@@ -48,7 +50,6 @@ ocamlPackages.buildDunePackage (finalAttrs: {
   buildInputs = with ocamlPackages; [
     cmdliner
     fmt
-    ppx_deriving_qcheck
   ];
 
   propagatedBuildInputs = with ocamlPackages; [
@@ -62,8 +63,6 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     })
     kdl
     logs
-    ppx_deriving
-    qcheck-core
     saturn
     stdint
     uri
@@ -72,8 +71,10 @@ ocamlPackages.buildDunePackage (finalAttrs: {
 
   checkInputs = with ocamlPackages; [
     alcotest
+    ppx_deriving_qcheck
     qcheck
     qcheck-alcotest
+    qcheck-core
   ];
 
   postPatch = ''

From a41d19f469e13ad9b832834dc15b40e507631a9a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 20:32:02 +0000
Subject: [PATCH 104/210] cargo-show-asm: 0.2.59 -> 0.2.62

---
 pkgs/by-name/ca/cargo-show-asm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-show-asm/package.nix b/pkgs/by-name/ca/cargo-show-asm/package.nix
index 5714316129c1..039fa3861b06 100644
--- a/pkgs/by-name/ca/cargo-show-asm/package.nix
+++ b/pkgs/by-name/ca/cargo-show-asm/package.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-show-asm";
-  version = "0.2.59";
+  version = "0.2.62";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-5RNfokTD86OFGzWRUyY29+d5P3sWWHmzGCGdIkzIK/g=";
+    hash = "sha256-gR1+Daz3EY6HtijWqbaCg6nD2B8gi6EYMYFspW39nlw=";
   };
 
-  cargoHash = "sha256-EcnxozYMjxFHwLpeYwh5dP18+1tiPsY6uQBie3SCg18=";
+  cargoHash = "sha256-QpitYFYRkzntVW15PJimVIX6AaIU+qVY7g3Y88GnKkA=";
 
   nativeBuildInputs = [
     installShellFiles

From 398e27c34805b8195374d00621886e22f0baae86 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 21:09:54 +0000
Subject: [PATCH 105/210] codex: 0.142.0 -> 0.142.2

---
 pkgs/by-name/co/codex/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 4514766a1ba0..4dded060e51a 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -26,18 +26,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.142.0";
+  version = "0.142.2";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-F8wlv0vSuljNFDgIzoeuVxvD0dk90z2FBtpBTMih7AA=";
+    hash = "sha256-580LZSn3+lqyW5x7zkVX0TjW+d6apb/P1eG4q586dio=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-fvEFNE12J6zaLZrN6oQB8X+jXoKPSCWrL17Sl28+7/c=";
+  cargoHash = "sha256-1gDiCB3Nf/0aIm+EoL3g9C0xbCi3cv6TfH5VytjJpOY=";
 
   __structuredAttrs = true;
 

From 4be720f49b6e8ec51f2e9c7fd992d0ade1ce7749 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 22:29:43 +0000
Subject: [PATCH 106/210] rura: 1.5.0 -> 1.7.0

---
 pkgs/by-name/ru/rura/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rura/package.nix b/pkgs/by-name/ru/rura/package.nix
index 0b23a2941339..8d7752479584 100644
--- a/pkgs/by-name/ru/rura/package.nix
+++ b/pkgs/by-name/ru/rura/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rura";
-  version = "1.5.0";
+  version = "1.7.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "tlipinski";
     repo = "rura";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AL8qrO6QlHD+cLMEjgfH/4cLqxsRapp9nxJ/eMe0uic=";
+    hash = "sha256-rz8Hmxse1THGH3inGP3K+7JY3Lh9qaGUdESSHkai82c=";
   };
 
-  cargoHash = "sha256-t/ylPVTi0AAumiixU5oaFgldtKkwYvuETjaxCwzveDk=";
+  cargoHash = "sha256-Ytbo8fVf6oAHGQvicU3TFGQxoYh36CISuRaMwd1Ysf4=";
 
   passthru = {
     updateScript = nix-update-script { };

From 56374d7ba0a12d0118cc719a42be8b8e115f6f7c Mon Sep 17 00:00:00 2001
From: Skye Soss <skye@soss.website>
Date: Fri, 5 Jun 2026 02:11:00 -0500
Subject: [PATCH 107/210] mlkit: also install barry

---
 pkgs/by-name/ml/mlkit/package.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ml/mlkit/package.nix b/pkgs/by-name/ml/mlkit/package.nix
index 68fe4302198d..62b090e74a19 100644
--- a/pkgs/by-name/ml/mlkit/package.nix
+++ b/pkgs/by-name/ml/mlkit/package.nix
@@ -27,11 +27,13 @@ stdenv.mkDerivation (finalAttrs: {
     "mlkit_libs"
     "smltojs"
     "smltojs_basislibs"
+    "barry"
   ];
 
   installTargets = [
     "install"
     "install_smltojs"
+    "install_barry"
   ];
 
   doCheck = true;
@@ -46,6 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
     make -C test_dev test
     echo ==== Running MLKit test suite: test_prof ====
     make -C test_dev test_prof
+    echo ==== Running Barry test suite ====
+    make -C test/barry
     runHook postCheck
   '';
 
@@ -54,7 +58,10 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://elsman.com/mlkit/";
     changelog = "https://github.com/melsman/mlkit/blob/v${finalAttrs.version}/NEWS.md";
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.unix;
+    platforms = [
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
     maintainers = with lib.maintainers; [ athas ];
   };
 })

From 82d86164e4b2c7fea515cada29c277549935a7df Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 23:10:56 +0000
Subject: [PATCH 108/210] linyaps-box: 2.2.0 -> 2.2.1

---
 pkgs/by-name/li/linyaps-box/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/linyaps-box/package.nix b/pkgs/by-name/li/linyaps-box/package.nix
index d4d11afd0e63..2bda17485993 100644
--- a/pkgs/by-name/li/linyaps-box/package.nix
+++ b/pkgs/by-name/li/linyaps-box/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "linyaps-box";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "OpenAtom-Linyaps";
     repo = "linyaps-box";
     rev = finalAttrs.version;
-    hash = "sha256-s17BI5nftQFrDZQVKBJjQYSOJHDPlkA2VLG4Hd61xSY=";
+    hash = "sha256-KULNPztaDeO6Dih98KcnawMz2rDjQd6AYT9FgAADhIg=";
   };
 
   nativeBuildInputs = [

From 78499735365188b3e605abb1e3699993f42420eb Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Fri, 26 Jun 2026 15:50:18 -0700
Subject: [PATCH 109/210] kiro: fix build on Darwin

---
 pkgs/by-name/ki/kiro/package.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ki/kiro/package.nix b/pkgs/by-name/ki/kiro/package.nix
index 9c6e7361eebc..60d81bd99c69 100644
--- a/pkgs/by-name/ki/kiro/package.nix
+++ b/pkgs/by-name/ki/kiro/package.nix
@@ -5,6 +5,7 @@
   fetchurl,
   extraCommandLineArgs ? "",
   useVSCodeRipgrep ? stdenv.hostPlatform.isDarwin,
+  _7zz,
 }:
 
 let
@@ -31,7 +32,16 @@ in
     url = sources.url;
     hash = sources.hash;
   };
-  sourceRoot = "Kiro";
+
+  # Kiro.dmg is APFS formatted, unpack with 7zz
+  extraNativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ _7zz ];
+
+  sourceRoot = if stdenv.hostPlatform.isDarwin then "Kiro.app" else "Kiro";
+
+  sourceExecutableName = if stdenv.hostPlatform.isDarwin then "code" else "kiro";
+
+  dontFixup = stdenv.hostPlatform.isDarwin;
+
   patchVSCodePath = true;
 
   tests = { };

From 2b8a1f0842fbccebf45a016f96561853161c03cf Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 15:41:00 +0200
Subject: [PATCH 110/210] cai: init at 1.1.5-unstable-2026-06-05

Framework for AI Security

https://github.com/aliasrobotics/cai
---
 pkgs/by-name/ca/cai/package.nix | 131 ++++++++++++++++++++++++++++++++
 1 file changed, 131 insertions(+)
 create mode 100644 pkgs/by-name/ca/cai/package.nix

diff --git a/pkgs/by-name/ca/cai/package.nix b/pkgs/by-name/ca/cai/package.nix
new file mode 100644
index 000000000000..2bc457a2ccfd
--- /dev/null
+++ b/pkgs/by-name/ca/cai/package.nix
@@ -0,0 +1,131 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+  writableTmpDirAsHomeHook,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "cai";
+  version = "1.1.5-unstable-2026-06-05";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "aliasrobotics";
+    repo = "cai";
+    rev = "1c79507140845d0c57455e3b623e489680fd80e8";
+    hash = "sha256-LcU9GoUulpeAaaBZr2Mg/C+UmjZ74UL+SGqdB0P9JtA=";
+  };
+
+  pythonRemoveDeps = [
+    "cryptography"
+    "dotenv"
+    "openinference-instrumentation-openai"
+    "pypdf2"
+  ];
+
+  pythonRelaxDeps = [ "openai" ];
+
+  build-system = with python3Packages; [ hatchling ];
+
+  dependencies = with python3Packages; [
+    cryptography
+    curl-cffi
+    dnspython
+    docker
+    fastapi
+    flask
+    folium
+    graphviz
+    griffe
+    litellm
+    mako
+    matplotlib
+    mcp
+    mkdocs
+    mkdocs-material
+    nest-asyncio
+    networkx
+    numpy
+    numpy
+    openai
+    openinference-instrumentation-openai
+    pandas
+    paramiko
+    prompt-toolkit
+    pydantic
+    pypdf
+    python-dotenv
+    questionary
+    requests
+    rich
+    textual
+    trafilatura
+    types-requests
+    typing-extensions
+    wasabi
+    websockets
+  ];
+
+  nativeInstallCheckInputs = with python3Packages; [
+    inline-snapshot
+    litellm
+    pytest-asyncio
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  pythonImportsCheck = [ "cai" ];
+
+  disabledTestPaths = [
+    # Exclude examples
+    "examples/"
+    # API key is required
+    "tests/agents/test_agent_inference.py"
+    "tests/agents/test_agent_one_tool.py"
+    "tests/agents/test_blue_teamer_gctr.py"
+    "tests/api/test_api.py"
+    "tests/cli/test_cli_headless_cancellation.py"
+    "tests/commands/"
+    "tests/integration/"
+    "tests/refusals/"
+    "tests/test_unified_pattern.py"
+    "tools/tpm_test.py"
+    # openai 2.x API changes
+    "tests/cli/test_cli_streaming.py"
+    "tests/core/test_openai_chatcompletions.py"
+    "tests/core/test_openai_chatcompletions_stream.py"
+    "tests/mcp/test_runner_calls_mcp.py"
+    "tests/tracing/test_agent_tracing.py"
+    "tests/tracing/test_responses_tracing.py"
+    "tests/tracing/test_tracing.py"
+    "tests/tracing/test_tracing_errors.py"
+    "tests/tracing/test_tracing_errors_streamed.py"
+    "tests/voice/test_workflow.py"
+    # Missing symbols (version mismatch)
+    "tests/core/test_auto_compact.py"
+    "tests/core/test_context_optimization.py"
+    # Probing the live interpreter outside sandbox
+    "tests/continuous_ops/test_wizard_worker_python_bin.py"
+    # Tests requires live CTF infrastructure
+    "tests/ctfs/test_ctf.py"
+    # Other error
+    "tests/test_cli_print_deduplication.py"
+    "tests/tools/test_output_tool.py"
+    "tests/util/test_wait_hints_compact.py"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Framework for AI Security";
+    homepage = "https://github.com/aliasrobotics/cai";
+    changelog = "https://github.com/aliasrobotics/cai/releases/tag/${finalAttrs.src.rev}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "cai";
+  };
+})

From de1c0631189ff3c2455de84dab9d5c6af2f5811b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 16 Jun 2026 15:46:46 +0200
Subject: [PATCH 111/210] python3Packages.opentelemetry-instrumentation:
 migrate to finalAttrs

---
 .../opentelemetry-instrumentation/default.nix          | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
index 80c5e8536de1..d8534e95f7f5 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
@@ -10,7 +10,7 @@
   wrapt,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "opentelemetry-instrumentation";
   version = "0.55b0";
   pyproject = true;
@@ -19,11 +19,11 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-python-contrib";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-UM9ezCh3TVwyj257O0rvTCIgfrddobWcVIgJmBUj/Vo=";
   };
 
-  sourceRoot = "${src.name}/opentelemetry-instrumentation";
+  sourceRoot = "${finalAttrs.src.name}/opentelemetry-instrumentation";
 
   build-system = [ hatchling ];
 
@@ -53,8 +53,8 @@ buildPythonPackage rec {
   meta = {
     description = "Instrumentation Tools & Auto Instrumentation for OpenTelemetry Python";
     homepage = "https://github.com/open-telemetry/opentelemetry-python-contrib/tree/main/opentelemetry-instrumentation";
-    changelog = "https://github.com/open-telemetry/opentelemetry-python-contrib/releases/tag/v${version}";
+    changelog = "https://github.com/open-telemetry/opentelemetry-python-contrib/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.natsukium ];
   };
-}
+})

From d754d06167cad3a7b76d31697af22fb420807ce5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 26 Jun 2026 23:59:57 +0200
Subject: [PATCH 112/210] 
 python313Packages.opentelemetry-instrumentation-httpx: disable test on Python
 3.14

---
 .../opentelemetry-instrumentation-httpx/default.nix         | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation-httpx/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation-httpx/default.nix
index 4fe687d399dd..4cf08c1aa584 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation-httpx/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation-httpx/default.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   buildPythonPackage,
   hatchling,
   httpx,
@@ -6,7 +7,9 @@
   opentelemetry-instrumentation,
   opentelemetry-util-http,
   opentelemetry-test-utils,
+  opentelemetry-semantic-conventions,
   pytestCheckHook,
+  pythonOlder,
   respx,
 }:
 
@@ -23,6 +26,7 @@ buildPythonPackage {
     httpx
     opentelemetry-api
     opentelemetry-instrumentation
+    opentelemetry-semantic-conventions
     opentelemetry-util-http
   ];
 
@@ -32,6 +36,8 @@ buildPythonPackage {
     respx
   ];
 
+  doCheck = pythonOlder "3.14";
+
   pythonImportsCheck = [ "opentelemetry.instrumentation.httpx" ];
 
   meta = opentelemetry-instrumentation.meta // {

From 35314051913268fa7c39d3792e575a50a7ebadfe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 00:31:27 +0000
Subject: [PATCH 113/210] python3Packages.hacking: 8.0.0 -> 8.1.0

---
 pkgs/development/python-modules/hacking/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hacking/default.nix b/pkgs/development/python-modules/hacking/default.nix
index 770856ea976c..260ceea913ad 100644
--- a/pkgs/development/python-modules/hacking/default.nix
+++ b/pkgs/development/python-modules/hacking/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "hacking";
-  version = "8.0.0";
+  version = "8.1.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-N89wYj7PMkdMTNYWSCeuff9HU62n+e/HBeiIOhAPi7I=";
+    hash = "sha256-PHjOx8Wkq7SQmlJS1mq5PpswayGthmV+LCA8eLUiQx8=";
   };
 
   postPatch = ''

From dc78f986bb5306327fa8f7eb83e3dd88deb5823a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 00:57:21 +0000
Subject: [PATCH 114/210] python3Packages.mcstatus: 13.1.0 -> 14.0.0

---
 pkgs/development/python-modules/mcstatus/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mcstatus/default.nix b/pkgs/development/python-modules/mcstatus/default.nix
index 2d8ae434aebe..3cbce0ff978a 100644
--- a/pkgs/development/python-modules/mcstatus/default.nix
+++ b/pkgs/development/python-modules/mcstatus/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mcstatus";
-  version = "13.1.0";
+  version = "14.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "py-mine";
     repo = "mcstatus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Fn2i9CCO5wESKSpeM8YlqrzF6RCwBbYQs2wSEgOYAcE=";
+    hash = "sha256-EyBaBC1Ly2549oFohtEulQMXIeRhQjtzvO+XPmwl8Zs=";
   };
 
   build-system = [

From 169a00e8d10b519a54a4e9f7763ee315532d3650 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 01:34:03 +0000
Subject: [PATCH 115/210] 
 home-assistant-custom-lovelace-modules.material-you-utilities: 2.1.15 ->
 2.1.16

---
 .../material-you-utilities/package.nix                      | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
index 0e886d89926d..af26077a697e 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "material-you-utilities";
-  version = "2.1.15";
+  version = "2.1.16";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "material-you-utilities";
     tag = version;
-    hash = "sha256-fqs2+OEBOJDO3Y3QO7+R93TCNg+FooZVgilTxcDcNjo=";
+    hash = "sha256-s8VVV2KmiJ3auQPRwVRWHonYlVWkExC3quRANfW295U=";
   };
 
-  npmDepsHash = "sha256-1Cv90vnfhAY+XaiN523APShl6al/RkFbcVUiNayg+FE=";
+  npmDepsHash = "sha256-D18gwO8zO7lKbaRhj+QaeGzkE7zqXc3KGvz9am4rrFY=";
 
   installPhase = ''
     runHook preInstall

From 4691f591f438818eb2076b60344790ac9c9e4ecf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 02:11:03 +0000
Subject: [PATCH 116/210] lxmf-rs: 0.5.0 -> 0.5.1

---
 pkgs/by-name/lx/lxmf-rs/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/lx/lxmf-rs/package.nix b/pkgs/by-name/lx/lxmf-rs/package.nix
index f528141e83a7..2105a1395f15 100644
--- a/pkgs/by-name/lx/lxmf-rs/package.nix
+++ b/pkgs/by-name/lx/lxmf-rs/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lxmf-rs";
-  version = "0.5.0";
+  version = "0.5.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "FreeTAKTeam";
     repo = "LXMF-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9yTteJCH/5/LGvp6AH74oKYcnue1NetD7DG3fMz+D2Y=";
+    hash = "sha256-ztJHjapogSF1qzyCBsi6mu3ByLdVTBt8y2OVEFyohKk=";
   };
 
-  cargoHash = "sha256-a6O1VslizDom6AuJKF5xZgKNSgrw1EfvJRWpG9J7Le8=";
+  cargoHash = "sha256-g80lnqJ8VxGg0zHqHsQCvJO9AgXFE0ABysSr+XjXBAk=";
 
   nativeBuildInputs = [
     pkg-config

From a9c1e5762a19d40610038140f3a549c53cdfdce5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 02:28:52 +0000
Subject: [PATCH 117/210] gren: 0.6.5 -> 0.6.6

---
 pkgs/by-name/gr/gren/generated-backend-package.nix | 8 ++++----
 pkgs/by-name/gr/gren/package.nix                   | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/gr/gren/generated-backend-package.nix b/pkgs/by-name/gr/gren/generated-backend-package.nix
index 6ff48bab9b53..a097c4ec8656 100644
--- a/pkgs/by-name/gr/gren/generated-backend-package.nix
+++ b/pkgs/by-name/gr/gren/generated-backend-package.nix
@@ -29,11 +29,11 @@
 }:
 mkDerivation {
   pname = "gren";
-  version = "0.6.5";
+  version = "0.6.6";
   src = fetchgit {
     url = "https://github.com/gren-lang/compiler.git";
-    sha256 = "1865x63y0kcp2ax49333i5512vwh845iiyq3b30jm31pr113csvr";
-    rev = "ba2a2153b78086d75fe01ba45bdd630d6f5fc2fc";
+    sha256 = "02hin22kyh2zgxn2fklnfa60iw3ppfr3xnv4z7r39vkf6c2q7fhq";
+    rev = "03c52374f82036e7a3276a94e345a4aa98738b9b";
     fetchSubmodules = true;
   };
   isLibrary = false;
@@ -83,6 +83,6 @@ mkDerivation {
   jailbreak = true;
   homepage = "https://gren-lang.org";
   description = "The `gren` command line interface";
-  license = lib.licensesSpdx."BSD-3-Clause";
+  license = lib.meta.getLicenseFromSpdxId "BSD-3-Clause";
   mainProgram = "gren";
 }
diff --git a/pkgs/by-name/gr/gren/package.nix b/pkgs/by-name/gr/gren/package.nix
index 84ad7637623c..69af8be0e155 100644
--- a/pkgs/by-name/gr/gren/package.nix
+++ b/pkgs/by-name/gr/gren/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gren";
-  version = "0.6.5";
+  version = "0.6.6";
 
   src = fetchFromGitHub {
     owner = "gren-lang";
     repo = "compiler";
     tag = finalAttrs.version;
-    hash = "sha256-eWs2Qsg3jCrBWAP7GAtBkG8RSoljjES6EpdN4IfpxaA=";
+    hash = "sha256-GLqDBTNu7jTy+WTbPrK7d/AIjHKWTidsf19AP4WwEQo=";
   };
 
   buildInputs = [ nodejs ];

From 0d9aaf29d17e369c2f31420ddd1c69d42811fa20 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 02:51:58 +0000
Subject: [PATCH 118/210] python3Packages.pyenphase: 2.4.9 -> 3.0.0

---
 pkgs/development/python-modules/pyenphase/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyenphase/default.nix b/pkgs/development/python-modules/pyenphase/default.nix
index eb469347d0d8..781728ccf4ee 100644
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyenphase";
-  version = "2.4.9";
+  version = "3.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyenphase";
     repo = "pyenphase";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-owjJEIaaF6J4IukNtT9IGXGXINgK2c+yaOS9xYV5kRU=";
+    hash = "sha256-yc9Klsaly4+eMM6v3NFMc948drq/Wum8ILfdTCNJx/c=";
   };
 
   pythonRelaxDeps = [ "tenacity" ];

From 2e0bb4a32507eaea76d2a1044337101ddbc4ee9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 19:57:38 -0700
Subject: [PATCH 119/210] pnpm_10_29_2: mark insecure

---
 pkgs/development/tools/pnpm/default.nix | 10 ++++++++++
 pkgs/development/tools/pnpm/generic.nix |  2 ++
 2 files changed, 12 insertions(+)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index f81d2861f3eb..4339c86d09cb 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -20,6 +20,15 @@ let
     "10_29_2" = {
       version = "10.29.2";
       hash = "sha256-hAL2daH0zJ1PJ7v6s1wtSi4dfrATHfA9rQlhnoZnTQw=";
+      knownVulnerabilities = [
+        "CVE-2026-48995"
+        "CVE-2026-50014"
+        "CVE-2026-50015"
+        "CVE-2026-50016"
+        "CVE-2026-50017"
+        "CVE-2026-50573"
+        "CVE-2026-55699"
+      ];
     };
     "10" = {
       version = "10.34.0";
@@ -35,6 +44,7 @@ let
     variant:
     callPackage ./generic.nix {
       inherit (variant) version hash;
+      knownVulnerabilities = variant.knownVulnerabilities or [ ];
       #FIXME: remove this hack in a future version.
       nodejs = null; # Passing null to detect out-of-tree overrides
     };
diff --git a/pkgs/development/tools/pnpm/generic.nix b/pkgs/development/tools/pnpm/generic.nix
index 2e2a6ddffcb0..f3cdc920f26d 100644
--- a/pkgs/development/tools/pnpm/generic.nix
+++ b/pkgs/development/tools/pnpm/generic.nix
@@ -17,6 +17,7 @@
   withNode ? true,
   version,
   hash,
+  knownVulnerabilities,
 }:
 let
   majorVersion = lib.versions.major version;
@@ -170,5 +171,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     ];
     platforms = lib.platforms.all;
     mainProgram = "pnpm";
+    inherit knownVulnerabilities;
   };
 })

From 7d1088918c897f20ea27b93832157662a107761d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 02:59:57 +0000
Subject: [PATCH 120/210] calibre: 9.9.0 -> 9.10.0

---
 pkgs/by-name/ca/calibre/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/calibre/package.nix b/pkgs/by-name/ca/calibre/package.nix
index 80c72740c555..e02365cf7ef9 100644
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@@ -40,11 +40,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "9.9.0";
+  version = "9.10.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ozwoRlJThVLiFmaR0fXdfxLDTEF4935rQGLZ+MzwXLk=";
+    hash = "sha256-U7iid8dm5sP7Xfsm+ikRn0oSm/j5qVS0I1qWPIowwwE=";
   };
 
   patches =

From 956f005a7e2cb62b82021f592c9a7c3957514af3 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 22:47:46 -0500
Subject: [PATCH 121/210] =?UTF-8?q?yaziPlugins.toggle-pane:=200-unstable-2?=
 =?UTF-8?q?026-05-07=20=E2=86=92=200-unstable-2026-06-26?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Compare: https://github.com/yazi-rs/plugins/compare/4ffa48f33465c22cce48c5d506295a3eb27c1979...39aaf6dc77e546fe7f7836f102a6c57f96d15365
---
 pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix b/pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix
index 939c16325536..8322d78c35ef 100644
--- a/pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/toggle-pane/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "toggle-pane.yazi";
-  version = "0-unstable-2026-05-07";
+  version = "0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "yazi-rs";
     repo = "plugins";
-    rev = "4ffa48f33465c22cce48c5d506295a3eb27c1979";
-    hash = "sha256-wr5QL493A175dRjYSyYpMMJax1RKWaZ3jAdFdL3XXTw=";
+    rev = "39aaf6dc77e546fe7f7836f102a6c57f96d15365";
+    hash = "sha256-rl8EA8aymVQU1296IVsEZ2WR9xBxQTYBK+VUCic/K3k=";
   };
 
   meta = {

From aa378c0be68ca966cf5cf9c51fc81271b35b3e49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 22:13:40 -0700
Subject: [PATCH 122/210] pnpm_8: mark insecure

---
 pkgs/development/tools/pnpm/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 4339c86d09cb..d89bd2034f84 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -9,6 +9,15 @@ let
     "8" = {
       version = "8.15.9";
       hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY=";
+      knownVulnerabilities = [
+        "CVE-2026-48995"
+        "CVE-2026-50014"
+        "CVE-2026-50015"
+        "CVE-2026-50016"
+        "CVE-2026-50017"
+        "CVE-2026-50573"
+        "CVE-2026-55699"
+      ];
     };
     "9" = {
       version = "9.15.9";

From b0ed2e0e81db3459e16c7fdc9d1572092ac73573 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 22:13:03 -0700
Subject: [PATCH 123/210] pnpm_9: mark insecure

---
 pkgs/development/tools/pnpm/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index d89bd2034f84..bd06623361bb 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -22,6 +22,15 @@ let
     "9" = {
       version = "9.15.9";
       hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc=";
+      knownVulnerabilities = [
+        "CVE-2026-48995"
+        "CVE-2026-50014"
+        "CVE-2026-50015"
+        "CVE-2026-50016"
+        "CVE-2026-50017"
+        "CVE-2026-50573"
+        "CVE-2026-55699"
+      ];
     };
     # 10.29.3 made a breaking change: https://github.com/pnpm/pnpm/issues/10601.
     # Pnpm packages that depend on electron builder must be upgraded to 26.8.2 or newer

From 8f4dedd2cdfb4d1c9540d871498aad1e686db18a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 05:14:34 +0000
Subject: [PATCH 124/210] immich-go: 0.31.0 -> 0.32.0

---
 pkgs/by-name/im/immich-go/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/im/immich-go/package.nix b/pkgs/by-name/im/immich-go/package.nix
index bb2900f0ab30..9dc8babd6be0 100644
--- a/pkgs/by-name/im/immich-go/package.nix
+++ b/pkgs/by-name/im/immich-go/package.nix
@@ -9,13 +9,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "immich-go";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "simulot";
     repo = "immich-go";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u+laNZ0/UncwH+3Ylk7g40DB99dAbQRrBNOVk80FrMc=";
+    hash = "sha256-bMbLMlLZpzFP7Zh9kqWzEELt3MdOR8HMkH0gTU8qD9U=";
 
     # Inspired by: https://github.com/NixOS/nixpkgs/blob/f2d7a289c5a5ece8521dd082b81ac7e4a57c2c5c/pkgs/applications/graphics/pdfcpu/default.nix#L20-L32
     # The intention here is to write the information into files in the `src`'s
@@ -32,7 +32,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-C6IQ6g5vdGqv8mzdTzLicZqP5lh3l2uNH2gIZELNAHg=";
+  vendorHash = "sha256-BwrP+eG+XPcTAbSKhJk0BOrfBlNeLHEeRhq49ZkQhwY=";
 
   # options used by upstream:
   # https://github.com/simulot/immich-go/blob/v0.25.0/.goreleaser.yaml

From b291d78e7501bbe327176016a378b81eff075d9d Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 22:55:16 -0500
Subject: [PATCH 125/210] luaPackages.fzf-lua: 0.0.2658-1 -> 0.0.2661-1

---
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 09ba666c16c2..973004b1d2d9 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1040,15 +1040,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "fzf-lua";
-      version = "0.0.2658-1";
+      version = "0.0.2661-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.2658-1.rockspec";
-          sha256 = "1dibv791x3yvw4ib56661r4g1v0lmfbwssj0x0jbwsjwnrnqis14";
+          url = "mirror://luarocks/fzf-lua-0.0.2661-1.rockspec";
+          sha256 = "0gw3q50zxawk81bnaxpj9n9n6fvv9qmyykvnxlha33bz0wvc13cq";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/267f5db2aa2202b9f6cc7a50783f0ccd2121766c.zip";
-        sha256 = "1a4yy3wj0xq0jyrx8qnj6i29v5c8vvi52sbrk8112xy66qlysmm8";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/b6f0392fe1645973c795b5bbbd8d6db466a5a25a.zip";
+        sha256 = "17mr5nnsx86isk8zqknpc172hpg86nxvmplcwwnk67qg1y8a8jwa";
       };
 
       disabled = luaOlder "5.1";

From d7cc6de0c6c40621575b194d6bb325d9fcf9f51b Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 22:56:54 -0500
Subject: [PATCH 126/210] luaPackages.grug-far-nvim: 1.6.71-1 -> 1.6.72-1

---
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 973004b1d2d9..12d8b6a3dccf 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1137,15 +1137,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "grug-far.nvim";
-      version = "1.6.71-1";
+      version = "1.6.72-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.6.71-1.rockspec";
-          sha256 = "1gvwjg617qimb8i737hvdr423py7ry8c0lsna9chpxaks3j0cf4n";
+          url = "mirror://luarocks/grug-far.nvim-1.6.72-1.rockspec";
+          sha256 = "1ky24vksn0wvv058pvv03r163ba07s8b051mwi99qna2y77js2ds";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/c995bbacf8229dc096ec1c3d60f8531059c86c1b.zip";
-        sha256 = "15wv6hvkiqi0rdg59y7dgaz7g6nz3141fdmkdggrc1h8aadky9zr";
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/c69859c1d5427ab5fc7ed12380ab521b4e336691.zip";
+        sha256 = "0yp64zp64zk5skf3blx359dmchy9wwfv4nf30hhdagvm8phbkkpx";
       };
 
       disabled = luaOlder "5.1";

From a19e6f82cca0e1750c412b9f7655664a600d7a26 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 22:59:07 -0500
Subject: [PATCH 127/210] luaPackages.kulala-nvim: 6.15.3-1 -> 6.17.0-1

---
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 12d8b6a3dccf..26528d92737f 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1322,15 +1322,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "kulala.nvim";
-      version = "6.15.3-1";
+      version = "6.17.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/kulala.nvim-6.15.3-1.rockspec";
-          sha256 = "00ghq3ph0vykphhiilj2k8643hdm5glz3h9iwpnsbahpgwpwppzy";
+          url = "mirror://luarocks/kulala.nvim-6.17.0-1.rockspec";
+          sha256 = "1m2i088p9gdkvh2s1pgzwq7j2wi2n97k2qdwggi5g22c20ph9370";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mistweaverco/kulala.nvim/archive/v6.15.3.zip";
-        sha256 = "1friyckh8bxsixsql1r3h1ljfr3a13w061hnw5z7rj92inyx5536";
+        url = "https://github.com/mistweaverco/kulala.nvim/archive/v6.17.0.zip";
+        sha256 = "03iilwmi10v6d849nxi47rgfg65qzir4h7h28iw2ga3l3f33h2gy";
       };
 
       disabled = luaOlder "5.1";

From b92a3029b56c947ce909c5fb51a62796855567a7 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 23:29:17 -0500
Subject: [PATCH 128/210] luaPackages.mini-test: 0.17.0-1 -> 0.18.0-1

---
 pkgs/development/lua-modules/generated-packages.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 26528d92737f..bf81a8f8e457 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -4712,21 +4712,21 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "mini.test";
-      version = "0.17.0-1";
+      version = "0.18.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/mini.test-0.17.0-1.rockspec";
-          sha256 = "0k9qvizfb3if0r20zid8had91ckkfy061lznvmi4r9hyy421dwfw";
+          url = "mirror://luarocks/mini.test-0.18.0-1.rockspec";
+          sha256 = "0k0pdp5qalfhcmdaqi0mz3s0p7rwq88bjcs6b7s5z80rqrhji67k";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/echasnovski/mini.test/archive/v0.17.0.zip";
-        sha256 = "0hffg59cn8dlhnjnkcfs9vannf10n2j33lna2d8zbaxajxaa8jks";
+        url = "https://github.com/nvim-mini/mini.test/archive/v0.18.0.zip";
+        sha256 = "1q1qy3f0mxrqx96gq4q3h4w2qip40lqkyd9vs65zc76wj9wx37hw";
       };
 
       disabled = luaOlder "5.1";
 
       meta = {
-        homepage = "https://github.com/echasnovski/mini.test";
+        homepage = "https://github.com/nvim-mini/mini.test";
         license = lib.licenses.mit;
         description = "Test neovim plugins. Part of the mini.nvim suite.";
       };

From 3efe3c35b5ae432bca177e26554dc3f2ee210b4c Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 23:43:20 -0500
Subject: [PATCH 129/210] luaPackages.teal-language-server: 0.1.3-1 -> 0.1.4-1

---
 pkgs/development/lua-modules/generated-packages.nix | 12 +++++-------
 pkgs/development/lua-modules/overrides.nix          |  6 +++---
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index bf81a8f8e457..def14215c9b5 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -5937,7 +5937,6 @@ final: prev: {
       buildLuarocksPackage,
       fetchFromGitHub,
       fetchurl,
-      inspect,
       ltreesitter,
       lua-cjson,
       luafilesystem,
@@ -5947,22 +5946,21 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "teal-language-server";
-      version = "0.1.3-1";
+      version = "0.1.4-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/teal-language-server-0.1.3-1.rockspec";
-          sha256 = "1mqg294rgzcfbfam0qdab3z93j7gsx250hs9f271337gqki34848";
+          url = "mirror://luarocks/teal-language-server-0.1.4-1.rockspec";
+          sha256 = "0hgjlpyc90r3m4n4y6k8vjf5cdkv1q5b1mrfc31pssrhfwplq5hq";
         }).outPath;
       src = fetchFromGitHub {
         owner = "teal-language";
         repo = "teal-language-server";
-        tag = "0.1.3";
-        hash = "sha256-XuHm6AbcBmv0fyQjlJlBMWqJlGYoveW7BEEN+axMRhw=";
+        tag = "0.1.4";
+        hash = "sha256-5SdKjE690zxLAl2Kwcy2Bk49KUrpkYBPviK+mrQnMec=";
       };
 
       propagatedBuildInputs = [
         argparse
-        inspect
         ltreesitter
         lua-cjson
         luafilesystem
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 6819850eef40..0bbadc0ac269 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -1178,9 +1178,9 @@ in
     '';
     postConfigure = (old.postConfigure or "") + ''
       substituteInPlace ''${rockspecFilename} \
-        --replace-fail '"ltreesitter == 0.1.0",' '"ltreesitter >= 0.2.0",' \
-        --replace-fail '"luv == 1.51.0",' '"luv >= 1.51.0",' \
-        --replace-fail '"tl == 0.24.5",' '"tl >= 0.24.5",'
+        --replace-fail '"ltreesitter == 0.3.0",' '"ltreesitter >= 0.3.0",' \
+        --replace-fail '"luv == 1.52.1",' '"luv >= 1.52.1",' \
+        --replace-fail '"tl == 0.24.8",' '"tl >= 0.24.8",'
     '';
   });
 

From a2bb7f10685284679519c9d991bcdb0b1e8ec787 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 23:44:08 -0500
Subject: [PATCH 130/210] luaPackages.telescope-nvim:
 scm-1-9377230aa5305d9e9aca4ed8dadf1070fb4aa9fc ->
 scm-1-427b576c16792edad01a92b89721d923c19ad60f

---
 pkgs/development/lua-modules/generated-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index def14215c9b5..23c348d7a46c 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -6032,8 +6032,8 @@ final: prev: {
       src = fetchFromGitHub {
         owner = "nvim-telescope";
         repo = "telescope.nvim";
-        rev = "9377230aa5305d9e9aca4ed8dadf1070fb4aa9fc";
-        hash = "sha256-iFHYx+5Rf3ol7CjVLjqVu+VNjdGfeC8V8nS/1THO+cQ=";
+        rev = "427b576c16792edad01a92b89721d923c19ad60f";
+        hash = "sha256-/GycCrepwDer0UvBN/f84pJUSvNp+ZfTIUPv0psl+IQ=";
       };
 
       disabled = lua.luaversion != "5.1";

From 6b379ca683a4696bc3a283e67758e5db181add3f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 27 Jun 2026 07:21:48 +0200
Subject: [PATCH 131/210] pear-desktop: unpinn pnpm to stop depending on marked
 insecure package and bring it back to cache

Tested by starting it via ./result/bin/pear-desktop and listening to some Bring Me The Horizon.
---
 pkgs/by-name/pe/pear-desktop/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/pe/pear-desktop/package.nix b/pkgs/by-name/pe/pear-desktop/package.nix
index db1853814587..d1748c3592f1 100644
--- a/pkgs/by-name/pe/pear-desktop/package.nix
+++ b/pkgs/by-name/pe/pear-desktop/package.nix
@@ -7,7 +7,7 @@
   python3,
   copyDesktopItems,
   nodejs,
-  pnpm_10_29_2,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   makeDesktopItem,
@@ -31,9 +31,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10_29_2;
-    fetcherVersion = 3;
-    hash = "sha256-BHxieFMMUFbHJHWu8spz0z803kx+kwJ99oYkDpm6a58=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-BNvAGM9ECtptDwxWsmJVq82Bky1AxslYt51FyvOBEvs=";
   };
 
   nativeBuildInputs = [
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     python3
     nodejs
     pnpmConfigHook
-    pnpm_10_29_2
+    pnpm_10
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ copyDesktopItems ];
 

From fd30c265e510dd61da43b4695a22a02f5f94d207 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Sun, 21 Jun 2026 17:29:21 -0600
Subject: [PATCH 132/210] kicad-unstable{,-small}: 2026-05-08 -> 2026-06-27

---
 pkgs/by-name/ki/kicad/versions.nix | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/ki/kicad/versions.nix b/pkgs/by-name/ki/kicad/versions.nix
index db49d0a36608..1585e6514867 100644
--- a/pkgs/by-name/ki/kicad/versions.nix
+++ b/pkgs/by-name/ki/kicad/versions.nix
@@ -47,23 +47,23 @@
   };
   "kicad-unstable" = {
     kicadVersion = {
-      version = "2026-05-08";
+      version = "2026-06-27";
       src = {
-        rev = "76f8839fd232594f81180f644e3370c390025144";
-        sha256 = "0nbr3cmrz1ca4rcwbfxvlrnwxy091lscgsqd92pqyy9sjcvqdfjg";
+        rev = "26010f14414a39852891c13a5f37261691608bb6";
+        sha256 = "1jd7dc7vabi2zl38aci3xlg3qwyrnwj0j2jzlfln7zq9p8h3fnsc";
       };
     };
     libVersion = {
-      version = "2026-05-08";
+      version = "2026-06-27";
       libSources = {
-        symbols.rev = "5a41d2112853c72129a9128df01021278c1aec11";
-        symbols.sha256 = "05h8dbygch2kp4s5ikspxngwv999j7jwsiwm4pzwwcrir7dqzdfl";
+        symbols.rev = "c7e226a4946cbd123ac57131b79a73979891d82f";
+        symbols.sha256 = "0sj2kxr48wqz075fda6jiwk9ajdf6iirbiw92wlilq3w8i3xa431";
         templates.rev = "3ed4538b0f965d821df63a5fffc4441e723cfe7f";
         templates.sha256 = "0zs29zn8qjgxv0w1vyr8yxmj02m8752zagn4vcraqgik46dwg2id";
-        footprints.rev = "098da23b916d287a0c7913752df53e6bfdf640a2";
-        footprints.sha256 = "1h1v44qc5lvvqvmi1i7b79jhxsfq8snk0mcfl6r73hj6w0b25l84";
-        packages3d.rev = "394aeaa41d7be7f717715d9ba004d7d0d8b74b36";
-        packages3d.sha256 = "01nbjcs3890hyfmafc623ldmfi9n8sjr5m0wripz5fq5fjdnzqxl";
+        footprints.rev = "645402ed82e16096cf827fea7114fdbef4c46948";
+        footprints.sha256 = "0plw6h6vr3rj9y7i59wa9c9qx9l8lsvzgan48q2k87wbs4x1gwsl";
+        packages3d.rev = "0bc64e922178140eb6890377646efd45e15011bd";
+        packages3d.sha256 = "0mkc9km540n6ri5is4fjw5abv8afidwj9q7fmbs66l6kx1z3lxky";
       };
     };
   };

From dc50dcfdead7beb457498c99b35a35374fedfc20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 22:47:34 -0700
Subject: [PATCH 133/210] lemmy-ui: use pnpm_11

---
 pkgs/servers/web-apps/lemmy/pin.json | 2 +-
 pkgs/servers/web-apps/lemmy/ui.nix   | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/servers/web-apps/lemmy/pin.json b/pkgs/servers/web-apps/lemmy/pin.json
index d419fa5b0c1e..b7e07bc4303b 100644
--- a/pkgs/servers/web-apps/lemmy/pin.json
+++ b/pkgs/servers/web-apps/lemmy/pin.json
@@ -4,5 +4,5 @@
   "serverHash": "sha256-JcJV1dEWlFsbv9eH2yQMGYEZEFB/Pe1xtL1UNtKI6c4=",
   "serverCargoHash": "sha256-cwmz8Gf7T1IsCRyxo3ap+byX+Aj7+iCTHmZ/IeMN2no=",
   "uiHash": "sha256-67OMwzOGl+dMX5YNPPBG/QwKOVerkSa7ICbrQl4YBp4=",
-  "uiPNPMDepsHash": "sha256-T7vHfeewwT8fCH6AM6u2GFRkd+KWsp4lKj5I7I+yJAo="
+  "uiPNPMDepsHash": "sha256-50IUUymGyaCAeMnWbYJlBytcULr9lvuY9kLVSEqHGL0="
 }
diff --git a/pkgs/servers/web-apps/lemmy/ui.nix b/pkgs/servers/web-apps/lemmy/ui.nix
index 787000960efe..b44e20f314b4 100644
--- a/pkgs/servers/web-apps/lemmy/ui.nix
+++ b/pkgs/servers/web-apps/lemmy/ui.nix
@@ -3,7 +3,7 @@
   stdenvNoCC,
   libsass,
   nodejs,
-  pnpm_9,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   fetchFromGitHub,
@@ -31,7 +31,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_9
+    pnpm_11
   ];
 
   buildInputs = [
@@ -42,8 +42,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   extraBuildInputs = [ libsass ];
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
     hash = pinData.uiPNPMDepsHash;
   };
 

From ed033eb3a2fef68087c5208ad2fd7a3e89e3d712 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 05:56:31 +0000
Subject: [PATCH 134/210] oh-my-posh: 29.18.0 -> 29.19.0

---
 pkgs/by-name/oh/oh-my-posh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/oh/oh-my-posh/package.nix b/pkgs/by-name/oh/oh-my-posh/package.nix
index c068bd32779e..93fbf33e6a40 100644
--- a/pkgs/by-name/oh/oh-my-posh/package.nix
+++ b/pkgs/by-name/oh/oh-my-posh/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "oh-my-posh";
-  version = "29.18.0";
+  version = "29.19.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = "oh-my-posh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A01LX+UvPlnQy/GoRoLVIBl8TrIB6XGjvpr3fCB5Jsg=";
+    hash = "sha256-KhE0JWOY9j4rSmVZOmUxC9pQbjSpISph+6RyntlryFs=";
   };
 
-  vendorHash = "sha256-cuVkJjaeLBECeEBPSB1hyRcBs4AhXkG4br0ehjZ0pjI=";
+  vendorHash = "sha256-SI2FjnRlWSsS9Uju8R+FW6/IpqewXsiOwKXfueZ7KPY=";
 
   sourceRoot = "${finalAttrs.src.name}/src";
 

From 6ba6b67a9c491b82ab4d9468e36840b9163270d3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 06:02:07 +0000
Subject: [PATCH 135/210] python3Packages.python-smarttub: 0.0.47 -> 0.0.48

---
 pkgs/development/python-modules/python-smarttub/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-smarttub/default.nix b/pkgs/development/python-modules/python-smarttub/default.nix
index 4bca217d6b6f..92d69807e2ae 100644
--- a/pkgs/development/python-modules/python-smarttub/default.nix
+++ b/pkgs/development/python-modules/python-smarttub/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "python-smarttub";
-  version = "0.0.47";
+  version = "0.0.48";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mdz";
     repo = "python-smarttub";
     tag = "v${version}";
-    hash = "sha256-jKNXViqyRFPeHmoUGL9BGUUcVTQ1w3uJy7J8OlFikPw=";
+    hash = "sha256-+iaRZO4jPpVnE8Tj8SwjMUXS3xB7vd/ztRYNE2B48Ro=";
   };
 
   build-system = [

From 062e157d63fa4596ef866ac6b34c4958d5de849c Mon Sep 17 00:00:00 2001
From: Lein Matsumaru <applePrincess@applePrincess.io>
Date: Sat, 27 Jun 2026 07:35:50 +0000
Subject: [PATCH 136/210] textlint: 15.2.1 -> 15.7.1

---
 pkgs/by-name/te/textlint/package.nix          | 14 ++++++-------
 .../te/textlint/remove-overrides.patch        | 20 +++++++++++++++----
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/te/textlint/package.nix b/pkgs/by-name/te/textlint/package.nix
index ddb43b9e6b20..5d18f749d5b4 100644
--- a/pkgs/by-name/te/textlint/package.nix
+++ b/pkgs/by-name/te/textlint/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   makeWrapper,
   nodejs-slim,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   versionCheckHook,
@@ -29,13 +29,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "textlint";
-  version = "15.2.1";
+  version = "15.7.1";
 
   src = fetchFromGitHub {
     owner = "textlint";
     repo = "textlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xjtmYz+O+Sn697OrBkPddv1Ma5UsOkO5v4SGlhsaYWA=";
+    hash = "sha256-Dt0AprnI/ixezMwU6JG6WhfJTU1xTRu2M4xwbY4uOko=";
   };
 
   patches = [
@@ -57,16 +57,16 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-TYMhAcmfWHbj/0yLNYiJXWd1GiYb+zqBLj2/83cGbzg=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-dWcLm8cTo8LC6IqMEe1zDxVJ7ioytKigEwYna6hiO8A=";
   };
 
   nativeBuildInputs = [
     makeWrapper
     nodejs-slim
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
   ];
 
   buildPhase = ''
diff --git a/pkgs/by-name/te/textlint/remove-overrides.patch b/pkgs/by-name/te/textlint/remove-overrides.patch
index 0d6737107c0e..8fa5d4108d09 100644
--- a/pkgs/by-name/te/textlint/remove-overrides.patch
+++ b/pkgs/by-name/te/textlint/remove-overrides.patch
@@ -1,10 +1,10 @@
 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index 1f0e8f8b..68a9c06a 100644
+index 9ee6370f6..552beed1b 100644
 --- a/pnpm-lock.yaml
 +++ b/pnpm-lock.yaml
-@@ -4,9 +4,6 @@ settings:
-   autoInstallPeers: true
-   excludeLinksFromLockfile: false
+@@ -295,9 +295,6 @@ catalogs:
+       specifier: ^3.25.76
+       version: 3.25.76
  
 -overrides:
 -  '@textlint/ast-node-types': workspace:*
@@ -12,3 +12,15 @@ index 1f0e8f8b..68a9c06a 100644
  importers:
  
    .:
+diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
+index 300a519e0..bf41d5370 100644
+--- a/pnpm-workspace.yaml
++++ b/pnpm-workspace.yaml
+@@ -130,7 +130,5 @@ minimumReleaseAgeExclude:
+ # Force all @textlint/ast-node-types references to use the workspace version
+ # This prevents version conflicts where some packages might reference old versions (e.g., 13.4.1)
+ # that cause TypeScript type incompatibility errors in monorepo
+-overrides:
+-  "@textlint/ast-node-types": "workspace:*"
+ # https://pnpm.io/settings#verifydepsbeforerun
+ verifyDepsBeforeRun: "install"

From 962c07a057e65cb058781deb24397af1acd7db6a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 07:54:16 +0000
Subject: [PATCH 137/210] manifold: 3.5.1 -> 3.5.2

---
 pkgs/by-name/ma/manifold/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/manifold/package.nix b/pkgs/by-name/ma/manifold/package.nix
index 80557bb78436..59537390f21a 100644
--- a/pkgs/by-name/ma/manifold/package.nix
+++ b/pkgs/by-name/ma/manifold/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "manifold";
-  version = "3.5.1";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "elalish";
     repo = "manifold";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZsTGokNpWDT0EgA3VaU/aMh8WtUygIqcSxzLikeyQ9c=";
+    hash = "sha256-jzVIQ90H90szzZSUWvqgBB+5UMgZ9I/uYhYJbexCifk=";
   };
 
   nativeBuildInputs = [ cmake ];

From abd6081647d0c35ab434647b35185b980169a9a5 Mon Sep 17 00:00:00 2001
From: eveeifyeve <kbkk7250@outlook.com>
Date: Sat, 27 Jun 2026 17:55:43 +1000
Subject: [PATCH 138/210] wasm-bindgen-cli_0_2_126: init

---
 .../wa/wasm-bindgen-cli_0_2_126/package.nix   | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 pkgs/by-name/wa/wasm-bindgen-cli_0_2_126/package.nix

diff --git a/pkgs/by-name/wa/wasm-bindgen-cli_0_2_126/package.nix b/pkgs/by-name/wa/wasm-bindgen-cli_0_2_126/package.nix
new file mode 100644
index 000000000000..f4cb05a610d2
--- /dev/null
+++ b/pkgs/by-name/wa/wasm-bindgen-cli_0_2_126/package.nix
@@ -0,0 +1,19 @@
+{
+  buildWasmBindgenCli,
+  fetchCrate,
+  rustPlatform,
+}:
+
+buildWasmBindgenCli rec {
+  src = fetchCrate {
+    pname = "wasm-bindgen-cli";
+    version = "0.2.126";
+    hash = "sha256-H6Is3fiZVxZCfOMWK5dWMSrtn50VGv0sfdnsT+cTtyk=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    inherit (src) pname version;
+    hash = "sha256-VucqkXbCi4qtQzY/HrXiDnbSURsagPsdNVMn1Tw3UiY=";
+  };
+}

From 71101bbb822041df2f053eeabb9e2d5b76f834f7 Mon Sep 17 00:00:00 2001
From: eveeifyeve <kbkk7250@outlook.com>
Date: Sat, 27 Jun 2026 17:56:53 +1000
Subject: [PATCH 139/210] dioxus-cli: upgrade wasm bindgen to 126

---
 pkgs/by-name/di/dioxus-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/di/dioxus-cli/package.nix b/pkgs/by-name/di/dioxus-cli/package.nix
index cdafe17af58f..ce34b458922b 100644
--- a/pkgs/by-name/di/dioxus-cli/package.nix
+++ b/pkgs/by-name/di/dioxus-cli/package.nix
@@ -9,7 +9,7 @@
   installShellFiles,
   makeWrapper,
   esbuild,
-  wasm-bindgen-cli_0_2_118,
+  wasm-bindgen-cli_0_2_126,
   testers,
   dioxus-cli,
   withTelemetry ? false,
@@ -81,7 +81,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --suffix PATH : ${
         lib.makeBinPath [
           esbuild
-          wasm-bindgen-cli_0_2_118
+          wasm-bindgen-cli_0_2_126
         ]
       }
   '';

From af3fbfd8f39eae8303ee44e0871cd5a16cbe732e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 09:58:09 +0200
Subject: [PATCH 140/210] python3Packages.iamdata: 0.1.202606261 ->
 0.1.202606271

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202606261...v0.1.202606271

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202606271
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 0a749b9892d9..6bedcafffc37 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606261";
+  version = "0.1.202606271";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gxtJMcDyez94n1JVc0KZo2ygtskcPgudSLdUzgfCJjw=";
+    hash = "sha256-EdU6fcNXufK/GK7tz43+SDox/Cms4uVT5DEzyIv93OQ=";
   };
 
   __darwinAllowLocalNetworking = true;

From d31c61f700b1a65b8e374f9d57de091228831c82 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:01:14 +0200
Subject: [PATCH 141/210] python3Packages.python-smarttub: migrate to
 finalAttrs

---
 .../python-modules/python-smarttub/default.nix            | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/python-smarttub/default.nix b/pkgs/development/python-modules/python-smarttub/default.nix
index 92d69807e2ae..f705b32a1940 100644
--- a/pkgs/development/python-modules/python-smarttub/default.nix
+++ b/pkgs/development/python-modules/python-smarttub/default.nix
@@ -13,7 +13,7 @@
   python-dateutil,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-smarttub";
   version = "0.0.48";
   pyproject = true;
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "mdz";
     repo = "python-smarttub";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-+iaRZO4jPpVnE8Tj8SwjMUXS3xB7vd/ztRYNE2B48Ro=";
   };
 
@@ -48,8 +48,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python API for SmartTub enabled hot tubs";
     homepage = "https://github.com/mdz/python-smarttub";
-    changelog = "https://github.com/mdz/python-smarttub/releases/tag/v${version}";
+    changelog = "https://github.com/mdz/python-smarttub/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From 6d8c9047d3a34145cb5dc84e8e909797103aac4b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 08:01:24 +0000
Subject: [PATCH 142/210] attic-client: 0-unstable-2026-06-14 ->
 0-unstable-2026-06-26

---
 pkgs/by-name/at/attic-client/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/at/attic-client/package.nix b/pkgs/by-name/at/attic-client/package.nix
index 51fa7cbe75da..5a23514ca537 100644
--- a/pkgs/by-name/at/attic-client/package.nix
+++ b/pkgs/by-name/at/attic-client/package.nix
@@ -21,13 +21,13 @@ in
 
 rustPlatform.buildRustPackage {
   pname = "attic";
-  version = "0-unstable-2026-06-14";
+  version = "0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "zhaofengli";
     repo = "attic";
-    rev = "6b22d76ca351c5a07a5e5a60b95bc23320f7e791";
-    hash = "sha256-sboz+gG8z0KX+q0kkvLloNcogXYLwiY5iw2xwN36rFo=";
+    rev = "b7c905657cb81b8ec9c26b0d9f53aa2e4f231810";
+    hash = "sha256-//gQFVLVFhwHyI9yrpPqX0MQJGYqS6nE/iLV872K+PU=";
   };
 
   nativeBuildInputs = [
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage {
   buildInputs = lib.optional needNixInclude nix ++ [ boost ];
 
   cargoBuildFlags = lib.concatMapStrings (c: "-p ${c} ") crates;
-  cargoHash = "sha256-LqE4jOIasxIG4DAhgZJMlTSyt/a900QR06wBFtRNRO8=";
+  cargoHash = "sha256-fYWRlgP3uwntULe6o2MC1yB/ea2x+27m1Op7o2wUd+U=";
 
   env = {
     ATTIC_DISTRIBUTOR = "nixpkgs";

From f727724f2c81d46b13f9f02fc79bf344ed6c2d25 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Wed, 17 Jun 2026 22:09:51 -0400
Subject: [PATCH 143/210] windsurf: rename to devin-desktop, bump to 3.3.18

Announcement: https://cognition.com/blog/introducing-devin-desktop

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/de/devin-desktop/info.json       | 14 +++++++++++++
 .../windsurf => de/devin-desktop}/package.nix | 20 +++++++++----------
 .../devin-desktop}/update/.gitignore          |  0
 .../devin-desktop}/update/package.json        |  0
 .../devin-desktop}/update/tsconfig.json       |  0
 .../devin-desktop}/update/update.mts          |  9 ++++-----
 pkgs/by-name/wi/windsurf/info.json            | 20 -------------------
 pkgs/top-level/aliases.nix                    |  1 +
 8 files changed, 29 insertions(+), 35 deletions(-)
 create mode 100644 pkgs/by-name/de/devin-desktop/info.json
 rename pkgs/by-name/{wi/windsurf => de/devin-desktop}/package.nix (73%)
 rename pkgs/by-name/{wi/windsurf => de/devin-desktop}/update/.gitignore (100%)
 rename pkgs/by-name/{wi/windsurf => de/devin-desktop}/update/package.json (100%)
 rename pkgs/by-name/{wi/windsurf => de/devin-desktop}/update/tsconfig.json (100%)
 rename pkgs/by-name/{wi/windsurf => de/devin-desktop}/update/update.mts (84%)
 delete mode 100644 pkgs/by-name/wi/windsurf/info.json

diff --git a/pkgs/by-name/de/devin-desktop/info.json b/pkgs/by-name/de/devin-desktop/info.json
new file mode 100644
index 000000000000..5c45c061197d
--- /dev/null
+++ b/pkgs/by-name/de/devin-desktop/info.json
@@ -0,0 +1,14 @@
+{
+  "aarch64-darwin": {
+    "version": "3.3.18",
+    "vscodeVersion": "1.110.1",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/16737566f57f3b53bde136375fe0544eca12fac4/Devin-darwin-arm64-3.3.18.zip",
+    "sha256": "7ac789baa5d818b09f6a62315d34b55dde02b0a409a22903d0228a819ea734e7"
+  },
+  "x86_64-linux": {
+    "version": "3.3.18",
+    "vscodeVersion": "1.110.1",
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/16737566f57f3b53bde136375fe0544eca12fac4/Devin-linux-x64-3.3.18.tar.gz",
+    "sha256": "05c7fa988c324a1633038ebe90e217d17a7f188197a5070f397460864ef41292"
+  }
+}
diff --git a/pkgs/by-name/wi/windsurf/package.nix b/pkgs/by-name/de/devin-desktop/package.nix
similarity index 73%
rename from pkgs/by-name/wi/windsurf/package.nix
rename to pkgs/by-name/de/devin-desktop/package.nix
index 6f5e6c97c769..d33b5d803dbf 100644
--- a/pkgs/by-name/wi/windsurf/package.nix
+++ b/pkgs/by-name/de/devin-desktop/package.nix
@@ -16,15 +16,16 @@ buildVscode {
   inherit commandLineArgs useVSCodeRipgrep;
 
   inherit (info) version vscodeVersion;
-  pname = "windsurf";
 
-  executableName = "windsurf";
-  longName = "Windsurf";
-  shortName = "windsurf";
-  libraryName = "windsurf";
-  iconName = "windsurf";
+  pname = "devin-desktop";
 
-  sourceRoot = if stdenv.hostPlatform.isDarwin then "Windsurf.app" else "Windsurf";
+  executableName = "devin-desktop";
+  longName = "devin-desktop";
+  shortName = "devin-desktop";
+  libraryName = "devin-desktop";
+  iconName = "devin-desktop";
+
+  sourceRoot = if stdenv.hostPlatform.isDarwin then "Devin.app" else "Devin";
 
   src = fetchurl { inherit (info) url sha256; };
 
@@ -41,9 +42,9 @@ buildVscode {
     description = "Agentic IDE powered by AI Flow paradigm";
     longDescription = ''
       The first agentic IDE, and then some.
-      The Windsurf Editor is where the work of developers and AI truly flow together, allowing for a coding experience that feels like literal magic.
+      Devin Desktop is where the work of developers and AI truly flow together, allowing for a coding experience that feels like literal magic.
     '';
-    homepage = "https://codeium.com/windsurf";
+    homepage = "https://devin.ai/desktop";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
       sarahec
@@ -51,7 +52,6 @@ buildVscode {
     ];
     platforms = [
       "aarch64-darwin"
-      "x86_64-darwin"
       "x86_64-linux"
     ];
     sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
diff --git a/pkgs/by-name/wi/windsurf/update/.gitignore b/pkgs/by-name/de/devin-desktop/update/.gitignore
similarity index 100%
rename from pkgs/by-name/wi/windsurf/update/.gitignore
rename to pkgs/by-name/de/devin-desktop/update/.gitignore
diff --git a/pkgs/by-name/wi/windsurf/update/package.json b/pkgs/by-name/de/devin-desktop/update/package.json
similarity index 100%
rename from pkgs/by-name/wi/windsurf/update/package.json
rename to pkgs/by-name/de/devin-desktop/update/package.json
diff --git a/pkgs/by-name/wi/windsurf/update/tsconfig.json b/pkgs/by-name/de/devin-desktop/update/tsconfig.json
similarity index 100%
rename from pkgs/by-name/wi/windsurf/update/tsconfig.json
rename to pkgs/by-name/de/devin-desktop/update/tsconfig.json
diff --git a/pkgs/by-name/wi/windsurf/update/update.mts b/pkgs/by-name/de/devin-desktop/update/update.mts
similarity index 84%
rename from pkgs/by-name/wi/windsurf/update/update.mts
rename to pkgs/by-name/de/devin-desktop/update/update.mts
index 64fad0bbd59f..f10048bfdbd4 100755
--- a/pkgs/by-name/wi/windsurf/update/update.mts
+++ b/pkgs/by-name/de/devin-desktop/update/update.mts
@@ -17,7 +17,7 @@ interface LatestInfo {
   readonly productVersion: string;
 }
 
-const platforms = ["aarch64-darwin", "x86_64-darwin", "x86_64-linux"] as const;
+const platforms = ["aarch64-darwin", "x86_64-linux"] as const;
 type Platform = (typeof platforms)[number];
 type InfoMap = Record<
   Platform,
@@ -29,7 +29,7 @@ type InfoMap = Record<
   }
 >;
 
-async function getInfo(targetSystem: "darwin-arm64" | "darwin-x64" | "linux-x64") {
+async function getInfo(targetSystem: "darwin-arm64" | "linux-x64") {
   const url =
     `https://windsurf-stable.codeium.com/api/update/${targetSystem}/stable/latest` as const;
 
@@ -57,7 +57,6 @@ async function main() {
 
   const info: InfoMap = {
     "aarch64-darwin": await getInfo("darwin-arm64"),
-    "x86_64-darwin": await getInfo("darwin-x64"),
     "x86_64-linux": await getInfo("linux-x64"),
   };
   if (JSON.stringify(oldInfo) === JSON.stringify(info)) {
@@ -66,7 +65,7 @@ async function main() {
   }
   for (const platform of platforms) {
     console.log(
-      `[update] Updating Windsurf ${platform} ${oldInfo[platform].version} -> ${info[platform].version}`,
+      `[update] Updating Devin Desktop ${platform} ${oldInfo[platform].version} -> ${info[platform].version}`,
     );
   }
   await fsPromises.writeFile(
@@ -74,7 +73,7 @@ async function main() {
     JSON.stringify(info, null, 2) + "\n",
     "utf-8",
   );
-  console.log("[update] Updating Windsurf complete");
+  console.log("[update] Updating Devin Desktop complete");
 }
 
 if (process.argv[1] === __filename) {
diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
deleted file mode 100644
index 52ac71b50298..000000000000
--- a/pkgs/by-name/wi/windsurf/info.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "aarch64-darwin": {
-    "version": "2.3.9",
-    "vscodeVersion": "1.110.1",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/a5d3f1ff990cabc0e8001cce6642bdb7ad429e73/Windsurf-darwin-arm64-2.3.9.zip",
-    "sha256": "35b11cd7307588fa11d4ec4690c2a5da8639e37659d68939e3a1dd46d9a105e3"
-  },
-  "x86_64-darwin": {
-    "version": "2.3.9",
-    "vscodeVersion": "1.110.1",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/a5d3f1ff990cabc0e8001cce6642bdb7ad429e73/Windsurf-darwin-x64-2.3.9.zip",
-    "sha256": "63a515c68f322653b901f1472184ca688102f9b8c0b598dec590eb648ead4211"
-  },
-  "x86_64-linux": {
-    "version": "2.3.9",
-    "vscodeVersion": "1.110.1",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/a5d3f1ff990cabc0e8001cce6642bdb7ad429e73/Windsurf-linux-x64-2.3.9.tar.gz",
-    "sha256": "874024744cd853b7c350fe514be19b0060fac39586253c3b7602d6869473eadc"
-  }
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f8623d3b89d7..986a37e07249 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2350,6 +2350,7 @@ mapAliases {
   wifi-password = throw "'wifi-password' has been removed as it was unmaintained upstream"; # Added 2025-08-29
   win-pvdrivers = throw "'win-pvdrivers' has been removed as it was subject to the Xen build machine compromise (XSN-01) and has open security vulnerabilities (XSA-468)"; # Added 2025-08-29
   win-virtio = throw "'win-virtio' has been renamed to/replaced by 'virtio-win'"; # Converted to throw 2025-10-27
+  windsurf = warnAlias "'windsurf' has been rebranded and replaced as 'devin-desktop'" devin-desktop;
   wineWayland = throw "'wineWayland' has been renamed to/replaced by 'wine-wayland'"; # Converted to throw 2025-10-27
   wineWowPackages =
     warnAlias

From 871635694326d93bc4328d6511db936f89f34dd0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 08:27:28 +0000
Subject: [PATCH 144/210] dbeaver-bin: 26.1.0 -> 26.1.1

---
 pkgs/by-name/db/dbeaver-bin/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index c68ca12af343..cb4cf4679e46 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -19,7 +19,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "26.1.0";
+  version = "26.1.1";
 
   src =
     let
@@ -32,10 +32,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-zAkHddh5xm9SHMV6OcJpl2A3+lS4GMJDbZ/+zg/5PzE=";
-        aarch64-linux = "sha256-0Tv45N+nZ2lRgn/Lo5HpPjuGigI0X2CJIIV96UO0bs8=";
-        x86_64-darwin = "sha256-INfXvR9FJZcruC8KeRtc0SIHUUHc0p3jjDNk4eBk7Lo=";
-        aarch64-darwin = "sha256-s+NQ5hp3NiQpJ/b3mp7Fdjh5rEmf1UnSz/Ai5Z43qEg=";
+        x86_64-linux = "sha256-atbQ00lq589FlNem85NgzTKGyhTRpFII8OSfVfYQuD0=";
+        aarch64-linux = "sha256-Sde0q31hXMqX2oxfhgj5EcpeUYYFZJy61usaJVpZkLM=";
+        x86_64-darwin = "sha256-EmTHuzEc4beM52hC2T7poZ1SOKa9kO2Rp3NnctlsBYo=";
+        aarch64-darwin = "sha256-PwuFwEE+aBEG/ykwNrEBl20yfrade8BdUUHdLJGBkwc=";
       };
     in
     fetchurl {

From cda2ff95ecc3b5bfda1f0eef4cf5c6337d58bb5f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 08:31:41 +0000
Subject: [PATCH 145/210] terraform-providers.cloudflare_cloudflare: 5.20.0 ->
 5.21.1

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index dcc45bb855cc..1a49fccc3bbc 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -209,13 +209,13 @@
     "vendorHash": "sha256-rCWeetM6nhNb1I1PmB66E5K1ku9ODRqN87MU9y6W/dc="
   },
   "cloudflare_cloudflare": {
-    "hash": "sha256-y3GAU5wLLETSrmYqGZs2I0qg8jnGcu32Xt/UHGS1NTA=",
+    "hash": "sha256-SHEK/NJrs1ZkyDc8jSnb39dT/wX7ixSsHc//cwhTfz8=",
     "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
     "owner": "cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v5.20.0",
+    "rev": "v5.21.1",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-LGibxg94dOiMfNynQfBoxQ6zR8A7xDfGNTujmEJcu14="
+    "vendorHash": "sha256-YLgIcohvOYBVt/GOkiqxdJVThhcphG2l8Lha1MwU9L4="
   },
   "cloudfoundry-community_cloudfoundry": {
     "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",

From dd82718270994cdb9b57401cb2a07022a7723308 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:35:27 +0200
Subject: [PATCH 146/210] python3Packages.pybase62: 0.5.0 -> 1.0.0

Changelog: https://github.com/suminb/base62/releases/tag/vv1.0.0
---
 pkgs/development/python-modules/pybase62/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pybase62/default.nix b/pkgs/development/python-modules/pybase62/default.nix
index eb0128481761..3b9cc45ed37b 100644
--- a/pkgs/development/python-modules/pybase62/default.nix
+++ b/pkgs/development/python-modules/pybase62/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pybase62";
-  version = "0.5.0";
+  version = "1.0.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "suminb";
     repo = "base62";
-    tag = finalAttrs.version;
+    tag = "v${finalAttrs.version}";
     hash = "sha256-/H16MT3mKCdXItoeOn1LWTHlgWmtwJdQHUaCp18eMz0=";
   };
 
@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Module for base62 encoding";
     homepage = "https://github.com/suminb/base62";
-    changelog = "https://github.com/suminb/base62/releases/tag/${finalAttrs.src.tag}";
+    changelog = "https://github.com/suminb/base62/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.bsd2WithViews;
     maintainers = with lib.maintainers; [ fab ];
   };

From 4f9bbfc5a8f392c4231ec5d5522b0c1a74d6a35d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:38:20 +0200
Subject: [PATCH 147/210] python3Packages.google-cloud-webrisk: 1.21.0 ->
 1.22.0

Changelog: https://github.com/googleapis/google-cloud-python/blob/google-cloud-webrisk-v1.22.0/packages/google-cloud-webrisk/CHANGELOG.md
---
 .../python-modules/google-cloud-webrisk/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-webrisk/default.nix b/pkgs/development/python-modules/google-cloud-webrisk/default.nix
index e99b9f90c206..b1bd9f39a93e 100644
--- a/pkgs/development/python-modules/google-cloud-webrisk/default.nix
+++ b/pkgs/development/python-modules/google-cloud-webrisk/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-webrisk";
-  version = "1.21.0";
+  version = "1.22.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_webrisk";
     inherit (finalAttrs) version;
-    hash = "sha256-/PcV2opz3zaGerJk6rCOQNwZbxV2FqY/3BLMNQzO8Pc=";
+    hash = "sha256-OjJcQDXpbtq4RB8Cev6UgCqvDByOXmoJ306oFlQtryQ=";
   };
 
   build-system = [ setuptools ];

From 54a72d01670a85d287d8442538de2deac4169966 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:39:08 +0200
Subject: [PATCH 148/210] python3Packages.google-cloud-workflows: 1.22.0 ->
 1.23.0

Changelog: https://github.com/googleapis/google-cloud-python/blob/google-cloud-workflows-v1.23.0/packages/google-cloud-workflows/CHANGELOG.md
---
 .../python-modules/google-cloud-workflows/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-workflows/default.nix b/pkgs/development/python-modules/google-cloud-workflows/default.nix
index 8c8ac097930f..5c147f3c176b 100644
--- a/pkgs/development/python-modules/google-cloud-workflows/default.nix
+++ b/pkgs/development/python-modules/google-cloud-workflows/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-workflows";
-  version = "1.22.0";
+  version = "1.23.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_workflows";
     inherit (finalAttrs) version;
-    hash = "sha256-9+uHMI2CPzwNWcn9Kci7ze+Oi5E4MhgHTIMf2Sfr4y0=";
+    hash = "sha256-vo4IpdE0GG2834Z8BbFZrYrH3jtkJbIb76q39PJY1Kg=";
   };
 
   build-system = [ setuptools ];

From e86ee0c868e515e3acadb806ed17aec6a526a89f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 27 Jun 2026 11:39:19 +0300
Subject: [PATCH 149/210] qui: 1.20.0 -> 1.21.0

---
 pkgs/by-name/qu/qui/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/qu/qui/package.nix b/pkgs/by-name/qu/qui/package.nix
index 4d24190dc46a..f5a749d4ff0c 100644
--- a/pkgs/by-name/qu/qui/package.nix
+++ b/pkgs/by-name/qu/qui/package.nix
@@ -14,12 +14,12 @@
 }:
 buildGo126Module (finalAttrs: {
   pname = "qui";
-  version = "1.20.0";
+  version = "1.21.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "qui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-h1OIz+4oVuHg7bKWSKgkEwouX1oJKJmOC1VI+nrPwmI=";
+    hash = "sha256-3LExp17AGxZjAXXF0GoiTW7I1wluZf3uoZnXNF6WNYg=";
   };
 
   qui-web = stdenvNoCC.mkDerivation (finalAttrs': {
@@ -44,7 +44,7 @@ buildGo126Module (finalAttrs: {
         ;
       pnpm = pnpm_11;
       fetcherVersion = 4;
-      hash = "sha256-nSlW06//r/olVgSBgHc8LGWWfNXewAF5cZXfoZemC+w=";
+      hash = "sha256-53bj1QlfihIyKsQK5o3FsA9qWZJrNPWEJ441UK9nWR0=";
     };
 
     postBuild = ''
@@ -56,7 +56,7 @@ buildGo126Module (finalAttrs: {
     '';
   });
 
-  vendorHash = "sha256-4HQOoBDjV3Pt4O/KMu8c3aeUB5evceIdlAnsixO1Pjs=";
+  vendorHash = "sha256-n+CCRQk46j/ljAfFap3mgwxs4JF9Qr/TLqZILghgbU4=";
 
   preBuild = ''
     cp -r ${finalAttrs.qui-web}/* web/dist

From 68e4176ee6d959a076ac8af8e2c2d75b3acc8880 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:40:47 +0200
Subject: [PATCH 150/210] python3Packages.google-cloud-vpc-access: 1.16.0 ->
 1.17.0

Changelog: https://github.com/googleapis/google-cloud-python/blob/google-cloud-vpc-access-v1.17.0/packages/google-cloud-vpc-access/CHANGELOG.md
---
 .../python-modules/google-cloud-vpc-access/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-vpc-access/default.nix b/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
index 7eadd4c1912e..3a9b138595d6 100644
--- a/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
+++ b/pkgs/development/python-modules/google-cloud-vpc-access/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-vpc-access";
-  version = "1.16.0";
+  version = "1.17.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_vpc_access";
     inherit (finalAttrs) version;
-    hash = "sha256-cVJ8Ok3K1dKGuTsBhDJUqhYEimNTEqOjfVSTqxke0NQ=";
+    hash = "sha256-c5HvaQIykWRNAuDSBhv72kHZs8qgMY8cyvn5N7mahY4=";
   };
 
   build-system = [ setuptools ];

From acf28333f7c4155aacbf9df7c88cdc4b32b8691d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:41:39 +0200
Subject: [PATCH 151/210] python3Packages.govee-ble: 1.2.0 -> 1.4.0

Diff: https://github.com/Bluetooth-Devices/govee-ble/compare/v1.2.0...v1.4.0

Changelog: https://github.com/bluetooth-devices/govee-ble/blob/v1.4.0/CHANGELOG.md
---
 pkgs/development/python-modules/govee-ble/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/govee-ble/default.nix b/pkgs/development/python-modules/govee-ble/default.nix
index 5831629f8e20..0277781145fd 100644
--- a/pkgs/development/python-modules/govee-ble/default.nix
+++ b/pkgs/development/python-modules/govee-ble/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "govee-ble";
-  version = "1.2.0";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = "govee-ble";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+qzSNwV+2h75LVly7kZaaulKQp5Hp0N8k05BauN1TXo=";
+    hash = "sha256-Y1iSU6G/+0qSLgFQNKeCuhpVv6mJYXivk0wNGNMBd6U=";
   };
 
   build-system = [ poetry-core ];

From f58d28f73fcf63fc23c9e1b52b6f301f6809ec63 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:45:30 +0200
Subject: [PATCH 152/210] python3Packages.microsoft-kiota-abstractions: 1.10.3
 -> 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-abstractions-v1.11.6...microsoft-kiota-abstractions-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-abstractions-v1.11.6
---
 .../microsoft-kiota-abstractions/default.nix           | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
index 88930abfb5e8..c2f1d0baa7f1 100644
--- a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
@@ -2,31 +2,31 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
+  gitUpdater,
   opentelemetry-api,
   opentelemetry-sdk,
   pytest-asyncio,
   pytest-mock,
   pytestCheckHook,
   std-uritemplate,
-  gitUpdater,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-abstractions";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-abstractions-v${finalAttrs.version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/abstractions/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [
     opentelemetry-api

From 3cedbfd22c44d9c100e4fe8a33a490886d81e1c9 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:49:26 +0200
Subject: [PATCH 153/210] python3Packages.microsoft-kiota-authentication-azure:
 1.10.3 -> 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-authentication-azure-v1.10.3...microsoft-kiota-authentication-azure-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-authentication-azure-microsoft-kiota-authentication-azure-v1.11.6
---
 .../microsoft-kiota-authentication-azure/default.nix      | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix b/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
index 6205839229ba..0fa9c9743652 100644
--- a/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
@@ -4,7 +4,7 @@
   azure-core,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
   microsoft-kiota-abstractions,
   opentelemetry-api,
   opentelemetry-sdk,
@@ -16,19 +16,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-authentication-azure";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-authentication-azure-v${finalAttrs.version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/authentication/azure/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [
     aiohttp

From 5eac6bee3fcb35cd942684557771b8091a391bb8 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:50:33 +0200
Subject: [PATCH 154/210] python3Packages.microsoft-kiota-http: 1.10.3 ->
 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-http-v1.10.3...microsoft-kiota-http-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-http-v1.11.6
---
 .../python-modules/microsoft-kiota-http/default.nix       | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-http/default.nix b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
index 245d7935a741..128abade58b3 100644
--- a/pkgs/development/python-modules/microsoft-kiota-http/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
   httpx,
   microsoft-kiota-abstractions,
   opentelemetry-api,
@@ -16,19 +16,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-http";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-http-v${finalAttrs.version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/http/httpx/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [
     httpx

From 9a289861be27be2c9bd206a0441475c67a673266 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:52:57 +0200
Subject: [PATCH 155/210] python3Packages.microsoft-kiota-serialization-json:
 1.10.3 -> 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-serialization-json-v1.10.3...microsoft-kiota-serialization-json-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-serialization-json-microsoft-kiota-serialization-json-v1.11.6
---
 .../microsoft-kiota-serialization-json/default.nix        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
index d0b08a6286d5..ca39e6a8824f 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
   microsoft-kiota-abstractions,
   pendulum,
   pytest-asyncio,
@@ -13,19 +13,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-serialization-json";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-json-v${finalAttrs.version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/serialization/json/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [
     microsoft-kiota-abstractions

From 764bdaec8dd1978bb68f16819ae236c4596798f1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:53:12 +0200
Subject: [PATCH 156/210] 
 python3Packages.microsoft-kiota-serialization-multipart: 1.10.3 -> 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-serialization-multipart-v1.10.3...microsoft-kiota-serialization-multipart-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-serialization-multipart-microsoft-kiota-serialization-multipart-v1.11.6
---
 .../microsoft-kiota-serialization-multipart/default.nix   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
index 5cd49138df9e..1b081aa9a210 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
   microsoft-kiota-abstractions,
   microsoft-kiota-serialization-json,
   pytest-asyncio,
@@ -13,19 +13,19 @@
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-multipart";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-multipart-v${version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${src.name}/packages/serialization/multipart/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [ microsoft-kiota-abstractions ];
 

From bdd24ff79f66ef8c8a695799982779fdccb36c7d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 27 Jun 2026 10:53:29 +0200
Subject: [PATCH 157/210] python3Packages.microsoft-kiota-serialization-text:
 1.10.3 -> 1.11.6

Diff: https://github.com/microsoft/kiota-python/compare/microsoft-kiota-serialization-text-v1.10.3...microsoft-kiota-serialization-text-v1.11.6

Changelog: https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-serialization-text-microsoft-kiota-serialization-text-v1.11.6
---
 .../microsoft-kiota-serialization-text/default.nix        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
index 800a324d4bc8..bae91e5e83ec 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  flit-core,
   microsoft-kiota-abstractions,
   pytest-asyncio,
   pytest-mock,
@@ -13,19 +13,19 @@
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-text";
-  version = "1.10.3";
+  version = "1.11.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-text-v${version}";
-    hash = "sha256-r0u+erTSKBWzLV7VfwWUYh7lyJS1hDh5A0Tzk3pFzo4=";
+    hash = "sha256-hhYQsNcy+jVVmKiDuB1nGpx+aA7toM6WDFoU5Vnu5Vs=";
   };
 
   sourceRoot = "${src.name}/packages/serialization/text/";
 
-  build-system = [ poetry-core ];
+  build-system = [ flit-core ];
 
   dependencies = [
     microsoft-kiota-abstractions

From c6202049fb490b29fa21b7528cf8ab2cab75502a Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Sat, 27 Jun 2026 11:54:09 +0300
Subject: [PATCH 158/210] waydroid-helper: add missing dependency

---
 pkgs/by-name/wa/waydroid-helper/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/wa/waydroid-helper/package.nix b/pkgs/by-name/wa/waydroid-helper/package.nix
index 828e9caf19c9..089e1f37332b 100644
--- a/pkgs/by-name/wa/waydroid-helper/package.nix
+++ b/pkgs/by-name/wa/waydroid-helper/package.nix
@@ -21,6 +21,7 @@
   libxml2,
   systemd,
   unzip,
+  vte-gtk4,
   nix-update-script,
   fetchpatch,
 }:
@@ -83,6 +84,7 @@ python3Packages.buildPythonApplication {
     libadwaita
     libxml2
     systemd
+    vte-gtk4
   ];
 
   dontUseCmakeConfigure = true;

From bf4f3d5c857c1826ab4869da5312d50ce38ca14f Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sat, 27 Jun 2026 07:58:27 +0200
Subject: [PATCH 159/210] reticulum-group-chat: init at 1.11.0

---
 .../re/reticulum-group-chat/package.nix       | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 pkgs/by-name/re/reticulum-group-chat/package.nix

diff --git a/pkgs/by-name/re/reticulum-group-chat/package.nix b/pkgs/by-name/re/reticulum-group-chat/package.nix
new file mode 100644
index 000000000000..862703889ab1
--- /dev/null
+++ b/pkgs/by-name/re/reticulum-group-chat/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "reticulum-group-chat";
+  version = "1.11.0";
+  __structuredAttrs = true;
+  __darwinAllowLocalNetworking = true;
+
+  src = fetchFromGitHub {
+    owner = "thatSFguy";
+    repo = "reticulum-group-chat";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LWHYIKnkEPrlDIEruP2ctuMQGnrL1uofOWAsZ4E5guw=";
+  };
+
+  vendorHash = "sha256-qMmEi7OYv2xzYOoeBWQ0omeIrcTyhxylw2qvv9kd9dk=";
+
+  ldflags = [ "-s" ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Pure-Go LXMF group-chat hub for the Reticulum network — a single static binary that relays many-to-many encrypted text chat over LoRa, TCP/IP, and mixed meshes. No Python, no third-party RNS library";
+    homepage = "https://github.com/thatSFguy/reticulum-group-chat";
+    changelog = "https://github.com/thatSFguy/reticulum-group-chat/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "fwdsvc";
+  };
+})

From c85eb5f9faaec8dfba051b1facb8e77bb472b737 Mon Sep 17 00:00:00 2001
From: Katsumi Takeuchi <contact@hibi.day>
Date: Sat, 27 Jun 2026 18:14:09 +0900
Subject: [PATCH 160/210] blesh: 0.4.0-devel3-unstable-2026-06-21 ->
 0.4.0-devel3-unstable-2026-06-27

---
 pkgs/by-name/bl/blesh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bl/blesh/package.nix b/pkgs/by-name/bl/blesh/package.nix
index c9e3b727dbf4..38f0304d1509 100644
--- a/pkgs/by-name/bl/blesh/package.nix
+++ b/pkgs/by-name/bl/blesh/package.nix
@@ -10,14 +10,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "blesh";
-  version = "0.4.0-devel3-unstable-2026-06-21";
+  version = "0.4.0-devel3-unstable-2026-06-27";
 
   src = fetchFromGitHub {
     owner = "akinomyoga";
     repo = "ble.sh";
-    rev = "6cffa910eccce252fa391875c7c03c94fb6f1b09";
+    rev = "5d39ebe6db67a46de4195f8ce8186e34cd2618d1";
     fetchSubmodules = true;
-    hash = "sha256-CUIHfK1m00p6rBBNp/XqXifeRcG7BKpkdF7kl4+2tZY=";
+    hash = "sha256-12aSZl0qx0CwaIq/U77pCFz9Ij2CrzhojQuBngc7oag=";
   };
 
   nativeBuildInputs = [

From a530361ef2b70186ea6dec789790ac57de1f58f4 Mon Sep 17 00:00:00 2001
From: Katsumi Takeuchi <contact@hibi.day>
Date: Sat, 27 Jun 2026 18:19:08 +0900
Subject: [PATCH 161/210] blesh: patch build helper shebangs

Assisted-by: Codex CLI with gpt-5.5 default (OpenAI)
---
 pkgs/by-name/bl/blesh/package.nix                     |  8 ++++----
 pkgs/by-name/bl/blesh/skip-readonly-runtime-dir.patch | 10 ----------
 2 files changed, 4 insertions(+), 14 deletions(-)
 delete mode 100644 pkgs/by-name/bl/blesh/skip-readonly-runtime-dir.patch

diff --git a/pkgs/by-name/bl/blesh/package.nix b/pkgs/by-name/bl/blesh/package.nix
index 38f0304d1509..74fba950d70b 100644
--- a/pkgs/by-name/bl/blesh/package.nix
+++ b/pkgs/by-name/bl/blesh/package.nix
@@ -28,10 +28,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # Fix the cache invalidation not working; see
     # https://github.com/NixOS/nixpkgs/pull/521218#issuecomment-4641313131
     ./fix-cache-invalidation.patch
-    # ble.sh reaches a runtime-dir fallback under the install base when the
-    # others are unusable (always on WSL); see
-    # https://github.com/NixOS/nixpkgs/pull/521218#issuecomment-4686973408
-    ./skip-readonly-runtime-dir.patch
   ];
 
   # ble.sh embeds the commit id, normally read from .git, which fetchFromGitHub omits.
@@ -41,6 +37,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     "BLE_GIT_BRANCH=master"
   ];
 
+  postPatch = ''
+    patchShebangs --build make_command.sh make
+  '';
+
   doCheck = true;
   # auto-detection runs `make -n check` without makeFlags, which fails without BLE_GIT_COMMIT_ID
   checkTarget = "check";
diff --git a/pkgs/by-name/bl/blesh/skip-readonly-runtime-dir.patch b/pkgs/by-name/bl/blesh/skip-readonly-runtime-dir.patch
deleted file mode 100644
index e03f56fc2646..000000000000
--- a/pkgs/by-name/bl/blesh/skip-readonly-runtime-dir.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/ble.pp
-+++ b/ble.pp
-@@ -1934,6 +1934,7 @@
- function ble/base/initialize-runtime-directory/.base {
-   local tmp_dir=$_ble_base/run
-   if [[ ! -d $tmp_dir ]]; then
-+    [[ -w $_ble_base ]] || return 1
-     ble/bin/mkdir -p "$tmp_dir" || return 1
-     ble/bin/chmod a+rwxt "$tmp_dir" || return 1
-   fi

From 651f3b12fd44a5c920a5d91bb8bff12c79fe7598 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sat, 27 Jun 2026 11:44:48 +0200
Subject: [PATCH 162/210] mongodb-ce: unbreak on darwin

Co-Authored-By: FlameFlag <git@ps1.sh>
---
 pkgs/by-name/mo/mongodb-ce/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index 66b2d4306eaa..2a73f1a2a0df 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -49,6 +49,11 @@ stdenv.mkDerivation (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/bin/mongod";
 
+  # Apple's LibreSSL tries to read this while running `mongod --version`
+  sandboxProfile = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    (allow file-read* (literal "/private/etc/ssl/openssl.cnf"))
+  '';
+
   passthru = {
     sources = {
       "x86_64-linux" = fetchurl {

From d1c6c4f6eab656f47b4db44d06ae73e49f1a108a Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sat, 27 Jun 2026 11:45:10 +0200
Subject: [PATCH 163/210] mongodb-ce: add `__structuredAttrs`, `strictDeps`

---
 pkgs/by-name/mo/mongodb-ce/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index 2a73f1a2a0df..5a7fe772b5e5 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -18,6 +18,8 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "mongodb-ce";
   version = "8.2.11";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src =
     finalAttrs.passthru.sources.${stdenv.hostPlatform.system}

From 78581b87cd0b96d2cd1a36aa5d20aad57b9a1d4e Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 27 Jun 2026 11:45:19 +0200
Subject: [PATCH 164/210] perlPackages.BytesRandomSecureTiny: add patch for
 CVE-2026-11702

---
 pkgs/top-level/perl-packages.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3cf8a274f583..484d4c88d6c8 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -2907,6 +2907,17 @@ with self;
       url = "mirror://cpan/authors/id/D/DA/DAVIDO/Bytes-Random-Secure-Tiny-1.011.tar.gz";
       hash = "sha256-A9lntfgoRpCRN9WrmYSsVwrBCkQB4MYC89IgjEZayYI=";
     };
+    patches = [
+      (fetchpatch {
+        name = "CVE-2026-11702.patch";
+        url = "https://security.metacpan.org/patches/B/Bytes-Random-Secure-Tiny/1.011/CVE-2026-11702-r1.patch";
+        hash = "sha256-81wvVdtQsF5YeRhjAeaOFa7aE1cgdCni+G28LA7ZLqM=";
+      })
+    ];
+    preCheck = ''
+      # Remove test that CVE patch breaks: "Attempt to access disallowed key '_rng' in a restricted hash"
+      rm t/35-mrie-cover.t
+    '';
     meta = {
       description = "Tiny Perl extension to generate cryptographically-secure random bytes";
       license = with lib.licenses; [

From f74dae849727a177dafb8686c1d573b945ff69ff Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 27 Jun 2026 11:59:49 +0200
Subject: [PATCH 165/210] perlPackages.BytesRandomSecure: add patch for
 CVE-2026-11625

---
 pkgs/top-level/perl-packages.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3cf8a274f583..0d4219bcf385 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -2886,6 +2886,13 @@ with self;
       url = "mirror://cpan/authors/id/D/DA/DAVIDO/Bytes-Random-Secure-0.29.tar.gz";
       hash = "sha256-U7vTOeahHvygfGGaYVx8GIpouyvoSaHLfvw91Nmuha4=";
     };
+    patches = [
+      (fetchpatch {
+        name = "CVE-2026-11625.patch";
+        url = "https://security.metacpan.org/patches/B/Bytes-Random-Secure/0.29/CVE-2026-11625-r1.patch";
+        hash = "sha256-EDPFvFjqGtN5/TiJlarqKMrtH6kEQD6rOA7B2moBkiA=";
+      })
+    ];
     propagatedBuildInputs = [
       CryptRandomSeed
       MathRandomISAAC

From e1d34cf7add373c352be43147f8e759d13fde764 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 12 Jun 2026 03:09:18 +0200
Subject: [PATCH 166/210] pnpm_10_34_0: init

---
 pkgs/development/tools/pnpm/default.nix | 12 ++++++++++++
 pkgs/top-level/all-packages.nix         |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 4339c86d09cb..6278253ee559 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -30,6 +30,18 @@ let
         "CVE-2026-55699"
       ];
     };
+    # 10.34.1 made a breaking change that causes
+    # ERR_PNPM_MISSING_TARBALL_INTEGRITY error for some packages.
+    "10_34_0" = {
+      version = "10.34.0";
+      hash = "sha256-WOFDJYhx31FYm2UcBiBdq+xIdmpdu6PCWZm2m1C+WY4=";
+      knownVulnerabilities = [
+        "CVE-2026-55487"
+        "CVE-2026-55698"
+        "CVE-2026-55180"
+        "CVE-2026-55697"
+      ];
+    };
     "10" = {
       version = "10.34.0";
       hash = "sha256-WOFDJYhx31FYm2UcBiBdq+xIdmpdu6PCWZm2m1C+WY4=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4bb26534613f..b4ee0e370cfd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2813,6 +2813,7 @@ with pkgs;
     pnpm_8
     pnpm_9
     pnpm_10_29_2
+    pnpm_10_34_0
     pnpm_10
     pnpm_11
     ;

From 45933c060a1ca896c751f15723dd3a5d9e015d67 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 10:34:35 +0000
Subject: [PATCH 167/210] libretro.opera: 0-unstable-2026-06-15 ->
 0-unstable-2026-06-19

---
 pkgs/applications/emulators/libretro/cores/opera.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/opera.nix b/pkgs/applications/emulators/libretro/cores/opera.nix
index 86015609ee73..227d42278623 100644
--- a/pkgs/applications/emulators/libretro/cores/opera.nix
+++ b/pkgs/applications/emulators/libretro/cores/opera.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-06-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "78f834b175bf2de3cc2cf05122d10d4c3d980c34";
-    hash = "sha256-E8/mD+4HKAZQciJBy0CsUIvCkfufkQCcudpMzvVoBhg=";
+    rev = "eb3a9162e99a71da221107aa58e7650fd076bbca";
+    hash = "sha256-swFdGY8ScsQG/8E/JWzGRL80jdMVzsr1BJ+UAisSJ9g=";
   };
 
   makefile = "Makefile";

From 893ae213cabc75762bfd953c0ecf67c0e1368340 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 12 Jun 2026 03:14:18 +0200
Subject: [PATCH 168/210] treewide: pin pnpm_10 packages with missing integrity
 fields to pnpm_10_34_0

---
 pkgs/by-name/sh/sharkey/package.nix             | 4 ++--
 pkgs/by-name/vu/vue-language-server/package.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/sh/sharkey/package.nix b/pkgs/by-name/sh/sharkey/package.nix
index 24bd745c8562..684383e39521 100644
--- a/pkgs/by-name/sh/sharkey/package.nix
+++ b/pkgs/by-name/sh/sharkey/package.nix
@@ -15,7 +15,7 @@
   pango,
   pixman,
   pkg-config,
-  pnpm_10,
+  pnpm_10_34_0,
   fetchPnpmDeps,
   pnpmConfigHook,
   python3,
@@ -24,7 +24,7 @@
 }:
 
 let
-  pnpm = pnpm_10.override { nodejs-slim = nodejs-slim_22; };
+  pnpm = pnpm_10_34_0.override { nodejs-slim = nodejs-slim_22; };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sharkey";
diff --git a/pkgs/by-name/vu/vue-language-server/package.nix b/pkgs/by-name/vu/vue-language-server/package.nix
index 79588684cd9f..78377e1228e1 100644
--- a/pkgs/by-name/vu/vue-language-server/package.nix
+++ b/pkgs/by-name/vu/vue-language-server/package.nix
@@ -4,13 +4,13 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_10_34_0,
   nodejs,
   nix-update-script,
   makeBinaryWrapper,
 }:
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_10_34_0;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vue-language-server";

From d93350e0c21f22d4b0f97277714202f098326fd2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 4 Jun 2026 13:42:43 +0200
Subject: [PATCH 169/210] pnpm_10: 10.34.0 -> 10.34.4

---
 doc/release-notes/rl-2611.section.md    | 2 ++
 pkgs/development/tools/pnpm/default.nix | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 6989db9f75e3..d7206ba99e2a 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -56,6 +56,8 @@
 
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
+- `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
+
 - `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
   removed, as announced in the 26.05 release. Packages still using them now
   throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 6278253ee559..3edd8e5a6172 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -43,8 +43,8 @@ let
       ];
     };
     "10" = {
-      version = "10.34.0";
-      hash = "sha256-WOFDJYhx31FYm2UcBiBdq+xIdmpdu6PCWZm2m1C+WY4=";
+      version = "10.34.4";
+      hash = "sha256-mM1XGNvYxLJokVZJO5WWzs9rZLGpjUoIfoITWhdbQOs=";
     };
     "11" = {
       version = "11.9.0";

From f5621e45121ad4900619b0959a5368e6ce72dbf4 Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Sat, 27 Jun 2026 12:35:27 +0200
Subject: [PATCH 170/210] incus-ui-canonical: 0.21.0 -> 0.21.2

---
 pkgs/by-name/in/incus-ui-canonical/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/in/incus-ui-canonical/package.nix b/pkgs/by-name/in/incus-ui-canonical/package.nix
index fa80bf582071..daf58189b326 100644
--- a/pkgs/by-name/in/incus-ui-canonical/package.nix
+++ b/pkgs/by-name/in/incus-ui-canonical/package.nix
@@ -20,14 +20,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "incus-ui-canonical";
-  version = "0.21.0";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "zabbly";
     repo = "incus-ui-canonical";
     # only use tags prefixed by incus- they are the tested fork versions
     tag = "incus-${finalAttrs.version}";
-    hash = "sha256-X5s9pxNI+XjL4mp/C/bS8K0lAJ/HsRJNTwLiF3mzY4s=";
+    hash = "sha256-nCussrzWjFbZ6its3X74KBktv/dZO76OJGwG7upjkMw=";
   };
 
   offlineCache = fetchYarnDeps {

From 42308f570774f0f3fe9e2def1e6bc483c287ef02 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 10:36:51 +0000
Subject: [PATCH 171/210] shaperglot-cli: 1.2.0 -> 1.2.1

---
 pkgs/by-name/sh/shaperglot-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sh/shaperglot-cli/package.nix b/pkgs/by-name/sh/shaperglot-cli/package.nix
index dbefda1670f8..fc1a9f10ac01 100644
--- a/pkgs/by-name/sh/shaperglot-cli/package.nix
+++ b/pkgs/by-name/sh/shaperglot-cli/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "shaperglot-cli";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "shaperglot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jh2/Rr7bIPFiblUZFS8KiQtMwmtMuOGCSV2w7LMCbq8=";
+    hash = "sha256-g8f8Q2DvYNvm8i6S+9K/jhhUiuGw366dht0Khx3/INg=";
   };
 
-  cargoHash = "sha256-3cHUSRvrvywfiYA/WpUrCIJV+hEQQwRNTPvSmCN50ho=";
+  cargoHash = "sha256-ivl3Zq0HRn4yP9JKfbjSaaERjbQ3SAEWhHk6toFp8dE=";
 
   cargoBuildFlags = [
     "--package=shaperglot-cli"

From 4dc1b0419428e13eb04856b65c4cda198d788d3a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 10:37:21 +0000
Subject: [PATCH 172/210] telemt: 3.4.18 -> 3.4.19

---
 pkgs/by-name/te/telemt/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/telemt/package.nix b/pkgs/by-name/te/telemt/package.nix
index b47d915d88a7..4f0a6495e014 100644
--- a/pkgs/by-name/te/telemt/package.nix
+++ b/pkgs/by-name/te/telemt/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "telemt";
-  version = "3.4.18";
+  version = "3.4.19";
 
   src = fetchFromGitHub {
     owner = "telemt";
     repo = "telemt";
     tag = version;
-    hash = "sha256-++EO+gkr6q+y8e0uwYyD04cFGyhwS2DW4JON4LOx0s0=";
+    hash = "sha256-3Vpz61/mEQ43zOEUtUBQw16D/LBvWymreJp4q1uDydM=";
   };
 
-  cargoHash = "sha256-n25cjncocDv5gNftqv4TO0HRCoZEakiGzfLZqvT1ya4=";
+  cargoHash = "sha256-uQVL4k+/6L2vUTWbpTC9RvWQHC84P5fuCSrBLtoDdz8=";
 
   checkFlags = [
     # flaky: races between MiddleClientWriterCancelled and TrafficBudgetWaitCancelled observation paths

From 0899fedf44910c9dd259a937e744a69a3e96d874 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 27 Jun 2026 10:37:47 +0000
Subject: [PATCH 173/210] linux_7_1: 7.1.1 -> 7.1.2

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 54ff5434cfe3..323533422ed5 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -40,8 +40,8 @@
         "lts": false
     },
     "7.1": {
-        "version": "7.1.1",
-        "hash": "sha256:0z8x6wafxzc5vkim9jh8wpycdkk9y5bpxgsirmdpyznw84szl5aj",
+        "version": "7.1.2",
+        "hash": "sha256:0gw8nnq6nix9xk2dhb1jwmhnqjayrn3bn2akzg4lgqkvfa9qq69p",
         "lts": false
     }
 }

From ae05d822afa333fd35d417b399beb1da0ebb689d Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 27 Jun 2026 10:38:00 +0000
Subject: [PATCH 174/210] linux_7_0: 7.0.13 -> 7.0.14

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 323533422ed5..651594b7683f 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -35,8 +35,8 @@
         "lts": true
     },
     "7.0": {
-        "version": "7.0.13",
-        "hash": "sha256:04wrz38ldls7pv1yxa1m7p2hqn1731l93xnz93fs7b0nyz8fv09w",
+        "version": "7.0.14",
+        "hash": "sha256:160ggaq9rh50a39gz02fpia8maq85bwxhqlwsc03yafjhjvrk6fy",
         "lts": false
     },
     "7.1": {

From 77ea4e37f84a559c32e38391066198989e9f1b32 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 27 Jun 2026 10:38:13 +0000
Subject: [PATCH 175/210] linux_6_18: 6.18.36 -> 6.18.37

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 651594b7683f..1850e03a312b 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,8 +30,8 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.36",
-        "hash": "sha256:0kn4r43lnd5nb5c298b30030qyaxv05s7k40n9si1j3iyk4qdazv",
+        "version": "6.18.37",
+        "hash": "sha256:0maj2ap1m09bxl6a3g9wc65h9sdr6y8rwc5qcqlbavb4wq0d4g58",
         "lts": true
     },
     "7.0": {

From 8d8350a77bfeef2d6915648c438ffd96a7bc6aa5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 10:46:10 +0000
Subject: [PATCH 176/210] protoc-gen-grpc-java: 1.81.0 -> 1.82.1

---
 pkgs/by-name/pr/protoc-gen-grpc-java/data.nix | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
index 0274f88a3c0a..694bd75a468d 100644
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
@@ -1,14 +1,14 @@
 {
-  version = "1.81.0";
+  version = "1.82.1";
   hashes = {
-    linux-aarch_64 = "sha256-BhO92wlj0L3M8H4CGuB4NRZkjN9zPuFM/E2NAkn6d1o=";
-    linux-ppcle_64 = "sha256-Y1YC+C/AxdYiB7gcaerVhE383+8rPOiEI8+r/BxkeXk=";
-    linux-s390_64 = "sha256-cVjZl+ju8e+yroYOttrgIBGSBWDPw1jz1dOLdr58Bmc=";
-    linux-x86_32 = "sha256-I10buzyicR0aVI3BKDvtly6NwfjSP2hLOD1eY5NJFZc=";
-    linux-x86_64 = "sha256-T3WWxgoTdSS1TysR2Vb6IA8/6XZ43hzd2CfRCVQlD30=";
-    osx-aarch_64 = "sha256-c359UvEa+J85KV6KFOXMuUWCYmyB5VkTfmLfj8J81qQ=";
-    osx-x86_64 = "sha256-c359UvEa+J85KV6KFOXMuUWCYmyB5VkTfmLfj8J81qQ=";
-    windows-x86_32 = "sha256-mMRY0dLrPpLcQUeK5GqeOrBFqlghBC7FgqqoRWHdjYs=";
-    windows-x86_64 = "sha256-18mnbuYxoqnQLYHPWC2m2+TW5pJmX/O2OkQLG5xyND0=";
+    linux-aarch_64 = "sha256-VTDKjBMzFj5CocdqK1EEIOBsdTIckXMrNGOlRyByCc8=";
+    linux-ppcle_64 = "sha256-/NCzmrhbTDaYhJBntW6n6yA5tvtsvdVldMlK7WfV6RY=";
+    linux-s390_64 = "sha256-Bk83rw8iGsniyNcivgQRjx/GOWB0kv4Wo01b4YTG0Pk=";
+    linux-x86_32 = "sha256-Ai7h2w1ZGWlS/tAdiT/dpd6wt3VM4rpPiQuv5rDbfCY=";
+    linux-x86_64 = "sha256-OnXRqIuP5E9KHVy48ixz+PzI1WOu2QV/9epISyLNry8=";
+    osx-aarch_64 = "sha256-hm3WySlSQu/J5rg8pWlpOStcPnODqn1b7pKL1N5CkSQ=";
+    osx-x86_64 = "sha256-hm3WySlSQu/J5rg8pWlpOStcPnODqn1b7pKL1N5CkSQ=";
+    windows-x86_32 = "sha256-CWZAubE98Aftf7Mjd2caROxsWSxS+JQGf4YB+FEwiwo=";
+    windows-x86_64 = "sha256-XmhjMhJ/djRizOkSh+i7PtZn2RL9jVV5PcBkgwpYw0o=";
   };
 }

From 1501c08af3cc131e2eb77439584b73f3a4ba7b1d Mon Sep 17 00:00:00 2001
From: Leonard-Orlando Menzel <79226837+lomenzel@users.noreply.github.com>
Date: Sat, 27 Jun 2026 10:48:25 +0000
Subject: [PATCH 177/210] nixos/kubo: fix typo in fuseAllowOther setting

---
 nixos/modules/services/network-filesystems/kubo.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/network-filesystems/kubo.nix b/nixos/modules/services/network-filesystems/kubo.nix
index 4e676b80a1aa..9c08028a0842 100644
--- a/nixos/modules/services/network-filesystems/kubo.nix
+++ b/nixos/modules/services/network-filesystems/kubo.nix
@@ -334,7 +334,7 @@ in
 
     programs.fuse = {
       enable = lib.mkIf cfg.autoMount true;
-      userAllowOther = lib.mkIf cfg.settings.Mounts.fuseAllowOther true;
+      userAllowOther = lib.mkIf cfg.settings.Mounts.FuseAllowOther true;
     };
 
     users.users = lib.mkIf (cfg.user == "ipfs") {

From 57dd769ad77916286f60299308b583f1297cb633 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 11:09:48 +0000
Subject: [PATCH 178/210] copilot-language-server: 1.509.0 -> 1.513.0

---
 pkgs/by-name/co/copilot-language-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index 0ec6ac776fb1..cadc8f9ad0cc 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.509.0";
+  version = "1.513.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-PY4pr9FHKHSJjNctq7bGlsZ1yvDM6IqbmfobI1WsDP0=";
+    hash = "sha256-wVibxZjUW6BX4YhdYlyE0/zp0fst2H/XmmqZLqxGXH8=";
     stripRoot = false;
   };
 

From a05d7f9e123495a8394c30b3ea96ffc7c82fba41 Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Sat, 27 Jun 2026 14:10:47 +0300
Subject: [PATCH 179/210] tabbyapi: unstable-2026-06-13 -> unstable-2026-06-27

---
 pkgs/by-name/ta/tabbyapi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ta/tabbyapi/package.nix b/pkgs/by-name/ta/tabbyapi/package.nix
index d4027e187c8d..cac9ebfe2c59 100644
--- a/pkgs/by-name/ta/tabbyapi/package.nix
+++ b/pkgs/by-name/ta/tabbyapi/package.nix
@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication {
   pname = "tabbyapi";
-  version = "0-unstable-2026-06-13";
+  version = "0-unstable-2026-06-27";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "theroyallab";
     repo = "tabbyAPI";
-    rev = "54850882315d509c984f9fe07fb8f5d04a0b4ba9";
-    hash = "sha256-rIpI3pCJtfU1AEHBwQCIwuOh4c14N/z8VlX0hdxOC60=";
+    rev = "3cf468c28362c28be1c8fc731ce1ccaf7b2206d0";
+    hash = "sha256-s97YFyij2/oYlClmV2laDrCkkoK4uVZgRsn5WwftLag=";
   };
 
   build-system = with python3Packages; [

From 13438077eea71c0672dee709ad62dc8eb753ad54 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 11:30:40 +0000
Subject: [PATCH 180/210] v2ray-domain-list-community: 20260618031303 ->
 20260627053650

---
 pkgs/by-name/v2/v2ray-domain-list-community/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
index 020f677924dd..19c89dba4e76 100644
--- a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
+++ b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
@@ -9,12 +9,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20260618031303";
+    version = "20260627053650";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-pDWnXhwR+/NNVlYepa6TKCbJmbLF9lxXu4lhr5impaY=";
+      hash = "sha256-UhPtWbCojuLRP0ATj592OIAQkuc3ZtHpllhPzbUoAp4=";
     };
     vendorHash = "sha256-9tXv+rDBowxDN9gH4zHCr4TRbic4kijco3Y6bojJKRk=";
     meta = {

From 9302bd5507628bc5acf8dd96d71532b84245717c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 12:09:15 +0000
Subject: [PATCH 181/210] sdl_gamecontrollerdb: 0-unstable-2026-06-12 ->
 0-unstable-2026-06-26

---
 pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
index a0e88a3b31dd..4a7ec7a46f7c 100644
--- a/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
+++ b/pkgs/by-name/sd/sdl_gamecontrollerdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sdl_gamecontrollerdb";
-  version = "0-unstable-2026-06-12";
+  version = "0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "mdqinc";
     repo = "SDL_GameControllerDB";
-    rev = "998d5b08b5b33bdf3a63b2ef8f2ac4ccc664e2f6";
-    hash = "sha256-OdamCeHnPH0zc5Uac6KMpltIIEQMAfQwcopzg5ytUy8=";
+    rev = "513c72e34569e0f471dde7aa26eecb23946c3ef7";
+    hash = "sha256-IZ6BYtxFRu8Kt+Ege3xf+E9dlMBHXFWvdvYdKEFAIM8=";
   };
 
   dontBuild = true;

From 4f355aab667a98e701a85716abbebbf27f813260 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 12:12:45 +0000
Subject: [PATCH 182/210] matcha: 0.40.1 -> 0.43.0

---
 pkgs/by-name/ma/matcha/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/matcha/package.nix b/pkgs/by-name/ma/matcha/package.nix
index 04720b6bd494..47c8b2744f6c 100644
--- a/pkgs/by-name/ma/matcha/package.nix
+++ b/pkgs/by-name/ma/matcha/package.nix
@@ -14,16 +14,16 @@ buildGoLatestModule (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "matcha";
-  version = "0.40.1";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "floatpane";
     repo = "matcha";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4GbuiFFHQ14O+S2TtWiP1UWg3h6J9Cys6A8k5+0Ww/I=";
+    hash = "sha256-x+k1/k7pwJ0MW0t31ieaOkbP8LtqDSmHOBrNEGA0K6Q=";
   };
 
-  vendorHash = "sha256-TFc7e7gNtFNiCJHARngWSBKGqGhH7PiX48VkU9kD9Bs=";
+  vendorHash = "sha256-5smWIw8ofG61ugHxFbmQ9r9vcxi098/UmxUE15lx4wE=";
   proxyVendor = true;
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [

From d384512ee80dbd84755962da3cb02105d8225ef3 Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Sat, 27 Jun 2026 14:11:47 +0300
Subject: [PATCH 183/210] nixos/tabbyapi: add writable HOME and cache

---
 nixos/modules/services/web-apps/tabbyapi.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nixos/modules/services/web-apps/tabbyapi.nix b/nixos/modules/services/web-apps/tabbyapi.nix
index 0340e69775a7..bd937b0d5685 100644
--- a/nixos/modules/services/web-apps/tabbyapi.nix
+++ b/nixos/modules/services/web-apps/tabbyapi.nix
@@ -167,6 +167,13 @@ in
       wantedBy = [ "multi-user.target" ];
       description = "TabbyAPI - OAI compatible server for Exllama";
 
+      # Triton & huggingface downloader need writable cache folders
+      environment = {
+        HOME = "/var/lib/tabbyapi";
+        XDG_CACHE_HOME = "/var/lib/tabbyapi/.cache";
+        TRITON_CACHE_DIR = "/tmp/triton";
+      };
+
       serviceConfig = {
         ExecStart = "${lib.getExe cfg.package} --config=${configFile}";
         Restart = "on-failure";

From e9734740531f2133ce1074a7ab1cabb648a9be4e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 13:08:04 +0000
Subject: [PATCH 184/210] home-assistant-custom-components.powercalc: 1.21.0 ->
 1.21.2

---
 .../home-assistant/custom-components/powercalc/package.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/powercalc/package.nix b/pkgs/servers/home-assistant/custom-components/powercalc/package.nix
index eadef67ec1b0..a294f47c40b8 100644
--- a/pkgs/servers/home-assistant/custom-components/powercalc/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/powercalc/package.nix
@@ -17,13 +17,13 @@
 buildHomeAssistantComponent rec {
   owner = "bramstroker";
   domain = "powercalc";
-  version = "1.21.0";
+  version = "1.21.2";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "homeassistant-powercalc";
     tag = "v${version}";
-    hash = "sha256-XVLemGYPuArcwek6zEZW/MS79sUWL2qbeUSTNarsZ8I=";
+    hash = "sha256-D8gFEhitQjryZLLcP2ZsXNqWLvPyayuoYGq5C0B2D5w=";
   };
 
   dependencies = [ numpy ];

From a0389e0e8c113d79e94954dbe9b682a9913c518b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 27 Jun 2026 14:57:10 +0200
Subject: [PATCH 185/210] ktailctl: 0.21.5 -> 0.22.0

Diff: https://github.com/f-koehler/KTailctl/compare/v0.21.5...v0.22.0
Changelog: https://github.com/f-koehler/KTailctl/releases/tag/v0.22.0
---
 pkgs/by-name/kt/ktailctl/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/kt/ktailctl/package.nix b/pkgs/by-name/kt/ktailctl/package.nix
index 883b2c93e090..739c374a00b4 100644
--- a/pkgs/by-name/kt/ktailctl/package.nix
+++ b/pkgs/by-name/kt/ktailctl/package.nix
@@ -11,21 +11,21 @@
 }:
 
 let
-  version = "0.21.5";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-DqPerb8NcNynMMmoG8Ld0ZEyhrNg2q17TaErAbXIHC0=";
+    hash = "sha256-20hR/N3m1BsbMGiaWVV/SH/OHgfk7ZC1+WWhYqQpIls=";
   };
 
   goDeps =
     (buildGoModule {
       pname = "ktailctl-go-wrapper";
       inherit src version;
-      modRoot = "src/wrapper";
-      vendorHash = "sha256-jA1yortzyaBOP9GenmARhBBNDdpkGo9DNz0CXlh3BIU=";
+      modRoot = "src/tailscale/wrapper";
+      vendorHash = "sha256-h2gf9igVOguNRroGK6qvinUlEkpeZ2YJTtKArvlMj88=";
     }).goModules;
 in
 stdenv.mkDerivation {
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
   inherit version src;
 
   postPatch = ''
-    cp -r --reflink=auto ${goDeps} src/wrapper/vendor
+    cp -r --reflink=auto ${goDeps} src/tailscale/wrapper/vendor
   '';
 
   # needed for go build to work

From a4ecf307158d9c3d1da7201689d873286cb28a74 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 27 Jun 2026 15:26:49 +0200
Subject: [PATCH 186/210] 
 postgresqlPackages.{age,pg_hint_plan,pg_safeupdate,pgaudit}: remove obsolete
 package versions for PG 13

PG 13 has been dropped from Nixpkgs for a while.
---
 pkgs/servers/sql/postgresql/ext/age.nix           | 1 -
 pkgs/servers/sql/postgresql/ext/pg_hint_plan.nix  | 4 ----
 pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix | 4 ----
 pkgs/servers/sql/postgresql/ext/pgaudit.nix       | 4 ----
 4 files changed, 13 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/age.nix b/pkgs/servers/sql/postgresql/ext/age.nix
index 15000ef02c33..eb91916748ca 100644
--- a/pkgs/servers/sql/postgresql/ext/age.nix
+++ b/pkgs/servers/sql/postgresql/ext/age.nix
@@ -16,7 +16,6 @@ let
     "16" = "sha256-iukdi2c3CukGvjuTojybFFAZBlAw8GEfzFPr2qJuwTA=";
     "15" = "sha256-webZWgWZGnSoXwTpk816tjbtHV1UIlXkogpBDAEL4gM=";
     "14" = "sha256-jZXhcYBubpjIJ8M5JHXKV5f6VK/2BkypH3P7nLxZz3E=";
-    "13" = "sha256-HR6nnWt/V2a0rD5eHHUsFIZ1y7lmvLz36URt9pPJnCw=";
   };
 in
 postgresqlBuildExtension (finalAttrs: {
diff --git a/pkgs/servers/sql/postgresql/ext/pg_hint_plan.nix b/pkgs/servers/sql/postgresql/ext/pg_hint_plan.nix
index 9e3cc3bd3fc1..6795b16692da 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_hint_plan.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_hint_plan.nix
@@ -27,10 +27,6 @@ let
       version = "1.4.4";
       hash = "sha256-8rJ4Ck0Axf9zKhOXaJ4EA/M783YZRLuWx+GMGccadVo=";
     };
-    "13" = {
-      version = "1.3.11";
-      hash = "sha256-XTxCw1Uj6rVLcXJuHoT3RkEhdKVLGjOdR7rhFI8YJas=";
-    };
   };
 
   source =
diff --git a/pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix b/pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix
index 7b9249ad64b1..7b0d32ea4c3c 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix
@@ -7,10 +7,6 @@
 
 let
   sources = {
-    "13" = {
-      version = "1.4";
-      hash = "sha256-1cyvVEC9MQGMr7Tg6EUbsVBrMc8ahdFS3+CmDkmAq4Y=";
-    };
     "14" = {
       version = "1.5";
       hash = "sha256-RRSpkWLFuif+6RCncnsb1NnjKnIIRY9KgebKkjCN5cs=";
diff --git a/pkgs/servers/sql/postgresql/ext/pgaudit.nix b/pkgs/servers/sql/postgresql/ext/pgaudit.nix
index 454fe1200ac5..6baf799df260 100644
--- a/pkgs/servers/sql/postgresql/ext/pgaudit.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgaudit.nix
@@ -26,10 +26,6 @@ let
       version = "1.6.3";
       hash = "sha256-KgLidJHjUK9BTp6ffmGUj1chcwIe6IzlcadRpGCfNdM=";
     };
-    "13" = {
-      version = "1.5.3";
-      hash = "sha256-IU4Clec3DkKWT7+kw0VtQNybt94i7M2rSSgJG/XdcRs=";
-    };
   };
 
   source =

From 9b49cc5ca0596879020dd7ac664c9aaf08df480d Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 27 Jun 2026 15:31:16 +0200
Subject: [PATCH 187/210] postgresql18Packages.pgaudit: init at 18.0

Release Notes:
https://github.com/pgaudit/pgaudit/releases/tag/18.0
---
 pkgs/servers/sql/postgresql/ext/pgaudit.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/sql/postgresql/ext/pgaudit.nix b/pkgs/servers/sql/postgresql/ext/pgaudit.nix
index 6baf799df260..af7763fd4ead 100644
--- a/pkgs/servers/sql/postgresql/ext/pgaudit.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgaudit.nix
@@ -9,7 +9,10 @@
 
 let
   sources = {
-    # v18: No upstream ticket, yet (2025-07-07)
+    "18" = {
+      version = "18.0";
+      hash = "sha256-+1YKJxMFkok7MsYeA9GRkc2FLxuBGRLpC+JzdK/xqoM=";
+    };
     "17" = {
       version = "17.1";
       hash = "sha256-9St/ESPiFq2NiPKqbwHLwkIyATKUkOGxFcUrWgT+Iqo=";

From b2b419d092c73ac676b66532ade58ccb2196d8b9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 13:31:35 +0000
Subject: [PATCH 188/210] dwproton-bin: dwproton-11.0-3 -> dwproton-11.0-5

---
 pkgs/by-name/dw/dwproton-bin/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/dw/dwproton-bin/package.nix b/pkgs/by-name/dw/dwproton-bin/package.nix
index cf51cb32d1e4..0d10c39ca128 100644
--- a/pkgs/by-name/dw/dwproton-bin/package.nix
+++ b/pkgs/by-name/dw/dwproton-bin/package.nix
@@ -11,11 +11,11 @@ proton-ge-bin.overrideAttrs (
     inherit steamDisplayName;
 
     pname = "dwproton-bin";
-    version = "dwproton-11.0-3";
+    version = "dwproton-11.0-5";
 
     src = fetchzip {
       url = "https://dawn.wine/dawn-winery/dwproton/releases/download/${finalAttrs.version}/${finalAttrs.version}-x86_64.tar.xz";
-      hash = "sha256-e/YzKvwe30KveLHRUsntKDwzdEbr7a3Wfkqe/pu93WE=";
+      hash = "sha256-2x4xotJ2aJYbg+G2TDPqyU7uuoc/hZQon9CA6SFGin0=";
     };
 
     preFixup = ''

From 7ed292fb378e0098c2eb34755034b243c15e7e6f Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 27 Jun 2026 15:36:57 +0200
Subject: [PATCH 189/210] postgresqlPackages.pg_safeupdate: 1.5 -> 1.6

Release Notes:
https://github.com/eradman/pg-safeupdate/blob/1.6/NEWS

Building with PostgreSQL 19 beta 1 still fails, reported upstream at:
https://github.com/eradman/pg-safeupdate/issues/12
---
 .../sql/postgresql/ext/pg_safeupdate.nix      | 44 +++----------------
 1 file changed, 6 insertions(+), 38 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix b/pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix
index 7b0d32ea4c3c..81de98b98bbc 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix
@@ -5,55 +5,23 @@
   postgresqlBuildExtension,
 }:
 
-let
-  sources = {
-    "14" = {
-      version = "1.5";
-      hash = "sha256-RRSpkWLFuif+6RCncnsb1NnjKnIIRY9KgebKkjCN5cs=";
-    };
-    "15" = {
-      version = "1.5";
-      hash = "sha256-RRSpkWLFuif+6RCncnsb1NnjKnIIRY9KgebKkjCN5cs=";
-    };
-    "16" = {
-      version = "1.5";
-      hash = "sha256-RRSpkWLFuif+6RCncnsb1NnjKnIIRY9KgebKkjCN5cs=";
-    };
-    "17" = {
-      version = "1.5";
-      hash = "sha256-RRSpkWLFuif+6RCncnsb1NnjKnIIRY9KgebKkjCN5cs=";
-    };
-    "18" = {
-      version = "1.5";
-      hash = "sha256-RRSpkWLFuif+6RCncnsb1NnjKnIIRY9KgebKkjCN5cs=";
-    };
-  };
-
-  source =
-    sources."${lib.versions.major postgresql.version}" or {
-      version = "";
-      hash = throw "pg_safeupdate: version specification for pg ${postgresql.version} missing.";
-    };
-in
-
-postgresqlBuildExtension {
+postgresqlBuildExtension (finalAttrs: {
   pname = "pg-safeupdate";
-  inherit (source) version;
+  version = "1.6";
 
   src = fetchFromGitHub {
     owner = "eradman";
     repo = "pg-safeupdate";
-    tag = source.version;
-    inherit (source) hash;
+    tag = finalAttrs.version;
+    hash = "sha256-xky2tlb0EoKzyIYftVr7/2BYLdinhxHjXiVO3lR57MM=";
   };
 
   meta = {
-    broken = !builtins.elem (lib.versions.major postgresql.version) (builtins.attrNames sources);
     description = "Simple extension to PostgreSQL that requires criteria for UPDATE and DELETE";
     homepage = "https://github.com/eradman/pg-safeupdate";
-    changelog = "https://github.com/eradman/pg-safeupdate/raw/${source.version}/NEWS";
+    changelog = "https://github.com/eradman/pg-safeupdate/raw/${finalAttrs.version}/NEWS";
     platforms = postgresql.meta.platforms;
     maintainers = with lib.maintainers; [ wolfgangwalther ];
     license = lib.licenses.postgresql;
   };
-}
+})

From 2f3e4c1013a58cdf3fc2afc3e5bd720e75e27d77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 27 Jun 2026 15:56:11 +0200
Subject: [PATCH 190/210] 
 home-assistant-custom-lovelace-modules.custom-brand-icons: 2026.06.3 ->
 2026.06.4

Diff: https://github.com/elax46/custom-brand-icons/compare/2026.06.3...2026.06.4

Changelog: https://github.com/elax46/custom-brand-icons/releases/tag/2026.06.4
---
 .../custom-lovelace-modules/custom-brand-icons/package.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
index fdddebbed451..0b09a638cb71 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-brand-icons/package.nix
@@ -6,13 +6,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "custom-brand-icons";
-  version = "2026.06.3";
+  version = "2026.06.4";
 
   src = fetchFromGitHub {
     owner = "elax46";
     repo = "custom-brand-icons";
     tag = finalAttrs.version;
-    hash = "sha256-fZwffVMrO+b/r6yb2XsDhjeokyXSShiIYkc6zFZ8lwg=";
+    hash = "sha256-9wipxsj4KcwgPDo6nanMrSpuDAMAAM72EQISkTOczbs=";
   };
 
   npmDepsHash = "sha256-ZTl9+vXEBR3pvksaLWof8y1WnoL2tAL3KuPzZn7VjjE=";

From 23507e17e7f2edd691dfcc70e1d4b0b410c4e1ee Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 20:21:29 -0500
Subject: [PATCH 191/210] ci/owners: add NixOS/neovim for neovim doc

Make the @NixOS/neovim team the codeowner for the Neovim languages/frameworks documentation section.
---
 ci/OWNERS | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ci/OWNERS b/ci/OWNERS
index 99972715f8e4..a37d9b33ae67 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -361,7 +361,8 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/development/lua-modules         @NixOS/lua
 
 # Neovim
-/pkgs/applications/editors/neovim      @NixOS/neovim
+/pkgs/applications/editors/neovim           @NixOS/neovim
+/doc/languages-frameworks/neovim.section.md @NixOS/neovim
 
 # VimPlugins
 /pkgs/applications/editors/vim/plugins         @NixOS/neovim

From 66e23f410b07195caa4bb05b5cab80826b763ce6 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 20:28:00 -0500
Subject: [PATCH 192/210] doc/neovim: document wrapNeovimUnstable options

Document extraPython3Packages, withPerl, vimAlias, viAlias, and extraName options for wrapNeovimUnstable.
---
 doc/languages-frameworks/neovim.section.md | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/doc/languages-frameworks/neovim.section.md b/doc/languages-frameworks/neovim.section.md
index e0c22d8ccba5..248281961120 100644
--- a/doc/languages-frameworks/neovim.section.md
+++ b/doc/languages-frameworks/neovim.section.md
@@ -64,11 +64,14 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
 - `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
   generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
 - `plugins`: A list of plugins to add to the wrapper.
-- `extraLuaPackages`: A function passed on to `lua.withPackages`
-- `withPython3`, `withNodeJs`, `withRuby` control when to enable neovim
+- `extraLuaPackages`: A function passed on to `lua.withPackages`.
+- `extraPython3Packages`: A function passed on to `python3.withPackages`.
+- `withPython3`, `withNodeJs`, `withRuby`, `withPerl` control when to enable neovim
   providers (see `:h provider`).
+- `vimAlias` and `viAlias` control whether to symlink the `vim` and `vi` binaries to `nvim` respectively.
+- `extraName` is a string appended to the package name and derivation name.
 
-```
+```nix
 wrapNeovimUnstable neovim-unwrapped {
   autoconfigure = true;
   autowrapRuntimeDeps = true;
@@ -98,7 +101,7 @@ wrapNeovimUnstable neovim-unwrapped {
 }
 ```
 
-You can explore the configuration with`nix repl` to discover these options and
+You can explore the configuration with `nix repl` to discover these options and
 override them. For instance:
 ```nix
 neovim.overrideAttrs (oldAttrs: {

From 46689fa74ac215e6b307a18016566c3165ecc339 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 20:28:03 -0500
Subject: [PATCH 193/210] doc/neovim: correct configuration overrides example

Correct configuration overrides example to use neovim.override instead of overrideAttrs.
---
 doc/languages-frameworks/neovim.section.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/languages-frameworks/neovim.section.md b/doc/languages-frameworks/neovim.section.md
index 248281961120..cc16860b1a02 100644
--- a/doc/languages-frameworks/neovim.section.md
+++ b/doc/languages-frameworks/neovim.section.md
@@ -104,9 +104,9 @@ wrapNeovimUnstable neovim-unwrapped {
 You can explore the configuration with `nix repl` to discover these options and
 override them. For instance:
 ```nix
-neovim.overrideAttrs (oldAttrs: {
+neovim.override {
   autowrapRuntimeDeps = false;
-})
+}
 ```
 
 ## Specificities for some plugins {#neovim-plugin-specificities}

From 9742b211f4a53a79cbcb03033d884d82dcd0f034 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 20:24:28 -0500
Subject: [PATCH 194/210] doc/neovim: fix VimScript comments in examples

VimScript comments start with a double quote (") instead of a hash sign (#).
---
 doc/languages-frameworks/neovim.section.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/languages-frameworks/neovim.section.md b/doc/languages-frameworks/neovim.section.md
index cc16860b1a02..57aaae9212f9 100644
--- a/doc/languages-frameworks/neovim.section.md
+++ b/doc/languages-frameworks/neovim.section.md
@@ -25,7 +25,7 @@ neovim.override {
   withRuby = false;
   configure = {
     customRC = ''
-      # here your custom viml configuration goes!
+      " here your custom viml configuration goes!
     '';
     packages.myVimPackage = with pkgs.vimPlugins; {
       # See examples below on how to use custom packages.
@@ -47,7 +47,7 @@ neovim-qt.override {
   neovim = neovim.override {
     configure = {
       customRC = ''
-        # your custom viml configuration
+        " your custom viml configuration
       '';
     };
   };

From f7b9e91062a7e3bdab65f4dbb0e7e6c81636b388 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 20:24:33 -0500
Subject: [PATCH 195/210] doc/neovim: document plugin lua config type option

Explain the type attribute in the plugins list configuration option, showing how to specify a Lua configuration block instead of VimScript.
---
 doc/languages-frameworks/neovim.section.md | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/doc/languages-frameworks/neovim.section.md b/doc/languages-frameworks/neovim.section.md
index 57aaae9212f9..ba258267352a 100644
--- a/doc/languages-frameworks/neovim.section.md
+++ b/doc/languages-frameworks/neovim.section.md
@@ -83,7 +83,8 @@ wrapNeovimUnstable neovim-unwrapped {
     vim.opt.colorcolumn = { 100 }
     vim.opt.termguicolors = true
   '';
-  # plugins accepts a list of either plugins or { plugin = ...; config = ..vimscript.. };
+  # plugins accepts a list of either plugins or attribute sets containing:
+  # { plugin = ...; config = ...; type = "viml"|"lua"; } (type defaults to "viml")
   plugins = with vimPlugins; [
     {
       plugin = vim-obsession;
@@ -91,6 +92,15 @@ wrapNeovimUnstable neovim-unwrapped {
         map <Leader>$ <Cmd>Obsession<CR>
       '';
     }
+    {
+      plugin = grug-far-nvim;
+      type = "lua";
+      config = ''
+        require('grug-far').setup({
+          startInInsertMode = false,
+        })
+      '';
+    }
     (nvim-treesitter.withPlugins (p: [ p.nix p.python ]))
     hex-nvim
   ];

From 6474a24fddf9544a3210720dd8bb20a8571d1a29 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 20:35:30 -0500
Subject: [PATCH 196/210] neovim/tests: use override instead of overrideAttrs
 for wrapper options

Correct nvim_with_autoconfigure and nvim_with_runtimeDeps tests.

1. Switched from overrideAttrs to override. Overriding wrapper arguments like autoconfigure via overrideAttrs was a silent no-op because the wrapper function evaluated the lexical autoconfigure parameter instead of the derivation attribute finalAttrs.autoconfigure.
2. Switched from plugins list to configure.packages format. The legacy neovim wrapper ignores the direct plugins argument and requires plugins to be configured under configure.packages.
---
 .../editors/neovim/tests/default.nix          | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/pkgs/applications/editors/neovim/tests/default.nix b/pkgs/applications/editors/neovim/tests/default.nix
index 5bc2730da87b..c17957ffbe3a 100644
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@@ -204,23 +204,23 @@ pkgs.lib.recurseIntoAttrs rec {
     ${nvim_with_plug}/bin/nvim -V3log.txt -i NONE -c 'color base16-tomorrow-night'  +quit! -e
   '';
 
-  nvim_with_autoconfigure = pkgs.neovim.overrideAttrs {
-    plugins = [
-      vimPlugins.unicode-vim
-      vimPlugins.fzf-hoogle-vim
-    ];
+  nvim_with_autoconfigure = pkgs.neovim.override {
+    configure = {
+      packages.myPlugins.start = [
+        vimPlugins.unicode-vim
+        vimPlugins.fzf-hoogle-vim
+      ];
+    };
     autoconfigure = true;
-    # legacy wrapper sets it to false
-    wrapRc = true;
   };
 
-  nvim_with_runtimeDeps = pkgs.neovim.overrideAttrs {
-    plugins = [
-      pkgs.vimPlugins.hex-nvim
-    ];
+  nvim_with_runtimeDeps = pkgs.neovim.override {
+    configure = {
+      packages.myPlugins.start = [
+        pkgs.vimPlugins.hex-nvim
+      ];
+    };
     autowrapRuntimeDeps = true;
-    # legacy wrapper sets it to false
-    wrapRc = true;
   };
 
   nvim_with_ftplugin =

From a47702c9dfe87c27e5db1342fcea846a635dcd20 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Fri, 26 Jun 2026 20:39:59 -0500
Subject: [PATCH 197/210] doc/neovim: fix formatting

Ran nixfmt and saw untouched section that needed formatting.
---
 doc/languages-frameworks/neovim.section.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/doc/languages-frameworks/neovim.section.md b/doc/languages-frameworks/neovim.section.md
index ba258267352a..78e9bf714013 100644
--- a/doc/languages-frameworks/neovim.section.md
+++ b/doc/languages-frameworks/neovim.section.md
@@ -101,7 +101,10 @@ wrapNeovimUnstable neovim-unwrapped {
         })
       '';
     }
-    (nvim-treesitter.withPlugins (p: [ p.nix p.python ]))
+    (nvim-treesitter.withPlugins (p: [
+      p.nix
+      p.python
+    ]))
     hex-nvim
   ];
   extraLuaPackages = lp: [ lp.mpack ];

From 9d04b9cc960309bf64ef05744ff26b4823b26a85 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 27 Jun 2026 16:12:51 +0200
Subject: [PATCH 198/210] home-assistant-custom-components.blueprints-updater:
 2.8.1 -> 2.9.0

Changelog: https://github.com/luuquangvu/blueprints-updater/releases/tag/2.9.0
Diff: https://github.com/luuquangvu/blueprints-updater/compare/2.8.1...2.9.0
---
 .../allow-symlinked-blueprints.diff           | 40 +++++++++----------
 .../blueprints-updater/package.nix            |  4 +-
 2 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/allow-symlinked-blueprints.diff b/pkgs/servers/home-assistant/custom-components/blueprints-updater/allow-symlinked-blueprints.diff
index 39fc706c1957..d7ac94e54b72 100644
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/allow-symlinked-blueprints.diff
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/allow-symlinked-blueprints.diff
@@ -1,24 +1,24 @@
 diff --git a/custom_components/blueprints_updater/coordinator.py b/custom_components/blueprints_updater/coordinator.py
-index 441b870..54551d1 100644
+index dfc001c..5017b84 100644
 --- a/custom_components/blueprints_updater/coordinator.py
 +++ b/custom_components/blueprints_updater/coordinator.py
-@@ -3731,19 +3731,6 @@ def scan_blueprints(
+@@ -3752,19 +3752,6 @@ def _scan_single_blueprint_file(
+     ) -> BlueprintMetadata | None:
+         """Scan and process a single blueprint file."""
+         real_full_path = os.path.realpath(full_path)
+-        try:
+-            if (
+-                os.path.commonpath([real_full_path, context.real_blueprint_path])
+-                != context.real_blueprint_path
+-            ):
+-                _LOGGER.warning(
+-                    "Security alert: Ignoring blueprint symlink outside root: %s",
+-                    full_path,
+-                )
+-                return None
+-        except (ValueError, OSError):
+-            _LOGGER.warning("Skipping blueprint with invalid path: %s", full_path)
+-            return None
  
-                     full_path = os.path.join(root, file)
-                     real_full_path = os.path.realpath(full_path)
--                    try:
--                        if (
--                            os.path.commonpath([real_full_path, real_blueprint_path])
--                            != real_blueprint_path
--                        ):
--                            _LOGGER.warning(
--                                "Security alert: Ignoring blueprint symlink outside root: %s",
--                                full_path,
--                            )
--                            continue
--                    except (ValueError, OSError):
--                        _LOGGER.warning("Skipping blueprint with invalid path: %s", full_path)
--                        continue
- 
-                     if relative_path := get_blueprint_relative_path(hass, full_path):
-                         try:
+         relative_path = get_blueprint_relative_path(context.hass, full_path)
+         if not relative_path:
diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
index e2a9f33cc2ec..31d0bf0b2d4b 100644
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
@@ -13,13 +13,13 @@
 buildHomeAssistantComponent rec {
   owner = "luuquangvu";
   domain = "blueprints_updater";
-  version = "2.8.1";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "blueprints-updater";
     tag = version;
-    hash = "sha256-aqufiwH9yJmyr5Bd3Etwf5aK9dAfa7srXpBcmXDFAoY=";
+    hash = "sha256-zIkK7ZhUC8fPycWJqXP706XbOdhVlNAOwZBTYTII3dE=";
   };
 
   patches = [

From 4455b767142c8a1bb27d54ff9d7c529290969fbd Mon Sep 17 00:00:00 2001
From: Morgan Helton <mhelton@gmail.com>
Date: Sat, 27 Jun 2026 08:47:33 -0500
Subject: [PATCH 199/210] aws-sso-cli: 2.2.4 -> 2.3.1

---
 pkgs/by-name/aw/aws-sso-cli/package.nix | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/aw/aws-sso-cli/package.nix b/pkgs/by-name/aw/aws-sso-cli/package.nix
index d553183cd34d..b643b6cbe685 100644
--- a/pkgs/by-name/aw/aws-sso-cli/package.nix
+++ b/pkgs/by-name/aw/aws-sso-cli/package.nix
@@ -6,19 +6,20 @@
   lib,
   makeWrapper,
   stdenv,
+  writableTmpDirAsHomeHook,
   xdg-utils,
 }:
 buildGoModule (finalAttrs: {
   pname = "aws-sso-cli";
-  version = "2.2.4";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "synfinatic";
     repo = "aws-sso-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JkCHzIbIeFvmXrIkQaybjUtPDzmZ2XPv6tz3fA6ni44=";
+    hash = "sha256-JFaCTgvH6qzQ8gMt5QgqAPBal2m8FZEemTgbqyECFck=";
   };
-  vendorHash = "sha256-euqhgbyz8H/fQ1RAP0k4GMOjOu7gVeYzQv75tjCh5z0=";
+  vendorHash = "sha256-f9qSnEOUw8QWbc0rgStyzuL6lWtfy3UFhjqDAnJkKJA=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -41,7 +42,14 @@ buildGoModule (finalAttrs: {
       --zsh <($out/bin/aws-sso setup completions --source --shell=zsh)
   '';
 
-  nativeCheckInputs = [ getent ];
+  nativeCheckInputs = [
+    getent
+    writableTmpDirAsHomeHook
+  ];
+
+  preCheck = ''
+    mkdir -p "$HOME/.config/aws-sso"
+  '';
 
   checkFlags =
     let
@@ -51,6 +59,7 @@ buildGoModule (finalAttrs: {
         "TestAWSConsoleUrlEU"
         "TestAWSConsoleUrlUSEast"
         "TestAWSConsoleUrlUSGov"
+        "TestGetScriptsAutoDetect"
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [ "TestDetectShellBash" ];
     in

From 29bf246dd82ba1b7107b3c2ca893efb8e147ccf0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 15:53:02 +0000
Subject: [PATCH 200/210] vicinae: 0.21.7 -> 0.22.0

---
 pkgs/by-name/vi/vicinae/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vi/vicinae/package.nix b/pkgs/by-name/vi/vicinae/package.nix
index d90d2b4f3b8f..fd0dc8d39cfe 100644
--- a/pkgs/by-name/vi/vicinae/package.nix
+++ b/pkgs/by-name/vi/vicinae/package.nix
@@ -21,13 +21,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vicinae";
-  version = "0.21.7";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "vicinaehq";
     repo = "vicinae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r4BuhKyW4sxin0YG3/EJjed/MiP5NwN7QGiM1ySozjE=";
+    hash = "sha256-f1d88cdqe1PfeuzY90JIRCoHKLV1Uuakc4TpSNvNBKA=";
   };
 
   apiDeps = fetchNpmDeps {

From 860fcaec942fac18b299dabcda5dfa443ba83578 Mon Sep 17 00:00:00 2001
From: 6543 <6543@obermui.de>
Date: Sat, 27 Jun 2026 17:53:15 +0200
Subject: [PATCH 201/210] woodpecker-{agent,cli,server}: 3.15.0 -> 3.16.0

---
 .../tools/continuous-integration/woodpecker/common.nix    | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/tools/continuous-integration/woodpecker/common.nix b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
index a67dde265183..7cf28d3e1022 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/common.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@@ -1,8 +1,8 @@
 { lib, fetchFromGitHub }:
 let
-  version = "3.15.0";
-  vendorHash = "sha256-7Hiyf/W1os1+Rd5VY4j96U3n6chub13fhbh0V3hPcCg=";
-  nodeModulesHash = "sha256-TX/2gtaq1MyXhfPtZpYIGKIvVbn6DwbFDL58GBWqtmg=";
+  version = "3.16.0";
+  vendorHash = "sha256-z87enzlH2jVq/BI6uVbpLG6jKsO5Wr2alJOcFjt/+MM=";
+  nodeModulesHash = "sha256-6sWSybiSJj7G1KO2iv81yylmOV6DBVN1D15PFYpilC0=";
 in
 {
   inherit version vendorHash nodeModulesHash;
@@ -11,7 +11,7 @@ in
     owner = "woodpecker-ci";
     repo = "woodpecker";
     tag = "v${version}";
-    hash = "sha256-enWZkYlZq2sWez4Uz78ZdNc+bqiN/UHnI5oOCicyjDI=";
+    hash = "sha256-9Bc7225CZFELgra5gnmo7KeNeY4X7+YpyvVGG/Y+sAs=";
   };
 
   postInstall = ''

From 3055643d37371660018202f8950bdd80addf20fb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 17:37:39 +0000
Subject: [PATCH 202/210] terraform-providers.terraform-lxd_lxd: 2.7.1 -> 3.0.1

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index dcc45bb855cc..a507768133ea 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1346,13 +1346,13 @@
     "vendorHash": "sha256-SF11E60OQiRdf+Pf6XyJg60yGRnGOcSzhrYccrWaeYE="
   },
   "terraform-lxd_lxd": {
-    "hash": "sha256-ovYvRpGY8tUiX5zYpTkb8uuQcKsW7o/bDgUPbkXnVnI=",
+    "hash": "sha256-vrrQxld9Ymu2RcSRlkUzknTIBJteVeb9Jqr19CV3XzM=",
     "homepage": "https://registry.terraform.io/providers/terraform-lxd/lxd",
     "owner": "terraform-lxd",
     "repo": "terraform-provider-lxd",
-    "rev": "v2.7.1",
+    "rev": "v3.0.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-vOip6KfD0hOQtNEc7U6DfMjitFGOleNlF88qKtbssng="
+    "vendorHash": "sha256-jOZw/va3dA0DYmnYSKbASHvyL7levjf1Bk6WelLga+Q="
   },
   "terraform-provider-openstack_openstack": {
     "hash": "sha256-6TcyPUacJNfGsaevg1DQ+WJrMFvGeo2mmsE2+P3RAZM=",

From 0c82b9032c2e2ff672b3ce1af46e72b998746b4f Mon Sep 17 00:00:00 2001
From: Matthias Beyer <mail@beyermatthias.de>
Date: Sat, 27 Jun 2026 19:31:00 +0200
Subject: [PATCH 203/210] tola: init at 0.7.1

Signed-off-by: Matthias Beyer <mail@beyermatthias.de>
---
 pkgs/by-name/to/tola/package.nix | 44 ++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 pkgs/by-name/to/tola/package.nix

diff --git a/pkgs/by-name/to/tola/package.nix b/pkgs/by-name/to/tola/package.nix
new file mode 100644
index 000000000000..a75c868b8097
--- /dev/null
+++ b/pkgs/by-name/to/tola/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  openssl,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+  pname = "tola";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "KawaYww";
+    repo = "tola";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zgPKsIRXp5na2d0X7j5+9xJBGFSlvIKIRmzVVo/dcLk=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  cargoHash = "sha256-3Y7+UJD2QyNs+GjijvOAyTQ9ZP7lRf/MpaWThN2/e5s=";
+
+  # There are not any tests in source project.
+  doCheck = false;
+
+  meta = {
+    description = "A static site generator for typst-based blog, written in Rust";
+    homepage = "https://github.com/KawaYww/tola";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      matthiasbeyer
+    ];
+  };
+})

From 6097ea82e938a4348cd381f730c352fab472be11 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 18:43:25 +0000
Subject: [PATCH 204/210] terraform-providers.metio_migadu: 2026.6.18 ->
 2026.6.25

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index dcc45bb855cc..9a9054110244 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -905,11 +905,11 @@
     "vendorHash": "sha256-t4dbDJNjEQ6/u+/6zqk2Sdd3LVn/L2BCJujpiLdGc58="
   },
   "metio_migadu": {
-    "hash": "sha256-F/eTAR0Du0NeRwH9m8hHzjIkx31xv8aRGNWuVrntxjQ=",
+    "hash": "sha256-KDk/uSxycO9hiaiEKHq58ktwum88J9StpB52mNQYer4=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2026.6.18",
+    "rev": "2026.6.25",
     "spdx": "0BSD",
     "vendorHash": "sha256-7/2iHstATnmeuvoIFIQw2Gi3QSIoXp5W69fnUYHipxc="
   },

From 530375c0ef1091284c41c75c26c5f302ca105db6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 14:16:08 +0000
Subject: [PATCH 205/210] freescout: 1.8.225 -> 1.8.226

https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226

Fixes:
GHSA-gh3r-jh6q-wrvj, GHSA-gh3r-jh6q-wrvj, GHSA-w668-wq26-6c94,
GHSA-wqq7-4q7m-273v
---
 pkgs/by-name/fr/freescout/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/freescout/package.nix b/pkgs/by-name/fr/freescout/package.nix
index 4b4b31d90954..440fad6b2a9a 100644
--- a/pkgs/by-name/fr/freescout/package.nix
+++ b/pkgs/by-name/fr/freescout/package.nix
@@ -7,13 +7,13 @@
 stdenv.mkDerivation (finalAttrs: {
   preferLocalBuild = true;
   pname = "freescout";
-  version = "1.8.225";
+  version = "1.8.226";
 
   src = fetchFromGitHub {
     owner = "freescout-help-desk";
     repo = "freescout";
     tag = finalAttrs.version;
-    hash = "sha256-kXZ6bjF36YO1p6q+KTugnBO+KxqQZci5O0RNM7lqecQ=";
+    hash = "sha256-9fojG6S6yb2+W94cHrLuYIRjRL8JWspsj4bNE4QKSuk=";
   };
 
   patches = [

From 33bd477c5dde1e6cb0741cbd1c86be54a199f4fa Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 27 Jun 2026 20:49:19 +0200
Subject: [PATCH 206/210] freescout: fix passthru tests

This must be a flat attribute set, not a nested one.
---
 pkgs/by-name/fr/freescout/package.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/by-name/fr/freescout/package.nix b/pkgs/by-name/fr/freescout/package.nix
index 440fad6b2a9a..3e025467f52c 100644
--- a/pkgs/by-name/fr/freescout/package.nix
+++ b/pkgs/by-name/fr/freescout/package.nix
@@ -46,9 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.tests = {
-    inherit (nixosTests) freescout;
-  };
+  passthru.tests = lib.attrValues nixosTests.freescout;
 
   # Because freescout is searching for some folders only relative to it's own source location, we need to have the symlinks to the actual locations in here
   dontCheckForBrokenSymlinks = true;

From 652ecb4d6f29c21d100d1289077b2b858f041748 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 27 Jun 2026 20:50:18 +0200
Subject: [PATCH 207/210] freescout: configure meta.changelog

---
 pkgs/by-name/fr/freescout/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/fr/freescout/package.nix b/pkgs/by-name/fr/freescout/package.nix
index 3e025467f52c..20a2a42f6bad 100644
--- a/pkgs/by-name/fr/freescout/package.nix
+++ b/pkgs/by-name/fr/freescout/package.nix
@@ -54,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   meta = with lib; {
+    changelog = "https://github.com/freescout-help-desk/freescout/releases/tag/${finalAttrs.src.tag}";
     description = "Free self-hosted help desk & shared mailbox";
     license = licenses.agpl3Only;
     homepage = "https://freescout.net/";

From 9a14c9489a834e377682e76e8d6cd57acdc34c83 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 20:51:50 +0000
Subject: [PATCH 208/210] terraform-providers.jianyuan_sentry: 0.15.2 -> 0.15.3

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1a49fccc3bbc..0be12e3d3314 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -787,13 +787,13 @@
     "vendorHash": "sha256-mnKXYT0GfIS+ODzBCS9l4rLF1ugadesmpgdOgj74nLg="
   },
   "jianyuan_sentry": {
-    "hash": "sha256-p1vaKwWrkNaaicQWFfnjgQ8O2P/194PvslzWdVwn6IE=",
+    "hash": "sha256-mJVuJJzNw/nkg1OoPG2iIE30RVsnj3YTQ3VAYITB6tE=",
     "homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
     "owner": "jianyuan",
     "repo": "terraform-provider-sentry",
-    "rev": "v0.15.2",
+    "rev": "v0.15.3",
     "spdx": "MIT",
-    "vendorHash": "sha256-7O7/m4N7MDb+AU7w6dqQqzsqDO3jWGwOHnRX2OkJirM="
+    "vendorHash": "sha256-+LDSNV2Y5jDFyOu/PFtJhP7VgWAVvozC/yBXzTU7YXQ="
   },
   "joneshf_openwrt": {
     "hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",

From 4b11716eb799be890928a73343ac0c0ef3faf2fe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 23:33:59 +0000
Subject: [PATCH 209/210] python3Packages.niquests: 3.19.1 -> 3.20.0

---
 pkgs/development/python-modules/niquests/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/niquests/default.nix b/pkgs/development/python-modules/niquests/default.nix
index be93ae9a06c9..1cad643d6c6d 100644
--- a/pkgs/development/python-modules/niquests/default.nix
+++ b/pkgs/development/python-modules/niquests/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "niquests";
-  version = "3.19.1";
+  version = "3.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jawah";
     repo = "niquests";
     tag = "v${version}";
-    hash = "sha256-YADGkjNAG7k6peC0vaH/8OSLbaQSsxsKik3RWIqgc+w=";
+    hash = "sha256-9zBo59l/zDIMKnYX1jOMOCec+oRnCkqJjjJmjbAzoPM=";
   };
 
   build-system = [ hatchling ];

From f77ba8a01a98dba28853a87530ef88d368b94341 Mon Sep 17 00:00:00 2001
From: Colorman <foss@colorman.me>
Date: Sun, 14 Jun 2026 14:01:40 +0200
Subject: [PATCH 210/210] yafc-ce: add update script passthru attribute

The default update script used by r-ryantm does not fetch the updated .NET
dependencies, which means most updates won't get an r-ryantm PR. The
`nix-update-script` *does* fetch these deps, solving the issue.
---
 pkgs/by-name/ya/yafc-ce/package.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ya/yafc-ce/package.nix b/pkgs/by-name/ya/yafc-ce/package.nix
index 27363b0a98cb..693a70b2c767 100644
--- a/pkgs/by-name/ya/yafc-ce/package.nix
+++ b/pkgs/by-name/ya/yafc-ce/package.nix
@@ -1,11 +1,18 @@
 {
-  buildDotnetModule,
   lib,
+
+  # Build
+  buildDotnetModule,
   fetchFromGitHub,
   dotnetCorePackages,
+
+  # Runtime
   SDL2,
   SDL2_image,
   SDL2_ttf,
+
+  # Updates
+  nix-update-script,
 }:
 let
   dotnet = dotnetCorePackages.dotnet_8;
@@ -39,6 +46,8 @@ buildDotnetModule (finalAttrs: {
     SDL2_image
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Powerful Factorio calculator/analyser that works with mods, Community Edition";
     longDescription = ''